harness-everything 0.16.0 → 0.16.2

package/plugins/harness-everything/hooks/scripts/state-persist.js

@@ -2,151 +2,51 @@
 const fs = require('fs');
 const path = require('path');
 const { getWorkspaceRoot, getSessionDir } = require('./lib/harness-state');
-const { loadWorkflow, saveWorkflow, isMajorWorkflow, peekMutationProbe, settleMutationProbe, settleMutationProbeConservative } = require('./lib/workflow-runtime');
-const { cwdOf, shellProbeKey, isVerificationShell, workspaceFingerprint, directMutationInWorkspace } = require('./lib/workflow-isolation');
+const { cwdOf, classifyShell, isVerificationShell, directMutationInWorkspace } = require('./lib/workflow-isolation');
 const { observeTool } = require('./lib/telemetry');
-
 let inputData = '';
-const timeout = setTimeout(() => {
-  processState(null);
-}, 200);
-
-process.stdin.on('data', chunk => {
-  inputData += chunk;
-});
-
-process.stdin.on('end', () => {
-  clearTimeout(timeout);
-  try {
-    const payload = JSON.parse(inputData.trim());
-    processState(payload);
-  } catch (err) {
-    processState(null);
-  }
-});
-
-function observeWorkspaceMutation(payload, root) {
-  const toolName = payload && (payload.tool_name || payload.tool);
-  if (toolName !== 'Bash' && toolName !== 'PowerShell' && toolName !== 'exec_command') return false;
-  const context = loadWorkflow(payload);
-  if (!context.workflow || context.workflow.state === 'deferred') return false;
-  const cwd = cwdOf(payload, root);
-  const probeKey = shellProbeKey(payload, cwd);
-  const probe = peekMutationProbe(context, probeKey);
-  if (!probe) return false;
-  const observationCwd = probe.observationCwd || cwd;
-  let after;
-  try {
-    after = workspaceFingerprint(observationCwd);
-  } catch (error) {
-    const fingerprintLimited = error && error.code === 'HARNESS_FINGERPRINT_LIMIT';
-    if (!isMajorWorkflow(context.workflow) || fingerprintLimited) {
-      const evidence = fingerprintLimited ? 'fingerprint-limit' : 'unobservable-workspace';
-      const conservative = settleMutationProbeConservative(context, probeKey, toolName, evidence);
-      return Boolean(conservative && conservative.changed);
-    }
-    context.workflow.state = 'blocked';
-    context.workflow.blockReason = 'mutation-observation-failed';
-    saveWorkflow(context);
-    const critical = new Error('cannot verify whether shell execution changed workspace content');
-    critical.code = 'HARNESS_MUTATION_OBSERVATION';
-    throw critical;
-  }
-  const result = settleMutationProbe(context, probeKey, after, toolName);
-  return Boolean(result && result.changed);
-}
-
+const timeout = setTimeout(() => processState(null), 200);
+process.stdin.on('data', chunk => { inputData += chunk; });
+process.stdin.on('end', () => { clearTimeout(timeout); try { processState(JSON.parse(inputData.trim())); } catch (_) { processState(null); } });
 function processState(payload) {
-  let exitCodeForHook = 0;
   try {
     const sessionId = payload && (payload.session_id || payload.sessionId);
     const root = getWorkspaceRoot(payload);
     const stateFile = path.join(getSessionDir(root, sessionId), 'handoff-state.json');
-
-    // Merge into the existing state rather than replacing it, so the
-    // failure/idle status and the Stop-gate milestones can coexist.
     let state = { status: 'idle', timestamp: new Date().toISOString() };
-    if (fs.existsSync(stateFile)) {
-      try { state = JSON.parse(fs.readFileSync(stateFile, 'utf8')); } catch (e) { /* keep default */ }
+    if (fs.existsSync(stateFile)) { try { state = JSON.parse(fs.readFileSync(stateFile, 'utf8')); } catch (_) {} }
+    if (!payload) {
+      if (!fs.existsSync(stateFile)) fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), 'utf8');
+      process.exit(0);
     }
-
-    if (payload) {
-      // Hook hosts nest tool output under tool_response, not at the top
-      // level, and uses tool_name rather than tool. A numeric exit code
-      // also isn't guaranteed to be present at all - only trust it when
-      // it's actually a number; fall back to a stderr signal otherwise.
-      const toolResponse = payload.tool_response || {};
-      const stdout = toolResponse.stdout ?? payload.stdout ?? '';
-      const stderr = toolResponse.stderr ?? payload.stderr ?? payload.error ?? '';
-      const rawExitCode = toolResponse.exitCode ?? toolResponse.exit_code ?? payload.exitCode;
-      const exitCode = typeof rawExitCode === 'number' ? rawExitCode : undefined;
-      const stderrSignal = typeof stderr === 'string' && stderr.trim().length > 0;
-      const hookEvent = payload.hook_event_name || payload.hookEventName || '';
-      const isSuccessEvent = hookEvent === 'PostToolUse';
-      const isFailed = hookEvent === 'PostToolUseFailure' ||
-        (exitCode !== undefined && exitCode !== 0) ||
-        (!isSuccessEvent && exitCode === undefined && stderrSignal);
-      const toolName = payload.tool_name || payload.tool || 'command';
-      const observedMutation = observeWorkspaceMutation(payload, root);
-
-      if (isFailed) {
