harness-everything 0.2.2 → 0.4.0

package/ci/installer-roundtrip.test.js

@@ -0,0 +1,159 @@
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const root = path.resolve(__dirname, '..');
+const cli = path.join(root, 'bin', 'cli.js');
+const ws = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-roundtrip-ws-'));
+const home = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-roundtrip-home-'));
+const prompts = path.join(home, 'vscode-prompts');
+
+function fail(message, detail = '') {
+  console.error(`❌ ${message}${detail ? `\n   ${detail}` : ''}`);
+  cleanup();
+  process.exit(1);
+}
+
+function check(message, condition, detail = '') {
+  if (!condition) fail(message, detail);
+  console.log(`✅ ${message}`);
+}
+
+function writeUnder(base, rel, content) {
+  const target = path.join(base, rel);
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.writeFileSync(target, content, 'utf8');
+  return target;
+}
+
+function write(rel, content) {
+  return writeUnder(ws, rel, content);
+}
+
+function writeHome(rel, content) {
+  return writeUnder(home, rel, content);
+}
+
+function run(args) {
+  const env = {
+    ...process.env,
+    HOME: home,
+    USERPROFILE: home,
+    APPDATA: path.join(home, 'AppData', 'Roaming'),
+    VSCODE_USER_PROMPTS_FOLDER: prompts,
+  };
+  return spawnSync(process.execPath, [cli, ...args], { cwd: ws, env, encoding: 'utf8' });
+}
+
+function cleanup() {
+  fs.rmSync(ws, { recursive: true, force: true });
+  fs.rmSync(home, { recursive: true, force: true });
+}
+
+fs.mkdirSync(path.join(ws, '.git'), { recursive: true });
+
+// -------------------------------------------------------------------------
+// Local round trip: seed real user files, install all platform integrations
+// with physical copies, then verify uninstall returns those bytes exactly.
+// -------------------------------------------------------------------------
+const seeded = new Map([
+  ['.claude/settings.json', JSON.stringify({ customSetting: true, permissions: { allow: ['Bash(git status)'] } }, null, 2)],
+  ['.cursorrules', 'user cursor rule\n'],
+  ['.github/copilot-instructions.md', 'user copilot instruction\n'],
+  ['AGENTS.md', 'user codex instruction\n'],
+  ['.hermes.md', 'user hermes context\n'],
+  ['.continue/rules/user.md', '# user continue rule\n'],
+]);
+for (const [rel, content] of seeded) write(rel, content);
+
+const customSkill = write(
+  '.agents/skills/custom-user-skill/SKILL.md',
+  '---\nname: custom-user-skill\ndescription: user owned\nmetadata:\n  author: Someone Else\n  version: 1.0.0\n---\n# User skill\n'
+);
+
+const install = run(['install', '--all', '--copy', '-y']);
+check('local install --all --copy succeeds', install.status === 0, `${install.stdout}\n${install.stderr}`);
+const verify = run(['verify-install']);
+check('verify-install succeeds after local installation', verify.status === 0, `${verify.stdout}\n${verify.stderr}`);
+
+const targetChecks = [
+  '.claude/skills/tdd/SKILL.md',
+  '.cursor/skills/tdd/SKILL.md',
+  '.github/skills/tdd/SKILL.md',
+  '.agents/skills/tdd/SKILL.md',
+  '.continue/skills/tdd/SKILL.md',
+];
+for (const rel of targetChecks) check(`installed ${rel}`, fs.existsSync(path.join(ws, rel)));
+check('Hermes/Codex shared project skill is discoverable through .agents/skills', fs.existsSync(path.join(ws, '.agents', 'skills', 'tdd', 'SKILL.md')));
+check('user-owned shared skill survives local install', fs.existsSync(customSkill));
+
+const uninstall = run(['uninstall', '--local', '--skills', '-y']);
+check('local uninstall --local --skills succeeds', uninstall.status === 0, `${uninstall.stdout}\n${uninstall.stderr}`);
+
+for (const [rel, expected] of seeded) {
+  const target = path.join(ws, rel);
+  check(`restored pre-existing ${rel}`, fs.existsSync(target) && fs.readFileSync(target, 'utf8') === expected,
+    fs.existsSync(target) ? JSON.stringify(fs.readFileSync(target, 'utf8')) : 'file missing');
+}
+check('Harness Continue rule is removed', !fs.existsSync(path.join(ws, '.continue', 'rules', 'harness.md')));
+check('user-owned shared skill survives local uninstall', fs.existsSync(customSkill));
+for (const rel of targetChecks) check(`removed Harness skill ${rel}`, !fs.existsSync(path.join(ws, rel)));
+
+const ownedHarnessDirs = [
+  '.claude/harness-everything',
+  '.cursor/harness-everything',
+  '.github/harness-everything',
+  '.codex/harness-everything',
+  '.continue/harness-everything',
+  '.hermes/harness-everything',
+];
+for (const rel of ownedHarnessDirs) check(`no orphaned local ${rel}`, !fs.existsSync(path.join(ws, rel)));
+
+// -------------------------------------------------------------------------
+// Global round trip: prove each host-native user skill root is used and that
+// a shared ~/.agents/skills directory can contain unrelated user content.
