harness-everything 0.18.0 → 0.19.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.18.0",
+      "version": "0.19.0",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "author": {
     "name": "Miya Daniel"
   },

package/AGENTS.md

@@ -41,7 +41,7 @@ The retained [OpenCode evidence](benchmarks/results/live-host/opencode-2026-09-1
 8. **CHANGELOG.md keeps pending human-authored notes under `[Unreleased]`.** Semantic-release owns stable headings/tags/release notes.
 9. **Conventional Commit type is release input.** Breaking→major; `feat`→minor; `fix`/`perf`/`refactor`/`build`/`revert`→patch; docs/test/ci/style/chore do not release by themselves.
 10. **Selected workflow is planning guidance; reasoning and execution stay flexible.** Before omitting a suggested skill, read/evaluate its complete `SKILL.md` flow. Do not turn routing into a universal TODO/TDD/Fable sequence. Missing workflow evidence should produce a reminder, not a persistent Harness lock.
-11. **User-visible Harness Status is mandatory for non-trivial work.** Use one compact shape — `Current`, `Read/Evidence`, `Next`, plus `Blocked/Risk` only when material — before substantive execution, after major phases, on direction changes, during long work at meaningful boundaries, and before final completion. This semantic MUST does not create a hard lock.
+11. **User-visible Harness Status is mandatory for non-trivial work.** Render one readable Markdown block headed `### 🚦 Harness Status`, with bullet-aligned bold `Current`, `Read / Evidence`, `Next`, plus optional `Risk / Blocked`; use nested evidence bullets when useful. Emit it before substantive execution, after major phases, on direction changes, during long work at meaningful boundaries, and before final completion. The routing checkpoint is internal source state, not a second user-facing block. This semantic MUST does not create a hard lock.
 12. **Prefer Git worktree isolation for major mutation.** Read-only discovery may stay in the bound repository. Tier 3 / Fable source and artifact changes should use a verified linked worktree when practical; failure to create one is a prominent risk reminder, not a Harness-owned deadlock. See [workflow-runtime.md](docs/workflow-runtime.md).
 
 ## Verification Before You Claim Done

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.19.0](https://github.com/dyphn1/Harness-everything/compare/v0.18.1...v0.19.0) (2026-09-21)
+
+### Features
+
+* **distribution:** add cross-platform plugin install/update command ([0566bf3](https://github.com/dyphn1/Harness-everything/commit/0566bf347feab785af829e0f257fa22899f5c259))
+
+## [0.18.1](https://github.com/dyphn1/Harness-everything/compare/v0.18.0...v0.18.1) (2026-09-21)
+
+### Bug Fixes
+
+* **status:** keep presentation contract compact ([942c2a3](https://github.com/dyphn1/Harness-everything/commit/942c2a30a4281d6f07e83bca91977991e53d04ea))
+* **status:** restore readable visual hierarchy ([63223b2](https://github.com/dyphn1/Harness-everything/commit/63223b2eac86926b154b5a90072216fd9e761342))
+
 ## [0.18.0](https://github.com/dyphn1/Harness-everything/compare/v0.17.0...v0.18.0) (2026-09-21)
 
 ### Features

package/README.md

@@ -58,6 +58,11 @@ Harness integrates directly into your workspace. There is no heavy daemon, no pa
 # Option B: install Harness hooks/skills/advisory integrations into your workspace
 npx github:dyphn1/Harness-everything install
 
+# Option C: install or update the native Claude Code/Codex plugin
+#   npx github:dyphn1/Harness-everything plugin-sync
+#   ./scripts/plugin-sync.sh              # POSIX shells / Git Bash
+#   powershell -File scripts/plugin-sync.ps1  # Windows PowerShell
+
 # OpenAI/Codex local plugin packaging is repository-owned under:
 #   .agents/plugins/marketplace.json
 #   plugins/harness-everything/.codex-plugin/plugin.json
@@ -69,7 +74,7 @@ npx github:dyphn1/Harness-everything install
 2. **Preflight / session context where packaged:** Hook-capable surfaces can inject environment/session context automatically; advisory-only surfaces must not be described as if they do.
 3. **Verification boundary:** Completion claims require objective evidence; whether that boundary is mechanically invoked or explicitly called depends on the host surface.
 4. **Mandatory applicable workflow:** Evaluate each suggested skill's complete `SKILL.md` before omission, then resolve the selected topology with objective evidence. Reasoning and implementation remain flexible; escape applies only to a declared uncovered stage with evidence. Tier 3 / Fable mutation requires a verified Git worktree. See the [workflow runtime contract](docs/workflow-runtime.md) for entry, completion, and host limits. Harness does not impose one universal TODO/TDD/Fable sequence.
-5. **Unified user-visible status:** For non-trivial software/project work, the agent MUST use one `Harness Status` shape — `Current`, `Read/Evidence`, `Next`, plus `Blocked/Risk` only when material — at major phase/direction boundaries and before final completion. This is a communication contract, not a hard runtime lock.
+5. **Unified user-visible status:** For non-trivial software/project work, the agent MUST render one scannable Markdown `### 🚦 Harness Status` block with bold bullet labels for `Current`, `Read / Evidence`, `Next`, plus optional `Risk / Blocked`; multiple evidence items may use nested bullets. Use it at major phase/direction boundaries and before final completion. The routing checkpoint remains internal source state. This is a communication contract, not a hard runtime lock.
 