-        // Truncate output to avoid state bloat
-        let output = (stderrSignal ? stderr : stdout) || payload.output || '';
-        if (output.length > 500) {
-          output = '...' + output.slice(-500);
-        }
-
-        state.status = 'failed';
-        state.timestamp = new Date().toISOString();
-        state.tool = toolName;
-        state.exitCode = exitCode;
-        state.errorSummary = output.trim();
-      } else if (!isFailed && state.status === 'failed') {
-        // Clear failed state or mark as idle/resolved.
-        // NOTE (#166, follows #153): Claude Code Bash PostToolUse payloads
-        // carry no numeric exit code, so `exitCode === 0` never holds there.
-        // A PostToolUse event with no numeric non-zero exit status counts as
-        // success even when stderr contains diagnostics. Hosts that omit the
-        // lifecycle event name retain the conservative stderr fallback.
-        state.lastResolved = { tool: state.tool, timestamp: state.timestamp };
-        state.status = 'idle';
-        state.timestamp = new Date().toISOString();
-        delete state.exitCode;
-        delete state.errorSummary;
-      }
-
-      // Milestones for the Stop gate: when did the last mutation happen, and
-      // has any verification-ish command succeeded since. Direct-tool edits
-      // outside the workspace advance neither milestone (#165).
-      const isDirectTool = toolName === 'Edit' || toolName === 'Write' || toolName === 'apply_patch';
-      if ((isDirectTool && directMutationInWorkspace(payload, cwdOf(payload, root), root)) || observedMutation) {
-        state.lastEditAt = Date.now();
-      }
-      if ((toolName === 'Bash' || toolName === 'PowerShell') && !isFailed) {
-        const command = (payload.tool_input && payload.tool_input.command) || '';
-        if (isVerificationShell(command)) {
-          state.lastVerifyAt = Date.now();
-          state.lastVerifyExitCode = exitCode ?? null;
-        }
-      }
-
-      fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), 'utf8');
-      // Reuse this already-running post-tool hook instead of spawning another
-      // process for every tool solely for telemetry. The observer is fail-open
-      // and stores no command/args/output content.
-      observeTool(payload);
-    } else {
-      // No standard input payload, or invalid JSON. Just maintain a heartbeat timestamp
-      if (!fs.existsSync(stateFile)) {
-        fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), 'utf8');
-      }
+    const toolResponse = payload.tool_response || {};
+    const stdout = toolResponse.stdout ?? payload.stdout ?? '';
+    const stderr = toolResponse.stderr ?? payload.stderr ?? payload.error ?? '';
+    const rawExitCode = toolResponse.exitCode ?? toolResponse.exit_code ?? payload.exitCode;
+    const exitCode = typeof rawExitCode === 'number' ? rawExitCode : undefined;
+    const stderrSignal = typeof stderr === 'string' && stderr.trim().length > 0;
+    const hookEvent = payload.hook_event_name || payload.hookEventName || '';
+    const isSuccessEvent = hookEvent === 'PostToolUse';
+    const isFailed = hookEvent === 'PostToolUseFailure' || (exitCode !== undefined && exitCode !== 0) || (!isSuccessEvent && exitCode === undefined && stderrSignal);
+    const toolName = payload.tool_name || payload.tool || 'command';
+    if (isFailed) {
+      let output = (stderrSignal ? stderr : stdout) || payload.output || '';
+      if (output.length > 500) output = '...' + output.slice(-500);
+      state.status = 'failed'; state.timestamp = new Date().toISOString(); state.tool = toolName; state.exitCode = exitCode; state.errorSummary = output.trim();
+    } else if (state.status === 'failed') {
+      state.lastResolved = { tool: state.tool, timestamp: state.timestamp }; state.status = 'idle'; state.timestamp = new Date().toISOString(); delete state.exitCode; delete state.errorSummary;
     }
-  } catch (err) {
-    if (err && (err.code === 'HARNESS_MUTATION_OBSERVATION' || err.code === 'HARNESS_WORKFLOW_BUDGET')) {
-      console.error('[State Persist] ' + err.message);
-      exitCodeForHook = 2;
+    const isDirectTool = toolName === 'Edit' || toolName === 'Write' || toolName === 'apply_patch';
+    if (isDirectTool && directMutationInWorkspace(payload, cwdOf(payload, root), root)) state.lastEditAt = Date.now();
+    const isShell = toolName === 'Bash' || toolName === 'PowerShell' || toolName === 'exec_command';
+    const command = (payload.tool_input && payload.tool_input.command) || '';
+    if (isShell) {
+      const commandClass = classifyShell(command);
+      if (commandClass !== 'read-only' && commandClass !== 'worktree-setup') state.lastEditAt = Date.now();
+      if (!isFailed && isVerificationShell(command)) { state.lastVerifyAt = Date.now(); state.lastVerifyExitCode = exitCode ?? null; }
     }
-    // Non-critical persistence/telemetry failures remain fail-open.
-  }
-  process.exit(exitCodeForHook);
+    fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), 'utf8');
+    observeTool(payload);
+  } catch (_) {}
+  process.exit(0);
 }

