harness-everything 0.12.1 → 0.12.3

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.12.1",
+      "version": "0.12.3",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.12.1",
+  "version": "0.12.3",
   "author": {
     "name": "Miya Daniel"
   },

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.12.3](https://github.com/dyphn1/Harness-everything/compare/v0.12.2...v0.12.3) (2026-09-19)
+
+### Bug Fixes
+
+* **workflow:** degrade oversized fingerprints conservatively ([ea90f30](https://github.com/dyphn1/Harness-everything/commit/ea90f30a4495e6144017373463c5279fae563252))
+* **workflow:** degrade oversized fingerprints conservatively ([a618d22](https://github.com/dyphn1/Harness-everything/commit/a618d2216955ab3594ecb31b45635dea94e9b109))
+* **workflow:** settle oversized fingerprint probes conservatively ([aafce50](https://github.com/dyphn1/Harness-everything/commit/aafce508551d6564afc884da17555ed71f989836))
+* **workflow:** settle oversized fingerprint probes conservatively ([3092dd6](https://github.com/dyphn1/Harness-everything/commit/3092dd60ed19de97c096f57278c26813f77c3ff7))
+
+### Performance Improvements
+
+* **workflow:** batch workspace content hashing ([ad0fc18](https://github.com/dyphn1/Harness-everything/commit/ad0fc18260c5a716d7711cb4b83cf9f5059dd21d))
+* **workflow:** batch workspace content hashing ([2cdd6e3](https://github.com/dyphn1/Harness-everything/commit/2cdd6e3dc568c9d6007ca10de76b06b47ff39880))
+
+## [0.12.2](https://github.com/dyphn1/Harness-everything/compare/v0.12.1...v0.12.2) (2026-09-19)
+
+### Bug Fixes
+
+* **workflow:** admit observation-only verification at limit ([08b859e](https://github.com/dyphn1/Harness-everything/commit/08b859ef27c04a07d9a0a6faeeed52f3da986378))
+* **workflow:** admit observation-only verification at limit ([8924a3c](https://github.com/dyphn1/Harness-everything/commit/8924a3cc80455592accbe81e3f2df0f4479a2d8b))
+* **workflow:** allow verification probe at iteration limit ([7ce511e](https://github.com/dyphn1/Harness-everything/commit/7ce511e29ca368371d996f4cbeff02298d97434c))
+* **workflow:** allow verification probe at iteration limit ([07e6ed0](https://github.com/dyphn1/Harness-everything/commit/07e6ed0b369e38f274ac099af590b12373b1ad1c))
+
 ## [0.12.1](https://github.com/dyphn1/Harness-everything/compare/v0.12.0...v0.12.1) (2026-09-19)
 
 ### Bug Fixes

package/ci/mechanism-2ah-workflow-lifecycle.test.js

@@ -203,6 +203,58 @@ try {
   git(['init']); fs.writeFileSync(path.join(repo, 'README.md'), 'fixture\n'); git(['add', '.']);
   git(['-c', 'user.name=Harness Test', '-c', 'user.email=harness@example.invalid', 'commit', '-m', 'fixture']);
   git(['worktree', 'add', linked, '-b', 'isolated']);
+
+  // #164: the mutation budget is an edit budget, not a reason to make the
+  // final edit unverifiable. At the exact limit a verification-shaped shell
+  // gets observation-only admission. No-effect verification may complete the
+  // workflow; a verification command that mutates still exhausts after Post.
+  const finalVerify = fixtureSession('workflow-final-iteration-verify');
+  check(finalVerify.route('Fix this checkout bug with a regression test').status === 0 &&
+    finalVerify.control('start').status === 0,
+    '#164 final-iteration verification fixture starts Tier 2');
+  const finalVerifyLimit = read(finalVerify.file).workflowPlan.limits.maxIterations;
+  for (let i = 0; i < finalVerifyLimit; i++) {
+    check(finalVerify.gate('Write', { file_path: path.join(repo, 'final-verify-' + i + '.txt') }).status === 0,
+      '#164 confirmed mutation fills iteration budget ' + (i + 1) + '/' + finalVerifyLimit);
+  }
+  check(read(finalVerify.file).budget.counters.iterations === finalVerifyLimit,
+    '#164 fixture reaches the exact mutation limit while still running');
+  const finalVerifyId = 'toolu_final_iteration_verify';
+  check(finalVerify.gate('Bash', { command: 'node run-test.js' }, { tool_use_id: finalVerifyId }).status === 0,
+    '#164 no-effect verification shell is admitted at the exact mutation limit');
+  check(finalVerify.persist('Bash', { command: 'node run-test.js' }, { stdout: 'tests passed' },
+    { tool_use_id: finalVerifyId }).status === 0,
+    '#164 no-effect verification settles without exhausting the budget');
+  check(read(finalVerify.file).budget.counters.iterations === finalVerifyLimit &&
+    read(finalVerify.file).state === 'running',
+    '#164 no-effect verification preserves the full mutation count and running state');
+  check(finalVerify.stop().status === 0 && read(finalVerify.file).state === 'satisfied',
+    '#164 verification after the final allowed edit can satisfy Stop');
+
+  const finalMutator = fixtureSession('workflow-final-iteration-mutator');
+  check(finalMutator.route('Fix this checkout bug with a regression test').status === 0 &&
+    finalMutator.control('start').status === 0,
+    '#164 at-limit mutator fixture starts Tier 2');
+  const finalMutatorLimit = read(finalMutator.file).workflowPlan.limits.maxIterations;
+  for (let i = 0; i < finalMutatorLimit; i++) {
+    check(finalMutator.gate('Write', { file_path: path.join(repo, 'final-mutator-' + i + '.txt') }).status === 0,
+      '#164 mutator fixture fills iteration budget ' + (i + 1) + '/' + finalMutatorLimit);
+  }
+  const finalMutatorId = 'toolu_final_iteration_mutator';
+  check(finalMutator.gate('Bash', { command: 'node run-test-and-mutate.js' }, { tool_use_id: finalMutatorId }).status === 0,
+    '#164 verification-shaped command receives observation-only admission at limit');
+  const finalOverflowTarget = path.join(repo, 'final-iteration-overflow.txt');
+  fs.writeFileSync(finalOverflowTarget, 'mutation beyond limit\n');
+  check(finalMutator.persist('Bash', { command: 'node run-test-and-mutate.js' }, { stdout: 'changed' },
+    { tool_use_id: finalMutatorId }).status === 2,
+    '#164 at-limit verification-shaped command that mutates is rejected on observation');
+  const finalMutatorState = read(finalMutator.file);
+  check(finalMutatorState.state === 'blocked' &&
+    finalMutatorState.budget?.state === 'budget-exhausted' &&
+    finalMutatorState.budget?.reasonCode === 'iteration-budget-exhausted',
+    '#164 observed mutation beyond the limit leaves an auditable blocked workflow');
+  fs.unlinkSync(finalOverflowTarget);
+
   const taskNotification = '<task-notification><summary>Background command "Run full test suite" failed with exit code 1</summary></task-notification>';
   const unboundNotification = node('harness-everything/scripts/kernel-router.js', { cwd: repo, prompt: taskNotification });
   check(unboundNotification.status === 0 &&

