harness-everything 0.25.0 → 0.26.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.25.0",
+      "version": "0.26.0",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.25.0",
+  "version": "0.26.0",
   "author": {
     "name": "Miya Daniel"
   },

package/CHANGELOG.md

@@ -2,6 +2,42 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.26.0](https://github.com/dyphn1/Harness-everything/compare/v0.25.1...v0.26.0) (2026-09-24)
+
+### Features
+
+* **verify:** add shared verification contract model ([8e9548c](https://github.com/dyphn1/Harness-everything/commit/8e9548c278c4c13d4d29a07093a0d1dec67b7a76))
+* **verify:** add structured multi-root verification gate ([e616978](https://github.com/dyphn1/Harness-everything/commit/e616978a2ae81dda9123f189b4639c6c6c9f97ed))
+
+### Bug Fixes
+
+* **verify:** align hook verification command recognition ([943659a](https://github.com/dyphn1/Harness-everything/commit/943659aa0639316beea7f90327c32b393d441931))
+* **verify:** keep hook evidence fail closed ([ff19098](https://github.com/dyphn1/Harness-everything/commit/ff190980e2452b297624ae06be60a29bcfc74fb5))
+* **verify:** preserve legacy evidence without broad word matching ([aa4ac71](https://github.com/dyphn1/Harness-everything/commit/aa4ac715b85321f29cd744c02221130e659de318))
+* **verify:** record project-aware verification evidence ([cab04fc](https://github.com/dyphn1/Harness-everything/commit/cab04fce9691938dcf17da88591e4063a94b5339))
+* **verify:** Require runnable commit hooks ([735790e](https://github.com/dyphn1/Harness-everything/commit/735790ea0fc39603f0e68f160f9bd20f49636095))
+* **verify:** route shell evidence through shared classifier ([e205319](https://github.com/dyphn1/Harness-everything/commit/e205319011fb8cfef4e43310e550b2725d41bacb))
+* **verify:** sync fail-closed verification classifier ([cfe1eb2](https://github.com/dyphn1/Harness-everything/commit/cfe1eb221686edac554f545637925e7c37002057))
+
+## [Unreleased]
+
+### Bug Fixes
+
+* **verify:** discover and execute project verification contracts across npm and non-npm repositories, with multi-root structured evidence and aligned hook recognition (#242)
+
+## [0.25.1](https://github.com/dyphn1/Harness-everything/compare/v0.25.0...v0.25.1) (2026-09-24)
+
+### Bug Fixes
+
+* **skills:** document worktree submodule reachability ([024185a](https://github.com/dyphn1/Harness-everything/commit/024185ab29363968bbe30d648cf2ef902751e9b9))
+* **skills:** keep worktree contract within token budget ([c41903d](https://github.com/dyphn1/Harness-everything/commit/c41903d2c37e3af127b84b0ba9c5a82cd4fab3ee))
+* **skills:** preserve isolation contract wording ([b14ea2a](https://github.com/dyphn1/Harness-everything/commit/b14ea2a6e6417f4103f16e5d2cf04e6fc994e583))
+* **skills:** require submodule reachability reference ([5c61c2b](https://github.com/dyphn1/Harness-everything/commit/5c61c2bbae0f2e29818579bd2ebcd7d45a76c1b0))
+* **skills:** sync compact worktree contract ([cd4e3a8](https://github.com/dyphn1/Harness-everything/commit/cd4e3a8db276083ac11346031f626058cd02bed3))
+* **skills:** sync isolation contract wording ([7f59b1c](https://github.com/dyphn1/Harness-everything/commit/7f59b1c4e66d00ec84c225ad161e503a443ad1cd))
+* **skills:** sync worktree submodule reference ([b3fdf5d](https://github.com/dyphn1/Harness-everything/commit/b3fdf5dff8b2c22ff02cc39510d23dc60c2489ae))
+* **skills:** sync worktree submodule skill ([08dffec](https://github.com/dyphn1/Harness-everything/commit/08dffec0aa69602b61a1a90b6d10cbf97cea0dcb))
+
 ## [0.25.0](https://github.com/dyphn1/Harness-everything/compare/v0.24.0...v0.25.0) (2026-09-23)
 
