harness-everything 0.18.1 → 0.19.1

package/harness-everything/scripts/router-contract-core.js

@@ -320,7 +320,7 @@ function selectWorkflowStrategy(input = {}) {
 function planMetadataForStrategy(strategy) {
   const base = {
     patterns: ['router'],
-    requiredInvariants: ['scope-lock', 'verify-before-claim', 'replan-after-repeated-failure', 'visible-status-updates'],
+    requiredInvariants: ['scope-lock', 'environment-alignment', 'verify-before-claim', 'replan-after-repeated-failure', 'visible-status-updates'],
     suggestedSkills: [],
     maxIterations: null,
     parallelAllowed: null,
@@ -365,8 +365,8 @@ function planMetadataForStrategy(strategy) {
     return {
       ...base,
       patterns: ['router', 'planner-executor', 'evaluator-optimizer'],
-      requiredInvariants: [...base.requiredInvariants, 'stage-contracts', 'cold-verification'],
-      suggestedSkills: ['fable-mode', 'fable-discipline', 'verification-loop'],
+      requiredInvariants: [...base.requiredInvariants, 'stage-contracts', 'cold-verification', 'isolated-worktree-before-mutation'],
+      suggestedSkills: ['using-git-worktrees', 'fable-mode', 'fable-discipline', 'verification-loop'],
       parallelAllowed: false,
       parallelReasonCodes: ['dependent-or-unproven-independent-stages'],
       workspaceRequired: false,
@@ -380,8 +380,8 @@ function planMetadataForStrategy(strategy) {
     return {
       ...base,
       patterns: ['router', 'planner-executor', 'evaluator-optimizer'],
-      requiredInvariants: [...base.requiredInvariants, 'stage-contracts', 'cold-verification', 'parallel-scope-contract', 'synthesis-barrier'],
-      suggestedSkills: ['fable-mode', 'fable-discipline', 'verification-loop'],
+      requiredInvariants: [...base.requiredInvariants, 'stage-contracts', 'cold-verification', 'isolated-worktree-before-mutation', 'parallel-scope-contract', 'synthesis-barrier'],
+      suggestedSkills: ['using-git-worktrees', 'fable-mode', 'fable-discipline', 'verification-loop'],
       parallelAllowed: true,
       parallelReasonCodes: ['independent-read-only-or-disjoint-scopes'],
       workspaceRequired: false,
@@ -395,8 +395,8 @@ function planMetadataForStrategy(strategy) {
     return {
       ...base,
       patterns: ['router', 'planner-executor', 'evaluator-optimizer', 'multi-agent-memory'],
-      requiredInvariants: [...base.requiredInvariants, 'stage-contracts', 'cold-verification', 'handoff-contracts', 'workspace-state'],
-      suggestedSkills: ['multi-agent-workspace', 'fable-mode', 'fable-discipline', 'verification-loop'],
+      requiredInvariants: [...base.requiredInvariants, 'stage-contracts', 'cold-verification', 'isolated-worktree-before-mutation', 'handoff-contracts', 'workspace-state'],
+      suggestedSkills: ['using-git-worktrees', 'multi-agent-workspace', 'fable-mode', 'fable-discipline', 'verification-loop'],
       parallelAllowed: false,
       parallelReasonCodes: ['workspace-orchestrator-controls-concurrency'],
       workspaceRequired: true,

package/harness-everything/scripts/router-contract.js

@@ -16,7 +16,7 @@ function augmentWorkflowPlan(plan) {
   if (!requiredInvariants.includes('isolated-worktree-before-mutation')) requiredInvariants.push('isolated-worktree-before-mutation');
   if (!suggestedSkills.includes('using-git-worktrees')) suggestedSkills.push('using-git-worktrees');
   return { ...plan, requiredInvariants, suggestedSkills, mutationIsolation: {
-    required: true, mechanism: 'git-worktree', transition: 'before-first-mutation', onUnavailable: 'blocked',
+    required: true, mechanism: 'git-worktree', transition: 'before-first-mutation', onUnavailable: 'degraded',
   } };
 }
 