package/ci/mechanism-2ai-workspace-fingerprint-batch.test.js

@@ -0,0 +1,216 @@
+#!/usr/bin/env node
+'use strict';
+
+const assert = require('assert');
+const crypto = require('crypto');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+const isolation = require(path.join(ROOT, 'hooks/scripts/lib/workflow-isolation'));
+const pluginIsolation = require(path.join(ROOT, 'plugins/harness-everything/hooks/scripts/lib/workflow-isolation'));
+const state = require(path.join(ROOT, 'hooks/scripts/lib/harness-state'));
+
+const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-workspace-fingerprint-'));
+const repo = path.join(temp, 'repo');
+fs.mkdirSync(repo);
+const env = {
+  ...process.env,
+  HARNESS_STATE_HOME: path.join(temp, 'state'),
+  HARNESS_WORKSPACE_ROOT: repo,
+};
+process.env.HARNESS_STATE_HOME = env.HARNESS_STATE_HOME;
+process.env.HARNESS_WORKSPACE_ROOT = env.HARNESS_WORKSPACE_ROOT;
+
+let passed = 0;
+function check(value, message) {
+  assert.ok(value, message);
+  passed++;
+  console.log('PASS ' + message);
+}
+
+function run(command, args, options = {}) {
+  const result = spawnSync(command, args, {
+    cwd: options.cwd || repo,
+    env,
+    input: options.input,
+    encoding: 'utf8',
+    windowsHide: true,
+    maxBuffer: 64 * 1024 * 1024,
+  });
+  assert.strictEqual(result.status, 0, result.stderr || result.stdout);
+  return result.stdout;
+}
+
+function git(args) {
+  return run('git', args);
+}
+
+function node(script, payload, args = []) {
+  return spawnSync(process.execPath, [path.join(ROOT, script), ...args], {
+    cwd: repo,
+    env,
+    input: payload === undefined ? undefined : JSON.stringify(payload),
+    encoding: 'utf8',
+    windowsHide: true,
+    maxBuffer: 64 * 1024 * 1024,
+  });
+}
+
+function gitRaw(args) {
+  return run('git', args);
+}
+
+function legacyHashWorktreePath(root, relative) {
+  const target = path.join(root, relative);
+  let stat;
+  try {
+    stat = fs.lstatSync(target);
+  } catch (error) {
+    if (error.code === 'ENOENT') return null;
+    throw error;
+  }
+  if (stat.isDirectory()) {
+    const result = spawnSync('git', ['-C', target, 'rev-parse', 'HEAD'], {
+      encoding: 'utf8',
+      windowsHide: true,
+    });
+    return { mode: '160000', oid: result.status === 0 ? result.stdout.trim() : 'directory' };
+  }
+  const mode = stat.isSymbolicLink() ? '120000' : ((stat.mode & 0o111) ? '100755' : '100644');
+  const result = spawnSync('git', ['hash-object', '--path=' + relative, '--', relative], {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  });
+  if (result.status !== 0) throw new Error('legacy fingerprint failed for ' + relative);
+  return { mode, oid: result.stdout.trim() };
+}
+
+function legacyFingerprint(cwd) {
+  const root = isolation.canonical(gitRaw(['rev-parse', '--show-toplevel']).trim());
+  const entries = new Map();
+  for (const record of gitRaw(['ls-files', '-s', '-z']).split('\0')) {
+    if (!record) continue;
+    const tab = record.indexOf('\t');
+    assert.ok(tab >= 0, 'legacy index record has a tab');
+    const meta = record.slice(0, tab).trim().split(/\s+/);
+    const relative = record.slice(tab + 1);
+    entries.set(relative, { relative, mode: meta[0], oid: meta[1] });
+  }
+  for (const relative of gitRaw(['diff-files', '--name-only', '-z']).split('\0').filter(Boolean)) {
+    const value = legacyHashWorktreePath(root, relative);
+    if (value) entries.set(relative, { relative, mode: value.mode, oid: value.oid });
+    else entries.delete(relative);
+  }
+  for (const relative of gitRaw(['ls-files', '--others', '--exclude-standard', '-z']).split('\0').filter(Boolean)) {
+    const value = legacyHashWorktreePath(root, relative);
+    if (value) entries.set(relative, { relative, mode: value.mode, oid: value.oid });
+  }
+  const digest = crypto.createHash('sha256');
+  digest.update('harness-workspace-fingerprint-v1\0');
+  for (const entry of [...entries.values()].sort((a, b) => a.relative.localeCompare(b.relative))) {
+    digest.update(entry.relative); digest.update('\0');
+    digest.update(entry.mode); digest.update('\0');
+    digest.update(entry.oid); digest.update('\0');
+  }
+  return digest.digest('hex');
+}
+
+try {
+  git(['init']);
+  fs.writeFileSync(path.join(repo, 'tracked.txt'), 'tracked\n');
+  fs.writeFileSync(path.join(repo, 'delete-me.txt'), 'delete me\n');
+  git(['add', '.']);
