harness-everything 0.2.2 → 0.4.0

package/.agents/plugins/marketplace.json

@@ -0,0 +1,20 @@
+{
+  "name": "harness-everything",
+  "interface": {
+    "displayName": "Harness Everything"
+  },
+  "plugins": [
+    {
+      "name": "harness-everything",
+      "source": {
+        "source": "local",
+        "path": "./plugins/harness-everything"
+      },
+      "policy": {
+        "installation": "AVAILABLE",
+        "authentication": "ON_INSTALL"
+      },
+      "category": "Developer Tools"
+    }
+  ]
+}

package/.claude-plugin/marketplace.json

@@ -0,0 +1,27 @@
+{
+  "name": "harness-everything",
+  "owner": {
+    "name": "dyphn1",
+    "url": "https://github.com/dyphn1"
+  },
+  "plugins": [
+    {
+      "name": "harness-everything",
+      "source": "./",
+      "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
+      "version": "0.4.0",
+      "author": {
+        "name": "Miya Daniel"
+      },
+      "license": "Apache-2.0",
+      "keywords": [
+        "agent-harness",
+        "orchestration",
+        "circuit-breaker",
+        "tdd",
+        "verification"
+      ],
+      "category": "productivity"
+    }
+  ]
+}

package/.claude-plugin/plugin.json

@@ -0,0 +1,52 @@
+{
+  "name": "harness-everything",
+  "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
+  "version": "0.4.0",
+  "author": {
+    "name": "Miya Daniel"
+  },
+  "license": "Apache-2.0",
+  "homepage": "https://github.com/dyphn1/Harness-everything#readme",
+  "repository": "https://github.com/dyphn1/Harness-everything",
+  "keywords": [
+    "agent-harness",
+    "orchestration",
+    "circuit-breaker",
+    "tdd",
+    "verification"
+  ],
+  "agents": [
+    "./fable-mode/agents/fable-orchestrator.md",
+    "./fable-mode/agents/fable-verifier.md",
+    "./fable-mode/agents/fable-worker-haiku.md",
+    "./fable-mode/agents/fable-worker-sonnet.md"
+  ],
+  "skills": [
+    "./multi-agent-workspace",
+    "./environment-detection",
+    "./eval-harness",
+    "./fable-discipline",
+    "./fable-mode",
+    "./find-skills",
+    "./git-commit",
+    "./grill-me",
+    "./grill-with-docs",
+    "./harness-everything",
+    "./improve-codebase-architecture",
+    "./install-cognitive-os",
+    "./repo-docs",
+    "./rewrite-commits",
+    "./security-review",
+    "./self-evolve",
+    "./skill-creator",
+    "./skill-style",
+    "./tdd",
+    "./to-spec",
+    "./to-tickets",
+    "./todo-driven-workflow",
+    "./using-git-worktrees",
+    "./verification-loop",
+    "./verify-before-claim",
+    "./zoom-out"
+  ]
+}

package/.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

package/.github/workflows/behavioral-evals.yml

@@ -0,0 +1,36 @@
+name: Behavioral Evals (Weekly)
+
+on:
+  schedule:
+    - cron: '0 6 * * 1'  # Every Monday 06:00 UTC
+  workflow_dispatch:
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Validate eval case structure (free)
+        run: node behavioral-evals/run.js validate
+      - name: Install Harness for eval
+        run: node scripts/installer.js install --force
+      - name: Run behavioral evals
+        run: |
+          # Run evals if claude CLI is available; skip gracefully otherwise
+          if command -v claude &> /dev/null; then
+            node behavioral-evals/run.js run
+          else
+            echo "::warning::claude CLI not found — skipping live evals"
+            echo "Validate-only mode: case structure verified, no token cost"
+          fi
+      - name: Commit results if any
+        if: success()
+        run: |
+          git config user.email "ci@harness-everything"
+          git config user.name "Harness CI"
+          git add behavioral-evals/results/ || true
+          git diff --staged --quiet || git commit -m "chore(evals): weekly behavioral eval results [skip ci]"
+          git push || true

