harness-everything 0.2.2 → 0.4.0

package/ci/release-consistency-check.js

@@ -0,0 +1,146 @@
+#!/usr/bin/env node
+/**
+ * Compare the checked-out skill catalog and SKILL.md path references with a
+ * named release tag. This keeps a release-to-release file-tree claim backed by
+ * Git objects instead of by the current working tree alone.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { execFileSync } = require('child_process');
+const { discoverSkills, extractCandidates, checkSkillReferences } = require('./reference-check');
+
+const root = path.resolve(__dirname, '..');
+const tagIndex = process.argv.indexOf('--tag');
+
+// A hard-coded baseline silently rots: it stayed on v0.3.3-beta while the
+// package moved to 0.3.6, so every run compared the tree against a release
+// three weeks old and still reported PASSED (issue #39). Derive it instead.
+function latestTag() {
+  try {
+    return git(['describe', '--tags', '--abbrev=0']);
+  } catch (err) {
+    try {
+      return git(['for-each-ref', '--sort=-creatordate', '--format=%(refname:short)', '--count=1', 'refs/tags']);
+    } catch (inner) {
+      return '';
+    }
+  }
+}
+
+const tag = tagIndex !== -1
+  ? process.argv[tagIndex + 1]
+  : (process.env.HARNESS_RELEASE_TAG || latestTag());
+
+if (!tag) {
+  console.error('No release tag to compare against. Pass --tag <tag>, set HARNESS_RELEASE_TAG, or fetch tags (actions/checkout needs fetch-depth: 0).');
+  process.exit(2);
+}
+const ignoredPrefixes = new Set(['.claude', '.github', '.cursor', '.codex', '.continue', 'tasks', 'memories', 'specs', 'docs', 'evals']);
+const rootPrefixes = new Set(['hooks', 'harness-everything', 'to-spec', 'to-tickets', 'bin', 'ci', 'skill-creator', 'self-evolve']);
+const releaseRenames = new Map([
+  ['build-multi-agent-system', 'multi-agent-workspace'],
+  ['create-agent-launcher', 'multi-agent-workspace']
+]);
+
+function git(args) {
+  return execFileSync('git', args, { cwd: root, encoding: 'utf8' }).trim();
+}
+
+function tagFiles(scope) {
+  return new Set(git(['ls-tree', '-r', '--name-only', tag, '--', scope]).split(/\r?\n/).filter(Boolean));
+}
+
+function tagSkills() {
+  return git(['ls-tree', '-d', '--name-only', tag]).split(/\r?\n/)
+    .filter(name => name && !name.startsWith('.') && tagFiles(name).has(`${name}/SKILL.md`));
+}
+
+function currentFiles(scope) {
+  const result = new Set();
+  function walk(dir) {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) walk(full);
+      else if (entry.isFile()) result.add(path.relative(path.join(root, scope), full).replace(/\\/g, '/'));
+    }
+  }
+  walk(path.join(root, scope));
+  return result;
+}
+
+function resolveTagReference(skillDir, reference, allFiles) {
+  let ref = reference.replace(/\\/g, '/');
+  if (ref.includes('<') && !ref.startsWith('<this-skill-dir>/') && !ref.startsWith('<skills-repo-root>/')) return null;
+  ref = ref.replace(/^<this-skill-dir>\//, '').replace(/^<skills-repo-root>\//, '');
+  if (!ref.includes('/')) return allFiles.has(ref) ? ref : (allFiles.has(`${skillDir}/${ref}`) ? `${skillDir}/${ref}` : null);
+  if (ref.startsWith('./') || ref.startsWith('../')) return path.posix.normalize(`${skillDir}/${ref}`);
+  const first = ref.split('/')[0];
+  if (ignoredPrefixes.has(first)) return null;
+  if (rootPrefixes.has(first) || allFiles.has(`${first}/SKILL.md`)) return ref;
+  return `${skillDir}/${ref}`;
+}
+
+function main() {
+  let tagRoot;
+  try {
+    tagRoot = tagSkills();
+  } catch (err) {
+    console.error(`Release tag ${tag} is unavailable: ${err.message.trim()}`);
+    process.exit(2);
+  }
+  const current = new Set(discoverSkills(root));
+  const currentLogical = new Set([...current].map(skill => releaseRenames.get(skill) || skill));
+  const releaseLogical = new Set(tagRoot.map(skill => releaseRenames.get(skill) || skill));