+// -------------------------------------------------------------------------
+const seededHome = new Map([
+  ['.claude/settings.json', JSON.stringify({ globalUserSetting: true }, null, 2)],
+  ['.cursorrules', 'global user cursor rule\n'],
+  ['.continue/rules/user.md', '# global user continue rule\n'],
+]);
+for (const [rel, content] of seededHome) writeHome(rel, content);
+
+const customGlobalSkill = writeHome(
+  '.agents/skills/custom-global-skill/SKILL.md',
+  '---\nname: custom-global-skill\ndescription: user owned global skill\nmetadata:\n  author: Someone Else\n  version: 1.0.0\n---\n# User global skill\n'
+);
+
+const globalInstall = run(['install', '--all', '--global', '--copy', '-y']);
+check('global install --all --copy succeeds', globalInstall.status === 0, `${globalInstall.stdout}\n${globalInstall.stderr}`);
+
+const globalTargets = [
+  ['Claude global', path.join(home, '.claude', 'skills', 'tdd', 'SKILL.md')],
+  ['shared Agent Skills global', path.join(home, '.agents', 'skills', 'tdd', 'SKILL.md')],
+  ['Continue global', path.join(home, '.continue', 'skills', 'tdd', 'SKILL.md')],
+  ['Hermes global', path.join(home, '.hermes', 'skills', 'tdd', 'SKILL.md')],
+];
+for (const [label, target] of globalTargets) check(`${label} target contains tdd`, fs.existsSync(target), target);
+check('Hermes global ownership marker exists', fs.existsSync(path.join(home, '.agents', 'harness-everything', 'hermes-global.json')));
+check('user-owned global Agent Skill survives global install', fs.existsSync(customGlobalSkill));
+
+const globalUninstall = run(['uninstall', '--global', '--skills', '-y']);
+check('global uninstall --global --skills succeeds', globalUninstall.status === 0, `${globalUninstall.stdout}\n${globalUninstall.stderr}`);
+
+for (const [rel, expected] of seededHome) {
+  const target = path.join(home, rel);
+  check(`restored pre-existing global ${rel}`, fs.existsSync(target) && fs.readFileSync(target, 'utf8') === expected,
+    fs.existsSync(target) ? JSON.stringify(fs.readFileSync(target, 'utf8')) : 'file missing');
+}
+check('user-owned global Agent Skill survives global uninstall', fs.existsSync(customGlobalSkill));
+for (const [label, target] of globalTargets) check(`${label} Harness skill removed`, !fs.existsSync(target), target);
+check('Hermes global ownership marker removed', !fs.existsSync(path.join(home, '.agents', 'harness-everything', 'hermes-global.json')));
+
+for (const rel of ['.claude/harness-everything', '.agents/harness-everything', '.continue/harness-everything', '.hermes/harness-everything']) {
+  check(`no orphaned global ${rel}`, !fs.existsSync(path.join(home, rel)));
+}
+
+cleanup();
+console.log('\nInstaller local + global round-trip: PASSED');

package/ci/invariant-routing.test.js

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+let failed = 0;
+
+function check(condition, message) {
+  if (condition) {
+    console.log(`  PASS ${message}`);
+  } else {
+    console.error(`  FAIL ${message}`);
+    failed++;
+  }
+}
+
+function read(rel) {
+  return fs.readFileSync(path.join(ROOT, rel), 'utf8');
+}
+
+console.log('=== Invariant-First Routing Contract ===');
+
+const kernel = path.join(ROOT, 'harness-everything', 'scripts', 'kernel-router.js');
+const tier2 = spawnSync(process.execPath, [kernel, 'add a login endpoint with tests and update the implementation'], {
+  cwd: ROOT,
+  encoding: 'utf8',
+});
+
+check(tier2.status === 0, 'kernel router exits successfully');
+check(/RECOMMENDED TIER:\s*Tier 2/i.test(tier2.stdout), 'classifier result is preserved');
+check(tier2.stdout.includes('"strategy":"iterative-single"'), 'Tier 2 structured plan selects iterative-single');
+check(tier2.stdout.includes('REQUIRED HARNESS INVARIANTS'), 'kernel emits mandatory invariants');