 ### Features

package/ci/mechanism-35-verification-contract.test.js

@@ -0,0 +1,416 @@
+'use strict';
+
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+const VERIFY = path.join(ROOT, 'harness-everything', 'scripts', 'verify-gate.js');
+const { isVerificationShell } = require('../hooks/scripts/lib/workflow-isolation');
+const { hasCommitHook, hookIsRunnable } = require('../scripts/lib/verification-contract');
+const { getWorkspaceKey } = require('../scripts/lib/workspace');
+
+function run(command, args, cwd, options = {}) {
+  const result = spawnSync(command, args, {
+    cwd,
+    encoding: 'utf8',
+    env: { ...process.env, ...(options.env || {}) },
+    timeout: options.timeout || 30000,
+  });
+  if (!options.allowFailure && result.status !== 0) {
+    throw new Error([
+      `${command} ${args.join(' ')} failed with ${result.status}`,
+      result.stdout,
+      result.stderr,
+    ].filter(Boolean).join('\n'));
+  }
+  return result;
+}
+
+function git(cwd, args, options = {}) {
+  return run('git', args, cwd, options);
+}
+
+function initRepo(dir) {
+  fs.mkdirSync(dir, { recursive: true });
+  git(dir, ['init', '-b', 'main']);
+  git(dir, ['config', 'user.name', 'Harness Verify Test']);
+  git(dir, ['config', 'user.email', 'verify@example.invalid']);
+  fs.writeFileSync(path.join(dir, 'README.md'), 'fixture\n');
+  git(dir, ['add', 'README.md']);
+  git(dir, ['commit', '-m', 'seed']);
+}
+
+function writeJson(file, value) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, JSON.stringify(value, null, 2) + '\n');
+}
+
+function invokeGate(cwd, options = {}) {
+  const args = options.json === false ? [] : ['--json'];
+  const result = run(process.execPath, [VERIFY, ...args], cwd, {
+    allowFailure: true,
+    env: options.env || {},
+    timeout: options.timeout || 30000,
+  });
+  if (options.json === false) return result;
+  let report;
+  try {
+    report = JSON.parse(result.stdout);
+  } catch (error) {
+    throw new Error(`verify-gate did not emit JSON (exit=${result.status})\nstdout:\n${result.stdout}\nstderr:\n${result.stderr}`);
+  }
+  return { ...result, report };
+}
+
+function packageScript(body) {
+  return {
+    name: 'verify-fixture',
+    version: '1.0.0',
+    private: true,
+    scripts: body,
+  };
+}
+
+const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-verify-contract-'));
+
+assert.strictEqual(hookIsRunnable({ isFile: () => true, mode: 0o100755 }, 'linux'), true);
+assert.strictEqual(hookIsRunnable({ isFile: () => true, mode: 0o100644 }, 'linux'), false);
+assert.strictEqual(hookIsRunnable({ isFile: () => true, mode: 0o100644 }, 'win32'), true);
+assert.strictEqual(hookIsRunnable({ isFile: () => false, mode: 0o100755 }, 'linux'), false);
+
+try {
+  // Taxonomy: truly no checks is distinct from discovered-but-unrun.
+  const empty = path.join(temp, 'empty');
+  initRepo(empty);
+  let result = invokeGate(empty);
+  assert.strictEqual(result.status, 0);
+  assert.strictEqual(result.report.status, 'UNCHECKED_NO_CHECKS');
+  assert.deepStrictEqual(result.report.candidates, []);
+  const emptyHuman = invokeGate(empty, { json: false });
+  assert.match(emptyHuman.stdout + emptyHuman.stderr, /PROHIBITED: Do NOT cite this run as proof/i);
