harness-everything 0.2.2 → 0.4.0

package/ci/mechanism-2ab-openai-plugin-sync-integrity.test.js

@@ -0,0 +1,80 @@
+#!/usr/bin/env node
+'use strict';
+
+const assert = require('assert');
+const crypto = require('crypto');
+const { spawnSync } = require('child_process');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '..');
+
+function treeDigest(root) {
+  const hash = crypto.createHash('sha256');
+  function visit(dir, relative = '') {
+    const entries = fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+    for (const entry of entries) {
+      const rel = relative ? `${relative}/${entry.name}` : entry.name;
+      const full = path.join(dir, entry.name);
+      hash.update(`${entry.isDirectory() ? 'D' : 'F'}:${rel}\0`);
+      if (entry.isDirectory()) visit(full, rel);
+      else if (entry.isFile()) hash.update(fs.readFileSync(full));
+    }
+  }
+  visit(root);
+  return hash.digest('hex');
+}
+
+const tempBase = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-plugin-sync-'));
+const copyRoot = path.join(tempBase, 'repo');
+
+try {
+  fs.cpSync(ROOT, copyRoot, {
+    recursive: true,
+    filter(source) {
+      const rel = path.relative(ROOT, source).replace(/\\/g, '/');
+      if (!rel) return true;
+      return !(
+        rel === '.git' || rel.startsWith('.git/') ||
+        rel === 'node_modules' || rel.startsWith('node_modules/') ||
+        rel === '.harness' || rel.startsWith('.harness/')
+      );
+    },
+  });
+
+  const pluginRoot = path.join(copyRoot, 'plugins', 'harness-everything');
+  const before = treeDigest(pluginRoot);
+  const run = spawnSync(process.execPath, [path.join(copyRoot, 'scripts', 'sync-openai-plugin.js')], {
+    cwd: copyRoot,
+    encoding: 'utf8',
+  });
+  assert.strictEqual(run.status, 0, `plugin:sync equivalent failed:\n${run.stdout}\n${run.stderr}`);
+  const after = treeDigest(pluginRoot);
+  assert.strictEqual(after, before, 'sync-openai-plugin.js must be idempotent against the committed plugin package');
+
+  const hooks = JSON.parse(fs.readFileSync(path.join(pluginRoot, 'hooks', 'hooks.json'), 'utf8'));
+  const referenced = new Set();
+  for (const groups of Object.values(hooks.hooks || {})) {
+    for (const group of groups || []) {
+      for (const hook of group.hooks || []) {
+        for (const field of ['command', 'commandWindows']) {
+          const command = hook[field];
+          if (typeof command !== 'string') continue;
+          const match = command.match(/(?:\$PLUGIN_ROOT|%PLUGIN_ROOT%)[\\/]([^"']+)/);
+          if (match) referenced.add(match[1].replace(/\\/g, '/'));
+        }
+      }
+    }
+  }
+  for (const relative of referenced) {
+    assert.ok(fs.existsSync(path.join(pluginRoot, relative)), `sync must preserve every hook target: ${relative}`);
+  }
+
+  assert.ok(fs.existsSync(path.join(pluginRoot, 'hooks', 'scripts', 'codex-action-gate-post.js')), 'sync must preserve the Codex PostToolUse adapter');
+  assert.ok(fs.existsSync(path.join(pluginRoot, 'hooks', 'scripts', 'codex-permission-request.js')), 'sync must preserve the Codex PermissionRequest adapter');
+
+  console.log('PASS: OpenAI/Codex plugin sync is idempotent and preserves every referenced hook runtime file.');
+} finally {
+  fs.rmSync(tempBase, { recursive: true, force: true });
+}

package/ci/mechanism-2b-boundary-guard.test.js

@@ -0,0 +1,16 @@
+const fs = require('fs');
+const helper = require('./test-helper');
+
+console.log('\n[2b] Boundary guard...');
+
+const bigFile = helper.tempFile('.mechanism-test-big.tmp');
+fs.writeFileSync(bigFile, 'x'.repeat(600 * 1024));
+const boundaryResult = helper.runHook('boundary-guard.js', { tool_name: 'Read', tool_input: { file_path: bigFile } });
+helper.check(
+  '2b. Blocks a 600KB Read without limit/offset (exit=2, BLOCKED)',
+  boundaryResult.code === 2 && boundaryResult.stderr.includes('[Boundary Guard] BLOCKED'),
+  `Got exit=${boundaryResult.code}, stderr="${boundaryResult.stderr.slice(0, 200)}"`
+);
+fs.unlinkSync(bigFile);
+
+helper.finish();

