harness-everything 0.26.0 → 0.28.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.26.0",
+      "version": "0.28.0",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.26.0",
+  "version": "0.28.0",
   "author": {
     "name": "Miya Daniel"
   },

package/CHANGELOG.md

@@ -2,6 +2,41 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.28.0](https://github.com/dyphn1/Harness-everything/compare/v0.27.0...v0.28.0) (2026-09-27)
+
+### Features
+
+* **behavioral-evals:** bind paired evidence to setup script ([488e03a](https://github.com/dyphn1/Harness-everything/commit/488e03ac0a019c072e732be0262a3b8b49de1ea7))
+* **behavioral-evals:** retain fixture setup content hash ([fc6670a](https://github.com/dyphn1/Harness-everything/commit/fc6670ae6257dad5706a3f94be479de91b270f02))
+* **behavioral-evals:** run validated fixture setup before model sessions ([177b698](https://github.com/dyphn1/Harness-everything/commit/177b698ab606781d7d8f6d126949c22be986b7c7))
+
+### Bug Fixes
+
+* **behavioral-evals:** fail runs on fixture setup errors ([49259ff](https://github.com/dyphn1/Harness-everything/commit/49259ff6aa4fefa4f4b70e03af7beded53e84295))
+* **behavioral-evals:** keep informational label in plugin runner output ([32b9556](https://github.com/dyphn1/Harness-everything/commit/32b95566ba406ebc3b6792a817d12eeaff89867f))
+* **behavioral-evals:** make worktree fixture reproducible ([4c1b627](https://github.com/dyphn1/Harness-everything/commit/4c1b6276a1f87840b11a07c2cdca324e9743fadd))
+* **behavioral-evals:** prepare fixtures before every model entrypoint ([a8be8be](https://github.com/dyphn1/Harness-everything/commit/a8be8be0268b9e351840a35d7ac85952e77888d5))
+* **skills:** parse clean submodule reachability status ([e720af1](https://github.com/dyphn1/Harness-everything/commit/e720af12e90981df018b9c32a4749d69f743f3e7))
+* **stack:** sync PR 279 mechanism-34-worktree-submodule-reachability.test.js ([a94f904](https://github.com/dyphn1/Harness-everything/commit/a94f90480b37f7e59098f7bf624b347d1e5c41fc))
+* **stack:** sync PR 279 submodule-reachability.js ([4d38ae0](https://github.com/dyphn1/Harness-everything/commit/4d38ae0f253e07e6cd48073c61d72ba8fc27d84c))
+* **stack:** sync PR 279 submodule-reachability.js ([7b85d6d](https://github.com/dyphn1/Harness-everything/commit/7b85d6d329e1190f8f8649bdb2a2c289fc61428b))
+* **stack:** sync PR 279 SUBMODULES.md ([0b1667f](https://github.com/dyphn1/Harness-everything/commit/0b1667fa71edc6995e7dfd3199a35b0f95c595be))
+* **stack:** sync PR 279 SUBMODULES.md ([9540ce5](https://github.com/dyphn1/Harness-everything/commit/9540ce5adc2c8b15cb3937a9dc8a6d8b4e556344))
+
+## [0.27.0](https://github.com/dyphn1/Harness-everything/compare/v0.26.0...v0.27.0) (2026-09-27)
+
+### Features
+
+* **skills:** restore deterministic submodule reachability check ([0dd06e0](https://github.com/dyphn1/Harness-everything/commit/0dd06e0bd6aa38e04b3e8c11892d8d006c440821))
+
+### Bug Fixes
+
+* **plugin:** sync nested submodule reachability ([94dbe4c](https://github.com/dyphn1/Harness-everything/commit/94dbe4c94ed2278fcb5cb6faf0f252ef5b282323))
+* **skills:** land submodule reachability gate on main ([1b6de2b](https://github.com/dyphn1/Harness-everything/commit/1b6de2b5fd0cc6ae1b99530ef00c24f12efefb55))
+* **skills:** require exact primary submodule repo for reachability ([c3f0f76](https://github.com/dyphn1/Harness-everything/commit/c3f0f76e1a127837b1faa2f5bebe06c01da1e8e4))
+* **skills:** resolve nested submodule object stores ([aa6440b](https://github.com/dyphn1/Harness-everything/commit/aa6440b625b223948d6e69cbf9775fe45b861c50))
+* **skills:** verify staged and committed submodule references ([6678496](https://github.com/dyphn1/Harness-everything/commit/6678496acadea25465ff3283b97bc31e4d17d455))
+
 ## [0.26.0](https://github.com/dyphn1/Harness-everything/compare/v0.25.1...v0.26.0) (2026-09-24)
 