+
+  // npm compatibility: placeholder is no check; lint/test auto-run; failure blocks.
+  const npmRepo = path.join(temp, 'npm');
+  initRepo(npmRepo);
+  writeJson(path.join(npmRepo, 'package.json'), packageScript({
+    test: 'echo "Error: no test specified" && exit 1',
+  }));
+  result = invokeGate(npmRepo);
+  assert.strictEqual(result.report.status, 'UNCHECKED_NO_CHECKS');
+
+  writeJson(path.join(npmRepo, 'package.json'), packageScript({
+    lint: 'node -e "process.exit(0)"',
+    test: 'node -e "process.exit(0)"',
+  }));
+  result = invokeGate(npmRepo);
+  assert.strictEqual(result.status, 0);
+  assert.strictEqual(result.report.status, 'PASSED');
+  assert.strictEqual(result.report.checks.length, 2);
+  assert.ok(result.report.checks.every(check => check.exitCode === 0));
+
+  writeJson(path.join(npmRepo, 'package.json'), packageScript({
+    test: 'node -e "process.exit(9)"',
+  }));
+  result = invokeGate(npmRepo);
+  assert.strictEqual(result.status, 1);
+  assert.strictEqual(result.report.status, 'FAILED');
+  assert.strictEqual(result.report.checks[0].exitCode, 9);
+
+  fs.writeFileSync(path.join(npmRepo, 'package.json'), '{ invalid json');
+  result = invokeGate(npmRepo);
+  assert.strictEqual(result.status, 1);
+  assert.strictEqual(result.report.status, 'FAILED');
+  assert.match(result.report.reason, /package\.json/i);
+
+  fs.writeFileSync(path.join(npmRepo, '.verify-fail.tmp'), 'fail');
+  result = invokeGate(npmRepo);
+  assert.strictEqual(result.status, 1);
+  assert.strictEqual(result.report.status, 'FAILED');
+  fs.rmSync(path.join(npmRepo, '.verify-fail.tmp'));
+
+  result = invokeGate(npmRepo, { env: { HARNESS_SKIP_PROJECT_CHECKS: '1' } });
+  assert.strictEqual(result.status, 0);
+  assert.strictEqual(result.report.status, 'SKIPPED');
+
+  // Read-only discovery: candidates are listed but never executed.
+  const detected = path.join(temp, 'detected');
+  initRepo(detected);
+  fs.writeFileSync(path.join(detected, 'sentinel.js'), 'require("fs").writeFileSync("RAN", "bad")\n');
+  fs.writeFileSync(path.join(detected, 'Makefile'), 'test:\n\tnode sentinel.js\ncheck:\n\t@echo check\n');
+  fs.writeFileSync(path.join(detected, 'justfile'), 'ci:\n    node sentinel.js\n');
+  fs.writeFileSync(path.join(detected, '.pre-commit-config.yaml'), 'repos: []\n');
+  fs.writeFileSync(path.join(detected, 'pyproject.toml'), '[tool.pytest.ini_options]\naddopts = "-q"\n[tool.ruff]\nline-length = 100\n');
+  fs.writeFileSync(path.join(detected, 'tox.ini'), '[tox]\nenvlist = py\n');
+  fs.writeFileSync(path.join(detected, 'noxfile.py'), '# nox fixture\n');
+  fs.writeFileSync(path.join(detected, 'Cargo.toml'), '[package]\nname="x"\nversion="0.1.0"\n');
+  fs.writeFileSync(path.join(detected, 'go.mod'), 'module example.invalid/x\n\ngo 1.22\n');
+  result = invokeGate(detected);
+  assert.strictEqual(result.status, 0);
+  assert.strictEqual(result.report.status, 'UNCHECKED_DISCOVERED');
+  const candidateRuns = result.report.candidates.map(candidate => candidate.run);
+  for (const command of [
+    'pre-commit run --all-files',
+    'make test',
+    'make check',
+    'just ci',
+    'pytest',
