harness-everything 0.16.0 → 0.16.2

package/ci/mechanism-2a-rule-of-3.test.js

@@ -4,178 +4,113 @@ const helper = require('./test-helper');
 
 console.log('\n[2a] Rule of 3 circuit breaker...');
 
-const hooksConfig = JSON.parse(
-  fs.readFileSync(path.join(helper.root, 'hooks', 'hooks.json'), 'utf8')
-);
-const failureTrackerHook = (hooksConfig.hooks.PostToolUseFailure || [])
-  .find(entry => entry.id === 'harness:post-failure:rule-of-3-tracker');
+const hooksConfig = JSON.parse(fs.readFileSync(path.join(helper.root, 'hooks', 'hooks.json'), 'utf8'));
+const preRuleHook = (hooksConfig.hooks.PreToolUse || []).find(entry => entry.id === 'harness:pre:rule-of-3');
+const successTrackerHook = (hooksConfig.hooks.PostToolUse || []).find(entry => entry.id === 'harness:post:rule-of-3-tracker');
+const failureTrackerHook = (hooksConfig.hooks.PostToolUseFailure || []).find(entry => entry.id === 'harness:post-failure:rule-of-3-tracker');
+const matcherHas = (entry, tool) => Boolean(entry && String(entry.matcher || '').split('|').includes(tool));
 helper.check(
-  '2a-claude-wiring. PostToolUseFailure invokes the Rule-of-3 tracker',
-  failureTrackerHook &&
-    failureTrackerHook.matcher === 'Bash|PowerShell' &&
+  '2a-wiring. PostToolUseFailure invokes the Rule-of-3 tracker',
+  matcherHas(failureTrackerHook, 'Bash') && matcherHas(failureTrackerHook, 'PowerShell') &&
+    matcherHas(failureTrackerHook, 'apply_patch') &&
     failureTrackerHook.hooks?.some(hook => hook.command.includes('rule-of-3-tracker.js')),
-  `Hook=${JSON.stringify(failureTrackerHook)}`
+  JSON.stringify(failureTrackerHook)
+);
+helper.check(
+  '2a-wiring. apply_patch is covered before and after execution',
+  matcherHas(preRuleHook, 'apply_patch') && matcherHas(successTrackerHook, 'apply_patch') && matcherHas(failureTrackerHook, 'apply_patch'),
+  JSON.stringify({ preRuleHook, successTrackerHook, failureTrackerHook })
 );
 
-const claudeFailurePayload = {
+const failure = {
   hook_event_name: 'PostToolUseFailure',
   tool_name: 'Bash',
   tool_input: { command: 'node -e "process.exit(1)"' },
   error: 'Exit code 1\ncommand failed',
   session_id: helper.SESSION_ID,
 };
-const failureRuns = [1, 2, 3].map(() =>
-  helper.runHook('rule-of-3-tracker.js', claudeFailurePayload)
-);
-const trackedFailureState = helper.readState('rule-of-3-state.json');
+for (let i = 0; i < 3; i++) helper.runHook('rule-of-3-tracker.js', failure);
+let state = helper.readState('rule-of-3-state.json');
 helper.check(
-  '2a-claude-failure. PostToolUseFailure error payload increments the same signature to threshold',
-  failureRuns.every(result => result.code === 0) &&
-    trackedFailureState.count === 3 &&
-    trackedFailureState.threshold === 3 &&
-    trackedFailureState.lastHash &&
-    trackedFailureState.zoomOutResolved === false,
-  `Runs=${JSON.stringify(failureRuns)}, state=${JSON.stringify(trackedFailureState)}`
+  '2a-three. exactly three matching failures arm zoom-out',
+  state.count === 3 && state.lastHash && state.zoomOutResolved === false && state.threshold === undefined,
+  JSON.stringify(state)
 );
 