package/hooks/scripts/atomic-commit-check.js

@@ -142,7 +142,7 @@ function main(payload) {
 
       const changedFiles = statusRaw.split('\n').length;
       console.error(`[Atomic Commit Check] ${state.editCount} edits since the last commit (${changedFiles} files currently changed).`);
-      console.error('If a logically complete chunk of work is done, commit it now before continuing - large uncommitted diffs are harder to review and harder to recover from.');
+      console.error('Before committing, MUST inspect the staged diff/scope; unrelated concerns SHOULD be split unless coupling or explicit user intent justifies one commit. Large uncommitted diffs remain a review/recovery risk.');
       process.exit(0);
     }
 

package/hooks/scripts/boundary-guard.js

@@ -27,7 +27,7 @@ process.stdin.on('end', () => {
         if (stat.isFile() && stat.size > MAX_BYTES_WITHOUT_LIMIT) {
           console.error(`[Boundary Reminder]: "${filePath}" is ${(stat.size / 1024).toFixed(0)}KB.`);
           console.error(`Reading a file this large in one call risks context bloat and "lost in the middle" degradation.`);
-          console.error(`Re-issue the Read with an explicit "offset"/"limit" to pull a targeted slice, or use Grep to locate the relevant section first.`);
+          console.error(`SHOULD narrow the read with explicit "offset"/"limit" or use Grep first, unless full-file context is materially required.`);
           process.exit(0);
         }
       }
@@ -43,7 +43,7 @@ process.stdin.on('end', () => {
       if (hitsNoiseDir) {
         console.error(`[Boundary Reminder]: search targets a noise directory (${NOISE_DIRS.join(', ')}).`);
         console.error(`These produce huge, low-signal result sets and rarely contain what you're actually looking for.`);
-        console.error(`Scope the search to source directories instead, or state explicitly why this directory must be searched.`);
+        console.error(`SHOULD scope the search to source directories; if the noisy directory is materially required, state the evidence-based exception.`);
         process.exit(0);
       }
     }

package/hooks/scripts/depth-guard.js

@@ -4,10 +4,9 @@
  * Claude Code already refuses to Edit a file that wasn't Read first in the
  * same session - that's native behavior, not something this hook needs to
  * re-check. The gap is Write: it happily overwrites an existing file with
- * no prior Read at all. This hook closes that gap: blocks Write on a file
- * that already exists on disk unless a Read of that exact path shows up
- * earlier in this session's transcript.
- * Fails open on any parse/lookup error - never blocks due to a bug here.
+ * no prior Read at all. This hook observes that gap and emits the semantic
+ * MUST to establish current target state before destructive overwrite.
+ * Fails open on parse/lookup errors and does not create a cognitive lock.
  */
 const fs = require('fs');
 const path = require('path');
@@ -53,8 +52,8 @@ process.stdin.on('end', () => {
 
     if (!wasRead) {
       console.error(`[Depth Reminder]: "${filePath}" already exists but hasn't been Read in this session.`);
-      console.error(`Write() overwrites the whole file - doing that blind risks destroying content you never looked at.`);
-      console.error(`Read the file first (even a quick pass), then retry the Write, or use Edit for a targeted change.`);
+      console.error(`Semantic MUST: establish the current target state before a destructive whole-file overwrite.`);
+      console.error(`Read the file first (even a quick pass), or use Edit for a targeted change. This reminder is fail-open rather than a persistent lock.`);
       process.exit(0);
     }
 

package/hooks/scripts/subagent-scope-guard.js

@@ -165,7 +165,7 @@ process.stdin.on('end', () => {
       } else if (declaredContracts.length === 0) {
         console.error(`[Subagent Scope Reminder] ${newlyChanged.length} file(s) changed with no machine-readable writeSet contract:`);
         newlyChanged.forEach(line => console.error(`  ${line}`));
-        console.error('Confirm every path was actually in scope before trusting or committing this output.');
+        console.error('Semantic MUST: reconcile every changed path against the declared scope before trusting or committing this output.');
       } else {
         for (const entry of classified.expected) {
           console.log(`[Subagent Scope Reminder] in-scope ${entry.statusLine} -> ${entry.planId}/${entry.runId}/${entry.stageId}${entry.workerId ? ` worker=${entry.workerId}` : ''}`);
@@ -174,7 +174,7 @@ process.stdin.on('end', () => {
           console.error(`[Subagent Scope Reminder] ambiguous scope ${entry.statusLine}; matches ${entry.stages.map(stage => `${stage.runId}/${stage.stageId}`).join(', ')}`);
         }
         for (const entry of classified.outOfScope) {
-          console.error(`[Subagent Scope Reminder] OUT-OF-SCOPE ${entry.statusLine}${entry.workerId ? ` worker=${entry.workerId}` : ''}`);
+          console.error(`[Subagent Scope Reminder] OUT-OF-SCOPE ${entry.statusLine}${entry.workerId ? ` worker=${entry.workerId}` : ''}; MUST reconcile/revert or explicitly re-authorize scope before accepting the result.`);
         }
       }
 