package/.github/workflows/ci.yml

@@ -0,0 +1,122 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  # release.yml calls this workflow so a tag push is gated by exactly the same
+  # jobs as a pull request - including installer-e2e and the full OS matrix.
+  workflow_call:
+
+jobs:
+  self-regression:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Install dependencies for regression suite
+        run: npm ci
+      - name: Run hermetic self-regression suite
+        run: npm test
+      - name: Run focused mutation checks
+        run: npm run test:mutations
+
+  skill-quality:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Install waza CLI
+        run: curl -fsSL https://raw.githubusercontent.com/microsoft/waza/main/install.sh | bash
+      - name: Check every canonical SKILL.md passes waza readiness gates
+        run: |
+          fail=0
+          for dir in $(find . -name "SKILL.md" -not -path "./node_modules/*" -not -path "./.git/*" -not -path "./plugins/*" -not -path "./ci/fixtures/*" -not -path "./eval-framework/fixtures/*" -exec dirname {} \; | sort); do
+            out=$(waza check "$dir" 2>&1) || true
+            echo "=== $dir"
+            if echo "$out" | grep -q "Does not fully meet"; then
+              echo "::error file=$dir/SKILL.md::waza spec compliance failed"
+              fail=1
+            fi
+            if echo "$out" | grep -qE "SKILL.md is [0-9]+ tokens \(hard limit 500\)"; then
+              echo "::error file=$dir/SKILL.md::token budget exceeded (hard limit 500)"
+              fail=1
+            fi
+            if ! grep -q "^## USE FOR:" "$dir/SKILL.md"; then
+              echo "::error file=$dir/SKILL.md::missing '## USE FOR:' trigger section"
+              fail=1
+            fi
+            if ! grep -q "^## DO NOT USE FOR:" "$dir/SKILL.md"; then
+              echo "::error file=$dir/SKILL.md::missing '## DO NOT USE FOR:' trigger section"
+              fail=1
+            fi
+          done
+          exit $fail
+      - name: Verify eval coverage against SKILL.md requirements
+        run: |
+          fail=0
+          for eval in evals/*/eval.yaml; do
+            skill=$(dirname "$eval" | xargs basename)
+            echo "=== $skill"
+            waza spec verify "$skill" "$eval" --fail --threshold 1 || fail=1
+          done
+          exit $fail
+      - name: Block canonical SKILL.md token growth vs base branch
+        run: waza tokens compare "${{ github.event.pull_request.base.ref || 'HEAD' }}" --strict --threshold 10 --skills
+
+  consistency:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Install Node dependencies
+        run: npm ci
+      - name: Docs, manifest, and eval-coverage consistency
+        run: npm run test:consistency
+      - name: Skill executable and deep-dive references resolve
+        run: npm run test:references
+      - name: Release tag skill tree and references remain verifiable
+        run: npm run test:release
+      - name: Skill description collision detection
+        run: npm run test:collision
+      - name: OpenAI plugin package is in sync and runnable
+        run: npm run test:plugin:openai
+      - name: OpenAI public submission artifacts are reproducible
+        run: npm run test:plugin:submission
+      - name: Platform compatibility matrix matches official-source and installer contracts
+        run: npm run test:platform:compatibility
+
+  installer-e2e:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: CLI --help works
+        run: node bin/cli.js --help
+      - name: Install, verify, uninstall, and restore seeded user files
+        run: node ci/installer-roundtrip.test.js