+  git(['-c', 'user.name=Harness Test', '-c', 'user.email=harness@example.invalid', 'commit', '-m', 'fixture']);
+
+  const cleanLegacy = legacyFingerprint(repo);
+  check(isolation.workspaceFingerprint(repo) === cleanLegacy,
+    '#169 batched fingerprint matches the legacy clean-worktree fingerprint');
+  check(pluginIsolation.workspaceFingerprint(repo) === cleanLegacy,
+    '#169 packaged plugin fingerprint matches canonical/legacy on a clean worktree');
+
+  fs.writeFileSync(path.join(repo, 'tracked.txt'), 'tracked changed\n');
+  fs.writeFileSync(path.join(repo, 'untracked.txt'), 'untracked\n');
+  const dirtyLegacy = legacyFingerprint(repo);
+  const dirtyBatched = isolation.workspaceFingerprint(repo);
+  check(dirtyBatched === dirtyLegacy,
+    '#169 batched fingerprint matches legacy for dirty tracked + untracked content');
+  check(pluginIsolation.workspaceFingerprint(repo) === dirtyLegacy,
+    '#169 packaged plugin batched fingerprint matches legacy dirty semantics');
+
+  git(['add', 'tracked.txt', 'untracked.txt']);
+  check(isolation.workspaceFingerprint(repo) === dirtyBatched,
+    '#169 staging visible content does not change the workspace fingerprint');
+
+  fs.unlinkSync(path.join(repo, 'delete-me.txt'));
+  check(isolation.workspaceFingerprint(repo) === legacyFingerprint(repo),
+    '#169 tracked deletion keeps legacy fingerprint semantics');
+
+  git(['reset', '--hard', 'HEAD']);
+  git(['clean', '-fdx']);
+  const bulk = path.join(repo, 'bulk');
+  fs.mkdirSync(bulk);
+  for (let i = 0; i < 1000; i++) {
+    fs.writeFileSync(path.join(bulk, 'file-' + String(i).padStart(4, '0') + '.txt'), 'x\n');
+  }
+
+  const startedAt = process.hrtime.bigint();
+  const bulkFingerprint = isolation.workspaceFingerprint(repo);
+  const elapsedMs = Number(process.hrtime.bigint() - startedAt) / 1e6;
+  check(/^[a-f0-9]{64}$/.test(bulkFingerprint),
+    '#169 1000-untracked-file fingerprint returns a valid digest');
+  check(elapsedMs < 5000,
+    '#169 1000-untracked-file fingerprint stays below 5s regression ceiling (actual ' + elapsedMs.toFixed(1) + 'ms)');
+  check(pluginIsolation.workspaceFingerprint(repo) === bulkFingerprint,
+    '#169 packaged plugin fingerprint remains byte-identical for 1000 untracked files');
+
+  let limitError = null;
+  try {
+    isolation.workspaceFingerprint(repo, { maxPaths: 10 });
+  } catch (error) {
+    limitError = error;
+  }
+  check(limitError?.code === 'HARNESS_FINGERPRINT_LIMIT' &&
+    limitError.count === 1000 &&
+    limitError.maxPaths === 10,
+    '#169 explicit fingerprint cap reports a structured conservative-fallback signal');
+
+  for (let i = 1000; i < 5101; i++) {
+    fs.writeFileSync(path.join(bulk, 'file-' + String(i).padStart(4, '0') + '.txt'), 'x\n');
+  }
+  const sessionId = 'workspace-fingerprint-limit';
+  const payload = { session_id: sessionId, cwd: repo };
+  const routed = node('harness-everything/scripts/kernel-router.js', {
+    ...payload,
+    prompt: 'Fix this checkout bug with a regression test',
+  });
+  check(routed.status === 0, '#169 large-workspace Tier-2 fixture routes normally');
+  const started = node('hooks/scripts/workflow-disposition.js', undefined, ['start', '--session-id', sessionId]);
+  check(started.status === 0, '#169 large-workspace Tier-2 fixture starts normally');
+
+  const admitted = node('hooks/scripts/workflow-gate.js', {
+    ...payload,
+    tool_name: 'Bash',
+    tool_use_id: 'toolu_fingerprint_limit',
+    tool_input: { command: 'node large-fingerprint.js' },
+  });
+  check(admitted.status === 0,
+    '#169 >5000 observed paths degrade conservatively instead of blocking the shell call');
+  const workflowFile = path.join(state.getSessionDir(repo, sessionId), 'workflow-run.json');
+  const workflow = JSON.parse(fs.readFileSync(workflowFile, 'utf8'));
+  check(workflow.state === 'running' &&
+    workflow.budget?.counters?.iterations === 1 &&
+    workflow.lastMutationAt > 0 &&
+    workflow.budget?.events?.at(-1)?.evidence === 'shell:fingerprint-limit',
+    '#169 fingerprint-limit fallback records one auditable conservative mutation');
+
+  console.log('PASS: batched workspace fingerprint (' + passed + ' assertions, 1000-file ' + elapsedMs.toFixed(1) + 'ms)');
+} finally {
+  if (!temp.startsWith(path.join(os.tmpdir(), 'harness-workspace-fingerprint-'))) {
+    throw new Error('unsafe fixture cleanup');
+  }
+  fs.rmSync(temp, { recursive: true, force: true });
+}