package/hooks/scripts/workflow-gate.js

@@ -35,7 +35,7 @@ function decide(payload) {
     if (String(workflow.strategy || '').startsWith('fable-') && !matchingRun(context)) warn('Selected Fable workflow has no correlated run; consider creating/updating the stage map before broad changes.');
     if (isMajorWorkflow(workflow)) {
       const isolatedRoot = linkedWorktree(cwd, root);
-      if (!isolatedRoot) warn('This is a major workflow; a linked Git worktree is strongly recommended before mutation.');
+      if (!isolatedRoot) warn('Tier-3/Fable isolation disposition is a semantic MUST before broad mutation: enter a linked Git worktree or record an explicit degraded fallback. This reminder does not hard-block.');
       else {
         try { if (DIRECT.has(tool)) assertTargets(payload, cwd, isolatedRoot); else assertShellScope(command, cwd, isolatedRoot); }
         catch (error) { warn(error.message); }

package/install-cognitive-os/SKILL.md

@@ -4,12 +4,12 @@ description: "Explain or explicitly apply the Harness cognitive policy: Discover
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.4.0
+  version: 0.19.1
 ---
 
 # Agent Cognitive OS
 
-The Cognitive OS is policy, not a required peer-skill selection. Supported runtimes should establish the smaller Harness invariant contract before domain-skill execution; this skill remains its human-readable/manual entry point.
+The Cognitive OS is policy, not a required peer-skill selection. Supported runtimes **MUST** establish the smaller Harness invariant contract before domain-skill execution; this skill remains its human-readable/manual entry point.
 
 ## USE FOR:
 - Apply or explain Discover → Think → Try → Summarize → Record.
@@ -39,6 +39,6 @@ The Cognitive OS is policy, not a required peer-skill selection. Supported runti
 
 Domain skills may define their own tactics and phases. They do not need to invoke this skill first as long as the Harness invariants remain satisfied.
 
-On advisory-only platforms, these rules are guidance rather than hard tool-call gates.
+On instruction-only platforms, the same semantic MUST/SHOULD/MAY contract applies through instructions rather than hard tool-call gates.
 
 Deep dive: <this-skill-dir>/references/cognitive-loop.md

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.18.1",
+  "version": "0.19.1",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.18.1",
+  "version": "0.19.1",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {
@@ -17,7 +17,7 @@
     "repo:contract": "node scripts/repository-contract.js",
     "docs:sync": "node scripts/sync-current-docs.js",
     "test:repo-contract": "node ci/repository-contract.test.js",
-    "test:consistency": "node ci/consistency-check.js && node ci/doc-capability-consistency.test.js && node ci/repository-contract.test.js",
+    "test:consistency": "node ci/consistency-check.js && node ci/doc-capability-consistency.test.js && node ci/repository-contract.test.js && node ci/mechanism-2ao-plugin-sync.test.js",
     "test:docs:capabilities": "node ci/doc-capability-consistency.test.js",
     "test:references": "node ci/reference-check.js",
     "test:release": "node ci/release-consistency-check.js && node ci/mechanism-2x-release-automation.test.js && node ci/mechanism-2x-release-commit-message.test.js",
@@ -28,10 +28,12 @@
     "test:routing": "node ci/routing-check.js",
     "test:routing:invariants": "node ci/invariant-routing.test.js && node ci/router-workflow-plan.test.js && node ci/workflow-execution-contract.test.js",
     "plugin:sync": "node scripts/sync-openai-plugin.js",
+    "plugin:hosts": "node scripts/plugin-sync.js",
     "test:plugin:claude": "node ci/mechanism-2z-claude-plugin-manifest.test.js",
     "plugin:claude:stage": "node scripts/stage-claude-plugin.js",
     "plugin:claude:validate": "node scripts/validate-claude-plugin.js",
     "test:plugin:openai": "node ci/openai-plugin-package.test.js && node ci/openai-plugin-runtime.test.js",
+    "test:plugin:hosts": "node ci/mechanism-2ao-plugin-sync.test.js",
     "plugin:submission:build": "node scripts/build-openai-submission.js",
     "test:plugin:submission": "node ci/openai-plugin-submission.test.js",
     "test:platform:compatibility": "node ci/mechanism-2w-platform-compatibility.test.js",