package/plugins/harness-everything/hooks/scripts/stop-gate.js

@@ -1,12 +1,10 @@
 #!/usr/bin/env node
 /**
- * Stop Gate (Stop hook - Claude Code only)
- * The pre-delivery gate (verification-loop) was prose-only, and prose decays
- * as context grows. This makes the one check that matters mechanical: ending
- * the turn with edits that were never followed by a successful
- * verification-ish command (test/build/lint - tracked by state-persist.js)
- * while uncommitted changes sit in the tree gets bounced back ONCE per edit
- * batch. Objective facts only; fails open on any error.
+ * Verification reminder for Stop hooks.
+ *
+ * If uncommitted edits exist and no later successful verification was observed,
+ * emit one concise reminder for this Stop event. No gate state is persisted and
+ * Stop is never rejected.
  */
 const fs = require('fs');
 const path = require('path');
@@ -15,66 +13,35 @@ const { getWorkspaceRoot, getSessionDir } = require('./lib/harness-state');
 
 function decide(payload) {
   try {
-    // Loop guard: if this stop already resulted from a Stop-hook block,
-    // always let it through - one bounce is the contract, never a cage.
-    if (payload && payload.stop_hook_active) {
-      process.exit(0);
-    }
-
     const root = getWorkspaceRoot(payload);
     const sessionDir = getSessionDir(root, payload && (payload.session_id || payload.sessionId));
     const handoffFile = path.join(sessionDir, 'handoff-state.json');
-    const gateFile = path.join(sessionDir, 'stop-gate-state.json');
+    if (!fs.existsSync(handoffFile)) return;
 
-    if (!fs.existsSync(handoffFile)) process.exit(0);
     const handoff = JSON.parse(fs.readFileSync(handoffFile, 'utf8'));
     const lastEditAt = handoff.lastEditAt || 0;
     const lastVerifyAt = handoff.lastVerifyAt || 0;
+    if (!lastEditAt || lastVerifyAt >= lastEditAt) return;
 
-    // No edits this session, or verification already ran after the last edit.
-    if (!lastEditAt || lastVerifyAt >= lastEditAt) process.exit(0);
-
-    // One bounce per edit batch: if we already blocked for this exact edit
-    // timestamp, the model either verified (which moves lastVerifyAt) or
-    // explicitly chose not to - don't nag twice for the same batch.
-    let gate = {};
-    if (fs.existsSync(gateFile)) {
-      try { gate = JSON.parse(fs.readFileSync(gateFile, 'utf8')); } catch (e) { /* ignore */ }
-    }
-    if (gate.blockedForEditAt === lastEditAt) process.exit(0);
-
-    // Only relevant when unverified work is actually sitting in the tree.
     const dirty = execSync('git status --porcelain', {
       cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore']
     }).trim();
-    if (!dirty) process.exit(0);
-
-    fs.writeFileSync(gateFile, JSON.stringify({ blockedForEditAt: lastEditAt }, null, 2), 'utf8');
+    if (!dirty) return;
 