-const claudeTripResult = helper.runHook('rule-of-3.js', {
-  hook_event_name: 'PreToolUse',
-  tool_name: 'Bash',
-  tool_input: { command: 'echo retry' },
-  session_id: helper.SESSION_ID,
-});
+const trip = helper.runHook('rule-of-3.js', { hook_event_name: 'PreToolUse', tool_name: 'Bash', session_id: helper.SESSION_ID });
 helper.check(
-  '2a-claude-trip. Tracked Claude failures block the next mutation',
-  claudeTripResult.code === 2 &&
-    claudeTripResult.stderr.includes('RULE OF 3 CIRCUIT BREAKER TRIGGERED'),
-  `Got exit=${claudeTripResult.code}, stderr="${claudeTripResult.stderr.slice(0, 200)}"`
+  '2a-trip. third matching failure blocks mutation for reflection',
+  trip.code === 2 && trip.stderr.includes('RULE OF 3 CIRCUIT BREAKER TRIGGERED'),
+  trip.stderr
 );
 
-const successResult = helper.runHook('rule-of-3-tracker.js', {
-  hook_event_name: 'PostToolUse',
-  tool_name: 'Bash',
-  tool_input: { command: 'echo success' },
-  tool_response: { stdout: 'success', stderr: '', exitCode: 0 },
-  session_id: helper.SESSION_ID,
-});
-const resetState = helper.readState('rule-of-3-state.json');
+helper.writeState('rule-of-3-state.json', { count: 3, lastHash: 'mech-test', zoomOutResolved: false, lastFailureAt: 0, zoomOutCycles: 0 });
+fs.writeFileSync(path.join(helper.sessionDir, 'zoom-out-report.md'),
+  '## Goal\nx\n## Failed Attempts\nx\n## Verified Facts\nx\n## Diagnosis\nx\n## Decision\nRESUME: new approach\n', 'utf8');
+const release = helper.runHook('rule-of-3.js', { session_id: helper.SESSION_ID });
+state = helper.readState('rule-of-3-state.json');
 helper.check(
-  '2a-claude-success. Confirmed PostToolUse success keeps the existing reset behavior',
-  successResult.code === 0 &&
-    resetState.count === 0 &&
-    resetState.zoomOutResolved === true &&
-    resetState.zoomOutCycles === 0,
-  `Got exit=${successResult.code}, state=${JSON.stringify(resetState)}`
+  '2a-release. valid reflection releases breaker and resets count',
+  release.code === 0 && state.count === 0 && state.zoomOutResolved === true && state.zoomOutCycles === 1,
+  JSON.stringify(state)
 );
 
-helper.runHook('rule-of-3-tracker.js', claudeFailurePayload);
-const claudeNoExitSuccess = helper.runHook('rule-of-3-tracker.js', {
-  hook_event_name: 'PostToolUse',
-  tool_name: 'Bash',
-  tool_input: { command: 'echo recovered' },
-  tool_response: {
-    stdout: 'recovered',
-    stderr: 'warning: successful command emitted an error-like diagnostic',
-  },
-  session_id: helper.SESSION_ID,
-});
-const noExitResetState = helper.readState('rule-of-3-state.json');
+helper.writeState('rule-of-3-state.json', { count: 3, lastHash: 'mech-test', zoomOutResolved: false, lastFailureAt: Date.now() + 60000, zoomOutCycles: 1 });
+const retrip = helper.runHook('rule-of-3.js', { session_id: helper.SESSION_ID });
 helper.check(
-  '2a-claude-success-no-exit. PostToolUse without exitCode resets even with stderr diagnostics',
-  claudeNoExitSuccess.code === 0 &&
-    noExitResetState.count === 0 &&
-    noExitResetState.zoomOutResolved === true,
-  `Got exit=${claudeNoExitSuccess.code}, state=${JSON.stringify(noExitResetState)}`
+  '2a-repeat. later three-failure cycle requests another zoom-out, not permanent hard lock',
+  retrip.code === 2 && retrip.stderr.includes('RULE OF 3 CIRCUIT BREAKER TRIGGERED') && !/hard lock|repeat trip/i.test(retrip.stderr),
+  retrip.stderr
 );
 
