harness-everything 0.25.0 → 0.26.0

package/harness-everything/scripts/verify-gate.js

@@ -1,100 +1,248 @@
 #!/usr/bin/env node
+'use strict';
+
 /**
- * Verification Gatekeeper
- * Runs the target project's own mechanical checks (lint/test scripts from the
- * nearest package.json) and refuses completion (Exit 1) when any of them fail.
+ * Harness project verification gate.
  *
- * Escape hatches, both deliberate:
- * - `.verify-fail.tmp` in cwd forces a failure - the hermetic self-regression
- *   suite uses it to prove the blocking mechanism without needing a real
- *   broken project.
- * - HARNESS_SKIP_PROJECT_CHECKS=1 skips the project-script phase (the tmp-file
- *   check above still applies). The gate sets it for its own children so a
- *   project whose test suite itself drives the Harness runtime (like this repo) cannot
- *   recurse back into the gate.
+ * Contract: .harness/verify.json
+ * Discovery: read-only candidates; legacy package lint/test remains auto-run.
+ * UNCHECKED_* is non-blocking control flow and is never passing-test evidence.
  */
-const { execSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
+const { spawnSync } = require('child_process');
 
-console.log("=== 🛡️ Harness Verification Gate ===");
-
-// Phase 1: explicit failure injection (test/demo hook).
-if (fs.existsSync('.verify-fail.tmp')) {
-  console.error("❌ Verification FAILED: .verify-fail.tmp present (injected failure).");
-  console.error("Please fix the code and run this gate again.");
-  process.exit(1);
+function loadVerificationModel() {
+  for (const candidate of [
+    path.resolve(__dirname, '../../scripts/lib/verification-contract.js'),
+    path.resolve(__dirname, '../../../scripts/lib/verification-contract.js'),
+  ]) {
+    if (fs.existsSync(candidate)) return require(candidate);
+  }
+  throw new Error('verification-contract runtime is missing from this Harness distribution');
 }
 
-if (process.env.HARNESS_SKIP_PROJECT_CHECKS === '1') {
-  console.log("ℹ️ HARNESS_SKIP_PROJECT_CHECKS=1 - project scripts skipped (recursion guard / hermetic test mode).");
-  console.log("✅ Verification SUCCESS (injection check only).");
-  process.exit(0);
+const {
+  detectRoot,
+  enumerateSubmoduleRoots,
+  findGitRoot,
+  readContract,
+} = loadVerificationModel();
+
+const jsonMode = process.argv.includes('--json');
+const cwd = path.resolve(process.cwd());
+const repoRoot = findGitRoot(cwd);
+
+function emptyReport(status, reason) {
+  return {
+    status,
+    reason,
+    repoRoot,
+    roots: [],
+    checks: [],
+    candidates: [],
+  };
 }
 
-// Phase 2: locate the nearest package.json, walking up from cwd but never
-// above the enclosing git repository (same scoping rule as tier-router.js).
-function findPackageDir() {
-  let dir = path.resolve(process.cwd());
-  while (true) {
-    if (fs.existsSync(path.join(dir, 'package.json'))) return dir;
-    if (fs.existsSync(path.join(dir, '.git'))) return null; // repo root reached, none found
-    const parent = path.dirname(dir);
-    if (parent === dir) return null;
-    dir = parent;
+function emit(report) {
+  if (jsonMode) {
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    return;
+  }
+
+  console.log('=== 🛡️ Harness Verification Gate ===');
+  console.log(`Status: ${report.status}`);
+  console.log(`Repository: ${report.repoRoot}`);
+  if (report.reason) console.log(`Reason: ${report.reason}`);
+
+  for (const root of report.roots || []) {
+    console.log(`\n[${root.status}] ${root.path}`);
+    if (root.reason) console.log(`  ${root.reason}`);
+    for (const check of root.checks || []) {
+      const exit = check.exitCode === null ? 'timeout/error' : check.exitCode;
+      console.log(`  check ${check.id}: ${check.run} (exit ${exit}, ${check.durationMs}ms)`);
+      if (check.stdout) process.stdout.write(check.stdout.endsWith('\n') ? check.stdout : check.stdout + '\n');
+      if (check.stderr) process.stderr.write(check.stderr.endsWith('\n') ? check.stderr : check.stderr + '\n');
+    }
+    for (const candidate of root.candidates || []) {
+      console.log(`  candidate [${candidate.source}]: ${candidate.run}`);
+    }
   }
+
+  if (report.status === 'UNCHECKED_NO_CHECKS' || report.status === 'UNCHECKED_DISCOVERED') {
+    console.log('\nExit code is 0 (non-blocking), but NO COMPLETE AUTOMATED EVIDENCE was produced.');
+    console.log('PROHIBITED: Do NOT cite this run as proof that tests pass. Perform the listed or project-declared verification first.');
+  } else if (report.status === 'PASSED') {
+    console.log('\n✅ Verification PASSED. Objective project checks completed successfully.');
+  } else if (report.status === 'FAILED') {
+    console.error('\n❌ Verification FAILED. Fix the reported check/contract error and run this gate again.');
+  } else if (report.status === 'SKIPPED') {
+    console.log('ℹ️ Project checks skipped by HARNESS_SKIP_PROJECT_CHECKS=1.');
+  }
+}
+
+function finish(report) {
+  emit(report);
+  process.exit(report.status === 'FAILED' ? 1 : 0);
+}
+
+function statusRank(status) {
+  return {
+    PASSED: 0,
+    UNCHECKED_NO_CHECKS: 1,
+    UNCHECKED_DISCOVERED: 2,
+    FAILED: 3,
+  }[status] ?? 0;
+}
+
+function aggregateStatus(roots) {
+  if (!roots.length) return 'UNCHECKED_NO_CHECKS';
+  return roots.reduce((worst, root) => statusRank(root.status) > statusRank(worst) ? root.status : worst, 'PASSED');
 }
 