 ### What Gets Installed (and How to Remove It)
 
@@ -90,6 +95,8 @@ For `--global`, the installer uses each host's supported user-level skill locati
 
 The repository also ships a separate local OpenAI/Codex plugin package under `plugins/harness-everything/` with marketplace metadata in `.agents/plugins/marketplace.json`. That package is not the same thing as the `--codex` advisory installer path. The public OpenAI Skills-only upload is narrower again; see [docs/openai-plugin.md](docs/openai-plugin.md).
 
+The native `plugin-sync` command detects the installed host CLIs and applies the state-specific operation: an absent plugin is installed, while an already-installed plugin is explicitly updated (Claude Code) or its configured marketplace is upgraded (Codex). If a host cannot report plugin state, the command fails closed without installing or updating blindly.
+
 The installer records its state directories in `.git/info/exclude` — a local-only git ignore file — so Harness state never lands in a commit and your working tree (including `.gitignore`) is never modified. Everything owned by the general installer is removed with the built-in uninstaller:
 
 ```bash

package/bin/cli.js

@@ -40,6 +40,9 @@ switch (command) {
   case 'codex-hooks':
     runCodexHooksCompat(args.slice(1));
     break;
+  case 'plugin-sync':
+    runPluginSync(args.slice(1));
+    break;
   default:
     console.error(`[Error] Unknown command: "${command}"`);
     showHelp();
@@ -104,6 +107,9 @@ Commands:
                      that fail to mount enabled plugin-bundled hooks.
                      Usage: harness codex-hooks <install|status|uninstall>
                      Does not trust hooks or modify Codex config.toml.
+  plugin-sync        Install or update the native Harness plugin on Claude Code
+                     and Codex. Existing installations always take the update
+                     path. Supports --host, --dry-run, and --json.
   verify             Run the pre-delivery verification gate (lint/test from the
                      nearest package.json). Exits non-zero if checks fail. This is
                      the explicit stand-in for a hard stop gate on platforms where
@@ -179,3 +185,13 @@ function runCodexHooksCompat(compatArgs) {
   const result = spawnSync('node', [script, ...compatArgs], { stdio: 'inherit' });
   process.exit(result.status === null ? 1 : result.status);
 }
+
+function runPluginSync(pluginArgs) {
+  const script = path.resolve(__dirname, '..', 'scripts', 'plugin-sync.js');
+  if (!fs.existsSync(script)) {
+    console.error('[Error] Native plugin synchronization script not found.');
+    process.exit(1);
+  }
+  const result = spawnSync('node', [script, ...pluginArgs], { stdio: 'inherit' });
+  process.exit(result.status === null ? 1 : result.status);
+}

package/ci/invariant-routing.test.js

@@ -20,9 +20,12 @@ check(!tier2.stdout.includes('unavailable isolation means BLOCKED'),'old worktre
 check(tier2.stdout.includes('evaluate-suggestions-before-skip'),'skill suggestions still require evaluation before omission');
 check(tier2.stdout.includes('visible-status-updates'),'workflow plan carries mandatory user-visible status invariant');
 check(tier2.stdout.includes('USER-VISIBLE HARNESS STATUS CONTRACT (MUST)'),'kernel emits the mandatory unified status contract');
-for(const field of ['Harness Status','Current:','Read/Evidence:','Next:','Blocked/Risk:']){
-  check(tier2.stdout.includes(field),'kernel status contract includes '+field);
+for(const field of ['### 🚦 Harness Status','- **Current:**','- **Read / Evidence:**','- **Next:**','- **Risk / Blocked:**']){
+  check(tier2.stdout.includes(field),'kernel status contract includes readable Markdown field '+field);
 }
+check(tier2.stdout.includes('HARNESS ROUTING CHECKPOINT (INTERNAL SOURCE STATE — DO NOT RENDER SEPARATELY)'),'routing checkpoint is marked internal rather than user-facing');
+check(!tier2.stdout.includes('HARNESS ROUTING CHECKPOINT (REQUIRED VISIBLE STATE)'),'legacy duplicate-visible checkpoint label is absent');
+check(tier2.stdout.includes('nested bullets when there are multiple items'),'kernel tells agents to split dense evidence into nested bullets');
 check(tier2.stdout.includes('semantic communication MUST, not a hard execution lock'),'kernel separates semantic MUST from mechanical blocking');
 
 const tier3=spawnSync(process.execPath,[kernel,'audit the entire repository architecture and coordinate multiple modules'],{cwd:ROOT,encoding:'utf8'});
@@ -34,7 +37,7 @@ check(tier3.stdout.includes('WORKFLOW GUIDANCE (ADVISORY WHEN SELECTED)'),'Tier
 const hs=read('harness-everything/SKILL.md');
 check(/workflow state and numeric limits guide; they do not hard-stop execution/i.test(hs),'Harness skill states non-blocking workflow contract');
 check(/only Rule-of-3 reflection and explicit user\/host permission boundaries may block/i.test(hs),'Harness skill names the only intentional blocking boundaries');
-check(/Surface status.*MUST use one.*Harness Status/i.test(hs)&&/Read\/Evidence/i.test(hs),'Harness skill makes the unified user-visible status mandatory');