+    'ruff check .',
+    'tox',
+    'nox',
+    'cargo test',
+    'go test ./...',
+  ]) assert.ok(candidateRuns.includes(command), `missing candidate: ${command}\n${JSON.stringify(result.report.candidates)}`);
+  assert.ok(!fs.existsSync(path.join(detected, 'RAN')), 'detected commands must not run');
+
+  // package check/typecheck/verify are detected but not auto-run.
+  writeJson(path.join(detected, 'package.json'), packageScript({
+    test: 'node -e "process.exit(0)"',
+    check: 'node sentinel.js',
+    typecheck: 'node sentinel.js',
+    verify: 'node sentinel.js',
+  }));
+  result = invokeGate(detected);
+  assert.strictEqual(result.report.status, 'UNCHECKED_DISCOVERED');
+  assert.ok(result.report.checks.some(check => / run test$/.test(check.run)));
+  assert.ok(result.report.candidates.some(candidate => / run check$/.test(candidate.run)));
+  assert.ok(!fs.existsSync(path.join(detected, 'RAN')));
+
+  // Explicit contract is authoritative and executable.
+  const contracted = path.join(temp, 'contracted');
+  initRepo(contracted);
+  writeJson(path.join(contracted, 'package.json'), packageScript({
+    test: 'node -e "process.exit(13)"',
+  }));
+  writeJson(path.join(contracted, '.harness', 'verify.json'), {
+    version: 1,
+    roots: ['.'],
+    checks: [{
+      id: 'contract-pass',
+      run: 'node -e "if(process.env.HARNESS_SKIP_PROJECT_CHECKS!==\'1\') process.exit(7)"',
+      cwd: '.',
+      timeoutSec: 10,
+    }],
+  });
+  result = invokeGate(contracted);
+  assert.strictEqual(result.status, 0);
+  assert.strictEqual(result.report.status, 'PASSED');
+  assert.strictEqual(result.report.checks.length, 1, 'package.json must be ignored when contract exists');
+  assert.strictEqual(result.report.checks[0].id, 'contract-pass');
+
+  writeJson(path.join(contracted, '.harness', 'verify.json'), {
+    version: 1,
+    checks: [{ id: 'contract-fail', run: 'node -e "process.exit(4)"', cwd: '.' }],
+  });
+  result = invokeGate(contracted);
+  assert.strictEqual(result.status, 1);
+  assert.strictEqual(result.report.status, 'FAILED');
+  assert.strictEqual(result.report.checks[0].id, 'contract-fail');
+  assert.strictEqual(result.report.checks[0].exitCode, 4);
+
+  writeJson(path.join(contracted, '.harness', 'verify.json'), {
+    version: 1,
+    checks: [{ id: 'timeout', run: 'node -e "setTimeout(()=>{}, 5000)"', timeoutSec: 1 }],
+  });
+  result = invokeGate(contracted, { timeout: 10000 });
+  assert.strictEqual(result.status, 1);
+  assert.strictEqual(result.report.status, 'FAILED');
+  assert.match(result.report.reason, /timeout/i);
+
+  fs.writeFileSync(path.join(contracted, '.harness', 'verify.json'), '{ bad');
+  result = invokeGate(contracted);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.report.reason, /verify\.json/i);
+
+  writeJson(path.join(contracted, '.harness', 'verify.json'), {
+    version: 1,
+    unknown: true,
+    checks: [{ id: 'x', run: 'node -e "process.exit(0)"' }],
+  });
+  result = invokeGate(contracted);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.report.reason, /unknown/i);
+
+  writeJson(path.join(contracted, '.harness', 'verify.json'), {
+    version: 1,
+    roots: ['..'],