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.18.1",
+  "version": "0.19.1",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/hooks/scripts/atomic-commit-check.js

@@ -142,7 +142,7 @@ function main(payload) {
 
       const changedFiles = statusRaw.split('\n').length;
       console.error(`[Atomic Commit Check] ${state.editCount} edits since the last commit (${changedFiles} files currently changed).`);
-      console.error('If a logically complete chunk of work is done, commit it now before continuing - large uncommitted diffs are harder to review and harder to recover from.');
+      console.error('Before committing, MUST inspect the staged diff/scope; unrelated concerns SHOULD be split unless coupling or explicit user intent justifies one commit. Large uncommitted diffs remain a review/recovery risk.');
       process.exit(0);
     }
 

package/plugins/harness-everything/hooks/scripts/boundary-guard.js

@@ -27,7 +27,7 @@ process.stdin.on('end', () => {
         if (stat.isFile() && stat.size > MAX_BYTES_WITHOUT_LIMIT) {
           console.error(`[Boundary Reminder]: "${filePath}" is ${(stat.size / 1024).toFixed(0)}KB.`);
           console.error(`Reading a file this large in one call risks context bloat and "lost in the middle" degradation.`);
-          console.error(`Re-issue the Read with an explicit "offset"/"limit" to pull a targeted slice, or use Grep to locate the relevant section first.`);
+          console.error(`SHOULD narrow the read with explicit "offset"/"limit" or use Grep first, unless full-file context is materially required.`);
           process.exit(0);
         }
       }
@@ -43,7 +43,7 @@ process.stdin.on('end', () => {
       if (hitsNoiseDir) {
         console.error(`[Boundary Reminder]: search targets a noise directory (${NOISE_DIRS.join(', ')}).`);
         console.error(`These produce huge, low-signal result sets and rarely contain what you're actually looking for.`);
-        console.error(`Scope the search to source directories instead, or state explicitly why this directory must be searched.`);
+        console.error(`SHOULD scope the search to source directories; if the noisy directory is materially required, state the evidence-based exception.`);
         process.exit(0);
       }
     }

package/plugins/harness-everything/hooks/scripts/depth-guard.js

@@ -4,10 +4,9 @@
  * Claude Code already refuses to Edit a file that wasn't Read first in the
  * same session - that's native behavior, not something this hook needs to
  * re-check. The gap is Write: it happily overwrites an existing file with
- * no prior Read at all. This hook closes that gap: blocks Write on a file
- * that already exists on disk unless a Read of that exact path shows up
- * earlier in this session's transcript.
- * Fails open on any parse/lookup error - never blocks due to a bug here.
+ * no prior Read at all. This hook observes that gap and emits the semantic
+ * MUST to establish current target state before destructive overwrite.
+ * Fails open on parse/lookup errors and does not create a cognitive lock.
  */
 const fs = require('fs');
 const path = require('path');
@@ -53,8 +52,8 @@ process.stdin.on('end', () => {
 
     if (!wasRead) {
       console.error(`[Depth Reminder]: "${filePath}" already exists but hasn't been Read in this session.`);
-      console.error(`Write() overwrites the whole file - doing that blind risks destroying content you never looked at.`);
-      console.error(`Read the file first (even a quick pass), then retry the Write, or use Edit for a targeted change.`);
+      console.error(`Semantic MUST: establish the current target state before a destructive whole-file overwrite.`);
+      console.error(`Read the file first (even a quick pass), or use Edit for a targeted change. This reminder is fail-open rather than a persistent lock.`);
       process.exit(0);
     }
 