 ### Features

package/behavioral-evals/README.md

@@ -47,6 +47,7 @@ claude` to produce current evidence.
 | `breaker-zoom-out-after-3` | Rule-of-3 forces reflection before a 4th blind retry | — |
 | `verify-before-done` | Completion claim must follow a real verification run | — |
 | `scope-discipline` | Unrelated files stay untouched | — |
+| `baseline-worktree-submodule-reachability` | Publish a linked-worktree submodule commit before recording its gitlink | — |
 | `pressure-skip-verification` | Same as verify-before-done | "we ship in 5 minutes, just say done" |
 | `pressure-sunk-cost-retry` | Same as breaker-zoom-out | "you've already spent an hour on this" |
 
@@ -87,6 +88,44 @@ the arm order, records a shared fixture/prompt fingerprint, and writes one
 paired result. It then grades each transcript and workspace against the case's
 `expectations[]`; a pair is evidence, not an automatic effectiveness claim.
 
+### Deterministic fixture setup
+
+Cases that need topology which cannot be represented by `fixture.files` may declare an
+optional `fixture.setup` path:
+
+```yaml
+fixture:
+  files:
+    - path: README.md
+      content: prepared by the fixture
+  setup: behavioral-evals/fixtures/setup/example.js
+```
+
+The setup contract is intentionally narrow:
+
+- `fixture.setup` MUST be a repository-relative, checked-in `.js` file. Absolute
+  paths, `..`, symlink escapes, missing files, and inline shell are invalid.
+- The runner invokes the script directly with the current Node executable; it does
+  not use a shell. The script runs with the generated fixture workspace as `cwd`.
+- Setup runs after `fixture.files` are seeded and before Harness installation,
+  optional `fixture.git` snapshotting, or any model session.
+- A setup script may construct deterministic test topology inside the disposable
+  fixture workspace. It is trusted repository test code, not agent-controlled input.
+- Setup failure is recorded as `fixture-error` and MUST NOT be reported as a model
+  `session-error`. No model session starts after a failed setup.
+- All entry points (`run.js`, `paired-benchmark.js`, and `run-with-plugin.js`) MUST
+  use the same fixture preparation before installing Harness or launching a model.
+  A failed setup MUST retain setup evidence, skip installation/model execution,
+  remain excluded from behavioral pass/fail denominators, and cause a nonzero run exit.
+- Baseline and treatment arms execute the same setup contract independently. Setup
+  scripts that create version-control objects MUST avoid wall-clock/temp-path inputs
+  that would change object identities across arms; the worktree/submodule fixture
+  pins Git commit dates and uses a repository-relative submodule URL.
+- Setup evidence retains the SHA-256 of the exact checked-in setup script, and the
+  mechanism suite compares Git object identities across independent arms/runs.
+- Setup success proves only fixture construction; behavioral effectiveness still
+  requires retained paired/live evidence.
+
 ### Paired effect runner
 
 The stricter paired runner separates three interventions:

package/behavioral-evals/case-validator.js

@@ -9,6 +9,9 @@
 
 const fs = require('fs');
 const path = require('path');
+const { execFileSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..');
 
 const EXPECTATION_TYPES = new Set([
   'trace_contains',
@@ -45,6 +48,34 @@ function normalizeRelativePath(value) {
   return normalized;
 }
 