-    console.error(`[Stop Gate] Turn is ending with uncommitted edits and no successful verification command (test/build/lint) since the last edit.`);
-    console.error(`Before delivering: run the relevant check from 'verification-loop' - even a single targeted test beats none.`);
-    console.error(`If verification is genuinely not applicable (docs-only change, analysis-only turn, the Human Partner told you to stop), state that explicitly in your reply and stop again.`);
-    console.error(`This gate bounces at most once per edit batch.`);
-    process.exit(2);
-  } catch (err) {
-    // Fail open - a broken gate must never trap the session.
-    process.exit(0);
+    console.error('[Verification Reminder] Uncommitted edits have no observed successful verification after the latest edit.');
+    console.error("Run a relevant test/build/lint check before claiming completion, or state why verification is not applicable.");
+  } catch (_) {
+    // Reminder infrastructure is always fail-open.
   }
 }
 
 let inputData = '';
-const timeout = setTimeout(() => {
-  decide(null);
-}, 200);
-
+const timeout = setTimeout(() => decide(null), 200);
 process.stdin.on('data', chunk => { inputData += chunk; });
 process.stdin.on('end', () => {
   clearTimeout(timeout);
   let payload = null;
-  try { payload = JSON.parse(inputData.trim()); } catch (err) { /* no payload */ }
+  try { payload = JSON.parse(inputData.trim()); } catch (_) {}
   decide(payload);
 });
-process.stdin.on('error', () => {
-  clearTimeout(timeout);
-  decide(null);
-});
+process.stdin.on('error', () => { clearTimeout(timeout); decide(null); });

package/plugins/harness-everything/hooks/scripts/subagent-scope-guard.js

@@ -161,20 +161,20 @@ process.stdin.on('end', () => {
       atomicWriteJson(path.join(sessionDir, 'subagent-scope-last.json'), audit);
 
       if (newlyChanged.length === 0) {
-        console.log('[Subagent Scope Guard] No new changed files detected during the subagent burst.');
+        console.log('[Subagent Scope Reminder] No new changed files detected during the subagent burst.');
       } else if (declaredContracts.length === 0) {
-        console.error(`[Subagent Scope Guard] ${newlyChanged.length} file(s) changed with no machine-readable writeSet contract:`);
+        console.error(`[Subagent Scope Reminder] ${newlyChanged.length} file(s) changed with no machine-readable writeSet contract:`);
         newlyChanged.forEach(line => console.error(`  ${line}`));
         console.error('Confirm every path was actually in scope before trusting or committing this output.');
       } else {
         for (const entry of classified.expected) {
-          console.log(`[Subagent Scope Guard] in-scope ${entry.statusLine} -> ${entry.planId}/${entry.runId}/${entry.stageId}${entry.workerId ? ` worker=${entry.workerId}` : ''}`);
+          console.log(`[Subagent Scope Reminder] in-scope ${entry.statusLine} -> ${entry.planId}/${entry.runId}/${entry.stageId}${entry.workerId ? ` worker=${entry.workerId}` : ''}`);
         }
         for (const entry of classified.ambiguous) {
-          console.error(`[Subagent Scope Guard] ambiguous scope ${entry.statusLine}; matches ${entry.stages.map(stage => `${stage.runId}/${stage.stageId}`).join(', ')}`);
+          console.error(`[Subagent Scope Reminder] ambiguous scope ${entry.statusLine}; matches ${entry.stages.map(stage => `${stage.runId}/${stage.stageId}`).join(', ')}`);
         }
         for (const entry of classified.outOfScope) {
-          console.error(`[Subagent Scope Guard] OUT-OF-SCOPE ${entry.statusLine}${entry.workerId ? ` worker=${entry.workerId}` : ''}`);
+          console.error(`[Subagent Scope Reminder] OUT-OF-SCOPE ${entry.statusLine}${entry.workerId ? ` worker=${entry.workerId}` : ''}`);
         }
       }
 
@@ -189,7 +189,7 @@ process.stdin.on('end', () => {
         : classified.ambiguous.length > 0 || classified.outOfScope.length > 0;
       if (violated) {
         console.error('Do not "git add -A"; stage files explicitly so unexpected paths stay visible.');
-        process.exit(2);
+        process.exit(0);
       }
       process.exit(0);
     }
@@ -197,8 +197,8 @@ process.stdin.on('end', () => {
     process.exit(0);
   } catch (error) {
     if (error && error.code === 'HARNESS_WORKFLOW_BUDGET') {
-      console.error(`[Subagent Scope Guard] ${error.message}`);
-      process.exit(2);
+      console.error(`[Subagent Scope Reminder] ${error.message}`);
+      process.exit(0);
     }
     // This is otherwise a post-execution visibility gate. Runtime errors fail open;
     // actionGate has a stricter fail-ask policy for side effects.