package/ci/mechanism-2c-state-persist.test.js

@@ -0,0 +1,29 @@
+const helper = require('./test-helper');
+
+console.log('\n[2c] State persistence (WAL)...');
+
+helper.runHook('state-persist.js', {
+  session_id: helper.SESSION_ID,
+  tool_name: 'Bash',
+  tool_response: { stdout: '', stderr: 'npm ERR! mech-test failure' },
+});
+const failedHandoff = helper.readState('handoff-state.json');
+helper.check(
+  '2c. Failing Bash call is recorded as status=failed',
+  failedHandoff.status === 'failed' && failedHandoff.errorSummary.includes('mech-test failure'),
+  `Got ${JSON.stringify(failedHandoff)}`
+);
+
+helper.runHook('state-persist.js', {
+  session_id: helper.SESSION_ID,
+  tool_name: 'Bash',
+  tool_response: { stdout: 'ok', exitCode: 0 },
+});
+const resolvedHandoff = helper.readState('handoff-state.json');
+helper.check(
+  '2c. A subsequent successful command clears status back to idle',
+  resolvedHandoff.status === 'idle' && !!resolvedHandoff.lastResolved,
+  `Got ${JSON.stringify(resolvedHandoff)}`
+);
+
+helper.finish();

package/ci/mechanism-2d-fact-audit.test.js

@@ -0,0 +1,18 @@
+const { execSync } = require('child_process');
+const path = require('path');
+const helper = require('./test-helper');
+
+console.log('\n[2d] Fact-audit reminder...');
+
+const tierRouterPath = path.join(helper.root, 'harness-everything', 'scripts', 'tier-router.js');
+const factAuditOut = execSync(`node "${tierRouterPath}"`, {
+  encoding: 'utf8',
+  input: JSON.stringify({ prompt: 'what exit code does this hook use by default and is it documented' }),
+});
+helper.check(
+  '2d. tier-router.js reads {"prompt":...} from stdin and emits FACT-AUDIT REMINDER',
+  factAuditOut.includes('FACT-AUDIT REMINDER'),
+  `Output was:\n${factAuditOut.slice(0, 300)}`
+);
+
+helper.finish();

package/ci/mechanism-2e-scope-guard.test.js

@@ -0,0 +1,24 @@
+const fs = require('fs');
+const path = require('path');
+const helper = require('./test-helper');
+
+console.log('\n[2e] Subagent scope guard...');
+
+helper.runHook('subagent-scope-guard.js', {
+  session_id: helper.SESSION_ID, tool_name: 'Task', hook_event_name: 'PreToolUse', tool_input: {},
+});
+const scopeFile = helper.tempFile('.mechanism-test-scope.tmp');
+fs.writeFileSync(scopeFile, 'unexpected change');
+const scopeResult = helper.runHook('subagent-scope-guard.js', {
+  session_id: helper.SESSION_ID, tool_name: 'Task', hook_event_name: 'PostToolUse', tool_input: {},
+});
+helper.check(
+  '2e. Flags the newly-created file after a Task burst (exit=2, lists filename)',
+  scopeResult.code === 2 &&
+    scopeResult.stderr.includes('Subagent Scope Guard') &&
+    scopeResult.stderr.includes(path.basename(scopeFile)),
+  `Got exit=${scopeResult.code}, stderr="${scopeResult.stderr.slice(0, 300)}"`
+);
+fs.unlinkSync(scopeFile);
+
+helper.finish();