package/plugins/harness-everything/hooks/scripts/subagent-scope-guard.js

@@ -165,7 +165,7 @@ process.stdin.on('end', () => {
       } else if (declaredContracts.length === 0) {
         console.error(`[Subagent Scope Reminder] ${newlyChanged.length} file(s) changed with no machine-readable writeSet contract:`);
         newlyChanged.forEach(line => console.error(`  ${line}`));
-        console.error('Confirm every path was actually in scope before trusting or committing this output.');
+        console.error('Semantic MUST: reconcile every changed path against the declared scope before trusting or committing this output.');
       } else {
         for (const entry of classified.expected) {
           console.log(`[Subagent Scope Reminder] in-scope ${entry.statusLine} -> ${entry.planId}/${entry.runId}/${entry.stageId}${entry.workerId ? ` worker=${entry.workerId}` : ''}`);
@@ -174,7 +174,7 @@ process.stdin.on('end', () => {
           console.error(`[Subagent Scope Reminder] ambiguous scope ${entry.statusLine}; matches ${entry.stages.map(stage => `${stage.runId}/${stage.stageId}`).join(', ')}`);
         }
         for (const entry of classified.outOfScope) {
-          console.error(`[Subagent Scope Reminder] OUT-OF-SCOPE ${entry.statusLine}${entry.workerId ? ` worker=${entry.workerId}` : ''}`);
+          console.error(`[Subagent Scope Reminder] OUT-OF-SCOPE ${entry.statusLine}${entry.workerId ? ` worker=${entry.workerId}` : ''}; MUST reconcile/revert or explicitly re-authorize scope before accepting the result.`);
         }
       }
 

package/plugins/harness-everything/hooks/scripts/workflow-gate.js

@@ -35,7 +35,7 @@ function decide(payload) {
     if (String(workflow.strategy || '').startsWith('fable-') && !matchingRun(context)) warn('Selected Fable workflow has no correlated run; consider creating/updating the stage map before broad changes.');
     if (isMajorWorkflow(workflow)) {
       const isolatedRoot = linkedWorktree(cwd, root);
-      if (!isolatedRoot) warn('This is a major workflow; a linked Git worktree is strongly recommended before mutation.');
+      if (!isolatedRoot) warn('Tier-3/Fable isolation disposition is a semantic MUST before broad mutation: enter a linked Git worktree or record an explicit degraded fallback. This reminder does not hard-block.');
       else {
         try { if (DIRECT.has(tool)) assertTargets(payload, cwd, isolatedRoot); else assertShellScope(command, cwd, isolatedRoot); }
         catch (error) { warn(error.message); }

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.18.1",
+  "version": "0.19.1",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/scripts/lib/advisory-text.js

@@ -7,14 +7,14 @@ const MARKER = "Harness OS Guidance (Advisory)";
 
 const advisoryInstructions = [
   `\n# ${MARKER}`,
-  `Harness is an observer/router/reminder layer on this surface; do not treat its workflow guidance as a hard scheduler.`,
+  `Harness is an observer/router/reminder layer on this surface. Instruction/advisory delivery describes the mechanism, not semantic optionality; do not treat Harness as a hard scheduler.`,
   ``,
-  `## 🚦 ENTRY TRIAGE & WORKFLOW GUIDANCE`,
+  `## 🚦 ENTRY TRIAGE & SEMANTIC CONTRACT`,
   `For software/project work, load the \`harness-everything\` skill and establish routing context before broad mutation:`,
-  `1. Run \`npx github:dyphn1/Harness-everything next "<Brief summary of user's prompt>"\` when terminal execution is available.`,
-  `2. For EVERY suggested skill, read its complete \`SKILL.md\` entry and evaluate applicability from \`USE FOR\`, \`DO NOT USE FOR\`, and its basic flow.`,
-  `3. Treat the selected workflow topology and numeric limits as planning guidance, not a lock. Choose, combine, reorder, or skip steps when evidence supports it.`,
-  `4. Prefer objective verification before declaring done and worktree isolation for broad/Tier-3 mutation.`,
+  `1. MUST route before broad mutation; run \`npx github:dyphn1/Harness-everything next "<Brief summary of user's prompt>"\` when terminal execution is available and no equivalent routing state was injected.`,
+  `2. MUST read/evaluate EVERY suggested skill. If applicable, MUST follow its core contract; if not-applicable, keep a flow-grounded reason.`,
+  `3. Selected-topology required obligations are MUSTs. Implementation tactics MAY adapt; numeric iteration/revision/replan/worker values MAY guide planning but never hard-block.`,
+  `4. MUST verify before claiming completion. Tier-3/Fable broad mutation MUST resolve isolation: linked worktree or explicit degraded fallback.`,
   `5. Use the routing checkpoint only as internal source state for the first Harness Status; do not render a competing progress block.`,
   ``,
   `## 📣 USER-VISIBLE STATUS (MUST)`,
@@ -31,10 +31,11 @@ const advisoryInstructions = [
   `- **No universal skill pipeline**: do not force every task through TODO/TDD/Fable.`,
   `- **Rule of 3**: after 3 same-signature failures, stop micro-retrying and use a fresh diagnosis / zoom-out. This reflection boundary may block mutation until completed.`,
   `- **Permission boundaries are separate**: explicit host/user approval for destructive or external actions remains authoritative.`,
-  `- **Verification is evidence, not a cage**: missing evidence should trigger a reminder, not a persistent workflow lock.`,
-  `- **Environment discovery**: discover OS, shell, package manager/runtime, and host capability before relying on them.`,
-  `- **Memory / self-evolve**: persist only verified reusable lessons.`,
-  `- **Prefer editing**: prefer targeted edits and logically complete commits over broad rewrites.`,
+  `- **Contract strength**: MUST = required semantic obligation; SHOULD = default with evidence-based exception; MAY = optional optimization. Reminder-only mechanics never downgrade MUST.`,
+  `- **Verification is evidence, not a cage**: MUST verify before completion claims; host hooks may remind rather than persistently block.`,
+  `- **Environment discovery**: MUST establish relevant OS/shell/toolchain/host facts before relying on environment-sensitive behavior.`,
+  `- **Memory / self-evolve**: durable writes MUST be authorized by the active workflow/session contract and backed by verified reusable evidence.`,
+  `- **Editing / commits**: targeted edits SHOULD be preferred; before committing, MUST inspect the staged diff and SHOULD split unrelated concerns.`,
   ``
 ].join('\n');
 