package/plugins/harness-everything/hooks/scripts/workflow-disposition.js

@@ -3,7 +3,7 @@
 
 const fs = require('fs');
 const path = require('path');
-const { loadWorkflow, saveWorkflow, matchingRun, OPEN_STATES, budgetLimits, ensureWorkflowBudget, recordBudgetEvent, resetWorkflowBudget, syncBudgetToRun, WORKFLOW_CONTROLLER_COMMANDS } = require('./lib/workflow-runtime');
+const { loadWorkflow, saveWorkflow, matchingRun, OPEN_STATES, WORKFLOW_CONTROLLER_COMMANDS } = require('./lib/workflow-runtime');
 const { getWorkspaceRoot, readCurrentSession } = require('./lib/harness-state');
 const { atomicWriteJson, readJson } = require('./lib/fable-contracts');
 
@@ -41,9 +41,6 @@ function activatePlan(workflow, plan) {
   workflow.suggestedSkills = plan.suggestedSkills || [];
   workflow.verification = plan.verification;
   workflow.mutationIsolation = plan.mutationIsolation || { required: false };
-  const budget = ensureWorkflowBudget(workflow);
-  budget.limits = budgetLimits(workflow);
-  budget.updatedAt = new Date().toISOString();
 }
 
 function main() {
@@ -57,8 +54,6 @@ function main() {
   if (args.command === 'start') {
     if (!workflow.workflowId || !workflow.workflowPlan) throw new Error('legacy workflow lacks a correlated plan; cannot start it implicitly');
     if (workflow.state === 'running') throw new Error('workflow already running; record a blocker before replanning');
-    const isReplan = workflow.revision > 0 || Boolean(workflow.runId);
-    if (isReplan) recordBudgetEvent(context, 'replan', { evidence: 'workflow-disposition:start' });
     const plan = workflow.pendingPlan || workflow.workflowPlan;
     if (!String(plan.strategy || '').startsWith('fable-')) {
       activatePlan(workflow, plan);
@@ -90,9 +85,7 @@ function main() {
     delete workflow.pendingPlan;
     delete workflow.blockReason;
   } else if (args.command === 'revision') {
-    recordBudgetEvent(context, 'revision', { evidence: args.evidence || 'workflow-disposition:revision' });
-  } else if (args.command === 'reset-budget') {
-    resetWorkflowBudget(context, args.evidence);
+    console.error('[Workflow Reminder] Revision requested; no hard revision budget is enforced.');
   } else if (args.command === 'escape') {
     if (!ALLOWED_ESCAPE_REASONS.has(args.reasonCode)) throw new Error('generic simple/routine/already-clear reasons are intentionally rejected');
     if (!args.scope?.trim()) throw new Error('--scope is required');
@@ -114,7 +107,6 @@ function main() {
     workflow.blockReason = args.evidence.trim();
   } else throw new Error(usage());
   saveWorkflow(context);
-  syncBudgetToRun(context);
   process.stdout.write(JSON.stringify({ state: workflow.state, workflowId: workflow.workflowId, runId: workflow.runId, revision: workflow.revision, escapes: workflow.escapes }) + '\n');
 }
 try { main(); } catch (error) { console.error('[Workflow Disposition] ' + error.message); process.exitCode = 2; }