package/ci/mechanism-2f-stop-gate.test.js

@@ -0,0 +1,23 @@
+const fs = require('fs');
+const helper = require('./test-helper');
+
+console.log('\n[2f] Stop gate...');
+
+helper.writeState('handoff-state.json', { status: 'idle', lastEditAt: Date.now(), lastVerifyAt: 0 });
+const dirtyFile = helper.tempFile('.mechanism-test-dirty.tmp');
+fs.writeFileSync(dirtyFile, 'dirty');
+const firstStop = helper.runHook('stop-gate.js', { session_id: helper.SESSION_ID });
+helper.check(
+  '2f. First stop after an unverified edit bounces (exit=2)',
+  firstStop.code === 2 && firstStop.stderr.includes('[Stop Gate]'),
+  `Got exit=${firstStop.code}, stderr="${firstStop.stderr.slice(0, 200)}"`
+);
+const secondStop = helper.runHook('stop-gate.js', { session_id: helper.SESSION_ID });
+helper.check(
+  '2f. Same edit batch does not bounce twice (exit=0)',
+  secondStop.code === 0,
+  `Got exit=${secondStop.code}`
+);
+fs.unlinkSync(dirtyFile);
+
+helper.finish();

package/ci/mechanism-2g-platform-ignore.test.js

@@ -0,0 +1,88 @@
+const fs = require('fs');
+const path = require('path');
+const helper = require('./test-helper');
+
+console.log('\n[2g] Platform ignore patterns / Gitignore matching...');
+
+const mockWs = helper.tempDir('.mechanism-test-mock-ws');
+fs.mkdirSync(mockWs, { recursive: true });
+
+const platforms = require('../hooks/scripts/lib/platforms');
+const claudePlatform = platforms.find(p => p.name === 'claude');
+const cursorPlatform = platforms.find(p => p.name === 'cursor');
+
+// 1. Claude platform ignore pattern with mixed skills
+const claudeSkillsDir = path.join(mockWs, '.claude', 'skills');
+fs.mkdirSync(path.join(claudeSkillsDir, 'harness-skill'), { recursive: true });
+fs.mkdirSync(path.join(claudeSkillsDir, 'custom-skill'), { recursive: true });
+
+fs.writeFileSync(
+  path.join(claudeSkillsDir, 'harness-skill', 'SKILL.md'),
+  '---\nauthor: Miya Daniel\n---\n',
+  'utf8'
+);
+fs.writeFileSync(
+  path.join(claudeSkillsDir, 'custom-skill', 'SKILL.md'),
+  '---\nauthor: Someone Else\n---\n',
+  'utf8'
+);
+
+const claudePatterns = claudePlatform.getIgnorePatterns(mockWs);
+helper.check(
+  '2g. getIgnorePatterns returns ONLY Harness skills',
+  claudePatterns.includes('.claude/harness-everything/') &&
+    claudePatterns.includes('.claude/skills/harness-skill/') &&
+    !claudePatterns.includes('.claude/skills/custom-skill/'),
+  `Got patterns: ${JSON.stringify(claudePatterns)}`
+);
+
+// 2. test isMatch for claude parent matching to avoid double appending
+helper.check(
+  '2g. isMatch returns true for parent folder match (Claude)',
+  claudePlatform.isMatch('.claude/harness-everything/', '.claude') === true &&
+    claudePlatform.isMatch('.claude/harness-everything/', '.claude/') === true,
+  `isMatch for .claude failed`
+);
+
+helper.check(
+  '2g. isMatch returns true for exact match of harness skill (Claude)',
+  claudePlatform.isMatch('.claude/skills/harness-skill/', '.claude/skills/harness-skill/') === true &&
+    claudePlatform.isMatch('.claude/skills/harness-skill/', '.claude/skills/harness-skill') === true,
+  `isMatch for exact skill path failed`
+);
+
+// 3. Cursor platform ignore pattern with mixed skills
+const cursorSkillsDir = path.join(mockWs, '.cursor', 'skills');
+fs.mkdirSync(path.join(cursorSkillsDir, 'harness-skill'), { recursive: true });
+fs.mkdirSync(path.join(cursorSkillsDir, 'custom-skill'), { recursive: true });
+
+fs.writeFileSync(
+  path.join(cursorSkillsDir, 'harness-skill', 'SKILL.md'),
+  '---\nauthor: Miya Daniel\n---\n',
+  'utf8'
+);
+fs.writeFileSync(
+  path.join(cursorSkillsDir, 'custom-skill', 'SKILL.md'),
+  '---\nauthor: Someone Else\n---\n',
+  'utf8'
+);
+
+const cursorPatterns = cursorPlatform.getIgnorePatterns(mockWs);
+helper.check(
+  '2g. getIgnorePatterns returns ONLY Harness skills (Cursor)',
+  cursorPatterns.includes('.cursor/harness-everything/') &&
+    cursorPatterns.includes('.cursor/skills/harness-skill/') &&
+    !cursorPatterns.includes('.cursor/skills/custom-skill/'),
+  `Got patterns: ${JSON.stringify(cursorPatterns)}`
+);
+
+helper.check(
+  '2g. isMatch returns true for parent folder match (Cursor)',
+  cursorPlatform.isMatch('.cursor/harness-everything/', '.cursor') === true &&
+    cursorPlatform.isMatch('.cursor/harness-everything/', '.cursor/') === true,
+  `isMatch for .cursor failed`
+);
+
+fs.rmSync(mockWs, { recursive: true, force: true });
+
+helper.finish();