package/hooks/scripts/lib/workflow-isolation.js

@@ -5,8 +5,15 @@ const crypto = require('crypto');
 const path = require('path');
 const { spawnSync } = require('child_process');
 
-function gitRaw(cwd, args) {
-  const result = spawnSync('git', args, { cwd, encoding: 'utf8', windowsHide: true, timeout: 5000, maxBuffer: 16 * 1024 * 1024 });
+function gitRaw(cwd, args, options = {}) {
+  const result = spawnSync('git', args, {
+    cwd,
+    encoding: 'utf8',
+    windowsHide: true,
+    timeout: options.timeout ?? 5000,
+    maxBuffer: options.maxBuffer ?? (16 * 1024 * 1024),
+    ...(options.input === undefined ? {} : { input: options.input }),
+  });
   if (result.status !== 0) throw new Error('cannot verify Git worktree isolation');
   return result.stdout;
 }
@@ -15,30 +22,73 @@ function git(cwd, args) {
   return gitRaw(cwd, args).trim();
 }
 
-function hashWorktreePath(root, relative) {
-  const target = path.join(root, relative);
-  let stat;
-  try { stat = fs.lstatSync(target); }
-  catch (error) {
-    if (error.code === 'ENOENT') return null;
-    throw error;
+function fingerprintLimitError(count, maxPaths) {
+  const error = new Error('workspace fingerprint path limit exceeded');
+  error.code = 'HARNESS_FINGERPRINT_LIMIT';
+  error.count = count;
+  error.maxPaths = maxPaths;
+  return error;
+}
+
+function hashWorktreePaths(root, relatives) {
+  const values = new Map();
+  const batch = [];
+  for (const relative of relatives) {
+    const target = path.join(root, relative);
+    let stat;
+    try { stat = fs.lstatSync(target); }
+    catch (error) {
+      if (error.code === 'ENOENT') {
+        values.set(relative, null);
+        continue;
+      }
+      throw error;
+    }
+    if (stat.isDirectory()) {
+      const result = spawnSync('git', ['-C', target, 'rev-parse', 'HEAD'], {
+        encoding: 'utf8', windowsHide: true, timeout: 5000,
+      });
+      values.set(relative, { mode: '160000', oid: result.status === 0 ? result.stdout.trim() : 'directory' });
+      continue;
+    }
+    const mode = stat.isSymbolicLink() ? '120000' : ((stat.mode & 0o111) ? '100755' : '100644');
+    // --stdin-paths is line-delimited. Rare pathnames containing a newline use
+    // the legacy one-file call so the fingerprint remains exact.
+    if (/[\r\n]/.test(relative)) {
+      const one = spawnSync('git', ['hash-object', '--path=' + relative, '--', relative], {
+        cwd: root, encoding: 'utf8', windowsHide: true, timeout: 5000,
+      });
+      if (one.status !== 0) throw new Error('cannot fingerprint workspace content');
+      values.set(relative, { mode, oid: one.stdout.trim() });
+      continue;
+    }
+    batch.push({ relative, mode });
   }
-  if (stat.isDirectory()) {
-    const result = spawnSync('git', ['-C', target, 'rev-parse', 'HEAD'], { encoding: 'utf8', windowsHide: true, timeout: 5000 });
-    return { mode: '160000', oid: result.status === 0 ? result.stdout.trim() : 'directory' };
+
+  if (batch.length > 0) {
+    const hashed = spawnSync('git', ['hash-object', '--stdin-paths'], {
+      cwd: root,
+      input: batch.map(item => item.relative).join('\n') + '\n',
+      encoding: 'utf8',
+      windowsHide: true,
+      timeout: 15000,
+      maxBuffer: 16 * 1024 * 1024,
+    });
+    if (hashed.status !== 0) throw new Error('cannot fingerprint workspace content');
+    const oids = hashed.stdout.split(/\r?\n/).filter(Boolean);
+    if (oids.length !== batch.length) throw new Error('cannot fingerprint workspace content');
+    for (let i = 0; i < batch.length; i++) {
+      values.set(batch[i].relative, { mode: batch[i].mode, oid: oids[i] });
+    }
   }
-  const mode = stat.isSymbolicLink() ? '120000' : ((stat.mode & 0o111) ? '100755' : '100644');
-  const result = spawnSync('git', ['hash-object', '--path=' + relative, '--', relative], {
-    cwd: root, encoding: 'utf8', windowsHide: true, timeout: 5000,
-  });
-  if (result.status !== 0) throw new Error('cannot fingerprint workspace content');
-  return { mode, oid: result.stdout.trim() };
+  return values;
 }
 
-function workspaceFingerprint(cwd) {
+function workspaceFingerprint(cwd, options = {}) {
   const root = canonical(git(cwd, ['rev-parse', '--show-toplevel']));
   const entries = new Map();
-  for (const record of gitRaw(root, ['ls-files', '-s', '-z']).split('\0')) {
+  const largeGitRead = { timeout: 15000, maxBuffer: 64 * 1024 * 1024 };
+  for (const record of gitRaw(root, ['ls-files', '-s', '-z'], largeGitRead).split('\0')) {
     if (!record) continue;
     const tab = record.indexOf('\t');
     if (tab < 0) throw new Error('cannot fingerprint workspace index');
@@ -49,18 +99,25 @@ function workspaceFingerprint(cwd) {
     entries.set(relative, { relative, mode, oid });
   }
 
+  const changed = gitRaw(root, ['diff-files', '--name-only', '-z'], largeGitRead).split('\0').filter(Boolean);
+  const untracked = gitRaw(root, ['ls-files', '--others', '--exclude-standard', '-z'], largeGitRead).split('\0').filter(Boolean);
+  const observedPaths = [...new Set([...changed, ...untracked])];
+  const maxPaths = Number.isInteger(options.maxPaths) && options.maxPaths > 0 ? options.maxPaths : 5000;
+  if (observedPaths.length > maxPaths) throw fingerprintLimitError(observedPaths.length, maxPaths);
+  const worktreeValues = hashWorktreePaths(root, observedPaths);
+
   // Substitute current worktree content for tracked paths that differ from the
   // index. This keeps the fingerprint stable across git add / git commit when
   // visible workspace content did not change.
-  for (const relative of gitRaw(root, ['diff-files', '--name-only', '-z']).split('\0').filter(Boolean)) {
-    const value = hashWorktreePath(root, relative);
+  for (const relative of changed) {
+    const value = worktreeValues.get(relative);
     if (value) entries.set(relative, { relative, mode: value.mode, oid: value.oid });
     else entries.delete(relative);
   }
 
-  for (const relative of gitRaw(root, ['ls-files', '--others', '--exclude-standard', '-z']).split('\0').filter(Boolean)) {
-    const value = hashWorktreePath(root, relative);
-    entries.set(relative, { relative, mode: value.mode, oid: value.oid });
+  for (const relative of untracked) {
+    const value = worktreeValues.get(relative);
+    if (value) entries.set(relative, { relative, mode: value.mode, oid: value.oid });
   }
 
   const digest = crypto.createHash('sha256');
@@ -135,6 +192,11 @@ function linkedWorktree(cwd, boundRoot) {
 // Unsupported shell syntax still fails closed.
 const DANGEROUS_FLAG_RE = /\s(?:--(?:output|ext-diff|textconv|exec|pre|pre-glob|pager|open|batch|filters)|-[xoO])(?:\b|=)|\s-(?:exec|execdir|delete|fprint|fprintf)\b/i;
 const READ_ONLY_PREFIX_RE = /^(?:git\s+(?:status|rev-parse|diff|log|show|ls-files|check-ignore)(?:\s|$)|git\s+branch\s+--show-current$|git\s+worktree\s+list(?:\s|$)|gh\s+(?:issue|pr)\s+(?:view|list)(?:\s|$)|gh\s+repo\s+view(?:\s|$)|gh\s+auth\s+status(?:\s|$)|(?:pwd|ls|dir|cat|type|head|tail|wc|stat|rg|grep|echo|Get-Location|Get-ChildItem|Get-Content|Select-String|Test-Path)(?:\s|$))/i;
+const VERIFY_COMMAND_RE = /\b(test|spec|jest|vitest|mocha|pytest|rspec|phpunit|tsc|eslint|lint|build|compile|verify|check)\b/i;
+
+function isVerificationShell(command) {
+  return VERIFY_COMMAND_RE.test(String(command || ''));
+}
 
 function isReadOnlySegment(segment) {
   return READ_ONLY_PREFIX_RE.test(segment) && !DANGEROUS_FLAG_RE.test(segment);
@@ -311,4 +373,4 @@ function assertShellScope(command, cwd, isolatedRoot) {
   }
 }
 
