harness-everything 0.25.1 → 0.26.0

package/plugins/harness-everything/skills/harness-everything/scripts/verify-gate.js

@@ -1,100 +1,248 @@
 #!/usr/bin/env node
+'use strict';
+
 /**
- * Verification Gatekeeper
- * Runs the target project's own mechanical checks (lint/test scripts from the
- * nearest package.json) and refuses completion (Exit 1) when any of them fail.
+ * Harness project verification gate.
  *
- * Escape hatches, both deliberate:
- * - `.verify-fail.tmp` in cwd forces a failure - the hermetic self-regression
- *   suite uses it to prove the blocking mechanism without needing a real
- *   broken project.
- * - HARNESS_SKIP_PROJECT_CHECKS=1 skips the project-script phase (the tmp-file
- *   check above still applies). The gate sets it for its own children so a
- *   project whose test suite itself drives the Harness runtime (like this repo) cannot
- *   recurse back into the gate.
+ * Contract: .harness/verify.json
+ * Discovery: read-only candidates; legacy package lint/test remains auto-run.
+ * UNCHECKED_* is non-blocking control flow and is never passing-test evidence.
  */
-const { execSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
+const { spawnSync } = require('child_process');
 
-console.log("=== 🛡️ Harness Verification Gate ===");
-
-// Phase 1: explicit failure injection (test/demo hook).
-if (fs.existsSync('.verify-fail.tmp')) {
-  console.error("❌ Verification FAILED: .verify-fail.tmp present (injected failure).");
-  console.error("Please fix the code and run this gate again.");
-  process.exit(1);
+function loadVerificationModel() {
+  for (const candidate of [
+    path.resolve(__dirname, '../../scripts/lib/verification-contract.js'),
+    path.resolve(__dirname, '../../../scripts/lib/verification-contract.js'),
+  ]) {
+    if (fs.existsSync(candidate)) return require(candidate);
+  }
+  throw new Error('verification-contract runtime is missing from this Harness distribution');
 }
 
-if (process.env.HARNESS_SKIP_PROJECT_CHECKS === '1') {
-  console.log("ℹ️ HARNESS_SKIP_PROJECT_CHECKS=1 - project scripts skipped (recursion guard / hermetic test mode).");
-  console.log("✅ Verification SUCCESS (injection check only).");
-  process.exit(0);
+const {
+  detectRoot,
+  enumerateSubmoduleRoots,
+  findGitRoot,
+  readContract,
+} = loadVerificationModel();
+
+const jsonMode = process.argv.includes('--json');
+const cwd = path.resolve(process.cwd());
+const repoRoot = findGitRoot(cwd);
+
+function emptyReport(status, reason) {
+  return {
+    status,
+    reason,
+    repoRoot,
+    roots: [],
+    checks: [],
+    candidates: [],
+  };
 }
 