-helper.writeState('rule-of-3-state.json', {
-  count: 0, lastHash: null, zoomOutResolved: false, zoomOutCycles: 0, lastFailureAt: 0,
+helper.writeState('rule-of-3-state.json', { count: 0, lastHash: null, zoomOutResolved: false, zoomOutCycles: 0, lastFailureAt: 0 });
+for (let i = 0; i < 2; i++) helper.runHook('rule-of-3-tracker.js', {
+  hook_event_name: 'PostToolUseFailure', tool_name: 'Bash',
+  tool_input: { command: 'cat protected.txt' }, error: 'EACCES: permission denied, open protected.txt',
+  session_id: helper.SESSION_ID,
 });
+state = helper.readState('rule-of-3-state.json');
+helper.check('2a-category. permission failures still use the same threshold of three', state.count === 2 && state.category === 'permission' && state.threshold === undefined, JSON.stringify(state));
+const beforeThird = helper.runHook('rule-of-3.js', { session_id: helper.SESSION_ID });
+helper.check('2a-category-two. two permission failures do not trip early', beforeThird.code === 0, beforeThird.stderr);
 helper.runHook('rule-of-3-tracker.js', {
-  hook_event_name: 'PostToolUseFailure',
-  tool_name: 'Bash',
-  tool_input: { command: 'diff -rq hooks cache-hooks' },
-  error: 'Exit code 1\nworkflow-mutation-denied.js\nFiles hooks/a.js and cache-hooks/a.js differ',
+  hook_event_name: 'PostToolUseFailure', tool_name: 'Bash',
+  tool_input: { command: 'cat protected.txt' }, error: 'EACCES: permission denied, open protected.txt',
   session_id: helper.SESSION_ID,
 });
-const deniedFilenameState = helper.readState('rule-of-3-state.json');
-helper.check(
-  '2a-category-negative. File name containing denied stays unknown/threshold 3',
-  deniedFilenameState.category === 'unknown' && deniedFilenameState.threshold === 3,
-  `State=${JSON.stringify(deniedFilenameState)}`
-);
+const third = helper.runHook('rule-of-3.js', { session_id: helper.SESSION_ID });
+helper.check('2a-category-three. third permission failure trips normally', third.code === 2, third.stderr);
 