+check(/Surface status.*MUST render.*Harness Status/i.test(hs)&&/bold bullets/i.test(hs)&&/Read \/ Evidence/i.test(hs),'Harness skill requires the readable unified user-visible status');
 check(read('plugins/harness-everything/skills/harness-everything/SKILL.md')===hs,'Harness skill mirror matches');
 
 const wt=read('using-git-worktrees/SKILL.md');
@@ -55,13 +58,13 @@ for(const p of ['docs/routing.md','docs/architecture.md','docs/workflow-runtime.
 }
 const advisory=read('scripts/lib/advisory-text.js');
 check(/selected workflow topology.*planning guidance/i.test(advisory),'installer advisory text keeps workflow non-blocking');
-check(/USER-VISIBLE STATUS \(MUST\)/i.test(advisory)&&/Read\/Evidence:/i.test(advisory),'instruction-only installers carry the mandatory unified status contract');
+check(/USER-VISIBLE STATUS \(MUST\)/i.test(advisory)&&/### 🚦 Harness Status/i.test(advisory)&&/\*\*Read \/ Evidence:\*\*/i.test(advisory),'instruction-only installers carry the readable mandatory status contract');
 check(/Rule of 3/i.test(advisory)&&/Permission boundaries are separate/i.test(advisory),'installer text preserves Rule-of-3 and permission boundaries');
 check(read('plugins/harness-everything/scripts/lib/advisory-text.js')===advisory,'OpenAI advisory mirror matches');
 
 const agents=read('AGENTS.md');
 check(/Selected workflow is planning guidance/i.test(agents),'repository agent contract is guidance-first');
-check(/User-visible Harness Status is mandatory/i.test(agents),'repository agent contract requires unified user-visible status');
+check(/User-visible Harness Status is mandatory/i.test(agents)&&/### 🚦 Harness Status/i.test(agents)&&/nested evidence bullets/i.test(agents),'repository agent contract requires readable unified user-visible status');
 check(/Prefer Git worktree isolation/i.test(agents),'repository worktree rule is a recommendation');
 
 const hooks=JSON.parse(read('hooks/hooks.json'));

package/ci/mechanism-2ao-plugin-sync.test.js

@@ -0,0 +1,163 @@
+'use strict';
+
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const {
+  findMarketplace,
+  findPlugin,
+  parseJsonOutput,
+  sync
+} = require('../scripts/plugin-sync');
+
+const ROOT = path.resolve(__dirname, '..');
+
+function fakeHost({ claudeInstalled = false, codexInstalled = false, claudeMarketplace = true, codexMarketplace = true, unknownClaudePluginState = false } = {}) {
+  const calls = [];
+  const state = {
+    claudeInstalled,
+    codexInstalled,
+    claudeMarketplace,
+    codexMarketplace
+  };
+  const runner = (command, args) => {
+    calls.push({ command, args: [...args] });
+    const joined = args.join(' ');
+
+    if (command === 'claude') {
+      if (joined.includes('marketplace list --json')) {
+        return { status: 0, stdout: JSON.stringify({ marketplaces: state.claudeMarketplace ? [{ name: 'harness-everything' }] : [] }), stderr: '' };
+      }
+      if (joined === 'plugin marketplace list') {
+        return { status: 0, stdout: state.claudeMarketplace ? 'harness-everything\n' : '', stderr: '' };
+      }
+      if (joined.startsWith('plugin marketplace add')) {
+        state.claudeMarketplace = true;
+        return { status: 0, stdout: '', stderr: '' };
+      }
+      if (joined.startsWith('plugin marketplace update')) return { status: 0, stdout: '', stderr: '' };
+      if (joined.includes('plugin list --json')) {
+        if (unknownClaudePluginState) return { status: 1, stdout: '', stderr: 'unsupported --json' };
+        return { status: 0, stdout: JSON.stringify({ plugins: state.claudeInstalled ? [{ id: 'harness-everything@harness-everything' }] : [] }), stderr: '' };
+      }
+      if (joined === 'plugin list') {
+        if (unknownClaudePluginState) return { status: 1, stdout: '', stderr: 'unsupported list' };
+        return { status: 0, stdout: state.claudeInstalled ? 'harness-everything@harness-everything\n' : '', stderr: '' };
+      }
+      if (joined.startsWith('plugin install') || joined.startsWith('plugin update')) {
+        state.claudeInstalled = true;
+        return { status: 0, stdout: '{}', stderr: '' };
+      }
+    }
+
+    if (command === 'codex') {
+      if (joined.includes('marketplace list --json')) {
+        return { status: 0, stdout: JSON.stringify({ marketplaces: state.codexMarketplace ? [{ name: 'harness-everything' }] : [] }), stderr: '' };
+      }
+      if (joined === 'plugin marketplace list') {
+        return { status: 0, stdout: state.codexMarketplace ? 'harness-everything\n' : '', stderr: '' };
+      }
+      if (joined.startsWith('plugin marketplace add')) {
+        state.codexMarketplace = true;
+        return { status: 0, stdout: '{}', stderr: '' };
+      }
+      if (joined.startsWith('plugin marketplace upgrade')) return { status: 0, stdout: '{}', stderr: '' };
+      if (joined.includes('plugin list --marketplace harness-everything --json') || joined === 'plugin list --json') {
+        return { status: 0, stdout: JSON.stringify({ plugins: state.codexInstalled ? [{ name: 'harness-everything', marketplace: 'harness-everything' }] : [] }), stderr: '' };
+      }