-function detectRunner(dir) {
-  if (fs.existsSync(path.join(dir, 'pnpm-lock.yaml'))) return 'pnpm';
-  if (fs.existsSync(path.join(dir, 'yarn.lock'))) return 'yarn';
-  if (fs.existsSync(path.join(dir, 'bun.lockb')) || fs.existsSync(path.join(dir, 'bun.lock'))) return 'bun';
-  return 'npm';
+function executeCheck(check) {
+  const started = Date.now();
+  const result = spawnSync(check.run, {
+    cwd: check.cwd,
+    shell: true,
+    encoding: 'utf8',
+    windowsHide: true,
+    timeout: check.timeoutSec * 1000,
+    env: { ...process.env, HARNESS_SKIP_PROJECT_CHECKS: '1' },
+    maxBuffer: 16 * 1024 * 1024,
+  });
+  const durationMs = Date.now() - started;
+  const timedOut = !!(result.error && result.error.code === 'ETIMEDOUT');
+  const exitCode = typeof result.status === 'number' ? result.status : null;
+  return {
+    id: check.id,
+    run: check.run,
+    cwd: check.cwd,
+    source: check.source,
+    exitCode,
+    durationMs,
+    timedOut,
+    signal: result.signal || null,
+    stdout: result.stdout || '',
+    stderr: result.stderr || '',
+    passed: !timedOut && exitCode === 0,
+  };
 }
 
-const pkgDir = findPackageDir();
-let scripts = {};
-if (pkgDir) {
-  try {
-    scripts = JSON.parse(fs.readFileSync(path.join(pkgDir, 'package.json'), 'utf8')).scripts || {};
-  } catch (err) {
-    console.error(`❌ Verification FAILED: package.json at ${pkgDir} is unreadable/invalid JSON (${err.message}).`);
-    process.exit(1);
+function publicCheck(check) {
+  return {
+    id: check.id,
+    run: check.run,
+    cwd: check.cwd,
+    source: check.source,
+    exitCode: check.exitCode,
+    durationMs: check.durationMs,
+    ...(check.timedOut ? { timedOut: true } : {}),
+    ...(check.signal ? { signal: check.signal } : {}),
+    ...(!jsonMode && check.stdout ? { stdout: check.stdout } : {}),
+    ...(!jsonMode && check.stderr ? { stderr: check.stderr } : {}),
+  };
+}
+
+function candidateView(candidate) {
+  return {
+    source: candidate.source,
+    run: candidate.run,
+    cwd: candidate.cwd,
+  };
+}
+
+function rootReason(status, checks, candidates) {
+  if (status === 'FAILED') {
+    const failed = checks.find(check => !check.passed);
+    if (!failed) return 'verification failed';
+    return failed.timedOut
+      ? `check ${failed.id} timed out after ${failed.durationMs}ms`
+      : `check ${failed.id} exited ${failed.exitCode}`;
   }
+  if (status === 'UNCHECKED_DISCOVERED') return `${candidates.length} verification candidate(s) detected but not executed`;
+  if (status === 'UNCHECKED_NO_CHECKS') return 'no project verification checks were declared or detected';
+  return `${checks.length} check(s) passed`;
 }
 