package/.github/workflows/release.yml

@@ -0,0 +1,71 @@
+name: Release
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+# A release owns the version/tag transaction. Never cancel one release halfway
+# through because a newer main push arrived; the next queued run will analyze
+# from the tag produced by the first one.
+concurrency:
+  group: release-main
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+  id-token: write
+
+jobs:
+  # Release publication is gated by exactly the same test matrix as a PR.
+  gate:
+    uses: ./.github/workflows/ci.yml
+
+  release:
+    needs: gate
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout full release history
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      # semantic-release 25 requires a newer Node runtime than the product's
+      # normal Node 20 CI matrix. This only changes the release runner.
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+          registry-url: https://registry.npmjs.org
+
+      - name: Install project dependencies
+        run: npm ci
+
+      # Keep release tooling out of the product dependency graph/package-lock.
+      # Versions are pinned so release behavior cannot float between runs.
+      # release-notes-generator 14 uses conventional-changelog-writer 8;
+      # conventionalcommits 10 requires writer 9+, so keep the preset on 9.x
+      # until the stable release-notes-generator line upgrades its writer.
+      - name: Install pinned release tooling
+        run: >-
+          npm install --no-save --package-lock=false --ignore-scripts
+          semantic-release@25.0.9
+          @semantic-release/changelog@7.0.0
+          @semantic-release/commit-analyzer@13.0.1
+          @semantic-release/exec@7.1.0
+          @semantic-release/git@11.0.1
+          @semantic-release/github@12.0.9
+          @semantic-release/npm@13.1.5
+          @semantic-release/release-notes-generator@14.1.1
+          conventional-changelog-conventionalcommits@9.3.1
+
+      - name: Calculate, prepare, and publish release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: "true"
+        run: npx --no-install semantic-release

package/.husky/commit-msg

@@ -0,0 +1 @@
+npx --no -- commitlint --edit "$1"

package/.releaserc.json

@@ -0,0 +1,113 @@
+{
+  "branches": [
+    "main"
+  ],
+  "tagFormat": "v${version}",
+  "plugins": [
+    [
+      "@semantic-release/commit-analyzer",
+      {
+        "preset": "conventionalcommits",
+        "presetConfig": {},
+        "releaseRules": [
+          {
+            "breaking": true,
+            "release": "major"
+          },
+          {
+            "type": "feat",
+            "release": "minor"
+          },
+          {
+            "type": "fix",
+            "release": "patch"
+          },
+          {
+            "type": "perf",
+            "release": "patch"
+          },
+          {
+            "type": "refactor",
+            "release": "patch"
+          },
+          {
+            "type": "build",
+            "release": "patch"
+          },
+          {
+            "type": "revert",
+            "release": "patch"
+          }
+        ],
+        "parserOpts": {
+          "noteKeywords": [
+            "BREAKING CHANGE",
+            "BREAKING CHANGES"
+          ]
+        }
+      }
+    ],
+    [
+      "@semantic-release/release-notes-generator",
+      {
+        "preset": "conventionalcommits",
+        "presetConfig": {},
+        "parserOpts": {
+          "noteKeywords": [
+            "BREAKING CHANGE",
+            "BREAKING CHANGES"
+          ]
+        }
+      }
+    ],
+    [
+      "@semantic-release/exec",
+      {
+        "verifyReleaseCmd": "node scripts/sync-release-version.js --validate ${nextRelease.version}",
+        "prepareCmd": "node scripts/sync-release-version.js ${nextRelease.version} --base ${lastRelease.gitTag} && npm run plugin:sync && node scripts/sync-release-version.js --check ${nextRelease.version} --base ${lastRelease.gitTag} && npm run test:consistency && npm run test:plugin:openai && npm run test:plugin:submission"
+      }
+    ],
+    [
+      "@semantic-release/changelog",
+      {
+        "changelogFile": "CHANGELOG.md",
+        "changelogTitle": "# Changelog\n\nAll notable changes to this project are documented in this file."
+      }
+    ],
+    [
+      "@semantic-release/npm",
+      {
+        "npmPublish": true
+      }
+    ],
+    [
+      "@semantic-release/git",
+      {
+        "assets": [
+          "CHANGELOG.md",
+          "package.json",
+          "package-lock.json",
+          ".claude-plugin/plugin.json",
+          ".claude-plugin/marketplace.json",
+          "*/SKILL.md",
+          "*/**/SKILL.md",
+          "plugins/harness-everything/plugin.json",
+          "plugins/harness-everything/.codex-plugin/plugin.json",
+          "plugins/harness-everything/skills",
+          "plugins/harness-everything/hooks",
+          "opencode-plugin/plugin.json"
+        ],
+        "message": "chore(release): ${nextRelease.version} [skip ci]"
+      }
+    ],
+    [
+      "@semantic-release/github",
+      {
+        "successComment": false,
+        "failTitle": false,
+        "labels": false,
+        "releasedLabels": false
+      }
+    ]
+  ]
+}

