harness-everything 0.2.2 → 0.4.0

package/RELEASING.md

@@ -0,0 +1,82 @@
+# Releasing Harness Everything
+
+Harness releases are stable SemVer releases generated automatically from Conventional Commit history on `main`. Do not manually choose or bump a release version in normal pull requests.
+
+## Version policy
+
+`semantic-release` compares `main` with the latest stable `vX.Y.Z` tag and selects the highest required bump:
+
+| Commit | Release |
+| --- | --- |
+| `BREAKING CHANGE:` footer or breaking `!` | major |
+| `feat:` | minor |
+| `fix:` / `perf:` / `refactor:` / `build:` / `revert:` | patch |
+| `docs:` / `test:` / `ci:` / `style:` / `chore:` | none |
+
+There are no alpha, beta, or rc release channels. Historical prerelease tags remain history, but new releases come only from `main` and use `vX.Y.Z` tags.
+
+The migration baseline is the latest stable release tag, currently `v0.3.6`. Existing unreleased manifest strings do not determine the next version; Git history after that tag does.
+
+## Release flow
+
+A push to `main` runs the full reusable CI gate and then semantic-release. A manual `workflow_dispatch` run is available for a safe retry.
+
+1. Check out full Git history and tags.
+2. Run the same CI jobs used for pull requests.
+3. Analyze Conventional Commits since the latest stable release.
+4. Exit without publishing when there is no releasable commit.
+5. Calculate the next stable SemVer.
+6. Run `scripts/sync-release-version.js` to synchronize package, Claude, OpenAI/Codex, OpenCode, lockfile, and changed canonical skill version fields.
+7. Regenerate and verify plugin packages.
+8. Update `CHANGELOG.md` and create `chore(release): X.Y.Z [skip ci]`.
+9. Create tag `vX.Y.Z`, publish npm with provenance, and create the GitHub Release.
+
+Release concurrency is serialized so two updates to `main` cannot publish competing versions.
+
+## Version ownership
+
+The following checked-in fields are release outputs and are synchronized together:
+
+- `package.json`
+- `package-lock.json` and its root package entry
+- `.claude-plugin/plugin.json`
+- `.claude-plugin/marketplace.json`
+- `plugins/harness-everything/plugin.json`
+- `plugins/harness-everything/.codex-plugin/plugin.json`
+- `opencode-plugin/plugin.json`
+- `metadata.version` for canonical skills changed since the previous release tag; when a top-level skill changes, all nested sub-skill `SKILL.md` files inherit that same release version
+
+Unchanged skills keep the version of the release in which they last changed. This preserves useful per-skill provenance while removing manual version edits from normal PRs.
+
+The release workflow passes the previous stable tag explicitly:
+
+```bash
+node scripts/sync-release-version.js 1.2.3 --base v1.2.2
+node scripts/sync-release-version.js --check 1.2.3 --base v1.2.2
+node scripts/sync-release-version.js --validate 1.2.3
+```
+
+Prerelease/build suffixes such as `1.2.3-beta` or `1.2.3+meta` are rejected.
+
+## Contributor requirements
+
+The final commit that lands on `main` must use a Conventional Commit type because it is release input. With squash merging, the PR title becomes especially important. Use `feat`, `fix`, `perf`, `refactor`, `build`, or `revert` when a shipped change needs a release, and use non-releasing types for changes that should not publish.
+
+Keep human-authored pending notes under `[Unreleased]` in `CHANGELOG.md`; semantic-release owns stable release headings and release notes.
+
+## Verification and evidence
+
+The release workflow runs the reusable CI gate before semantic-release. After publication, verify the workflow, GitHub Release, and npm registry rather than inferring publication from source state:
+
+```text
+gh run list --workflow release.yml --limit 5
+gh run view <run-id> --json conclusion,headSha,jobs
+gh release view v<version> --json tagName,publishedAt,url
+npm view harness-everything version dist-tags --json
+```
+
+Record release evidence in [docs/release-evidence.md](docs/release-evidence.md) when the release process requires an auditable observation.
+
+## Failure and retry
+
+A failure before tag/publication leaves no completed release. Running the workflow again against unchanged commit history calculates the same next version. Once a release tag exists, semantic-release treats it as the new baseline and will not republish that version. The generated release commit uses `[skip ci]` and a non-releasing `chore` type to prevent recursive releases.

package/SECURITY.md

@@ -0,0 +1,33 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in Harness, please report it responsibly.
+
+**Do not open a public issue for security vulnerabilities.**
+
+Instead, email: dyphn1@hotmail.com
+
+Include:
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
+
+## Response Timeline
+
+- Acknowledgment within 48 hours
+- Fix or mitigation plan within 7 days for confirmed vulnerabilities
+
+## Scope
+
+This policy covers the Harness-everything repository and its published npm package.
+
+## Hooks and Runtime Behavior
+
+Harness installs execution hooks (circuit breaker, scope guard, stop gate) into Claude Code sessions. These hooks:
+
+- Enforce file-scope boundaries
+- Track verification state
+- Block unsafe operations
+
+If you find a bypass or unintended behavior in these mechanisms, please report it.

package/SUPPORT.md

@@ -0,0 +1,27 @@
+# Support
+
+Harness Everything is an open-source, skill-only plugin for software-development workflows in ChatGPT, Codex, and compatible coding-agent hosts.
+
+## Get help
+
+For installation, routing, skill behavior, or publication-related problems, open a GitHub issue:
+
+https://github.com/dyphn1/Harness-everything/issues
+
+Please include:
+
+- the host and version you were using;
+- the Harness Everything version or commit;
+- the smallest prompt or workflow that reproduces the problem;
+- expected and observed behavior;
+- relevant logs with secrets, credentials, private source, and personal data removed.
+
+## Security reports
+
+Do not post sensitive vulnerability details or credentials in a public issue. Follow the reporting guidance in `SECURITY.md`:
+
+https://github.com/dyphn1/Harness-everything/blob/main/SECURITY.md
+
+## Scope
+
+Harness Everything does not operate a hosted support service, hosted backend, or separate user account. Support covers the open-source plugin package and its documented workflows; support for ChatGPT, Codex, GitHub, package registries, and other third-party services remains with those providers.

package/TERMS.md

@@ -0,0 +1,21 @@
+# Terms of Use
+
+Harness Everything is open-source software distributed under the Apache License 2.0. Use, copying, modification, and distribution of the software are governed by the terms of the repository `LICENSE` file.
+
+## No hosted service
+
+The project does not provide a hosted service or separate user account. The plugin packages skills and local hooks that run through the user's supported ChatGPT/Codex or coding-agent environment.
+
+## User responsibility
+
+Harness workflows can guide an agent to inspect code, modify files, run commands, and interact with tools made available by the user or host. Users remain responsible for reviewing permissions, commands, generated changes, third-party service terms, and verification evidence before relying on or deploying results.
+
+## Third-party platforms
+
+Use of ChatGPT, Codex, GitHub, package registries, external tools, or connected services remains subject to the applicable third-party terms. Harness Everything does not grant additional rights to those services and does not bypass their authorization or workspace controls.
+
+## Warranty and liability
+
+The warranty, limitation-of-liability, and other license conditions in the Apache License 2.0 apply to the software. Nothing in this document creates a warranty or service-level commitment beyond that license.
+
+For project questions or reports, use the repository issue tracker: https://github.com/dyphn1/Harness-everything/issues