-// npm-init's placeholder ("no test specified" + exit 1) is absence of a test
-// suite, not a failing one - running it would block every fresh project.
-const runnable = ['lint', 'test'].filter(name =>
-  typeof scripts[name] === 'string' &&
-  scripts[name].trim() !== '' &&
-  !/no test specified/i.test(scripts[name])
-);
-
-if (!pkgDir || runnable.length === 0) {
-  console.log("⚠️ Verification UNCHECKED: No automated lint/test scripts detected in package.json.");
-  console.log("   Exit code is 0 (non-blocking), but NO AUTOMATED EVIDENCE was produced.");
-  console.log("   PROHIBITED: Do NOT cite this run as proof that tests pass. Perform manual or alternative verification first.");
-  process.exit(0);
+function contractPlan(contract) {
+  const rootResults = contract.roots.map(root => ({
+    path: root.path,
+    status: 'UNCHECKED_NO_CHECKS',
+    reason: '',
+    checks: [],
+    candidates: [],
+  }));
+  const byPath = new Map(rootResults.map(root => [path.resolve(root.path), root]));
+
+  for (const check of contract.checks) {
+    const executed = executeCheck(check);
+    const root = byPath.get(path.resolve(check.root));
+    root.checks.push(executed);
+  }
+
+  for (const root of rootResults) {
+    root.status = root.checks.length === 0
+      ? 'UNCHECKED_NO_CHECKS'
+      : root.checks.some(check => !check.passed) ? 'FAILED' : 'PASSED';
+    root.reason = rootReason(root.status, root.checks, root.candidates);
+  }
+  return rootResults;
 }
 
-const runner = detectRunner(pkgDir);
-for (const name of runnable) {
-  console.log(`\n▶ Running "${runner} run ${name}" in ${pkgDir} ...`);
-  try {
-    execSync(`${runner} run ${name}`, {
-      cwd: pkgDir,
-      stdio: 'inherit',
-      timeout: 10 * 60 * 1000,
-      env: { ...process.env, HARNESS_SKIP_PROJECT_CHECKS: '1' }
+function discoveredPlan() {
+  const roots = [];
+  for (const rootPath of enumerateSubmoduleRoots(repoRoot)) {
+    const detected = detectRoot(rootPath);
+    const executed = detected.checks.map(executeCheck);
+    const candidates = detected.candidates;
+    const status = executed.some(check => !check.passed)
+      ? 'FAILED'
+      : candidates.length > 0 ? 'UNCHECKED_DISCOVERED'
+        : executed.length > 0 ? 'PASSED' : 'UNCHECKED_NO_CHECKS';
+    roots.push({
+      path: rootPath,
+      status,
+      reason: rootReason(status, executed, candidates),
+      checks: executed,
+      candidates,
     });
-    console.log(`✅ ${name} passed.`);
-  } catch (err) {
-    console.error(`\n❌ Verification FAILED: "${runner} run ${name}" exited non-zero${err.signal ? ` (signal ${err.signal})` : ''}.`);
-    console.error("Fix the failures above and run this gate again.");
-    process.exit(1);
   }
+  return roots;
 }
 
-console.log("\n✅ Verification SUCCESS. You may now complete the task.");
-process.exit(0);
+function finalize(roots) {
+  const status = aggregateStatus(roots);
+  const failingRoot = roots.find(root => root.status === status);
+  const report = {
+    status,
+    reason: failingRoot ? failingRoot.reason : '',
+    repoRoot,
+    roots: roots.map(root => ({
+      path: root.path,
+      status: root.status,
+      reason: root.reason,
+      checks: root.checks.map(publicCheck),
+      candidates: root.candidates.map(candidateView),
+    })),
+    checks: roots.flatMap(root => root.checks.map(publicCheck)),
+    candidates: roots.flatMap(root => root.candidates.map(candidateView)),
+  };
+  finish(report);
+}
+
+try {
+  // Injection remains first and cannot be bypassed by the recursion guard.
+  if (fs.existsSync(path.join(cwd, '.verify-fail.tmp'))) {
+    finish(emptyReport('FAILED', '.verify-fail.tmp present (injected failure)'));
+  }
+
+  if (process.env.HARNESS_SKIP_PROJECT_CHECKS === '1') {
+    finish(emptyReport('SKIPPED', 'HARNESS_SKIP_PROJECT_CHECKS=1 recursion guard'));
+  }
+
+  const contract = readContract(repoRoot);
+  finalize(contract ? contractPlan(contract) : discoveredPlan());
+} catch (error) {
+  finish(emptyReport('FAILED', error && error.message ? error.message : String(error)));
+}

package/hooks/scripts/lib/workflow-isolation.js

@@ -4,6 +4,7 @@ const fs = require('fs');
 const crypto = require('crypto');
 const path = require('path');
 const { spawnSync } = require('child_process');
+const { isVerificationCommand } = require('../../../scripts/lib/verification-contract');
 