package/plugins/harness-everything/hooks/scripts/workflow-gate.js

@@ -1,101 +1,50 @@
 #!/usr/bin/env node
 'use strict';
-
 const path = require('path');
 const fs = require('fs');
-const { loadWorkflow, saveWorkflow, isMajorWorkflow, matchingRun, registerMutationProbe, recordBudgetEvent, readHookInput, WORKFLOW_CONTROLLER_COMMANDS } = require('./lib/workflow-runtime');
-const { key, classifyShell, isVerificationShell, workspaceFingerprint, shellProbeKey, cwdOf, commandOf, mutationPaths, directMutationInWorkspace, linkedWorktree, assertTargets, assertShellScope } = require('./lib/workflow-isolation');
-
+const { loadWorkflow, saveWorkflow, isMajorWorkflow, matchingRun, readHookInput, WORKFLOW_CONTROLLER_COMMANDS } = require('./lib/workflow-runtime');
+const { key, classifyShell, cwdOf, commandOf, mutationPaths, directMutationInWorkspace, linkedWorktree, assertTargets, assertShellScope } = require('./lib/workflow-isolation');
 const DIRECT = new Set(['Edit', 'Write', 'apply_patch']);
 const SHELL = new Set(['Bash', 'PowerShell', 'exec_command']);
-
-function shellTimeoutMs(payload) {
-  const input = payload?.tool_input || payload?.input || {};
-  for (const value of [input.timeout_ms, input.timeoutMs, input.timeout, payload.timeout_ms, payload.timeoutMs]) {
-    const parsed = Number(value);
-    if (Number.isFinite(parsed) && parsed > 0) return parsed;
-  }
-  return null;
-}
-
+function warn(message) { console.error('[Workflow Reminder] ' + message); }
 function isController(command, cwd) {
-  // One trusted local executable, literal arguments, no shell evaluation.
-  if (/[;&|`\r\n<>$(){}]/.test(command)) return false;
+  if (/[;&|\x60\r\n<>$(){}]/.test(command)) return false;
   const match = command.match(/^node\s+(?:"([^"]+)"|'([^']+)'|(\S+))\s+([A-Za-z][A-Za-z0-9-]*)\b/);
   return Boolean(match && WORKFLOW_CONTROLLER_COMMANDS.has(match[4]) &&
     key(path.resolve(cwd, match[1] || match[2] || match[3])) === key(path.join(__dirname, 'workflow-disposition.js')));
 }
-
 function decide(payload) {
   if (!payload) return;
-  const tool = payload.tool_name || payload.tool;
-  if (!DIRECT.has(tool) && !SHELL.has(tool)) return;
-  const context = loadWorkflow(payload);
-  const { workflow, root, sessionDir } = context;
-  if (!workflow || workflow.state === 'deferred') return;
-  const cwd = cwdOf(payload, root);
-  const command = commandOf(payload);
-  const commandClass = SHELL.has(tool) ? classifyShell(command) : 'direct-mutation';
-  if (SHELL.has(tool) && isController(command, cwd)) return;
-  if (commandClass === 'read-only' || commandClass === 'worktree-setup') return;
-  // Only the stage specification is allowed before run entry. Other runtime
-  // state, including workflow-run.json, cannot use this bootstrap exception.
-  const targets = DIRECT.has(tool) ? mutationPaths(payload) : [];
-  const spec = path.join(sessionDir, 'workflow-stages.json');
-  const specStat = fs.existsSync(spec) ? fs.lstatSync(spec) : null;
-  if ((!specStat || (specStat.isFile() && !specStat.isSymbolicLink() && specStat.nlink === 1)) &&
-      targets.length && targets.every(target => key(path.resolve(cwd, target)) === key(spec))) return;
-  if (['blocked', 'failed'].includes(workflow.state)) throw new Error('workflow is BLOCKED; replan through the controller before mutation');
-  if (isMajorWorkflow(workflow)) {
-    const isolatedRoot = linkedWorktree(cwd, root);
-    if (!isolatedRoot) throw new Error('Git worktree isolation is required before mutation. Enter a linked worktree; unavailable isolation means BLOCKED, never in-place fallback.');
-    if (DIRECT.has(tool)) assertTargets(payload, cwd, isolatedRoot);
-    else assertShellScope(command, cwd, isolatedRoot);
-  }
-  if (workflow.state === 'satisfied') throw new Error('workflow is already satisfied; submit a new task before further mutation');
-  if (String(workflow.strategy || '').startsWith('fable-') && !matchingRun(context)) {
-    throw new Error('selected Fable workflow has no correlated run. Write workflow-stages.json at the displayed session path, then use workflow-disposition.js start.');