+check(tier2.stdout.includes('Route before execution'), 'route-before-execution invariant is present');
+check(tier2.stdout.includes('Verify before claim'), 'verify-before-claim invariant is present');
+check(tier2.stdout.includes('after 3 same-signature failures'), 'failure escalation invariant is present');
+check(tier2.stdout.includes('loop-budget:'), 'iterative-single loop budget invariant is present');
+check(tier2.stdout.includes('SUGGESTED SKILLS (ADVISORY'), 'domain skills are explicitly advisory');
+check(tier2.stdout.includes('tdd:'), 'Tier 2 can still recommend TDD');
+check(!tier2.stdout.includes('BASE EXECUTION LOOP'), 'legacy fixed base-execution-loop output is suppressed');
+check(tier2.stdout.includes('Do not enforce workflow order'), 'self-orchestration policy is explicit');
+
+const tier3 = spawnSync(process.execPath, [kernel, 'audit the entire repository architecture and coordinate multiple modules'], {
+  cwd: ROOT,
+  encoding: 'utf8',
+});
+check(tier3.status === 0, 'Tier 3 kernel routing exits successfully');
+check(/RECOMMENDED TIER:\s*Tier 3/i.test(tier3.stdout), 'macro task remains Tier 3');
+check(tier3.stdout.includes('"strategy":"fable-staged"'), 'Tier 3 dependent/unproven work selects fable-staged');
+check(tier3.stdout.includes('fable-mode / fable-discipline'), 'Tier 3 selected plan suggests Fable capabilities');
+check(tier3.stdout.includes('suggested skills remain advisory'), 'Tier 3 suggestions remain non-mandatory');
+
+const harnessSkill = read('harness-everything/SKILL.md');
+check(!/Requests that already name a skill/i.test(harnessSkill), 'harness entrypoint no longer opts out when another skill is named');
+check(/including work that already names or strongly matches another skill/i.test(harnessSkill), 'named domain skills still pass through Harness routing');
+check(/not a fixed pipeline/i.test(harnessSkill), 'skill contract rejects fixed pipeline semantics');
+
+const cognitiveSkill = read('install-cognitive-os/SKILL.md');
+check(/policy, not a required peer-skill selection/i.test(cognitiveSkill), 'Cognitive OS is defined as policy rather than peer-skill dependency');
+check(!/Tasks already governed by a more specific domain skill/i.test(cognitiveSkill), 'domain skill selection no longer disables Cognitive OS policy');
+
+const hooks = JSON.parse(read('hooks/hooks.json'));
+const promptHooks = hooks.hooks && hooks.hooks.UserPromptSubmit;
+const command = promptHooks && promptHooks[0] && promptHooks[0].hooks && promptHooks[0].hooks[0] && promptHooks[0].hooks[0].command;
+check(command === 'node "${CLAUDE_PLUGIN_ROOT}/harness-everything/scripts/kernel-router.js"', 'UserPromptSubmit anchors the Harness kernel to the Claude plugin root');
+
+const triageDoc = read('harness-everything/references/triage-and-tiers.md');
+check(triageDoc.includes('Do not enforce workflow order. Enforce workflow invariants.'), 'architecture reference records the invariant-first decision');
+check(triageDoc.includes('A tier is **not** a fixed pipeline'), 'tier documentation rejects rigid orchestration');
+check(!triageDoc.includes('MUST load `todo-driven-workflow`'), 'documentation no longer mandates TODO as universal Tier 2/3 first step');
+check(triageDoc.includes('```mermaid'), 'updated architecture retains executable flowchart documentation');
+
+console.log(`\n${failed === 0 ? 'PASS' : 'FAIL'}: invariant routing contract (${failed} failure${failed === 1 ? '' : 's'})`);
+process.exit(failed === 0 ? 0 : 1);

package/ci/issue99-runtime.test.js

@@ -0,0 +1,218 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawn, spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+const actionGatePath = path.join(ROOT, 'hooks', 'scripts', 'action-gate.js');