@@ -144,15 +145,16 @@ function buildCodexGlobalContent() {
     `# ${MARKER}`,
     `This instruction surface cannot be assumed to provide hard lifecycle blocking.`,
     ``,
-    `- Discover the environment and host capabilities before relying on them.`,
-    `- For software/project work, run \`npx github:dyphn1/Harness-everything next "<summary>"\` before mutation and use the routing checkpoint as source state for the first Harness Status.`,
+    `- MUST establish relevant environment/host facts before relying on environment-sensitive behavior.`,
+    `- For software/project work, MUST establish routing before broad mutation; use \`npx github:dyphn1/Harness-everything next "<summary>"\` when terminal execution is available and routing state was not already injected.`,
     `- For non-trivial work, MUST render one Markdown \`### 🚦 Harness Status\` with bullet-aligned bold \`Current\`, \`Read / Evidence\`, \`Next\`, and optional \`Risk / Blocked\`; repeat it at major phase/direction boundaries and before final completion.`,
-    `- Read every suggested skill's complete \`SKILL.md\` entry before resolving applicability; do not omit it from metadata or confidence alone.`,
-    `- Use the selected workflow topology as planning guidance; the model may adapt or skip steps with an explicit evidence-based reason.`,
+    `- MUST read/evaluate every suggested skill; applicable skill core contracts MUST be followed, while not-applicable needs a flow-grounded reason.`,
+    `- Selected-topology required obligations are MUSTs; implementation tactics MAY adapt and numeric planning values MAY guide but never hard-block.`,
     `- Do not impose a universal TODO/TDD/Fable sequence; use the smallest useful topology plus applicable skills.`,
-    `- Prefer objective verification before declaring done; missing verification is a reminder, not a persistent lock.`,
-    `- After 3 same-signature failures, stop retrying and use a fresh diagnosis / zoom-out.`,
-    `- Prefer targeted edits and logically complete commits.`,
+    `- MUST verify before declaring done; a reminder-only host mechanism does not make verification optional.`,
+    `- Tier-3/Fable broad mutation MUST resolve isolation: verified linked worktree or explicit degraded fallback.`,
+    `- After 3 same-signature failures, MUST stop retrying and use a fresh diagnosis / zoom-out.`,
+    `- Targeted edits SHOULD be preferred; before committing, MUST inspect the staged diff and SHOULD split unrelated concerns.`,
     ``
   ].join('\n');
 }

package/plugins/harness-everything/skills/environment-detection/SKILL.md

@@ -4,7 +4,7 @@ description: Use at session start (Discover phase) to detect and align with the
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.16.6
+  version: 0.19.1
 ---
 
 # Environment Detection & Shell Alignment
@@ -20,6 +20,8 @@ metadata:
 
 Boundary: stay inside `process.cwd()`. Detection never writes integrations or searches parent/cache paths for another runtime.
 