-// Phase 2: locate the nearest package.json, walking up from cwd but never
-// above the enclosing git repository (same scoping rule as tier-router.js).
-function findPackageDir() {
-  let dir = path.resolve(process.cwd());
-  while (true) {
-    if (fs.existsSync(path.join(dir, 'package.json'))) return dir;
-    if (fs.existsSync(path.join(dir, '.git'))) return null; // repo root reached, none found
-    const parent = path.dirname(dir);
-    if (parent === dir) return null;
-    dir = parent;
+function emit(report) {
+  if (jsonMode) {
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    return;
+  }
+
+  console.log('=== 🛡️ Harness Verification Gate ===');
+  console.log(`Status: ${report.status}`);
+  console.log(`Repository: ${report.repoRoot}`);
+  if (report.reason) console.log(`Reason: ${report.reason}`);
+
+  for (const root of report.roots || []) {
+    console.log(`\n[${root.status}] ${root.path}`);
+    if (root.reason) console.log(`  ${root.reason}`);
+    for (const check of root.checks || []) {
+      const exit = check.exitCode === null ? 'timeout/error' : check.exitCode;
+      console.log(`  check ${check.id}: ${check.run} (exit ${exit}, ${check.durationMs}ms)`);
+      if (check.stdout) process.stdout.write(check.stdout.endsWith('\n') ? check.stdout : check.stdout + '\n');
+      if (check.stderr) process.stderr.write(check.stderr.endsWith('\n') ? check.stderr : check.stderr + '\n');
+    }
+    for (const candidate of root.candidates || []) {
+      console.log(`  candidate [${candidate.source}]: ${candidate.run}`);
+    }
   }
+
+  if (report.status === 'UNCHECKED_NO_CHECKS' || report.status === 'UNCHECKED_DISCOVERED') {
+    console.log('\nExit code is 0 (non-blocking), but NO COMPLETE AUTOMATED EVIDENCE was produced.');
+    console.log('PROHIBITED: Do NOT cite this run as proof that tests pass. Perform the listed or project-declared verification first.');
+  } else if (report.status === 'PASSED') {
+    console.log('\n✅ Verification PASSED. Objective project checks completed successfully.');
+  } else if (report.status === 'FAILED') {
+    console.error('\n❌ Verification FAILED. Fix the reported check/contract error and run this gate again.');
+  } else if (report.status === 'SKIPPED') {
+    console.log('ℹ️ Project checks skipped by HARNESS_SKIP_PROJECT_CHECKS=1.');
+  }
+}
+
+function finish(report) {
+  emit(report);
+  process.exit(report.status === 'FAILED' ? 1 : 0);
+}
+
+function statusRank(status) {
+  return {
+    PASSED: 0,
+    UNCHECKED_NO_CHECKS: 1,
+    UNCHECKED_DISCOVERED: 2,
+    FAILED: 3,
+  }[status] ?? 0;
+}
+
+function aggregateStatus(roots) {
+  if (!roots.length) return 'UNCHECKED_NO_CHECKS';
+  return roots.reduce((worst, root) => statusRank(root.status) > statusRank(worst) ? root.status : worst, 'PASSED');
 }
 
-function detectRunner(dir) {
-  if (fs.existsSync(path.join(dir, 'pnpm-lock.yaml'))) return 'pnpm';
-  if (fs.existsSync(path.join(dir, 'yarn.lock'))) return 'yarn';
-  if (fs.existsSync(path.join(dir, 'bun.lockb')) || fs.existsSync(path.join(dir, 'bun.lock'))) return 'bun';
-  return 'npm';
+function executeCheck(check) {
+  const started = Date.now();
+  const result = spawnSync(check.run, {
+    cwd: check.cwd,
+    shell: true,
+    encoding: 'utf8',
+    windowsHide: true,
+    timeout: check.timeoutSec * 1000,
+    env: { ...process.env, HARNESS_SKIP_PROJECT_CHECKS: '1' },
+    maxBuffer: 16 * 1024 * 1024,
+  });
+  const durationMs = Date.now() - started;
+  const timedOut = !!(result.error && result.error.code === 'ETIMEDOUT');
+  const exitCode = typeof result.status === 'number' ? result.status : null;
+  return {
+    id: check.id,
+    run: check.run,
+    cwd: check.cwd,
+    source: check.source,
+    exitCode,
+    durationMs,
+    timedOut,
+    signal: result.signal || null,
+    stdout: result.stdout || '',
+    stderr: result.stderr || '',
+    passed: !timedOut && exitCode === 0,
+  };
 }
 
