harness-everything 0.19.1 → 0.20.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.19.1",
+      "version": "0.20.0",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.19.1",
+  "version": "0.20.0",
   "author": {
     "name": "Miya Daniel"
   },

package/.releaserc.json

@@ -64,7 +64,7 @@
       "@semantic-release/exec",
       {
         "verifyReleaseCmd": "node scripts/sync-release-version.js --validate ${nextRelease.version}",
-        "prepareCmd": "node scripts/sync-release-version.js ${nextRelease.version} --base ${lastRelease.gitTag} && npm run plugin:sync && node scripts/sync-release-version.js --check ${nextRelease.version} --base ${lastRelease.gitTag} && npm run test:consistency && npm run test:plugin:openai && npm run test:plugin:submission"
+        "prepareCmd": "node scripts/sync-release-version.js ${nextRelease.version} --base ${lastRelease.gitTag} && npm run plugin:sync && node scripts/generate-sbom.js --output sbom.cdx.json --version ${nextRelease.version} && node scripts/generate-sbom.js --validate sbom.cdx.json --version ${nextRelease.version} && node scripts/sync-release-version.js --check ${nextRelease.version} --base ${lastRelease.gitTag} && npm run test:consistency && npm run test:plugin:openai && npm run test:plugin:submission"
       }
     ],
     [

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.20.0](https://github.com/dyphn1/Harness-everything/compare/v0.19.1...v0.20.0) (2026-09-21)
+
+### Features
+
+* **release:** adopt cyclonedx 1.7 sbom ([39304e4](https://github.com/dyphn1/Harness-everything/commit/39304e4bfe8f94e969c72624301238c5f183a995))
+* **release:** generate and publish CycloneDX SBOM with npm ([6d8ddd0](https://github.com/dyphn1/Harness-everything/commit/6d8ddd008b5cb1e893cbdad915be8fe063e85b84))
+
 ## [0.19.1](https://github.com/dyphn1/Harness-everything/compare/v0.19.0...v0.19.1) (2026-09-21)
 
 ## [0.19.0](https://github.com/dyphn1/Harness-everything/compare/v0.18.1...v0.19.0) (2026-09-21)

package/RELEASING.md

@@ -38,9 +38,11 @@ A push to `main` runs the full reusable CI gate and then semantic-release. A man
 4. Exit without publishing when there is no releasable commit.
 5. Calculate the next stable SemVer.
 6. Run `scripts/sync-release-version.js` to synchronize package, Claude, OpenAI/Codex, OpenCode, lockfile, and changed canonical skill version fields.
-7. Regenerate and verify plugin packages.
+7. Regenerate and verify plugin packages, then generate and validate the release-only `sbom.cdx.json` CycloneDX 1.7 file.
 8. Update `CHANGELOG.md` and create `chore(release): X.Y.Z [skip ci]`.
-9. Create tag `vX.Y.Z`, publish npm with provenance, and create the GitHub Release.
+9. Create tag `vX.Y.Z`, publish npm with provenance (including the generated SBOM), and create the GitHub Release.
+
+The SBOM is generated from the release `package.json`/`package-lock.json` as CycloneDX 1.7, the current 1.x format, to satisfy consumers and regulatory baselines requiring CycloneDX 1.6 or later. It is intentionally not committed to Git. npm packaging is tested to ensure `sbom.cdx.json` is included in the published tarball.
 
 Release concurrency is serialized so two updates to `main` cannot publish competing versions.
 
@@ -69,6 +71,12 @@ node scripts/sync-release-version.js --validate 1.2.3
 
 Prerelease/build suffixes such as `1.2.3-beta` or `1.2.3+meta` are rejected.
 