+const pluginActionGatePath = path.join(ROOT, 'plugins', 'harness-everything', 'hooks', 'scripts', 'action-gate.js');
+const rulesPath = path.join(ROOT, 'hooks', 'scripts', 'action-gate-rules.json');
+const actionGate = require(actionGatePath);
+const claudePlatform = require(path.join(ROOT, 'hooks', 'scripts', 'lib', 'platforms', 'claude.js'));
+
+let failed = 0;
+function check(condition, message) {
+  if (condition) console.log(`  PASS ${message}`);
+  else {
+    console.error(`  FAIL ${message}`);
+    failed++;
+  }
+}
+
+function collectCommands(manifest) {
+  const commands = [];
+  for (const [event, groups] of Object.entries((manifest && manifest.hooks) || {})) {
+    for (const group of groups || []) {
+      for (const hook of group.hooks || []) {
+        if (hook.type === 'command' && hook.command) commands.push({ event, command: hook.command });
+      }
+    }
+  }
+  return commands;
+}
+
+function scriptFromClaudeCommand(command, pluginRoot) {
+  const match = String(command).match(/^node\s+"([^"]+)"/);
+  if (!match) return null;
+  return match[1].replace(/\$\{CLAUDE_PLUGIN_ROOT\}/g, pluginRoot);
+}
+
+function probeHookModule(entry, script, cwd) {
+  if (entry.event === 'SessionStart') {
+    return spawnSync(process.execPath, [script], {
+      cwd,
+      encoding: 'utf8',
+      input: JSON.stringify({
+        hook_event_name: 'SessionStart',
+        session_id: 'issue99-cwd-probe',
+        cwd,
+      }),
+      env: { ...process.env, CLAUDE_PLUGIN_ROOT: ROOT },
+    });
+  }
+  return spawnSync(process.execPath, ['-e', 'require(process.argv[1])', script], {
+    cwd,
+    encoding: 'utf8',
+    env: { ...process.env, CLAUDE_PLUGIN_ROOT: ROOT },
+  });
+}
+
+function readAudit(sessionDir, toolUseId) {
+  const file = path.join(sessionDir, 'action-gate', `${toolUseId}.json`);
+  return JSON.parse(fs.readFileSync(file, 'utf8'));
+}
+
+function makePayload(command, options = {}) {
+  return {
+    session_id: options.sessionId || 'issue99',
+    hook_event_name: options.event || 'PreToolUse',
+    tool_name: options.tool || 'Bash',
+    tool_use_id: options.toolUseId || 'issue99-tool',
+    tool_input: { command },
+    cwd: options.cwd || ROOT,
+  };
+}
+
+function runTimerExitCase(scriptPath, cwd) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, [scriptPath], {
+      cwd,
+      env: {
+        ...process.env,
+        HARNESS_ACTION_GATE_HOST: 'codex',
+        HARNESS_ACTION_GATE_STDIN_TIMEOUT_MS: '50',
+      },
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    let stdout = '';
+    let stderr = '';
+    child.stdout.on('data', chunk => { stdout += chunk.toString(); });
+    child.stderr.on('data', chunk => { stderr += chunk.toString(); });
+    child.on('error', reject);
+    child.on('close', code => resolve({ code, stdout, stderr }));
+
+    child.stdin.write(JSON.stringify(makePayload('git push --force origin main', {
+      toolUseId: 'timer-block',
+      cwd,
+    })));
+    setTimeout(() => child.stdin.end(), 140);
+  });
+}
+
+async function main() {
+  console.log('=== Issue #99 — runtime correctness ===');
+  const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-issue99-'));
+  const sessionDir = path.join(tempRoot, 'session');
+  fs.mkdirSync(sessionDir, { recursive: true });
+
+  try {
+    const hooks = JSON.parse(fs.readFileSync(path.join(ROOT, 'hooks', 'hooks.json'), 'utf8'));
+    const commands = collectCommands(hooks);
+    check(commands.length > 0, 'canonical Claude hook manifest contains command hooks');
+    check(commands.every(entry => entry.command.includes('${CLAUDE_PLUGIN_ROOT}/')), 'every canonical Claude plugin hook is anchored to CLAUDE_PLUGIN_ROOT');
+
+    for (const entry of commands) {
+      const script = scriptFromClaudeCommand(entry.command, ROOT);