-const pkgDir = findPackageDir();
-let scripts = {};
-if (pkgDir) {
-  try {
-    scripts = JSON.parse(fs.readFileSync(path.join(pkgDir, 'package.json'), 'utf8')).scripts || {};
-  } catch (err) {
-    console.error(`❌ Verification FAILED: package.json at ${pkgDir} is unreadable/invalid JSON (${err.message}).`);
-    process.exit(1);
+function publicCheck(check) {
+  return {
+    id: check.id,
+    run: check.run,
+    cwd: check.cwd,
+    source: check.source,
+    exitCode: check.exitCode,
+    durationMs: check.durationMs,
+    ...(check.timedOut ? { timedOut: true } : {}),
+    ...(check.signal ? { signal: check.signal } : {}),
+    ...(!jsonMode && check.stdout ? { stdout: check.stdout } : {}),
+    ...(!jsonMode && check.stderr ? { stderr: check.stderr } : {}),
+  };
+}
+
+function candidateView(candidate) {
+  return {
+    source: candidate.source,
+    run: candidate.run,
+    cwd: candidate.cwd,
+  };
+}
+
+function rootReason(status, checks, candidates) {
+  if (status === 'FAILED') {
+    const failed = checks.find(check => !check.passed);
+    if (!failed) return 'verification failed';
+    return failed.timedOut
+      ? `check ${failed.id} timed out after ${failed.durationMs}ms`
+      : `check ${failed.id} exited ${failed.exitCode}`;
   }
+  if (status === 'UNCHECKED_DISCOVERED') return `${candidates.length} verification candidate(s) detected but not executed`;
+  if (status === 'UNCHECKED_NO_CHECKS') return 'no project verification checks were declared or detected';
+  return `${checks.length} check(s) passed`;
 }
 
-// npm-init's placeholder ("no test specified" + exit 1) is absence of a test
-// suite, not a failing one - running it would block every fresh project.
-const runnable = ['lint', 'test'].filter(name =>
-  typeof scripts[name] === 'string' &&
-  scripts[name].trim() !== '' &&
-  !/no test specified/i.test(scripts[name])
-);
-
-if (!pkgDir || runnable.length === 0) {
-  console.log("⚠️ Verification UNCHECKED: No automated lint/test scripts detected in package.json.");
-  console.log("   Exit code is 0 (non-blocking), but NO AUTOMATED EVIDENCE was produced.");
-  console.log("   PROHIBITED: Do NOT cite this run as proof that tests pass. Perform manual or alternative verification first.");
-  process.exit(0);
+function contractPlan(contract) {
+  const rootResults = contract.roots.map(root => ({
+    path: root.path,
+    status: 'UNCHECKED_NO_CHECKS',
+    reason: '',
+    checks: [],
+    candidates: [],
+  }));
+  const byPath = new Map(rootResults.map(root => [path.resolve(root.path), root]));
+
+  for (const check of contract.checks) {
+    const executed = executeCheck(check);
+    const root = byPath.get(path.resolve(check.root));
+    root.checks.push(executed);
+  }
+
+  for (const root of rootResults) {
+    root.status = root.checks.length === 0
+      ? 'UNCHECKED_NO_CHECKS'
+      : root.checks.some(check => !check.passed) ? 'FAILED' : 'PASSED';
+    root.reason = rootReason(root.status, root.checks, root.candidates);
+  }
+  return rootResults;
 }
 
-const runner = detectRunner(pkgDir);
-for (const name of runnable) {
-  console.log(`\n▶ Running "${runner} run ${name}" in ${pkgDir} ...`);
-  try {
-    execSync(`${runner} run ${name}`, {
-      cwd: pkgDir,
-      stdio: 'inherit',
-      timeout: 10 * 60 * 1000,
-      env: { ...process.env, HARNESS_SKIP_PROJECT_CHECKS: '1' }
+function discoveredPlan() {
+  const roots = [];
+  for (const rootPath of enumerateSubmoduleRoots(repoRoot)) {
+    const detected = detectRoot(rootPath);
+    const executed = detected.checks.map(executeCheck);
+    const candidates = detected.candidates;
+    const status = executed.some(check => !check.passed)
+      ? 'FAILED'
+      : candidates.length > 0 ? 'UNCHECKED_DISCOVERED'
+        : executed.length > 0 ? 'PASSED' : 'UNCHECKED_NO_CHECKS';
+    roots.push({
+      path: rootPath,
+      status,
+      reason: rootReason(status, executed, candidates),
+      checks: executed,
+      candidates,
     });
-    console.log(`✅ ${name} passed.`);
-  } catch (err) {
-    console.error(`\n❌ Verification FAILED: "${runner} run ${name}" exited non-zero${err.signal ? ` (signal ${err.signal})` : ''}.`);
-    console.error("Fix the failures above and run this gate again.");
-    process.exit(1);
   }
+  return roots;
 }
 