package/.waza.yaml

@@ -0,0 +1,22 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/microsoft/waza/main/schemas/config.schema.json
+
+paths:
+  skills: .
+  evals: evals/
+
+tokens:
+  warningThreshold: 500
+  limits:
+    defaults:
+      # Skill bodies stay lean (progressive disclosure); deep detail lives in
+      # references/*.md which may be larger but still bounded.
+      # "*.md" (no slash) is required to match root-level files like README.md;
+      # "**/*.md" alone cannot match them because its regex demands a leading path segment.
+      "SKILL.md": 500
+      "**/SKILL.md": 500
+      "*.md": 4000
+      "**/*.md": 4000
+    overrides:
+      # Append-only history / audit documents — size grows by design.
+      "CHANGELOG.md": 12000
+      "VERIFICATION.md": 10000

package/AGENTS.md

@@ -1,2 +1,71 @@
----
-description: "
+---
+description: Operating guide for AI agents working inside the Harness-everything repository — layout, change rules, quality gates, and release policy.
+---
+
+# AGENTS.md — Working in This Repository
+
+You are modifying **Harness**: an orchestrated agent operating system (skills + hooks/plugins + routing) for AI coding agents. Changes here ship to real agent sessions; a vague `SKILL.md`, stale manifest, or contradictory platform claim can misroute other people's agents. Precision is the product.
+
+## Repository Layout
+
+| Path | What it is |
+|---|---|
+| `<skill-name>/SKILL.md` | One canonical skill per top-level directory. Frontmatter: `name`, `description`, `metadata.author`, `metadata.version`. |
+| `hooks/` | Claude Code lifecycle hook scripts and shared mechanisms such as circuit breaker, scope guard, and stop gate. Do not infer that every host packages every hook. |
+| `harness-everything/scripts/` | Runtime: kernel/tier routing, verification, bootstrap, self-heal. |
+| `opencode-plugin/` | OpenCode native plugin implementation. Mechanism-tested; live plugin loading remains unverified until real host evidence exists. |
+| `.agents/plugins/` + `plugins/harness-everything/` | Local OpenAI/Codex marketplace + `.codex-plugin` package with canonical skill copies and packaged session/prompt hooks. |
+| `submission/openai/` | Public OpenAI Skills-only listing/test inputs. The public artifact does not include local `.codex-plugin` lifecycle hooks. |
+| `evals/<skill>/` | Trigger/routing eval per skill (waza format). Required for every canonical routed skill. |
+| `behavioral-evals/` | LLM-behavior cases run via headless CLI sessions. On-demand only; costs tokens; never CI. |
+| `benchmarks/` | BENCHMARK_SOP fixtures and recorded results. Evidence lives here or nowhere. |
+| `.claude-plugin/` | Claude Code plugin distribution manifests. Must list exactly the on-disk canonical skills. |
+| `docs/platform-capabilities.md` | Canonical current platform/install/enforcement/evidence matrix. |
+| `docs/`, `references/` | Philosophy, architecture, workflow documentation, shared checklists. |
+
+## Non-Negotiable Change Rules
+
+1. **Every canonical SKILL.md keeps ≤ 500 tokens** (hard CI gate) and must contain `## USE FOR:` and `## DO NOT USE FOR:` sections. Deep detail goes in the skill's `references/` or `guides/`.
+2. **Descriptions are routing surfaces.** Two skills whose descriptions overlap enough that a router cannot distinguish them will fail `test:collision`. When adding a skill, differentiate its description from near neighbors deliberately.
+3. **A new canonical skill ships with a routing eval** (`evals/<skill>/eval.yaml` + positive/negative tasks). The positive task's `description:` field must carry the skill's exact frontmatter description — waza's deterministic matcher requires it verbatim.