+The release SBOM can be checked independently with:
+
+```bash
+npm run test:release:sbom
+```
+
 ## Contributor requirements
 
 The final commit that lands on `main` must use a Conventional Commit type because it is release input. With squash merging, the PR title becomes especially important. Use `feat`, `fix`, `perf`, `refactor`, `build`, or `revert` when a shipped change needs a release, and use non-releasing types for changes that should not publish.

package/ci/mechanism-2ap-sbom.test.js

@@ -0,0 +1,92 @@
+'use strict';
+
+const assert = require('assert');
+const childProcess = require('child_process');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const {
+  buildBom,
+  CYCLONEDX_SCHEMA_URL,
+  CYCLONEDX_VERSION,
+  validateBom,
+  writeBom
+} = require('../scripts/generate-sbom');
+
+const ROOT = path.resolve(__dirname, '..');
+const packageJson = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8'));
+const releaseConfig = JSON.parse(fs.readFileSync(path.join(ROOT, '.releaserc.json'), 'utf8'));
+const execFileSync = childProcess.execFileSync;
+const npmCommand = 'npm';
+
+const execPlugin = releaseConfig.plugins.find(plugin => Array.isArray(plugin) && plugin[0] === '@semantic-release/exec');
+assert.ok(execPlugin, 'semantic-release exec plugin is required for SBOM generation');
+assert.match(execPlugin[1].prepareCmd, /generate-sbom\.js --output sbom\.cdx\.json --version \$\{nextRelease\.version\}/);
+assert.match(execPlugin[1].prepareCmd, /generate-sbom\.js --validate sbom\.cdx\.json --version \$\{nextRelease\.version\}/);
+
+const bom = buildBom(ROOT, {
+  version: packageJson.version,
+  timestamp: '2026-09-21T00:00:00.000Z',
+  serialNumber: 'urn:uuid:00000000-0000-5000-8000-000000000001'
+});
+assert.doesNotThrow(() => validateBom(bom, packageJson.version));
+assert.strictEqual(bom.bomFormat, 'CycloneDX');
+assert.strictEqual(bom.$schema, CYCLONEDX_SCHEMA_URL);
+assert.strictEqual(bom.specVersion, CYCLONEDX_VERSION);
+assert.strictEqual(CYCLONEDX_VERSION, '1.7');
+assert.match(bom.serialNumber, /^urn:uuid:/);
+assert.strictEqual(bom.metadata.component.version, packageJson.version);
+assert.ok(bom.components.length > 0, 'SBOM must include lockfile components');
+assert.ok(bom.components.every(component => component.purl.startsWith('pkg:npm/')));
+assert.ok(bom.components.some(component => component.name.startsWith('@') && component.purl.includes('%40')), 'scoped npm packages must use valid PURLs');
+assert.ok(bom.dependencies.some(entry => entry.ref === `pkg:npm/${packageJson.name}@${packageJson.version}`));
+
+const output = path.join(os.tmpdir(), `harness-sbom-${process.pid}.cdx.json`);
+try {
+  writeBom(output, ROOT, { version: packageJson.version, timestamp: '2026-09-21T00:00:00.000Z' });
+  const written = JSON.parse(fs.readFileSync(output, 'utf8'));
+  assert.doesNotThrow(() => validateBom(written, packageJson.version));
+} finally {
+  fs.rmSync(output, { force: true });
+}
+
+const packRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-sbom-pack-'));
+try {
+  fs.cpSync(ROOT, packRoot, {
+    recursive: true,
+    filter: source => {
+      const relative = path.relative(ROOT, source).replace(/\\/g, '/');
+      return relative === '' || !['.git', 'node_modules', '.husky', '.mechanism-test-opencode-home', '.mechanism-test-opencode-workspace'].some(prefix => relative === prefix || relative.startsWith(`${prefix}/`));
+    }
+  });
+  const generated = writeBom(path.join(packRoot, 'sbom.cdx.json'), packRoot, { version: packageJson.version, timestamp: '2026-09-21T00:00:00.000Z' });
+  const packOutput = execFileSync(npmCommand, ['pack', '--dry-run', '--json', '--ignore-scripts'], {
+    cwd: packRoot,
+    encoding: 'utf8',
+    shell: process.platform === 'win32',
+    env: {
+      ...process.env,
+      HUSKY: '0',
+      npm_config_ignore_scripts: 'true'
+    }
+  });
+  const jsonStart = packOutput.indexOf('[');
+  const jsonEnd = packOutput.lastIndexOf(']');
+  assert.ok(jsonStart >= 0 && jsonEnd > jsonStart, 'npm pack --json output must include JSON records');
+  const records = JSON.parse(packOutput.slice(jsonStart, jsonEnd + 1));
+  const files = records.flatMap(record => record.files || []).map(file => file.path);
+  assert.ok(files.includes('sbom.cdx.json'), 'npm pack must include the generated SBOM');
+  assert.strictEqual(generated.metadata.component.version, packageJson.version);
+} finally {
+  fs.rmSync(packRoot, { recursive: true, force: true });
+}
+
+let tracked = true;
+try {
+  execFileSync('git', ['ls-files', '--error-unmatch', 'sbom.cdx.json'], { cwd: ROOT, stdio: 'ignore' });
+} catch (_) {
+  tracked = false;
+}
+assert.strictEqual(tracked, false, 'release-generated SBOM must remain untracked');
+
+console.log(`CycloneDX SBOM verified: ${bom.components.length} lockfile components and npm pack inclusion.`);