-  }
-  if (DIRECT.has(tool)) {
-    // Bookkeeping outside the workspace (scratchpad, memory files, temp
-    // notes) is not a workspace mutation: it consumes no Tier-2 iteration
-    // and advances no mutation milestone (#165).
-    if (!directMutationInWorkspace(payload, cwd, root)) return;
-    if (workflow.strategy === 'iterative-single') {
-      recordBudgetEvent(context, 'iteration', { evidence: `${tool}:direct-mutation` });
-    }
-    workflow.lastMutationAt = Date.now();
-    saveWorkflow(context);
-    return;
-  }
-
-  // Shell safety and shell mutation accounting are intentionally separate.
-  // `untrusted` means "not proven read-only", not "a mutation occurred".
-  // Capture an opaque pre-execution workspace fingerprint when possible. A
-  // non-major workflow may run outside Git, where mutation observation is an
-  // accounting aid rather than an isolation boundary; degrade conservatively
-  // instead of blocking the user's command (#162).
-  let fingerprint;
   try {
-    fingerprint = workspaceFingerprint(cwd);
-  } catch (error) {
-    const fingerprintLimited = error && error.code === 'HARNESS_FINGERPRINT_LIMIT';
-    if (isMajorWorkflow(workflow) && !fingerprintLimited) throw error;
-    const evidence = fingerprintLimited ? 'shell:fingerprint-limit' : 'shell:unobservable-workspace';
-    if (workflow.strategy === 'iterative-single') {
-      recordBudgetEvent(context, 'iteration', { evidence });
+    const tool = payload.tool_name || payload.tool;
+    if (!DIRECT.has(tool) && !SHELL.has(tool)) return;
+    const context = loadWorkflow(payload);
+    const { workflow, root, sessionDir } = context;
+    if (!workflow || workflow.state === 'deferred') return;
+    const cwd = cwdOf(payload, root), command = commandOf(payload);
+    const commandClass = SHELL.has(tool) ? classifyShell(command) : 'direct-mutation';
+    if (SHELL.has(tool) && isController(command, cwd)) return;
+    if (commandClass === 'read-only' || commandClass === 'worktree-setup') return;
+    const targets = DIRECT.has(tool) ? mutationPaths(payload) : [];
+    const spec = path.join(sessionDir, 'workflow-stages.json');
+    const specStat = fs.existsSync(spec) ? fs.lstatSync(spec) : null;
+    if ((!specStat || (specStat.isFile() && !specStat.isSymbolicLink() && specStat.nlink === 1)) &&
+        targets.length && targets.every(target => key(path.resolve(cwd, target)) === key(spec))) return;
+    if (['blocked', 'failed'].includes(workflow.state)) warn('Workflow is marked ' + workflow.state.toUpperCase() + '; review the recorded reason before continuing.');
+    if (workflow.state === 'satisfied') warn('Workflow was already marked satisfied; confirm this mutation belongs to the current task.');
+    if (String(workflow.strategy || '').startsWith('fable-') && !matchingRun(context)) warn('Selected Fable workflow has no correlated run; consider creating/updating the stage map before broad changes.');
+    if (isMajorWorkflow(workflow)) {
+      const isolatedRoot = linkedWorktree(cwd, root);
+      if (!isolatedRoot) warn('This is a major workflow; a linked Git worktree is strongly recommended before mutation.');
+      else {
+        try { if (DIRECT.has(tool)) assertTargets(payload, cwd, isolatedRoot); else assertShellScope(command, cwd, isolatedRoot); }
+        catch (error) { warn(error.message); }
+      }
+    }
+    if (DIRECT.has(tool) && directMutationInWorkspace(payload, cwd, root)) {
+      workflow.lastMutationAt = Date.now();
+      saveWorkflow(context);
     }
-    workflow.lastMutationAt = Date.now();
-    saveWorkflow(context);
-    return;
-  }
-  const probeKey = shellProbeKey(payload, cwd);
-  const iterative = workflow.strategy === 'iterative-single';
-  registerMutationProbe(context, probeKey, fingerprint, iterative, cwd, {
-    countIteration: iterative,
-    allowAtLimit: iterative && isVerificationShell(command),
-    timeoutMs: shellTimeoutMs(payload),
-  });
+  } catch (error) { warn(error && error.message ? error.message : String(error)); }
 }
-
 readHookInput(decide);