+      if (joined === 'plugin list --marketplace harness-everything' || joined === 'plugin list') {
+        return { status: 0, stdout: state.codexInstalled ? 'harness-everything@harness-everything\n' : '', stderr: '' };
+      }
+      if (joined.startsWith('plugin add')) {
+        state.codexInstalled = true;
+        return { status: 0, stdout: '{}', stderr: '' };
+      }
+    }
+
+    return { status: 0, stdout: '', stderr: '' };
+  };
+
+  return {
+    calls,
+    runner,
+    commandAvailable: () => true
+  };
+}
+
+function callsFor(calls, command, prefix) {
+  return calls.filter(call => call.command === command && call.args.join(' ').startsWith(prefix));
+}
+
+function runHost(host, fake) {
+  return sync({ host, repository: 'dyphn1/Harness-everything', ref: 'main' }, {
+    ...fake,
+    log: () => {},
+    warn: () => {}
+  });
+}
+
+assert.strictEqual(parseJsonOutput('status\n{"ok":true}\n').ok, true);
+assert.strictEqual(findMarketplace({ marketplaces: [{ name: 'harness-everything' }] }, 'harness-everything'), true);
+assert.strictEqual(findPlugin({ plugins: [{ id: 'harness-everything@harness-everything' }] }, 'harness-everything', 'harness-everything'), true);
+
+{
+  const fake = fakeHost({ claudeInstalled: false });
+  const result = runHost('claude', fake);
+  assert.strictEqual(result.failed, 0);
+  assert.strictEqual(result.results[0].action, 'install');
+  assert.strictEqual(callsFor(fake.calls, 'claude', 'plugin install').length, 1, 'absent Claude plugin must install');
+  assert.strictEqual(callsFor(fake.calls, 'claude', 'plugin update').length, 0, 'absent Claude plugin must not update');
+}
+
+{
+  const fake = fakeHost({ claudeInstalled: true });
+  const result = runHost('claude', fake);
+  assert.strictEqual(result.failed, 0);
+  assert.strictEqual(result.results[0].action, 'update');
+  assert.strictEqual(callsFor(fake.calls, 'claude', 'plugin update').length, 1, 'installed Claude plugin must update');
+  assert.strictEqual(callsFor(fake.calls, 'claude', 'plugin install').length, 0, 'installed Claude plugin must not reinstall');
+}
+
+{
+  const fake = fakeHost({ codexInstalled: false });
+  const result = runHost('codex', fake);
+  assert.strictEqual(result.failed, 0);
+  assert.strictEqual(result.results[0].action, 'install');
+  assert.strictEqual(callsFor(fake.calls, 'codex', 'plugin add').length, 1, 'absent Codex plugin must install');
+}
+
+{
+  const fake = fakeHost({ codexInstalled: true });
+  const result = runHost('codex', fake);
+  assert.strictEqual(result.failed, 0);
+  assert.strictEqual(result.results[0].action, 'update');
+  assert.strictEqual(callsFor(fake.calls, 'codex', 'plugin marketplace upgrade').length, 1, 'installed Codex plugin must upgrade its marketplace');
+  assert.strictEqual(callsFor(fake.calls, 'codex', 'plugin add').length, 0, 'installed Codex plugin must not be re-added');
+}
+
+{
+  const fake = fakeHost({ unknownClaudePluginState: true });
+  const result = runHost('claude', fake);
+  assert.strictEqual(result.failed, 1, 'unknown installed state must fail closed');
+  assert.strictEqual(callsFor(fake.calls, 'claude', 'plugin install').length, 0, 'unknown state must not install');
+  assert.strictEqual(callsFor(fake.calls, 'claude', 'plugin update').length, 0, 'unknown state must not update blindly');
+  assert.strictEqual(callsFor(fake.calls, 'claude', 'plugin marketplace update').length, 0, 'unknown state must not refresh the marketplace blindly');
+}
+
+{
+  const result = sync({ host: 'all' }, { commandAvailable: () => false, log: () => {}, warn: () => {} });
+  assert.strictEqual(result.skipped, 2);
+  assert.strictEqual(result.failed, 0);
+}
+
+for (const wrapper of ['scripts/plugin-sync.sh', 'scripts/plugin-sync.ps1']) {
+  const text = fs.readFileSync(path.join(ROOT, wrapper), 'utf8');
+  assert.match(text, /plugin-sync\.js/);
+  assert.doesNotMatch(text, /\.codex\/plugins\/cache|config\.toml/);
+}
+
+const cli = fs.readFileSync(path.join(ROOT, 'bin', 'cli.js'), 'utf8');
+assert.match(cli, /case 'plugin-sync'/);
+assert.match(cli, /Existing installations always take the update/);
+
+console.log('Native plugin sync verified: absent plugins install, installed plugins update, and unknown state fails closed.');

package/docs/architecture.md

@@ -57,17 +57,20 @@ The router does not tell the model *how* to solve each stage. It decides what li
 
 ### User-visible status protocol
 
-Non-trivial work MUST expose one stable progress shape to the user:
-
-```text
-Harness Status
-- Current: <what is being done now>
-- Read/Evidence: <important files/sources/evidence read or confirmed>
-- Next: <next intended action>
-- Blocked/Risk: <only when materially applicable>
+Non-trivial work MUST expose one stable, scannable Markdown progress shape to the user:
+
+```md
+### 🚦 Harness Status
+
+- **Current:** <what is being done now>
+- **Read / Evidence:**
+  - <important file/source/evidence read or confirmed>
+  - <another item when multiple evidence items improve scanability>
+- **Next:** <next intended action>
+- **Risk / Blocked:** <only when materially applicable; omit otherwise>
 ```
 