-helper.writeState('rule-of-3-state.json', {
-  count: 0, lastHash: null, zoomOutResolved: false, zoomOutCycles: 0, lastFailureAt: 0,
-});
-helper.runHook('rule-of-3-tracker.js', {
+helper.writeState('rule-of-3-state.json', { count: 0, lastHash: null, lastOperationHash: null, zoomOutResolved: false, zoomOutCycles: 0, lastFailureAt: 0 });
+const repeatedFailure = {
   hook_event_name: 'PostToolUseFailure',
   tool_name: 'Bash',
-  tool_input: { command: 'cat protected.txt' },
-  error: 'EACCES: permission denied, open protected.txt',
+  tool_input: { command: 'node flaky.js' },
+  error: 'Error: flaky failure',
   session_id: helper.SESSION_ID,
-});
-const permissionState = helper.readState('rule-of-3-state.json');
-helper.check(
-  '2a-category-permission. Real EACCES is permission/threshold 2',
-  permissionState.category === 'permission' && permissionState.threshold === 2,
-  `State=${JSON.stringify(permissionState)}`
-);
-
-helper.writeState('rule-of-3-state.json', {
-  count: 0, lastHash: null, zoomOutResolved: false, zoomOutCycles: 0, lastFailureAt: 0,
-});
+};
+helper.runHook('rule-of-3-tracker.js', repeatedFailure);
+helper.runHook('rule-of-3-tracker.js', repeatedFailure);
 helper.runHook('rule-of-3-tracker.js', {
-  hook_event_name: 'PostToolUseFailure',
+  hook_event_name: 'PostToolUse',
   tool_name: 'Bash',
-  tool_input: { command: 'node slow.js' },
-  error: 'TimeoutError: operation timed out',
+  tool_input: { command: 'git status --short' },
+  tool_response: { exitCode: 0, stdout: '' },
   session_id: helper.SESSION_ID,
 });
-const timeoutState = helper.readState('rule-of-3-state.json');
-helper.check(
-  '2a-category-timeout. Real timeout is timeout/threshold 2',
-  timeoutState.category === 'timeout' && timeoutState.threshold === 2,
-  `State=${JSON.stringify(timeoutState)}`
-);
-
-helper.writeState('rule-of-3-state.json', { count: 3, lastHash: 'mech-test', zoomOutResolved: false });
-const tripResult = helper.runHook('rule-of-3.js', { session_id: helper.SESSION_ID });
-helper.check(
-  '2a. Trips at count=3 (exit=2, CRITICAL banner)',
-  tripResult.code === 2 && tripResult.stderr.includes('RULE OF 3 CIRCUIT BREAKER TRIGGERED'),
-  `Got exit=${tripResult.code}, stderr="${tripResult.stderr.slice(0, 200)}"`
-);
-
-helper.writeState('rule-of-3-state.json', {
-  count: 3, lastHash: 'mech-test', zoomOutResolved: false, lastFailureAt: 0, zoomOutCycles: 0,
-});
-fs.writeFileSync(
-  path.join(helper.sessionDir, 'zoom-out-report.md'),
-  '## Goal\nx\n## Failed Attempts\nx\n## Verified Facts\nx\n## Diagnosis\nx\n## Decision\nRESUME: new approach\n',
-  'utf8'
-);
-const releaseResult = helper.runHook('rule-of-3.js', { session_id: helper.SESSION_ID });
-const releasedState = helper.readState('rule-of-3-state.json');
-helper.check(
-  '2a-bis. Valid zoom-out report releases the breaker (exit=0, count reset)',
-  releaseResult.code === 0 &&
-    releaseResult.stdout.includes('breaker released') &&
-    releasedState.count === 0 &&
-    releasedState.zoomOutResolved === true &&
-    releasedState.zoomOutCycles === 1,
-  `Got exit=${releaseResult.code}, state=${JSON.stringify(releasedState)}`
-);
-
-helper.writeState('rule-of-3-state.json', {
-  count: 3, lastHash: 'mech-test', zoomOutResolved: false,
-  lastFailureAt: Date.now() + 60000, zoomOutCycles: 1,
+state = helper.readState('rule-of-3-state.json');
+helper.check('2a-interleaved. unrelated success preserves the matching failure count', state.count === 2 && state.lastHash, JSON.stringify(state));
+helper.runHook('rule-of-3-tracker.js', repeatedFailure);
+state = helper.readState('rule-of-3-state.json');
+helper.check('2a-interleaved-three. third matching failure still arms zoom-out after unrelated success', state.count === 3 && state.zoomOutResolved === false, JSON.stringify(state));
+helper.runHook('rule-of-3-tracker.js', {
+  hook_event_name: 'PostToolUse',
+  tool_name: 'Bash',
+  tool_input: { command: 'node flaky.js' },
+  tool_response: { exitCode: 0, stdout: 'recovered' },
+  session_id: helper.SESSION_ID,
 });
-const hardLockResult = helper.runHook('rule-of-3.js', { session_id: helper.SESSION_ID });
-helper.check(
-  '2a-ter. Second trip on same signature hard-locks (exit=2, repeat trip)',
-  hardLockResult.code === 2 && hardLockResult.stderr.includes('repeat trip - hard lock'),
-  `Got exit=${hardLockResult.code}, stderr="${hardLockResult.stderr.slice(0, 200)}"`
-);
+state = helper.readState('rule-of-3-state.json');
+helper.check('2a-resolved. same-operation success clears the resolved signature', state.count === 0 && state.lastHash === null && state.lastOperationHash === null, JSON.stringify(state));
 
 helper.finish();

package/ci/mechanism-2ac-atomic-commit-check.test.js

@@ -87,7 +87,7 @@ try {
   fs.writeFileSync(path.join(repo, 'tracked.txt'), 'changed\n', 'utf8');
   const dirtyResults = sixInvocations({ session: 'dirty-tree', target: path.join(repo, 'tracked.txt') });
   assert.ok(dirtyResults.slice(0, 5).every(result => result.status === 0), 'first five in-workspace edits remain non-blocking');
-  assert.strictEqual(dirtyResults[5].status, 2, 'sixth in-workspace edit with uncommitted changes nudges');
+  assert.strictEqual(dirtyResults[5].status, 0, 'sixth in-workspace edit with uncommitted changes remains non-blocking');
   assert.match(String(dirtyResults[5].stderr || ''), /6 edits since the last commit/, 'nudge wording is tool-neutral');
   assert.doesNotMatch(String(dirtyResults[5].stderr || ''), /apply_patch calls/, 'nudge no longer claims all edits are apply_patch calls');
 