-console.log("\n✅ Verification SUCCESS. You may now complete the task.");
-process.exit(0);
+function finalize(roots) {
+  const status = aggregateStatus(roots);
+  const failingRoot = roots.find(root => root.status === status);
+  const report = {
+    status,
+    reason: failingRoot ? failingRoot.reason : '',
+    repoRoot,
+    roots: roots.map(root => ({
+      path: root.path,
+      status: root.status,
+      reason: root.reason,
+      checks: root.checks.map(publicCheck),
+      candidates: root.candidates.map(candidateView),
+    })),
+    checks: roots.flatMap(root => root.checks.map(publicCheck)),
+    candidates: roots.flatMap(root => root.candidates.map(candidateView)),
+  };
+  finish(report);
+}
+
+try {
+  // Injection remains first and cannot be bypassed by the recursion guard.
+  if (fs.existsSync(path.join(cwd, '.verify-fail.tmp'))) {
+    finish(emptyReport('FAILED', '.verify-fail.tmp present (injected failure)'));
+  }
+
+  if (process.env.HARNESS_SKIP_PROJECT_CHECKS === '1') {
+    finish(emptyReport('SKIPPED', 'HARNESS_SKIP_PROJECT_CHECKS=1 recursion guard'));
+  }
+
+  const contract = readContract(repoRoot);
+  finalize(contract ? contractPlan(contract) : discoveredPlan());
+} catch (error) {
+  finish(emptyReport('FAILED', error && error.message ? error.message : String(error)));
+}

package/plugins/harness-everything/skills/verification-loop/SKILL.md

@@ -4,44 +4,36 @@ description: "Run objective verification gates (build, types, lint, tests, secur
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.15.0
+  version: 0.26.0
 ---
 
 # Verification Loop
 
-Run objective quality gates before claiming a change is ready.
+Run objective gates before claiming delivery readiness.
 
 ## Skill Contract
 
 | Component | Specification |
 | :--- | :--- |
-| **Trigger / Input** | Completed implementation or change awaiting delivery. |
-| **Expected Output** | Evidence-backed verification report and delivery decision. |
-| **State Mutations** | Fills a report from `<this-skill-dir>/templates/verification-report.template.md`. |
-| **Enforcement Gate** | Build, type, lint, test, security, and diff gates all pass. |
+| **Trigger / Input** | Completed change awaiting delivery. |
+| **Expected Output** | Evidence-backed verification report. |
+| **State Mutations** | Fills `<this-skill-dir>/templates/verification-report.template.md`. |
+| **Enforcement Gate** | Every applicable gate passes. |
 
 ## USE FOR:
-
-- Verify a feature or change before delivery
-- Run quality gates before a PR
+- Verify a completed change
+- Run quality gates before delivery/PR
 
 ## DO NOT USE FOR:
-
-- Fixing failures without re-running the loop
-- Writing new features or tests (use `tdd`)
+- Fixing failures without re-running verification
+- New feature/test implementation (use `tdd`)
 