-module.exports = { canonical, key, within, linkedWorktree, classifyShell, workspaceFingerprint, shellProbeKey, inputOf, cwdOf, commandOf, mutationPaths, worktreeRoots, directMutationInWorkspace, assertTargets, assertShellScope };
+module.exports = { canonical, key, within, linkedWorktree, classifyShell, isVerificationShell, workspaceFingerprint, shellProbeKey, inputOf, cwdOf, commandOf, mutationPaths, worktreeRoots, directMutationInWorkspace, assertTargets, assertShellScope };

package/hooks/scripts/lib/workflow-runtime.js

@@ -196,14 +196,30 @@ function reclaimStaleMutationProbes(context, keepKey) {
   }
 }
 
-function registerMutationProbe(context, key, fingerprint, reserveIteration, observationCwd, timeoutMs) {
+function registerMutationProbe(context, key, fingerprint, reserveIteration, observationCwd, options = {}) {
   if (!MUTATION_PROBE_KEY.test(String(key || '')) || !MUTATION_PROBE_KEY.test(String(fingerprint || ''))) {
     throw new Error('invalid mutation probe identity');
   }
   return withMutationProbeLock(context, () => {
     refreshWorkflowForProbe(context);
     reclaimStaleMutationProbes(context, key);
-    if (reserveIteration) assertIterationCapacity(context, 'shell:untrusted');
+    let activeReservation = Boolean(reserveIteration);
+    let atLimitAllowance = false;
+    if (activeReservation) {
+      const budget = ensureWorkflowBudget(context.workflow);
+      const limit = budget.limits.maxIterations;
+      const reserved = mutationProbeReservations(context);
+      if (options.allowAtLimit === true && budget.state === 'active' && limit !== null &&
+          budget.counters.iterations === limit && reserved === 0) {
+        // Verification-shaped commands get observation-only admission at the
+        // exact mutation limit. If they mutate, settlement still records the
+        // mutation and exhausts the budget after execution (#164).
+        activeReservation = false;
+        atLimitAllowance = true;
+      } else {
+        assertIterationCapacity(context, 'shell:untrusted');
+      }
+    }
     const dir = mutationProbeDir(context);
     fs.mkdirSync(dir, { recursive: true });
     const file = mutationProbeFile(context, key);
@@ -212,11 +228,12 @@ function registerMutationProbe(context, key, fingerprint, reserveIteration, obse
     const probe = {
       schemaVersion: 1,
       fingerprint,
-      reserveIteration: Boolean(reserveIteration),
-      countIteration: Boolean(reserveIteration),
+      reserveIteration: activeReservation,
+      countIteration: options.countIteration === undefined ? Boolean(reserveIteration) : Boolean(options.countIteration),
+      atLimitAllowance,
       observationCwd: observationCwd ? path.resolve(observationCwd) : null,
       observedAt,
-      reclaimAfterAt: observedAt + mutationProbeLeaseMs(timeoutMs),
+      reclaimAfterAt: observedAt + mutationProbeLeaseMs(options.timeoutMs),
     };
     atomicWriteJson(file, probe);
     return probe;

package/hooks/scripts/state-persist.js

@@ -3,14 +3,9 @@ const fs = require('fs');
 const path = require('path');
 const { getWorkspaceRoot, getSessionDir } = require('./lib/harness-state');
 const { loadWorkflow, saveWorkflow, isMajorWorkflow, peekMutationProbe, settleMutationProbe, settleMutationProbeConservative } = require('./lib/workflow-runtime');
-const { cwdOf, shellProbeKey, workspaceFingerprint, directMutationInWorkspace } = require('./lib/workflow-isolation');
+const { cwdOf, shellProbeKey, isVerificationShell, workspaceFingerprint, directMutationInWorkspace } = require('./lib/workflow-isolation');
 const { observeTool } = require('./lib/telemetry');
 
-// Commands that count as "verification ran" for the Stop gate
-// (hooks/scripts/stop-gate.js). Recall over precision: under-blocking the
-// gate is the correct failure direction, so a broad net is fine.
-const VERIFY_COMMAND_RE = /\b(test|spec|jest|vitest|mocha|pytest|rspec|phpunit|tsc|eslint|lint|build|compile|verify|check)\b/i;
-
 let inputData = '';
 const timeout = setTimeout(() => {
   processState(null);
@@ -44,8 +39,10 @@ function observeWorkspaceMutation(payload, root) {
   try {
     after = workspaceFingerprint(observationCwd);
   } catch (error) {
-    if (!isMajorWorkflow(context.workflow)) {
-      const conservative = settleMutationProbeConservative(context, probeKey, toolName, 'unobservable-workspace');
+    const fingerprintLimited = error && error.code === 'HARNESS_FINGERPRINT_LIMIT';
+    if (!isMajorWorkflow(context.workflow) || fingerprintLimited) {
+      const evidence = fingerprintLimited ? 'fingerprint-limit' : 'unobservable-workspace';
+      const conservative = settleMutationProbeConservative(context, probeKey, toolName, evidence);
       return Boolean(conservative && conservative.changed);
     }
     context.workflow.state = 'blocked';
@@ -127,7 +124,7 @@ function processState(payload) {
       }
       if ((toolName === 'Bash' || toolName === 'PowerShell') && !isFailed) {
         const command = (payload.tool_input && payload.tool_input.command) || '';
-        if (VERIFY_COMMAND_RE.test(command)) {
+        if (isVerificationShell(command)) {
           state.lastVerifyAt = Date.now();
           state.lastVerifyExitCode = exitCode ?? null;
         }