+  const missing = [...releaseLogical].filter(skill => !currentLogical.has(skill));
+  const extra = [...currentLogical].filter(skill => !releaseLogical.has(skill));
+  console.log(`Release ${tag}: ${tagRoot.length} skill(s); current tree: ${current.size} skill(s).`);
+  if (missing.length || extra.length) {
+    if (missing.length) console.error(`Missing from current tree: ${missing.join(', ')}`);
+    if (extra.length) console.error(`Not present in release tag: ${extra.join(', ')}`);
+    process.exit(1);
+  }
+
+  let references = 0;
+  let failures = 0;
+  const allFiles = new Set(git(['ls-tree', '-r', '--name-only', tag]).split(/\r?\n/).filter(Boolean));
+  const tagDocuments = [...allFiles]
+    .filter(file => file.endsWith('/SKILL.md'))
+    .filter(file => tagRoot.includes(file.split('/')[0]));
+  for (const document of tagDocuments) {
+    const skill = path.posix.dirname(document);
+    const skillText = git(['show', `${tag}:${document}`]);
+    for (const reference of extractCandidates(skillText)) {
+      const resolved = resolveTagReference(skill, reference, allFiles);
+      if (!resolved) continue;
+      references++;
+      if (!allFiles.has(resolved)) {
+        console.warn(`BASELINE NOTE ${skill}/SKILL.md -> ${reference} (missing ${resolved} in ${tag})`);
+        failures++;
+      }
+    }
+  }
+  for (const skill of tagRoot) {
+    const files = tagFiles(skill);
+    const currentSkill = current.has(skill) ? skill : releaseRenames.get(skill);
+    const sourceFiles = currentSkill && current.has(currentSkill) ? currentFiles(currentSkill) : new Set();
+    const renameNote = currentSkill && currentSkill !== skill ? ` (renamed to ${currentSkill})` : '';
+    console.log(`  ${skill}: ${files.size} file(s) in ${tag}; ${sourceFiles.size} file(s) in current source${renameNote}`);
+  }
+  console.log(`Checked ${references} release-tag skill reference(s).`);
+  if (failures) {
+    console.warn(`RELEASE BASELINE NOTE: ${failures} historical reference(s) in ${tag} do not resolve; current-tree references are gated separately.`);
+  }
+  const currentReferences = checkSkillReferences(root);
+  console.log(`Checked ${currentReferences.references} current skill path reference(s).`);
+  for (const failure of currentReferences.failures) {
+    console.error(`CURRENT FAIL ${failure.skill}/SKILL.md -> ${failure.reference} (missing ${failure.target})`);
+  }
+  if (currentReferences.failures.length) {
+    console.error(`CURRENT RELEASE CHECK FAILED: ${currentReferences.failures.length} dangling reference(s).`);
+    process.exit(1);
+  }
+  console.log(`RELEASE SKILL CATALOG PASSED for ${tag}; current source has the same logical skill catalog (${tagRoot.length} release entries, ${current.size} current directories after merges).`);
+}
+
+if (require.main === module) main();

package/ci/router-phase2-safety.test.js

@@ -0,0 +1,81 @@
+#!/usr/bin/env node
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+const tierRouter = path.join(ROOT, 'harness-everything', 'scripts', 'tier-router.js');
+const { validateRouterContract } = require(path.join(ROOT, 'harness-everything', 'scripts', 'router-contract.js'));
+let failed = 0;
+
+function check(condition, message) {
+  if (condition) console.log(`  PASS ${message}`);
+  else {
+    console.error(`  FAIL ${message}`);
+    failed++;
+  }
+}
+
+function route(prompt) {
+  const contractPath = path.join(os.tmpdir(), `harness-router-phase2-safety-${process.pid}-${Math.random().toString(16).slice(2)}.json`);
+  const result = spawnSync(process.execPath, [tierRouter, prompt], {
+    cwd: ROOT,
+    encoding: 'utf8',
+    env: { ...process.env, HARNESS_ROUTER_CONTRACT_PATH: contractPath },
+  });
+  let contract = null;
+  if (fs.existsSync(contractPath)) {