+4. **Release version policy:** normal PRs do not manually bump package/plugin versions. `semantic-release` determines the next stable SemVer from Conventional Commits on `main`, and `scripts/sync-release-version.js` owns distribution-version synchronization. Skill frontmatter versions remain release metadata and must never exceed the package version's numeric base. Nested sub-skills (`<skill>/<sub>/SKILL.md`) inherit the parent skill's version and must always match it.
+5. **Distribution manifests are generated facts, not opinions:** if you add/remove/rename a canonical skill, update/sync every distribution that copies or lists it. Run `npm run plugin:sync`, `npm run test:consistency`, and `npm run test:plugin:openai` rather than updating only `.claude-plugin/plugin.json`.
+6. **Platform capability claims are tested contracts.** If host integration behavior changes, update `docs/platform-capabilities.md` and every affected current-state surface in the same change. Never turn package/mechanism evidence into a live-host claim, and never describe public Skills-only behavior as if it includes local lifecycle hooks.
+7. **CHANGELOG.md keeps pending human-authored notes under `[Unreleased]`.** Do not create new alpha/beta/rc release headings; semantic-release owns stable release headings, tags, and release notes.
+8. **Conventional Commit type is release input.** The final commit/squash title that lands on `main` must follow the convention. Breaking changes release major; `feat` releases minor; `fix`, `perf`, `refactor`, `build`, and `revert` release patch; `docs`, `test`, `ci`, `style`, and `chore` do not release by themselves.
+
+## Verification Before You Claim Done
+
+Run the local gates that mirror CI:
+
+```bash
+npm test                       # self-regression: syntax, routing, mechanisms
+npm run test:mechanism         # mechanism suites alone
+npm run test:consistency       # manifests, versions, docs links, eval coverage + capability docs
+npm run test:docs:capabilities # platform documentation drift gate
+npm run test:references        # executable/deep-dive references
+npm run test:release           # release catalog + semantic-release/version-sync contract
+npm run test:collision         # description collision detection
+npm run test:routing:skills    # every positive skill route reaches its target
+npm run test:plugin:openai     # local OpenAI/Codex plugin package
+npm run test:plugin:submission # public Skills-only submission inputs/bundle parity
+```
+
+If waza is installed (`~/bin/waza`), also run what CI runs:
+
+```bash
+waza check <skill-dir>
+waza spec verify <skill> evals/<skill>/eval.yaml --fail --threshold 1
+waza tokens check
+```
+
+Do not report "it works" from reading code. Record which evidence layer you actually proved: package, deterministic mechanism, live host, or behavior.
+
+## Behavioral & Benchmark Evidence
+
+Deterministic mechanism tests prove the tested hook/plugin contract; they do **not** prove a real host loaded it or that agents behave differently. For behavior:
+
+- `node behavioral-evals/run.js run --engine opencode` (or `--engine claude`) — on-demand, token-costing.
+- `node benchmarks/run.js scaffold <scenario>` → run both variants → `record` with evidence logs.
+
+For a live-host enforcement claim, preserve a host/session artifact showing the mechanism was actually loaded and fired. Results are committed where the relevant evidence workflow requires it. A benchmark run without a recorded result is indistinguishable from one that never happened.