+    checks: [{ id: 'escape', run: 'node -e "process.exit(0)"' }],
+  });
+  result = invokeGate(contracted);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.report.reason, /inside|escape|root/i);
+
+  // Multi-root contract reports every root and applies worst-root status.
+  fs.mkdirSync(path.join(contracted, 'sub', 'a'), { recursive: true });
+  fs.mkdirSync(path.join(contracted, 'sub', 'b'), { recursive: true });
+  writeJson(path.join(contracted, '.harness', 'verify.json'), {
+    version: 1,
+    roots: ['.', 'sub/a', 'sub/b'],
+    checks: [
+      { id: 'root', run: 'node -e "process.exit(0)"', cwd: '.' },
+      { id: 'a', run: 'node -e "process.exit(0)"', cwd: 'sub/a' },
+      { id: 'b', run: 'node -e "process.exit(0)"', cwd: 'sub/b' },
+    ],
+  });
+  result = invokeGate(contracted);
+  assert.strictEqual(result.report.status, 'PASSED');
+  assert.strictEqual(result.report.roots.length, 3);
+  assert.ok(result.report.roots.every(root => root.status === 'PASSED'));
+
+  writeJson(path.join(contracted, '.harness', 'verify.json'), {
+    version: 1,
+    roots: ['.', 'sub/a', 'sub/b'],
+    checks: [
+      { id: 'root', run: 'node -e "process.exit(0)"', cwd: '.' },
+      { id: 'a', run: 'node -e "process.exit(8)"', cwd: 'sub/a' },
+      { id: 'b', run: 'node -e "process.exit(0)"', cwd: 'sub/b' },
+    ],
+  });
+  result = invokeGate(contracted);
+  assert.strictEqual(result.status, 1);
+  assert.strictEqual(result.report.status, 'FAILED');
+  assert.strictEqual(result.report.roots.find(root => /sub[\\/]a$/.test(root.path)).status, 'FAILED');
+
+  // No-contract multi-root discovery enumerates initialized submodules.
+  const childA = path.join(temp, 'child-a');
+  const childB = path.join(temp, 'child-b');
+  for (const child of [childA, childB]) {
+    initRepo(child);
+    writeJson(path.join(child, 'package.json'), packageScript({ test: 'node -e "process.exit(0)"' }));
+    git(child, ['add', 'package.json']);
+    git(child, ['commit', '-m', 'add passing test']);
+  }
+  const multi = path.join(temp, 'multi');
+  initRepo(multi);
+  writeJson(path.join(multi, 'package.json'), packageScript({ test: 'node -e "process.exit(0)"' }));
+  git(multi, ['add', 'package.json']);
+  git(multi, ['commit', '-m', 'parent test']);
+  git(multi, ['-c', 'protocol.file.allow=always', 'submodule', 'add', childA, 'sub/a']);
+  git(multi, ['-c', 'protocol.file.allow=always', 'submodule', 'add', childB, 'sub/b']);
+  git(multi, ['commit', '-am', 'add submodules']);
+  result = invokeGate(multi);
+  assert.strictEqual(result.report.status, 'PASSED');
+  assert.strictEqual(result.report.roots.length, 3);
+
+  writeJson(path.join(multi, 'sub', 'b', 'package.json'), packageScript({ test: 'node -e "process.exit(6)"' }));
+  result = invokeGate(multi);
+  assert.strictEqual(result.status, 1);
+  assert.strictEqual(result.report.status, 'FAILED');
+  assert.strictEqual(result.report.roots.find(root => /sub[\\/]b$/.test(root.path)).status, 'FAILED');
+
+  // Hook-side recognition uses the same project signals and contract.
+  const classifyRepo = path.join(temp, 'classify');
+  initRepo(classifyRepo);