+    contract = JSON.parse(fs.readFileSync(contractPath, 'utf8'));
+    fs.rmSync(contractPath, { force: true });
+  }
+  return { result, contract };
+}
+
+console.log('=== Router Phase 2 Explicit-Parallel Safety ===');
+
+const unproven = route('Use fable-parallel to audit the entire repository architecture.');
+check(unproven.result.status === 0, 'unproven explicit parallel request does not crash routing');
+check(Boolean(unproven.contract), 'unproven explicit parallel request emits a contract');
+if (unproven.contract) {
+  const validation = validateRouterContract(unproven.contract);
+  check(validation.valid, `serialized explicit request validates (${validation.errors.join('; ') || 'no errors'})`);
+  check(unproven.contract.taskShape.explicitRequest.strategy === 'fable-parallel', 'original explicit fable-parallel request remains recorded');
+  check(unproven.contract.workflowPlan.strategy === 'fable-staged', 'unproven parallel request serializes to fable-staged');
+  check(unproven.contract.workflowPlan.fallback.disposition === 'reduced', 'unproven parallel request exposes reduced fallback');
+  check(unproven.contract.workflowPlan.fallback.mode === 'serialized', 'unproven parallel request exposes serialized fallback mode');
+  check(unproven.contract.workflowPlan.fallback.reasonCodes.includes('parallel-preconditions-unproven'), 'unproven parallel request records precondition reason');
+}
+
+const overlap = route('Use fable-parallel with independent agents editing the same file across the entire repository.');
+check(overlap.result.status === 0, 'overlapping explicit parallel request does not crash routing');
+check(Boolean(overlap.contract), 'overlapping explicit parallel request emits a contract');
+if (overlap.contract) {
+  check(overlap.contract.taskShape.writeSetOverlap === 'overlap', 'overlap evidence is machine-visible');
+  check(overlap.contract.workflowPlan.strategy === 'fable-staged', 'explicit parallel overlap serializes to staged');
+  check(overlap.contract.workflowPlan.fallback.reasonCodes.includes('parallel-write-set-overlap'), 'overlap serialization has a deterministic reason');
+}
+
+const safe = route('Use fable-parallel for independent read-only security and architecture audits across the entire repository.');
+check(safe.result.status === 0, 'validated explicit parallel request routes successfully');
+check(Boolean(safe.contract), 'validated explicit parallel request emits a contract');
+if (safe.contract) {
+  const validation = validateRouterContract(safe.contract);
+  check(validation.valid, `validated explicit parallel contract passes (${validation.errors.join('; ') || 'no errors'})`);
+  check(safe.contract.workflowPlan.strategy === 'fable-parallel', 'validated explicit parallel request keeps fable-parallel');
+  check(safe.contract.workflowPlan.parallelism.allowed === true, 'validated explicit parallel request enables parallelism');
+  check(safe.contract.workflowPlan.fallback.disposition === 'none', 'validated explicit parallel request needs no fallback');
+}
+
+const contradiction = route('Use fable-parallel to audit the entire repository, but do not use parallel execution.');
+check(contradiction.result.status === 0, 'contradictory explicit request remains representable');
+check(Boolean(contradiction.contract), 'contradictory explicit request emits a contract');
+if (contradiction.contract) {
+  const validation = validateRouterContract(contradiction.contract);
+  check(validation.valid, `blocked contradiction is still a valid audit contract (${validation.errors.join('; ') || 'no errors'})`);
+  check(contradiction.contract.workflowPlan.fallback.disposition === 'blocked', 'explicit strategy/prohibition conflict is blocked');