package/ci/mechanism-2h-installer-manifest.test.js

@@ -0,0 +1,147 @@
+const fs = require('fs');
+const path = require('path');
+const helper = require('./test-helper');
+
+console.log('\n[2h] Installer manifest and skill bookkeeping...');
+
+const manifestMockWs = helper.tempDir('.mechanism-test-manifest-ws');
+fs.mkdirSync(manifestMockWs, { recursive: true });
+
+const manifestHelper = require('../scripts/lib/manifest');
+const skillsHelper = require('../scripts/lib/skills');
+const testManifestPath = path.join(manifestMockWs, 'manifest.json');
+
+// 1. Verify readManifest of non-existent path
+const initialManifest = manifestHelper.readManifest(testManifestPath);
+helper.check(
+  '2h. readManifest returns fallback structure when file does not exist',
+  initialManifest.package === 'harness-everything' && Array.isArray(initialManifest.skills) && initialManifest.skills.length === 0,
+  `Got: ${JSON.stringify(initialManifest)}`
+);
+
+// 2. Verify recordSkillInstall writes and serializes correctly
+manifestHelper.recordSkillInstall(testManifestPath, '1.0.0', 'test-skill', '/path/to/test-skill');
+const writtenManifest = manifestHelper.readManifest(testManifestPath);
+helper.check(
+  '2h. recordSkillInstall successfully records skill information',
+  writtenManifest.version === '1.0.0' &&
+    writtenManifest.skills.length === 1 &&
+    writtenManifest.skills[0].id === 'test-skill' &&
+    writtenManifest.skills[0].dirPath === '/path/to/test-skill',
+  `Got: ${JSON.stringify(writtenManifest)}`
+);
+
+// 3. Verify recordGeneratedSkill and removeGeneratedSkill
+manifestHelper.recordGeneratedSkill(testManifestPath, 'gen-skill', '/path/to/gen-skill', 'desc', ['trigger']);
+const withGenerated = manifestHelper.readManifest(testManifestPath);
+helper.check(
+  '2h. recordGeneratedSkill successfully records generated skill with triggers',
+  withGenerated.generated &&
+    withGenerated.generated.length === 1 &&
+    withGenerated.generated[0].id === 'gen-skill' &&
+    withGenerated.generated[0].triggers.includes('trigger'),
+  `Got: ${JSON.stringify(withGenerated)}`
+);
+
+manifestHelper.removeGeneratedSkill(testManifestPath, '/path/to/gen-skill');
+const afterRemoveGen = manifestHelper.readManifest(testManifestPath);
+helper.check(
+  '2h. removeGeneratedSkill removes generated skill correctly',
+  afterRemoveGen.generated && afterRemoveGen.generated.length === 0,
+  `Got: ${JSON.stringify(afterRemoveGen)}`
+);
+
+// 4. Verify isHarnessSkillDir matches correct author
+const mockSkillPath = path.join(manifestMockWs, 'mock-skill-folder');
+fs.mkdirSync(mockSkillPath, { recursive: true });
+const mockSkillMdPath = path.join(mockSkillPath, 'SKILL.md');
+
+fs.writeFileSync(mockSkillMdPath, '---\nauthor: Miya Daniel\n---\n', 'utf8');
+const isHarness = skillsHelper.isHarnessSkillDir(mockSkillPath);
+helper.check(
+  '2h. isHarnessSkillDir detects Harness author correctly',
+  isHarness === true,
+  `Expected true but got false`
+);
+
+// Regression: spec-compliant frontmatter (author nested under metadata:) must
+// also be recognized. Guards the getMeta parser in scripts/lib/skills.js.
+fs.writeFileSync(mockSkillMdPath, '---\nname: spec-skill\ndescription: x\nlicense: Apache-2.0\nmetadata:\n  author: Miya Daniel\n  version: 0.3.3\n---\n', 'utf8');
+const isHarnessSpec = skillsHelper.isHarnessSkillDir(mockSkillPath);