 function gitRaw(cwd, args, options = {}) {
   const result = spawnSync('git', args, {
@@ -192,10 +193,8 @@ function linkedWorktree(cwd, boundRoot) {
 // Unsupported shell syntax still fails closed.
 const DANGEROUS_FLAG_RE = /\s(?:--(?:output|ext-diff|textconv|exec|pre|pre-glob|pager|open|batch|filters)|-[xoO])(?:\b|=)|\s-(?:exec|execdir|delete|fprint|fprintf)\b/i;
 const READ_ONLY_PREFIX_RE = /^(?:git\s+(?:status|rev-parse|diff|log|show|ls-files|check-ignore)(?:\s|$)|git\s+branch\s+--show-current$|git\s+worktree\s+list(?:\s|$)|gh\s+(?:issue|pr)\s+(?:view|list)(?:\s|$)|gh\s+repo\s+view(?:\s|$)|gh\s+auth\s+status(?:\s|$)|(?:pwd|ls|dir|cat|type|head|tail|wc|stat|rg|grep|echo|Get-Location|Get-ChildItem|Get-Content|Select-String|Test-Path)(?:\s|$))/i;
-const VERIFY_COMMAND_RE = /\b(test|spec|jest|vitest|mocha|pytest|rspec|phpunit|tsc|eslint|lint|build|compile|verify|check)\b/i;
-
-function isVerificationShell(command) {
-  return VERIFY_COMMAND_RE.test(String(command || ''));
+function isVerificationShell(command, options = {}) {
+  return isVerificationCommand(command, options);
 }
 
 function isReadOnlySegment(segment) {

package/hooks/scripts/state-persist.js

@@ -43,7 +43,7 @@ function processState(payload) {
     if (isShell) {
       const commandClass = classifyShell(command);
       if (commandClass !== 'read-only' && commandClass !== 'worktree-setup') state.lastEditAt = Date.now();
-      if (!isFailed && isVerificationShell(command)) { state.lastVerifyAt = Date.now(); state.lastVerifyExitCode = exitCode ?? null; }
+      if (!isFailed && isVerificationShell(command, { cwd: cwdOf(payload, root), root })) { state.lastVerifyAt = Date.now(); state.lastVerifyExitCode = exitCode ?? null; }
     }
     fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), 'utf8');
     observeTool(payload);

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.25.0",
+  "version": "0.26.0",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.25.0",
+  "version": "0.26.0",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.25.0",
+  "version": "0.26.0",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/hooks/scripts/lib/workflow-isolation.js

@@ -4,6 +4,7 @@ const fs = require('fs');
 const crypto = require('crypto');
 const path = require('path');
 const { spawnSync } = require('child_process');
+const { isVerificationCommand } = require('../../../scripts/lib/verification-contract');
 
 function gitRaw(cwd, args, options = {}) {
   const result = spawnSync('git', args, {
@@ -192,10 +193,8 @@ function linkedWorktree(cwd, boundRoot) {
 // Unsupported shell syntax still fails closed.
 const DANGEROUS_FLAG_RE = /\s(?:--(?:output|ext-diff|textconv|exec|pre|pre-glob|pager|open|batch|filters)|-[xoO])(?:\b|=)|\s-(?:exec|execdir|delete|fprint|fprintf)\b/i;
 const READ_ONLY_PREFIX_RE = /^(?:git\s+(?:status|rev-parse|diff|log|show|ls-files|check-ignore)(?:\s|$)|git\s+branch\s+--show-current$|git\s+worktree\s+list(?:\s|$)|gh\s+(?:issue|pr)\s+(?:view|list)(?:\s|$)|gh\s+repo\s+view(?:\s|$)|gh\s+auth\s+status(?:\s|$)|(?:pwd|ls|dir|cat|type|head|tail|wc|stat|rg|grep|echo|Get-Location|Get-ChildItem|Get-Content|Select-String|Test-Path)(?:\s|$))/i;
-const VERIFY_COMMAND_RE = /\b(test|spec|jest|vitest|mocha|pytest|rspec|phpunit|tsc|eslint|lint|build|compile|verify|check)\b/i;
-
-function isVerificationShell(command) {
-  return VERIFY_COMMAND_RE.test(String(command || ''));
+function isVerificationShell(command, options = {}) {
+  return isVerificationCommand(command, options);
 }
 
 function isReadOnlySegment(segment) {

package/plugins/harness-everything/hooks/scripts/state-persist.js

@@ -43,7 +43,7 @@ function processState(payload) {
     if (isShell) {
       const commandClass = classifyShell(command);
       if (commandClass !== 'read-only' && commandClass !== 'worktree-setup') state.lastEditAt = Date.now();
-      if (!isFailed && isVerificationShell(command)) { state.lastVerifyAt = Date.now(); state.lastVerifyExitCode = exitCode ?? null; }
+      if (!isFailed && isVerificationShell(command, { cwd: cwdOf(payload, root), root })) { state.lastVerifyAt = Date.now(); state.lastVerifyExitCode = exitCode ?? null; }
     }
     fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), 'utf8');
     observeTool(payload);

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.25.0",
+  "version": "0.26.0",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",