 ## Workflow
 
-Never claim completion until every applicable gate passes. On failure, fix the cause
-and rerun from the first affected gate.
-
-1. Build: `npm run build`.
-2. Types: `npx tsc --noEmit` or `pyright .`.
-3. Lint: `npm run lint` or `ruff check .`.
-4. Tests and coverage: `npm run test -- --coverage`.
-5. Security scan: secrets and stray logs.
-6. Diff review: `git diff --stat` and unintended-change checks.
-7. Contract reconciliation when the work cites `REQ-*` / ADR/spec/ticket lineage or a contract-integrity trace exists: run the strict `<this-skill-dir>/scripts/contract-integrity-audit.js` gate with current #58 evidence and `--workspace <workspace>` so traced source/test/implementation artifacts are fingerprinted. `AUDIT`, `NOT_EVALUATED`, stale source binding, or drift is **not ready** for delivery.
-8. Fill `<this-skill-dir>/templates/verification-report.template.md` with evidence.
+1. Run applicable build, type, lint, test/coverage, security, and diff gates.
+2. Reconcile cited REQ/ADR/spec lineage with `<this-skill-dir>/scripts/contract-integrity-audit.js`; stale/failed/audit-only evidence is not ready.
+3. For project-declared/discovered mechanical gates, follow `<this-skill-dir>/references/project-verification-contract.md`.
+4. On failure, fix and rerun from the first affected gate.
+5. Fill `<this-skill-dir>/templates/verification-report.template.md` with actual evidence.
 
 Deep dive: `<this-skill-dir>/references/verification-phases.md`

package/plugins/harness-everything/skills/verification-loop/references/project-verification-contract.md

@@ -0,0 +1,112 @@
+# Project Verification Contract
+
+Harness project verification has two layers:
+
+1. **Declared contract** — `.harness/verify.json` is authoritative and executable.
+2. **Read-only discovery** — ecosystem signals are reported as candidates when no contract exists. Detected candidates are never auto-run except the legacy `package.json` `lint` / `test` scripts.
+
+This keeps verification explicit without turning discovery into an accidental command runner.
+
+## Contract
+
+Create `.harness/verify.json` at the enclosing Git repository root. Its documented JSON Schema is `<this-skill-dir>/references/verify-contract.schema.json`:
+
+```json
+{
+  "version": 1,
+  "roots": [".", "sub/a", "sub/b"],
+  "checks": [
+    {
+      "id": "precommit",
+      "run": "pre-commit run --all-files",
+      "cwd": ".",
+      "timeoutSec": 600
+    },
+    {
+      "id": "sub-a-e2e",
+      "run": "bash scripts/e2e.sh",
+      "cwd": "sub/a",
+      "timeoutSec": 600
+    }
+  ]
+}
+```
+
+Rules:
+
+- `version` MUST be `1`.
+- `roots` is optional; default is `["."]`. Every root MUST stay inside the enclosing Git repository and exist.
+- `checks` MUST be a non-empty array.
+- Each check MUST have a unique non-empty `id`, non-empty `run`, repository-contained `cwd` (default `.`), and optional integer `timeoutSec` from 1 through 3600.
+- Unknown fields, invalid JSON, duplicate IDs, escaping paths, or invalid values make verification `FAILED`.
+- Contract checks run with `HARNESS_SKIP_PROJECT_CHECKS=1` so a project's checks cannot recursively invoke the same project gate.