+  check(contradiction.contract.workflowPlan.fallback.reasonCodes.includes('explicit-request-conflicts-with-prohibition'), 'explicit contradiction records its reason');
+}
+
+console.log(`\n${failed === 0 ? 'PASS' : 'FAIL'}: router phase 2 explicit-parallel safety (${failed} failure${failed === 1 ? '' : 's'})`);
+process.exit(failed === 0 ? 0 : 1);

package/ci/router-workflow-plan.test.js

@@ -0,0 +1,264 @@
+#!/usr/bin/env node
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+const tierRouter = path.join(ROOT, 'harness-everything', 'scripts', 'tier-router.js');
+const kernelRouter = path.join(ROOT, 'harness-everything', 'scripts', 'kernel-router.js');
+const {
+  ITERATIVE_MAX_ITERATIONS,
+  validateRouterContract,
+} = require(path.join(ROOT, 'harness-everything', 'scripts', 'router-contract.js'));
+let failed = 0;
+
+function check(condition, message) {
+  if (condition) {
+    console.log(`  PASS ${message}`);
+  } else {
+    console.error(`  FAIL ${message}`);
+    failed++;
+  }
+}
+
+function runTier(prompt, options = {}) {
+  const contractPath = path.join(os.tmpdir(), `harness-router-test-${process.pid}-${Math.random().toString(16).slice(2)}.json`);
+  const context = options.context || null;
+  const args = context ? [tierRouter] : [tierRouter, prompt];
+  const result = spawnSync(process.execPath, args, {
+    cwd: ROOT,
+    encoding: 'utf8',
+    input: context ? JSON.stringify({ ...context, prompt }) : undefined,
+    env: {
+      ...process.env,
+      ...(options.env || {}),
+      HARNESS_ROUTER_CONTRACT_PATH: contractPath,
+    },
+  });
+
+  let contract = null;
+  if (fs.existsSync(contractPath)) {
+    contract = JSON.parse(fs.readFileSync(contractPath, 'utf8'));
+    fs.rmSync(contractPath, { force: true });
+  }
+  return { result, contract };
+}
+
+function validContract(run, label) {
+  check(run.result.status === 0, `${label}: tier router exits successfully`);
+  check(Boolean(run.contract), `${label}: structured contract exists`);
+  if (!run.contract) return false;
+  const validation = validateRouterContract(run.contract);
+  check(validation.valid, `${label}: contract validates (${validation.errors.join('; ') || 'no errors'})`);
+  return validation.valid;
+}
+
+console.log('=== Router Workflow Plan Contract — Phase 2 ===');
+
+const direct = runTier('Update one README typo');
+if (validContract(direct, 'direct-single')) {
+  const plan = direct.contract.workflowPlan;
+  check(plan.tier === 'tier1', 'one-file trivial task remains tier1');
+  check(plan.strategy === 'direct-single', 'one-file trivial task selects direct-single');
+  check(plan.strategySelection === 'selected', 'direct-single is a selected strategy');
+  check(plan.workspace.required === false, 'direct-single does not require a workspace');
+  check(plan.parallelism.allowed === false, 'direct-single does not parallelize');
+}
+
+const iterative = runTier('Fix this checkout bug and add a regression test.');
+if (validContract(iterative, 'iterative-single')) {
+  const plan = iterative.contract.workflowPlan;
+  check(plan.tier === 'tier2', 'ordinary test-first bug fix is tier2');
+  check(plan.strategy === 'iterative-single', 'ordinary bug fix selects iterative-single');
+  check(plan.limits.maxIterations === ITERATIVE_MAX_ITERATIONS, 'iterative-single has an explicit loop budget');
+  check(plan.requiredInvariants.includes('objective-verification'), 'iterative-single carries objective verification invariant');
+  check(plan.requiredInvariants.includes('loop-budget'), 'iterative-single carries loop-budget invariant');
+  check(plan.suggestedSkills.includes('tdd'), 'TDD stays advisory rather than an invariant');
+  check(!plan.requiredInvariants.includes('tdd'), 'suggested skills are separated from mandatory invariants');
+}
+
+const staged = runTier('Refactor the entire authentication architecture in dependent stages.');