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.19.1",
+  "version": "0.20.0",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.19.1",
+  "version": "0.20.0",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {
@@ -20,7 +20,7 @@
     "test:consistency": "node ci/consistency-check.js && node ci/doc-capability-consistency.test.js && node ci/repository-contract.test.js && node ci/mechanism-2ao-plugin-sync.test.js",
     "test:docs:capabilities": "node ci/doc-capability-consistency.test.js",
     "test:references": "node ci/reference-check.js",
-    "test:release": "node ci/release-consistency-check.js && node ci/mechanism-2x-release-automation.test.js && node ci/mechanism-2x-release-commit-message.test.js",
+    "test:release": "node ci/release-consistency-check.js && node ci/mechanism-2x-release-automation.test.js && node ci/mechanism-2x-release-commit-message.test.js && node ci/mechanism-2ap-sbom.test.js",
     "test:release:semantics": "node ci/semantic-release-analyzer.test.mjs",
     "test:install": "node scripts/verify-install.js",
     "test:collision": "node ci/description-collision.js",
@@ -29,11 +29,14 @@
     "test:routing:invariants": "node ci/invariant-routing.test.js && node ci/router-workflow-plan.test.js && node ci/workflow-execution-contract.test.js",
     "plugin:sync": "node scripts/sync-openai-plugin.js",
     "plugin:hosts": "node scripts/plugin-sync.js",
+    "sbom:generate": "node scripts/generate-sbom.js --output sbom.cdx.json",
+    "sbom:validate": "node scripts/generate-sbom.js --validate sbom.cdx.json",
     "test:plugin:claude": "node ci/mechanism-2z-claude-plugin-manifest.test.js",
     "plugin:claude:stage": "node scripts/stage-claude-plugin.js",
     "plugin:claude:validate": "node scripts/validate-claude-plugin.js",
     "test:plugin:openai": "node ci/openai-plugin-package.test.js && node ci/openai-plugin-runtime.test.js",
     "test:plugin:hosts": "node ci/mechanism-2ao-plugin-sync.test.js",
+    "test:release:sbom": "node ci/mechanism-2ap-sbom.test.js",
     "plugin:submission:build": "node scripts/build-openai-submission.js",
     "test:plugin:submission": "node ci/openai-plugin-submission.test.js",
     "test:platform:compatibility": "node ci/mechanism-2w-platform-compatibility.test.js",

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.19.1",
+  "version": "0.20.0",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.19.1",
+  "version": "0.20.0",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",