-The agent emits it before substantive execution, after major phases, on material direction changes, at meaningful long-running phase boundaries, and before final completion. The router checkpoint feeds this status but is not a second user-facing template.
+Use nested evidence bullets when multiple items would otherwise become one dense sentence. The agent emits the status before substantive execution, after major phases, on material direction changes, at meaningful long-running phase boundaries, and before final completion. The router checkpoint feeds this status as internal source state but is not a second user-facing template.
 
 This is a semantic contract, not another cognitive lock. Hook-capable hosts may observe or remind about compliance; instruction-only hosts still receive the MUST contract without pretending they can mechanically enforce it.
 

package/docs/platform-capabilities.md

@@ -27,9 +27,9 @@ This is a **repository/agent contract**, not an automatic upgrade to any platfor
 
 | Platform surface | Standalone skills | Plugin support | Hooks/lifecycle | Project scope | Global scope | Current evidence boundary |
 | --- | --- | --- | --- | --- | --- | --- |
-| Codex | `Supported` | `Mechanism verified` | `Mechanism verified` for the local OpenAI package, including session, prompt, supported-tool, subagent, and stop hooks | `.agents/skills/`, `AGENTS.md` | `~/.agents/skills/` | Local package hooks are mechanically checked; live loading and marketplace refresh remain `Unknown`. |
+| Codex | `Supported` | `Mechanism verified` | `Mechanism verified` for the local OpenAI package, including session, prompt, supported-tool, subagent, and stop hooks | `.agents/skills/`, `AGENTS.md` | `~/.agents/skills/` | Local package hooks and the state-specific marketplace sync command are mechanically checked; live loading and marketplace refresh remain unverified. |
 | ChatGPT / OpenAI Plugin | `Unknown` for a repository-local standalone path | `Mechanism verified` | `Partial`: local Work/Codex hooks are separate from ordinary Chat | Managed workspace marketplace | Not established | The public Skills-only bundle is mechanically reproducible; import, approval, and live behavior remain `Unknown`. |
-| Claude Code | `Supported` | `Supported` | `Mechanism verified` for Harness configuration | `.claude/skills/` | `~/.claude/skills/` | Native Claude surfaces are documented and package/installer checks pass; fresh-host execution is not preserved here. |
+| Claude Code | `Supported` | `Supported` | `Mechanism verified` for Harness configuration | `.claude/skills/` | `~/.claude/skills/` | Native Claude surfaces and the state-specific plugin sync command are mechanically checked; fresh-host execution is not preserved here. |
 | OpenCode | `Supported` | `Partial` live-host loading for the project-scope, `.js`-filename install path on OpenCode 1.18.31 (macOS); other install paths remain `Mechanism verified` | `Partial` live-host evidence for project-scope `.js` loading and edit/verification state; hard lock reported only, with no retained blocked-tool trace and a post-reset final snapshot | `.opencode/skills/`, `.agents/skills/`, `.opencode/plugins/` | `~/.config/opencode/skills/`, `~/.agents/skills/`, `~/.config/opencode/plugins/` | [Retained evidence](../benchmarks/results/live-host/opencode-2026-09-16/README.md): loading and state effects verified in one host session; final snapshot post-reset; hard lock only an interactive observation; reflection operator-seeded, then agent-rewritten; no raw transcript or behavioral-effectiveness claim. `.mjs` auto-discovery broken (issue #127); global scope, npm-package installation, and other host versions remain unverified. |
 | GitHub Copilot agent surfaces | `Supported` | `Unknown` for a Harness-specific plugin install | `Unknown` | `.github/skills/`, `.agents/skills/`, repository instructions | `~/.copilot/skills/`, `~/.agents/skills/` | GitHub Agent Skills paths and installer behavior are checked; no live Copilot session or plugin install is preserved. |
 | Cursor | `Supported` | `Mechanism verified` for the portable package shape | `Unknown` for Harness | `.cursor/skills/`, `.agents/skills/` | `~/.cursor/skills/`, `~/.agents/skills/` | Official paths and package shape are checked; Cursor plugin loading and hooks remain unverified. |
@@ -64,6 +64,26 @@ Codex has two paths that must not be collapsed:
 
 The package is tested at the mechanism layer and remains subject to the host’s hook review/trust flow. A fresh host session is still required before claiming that a particular ChatGPT/Codex installation loaded and fired the hooks or that the model followed read-before-skip.
 