+helper.check(
+  '2h. isHarnessSkillDir detects author under metadata: (spec format)',
+  isHarnessSpec === true,
+  `Expected true but got false`
+);
+
+fs.writeFileSync(mockSkillMdPath, '---\nauthor: Outsider\n---\n', 'utf8');
+const isNotHarness = skillsHelper.isHarnessSkillDir(mockSkillPath);
+helper.check(
+  '2h. isHarnessSkillDir returns false for foreign authors',
+  isNotHarness === false,
+  `Expected false but got true`
+);
+
+// 5. Verify removeSkillFromManifest removes skill and deletes empty manifest
+manifestHelper.removeSkillFromManifest(testManifestPath, '/path/to/test-skill');
+helper.check(
+  '2h. removeSkillFromManifest cleans up or unlinks empty manifest',
+  !fs.existsSync(testManifestPath),
+  `Manifest file still exists after removing all entries!`
+);
+
+// 6. Verify Fable agent definitions install into the native Claude agent
+// directory, preserve a conflicting user file, and are manifest tracked.
+const agentTargetDir = path.join(manifestMockWs, 'agents');
+const agentManifestPath = path.join(manifestMockWs, 'agent-manifest.json');
+fs.mkdirSync(agentTargetDir, { recursive: true });
+const conflictPath = path.join(agentTargetDir, 'fable-orchestrator.md');
+fs.writeFileSync(conflictPath, '---\nname: fable-orchestrator\n---\nuser-owned\n', 'utf8');
+skillsHelper.installAgentsToTarget({
+  target: { path: agentTargetDir, label: 'test-agents/', manifestPath: agentManifestPath },
+  harnessSourceDir: path.join(__dirname, '..'),
+  packageVersion: '1.0.0'
+});
+const installedAgents = manifestHelper.readManifest(agentManifestPath).agents;
+helper.check(
+  '2h. Fable agents are manifest tracked without overwriting a conflicting file',
+  installedAgents.length === 3 &&
+    fs.readFileSync(conflictPath, 'utf8').includes('user-owned') &&
+    fs.existsSync(path.join(agentTargetDir, 'fable-verifier.md')),
+  `Got: ${JSON.stringify(installedAgents)}`
+);
+
+for (const agent of [...installedAgents]) {
+  skillsHelper.removeAgent({ ...agent, manifestPath: agentManifestPath });
+}
+helper.check(
+  '2h. Removing Fable agents removes only tracked files and manifest state',
+  fs.existsSync(conflictPath) && !fs.existsSync(agentManifestPath),
+  `Agent conflict or manifest was removed unexpectedly`
+);
+
+const identicalPath = path.join(agentTargetDir, 'fable-verifier.md');
+fs.copyFileSync(path.join(__dirname, '..', 'fable-mode', 'agents', 'fable-verifier.md'), identicalPath);
+skillsHelper.installAgentsToTarget({
+  target: { path: agentTargetDir, label: 'test-agents/', manifestPath: agentManifestPath },
+  harnessSourceDir: path.join(__dirname, '..'),
+  packageVersion: '1.0.0'
+});
+const secondInstall = manifestHelper.readManifest(agentManifestPath).agents;
+helper.check(
+  '2h. Pre-existing identical agent is not claimed as Harness-owned',
+  secondInstall.length === 2,
+  `Got: ${JSON.stringify(secondInstall)}`
+);
+for (const agent of [...secondInstall]) {
+  skillsHelper.removeAgent({ ...agent, manifestPath: agentManifestPath });
+}
+helper.check(
+  '2h. Pre-existing identical agent survives tracked-agent removal',
+  fs.existsSync(conflictPath) && fs.existsSync(identicalPath),
+  `A pre-existing agent was removed unexpectedly`
+);
+
+fs.rmSync(manifestMockWs, { recursive: true, force: true });
+
+helper.finish();