+      check(Boolean(script) && fs.existsSync(script), `${entry.event} hook resolves from plugin root: ${path.relative(ROOT, script || '')}`);
+      if (!script || !fs.existsSync(script)) continue;
+      const loaded = probeHookModule(entry, script, tempRoot);
+      check(
+        loaded.status === 0 && !/MODULE_NOT_FOUND|Cannot find module/i.test(`${loaded.stdout}\n${loaded.stderr}`),
+        `${entry.event} hook resolves and starts from unrelated cwd`,
+      );
+    }
+
+    const targetWorkspace = path.join(tempRoot, 'installed-project');
+    fs.mkdirSync(targetWorkspace, { recursive: true });
+    const claudeHooks = {
+      mergeHarnessHooks(config, resolved) { config.hooks = resolved; },
+      removeHarnessHooks() {},
+    };
+    const manifest = {
+      PACKAGE_NAME: 'harness-everything',
+      HARNESS_AUTHOR: 'Miya Daniel',
+      getManifestPath(dir) { return path.join(dir, 'harness-manifest.json'); },
+    };
+    claudePlatform.install({
+      isGlobal: false,
+      targetWorkspaceRoot: targetWorkspace,
+      harnessSourceDir: ROOT,
+      packageVersion: 'issue99-test',
+      claudeHooks,
+      manifest,
+    });
+    const installedSettings = JSON.parse(fs.readFileSync(path.join(targetWorkspace, '.claude', 'settings.json'), 'utf8'));
+    const installedCommands = collectCommands(installedSettings);
+    check(installedCommands.length === commands.length, 'Claude installer preserves the full hook command set');
+    for (const entry of installedCommands) {
+      check(!entry.command.includes('${CLAUDE_PLUGIN_ROOT}'), `${entry.event} installer substitutes CLAUDE_PLUGIN_ROOT`);
+      const match = entry.command.match(/^node\s+"([^"]+)"/);
+      check(Boolean(match) && path.isAbsolute(match[1]) && fs.existsSync(match[1]), `${entry.event} installer writes an existing absolute hook path`);
+    }
+
+    const table = actionGate.loadRuleTable(rulesPath);
+    const outside = process.platform === 'win32' ? 'C:\\harness-issue99-critical' : '/opt/harness-issue99-critical';
+    const safeOne = path.join(os.tmpdir(), 'harness-issue99-safe-a');
+    const safeTwo = path.join(os.tmpdir(), 'harness-issue99-safe-b');
+
+    const chainedBash = makePayload(`rm -rf "${safeOne}" && rm -rf "${outside}"`, { toolUseId: 'bash-chain' });
+    const chainedBashDecision = actionGate.evaluatePreToolUse(chainedBash, { host: 'claude', sessionDir, ruleTable: table });
+    check(chainedBashDecision.kind === 'defer' && chainedBashDecision.rule.id === 'recursive-delete', 'chained rm checks every target and gates the outside-scratch delete');
+
+    const safeBashDecision = actionGate.evaluatePreToolUse(
+      makePayload(`rm -rf "${safeOne}" && rm -rf "${safeTwo}"`, { toolUseId: 'bash-safe-chain' }),
+      { host: 'claude', sessionDir, ruleTable: table },
+    );
+    check(safeBashDecision.kind === 'allow', 'chained rm remains exempt when every target is scratch/temp');
+
+    const chainedPs = makePayload(
+      `Remove-Item -Recurse -Force "${safeOne}"; Remove-Item -Recurse -Force "${outside}"`,
+      { tool: 'PowerShell', toolUseId: 'ps-chain' },
+    );
+    const chainedPsDecision = actionGate.evaluatePreToolUse(chainedPs, { host: 'claude', sessionDir, ruleTable: table });
+    check(chainedPsDecision.kind === 'defer' && chainedPsDecision.rule.id === 'powershell-recursive-force-delete', 'chained Remove-Item checks every target and gates the outside-scratch delete');
+
+    const pre = makePayload('npm publish', { toolUseId: 'post-error-preserve' });
+    actionGate.evaluatePreToolUse(pre, { host: 'claude', sessionDir, ruleTable: table });
+    actionGate.processEvent({ ...pre, hook_event_name: 'PostToolUse' }, { sessionDir });