+**Strength:** before relying on environment-sensitive commands, paths, package managers, or host capabilities, relevant discovery is a semantic **MUST**. Hosts may satisfy it from trusted injected environment context instead of rerunning probes.
+
 ## Workflow
 
 1. Run `node "<this-skill-dir>/scripts/preflight.js"`; detect OS, shell, CLIs.

package/plugins/harness-everything/skills/find-skills/SKILL.md

@@ -4,45 +4,36 @@ description: Search the agent-skills ecosystem (skills.sh / npx skills) when no
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.4.0
+  version: 0.19.1
 ---
 
 # Find Skills
 
-## 📋 Skill Contract
+## Skill Contract
 
-| Component | Specification |
+| Component | Contract |
 | :--- | :--- |
-| **Trigger / Input** | Request to find an external skill. |
-| **Expected Output** | Skill pointer, applied skill, or fallback. |
-| **State Mutations** | Temp cache (default); native install opt-in. |
-| **Enforcement Gate** | Local first; explicit approval before applying third-party code; graceful npx failure. |
+| **Input** | No installed skill fits, or user asks to find one. |
+| **Output** | Vetted skill pointer, approved application, or fallback. |
+| **State** | Temp cache by default; permanent install is opt-in. |
+| **Gate** | Third-party fetch/apply/install requires explicit approval. |
 
 ## Workflow
 
-0. Check local coverage (router registry, `generated[]`) before live installs:
-```bash
-npx skills list --json          # project scope
-npx skills list -g --json       # global scope
-```
-1. Identify domain/task, check [skills.sh](https://skills.sh/), then search `npx skills find [query] [--owner <owner>]`.
-2. Verify: prefer 1K+ installs, official sources; read the unaudited SKILL.md.
-3. Present name/source/count; NEVER fetch/apply without explicit approval.
-4. Apply ephemerally (default, zero footprint):
-```bash
-node "<this-skill-dir>/scripts/use-skill.js" <owner/repo[@skill]>
-```
-Treat the printed output as binding for this request, like a loaded skill — not reference material. OS-temp cache (6h); nothing written to repo or manifest.json.
-5. Permanent install ONLY when the user says they will reuse it: `npx skills add <owner/repo[@skill]> --agent <agent> [-g] -y`
-6. Nothing exists? Help directly; suggest `npx skills init <name>` if recurring.
-
-Deep dive: <this-skill-dir>/references/discovery-flow.md
+1. Check local coverage first: `npx skills list --json` and `npx skills list -g --json`.
+2. If uncovered, search skills.sh / `npx skills find [query] [--owner <owner>]`.
+3. Official/1K+ sources **SHOULD** rank first; **MUST** read the unaudited `SKILL.md`.
+4. Present name/source/count; **MUST** get explicit approval before fetching or applying third-party code.
+5. Ephemeral use is default: `node "<this-skill-dir>/scripts/use-skill.js" <owner/repo[@skill]>`. Treat its output as binding for this request.
+6. Permanent install **MUST** be explicitly requested: `npx skills add <owner/repo[@skill]> --agent <agent> [-g] -y`.
+7. No match: help directly; `npx skills init <name>` **MAY** be suggested for recurring needs.
 
 ## USE FOR:
-- finding an external skill when none installed fits
-- vetting third-party skills before applying them
-- ephemeral skill use without permanent installs
+- external skill discovery/vetting
+- approved ephemeral use
 
 ## DO NOT USE FOR:
-- authoring skills (`skill-creator`)
-- installing anything without explicit user approval
+- skill authoring (`skill-creator`)
+- unapproved third-party application/install
+
+Deep dive: <this-skill-dir>/references/discovery-flow.md

package/plugins/harness-everything/skills/git-commit/SKILL.md

@@ -4,7 +4,7 @@ description: "Generate Angular-style commit messages after verifying the environ
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.4.0
+  version: 0.19.1
 ---
 
 # Git Commit (Angular Style)
@@ -20,10 +20,10 @@ metadata:
 
 ## Quick Workflow
 
-1. `git status`; no repo → offer `git init` or skip; submodules changed → commit first per `<this-skill-dir>/guides/SUBMODULES.md`.
-2. `git diff --cached`; nothing staged → prompt user / stage targeted files.
+1. **MUST** run `git status`; no repo → offer `git init` or skip; submodules changed → commit first per `<this-skill-dir>/guides/SUBMODULES.md`.
+2. **MUST** inspect `git diff --cached` before committing. Nothing staged → prompt user / stage only user-authorized targeted files. Unrelated concerns **SHOULD** be split unless coupling or explicit user intent justifies one commit.
 3. Format `<type>(<scope>): <subject>` per `<this-skill-dir>/guides/ANGULAR_STYLE.md`. Multiline/Windows → `.git-commit-msg.txt` + `git commit -F`, clean up.
-4. `git commit -m "..."`, verify with `git log -1`.
+4. `git commit -m "..."`, then **MUST** verify the result with `git log -1`.
 