+  fs.writeFileSync(path.join(classifyRepo, '.pre-commit-config.yaml'), 'repos: []\n');
+  fs.writeFileSync(path.join(classifyRepo, 'Makefile'), 'test:\n\t@echo ok\n');
+  fs.writeFileSync(path.join(classifyRepo, 'justfile'), 'ci:\n    @echo ok\n');
+  fs.writeFileSync(path.join(classifyRepo, 'tox.ini'), '[tox]\nenvlist=py\n');
+  fs.writeFileSync(path.join(classifyRepo, 'Cargo.toml'), '[package]\nname="x"\nversion="0.1.0"\n');
+  fs.writeFileSync(path.join(classifyRepo, 'go.mod'), 'module example.invalid/x\n\ngo 1.22\n');
+  fs.writeFileSync(path.join(classifyRepo, 'pyproject.toml'), '[tool.pytest.ini_options]\naddopts="-q"\n');
+  writeJson(path.join(classifyRepo, '.harness', 'verify.json'), {
+    version: 1,
+    checks: [
+      { id: 'precommit', run: 'pre-commit run --all-files' },
+      { id: 'e2e', run: 'bash scripts/e2e.sh' },
+    ],
+  });
+  fs.mkdirSync(path.join(classifyRepo, '.git', 'hooks'), { recursive: true });
+  const preCommitHook = path.join(classifyRepo, '.git', 'hooks', 'pre-commit');
+  fs.writeFileSync(preCommitHook, '#!/bin/sh\nexit 0\n');
+  assert.strictEqual(hasCommitHook(classifyRepo, 'linux'), false, 'a non-executable POSIX hook must not count as verification');
+  if (process.platform !== 'win32') fs.chmodSync(preCommitHook, 0o755);
+
+  assert.strictEqual(isVerificationShell('pre-commit run --all-files', { cwd: classifyRepo }), true);
+  assert.strictEqual(isVerificationShell('bash scripts/e2e.sh', { cwd: classifyRepo }), true);
+  assert.strictEqual(isVerificationShell('git commit -m x', { cwd: classifyRepo }), true);
+  assert.strictEqual(isVerificationShell('git commit --no-verify -m x', { cwd: classifyRepo }), false);
+  assert.strictEqual(isVerificationShell('git commit -n -m x', { cwd: classifyRepo }), false);
+  assert.strictEqual(isVerificationShell('git commit -an -m x', { cwd: classifyRepo }), false, 'combined -n must still bypass hooks');
+  if (process.platform !== 'win32') {
+    fs.chmodSync(preCommitHook, 0o644);
+    assert.strictEqual(isVerificationShell('git commit -m x', { cwd: classifyRepo }), false, 'a non-executable POSIX hook cannot verify a commit');
+    fs.chmodSync(preCommitHook, 0o755);
+  }
+
+  // An invalid authoritative contract must fail closed in the hook classifier too.
+  // The verify gate reports FAILED here, so legacy command matching must not
+  // silently manufacture lastVerifyAt evidence from the same workspace.
+  fs.writeFileSync(path.join(classifyRepo, '.harness', 'verify.json'), '{ broken');
+  assert.strictEqual(isVerificationShell('npm test', { cwd: classifyRepo }), false, 'invalid contract must suppress legacy verifier fallback');
+  assert.strictEqual(isVerificationShell('pre-commit run --all-files', { cwd: classifyRepo }), false, 'invalid contract must suppress detector-based evidence');
+
+  fs.rmSync(path.join(classifyRepo, '.harness', 'verify.json'));
+  assert.strictEqual(isVerificationShell('git commit -m x', { cwd: classifyRepo }), false, 'commit is not full verification without a declared hook contract');
+  assert.strictEqual(isVerificationShell('pre-commit run --all-files', { cwd: classifyRepo }), true);
+  assert.strictEqual(isVerificationShell('make test', { cwd: classifyRepo }), true);