+if (validContract(staged, 'fable-staged')) {
+  const plan = staged.contract.workflowPlan;
+  check(plan.tier === 'tier3', 'multi-stage architecture work is tier3');
+  check(plan.strategy === 'fable-staged', 'dependent multi-stage work selects fable-staged');
+  check(plan.parallelism.allowed === false, 'dependent stages remain sequential');
+  check(plan.verification.mode === 'cold-verifier', 'fable-staged requires cold verification');
+}
+
+const parallelPrompt = 'Audit the entire repository with independent read-only security, architecture, and documentation workstreams.';
+const parallel = runTier(parallelPrompt);
+if (validContract(parallel, 'fable-parallel')) {
+  const shape = parallel.contract.taskShape;
+  const plan = parallel.contract.workflowPlan;
+  check(shape.dependencyGraph === 'independent', 'parallel task records independent dependency graph');
+  check(shape.writeSetOverlap === 'read-only', 'parallel audit records read-only write set');
+  check(plan.strategy === 'fable-parallel', 'independent read-only audits select fable-parallel');
+  check(plan.parallelism.allowed === true, 'fable-parallel exposes allowed=true');
+  check(plan.requiredInvariants.includes('synthesis-barrier'), 'parallel strategy requires synthesis barrier');
+}
+
+const sharedWrite = runTier('Audit the entire repository with independent agents in parallel editing the same file.');
+if (validContract(sharedWrite, 'shared-write serialization')) {
+  check(sharedWrite.contract.taskShape.writeSetOverlap === 'overlap', 'same-file writers are recorded as overlapping');
+  check(sharedWrite.contract.workflowPlan.strategy === 'fable-staged', 'same-file writers are serialized instead of fable-parallel');
+  check(sharedWrite.contract.workflowPlan.parallelism.allowed === false, 'overlapping writes cannot dispatch in parallel');
+}
+
+const workspace = runTier('Audit the entire repository as a durable multi-session effort with reusable specialists across security and architecture.');
+if (validContract(workspace, 'multi-agent workspace')) {
+  const plan = workspace.contract.workflowPlan;
+  check(plan.strategy === 'fable-multi-agent-workspace', 'durable reusable specialists select workspace topology');
+  check(plan.workspace.required === true, 'workspace topology marks workspace required');
+  check(plan.memory.read === 'workspace-index', 'workspace topology scopes reads through workspace index');
+  check(plan.memory.write === 'propose', 'workspace memory writes remain proposals');
+}
+
+const unknown = runTier('frobnicate the quux');
+if (validContract(unknown, 'unclassified')) {
+  check(unknown.contract.classification.tier === 'unclassified', 'no matched signal remains unclassified');
+  check(unknown.contract.workflowPlan.strategy === null, 'unclassified does not silently select direct-single');
+  check(unknown.contract.workflowPlan.strategySelection === 'deferred', 'unclassified strategy selection is deferred');
+  check(unknown.contract.workflowPlan.reasonCodes.includes('unclassified-strategy-deferred'), 'deferred selection has deterministic reason code');
+}
+
+const destructive = runTier('Drop the prod database table and force push to main.');
+if (validContract(destructive, 'actionGate')) {
+  const gate = destructive.contract.workflowPlan.actionGate;
+  check(gate.required === true, 'irreversible command intent requires actionGate independent of tier');
+  check(gate.reasonCodes.includes('irreversible-action'), 'actionGate records irreversible-action');
+  check(gate.disposition === 'pending-approval', 'actionGate closes at pending approval before execution');
+  check(destructive.contract.workflowPlan.requiredInvariants.includes('pre-action-approval'), 'actionGate adds pre-action invariant');
+}
+