+- When a contract exists, ecosystem detection and legacy npm auto-run are not used.
+
+A `git commit` is accepted as successful verification evidence only when:
+- the declared contract contains a `pre-commit ...` check,
+- a runnable pre-commit hook is configured for that repository (on POSIX, the hook file must have an executable bit), and
+- the commit command does not use `--no-verify` or `-n`.
+
+This prevents a generic commit from being mistaken for proof that the declared verification contract ran.
+
+## Status taxonomy
+
+| Status | Meaning | Exit |
+|---|---|---:|
+| `PASSED` | Every executed authoritative check exited 0. | 0 |
+| `FAILED` | A check failed/timed out, the injected failure marker exists, or declared/project metadata is invalid. | 1 |
+| `UNCHECKED_NO_CHECKS` | No contract, no runnable legacy npm checks, and no verification candidates were detected. | 0 |
+| `UNCHECKED_DISCOVERED` | Verification candidates exist but at least one was not executed. | 0 |
+| `SKIPPED` | `HARNESS_SKIP_PROJECT_CHECKS=1` recursion guard. | 0 |
+
+Every `UNCHECKED_*` human report MUST include:
+
+> PROHIBITED: Do NOT cite this run as proof that tests pass.
+
+An exit code of 0 from `UNCHECKED_*` is non-blocking control flow, not passing-test evidence.
+
+## Discovery when no contract exists
+
+Discovery is read-only. Harness may report:
+
+- `package.json`: `lint` / `test` remain legacy auto-run; `check`, `typecheck`, `verify` are candidates.
+- `.pre-commit-config.yaml`: `pre-commit run --all-files`.
+- `Makefile`: `test`, `check`, `lint`, `ci` targets.
+- `justfile`: `test`, `check`, `ci` recipes.
+- Python: pytest/ruff configuration in `pyproject.toml`, `tox.ini`, `noxfile.py`.
+- `Cargo.toml`: `cargo test`.
+- `go.mod`: `go test ./...`.
+- `core.hooksPath`, `.husky/`, or `.git/hooks/pre-commit`: commit-time gate presence.
+
+Detected commands are suggestions only. Their existence does not become pass evidence until they are explicitly run or declared in the contract.
+
+## Multi-root behavior
+
+With a contract, `roots` defines the verification scope. Each check is attributed to the most-specific declared root containing its `cwd`.
+
+Without a contract, Harness reports the main Git root plus initialized submodule roots from `git submodule status --recursive`.
+
+Overall status uses the most conservative root result:
+
+```text
+FAILED > UNCHECKED_DISCOVERED > UNCHECKED_NO_CHECKS > PASSED
+```
+
+A submodule with no checks remains visible as its own `UNCHECKED_NO_CHECKS` root; it is never silently merged into the parent result.
+
+## Structured output
+
+Run:
+
+```bash
+node harness-everything/scripts/verify-gate.js --json
+```
+
+The output contains:
+
+- `status`, `reason`, and `repoRoot`
+- `roots[]` with per-root status/reason
+- `checks[]` with `id`, `run`, `cwd`, `source`, `exitCode`, and `durationMs`
+- `candidates[]` with `source`, `run`, and `cwd`
+
+The machine-readable result conforms to `<this-skill-dir>/references/verify-result.schema.json`. It is evidence metadata; only `PASSED` means the gate produced passing verification evidence.