+  assert.strictEqual(isVerificationShell('just ci', { cwd: classifyRepo }), true);
+  assert.strictEqual(isVerificationShell('tox', { cwd: classifyRepo }), true);
+  assert.strictEqual(isVerificationShell('cargo test', { cwd: classifyRepo }), true);
+  assert.strictEqual(isVerificationShell('go test ./...', { cwd: classifyRepo }), true);
+  assert.strictEqual(isVerificationShell('uv run pytest', { cwd: classifyRepo }), true);
+  assert.strictEqual(isVerificationShell('npm run build', { cwd: classifyRepo }), true, 'legacy build evidence remains recognized without a contract');
+  assert.strictEqual(isVerificationShell('npx tsc --noEmit', { cwd: classifyRepo }), true, 'legacy typecheck evidence remains recognized without a contract');
+  assert.strictEqual(isVerificationShell('echo test', { cwd: classifyRepo }), false, 'plain words must not become verification evidence');
+
+  // Hook evidence: successful declared pre-commit verification after an edit
+  // updates lastVerifyAt, so Stop does not emit a stale verification reminder.
+  writeJson(path.join(classifyRepo, '.harness', 'verify.json'), {
+    version: 1,
+    checks: [{ id: 'precommit', run: 'pre-commit run --all-files' }],
+  });
+  const stateHome = path.join(temp, 'state-home');
+  const session = 'verify-contract-hook';
+  const stateEnv = { HARNESS_STATE_HOME: stateHome, CLAUDE: '1' };
+  const statePersist = path.join(ROOT, 'hooks', 'scripts', 'state-persist.js');
+  const stopGate = path.join(ROOT, 'hooks', 'scripts', 'stop-gate.js');
+  const invokeHook = (script, payload) => spawnSync(process.execPath, [script], {
+    cwd: classifyRepo,
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    env: { ...process.env, ...stateEnv },
+  });
+
+  fs.appendFileSync(path.join(classifyRepo, 'README.md'), 'dirty\n');
+  let hook = invokeHook(statePersist, {
+    session_id: session,
+    cwd: classifyRepo,
+    hook_event_name: 'PostToolUse',
+    tool_name: 'Edit',
+    tool_input: { file_path: path.join(classifyRepo, 'README.md') },
+    tool_response: { stdout: '', exitCode: 0 },
+  });
+  assert.strictEqual(hook.status, 0);
+
+  hook = invokeHook(statePersist, {
+    session_id: session,
+    cwd: classifyRepo,
+    hook_event_name: 'PostToolUse',
+    tool_name: 'Bash',
+    tool_input: { command: 'pre-commit run --all-files' },
+    tool_response: { stdout: 'ok', exitCode: 0 },
+  });
+  assert.strictEqual(hook.status, 0);
+
+  const stateFile = path.join(
+    stateHome,
+    'workspaces',
+    getWorkspaceKey(classifyRepo),
+    'state',
+    'sessions',
+    session,
+    'handoff-state.json',
+  );
+  const handoff = JSON.parse(fs.readFileSync(stateFile, 'utf8'));
+  assert.ok(handoff.lastVerifyAt >= handoff.lastEditAt, JSON.stringify(handoff));
+
+  const stop = invokeHook(stopGate, { session_id: session, cwd: classifyRepo });
+  assert.strictEqual(stop.status, 0);
+  assert.doesNotMatch(String(stop.stderr || ''), /Verification Reminder/i);
+
+  console.log('Issue #242 verification contract: taxonomy, discovery, execution safety, multi-root scope, hook recognition, and Stop evidence verified.');
+} finally {
+  fs.rmSync(temp, { recursive: true, force: true });
+}