@@ -97,7 +97,7 @@ try {
     tool: 'apply_patch',
     patch: '*** Begin Patch\n*** Update File: tracked.txt\n@@\n-old\n+new\n*** End Patch',
   });
-  assert.strictEqual(patchResults[5].status, 2, 'in-workspace apply_patch header participates in the threshold');
+  assert.strictEqual(patchResults[5].status, 0, 'in-workspace apply_patch reminder threshold remains non-blocking');
 
   // Moving HEAD resets the counter for the same session.
   git(['add', 'tracked.txt']);

package/ci/mechanism-2af-worktree-isolation.test.js

@@ -1,198 +1,40 @@
 #!/usr/bin/env node
 'use strict';
-
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-const { spawnSync } = require('child_process');
-
-const ROOT = path.resolve(__dirname, '..');
-const GATE = path.join(ROOT, 'hooks', 'scripts', 'workflow-gate.js');
-let failed = 0;
-
-function check(condition, message) {
-  if (condition) console.log(`✅ worktree-isolation: ${message}`);
-  else { console.error(`❌ worktree-isolation: ${message}`); failed++; }
-}
-
-function git(cwd, args) {
-  return spawnSync('git', args, { cwd, encoding: 'utf8', windowsHide: true });
-}
-
-const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-worktree-isolation-'));
-const home = path.join(temp, 'home');
-const repo = path.join(temp, 'repo');
-const linked = path.join(temp, 'repo-linked');
-fs.mkdirSync(home, { recursive: true });
-fs.mkdirSync(repo, { recursive: true });
-
-const env = {
-  ...process.env,
-  HOME: home,
-  USERPROFILE: home,
-  HARNESS_STATE_HOME: path.join(home, '.agents', 'harness-everything'),
-  CLAUDE: '1',
-};
-process.env.HARNESS_STATE_HOME = env.HARNESS_STATE_HOME;
-process.env.HOME = home;
-process.env.USERPROFILE = home;
-
-try {
-  if (process.platform === 'win32') {
-    const { key } = require('../hooks/scripts/lib/workflow-isolation');
-    const shortProgramFiles = path.join(process.env.SystemDrive || 'C:', 'PROGRA~1');
-    if (fs.existsSync(shortProgramFiles)) {
-      check(key(shortProgramFiles) === key(fs.realpathSync.native(shortProgramFiles)), 'Windows short and long path spellings identify the same physical directory');
-    }
-  }
-  check(git(repo, ['init']).status === 0, 'fixture git repository initializes');
-  fs.writeFileSync(path.join(repo, 'README.md'), 'fixture\n', 'utf8');
-  check(git(repo, ['add', 'README.md']).status === 0, 'fixture file stages');
-  check(git(repo, ['-c', 'user.name=Harness Test', '-c', 'user.email=harness@example.invalid', 'commit', '-m', 'fixture']).status === 0, 'fixture baseline commits');
-
-  const workspace = require(path.join(ROOT, 'scripts', 'lib', 'workspace'));
-  const state = require(path.join(ROOT, 'hooks', 'scripts', 'lib', 'harness-state'));
-  const sessionId = 'worktree-isolation-test';
-  const context = { session_id: sessionId, host_id: 'mechanism-test', cwd: repo };
-  workspace.bindWorkspaceSession(sessionId, repo, context, true);
-  const sessionDir = state.getSessionDir(repo, sessionId, context);
-  const workflowFile = path.join(sessionDir, 'workflow-run.json');
-
-  function writeWorkflow(tier, strategy) {
-    fs.writeFileSync(workflowFile, `${JSON.stringify({
-      schemaVersion: 1,
-      createdAt: new Date().toISOString(),
-      createdAtMs: Date.now(),
-      sessionId,
-      tier,
-      strategy,
-      state: 'active',
-    }, null, 2)}\n`, 'utf8');
-  }
-
-  function runGate(tool, cwd, input = {}) {
-    const payload = {
-      session_id: sessionId,
-      host_id: 'mechanism-test',
-      cwd,
-      tool_name: tool,
-      tool_input: input,
-    };
-    return spawnSync(process.execPath, [GATE], {
-      cwd: ROOT,
-      env,
-      input: JSON.stringify(payload),