+### Native plugin install/update synchronization
+
+The repository also ships a host-facing synchronization command for the native marketplace/plugin surfaces:
+
+```bash
+npx github:dyphn1/Harness-everything plugin-sync
+# or, from a checkout:
+./scripts/plugin-sync.sh
+powershell -File scripts/plugin-sync.ps1
+```
+
+The command detects Claude Code and Codex independently, ensures the Harness marketplace is configured, reads the installed-plugin state, then refreshes that marketplace before choosing the operation:
+
+- absent plugin → install;
+- existing Claude Code plugin → `claude plugin update harness-everything@harness-everything`;
+- existing Codex plugin → `codex plugin marketplace upgrade harness-everything`;
+- unknown plugin state → fail closed, with no blind install/re-add.
+
+The installed branch is intentionally an update branch even when the current release is already the newest version; the host command may report “already latest.” Codex marketplace upgrade is the current native refresh operation; the command does not edit private cache paths or `config.toml`. These are deterministic command/state tests, not live-host evidence, so `liveHostVerification` remains `Unknown` in the matrix.
+
 ### Explicit Codex user-hook compatibility fallback
 
 Current Codex documentation supports plugin-bundled hooks, so native plugin mounting remains the preferred path. Some host/source combinations have nevertheless failed to expose enabled plugin hooks for review/entry attribution (#122 and upstream Codex reports). Harness therefore provides an **explicit compatibility fallback**, not an automatic replacement for native plugin hooks:

package/docs/platform-compatibility.json

@@ -1,6 +1,6 @@
 {
   "format": "harness-platform-compatibility-v1",
-  "last_reviewed": "2026-09-19",
+  "last_reviewed": "2026-09-21",
   "status_vocabulary": {
     "Supported": "An official or native mechanism exists and the Harness behavior is verified.",
     "Mechanism verified": "Harness package, adapter, or installer checks pass, but a real host run is not confirmed.",
@@ -114,7 +114,7 @@
         "globalScope": {"status": "Mechanism verified", "paths": {"skills": ["~/.agents/skills"]}},
         "installUninstallSymmetry": {"status": "Mechanism verified", "notes": "General Harness installer ownership is mechanism-tested. The optional codex-hooks compatibility fallback separately has exact-entry update/uninstall ownership tests and preserves unrelated user hooks; live Codex trust/dispatch still requires host evidence."},
         "assetsReferences": {"status": "Mechanism verified", "notes": "Packaged skill references are checked and remain inside the package."},
-        "updateSync": {"status": "Unknown", "notes": "A real marketplace refresh has not been run in a Codex host."},
+        "updateSync": {"status": "Mechanism verified", "notes": "scripts/plugin-sync.js detects installed state and uses marketplace upgrade for an installed Codex plugin; no live Codex host refresh is preserved."},
         "liveHostVerification": {"status": "Unknown", "notes": "No preserved Codex plugin/session artifact proves current bundled-hook entry. Native plugin mounting is preferred; the explicit user-hook fallback is mechanism-verified only and does not solve host carriers that bypass hook dispatch."}
       }
     },
@@ -159,7 +159,7 @@
         "globalScope": {"status": "Mechanism verified", "paths": {"skills": ["~/.claude/skills"], "hooks": ["~/.claude/settings.json"]}},
         "installUninstallSymmetry": {"status": "Mechanism verified", "notes": "Owned settings, skills, agents, and user files are covered by round-trip tests."},
         "assetsReferences": {"status": "Mechanism verified", "notes": "Skill-local references, scripts, and templates are checked."},
-        "updateSync": {"status": "Unknown", "notes": "A live marketplace update has not been run in Claude Code."},
+        "updateSync": {"status": "Mechanism verified", "notes": "scripts/plugin-sync.js detects installed state and uses the explicit Claude plugin update command for an installed plugin; no live Claude host refresh is preserved."},
         "liveHostVerification": {"status": "Unknown", "notes": "No fresh Claude Code plugin session artifact is committed for this revision."}
       }
     },
@@ -267,4 +267,4 @@
       }
     }
   ]
-}
+}

package/docs/routing.md

@@ -47,17 +47,20 @@ On a host where `UserPromptSubmit` is wired, reuse that hook output instead of r
 
 ## User-visible status contract
 
-For non-trivial software/project work, the user-facing progress protocol is a semantic **MUST** and is identical across execution topologies:
+For non-trivial software/project work, the user-facing progress protocol is a semantic **MUST** and uses the same readable Markdown presentation across execution topologies:
 