+const external = runTier('Deploy to production and publish the package release.');
+if (validContract(external, 'external side effect')) {
+  check(external.contract.workflowPlan.actionGate.required === true, 'external side effect requires actionGate');
+  check(external.contract.workflowPlan.actionGate.reasonCodes.includes('external-side-effect'), 'external side effect reason is explicit');
+}
+
+const fableTypo = runTier('fix typo in the fable-mode readme');
+if (validContract(fableTypo, 'fable keyword trivial edit')) {
+  check(fableTypo.contract.classification.tier === 'tier1', 'fable keyword does not force Tier 3 on a trivial README typo');
+  check(fableTypo.contract.workflowPlan.strategy === 'direct-single', 'fable README typo remains direct-single');
+}
+
+const explicitFable = runTier('fable on opus audit the entire repository architecture');
+if (validContract(explicitFable, 'explicit Fable model')) {
+  check(explicitFable.contract.workflowPlan.strategy === 'fable-staged', 'explicit Fable request selects Fable topology');
+  check(explicitFable.contract.workflowPlan.modelSelection.requested === 'opus', 'explicit Fable model stays delegated to model selector');
+  check(explicitFable.result.stdout.includes('REQUESTED FABLE MODEL MODE: opus'), 'legacy explicit Fable route remains visible');
+}
+
+const explicitOverride = runTier('Use iterative-single to audit the entire repository architecture.');
+if (validContract(explicitOverride, 'explicit strategy override')) {
+  check(explicitOverride.contract.workflowPlan.strategy === 'iterative-single', 'explicit user strategy overrides derived Tier 3 topology');
+  check(explicitOverride.contract.workflowPlan.reasonCodes.includes('explicit-strategy-request'), 'explicit strategy override is recorded');
+}
+
+const prohibitedParallel = runTier(`${parallelPrompt} Do not use parallel execution.`);
+if (validContract(prohibitedParallel, 'parallel prohibition')) {
+  check(prohibitedParallel.contract.workflowPlan.strategy === 'fable-staged', 'explicit no-parallel prohibition serializes derived parallel work');
+  check(prohibitedParallel.contract.workflowPlan.fallback.disposition === 'reduced', 'parallel prohibition is a visible reduced fallback');
+  check(prohibitedParallel.contract.workflowPlan.fallback.reasonCodes.includes('user-prohibited-parallelism'), 'parallel prohibition reason is recorded');
+}
+
+const noParallelCapability = runTier(parallelPrompt, {
+  context: { hostCapabilities: { parallelCalls: 'unavailable', subagents: 'available' } },
+});
+if (validContract(noParallelCapability, 'parallel capability fallback')) {
+  check(noParallelCapability.contract.workflowPlan.strategy === 'fable-staged', 'missing parallel capability serializes to fable-staged');
+  check(noParallelCapability.contract.workflowPlan.fallback.mode === 'serialized', 'parallel capability fallback is visibly serialized');
+  check(noParallelCapability.contract.workflowPlan.fallback.reasonCodes.includes('parallel-capability-unavailable'), 'missing parallel capability reason is recorded');
+}
+
+const concurrencyOne = runTier(parallelPrompt, {
+  context: { constraints: { concurrency: 1 }, hostCapabilities: { parallelCalls: 'available', subagents: 'available' } },
+});
+if (validContract(concurrencyOne, 'concurrency budget fallback')) {
+  check(concurrencyOne.contract.workflowPlan.strategy === 'fable-staged', 'concurrency=1 serializes fable-parallel');
+  check(concurrencyOne.contract.workflowPlan.fallback.reasonCodes.includes('concurrency-budget-serializes'), 'concurrency budget reason is recorded');
+}
+
+const noWorkspaceState = runTier('Audit the entire repository as a durable multi-session effort with reusable specialists across security and architecture.', {
+  context: { hostCapabilities: { state: 'unavailable', subagents: 'available' } },