-      encoding: 'utf8',
-    });
-  }
-
-  // Tier 3 isolation is independent of the selected execution topology.
-  writeWorkflow('tier3', 'iterative-single');
-
-  const primaryWrite = runGate('Write', repo, { file_path: path.join(repo, 'src.js'), content: 'x' });
-  check(primaryWrite.status === 2, 'Tier 3 direct write is blocked in the primary working tree');
-  check(/worktree isolation/i.test(primaryWrite.stderr), 'blocked write explains the isolation requirement');
-
-  const primaryDelete = runGate('Bash', repo, { command: 'rm -rf src' });
-  check(primaryDelete.status === 2, 'Tier 3 destructive shell mutation is blocked in the primary working tree');
-
-  for (const command of ['git status > tracked.txt', 'git log --output=tracked.txt', 'find . -delete', 'fd -x rm', 'rg --pre touch x', 'git show $(touch tracked.txt)', 'Get-Content (Remove-Item src)']) {
-    check(runGate('Bash', repo, { command }).status === 2, `shell side effect is not read-only: ${command}`);
-  }
-
-  const chainedBypass = runGate('Bash', repo, { command: 'git status --short && rm -rf src' });
-  check(chainedBypass.status === 2, 'read-only prefix cannot hide a chained mutation');
-
-  const readOnly = runGate('Bash', repo, { command: 'git status --short' });
-  check(readOnly.status === 0, 'read-only discovery remains allowed before isolation');
-
-  // #82-family follow-up: chaining/redirects that are hidden behind the old
-  // blanket metacharacter reject must stay blocked, but a compound command
-  // whose every segment is independently trusted read-only must not burn
-  // iteration budget or the mutation-timestamp just because it uses `;`,
-  // `&&`, `|`, or a non-writing `2>&1` redirect.
-  for (const command of [
-    'git status --short; git log --oneline -1',
-    'git status --short && git log --oneline -1',
-    'git log --oneline -1 | head -1',
-    'echo hello',
-    'echo hello; git status --short',
-    'git status --short 2>&1',
-    'gh issue view 1 --repo octocat/hello-world --json number,title 2>&1',
-    'gh pr list --repo octocat/hello-world --json number | head -1',
-    'gh repo view octocat/hello-world --json name',
-    'gh auth status',
-    'cat README.md | grep fixture',
-    'grep -n "fixture\\|missing" README.md | head -20',
-    "grep -n 'fixture|missing' README.md | head -20",
-    'echo "fixture|missing" | grep fixture',
-    'git log --grep="fix|feat" | head -5',
-    "grep 'fixture;missing' README.md | head -1",
-    'grep fixture\\|missing README.md | head -1',
-    'echo "2>&1"',
-    'echo "safe; rm -rf src"',
-  ]) {
-    check(runGate('Bash', repo, { command }).status === 0, `trusted read-only chain remains allowed: ${command}`);
-  }
-
-  for (const command of [
-    'git status --short; rm -rf src',
-    'git status --short | rm -rf src',
-    'echo hi & rm -rf src',
-    'git status --short > tracked.txt',
-    'git status --short 2>tracked.txt',
-    'git worktree add "harness-chain-probe" -b harness-chain-probe; rm -rf src',
-    'gh issue comment 1 --body hi',
-    'gh issue close 1',
-    'git status --short || rm -rf src',
-    'grep "unterminated README.md | head -1',
-    "grep 'unterminated README.md | head -1",
-    'echo safe | rm -rf src',
-  ]) {
-    check(runGate('Bash', repo, { command }).status === 2, `chained/redirected command is not read-only: ${command}`);
-  }
-
-  const setup = runGate('Bash', repo, { command: `git worktree add "${linked}" -b harness-isolation-test` });
-  check(setup.status === 0, 'git worktree creation is allowed as the isolation transition');
-
-  const createLinked = git(repo, ['worktree', 'add', linked, '-b', 'harness-isolation-test']);