package/hooks/scripts/workflow-gate.js

@@ -4,7 +4,7 @@
 const path = require('path');
 const fs = require('fs');
 const { loadWorkflow, saveWorkflow, isMajorWorkflow, matchingRun, registerMutationProbe, recordBudgetEvent, readHookInput, WORKFLOW_CONTROLLER_COMMANDS } = require('./lib/workflow-runtime');
-const { key, classifyShell, workspaceFingerprint, shellProbeKey, cwdOf, commandOf, mutationPaths, directMutationInWorkspace, linkedWorktree, assertTargets, assertShellScope } = require('./lib/workflow-isolation');
+const { key, classifyShell, isVerificationShell, workspaceFingerprint, shellProbeKey, cwdOf, commandOf, mutationPaths, directMutationInWorkspace, linkedWorktree, assertTargets, assertShellScope } = require('./lib/workflow-isolation');
 
 const DIRECT = new Set(['Edit', 'Write', 'apply_patch']);
 const SHELL = new Set(['Bash', 'PowerShell', 'exec_command']);
@@ -79,23 +79,23 @@ function decide(payload) {
   try {
     fingerprint = workspaceFingerprint(cwd);
   } catch (error) {
-    if (isMajorWorkflow(workflow)) throw error;
+    const fingerprintLimited = error && error.code === 'HARNESS_FINGERPRINT_LIMIT';
+    if (isMajorWorkflow(workflow) && !fingerprintLimited) throw error;
+    const evidence = fingerprintLimited ? 'shell:fingerprint-limit' : 'shell:unobservable-workspace';
     if (workflow.strategy === 'iterative-single') {
-      recordBudgetEvent(context, 'iteration', { evidence: 'shell:unobservable-workspace' });
+      recordBudgetEvent(context, 'iteration', { evidence });
     }
     workflow.lastMutationAt = Date.now();
     saveWorkflow(context);
     return;
   }
   const probeKey = shellProbeKey(payload, cwd);
-  registerMutationProbe(
-    context,
-    probeKey,
-    fingerprint,
-    workflow.strategy === 'iterative-single',
-    cwd,
-    shellTimeoutMs(payload)
-  );
+  const iterative = workflow.strategy === 'iterative-single';
+  registerMutationProbe(context, probeKey, fingerprint, iterative, cwd, {
+    countIteration: iterative,
+    allowAtLimit: iterative && isVerificationShell(command),
+    timeoutMs: shellTimeoutMs(payload),
+  });
 }
 
 readHookInput(decide);

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.12.1",
+  "version": "0.12.3",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.12.1",
+  "version": "0.12.3",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.12.1",
+  "version": "0.12.3",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/hooks/scripts/lib/workflow-isolation.js

@@ -5,8 +5,15 @@ const crypto = require('crypto');
 const path = require('path');
 const { spawnSync } = require('child_process');
 
-function gitRaw(cwd, args) {
-  const result = spawnSync('git', args, { cwd, encoding: 'utf8', windowsHide: true, timeout: 5000, maxBuffer: 16 * 1024 * 1024 });
+function gitRaw(cwd, args, options = {}) {
+  const result = spawnSync('git', args, {
+    cwd,
+    encoding: 'utf8',
+    windowsHide: true,
+    timeout: options.timeout ?? 5000,
+    maxBuffer: options.maxBuffer ?? (16 * 1024 * 1024),
+    ...(options.input === undefined ? {} : { input: options.input }),
+  });
   if (result.status !== 0) throw new Error('cannot verify Git worktree isolation');
   return result.stdout;
 }
@@ -15,30 +22,73 @@ function git(cwd, args) {
   return gitRaw(cwd, args).trim();
 }
 
-function hashWorktreePath(root, relative) {
-  const target = path.join(root, relative);
-  let stat;
-  try { stat = fs.lstatSync(target); }
-  catch (error) {
-    if (error.code === 'ENOENT') return null;
-    throw error;
+function fingerprintLimitError(count, maxPaths) {
+  const error = new Error('workspace fingerprint path limit exceeded');
+  error.code = 'HARNESS_FINGERPRINT_LIMIT';
+  error.count = count;
+  error.maxPaths = maxPaths;
+  return error;
+}
+
+function hashWorktreePaths(root, relatives) {
+  const values = new Map();
+  const batch = [];
+  for (const relative of relatives) {
+    const target = path.join(root, relative);
+    let stat;
+    try { stat = fs.lstatSync(target); }
+    catch (error) {
+      if (error.code === 'ENOENT') {
+        values.set(relative, null);
+        continue;
+      }
+      throw error;
+    }
+    if (stat.isDirectory()) {
+      const result = spawnSync('git', ['-C', target, 'rev-parse', 'HEAD'], {
+        encoding: 'utf8', windowsHide: true, timeout: 5000,
+      });
+      values.set(relative, { mode: '160000', oid: result.status === 0 ? result.stdout.trim() : 'directory' });
+      continue;
+    }
+    const mode = stat.isSymbolicLink() ? '120000' : ((stat.mode & 0o111) ? '100755' : '100644');
+    // --stdin-paths is line-delimited. Rare pathnames containing a newline use
+    // the legacy one-file call so the fingerprint remains exact.
+    if (/[\r\n]/.test(relative)) {
+      const one = spawnSync('git', ['hash-object', '--path=' + relative, '--', relative], {
+        cwd: root, encoding: 'utf8', windowsHide: true, timeout: 5000,
+      });
+      if (one.status !== 0) throw new Error('cannot fingerprint workspace content');
+      values.set(relative, { mode, oid: one.stdout.trim() });
+      continue;
+    }
+    batch.push({ relative, mode });
   }
-  if (stat.isDirectory()) {
-    const result = spawnSync('git', ['-C', target, 'rev-parse', 'HEAD'], { encoding: 'utf8', windowsHide: true, timeout: 5000 });
-    return { mode: '160000', oid: result.status === 0 ? result.stdout.trim() : 'directory' };
+
+  if (batch.length > 0) {
+    const hashed = spawnSync('git', ['hash-object', '--stdin-paths'], {
+      cwd: root,
+      input: batch.map(item => item.relative).join('\n') + '\n',
+      encoding: 'utf8',
+      windowsHide: true,
+      timeout: 15000,
+      maxBuffer: 16 * 1024 * 1024,
+    });
+    if (hashed.status !== 0) throw new Error('cannot fingerprint workspace content');
+    const oids = hashed.stdout.split(/\r?\n/).filter(Boolean);
+    if (oids.length !== batch.length) throw new Error('cannot fingerprint workspace content');
+    for (let i = 0; i < batch.length; i++) {
+      values.set(batch[i].relative, { mode: batch[i].mode, oid: oids[i] });
+    }
   }
-  const mode = stat.isSymbolicLink() ? '120000' : ((stat.mode & 0o111) ? '100755' : '100644');
-  const result = spawnSync('git', ['hash-object', '--path=' + relative, '--', relative], {
-    cwd: root, encoding: 'utf8', windowsHide: true, timeout: 5000,
-  });
-  if (result.status !== 0) throw new Error('cannot fingerprint workspace content');
-  return { mode, oid: result.stdout.trim() };
+  return values;
 }
 