package/ci/mechanism-2i-crlf-frontmatter.test.js

@@ -0,0 +1,145 @@
+#!/usr/bin/env node
+/**
+ * [2i] CRLF frontmatter immunity for quality gates.
+ *
+ * Regression guard for issue #5: every frontmatter parser in eval-framework
+ * must tolerate CRLF line endings. A Windows clone (core.autocrlf=true) used
+ * to produce 83 spurious consistency failures AND — worse — made the
+ * collision check silently compare 27 empty descriptions and pass as a no-op.
+ *
+ * Method: copy the repo to a temp dir, convert every SKILL.md to CRLF, then:
+ *   (a) consistency-check must PASS on the converted tree;
+ *   (b) collision check must PASS unmodified;
+ *   (c) negative control: plant a duplicated description pair -> collision
+ *       check must FAIL. If parsing ever regresses to empty strings again,
+ *       jaccard(NaN) trips nothing and this control goes red.
+ */
+
+const { spawnSync } = require('child_process');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const projectRoot = path.resolve(__dirname, '..');
+let tmpRoot = null;
+
+function check(name, condition, detail) {
+  if (condition) {
+    console.log(`✅ ${name}`);
+    return true;
+  }
+  console.error(`❌ ${name}`);
+  if (detail) console.error(`   ${detail}`);
+  return false;
+}
+
+function listSkillMdFiles(dir) {
+  const out = [];
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (entry.name.startsWith('.') || !entry.isDirectory()) continue;
+    const skillMd = path.join(dir, entry.name, 'SKILL.md');
+    if (fs.existsSync(skillMd)) out.push(skillMd);
+    const subDir = path.join(dir, entry.name);
+    for (const sub of fs.readdirSync(subDir, { withFileTypes: true })) {
+      if (!sub.isDirectory()) continue;
+      const nested = path.join(subDir, sub.name, 'SKILL.md');
+      if (fs.existsSync(nested)) out.push(nested);
+    }
+  }
+  return out;
+}
+
+function toCrlf(file) {
+  const raw = fs.readFileSync(file, 'utf8');
+  fs.writeFileSync(file, raw.replace(/\r?\n/g, '\r\n'), 'utf8');
+}
+
+function setDescription(file, newDesc) {
+  const lines = fs.readFileSync(file, 'utf8').split('\n');
+  const idx = lines.findIndex(l => l.replace(/\r$/, '').startsWith('description:'));
+  if (idx === -1) throw new Error(`no description line in ${file}`);
+  lines[idx] = `description: ${newDesc}`;
+  fs.writeFileSync(file, lines.join('\n'), 'utf8');
+}
+
+function getDescription(file) {
+  const raw = fs.readFileSync(file, 'utf8');
+  const fm = (raw.match(/^---\r?\n([\s\S]*?)\r?\n---/) || [])[1] || '';
+  return ((fm.match(/^description:\s*(.+)$/m) || [])[1] || '').trim();
+}
+
+function runGate(cwd, script) {
+  const r = spawnSync(process.execPath, [path.join('ci', script)], {
+    cwd,
+    encoding: 'utf8',
+  });
+  return { code: r.status, stdout: r.stdout || '', stderr: r.stderr || '' };
+}
+
+let failures = 0;
+
+try {
+  // Hermetic workspace: full repo copy minus VCS.
+    tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-crlf-test-'));
+    fs.cpSync(projectRoot, tmpRoot, {
+    recursive: true,
+    filter: (src) => {
+      const rel = path.relative(projectRoot, src);
+      const first = rel.split(path.sep)[0];
+      return first !== '.git' && first !== 'node_modules';
+    },
+  });
+  
+  // Copy node_modules separately to preserve symlinks
+  fs.cpSync(path.join(projectRoot, 'node_modules'), path.join(tmpRoot, 'node_modules'), {
+    recursive: true,
+  });
+
+  const skillMdFiles = listSkillMdFiles(tmpRoot);
+  if (!check(
+    '2i-pre. Found enough SKILL.md fixtures in copied tree',
+    skillMdFiles.length >= 20,
+    `Got ${skillMdFiles.length}`
+  )) failures++;
+  skillMdFiles.forEach(toCrlf);
+
+  // (a) Consistency gate must survive a fully-CRLF working tree.
+  const consistency = runGate(tmpRoot, 'consistency-check.js');
+  if (!check(
+    '2i-a. consistency-check passes on all-CRLF tree',
+    consistency.code === 0 && consistency.stdout.includes('ALL CONSISTENCY CHECKS PASSED'),
+    `exit=${consistency.code}, tail="${(consistency.stdout + consistency.stderr).trim().slice(-200)}"`
+  )) failures++;
+
+  // (b) Collision gate must pass unmodified...
+  const collisionClean = runGate(tmpRoot, 'description-collision.js');
+  if (!check(
+    '2i-b. description-collision passes on all-CRLF tree',
+    collisionClean.code === 0,
+    `exit=${collisionClean.code}, tail="${(collisionClean.stdout + collisionClean.stderr).trim().slice(-200)}"`
+  )) failures++;
+
+  // (c) ...and must still be comparing REAL descriptions. Plant a duplicate:
+  // if parsing regressed to empty strings, similarity would be NaN/0 and this
+  // would silently pass — exactly the pre-fix failure mode.
+  const donor = path.join(tmpRoot, 'tdd', 'SKILL.md');
+  const target = path.join(tmpRoot, 'zoom-out', 'SKILL.md');
+  setDescription(target, getDescription(donor));
+  const collisionDup = runGate(tmpRoot, 'description-collision.js');
+  if (!check(
+    '2i-c. Negative control: planted CRLF duplicate FAILS collision check',
+    collisionDup.code !== 0,
+    `exit=${collisionDup.code} (a silent no-op parses empty descriptions and passes here), tail="${(collisionDup.stdout + collisionDup.stderr).trim().slice(-200)}"`
+  )) failures++;
+} catch (err) {
+  failures++;
+  console.error(`❌ 2i-setup. Test harness error: ${err.message}`);
+} finally {
+  if (tmpRoot) {
+    try { fs.rmSync(tmpRoot, { recursive: true, force: true }); } catch (e) { /* best-effort */ }
+  }
+}
+
+if (failures > 0) process.exit(1);
+console.log('\n[2i] CRLF frontmatter immunity: all checks passed.');
+process.exit(0);