package/ci/mutation-check.js

@@ -15,6 +15,7 @@ const checks = [
   ['transcript command qualifiers', 'behavioral-evals/transcript-parser.js', 'ci/mechanism-2t-transcript-parser.test.js'],
   ['fixture path boundaries', 'behavioral-evals/run.js', 'ci/mechanism-2j-behavioral-runner.test.js'],
   ['unbound workspace identity', 'scripts/lib/workspace.js', 'ci/mechanism-2u-issue-42-regressions.test.js'],
+  ['verification contract precedence', 'harness-everything/scripts/verify-gate.js', 'ci/mechanism-35-verification-contract.test.js'],
 ];
 
 let failures = 0;
@@ -32,6 +33,7 @@ for (const [label, target, testFile] of checks) {
         'behavioral-evals/transcript-parser.js': 'transcript-command',
         'behavioral-evals/run.js': 'runner-fixture',
         'scripts/lib/workspace.js': 'workspace-identity',
+        'harness-everything/scripts/verify-gate.js': 'verify-contract-precedence',
       }[target],
       HARNESS_MUTATION_TARGET: path.join(ROOT, target),
       NODE_OPTIONS: `--require=${loader}`,

package/ci/mutation-loader.js

@@ -40,6 +40,10 @@ const mutations = {
     '  if (!workspaceRoot) return UNBOUND_WORKSPACE_KEY;',
     '  if (!workspaceRoot) return path.basename(process.cwd()); // mutation: derive unbound identity from cwd'
   ),
+  'verify-contract-precedence': (source) => source.replace(
+    '  finalize(contract ? contractPlan(contract) : discoveredPlan());',
+    '  finalize(discoveredPlan()); // mutation: ignore the authoritative project contract'
+  ),
 };
 
 if (target && mutation && mutations[mutation]) {

package/docs/audit.md

@@ -2,6 +2,8 @@
 
 Maintainer-facing audit record. If you just want to know whether Harness works and how to verify it yourself, start at [VERIFICATION.md](../VERIFICATION.md) instead — this file records *how the scores below were obtained* and what changed between audit cycles.
 
+> **Current verification-gate note (2026-09-24):** project verification now supports an authoritative `.harness/verify.json` contract, read-only ecosystem discovery, explicit `UNCHECKED_NO_CHECKS` versus `UNCHECKED_DISCOVERED`, and multi-root reporting. Hook-side verification evidence uses the same project-aware command model. Deterministic mechanism evidence is tracked under issue #242; this note does not claim new live-host evidence.
+
 > **Historical snapshot boundary:** the scorecards below are dated audits and are intentionally preserved as evidence of what was measured on each date. Platform capabilities have changed since the 2026-09-01 snapshot (including the OpenAI/Codex local plugin work and the OpenCode plugin implementation). Do not treat any dated platform row as current-state documentation; use [platform-capabilities.md](platform-capabilities.md) for the current matrix.
 
 **Last self-audited: 2026-09-18**, by running the deterministic test suite and gates on macOS (Node.js 24.14.1) — not by reading the code and assuming it works. The 2026-09-01 Windows 11 snapshot is preserved below. Live-host and behavioral evidence layers were not re-run in this cycle; retained artifacts are referenced, not re-measured.

package/harness-everything/SKILL.md

@@ -4,7 +4,7 @@ description: "Route software/project work through Harness: classify tier/topolog
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.24.0
+  version: 0.26.0
 ---
 
 # Harness Everything
@@ -20,7 +20,7 @@ Kernel routing entry.
 
 ## Invariants
 1. **Route (MUST)** — establish scope/tier and selected/deferred topology.
-2. **Verify (MUST)** — completion claims need objective evidence.
+2. **Verify (MUST)** — completion claims need objective evidence; `verify-gate.js --json` distinguishes passed, failed, discovered-but-unrun, and absent project checks.
 3. **Zoom out (MUST)** — after 3 same-signature failures, use `zoom-out`.
 4. **Resolve suggestions (MUST)** — read/evaluate each suggested `SKILL.md`; applicable core contracts MUST run, otherwise retain a flow-grounded reason.
 5. **Surface status (MUST)** — non-trivial work renders `### 🚦 Harness Status` with bold `Current`, `Read / Evidence`, `Next`; optional `Risk / Blocked`.