package/plugins/harness-everything/skills/verification-loop/references/verification-phases.md

@@ -25,11 +25,12 @@ flowchart TD
     RunScript --> ReportResult{All Verification Gates Passed?}
     DirectReport --> ReportResult
     
-    ReportResult -- Exit 0 / All Green --> Deliver[Task Ready for Delivery / PR]
-    ReportResult -- Failures Detected --> Fix[Fix Issues in Code & Re-verify] --> Build
+    ReportResult -- PASSED --> Deliver[Task Ready for Delivery / PR]
+    ReportResult -- FAILED --> Fix[Fix Issues in Code & Re-verify] --> Build
+    ReportResult -- UNCHECKED_* --> Manual[Run declared/listed verification; exit 0 alone is not evidence] --> Build
 ```
 
-Adapt commands according to the project's ecosystem and active environment (`environment-detection`). Run commands directly without non-portable POSIX pipe assumptions (avoid raw `head`, `tail`, `grep`, `2>/dev/null` piping on Windows).
+Adapt commands according to the project's ecosystem and active environment (`environment-detection`). Run commands directly without non-portable POSIX pipe assumptions (avoid raw `head`, `tail`, `grep`, `2>/dev/null` piping on Windows). For repository-specific mechanical gates and structured `PASSED` / `FAILED` / `UNCHECKED_*` semantics, follow `<this-skill-dir>/references/project-verification-contract.md`.
 
 ## Phase 1: Build Verification
 

package/plugins/harness-everything/skills/verification-loop/references/verify-contract.schema.json

@@ -0,0 +1,32 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/dyphn1/Harness-everything/verification-loop/references/verify-contract.schema.json",
+  "title": "Harness project verification contract",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["version", "checks"],
+  "properties": {
+    "version": { "const": 1 },
+    "roots": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": { "type": "string", "minLength": 1 }
+    },
+    "checks": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "run"],
+        "properties": {
+          "id": { "type": "string", "minLength": 1 },
+          "run": { "type": "string", "minLength": 1 },
+          "cwd": { "type": "string", "minLength": 1, "default": "." },
+          "timeoutSec": { "type": "integer", "minimum": 1, "maximum": 3600, "default": 600 }
+        }
+      }
+    }
+  }
+}

package/plugins/harness-everything/skills/verification-loop/references/verify-result.schema.json

@@ -0,0 +1,65 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/dyphn1/Harness-everything/verification-loop/references/verify-result.schema.json",
+  "title": "Harness verification result",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["status", "reason", "repoRoot", "roots", "checks", "candidates"],
+  "properties": {
+    "status": {
+      "enum": ["PASSED", "FAILED", "UNCHECKED_NO_CHECKS", "UNCHECKED_DISCOVERED", "SKIPPED"]
+    },
+    "reason": { "type": "string" },
+    "repoRoot": { "type": "string" },
+    "roots": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["path", "status", "reason", "checks", "candidates"],
+        "properties": {
+          "path": { "type": "string" },
+          "status": {
+            "enum": ["PASSED", "FAILED", "UNCHECKED_NO_CHECKS", "UNCHECKED_DISCOVERED"]
+          },
+          "reason": { "type": "string" },
+          "checks": { "$ref": "#/$defs/checkArray" },
+          "candidates": { "$ref": "#/$defs/candidateArray" }
+        }
+      }
+    },
+    "checks": { "$ref": "#/$defs/checkArray" },
+    "candidates": { "$ref": "#/$defs/candidateArray" }
+  },
+  "$defs": {
+    "checkArray": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": true,
+        "required": ["id", "run", "cwd", "source", "exitCode", "durationMs"],
+        "properties": {
+          "id": { "type": "string" },
+          "run": { "type": "string" },
+          "cwd": { "type": "string" },
+          "source": { "type": "string" },
+          "exitCode": { "type": ["integer", "null"] },
+          "durationMs": { "type": "integer", "minimum": 0 }
+        }
+      }
+    },
+    "candidateArray": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["source", "run", "cwd"],
+        "properties": {
+          "source": { "type": "string" },
+          "run": { "type": "string" },
+          "cwd": { "type": "string" }
+        }
+      }
+    }
+  }
+}

package/sbom.cdx.json

@@ -2,23 +2,23 @@
   "$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.7",
-  "serialNumber": "urn:uuid:fb030470-2601-5f76-9c8c-9e7efeb21a03",
+  "serialNumber": "urn:uuid:d5232bfe-e479-5e87-a012-d5dafb7acdc2",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-24T12:40:30.113Z",
+    "timestamp": "2026-09-24T14:53:53.083Z",
     "tools": [
       {
         "vendor": "Harness Everything",
         "name": "generate-sbom.js",
-        "version": "0.25.1"
+        "version": "0.26.0"
       }
     ],
     "component": {
       "type": "application",
-      "bom-ref": "pkg:npm/harness-everything@0.25.1",
+      "bom-ref": "pkg:npm/harness-everything@0.26.0",
       "name": "harness-everything",
-      "version": "0.25.1",
-      "purl": "pkg:npm/harness-everything@0.25.1"
+      "version": "0.26.0",
+      "purl": "pkg:npm/harness-everything@0.26.0"
     }
   },
   "components": [
@@ -1999,7 +1999,7 @@
       ]
     },
     {
-      "ref": "pkg:npm/harness-everything@0.25.1",
+      "ref": "pkg:npm/harness-everything@0.26.0",
       "dependsOn": [
         "pkg:npm/%40commitlint/cli@19.8.1",
         "pkg:npm/%40commitlint/config-conventional@19.8.1",