+});
+if (validContract(noWorkspaceState, 'workspace state block')) {
+  check(noWorkspaceState.contract.workflowPlan.strategy === 'fable-multi-agent-workspace', 'workspace requirement remains explicit when state is unavailable');
+  check(noWorkspaceState.contract.workflowPlan.fallback.disposition === 'blocked', 'missing durable state blocks rather than silently downgrades');
+  check(noWorkspaceState.contract.workflowPlan.fallback.reasonCodes.includes('workspace-state-unavailable'), 'workspace block reason is recorded');
+}
+
+const unavailableModel = runTier('fable on opus audit the entire repository architecture', {
+  context: { hostCapabilities: { modelAvailability: 'unavailable', subagents: 'available' } },
+});
+if (validContract(unavailableModel, 'model capability block')) {
+  check(unavailableModel.contract.workflowPlan.modelSelection.requested === 'opus', 'router never remaps requested branded model');
+  check(unavailableModel.contract.workflowPlan.fallback.disposition === 'blocked', 'known unavailable model is visibly blocked');
+  check(unavailableModel.contract.workflowPlan.fallback.reasonCodes.includes('requested-model-capability-unavailable'), 'model capability block reason is recorded');
+}
+
+const hookUnavailable = runTier('Drop the prod database table.', {
+  context: { hostCapabilities: { hooks: 'unavailable' } },
+});
+if (validContract(hookUnavailable, 'actionGate capability block')) {
+  check(hookUnavailable.contract.workflowPlan.actionGate.required === true, 'actionGate requirement survives missing hook capability');
+  check(hookUnavailable.contract.workflowPlan.fallback.disposition === 'blocked', 'known missing action-gate hook blocks side effect');
+  check(hookUnavailable.contract.workflowPlan.fallback.reasonCodes.includes('action-gate-hook-unavailable'), 'missing hook capability is visible');
+}
+
+const guideDedup = runTier('security audit login authentication');
+const securityGuideCount = (guideDedup.result.stdout.match(/security-review\/SKILL\.md/g) || []).length;
+check(securityGuideCount === 1, 'duplicate guide matches emit security-review/SKILL.md exactly once by path');
+
+const repeatA = runTier('Fix this checkout bug and add a regression test.');
+const repeatB = runTier('Fix this checkout bug and add a regression test.');
+if (repeatA.contract && repeatB.contract) {
+  check(JSON.stringify(repeatA.contract) === JSON.stringify(repeatB.contract), 'same normalized input produces byte-equivalent structured contracts');
+}
+
+const invalidConfigPath = path.join(os.tmpdir(), `harness-invalid-routing-${process.pid}.json`);
+fs.writeFileSync(invalidConfigPath, '{ invalid json', 'utf8');
+const degraded = runTier('frobnicate the quux', { env: { HARNESS_ROUTING_CONFIG_PATH: invalidConfigPath } });
+fs.rmSync(invalidConfigPath, { force: true });
+if (validContract(degraded, 'degraded routing')) {
+  check(degraded.contract.routingStatus === 'degraded', 'invalid routing config emits routingStatus=degraded');
+  check(degraded.contract.classification.tier === 'unclassified', 'invalid routing config never silently becomes Tier 1');
+  check(degraded.contract.workflowPlan.strategy === null, 'degraded routing does not select a strategy');
+  check(degraded.contract.workflowPlan.reasonCodes.includes('routing-degraded-strategy-deferred'), 'degraded strategy deferral is explicit');
+}
+
+const kernelUnknown = spawnSync(process.execPath, [kernelRouter, 'frobnicate the quux'], {
+  cwd: ROOT,
+  encoding: 'utf8',
+});
+check(kernelUnknown.status === 0, 'kernel consumes selected/deferred structured contract successfully');
+check(kernelUnknown.stdout.includes('ROUTER WORKFLOW PLAN (JSON)'), 'kernel emits the Phase 2 workflow-plan checkpoint');