package/plugins/harness-everything/hooks/scripts/workflow-mutation-denied.js

@@ -1,17 +1,5 @@
 #!/usr/bin/env node
 'use strict';
-
-const { loadWorkflow, discardMutationProbe, readHookInput } = require('./lib/workflow-runtime');
-const { cwdOf, shellProbeKey } = require('./lib/workflow-isolation');
-
-function discardDenied(payload) {
-  if (!payload) return;
-  const tool = payload.tool_name || payload.tool;
-  if (tool !== 'Bash' && tool !== 'PowerShell' && tool !== 'exec_command') return;
-  const context = loadWorkflow(payload);
-  if (!context.workflow || context.workflow.state === 'deferred') return;
-  const cwd = cwdOf(payload, context.root);
-  discardMutationProbe(context, shellProbeKey(payload, cwd));
-}
-
-readHookInput(discardDenied);
+// Compatibility no-op: mutation reservations were removed by #190.
+const { readHookInput } = require('./lib/workflow-runtime');
+readHookInput(() => {});

package/plugins/harness-everything/hooks/scripts/workflow-stop-gate.js

@@ -1,52 +1,37 @@
 #!/usr/bin/env node
 'use strict';
-
 const path = require('path');
 const { readJson } = require('./lib/fable-contracts');
 const { loadWorkflow, saveWorkflow, matchingRun, unresolvedStages, readHookInput } = require('./lib/workflow-runtime');
-
+function warn(message) { console.error('[Workflow Reminder] ' + message); }
 function decide(payload) {
   if (!payload) return;
-  const context = loadWorkflow(payload);
-  const { workflow, sessionDir } = context;
-  if (!workflow || ['deferred', 'satisfied'].includes(workflow.state)) return;
-  if (workflow.state === 'blocked') {
-    console.error('[Workflow Completion Gate] BLOCKED: report the unresolved work; completion has not been verified.');
-    return;
-  }
-  let unresolved = [];
-  if (String(workflow.strategy || '').startsWith('fable-')) {
-    const match = matchingRun(context);
-    unresolved = match ? unresolvedStages(match, workflow) : ['correlated-run-missing'];
-  } else {
+  try {
+    const context = loadWorkflow(payload);
+    const { workflow, sessionDir } = context;
+    if (!workflow || workflow.state === 'deferred') return;
     const handoff = readJson(path.join(sessionDir, 'handoff-state.json'));
-    const lastEdit = Math.max(workflow.lastMutationAt || 0, handoff?.lastEditAt || 0);
-    // state-persist.js only ever records lastVerifyAt/lastVerifyExitCode from
-    // its `!isFailed` branch, so reaching this timestamp already proves the
-    // command succeeded. Do not additionally require lastVerifyExitCode===0:
-    // hosts are not guaranteed to report a numeric exit code at all (some
-    // PostToolUse payloads omit it entirely), in which case state-persist.js
-    // correctly records success with lastVerifyExitCode: null, and requiring
-    // a literal 0 here would make this gate permanently unresolvable on that
-    // host after any edit.
-    if (lastEdit && (handoff?.lastVerifyAt || 0) < lastEdit) unresolved = ['verification-after-edit-missing'];
-  }
-  if (unresolved.length) {
-    workflow.unresolved = unresolved;
-    if (payload.stop_hook_active) {
-      // Do not loop forever or pretend the retry satisfied the contract.
-      workflow.state = 'blocked';
-      workflow.blockReason = 'unresolved-stop-retry';
+    let unresolved = [];
+    if (String(workflow.strategy || '').startsWith('fable-')) {
+      const match = matchingRun(context);
+      unresolved = match ? unresolvedStages(match, workflow, handoff?.lastEditAt || 0) : ['correlated-run-missing'];
+    } else {
+      const lastEdit = Math.max(workflow.lastMutationAt || 0, handoff?.lastEditAt || 0);
+      if (lastEdit && (handoff?.lastVerifyAt || 0) < lastEdit) unresolved = ['verification-after-edit-missing'];
+    }
+    const wasBlocked = workflow.state === 'blocked';
+    if (wasBlocked) warn('Workflow is marked BLOCKED; report or revisit the recorded blocker, but Harness will not trap the session.');
+    if (unresolved.length) {
+      workflow.unresolved = unresolved;
       saveWorkflow(context);
-      console.error('[Workflow Completion Gate] BLOCKED: ' + unresolved.join(', ') + '. Report the blocker; this is not completion.');
+      warn('Unresolved workflow evidence: ' + unresolved.join(', ') + '. Verify/review before claiming completion.');
       return;
     }
+    if (wasBlocked) return;
+    workflow.state = 'satisfied';
+    workflow.resolvedAt = new Date().toISOString();
+    workflow.unresolved = [];
     saveWorkflow(context);
-    throw new Error('Cannot complete: unresolved workflow obligations: ' + unresolved.join(', '));
-  }
-  workflow.state = 'satisfied';
-  workflow.resolvedAt = new Date().toISOString();
-  workflow.unresolved = [];
-  saveWorkflow(context);
+  } catch (error) { warn(error && error.message ? error.message : String(error)); }
 }
 readHookInput(decide);

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.16.0",
+  "version": "0.16.2",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",