-  check(createLinked.status === 0, 'fixture linked worktree is created');
-
-  const isolatedWrite = runGate('Write', linked, { file_path: path.join(linked, 'src.js'), content: 'x' });
-  check(isolatedWrite.status === 0, `Tier 3 mutation is allowed after entering a linked worktree (${isolatedWrite.stderr.trim() || 'allowed'})`);
-
-  check(runGate('Write', linked, { file_path: path.join(repo, 'src.js') }).status === 2, 'linked cwd cannot authorize a primary-tree target');
-  check(runGate('Write', linked, { file_path: '../repo/src.js' }).status === 2, 'relative traversal cannot escape the worktree');
-  check(runGate('apply_patch', linked, `*** Begin Patch\n*** Add File: ${path.join(repo, 'src.js')}\n+x\n*** End Patch`).status === 2, 'raw patch targets are checked');
-  check(runGate('apply_patch', linked, { patch: `*** Begin Patch\n*** Update File: README.md\n*** Move to: ${path.join(repo, 'moved.md')}\n@@\n-fixture\n+x\n*** End Patch` }).status === 2, 'patch move destination cannot escape isolation');
-  check(runGate('exec_command', repo, { cmd: 'rm -rf src', workdir: repo }).status === 2, 'native shell alias cannot skip mutation gating');
-  check(runGate('Bash', linked, { command: `rm "${path.join(repo, 'README.md')}"` }).status === 2, 'explicit primary-tree shell target is blocked');
-  check(runGate('Bash', linked, { command: 'cd ../repo && node build.js' }).status === 2, 'shell directory change cannot hide the effective working directory');
-  check(runGate('Write', linked, {}).status === 2, 'unknown direct target is blocked');
-  const junction = path.join(linked, 'outside');
-  fs.symlinkSync(repo, junction, process.platform === 'win32' ? 'junction' : 'dir');
-  check(runGate('Write', linked, { file_path: path.join(junction, 'src.js') }).status === 2, 'symlink or junction escape is blocked');
-  fs.unlinkSync(junction);
-
-  const escaped = JSON.parse(fs.readFileSync(workflowFile, 'utf8'));
-  escaped.state = 'escaped';
-  fs.writeFileSync(workflowFile, JSON.stringify(escaped));
-  check(runGate('Write', repo, { file_path: path.join(repo, 'src.js') }).status === 2, 'legacy escaped state never waives isolation');
-  escaped.state = 'blocked';
-  fs.writeFileSync(workflowFile, JSON.stringify(escaped));
-  check(runGate('Write', linked, { file_path: path.join(linked, 'src.js') }).status === 2, 'blocked workflow cannot mutate even inside isolation');
-  fs.writeFileSync(workflowFile, '{broken');
-  check(runGate('Write', linked, { file_path: path.join(linked, 'src.js') }).status === 2, 'corrupt recorded workflow cannot silently authorize mutation');
-
-  writeWorkflow('tier2', 'iterative-single');
-  const tier2Write = runGate('Write', repo, { file_path: path.join(repo, 'small.js'), content: 'x' });
-  check(tier2Write.status === 0, 'Tier 2 is not globally forced into worktree isolation');
-} finally {
-  try { fs.rmSync(temp, { recursive: true, force: true }); } catch (_) { /* best effort */ }
-}
-
-if (failed > 0) {
-  console.error(`FAIL: worktree isolation gate (${failed} failure${failed === 1 ? '' : 's'})`);
-  process.exit(1);
-}
-console.log('PASS: major-workflow worktree isolation gate');
+const fs=require('fs'),os=require('os'),path=require('path'),{spawnSync}=require('child_process');
+const ROOT=path.resolve(__dirname,'..'),GATE=path.join(ROOT,'hooks/scripts/workflow-gate.js');
+let failed=0;function check(c,m,d=''){if(c)console.log('PASS '+m);else{console.error('FAIL '+m+(d?': '+d:''));failed++;}}
+const temp=fs.mkdtempSync(path.join(os.tmpdir(),'harness-worktree-guidance-')),home=path.join(temp,'home'),repo=path.join(temp,'repo'),linked=path.join(temp,'linked');