+check(kernelUnknown.stdout.includes('"strategySelection":"deferred"'), 'kernel exposes deferred unclassified selection');
+check(!/RECOMMENDED TIER:\s*Tier 1/i.test(kernelUnknown.stdout), 'kernel does not expose a silent Tier 1 fallback for unmatched prompts');
+
+const kernelIterative = spawnSync(process.execPath, [kernelRouter, 'Fix this checkout bug and add a regression test.'], {
+  cwd: ROOT,
+  encoding: 'utf8',
+});
+check(kernelIterative.stdout.includes('"strategy":"iterative-single"'), 'kernel consumes strategy from structured plan');
+check(kernelIterative.stdout.includes('loop-budget:'), 'kernel prints dynamic plan invariants');
+check(kernelIterative.stdout.includes('   - tdd'), 'kernel prints advisory skills separately');
+
+for (const schemaPath of [
+  'harness-everything/schemas/router-task-shape.schema.json',
+  'harness-everything/schemas/router-workflow-plan.schema.json',
+]) {
+  try {
+    const schema = JSON.parse(fs.readFileSync(path.join(ROOT, schemaPath), 'utf8'));
+    assert.strictEqual(schema.$schema, 'https://json-schema.org/draft/2020-12/schema');
+    check(true, `${schemaPath} is valid JSON Schema metadata`);
+  } catch (err) {
+    check(false, `${schemaPath} parses: ${err.message}`);
+  }
+}
+
+console.log(`\n${failed === 0 ? 'PASS' : 'FAIL'}: router workflow plan phase 2 (${failed} failure${failed === 1 ? '' : 's'})`);
+process.exit(failed === 0 ? 0 : 1);

package/ci/routing-check.js

@@ -0,0 +1,91 @@
+#!/usr/bin/env node
+/**
+ * Routing Eval Local Gate
+ * 
+ * Runs `waza spec verify` for all skills' eval.yaml files.
+ * A missing waza installation is a clear, successful skip. CI installs waza;
+ * local callers should see the infrastructure boundary without a false gate
+ * failure.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+const EVALS_DIR = path.join(ROOT, 'evals');
+
+function checkWaza() {
+  try {
+    const r = spawnSync('waza', ['--version'], { stdio: 'ignore', shell: true });
+    return r.status === 0;
+  } catch {
+    return false;
+  }
+}
+
+function discoverSkills() {
+  const skills = [];
+  for (const entry of fs.readdirSync(ROOT, { withFileTypes: true })) {
+    if (!entry.isDirectory() || entry.name.startsWith('.')) continue;
+    const skillMd = path.join(ROOT, entry.name, 'SKILL.md');
+    if (!fs.existsSync(skillMd)) continue;
+    skills.push(entry.name);
+  }
+  return skills.sort();
+}
+
+function runRoutingCheck() {
+  console.log('=== Routing Eval Check ===\n');
+  
+  if (!checkWaza()) {
+    console.log('SKIP: waza not installed; routing eval check was not run.');
+    console.log('   CI installs it from the official installer in .github/workflows/ci.yml.');
+    process.exit(0);
+  }
+  
+  const skills = discoverSkills();
+  console.log(`Found ${skills.length} skills with routing evals\n`);
+  
+  let failed = 0;
+  let passed = 0;
+  
+  for (const skill of skills) {
+    const evalPath = path.join(EVALS_DIR, skill, 'eval.yaml');
+    if (!fs.existsSync(evalPath)) {
+      console.log(`❌ ${skill}: no eval.yaml found`);
+      failed++;
+      continue;
+    }
+    
+    console.log(`Checking ${skill}...`);
+    const r = spawnSync('waza', ['spec', 'verify', skill, evalPath, '--fail', '--threshold', '1'], {
+      cwd: ROOT,
+      encoding: 'utf8',
+      shell: true
+    });
+    
+    if (r.status === 0) {
+      console.log(`  ✅ PASS`);
+      passed++;
+    } else {
+      console.log(`  ❌ FAIL`);
+      console.log(`     ${r.stderr || r.stdout}`);
+      failed++;
+    }
+  }
+  
+  console.log(`\n=== Summary ===`);
+  console.log(`Passed: ${passed}`);
+  console.log(`Failed: ${failed}`);
+  
+  if (failed > 0) {
+    console.log('\n❌ ROUTING EVAL CHECK FAILED');
+    process.exit(1);
+  } else {
+    console.log('\n🎉 ALL ROUTING EVALS PASSED');
+    process.exit(0);
+  }
+}
+
+runRoutingCheck();