+    const beforeError = readAudit(sessionDir, 'post-error-preserve');
+    check(beforeError.disposition === 'executed', 'setup: approved payload reaches executed before audit-error probe');
+
+    const postError = actionGate.internalErrorDecision(
+      { ...pre, hook_event_name: 'PostToolUse' },
+      new Error('synthetic post-tool audit failure'),
+      { host: 'claude', sessionDir },
+    );
+    check(postError.kind === 'audit-error' && postError.exitCode === 0 && postError.stdout === null, 'PostToolUse internal error never emits a PreToolUse ask decision');
+    check(readAudit(sessionDir, 'post-error-preserve').disposition === 'executed', 'PostToolUse internal error does not overwrite an executed audit record');
+
+    const stopError = actionGate.internalErrorDecision(
+      { ...pre, hook_event_name: 'Stop' },
+      new Error('synthetic stop audit failure'),
+      { host: 'claude', sessionDir },
+    );
+    check(stopError.kind === 'audit-error' && stopError.stdout === null, 'Stop internal error remains an audit error, not an authorization prompt');
+
+    check(fs.readFileSync(actionGatePath, 'utf8') === fs.readFileSync(pluginActionGatePath, 'utf8'), 'canonical and Codex/OpenAI plugin action-gate runtimes are byte-identical');
+
+    const timerResult = await runTimerExitCase(actionGatePath, tempRoot);
+    check(timerResult.code === 2, 'stdin timeout path preserves Codex exit-2 fail-closed decision');
+    check(/git-force-push/.test(timerResult.stderr), 'stdin timeout block still reports the matched destructive rule');
+  } catch (err) {
+    console.error(err.stack || err.message);
+    failed++;
+  } finally {
+    try { fs.rmSync(tempRoot, { recursive: true, force: true }); } catch (_) {}
+  }
+
+  console.log(`\n${failed === 0 ? 'PASS' : 'FAIL'}: issue #99 runtime correctness (${failed} failure${failed === 1 ? '' : 's'})`);
+  process.exit(failed === 0 ? 0 : 1);
+}
+
+main().catch(err => {
+  console.error(err.stack || err.message);
+  process.exit(1);
+});

package/ci/mechanism-2a-rule-of-3.test.js

@@ -0,0 +1,46 @@
+const fs = require('fs');
+const path = require('path');
+const helper = require('./test-helper');
+
+console.log('\n[2a] Rule of 3 circuit breaker...');
+
+helper.writeState('rule-of-3-state.json', { count: 3, lastHash: 'mech-test', zoomOutResolved: false });
+const tripResult = helper.runHook('rule-of-3.js', { session_id: helper.SESSION_ID });
+helper.check(
+  '2a. Trips at count=3 (exit=2, CRITICAL banner)',
+  tripResult.code === 2 && tripResult.stderr.includes('RULE OF 3 CIRCUIT BREAKER TRIGGERED'),
+  `Got exit=${tripResult.code}, stderr="${tripResult.stderr.slice(0, 200)}"`
+);
+
+helper.writeState('rule-of-3-state.json', {
+  count: 3, lastHash: 'mech-test', zoomOutResolved: false, lastFailureAt: 0, zoomOutCycles: 0,
+});
+fs.writeFileSync(
+  path.join(helper.sessionDir, 'zoom-out-report.md'),
+  '## Goal\nx\n## Failed Attempts\nx\n## Verified Facts\nx\n## Diagnosis\nx\n## Decision\nRESUME: new approach\n',
+  'utf8'
+);
+const releaseResult = helper.runHook('rule-of-3.js', { session_id: helper.SESSION_ID });
+const releasedState = helper.readState('rule-of-3-state.json');
+helper.check(
+  '2a-bis. Valid zoom-out report releases the breaker (exit=0, count reset)',
+  releaseResult.code === 0 &&
+    releaseResult.stdout.includes('breaker released') &&
+    releasedState.count === 0 &&
+    releasedState.zoomOutResolved === true &&
+    releasedState.zoomOutCycles === 1,
+  `Got exit=${releaseResult.code}, state=${JSON.stringify(releasedState)}`
+);
+
+helper.writeState('rule-of-3-state.json', {
+  count: 3, lastHash: 'mech-test', zoomOutResolved: false,
+  lastFailureAt: Date.now() + 60000, zoomOutCycles: 1,
+});
+const hardLockResult = helper.runHook('rule-of-3.js', { session_id: helper.SESSION_ID });