-function workspaceFingerprint(cwd) {
+function workspaceFingerprint(cwd, options = {}) {
   const root = canonical(git(cwd, ['rev-parse', '--show-toplevel']));
   const entries = new Map();
-  for (const record of gitRaw(root, ['ls-files', '-s', '-z']).split('\0')) {
+  const largeGitRead = { timeout: 15000, maxBuffer: 64 * 1024 * 1024 };
+  for (const record of gitRaw(root, ['ls-files', '-s', '-z'], largeGitRead).split('\0')) {
     if (!record) continue;
     const tab = record.indexOf('\t');
     if (tab < 0) throw new Error('cannot fingerprint workspace index');
@@ -49,18 +99,25 @@ function workspaceFingerprint(cwd) {
     entries.set(relative, { relative, mode, oid });
   }
 
+  const changed = gitRaw(root, ['diff-files', '--name-only', '-z'], largeGitRead).split('\0').filter(Boolean);
+  const untracked = gitRaw(root, ['ls-files', '--others', '--exclude-standard', '-z'], largeGitRead).split('\0').filter(Boolean);
+  const observedPaths = [...new Set([...changed, ...untracked])];
+  const maxPaths = Number.isInteger(options.maxPaths) && options.maxPaths > 0 ? options.maxPaths : 5000;
+  if (observedPaths.length > maxPaths) throw fingerprintLimitError(observedPaths.length, maxPaths);
+  const worktreeValues = hashWorktreePaths(root, observedPaths);
+
   // Substitute current worktree content for tracked paths that differ from the
   // index. This keeps the fingerprint stable across git add / git commit when
   // visible workspace content did not change.
-  for (const relative of gitRaw(root, ['diff-files', '--name-only', '-z']).split('\0').filter(Boolean)) {
-    const value = hashWorktreePath(root, relative);
+  for (const relative of changed) {
+    const value = worktreeValues.get(relative);
     if (value) entries.set(relative, { relative, mode: value.mode, oid: value.oid });
     else entries.delete(relative);
   }
 
-  for (const relative of gitRaw(root, ['ls-files', '--others', '--exclude-standard', '-z']).split('\0').filter(Boolean)) {
-    const value = hashWorktreePath(root, relative);
-    entries.set(relative, { relative, mode: value.mode, oid: value.oid });
+  for (const relative of untracked) {
+    const value = worktreeValues.get(relative);
+    if (value) entries.set(relative, { relative, mode: value.mode, oid: value.oid });
   }
 
   const digest = crypto.createHash('sha256');
@@ -135,6 +192,11 @@ function linkedWorktree(cwd, boundRoot) {
 // Unsupported shell syntax still fails closed.
 const DANGEROUS_FLAG_RE = /\s(?:--(?:output|ext-diff|textconv|exec|pre|pre-glob|pager|open|batch|filters)|-[xoO])(?:\b|=)|\s-(?:exec|execdir|delete|fprint|fprintf)\b/i;
 const READ_ONLY_PREFIX_RE = /^(?:git\s+(?:status|rev-parse|diff|log|show|ls-files|check-ignore)(?:\s|$)|git\s+branch\s+--show-current$|git\s+worktree\s+list(?:\s|$)|gh\s+(?:issue|pr)\s+(?:view|list)(?:\s|$)|gh\s+repo\s+view(?:\s|$)|gh\s+auth\s+status(?:\s|$)|(?:pwd|ls|dir|cat|type|head|tail|wc|stat|rg|grep|echo|Get-Location|Get-ChildItem|Get-Content|Select-String|Test-Path)(?:\s|$))/i;
+const VERIFY_COMMAND_RE = /\b(test|spec|jest|vitest|mocha|pytest|rspec|phpunit|tsc|eslint|lint|build|compile|verify|check)\b/i;
+
+function isVerificationShell(command) {
+  return VERIFY_COMMAND_RE.test(String(command || ''));
+}
 
 function isReadOnlySegment(segment) {
   return READ_ONLY_PREFIX_RE.test(segment) && !DANGEROUS_FLAG_RE.test(segment);
@@ -311,4 +373,4 @@ function assertShellScope(command, cwd, isolatedRoot) {
   }
 }
 
-module.exports = { canonical, key, within, linkedWorktree, classifyShell, workspaceFingerprint, shellProbeKey, inputOf, cwdOf, commandOf, mutationPaths, worktreeRoots, directMutationInWorkspace, assertTargets, assertShellScope };
+module.exports = { canonical, key, within, linkedWorktree, classifyShell, isVerificationShell, workspaceFingerprint, shellProbeKey, inputOf, cwdOf, commandOf, mutationPaths, worktreeRoots, directMutationInWorkspace, assertTargets, assertShellScope };

package/plugins/harness-everything/hooks/scripts/lib/workflow-runtime.js

@@ -196,14 +196,30 @@ function reclaimStaleMutationProbes(context, keepKey) {
   }
 }
 