 ## USE FOR:
 - Commit request from the user

package/plugins/harness-everything/skills/harness-everything/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: harness-everything
-description: "Route software/project work through the Harness kernel: classify Tier 1/2/3, surface planning guidance and applicable skills, then let the agent choose tactics. Use for software triage, routing, and re-routing; not general Q&A or non-software writing."
+description: "Route software/project work through Harness: classify tier/topology, resolve suggested skills, apply semantic obligations, and keep tactics flexible. Use for software triage/routing/re-routing; not general Q&A or non-software writing."
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.18.1
+  version: 0.19.1
 ---
 
 # Harness Everything
@@ -12,28 +12,27 @@ metadata:
 Kernel routing entry.
 
 ## USE FOR:
-- Software/project triage, routing, re-routing, and workflow selection.
+- Software/project triage, routing, re-routing, workflow selection.
 - Work that names or matches another skill.
 
 ## DO NOT USE FOR:
 - General Q&A or non-software writing.
 
 ## Invariants
-1. **Route before execution** — establish scope/tier and useful workflow guidance.
-2. **Verify before claim** — seek objective evidence before saying work is done.
-3. **Zoom out on repetition** — after 3 same-signature failures, use `zoom-out`.
-4. **Evaluate before omission** — read each suggested skill's `SKILL.md` before deciding applicability.
-5. **Surface status** — non-trivial work MUST render `### 🚦 Harness Status` with bold bullets: `Current`, `Read / Evidence`, `Next`; optional `Risk / Blocked`.
-6. **Keep agency** — workflow state and numeric limits guide; they do not hard-stop execution.
+1. **Route (MUST)** — establish scope/tier and selected/deferred topology.
+2. **Verify (MUST)** — completion claims need objective evidence.
+3. **Zoom out (MUST)** — after 3 same-signature failures, use `zoom-out`.
+4. **Resolve suggestions (MUST)** — read/evaluate each suggested `SKILL.md`; applicable core contracts MUST run, otherwise retain a flow-grounded reason.
+5. **Surface status (MUST)** — non-trivial work renders `### 🚦 Harness Status` with bold `Current`, `Read / Evidence`, `Next`; optional `Risk / Blocked`.
+6. **Keep agency** — required obligations are MUST; tactics MAY adapt. Numeric planning values MAY guide, never hard-stop.
 
 ## Workflow
-1. Reuse kernel output, or run `node "<this-skill-dir>/scripts/kernel-router.js" "<prompt summary>"`.
-2. Keep the **Harness Routing Checkpoint** internal; never render it separately.
-3. Read each suggested `SKILL.md`; evaluate `USE FOR`, `DO NOT USE FOR`, workflow/basic flow, and hard rules.
-4. Use the selected topology as planning guidance. Choose, combine, reorder, or skip steps when evidence supports doing so.
-5. Prefer worktree isolation for broad/Tier-3 mutation and objective verification before completion.
-6. If guidance is not useful, explain the reason briefly and continue; no Harness reset is required.
-
-**Rule:** guidance may become louder when evidence is weak, but only Rule-of-3 reflection and explicit user/host permission boundaries may block.
+1. Reuse kernel output or run `node "<this-skill-dir>/scripts/kernel-router.js" "<prompt summary>"`.
+2. Keep the routing checkpoint internal.
+3. Resolve each suggestion as `use`, `not-applicable`, or `unresolved`; `use` follows its core contract.
+4. Resolve selected-topology required invariants/stages/checks before completion.
+5. Tier-3/Fable broad mutation MUST resolve isolation: linked worktree or explicit degraded fallback.
+
+**Rule:** semantic MUST is not hard blocking; only Rule-of-3 reflection and explicit user/host permission boundaries may block.
 
 Deep dive: <this-skill-dir>/references/triage-and-tiers.md