+helper.check(
+  '2a-ter. Second trip on same signature hard-locks (exit=2, repeat trip)',
+  hardLockResult.code === 2 && hardLockResult.stderr.includes('repeat trip - hard lock'),
+  `Got exit=${hardLockResult.code}, stderr="${hardLockResult.stderr.slice(0, 200)}"`
+);
+
+helper.finish();

package/ci/mechanism-2aa-codex-action-gate-policy.test.js

@@ -0,0 +1,117 @@
+#!/usr/bin/env node
+'use strict';
+
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '..');
+const actionGate = require(path.join(ROOT, 'hooks', 'scripts', 'action-gate.js'));
+const permissionRequest = require(path.join(ROOT, 'hooks', 'scripts', 'codex-permission-request.js'));
+
+const pluginRoot = path.join(ROOT, 'plugins', 'harness-everything');
+const pluginHooksPath = path.join(pluginRoot, 'hooks', 'hooks.json');
+const canonicalPost = path.join(ROOT, 'hooks', 'scripts', 'codex-action-gate-post.js');
+const packagedPost = path.join(pluginRoot, 'hooks', 'scripts', 'codex-action-gate-post.js');
+const canonicalPermission = path.join(ROOT, 'hooks', 'scripts', 'codex-permission-request.js');
+const packagedPermission = path.join(pluginRoot, 'hooks', 'scripts', 'codex-permission-request.js');
+
+function payload(command, options = {}) {
+  return {
+    session_id: options.sessionId || 'codex-action-gate-policy-test',
+    hook_event_name: options.event || 'PreToolUse',
+    turn_id: options.turnId || 'turn_policy_test',
+    tool_name: options.tool || 'Bash',
+    tool_use_id: options.toolUseId || 'toolu_policy_test',
+    tool_input: options.tool === 'apply_patch' ? { patch: command } : { command },
+    permission_mode: options.permissionMode || 'default',
+    cwd: ROOT,
+  };
+}
+
+function commandPaths(hooks) {
+  const paths = [];
+  for (const groups of Object.values(hooks || {})) {
+    for (const group of groups || []) {
+      for (const hook of group.hooks || []) {
+        for (const field of ['command', 'commandWindows']) {
+          const command = hook[field];
+          if (typeof command !== 'string') continue;
+          const match = command.match(/(?:\$PLUGIN_ROOT|%PLUGIN_ROOT%)[\\/]([^"']+)/);
+          if (match) paths.push(match[1].replace(/\\/g, '/'));
+        }
+      }
+    }
+  }
+  return paths;
+}
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-codex-policy-'));
+const sessionDir = path.join(tempRoot, 'session');
+fs.mkdirSync(sessionDir, { recursive: true });
+
+try {
+  assert.ok(fs.existsSync(canonicalPost), 'Codex PostToolUse adapter must live in canonical hooks/scripts so plugin:sync cannot delete it');
+  assert.ok(fs.existsSync(packagedPost), 'Codex PostToolUse adapter must be packaged');
+  assert.strictEqual(fs.readFileSync(canonicalPost, 'utf8'), fs.readFileSync(packagedPost, 'utf8'), 'canonical and packaged Codex PostToolUse adapters must be byte-equivalent');
+
+  assert.ok(fs.existsSync(canonicalPermission), 'Codex PermissionRequest adapter must live in canonical hooks/scripts');
+  assert.ok(fs.existsSync(packagedPermission), 'Codex PermissionRequest adapter must be packaged');
+  assert.strictEqual(fs.readFileSync(canonicalPermission, 'utf8'), fs.readFileSync(packagedPermission, 'utf8'), 'canonical and packaged PermissionRequest adapters must be byte-equivalent');
+
+  const hookConfig = JSON.parse(fs.readFileSync(pluginHooksPath, 'utf8'));
+  assert.ok(Array.isArray(hookConfig.hooks.PermissionRequest), 'Codex plugin must declare PermissionRequest');
+  assert.ok(!Object.prototype.hasOwnProperty.call(hookConfig.hooks, 'PostToolUseFailure'), 'Codex plugin must not invent PostToolUseFailure');
+  const permissionCommands = hookConfig.hooks.PermissionRequest.flatMap(group => (group.hooks || []).map(hook => hook.command || ''));