package/ci/mechanism-2i-install-verification.test.js

@@ -0,0 +1,34 @@
+const fs = require('fs');
+const path = require('path');
+const helper = require('./test-helper');
+const manifest = require('../scripts/lib/manifest');
+const { verifyManifest } = require('../scripts/verify-install');
+
+console.log('\n[2i] Installed version and skill-tree verification...');
+const root = helper.tempDir('.mechanism-test-install-verification');
+const installedRoot = path.join(root, 'skills');
+const installedSkill = path.join(installedRoot, 'tdd');
+const manifestPath = path.join(root, 'harness-everything', 'manifest.json');
+fs.mkdirSync(installedRoot, { recursive: true });
+fs.cpSync(path.join(__dirname, '..', 'tdd'), installedSkill, { recursive: true });
+manifest.recordSkillInstall(manifestPath, require('../package.json').version, 'tdd', installedSkill);
+
+let result = verifyManifest(manifestPath, installedRoot);
+helper.check('2i. matching version and tree pass', result.failures.length === 0, result.failures.join('; '));
+
+fs.appendFileSync(path.join(installedSkill, 'SKILL.md'), '\nlocal drift\n');
+result = verifyManifest(manifestPath, installedRoot);
+helper.check('2i. modified installed skill is reported stale', result.failures.some(f => f.includes('STALE tree: tdd')), JSON.stringify(result.failures));
+
+const data = manifest.readManifest(manifestPath);
+data.version = '0.3.3';
+manifest.writeManifest(manifestPath, data);
+result = verifyManifest(manifestPath, installedRoot);
+helper.check('2i. old package version is reported stale', result.failures.some(f => f.includes('STALE version')), JSON.stringify(result.failures));
+
+fs.rmSync(manifestPath, { force: true });
+result = verifyManifest(manifestPath, installedRoot);
+helper.check('2i. legacy install without a manifest is reported stale', result.failures.some(f => f.includes('STALE untracked installation')), JSON.stringify(result.failures));
+
+fs.rmSync(root, { recursive: true, force: true });
+helper.finish();