-```text
-Harness Status
-- Current: <what is being done now>
-- Read/Evidence: <important files/sources/evidence read or confirmed>
-- Next: <next intended action>
-- Blocked/Risk: <only when materially applicable>
+```md
+### 🚦 Harness Status
+
+- **Current:** <what is being done now>
+- **Read / Evidence:**
+  - <important file/source/evidence read or confirmed>
+  - <another item when multiple evidence items improve scanability>
+- **Next:** <next intended action>
+- **Risk / Blocked:** <only when materially applicable; omit otherwise>
 ```
 
-Emit it before substantive execution, after a major phase, when direction materially changes, at meaningful long-running phase boundaries, and before final completion. The final response may fold the last status into its completion summary. The routing checkpoint is source state for this protocol, not a second user-facing progress template.
+Keep one short evidence item inline when that reads better; use nested bullets for multiple evidence items. Emit the status before substantive execution, after a major phase, when direction materially changes, at meaningful long-running phase boundaries, and before final completion. The final response may fold the last status into its completion summary. The routing checkpoint is internal source state for this protocol, not a second user-facing progress template.
 
 This MUST is semantic rather than a hard runtime lock: hosts may observe/remind with different strength, but lack of a blocking hook does not downgrade the contract to optional advice.
 

package/docs/troubleshooting.md

@@ -189,6 +189,14 @@ If those checks pass but the host still shows an older copy:
 
 The local plugin mechanically injects the session policy and invariant-first routing contract, and its package includes mechanism-tested supported-tool, subagent, and stop adapters. If those events do not appear in a live session, verify the host loaded the current package and that changed command hooks were reviewed/trusted; package tests alone cannot prove host loading.
 
+For the native host install/update path, run:
+
+```bash
+npx github:dyphn1/Harness-everything plugin-sync --json
+```
+
+The command installs only when the plugin is absent. An installed Claude plugin uses the explicit Claude update command; an installed Codex plugin uses marketplace upgrade. If plugin state cannot be read, synchronization stops without re-adding or overwriting the plugin.
+
 See [openai-plugin.md](openai-plugin.md) for installation and validation details.
 
 ### Public OpenAI Skills-only plugin behaves differently from local Codex plugin

package/docs/workflow-runtime.md

@@ -17,17 +17,20 @@ None of those cognitive workflow conditions should trap a session or require a r
 
 A semantic MUST is not the same thing as a hard runtime lock. User-visible status, routing/applicability obligations, and verification-before-claim can remain mandatory agent contracts while host hooks observe or remind on a best-effort basis. Do not downgrade a semantic obligation to optional advice merely because the host cannot block it.
 
-The unified status shape is:
+The unified status shape uses a visible Markdown hierarchy:
 
-```text
-Harness Status
-- Current: <what is being done now>
-- Read/Evidence: <important files/sources/evidence read or confirmed>
-- Next: <next intended action>
-- Blocked/Risk: <only when materially applicable>
+```md
+### 🚦 Harness Status
+
+- **Current:** <what is being done now>
+- **Read / Evidence:**
+  - <important file/source/evidence read or confirmed>
+  - <another item when multiple evidence items improve scanability>
+- **Next:** <next intended action>
+- **Risk / Blocked:** <only when materially applicable; omit otherwise>
 ```
 
-Emit it before substantive execution, after major phases, on material direction changes, at meaningful long-running phase boundaries, and before final completion.
+Keep one short evidence item inline; use nested evidence bullets when multiple items improve scanability. Emit it before substantive execution, after major phases, on material direction changes, at meaningful long-running phase boundaries, and before final completion.
 
 The two intentionally separate hard boundaries are:
 

package/harness-everything/SKILL.md

@@ -4,7 +4,7 @@ description: "Route software/project work through the Harness kernel: classify T
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.18.0
+  version: 0.18.1
 ---
 
 # Harness Everything
@@ -23,12 +23,12 @@ Kernel routing entry.
 2. **Verify before claim** — seek objective evidence before saying work is done.
 3. **Zoom out on repetition** — after 3 same-signature failures, use `zoom-out`.
 4. **Evaluate before omission** — read each suggested skill's `SKILL.md` before deciding applicability.
-5. **Surface status** — non-trivial work MUST use one `Harness Status`: `Current`, `Read/Evidence`, `Next`, optional `Blocked/Risk`, at major phase/direction boundaries.
+5. **Surface status** — non-trivial work MUST render `### 🚦 Harness Status` with bold bullets: `Current`, `Read / Evidence`, `Next`; optional `Risk / Blocked`.
 6. **Keep agency** — workflow state and numeric limits guide; they do not hard-stop execution.
 
 ## Workflow
 1. Reuse kernel output, or run `node "<this-skill-dir>/scripts/kernel-router.js" "<prompt summary>"`.
-2. Use the **Harness Routing Checkpoint** to populate the first Harness Status; it is not a second progress format.
+2. Keep the **Harness Routing Checkpoint** internal; never render it separately.
 3. Read each suggested `SKILL.md`; evaluate `USE FOR`, `DO NOT USE FOR`, workflow/basic flow, and hard rules.
 4. Use the selected topology as planning guidance. Choose, combine, reorder, or skip steps when evidence supports doing so.
 5. Prefer worktree isolation for broad/Tier-3 mutation and objective verification before completion.

package/harness-everything/references/triage-and-tiers.md

@@ -151,23 +151,28 @@ Never turn mechanism/package evidence into a cross-host live-enforcement claim.
 