+  assert.ok(permissionCommands.some(command => command.includes('codex-permission-request.js')), 'PermissionRequest must invoke the native approval observer');
+
+  for (const relativePath of new Set(commandPaths(hookConfig.hooks))) {
+    assert.ok(fs.existsSync(path.join(pluginRoot, relativePath)), `hook command target must exist in plugin package: ${relativePath}`);
+  }
+
+  const table = actionGate.loadRuleTable(path.join(ROOT, 'hooks', 'scripts', 'action-gate-rules.json'));
+  const destructive = payload('git push --force origin main', { toolUseId: 'codex-hard-block' });
+  const pre = actionGate.evaluatePreToolUse(destructive, { host: 'codex', sessionDir, ruleTable: table });
+  assert.strictEqual(pre.kind, 'block', 'Codex destructive PreToolUse must remain fail-closed');
+  assert.strictEqual(pre.exitCode, 2, 'Codex destructive PreToolUse must use the supported exit-2 block fallback');
+  assert.strictEqual(pre.stdout, null, 'Codex PreToolUse must never emit permissionDecision=ask');
+  assert.ok(pre.stderr.includes('git-force-push'), 'Codex block reason must identify the matched rule');
+
+  const approvalPayload = payload('git push --force origin main', {
+    event: 'PermissionRequest',
+    toolUseId: undefined,
+    turnId: 'turn_native_approval',
+  });
+  delete approvalPayload.tool_use_id;
+  const approval = permissionRequest.processPayload(approvalPayload, { sessionDir, ruleTable: table });
+  assert.strictEqual(approval.kind, 'defer', 'PermissionRequest must defer to Codex native approval');
+  assert.strictEqual(approval.exitCode, 0, 'PermissionRequest observer must not block an approval already surfaced by Codex');
+  assert.strictEqual(approval.stdout, null, 'PermissionRequest observer must emit no allow/deny decision');
+  assert.strictEqual(approval.record.disposition, 'deferred-to-codex-approval');
+  assert.strictEqual(approval.record.matchedRule, 'git-force-push');
+  assert.strictEqual(approval.record.exactToolCallCorrelation, false, 'PermissionRequest audit must not claim unavailable tool_use_id correlation');
+  assert.strictEqual(approval.record.correlation, 'turn-id-and-payload-hash-only');
+  assert.ok(fs.existsSync(approval.auditFile), 'PermissionRequest audit evidence must be persisted');
+
+  const stored = JSON.parse(fs.readFileSync(approval.auditFile, 'utf8'));
+  assert.strictEqual(stored.payloadHash, permissionRequest.hashExact('git push --force origin main'), 'PermissionRequest audit must hash the exact tool payload');
+  assert.ok(!Object.prototype.hasOwnProperty.call(stored, 'command'), 'PermissionRequest audit must not persist raw command text');
+  assert.ok(!Object.prototype.hasOwnProperty.call(stored, 'toolInput'), 'PermissionRequest audit must not persist raw tool input');
+
+  const safeApproval = permissionRequest.processPayload(payload('git status', {
+    event: 'PermissionRequest',
+    turnId: 'turn_safe_native_approval',
+  }), { sessionDir, ruleTable: table });
+  assert.strictEqual(safeApproval.kind, 'defer');
+  assert.strictEqual(safeApproval.record.matchedRule, null, 'native approval audit may exist even when Harness classifier has no destructive match');
+
+  const error = permissionRequest.internalErrorResult(new Error('synthetic failure'));
+  assert.strictEqual(error.exitCode, 0, 'PermissionRequest audit failure must not override an approval Codex already surfaced');
+  assert.strictEqual(error.stdout, null, 'PermissionRequest audit failure must not emit allow/deny/ask');
+  assert.ok(/Native Codex approval flow remains authoritative/.test(error.stderr));
+
+  console.log('PASS: Codex action-gate uses supported hard blocking plus non-authorizing native PermissionRequest observation.');
+} finally {
+  fs.rmSync(tempRoot, { recursive: true, force: true });
+}