-function registerMutationProbe(context, key, fingerprint, reserveIteration, observationCwd, timeoutMs) {
+function registerMutationProbe(context, key, fingerprint, reserveIteration, observationCwd, options = {}) {
   if (!MUTATION_PROBE_KEY.test(String(key || '')) || !MUTATION_PROBE_KEY.test(String(fingerprint || ''))) {
     throw new Error('invalid mutation probe identity');
   }
   return withMutationProbeLock(context, () => {
     refreshWorkflowForProbe(context);
     reclaimStaleMutationProbes(context, key);
-    if (reserveIteration) assertIterationCapacity(context, 'shell:untrusted');
+    let activeReservation = Boolean(reserveIteration);
+    let atLimitAllowance = false;
+    if (activeReservation) {
+      const budget = ensureWorkflowBudget(context.workflow);
+      const limit = budget.limits.maxIterations;
+      const reserved = mutationProbeReservations(context);
+      if (options.allowAtLimit === true && budget.state === 'active' && limit !== null &&
+          budget.counters.iterations === limit && reserved === 0) {
+        // Verification-shaped commands get observation-only admission at the
+        // exact mutation limit. If they mutate, settlement still records the
+        // mutation and exhausts the budget after execution (#164).
+        activeReservation = false;
+        atLimitAllowance = true;
+      } else {
+        assertIterationCapacity(context, 'shell:untrusted');
+      }
+    }
     const dir = mutationProbeDir(context);
     fs.mkdirSync(dir, { recursive: true });
     const file = mutationProbeFile(context, key);
@@ -212,11 +228,12 @@ function registerMutationProbe(context, key, fingerprint, reserveIteration, obse
     const probe = {
       schemaVersion: 1,
       fingerprint,
-      reserveIteration: Boolean(reserveIteration),
-      countIteration: Boolean(reserveIteration),
+      reserveIteration: activeReservation,
+      countIteration: options.countIteration === undefined ? Boolean(reserveIteration) : Boolean(options.countIteration),
+      atLimitAllowance,
       observationCwd: observationCwd ? path.resolve(observationCwd) : null,
       observedAt,
-      reclaimAfterAt: observedAt + mutationProbeLeaseMs(timeoutMs),
+      reclaimAfterAt: observedAt + mutationProbeLeaseMs(options.timeoutMs),
     };
     atomicWriteJson(file, probe);
     return probe;

package/plugins/harness-everything/hooks/scripts/state-persist.js

@@ -3,14 +3,9 @@ const fs = require('fs');
 const path = require('path');
 const { getWorkspaceRoot, getSessionDir } = require('./lib/harness-state');
 const { loadWorkflow, saveWorkflow, isMajorWorkflow, peekMutationProbe, settleMutationProbe, settleMutationProbeConservative } = require('./lib/workflow-runtime');
-const { cwdOf, shellProbeKey, workspaceFingerprint, directMutationInWorkspace } = require('./lib/workflow-isolation');
+const { cwdOf, shellProbeKey, isVerificationShell, workspaceFingerprint, directMutationInWorkspace } = require('./lib/workflow-isolation');
 const { observeTool } = require('./lib/telemetry');
 
-// Commands that count as "verification ran" for the Stop gate
-// (hooks/scripts/stop-gate.js). Recall over precision: under-blocking the
-// gate is the correct failure direction, so a broad net is fine.
-const VERIFY_COMMAND_RE = /\b(test|spec|jest|vitest|mocha|pytest|rspec|phpunit|tsc|eslint|lint|build|compile|verify|check)\b/i;
-
 let inputData = '';
 const timeout = setTimeout(() => {
   processState(null);
@@ -44,8 +39,10 @@ function observeWorkspaceMutation(payload, root) {
   try {
     after = workspaceFingerprint(observationCwd);
   } catch (error) {
-    if (!isMajorWorkflow(context.workflow)) {
-      const conservative = settleMutationProbeConservative(context, probeKey, toolName, 'unobservable-workspace');
+    const fingerprintLimited = error && error.code === 'HARNESS_FINGERPRINT_LIMIT';
+    if (!isMajorWorkflow(context.workflow) || fingerprintLimited) {
+      const evidence = fingerprintLimited ? 'fingerprint-limit' : 'unobservable-workspace';
+      const conservative = settleMutationProbeConservative(context, probeKey, toolName, evidence);
       return Boolean(conservative && conservative.changed);
     }
     context.workflow.state = 'blocked';
@@ -127,7 +124,7 @@ function processState(payload) {
       }
       if ((toolName === 'Bash' || toolName === 'PowerShell') && !isFailed) {
         const command = (payload.tool_input && payload.tool_input.command) || '';
-        if (VERIFY_COMMAND_RE.test(command)) {
+        if (isVerificationShell(command)) {
           state.lastVerifyAt = Date.now();
           state.lastVerifyExitCode = exitCode ?? null;
         }

package/plugins/harness-everything/hooks/scripts/workflow-gate.js

@@ -4,7 +4,7 @@
 const path = require('path');
 const fs = require('fs');
 const { loadWorkflow, saveWorkflow, isMajorWorkflow, matchingRun, registerMutationProbe, recordBudgetEvent, readHookInput, WORKFLOW_CONTROLLER_COMMANDS } = require('./lib/workflow-runtime');
-const { key, classifyShell, workspaceFingerprint, shellProbeKey, cwdOf, commandOf, mutationPaths, directMutationInWorkspace, linkedWorktree, assertTargets, assertShellScope } = require('./lib/workflow-isolation');
+const { key, classifyShell, isVerificationShell, workspaceFingerprint, shellProbeKey, cwdOf, commandOf, mutationPaths, directMutationInWorkspace, linkedWorktree, assertTargets, assertShellScope } = require('./lib/workflow-isolation');
 
 const DIRECT = new Set(['Edit', 'Write', 'apply_patch']);
 const SHELL = new Set(['Bash', 'PowerShell', 'exec_command']);
@@ -79,23 +79,23 @@ function decide(payload) {
   try {
     fingerprint = workspaceFingerprint(cwd);
   } catch (error) {
-    if (isMajorWorkflow(workflow)) throw error;
+    const fingerprintLimited = error && error.code === 'HARNESS_FINGERPRINT_LIMIT';
+    if (isMajorWorkflow(workflow) && !fingerprintLimited) throw error;
+    const evidence = fingerprintLimited ? 'shell:fingerprint-limit' : 'shell:unobservable-workspace';
     if (workflow.strategy === 'iterative-single') {
-      recordBudgetEvent(context, 'iteration', { evidence: 'shell:unobservable-workspace' });
+      recordBudgetEvent(context, 'iteration', { evidence });
     }
     workflow.lastMutationAt = Date.now();
     saveWorkflow(context);
     return;
   }
   const probeKey = shellProbeKey(payload, cwd);
-  registerMutationProbe(
-    context,
-    probeKey,
-    fingerprint,
-    workflow.strategy === 'iterative-single',
-    cwd,
-    shellTimeoutMs(payload)
-  );
+  const iterative = workflow.strategy === 'iterative-single';
+  registerMutationProbe(context, probeKey, fingerprint, iterative, cwd, {
+    countIteration: iterative,
+    allowAtLimit: iterative && isVerificationShell(command),
+    timeoutMs: shellTimeoutMs(payload),
+  });
 }
 
 readHookInput(decide);

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.12.1",
+  "version": "0.12.3",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",