 ## 6. User-visible status contract
 
-For non-trivial software/project work, user-facing progress **MUST** use one stable shape across direct, iterative, Fable, and multi-agent execution:
-
-```text
-Harness Status
-- Current: <what is being done now>
-- Read/Evidence: <important files/sources/evidence read or confirmed>
-- Next: <next intended action>
-- Blocked/Risk: <only when materially applicable>
+For non-trivial software/project work, user-facing progress **MUST** use one stable Markdown shape across direct, iterative, Fable, and multi-agent execution:
+
+```md
+### 🚦 Harness Status
+
+- **Current:** <what is being done now>
+- **Read / Evidence:**
+  - <important file/source/evidence read or confirmed>
+  - <another item when multiple evidence items improve scanability>
+- **Next:** <next intended action>
+- **Risk / Blocked:** <only when materially applicable; omit otherwise>
 ```
 
+When there is only one short evidence item, keep it inline on the **Read / Evidence** bullet. Use nested bullets when multiple items would otherwise become one dense sentence.
+
 Emit it before substantive execution, after a major phase completes, when the plan/assumption/direction materially changes, at meaningful phase boundaries during long-running work, and before final completion. The final response may merge the last status naturally.
 
 This is a semantic communication MUST. It does **not** create a runtime lock, counter, reset requirement, or permission boundary. The routing checkpoint below is source state for this format, not a second competing progress template.
 
 ## 7. Routing Checkpoint
 
-For software/project work, consume this runtime state when producing the first Harness Status:
+For software/project work, consume this internal runtime state when producing the first Harness Status; do not render the checkpoint as a separate user-facing block:
 
 ```markdown
 ## 🚦 Harness Routing Checkpoint

package/harness-everything/scripts/kernel-router-core.js

@@ -24,7 +24,7 @@ const { applyEnsemblePolicy } = require('./ensemble-policy');
 const INVARIANT_TEXT = {
   'scope-lock': 'Route before execution: stay inside the authorized task/repository scope.',
   'verify-before-claim': 'Verify before claim: completion claims require objective evidence appropriate to the change.',
-  'visible-status-updates': 'User-visible status is mandatory: use the single Harness Status format with Current, Read/Evidence, and Next at required phase boundaries; add Blocked/Risk only when materially applicable.',
+  'visible-status-updates': 'User-visible status is mandatory: render the single Markdown Harness Status with a visible heading, bullet-aligned bold labels, Current, Read / Evidence, and Next; add Risk / Blocked only when materially applicable.',
   'replan-after-repeated-failure': 'Re-plan on repetition: after 3 same-signature failures, stop micro-retrying and zoom out/re-diagnose.',
   'evaluate-suggestions-before-skip': 'Evaluate before skip: read each suggested skill\'s complete SKILL.md entry/basic flow before omitting it.',
   'loop-awareness': 'When iterative work runs long, remind the agent to verify assumptions or re-plan; never hard-stop on a count.',
@@ -149,7 +149,7 @@ function printRoutingCheckpoint(plan) {
   const invariants = Array.isArray(plan.requiredInvariants) ? plan.requiredInvariants : [];
   const suggestions = uniqueSuggestedSkills(plan);
 
-  console.log('\n=> HARNESS ROUTING CHECKPOINT (REQUIRED VISIBLE STATE):');
+  console.log('\n=> HARNESS ROUTING CHECKPOINT (INTERNAL SOURCE STATE — DO NOT RENDER SEPARATELY):');
   console.log(`   - Tier: ${displayTier(plan.tier)}`);
   console.log(`   - Strategy: ${plan.strategy || 'deferred'}`);
   console.log(`   - Required invariants: ${invariants.length ? invariants.join(', ') : 'none'}`);
@@ -169,12 +169,16 @@ function printKernelContract(plan) {
   }
 
   console.log('\n=> USER-VISIBLE HARNESS STATUS CONTRACT (MUST):');
-  console.log('   - For non-trivial software/project work, the agent MUST use one compact user-visible status format:');
-  console.log('     Harness Status');
-  console.log('     - Current: <what is being done now>');
-  console.log('     - Read/Evidence: <important files/sources/evidence read or confirmed>');
-  console.log('     - Next: <next intended action>');
-  console.log('     - Blocked/Risk: <only when materially applicable>');
+  console.log('   - For non-trivial software/project work, the agent MUST render this single Markdown status shape:');
+  console.log('     ### 🚦 Harness Status');
+  console.log('');
+  console.log('     - **Current:** <what is being done now>');
+  console.log('     - **Read / Evidence:**');
+  console.log('       - <important file/source/evidence read or confirmed>');
+  console.log('       - <another item when multiple evidence items improve scanability>');
+  console.log('     - **Next:** <next intended action>');
+  console.log('     - **Risk / Blocked:** <only when materially applicable; omit otherwise>');
+  console.log('   - Keep evidence inline when there is only one short item; use nested bullets when there are multiple items.');
   console.log('   - Emit it before substantive execution, after a major phase, when direction materially changes, at meaningful long-running phase boundaries, and before final completion (the final response may merge it naturally).');
   console.log('   - This is a semantic communication MUST, not a hard execution lock, counter, or reset condition.');