+fs.mkdirSync(home,{recursive:true});fs.mkdirSync(repo,{recursive:true});
+const env={...process.env,HOME:home,USERPROFILE:home,HARNESS_STATE_HOME:path.join(home,'state'),HARNESS_WORKSPACE_ROOT:repo,CLAUDE:'1'};
+process.env.HARNESS_STATE_HOME=env.HARNESS_STATE_HOME;process.env.HARNESS_WORKSPACE_ROOT=repo;process.env.HOME=home;process.env.USERPROFILE=home;
+function git(cwd,args){return spawnSync('git',args,{cwd,encoding:'utf8'});}
+function runGate(tool,cwd,input={}){return spawnSync(process.execPath,[GATE],{cwd:ROOT,env,input:JSON.stringify({session_id:'worktree-guidance',host_id:'mechanism-test',cwd,tool_name:tool,tool_input:input}),encoding:'utf8'});}
+try{
+ check(git(repo,['init']).status===0,'fixture repository initializes');
+ fs.writeFileSync(path.join(repo,'README.md'),'fixture\n');git(repo,['add','README.md']);git(repo,['-c','user.name=Harness','-c','user.email=h@example.invalid','commit','-m','init']);
+ const workspace=require(path.join(ROOT,'scripts/lib/workspace')); const state=require(path.join(ROOT,'hooks/scripts/lib/harness-state')); const context={session_id:'worktree-guidance',host_id:'mechanism-test',cwd:repo}; workspace.bindWorkspaceSession('worktree-guidance',repo,context,true); const dir=state.getSessionDir(repo,'worktree-guidance',context);
+ fs.writeFileSync(path.join(dir,'workflow-run.json'),JSON.stringify({schemaVersion:1,sessionId:'worktree-guidance',tier:'tier3',strategy:'iterative-single',state:'active'}));
+ const primary=runGate('Write',repo,{file_path:path.join(repo,'src.js'),content:'x'});
+ check(primary.status===0,'Tier-3 primary-tree mutation is not hard-blocked',primary.stderr);
+ check(/worktree/i.test(primary.stderr),'Tier-3 primary-tree mutation emits worktree guidance',primary.stderr);
+ const mutator=runGate('Bash',repo,{command:'git status --short && rm -rf src'});
+ check(mutator.status===0,'mutation-shaped shell command remains available',mutator.stderr);
+ check(/worktree/i.test(mutator.stderr),'mutation-shaped shell command receives worktree guidance',mutator.stderr);
+ const readOnly=runGate('Bash',repo,{command:'git status --short'});
+ check(readOnly.status===0,'read-only discovery remains available');
+ const create=git(repo,['worktree','add',linked,'-b','guidance-test']);check(create.status===0,'linked worktree fixture creates',create.stderr);
+ const isolated=runGate('Write',linked,{file_path:path.join(linked,'src.js'),content:'x'});
+ check(isolated.status===0,'linked-worktree mutation remains available',isolated.stderr);
+ const escape=runGate('Write',linked,{file_path:path.join(repo,'escape.js'),content:'x'});
+ check(escape.status===0,'cross-worktree target is reminder-only',escape.stderr);
+ check(/outside|worktree|target/i.test(escape.stderr),'cross-worktree target emits scope/isolation guidance',escape.stderr);
+ const wf=JSON.parse(fs.readFileSync(path.join(dir,'workflow-run.json'),'utf8'));wf.state='blocked';fs.writeFileSync(path.join(dir,'workflow-run.json'),JSON.stringify(wf));
+ const legacy=runGate('Write',linked,{file_path:path.join(linked,'legacy.js'),content:'x'});
+ check(legacy.status===0,'legacy blocked workflow state does not trap mutation',legacy.stderr);
+ check(/marked BLOCKED/i.test(legacy.stderr),'legacy blocked state is surfaced as reminder',legacy.stderr);
+ fs.writeFileSync(path.join(dir,'workflow-run.json'),'{broken');
+ const corrupt=runGate('Write',linked,{file_path:path.join(linked,'corrupt.js'),content:'x'});
+ check(corrupt.status===0,'corrupt workflow state fails open',corrupt.stderr);
+}finally{fs.rmSync(temp,{recursive:true,force:true});}
+if(failed)process.exit(1);
+console.log('PASS: worktree isolation is guidance, not a cognitive lock');