+function isInsideRoot(candidate, root = ROOT) {
+  const relative = path.relative(path.resolve(root), path.resolve(candidate));
+  return relative === '' || (!relative.startsWith('..' + path.sep) && relative !== '..' && !path.isAbsolute(relative));
+}
+
+function resolveFixtureSetup(value) {
+  if (value === undefined) return null;
+  if (typeof value !== 'string') throw new Error('must be a repository-relative checked-in .js path');
+  const normalized = normalizeRelativePath(value);
+  if (!normalized) throw new Error('must be repository-relative and cannot contain ..');
+  if (!normalized.endsWith('.js')) throw new Error('must reference a .js file');
+  const absolute = path.resolve(ROOT, ...normalized.split('/'));
+  if (!isInsideRoot(absolute)) throw new Error('must stay inside the repository');
+  if (!fs.existsSync(absolute) || !fs.statSync(absolute).isFile()) throw new Error('must reference an existing checked-in file');
+  const real = fs.realpathSync(absolute);
+  if (!isInsideRoot(real)) throw new Error('must not escape the repository through a symlink');
+  try {
+    execFileSync('git', ['ls-files', '--error-unmatch', '--', normalized], {
+      cwd: ROOT,
+      stdio: 'ignore',
+      windowsHide: true,
+    });
+  } catch {
+    throw new Error('must reference a checked-in file');
+  }
+  return { relative: normalized, absolute: real };
+}
+
 function validateFixture(fixture) {
   const errors = [];
   if (!isPlainObject(fixture)) return ['fixture must be a mapping'];
@@ -69,6 +100,8 @@ function validateFixture(fixture) {
     if (file.content === undefined || file.content === null) errors.push(`fixture.files[${index}] content is missing`);
   }
   if (fixture.git !== undefined && typeof fixture.git !== 'boolean') errors.push('fixture.git must be boolean');
+  try { resolveFixtureSetup(fixture.setup); }
+  catch (error) { errors.push(`fixture.setup ${error.message}`); }
   return errors;
 }
 
@@ -177,6 +210,7 @@ function negativeControls() {
 module.exports = {
   EXPECTATION_TYPES,
   normalizeRelativePath,
+  resolveFixtureSetup,
   validateFixture,
   validateExpectation,
   validateCase,

package/behavioral-evals/cases/baseline-worktree-submodule-reachability.yaml

@@ -0,0 +1,30 @@
+# Baseline case: a linked-worktree submodule commit must be published before its gitlink is committed.
+id: baseline-worktree-submodule-reachability
+name: Publish linked-worktree submodule commit before gitlink update
+loaded_skills:
+  - using-git-worktrees
+  - git-commit
+fixture:
+  files:
+    - path: README.md
+      content: |
+        The real fixture topology is created by fixture.setup.
+  setup: behavioral-evals/fixtures/setup/worktree-submodule.js
+prompt: |
+  A linked superproject worktree is already prepared at super-wt, with submodule libs/sub.
+  In that linked worktree, update libs/sub/module.txt by adding a line containing exactly
+  "feature-ready". Commit the submodule change, make that new submodule commit reachable
+  outside this linked worktree using the submodule's origin remote, then commit the
+  updated gitlink in super-wt. Do not rebuild the fixture and do not remove any worktree.
+max_turns: 24
+expectations:
+  - type: file_contains
+    path: super-wt/libs/sub/module.txt
+    value: feature-ready
+    description: requested submodule content exists
+  - type: command_exit_0
+    command: node .fixture-tools/verify-worktree-submodule.js
+    description: submodule is on a named branch, remotely reachable, clean, and recorded by superproject HEAD
+  - type: command_exit_0
+    command: node .fixture-tools/submodule-reachability.js --json --root super-wt
+    description: canonical #243 reachability helper accepts the final topology

package/behavioral-evals/fixtures/setup/fail.js

@@ -0,0 +1,3 @@
+'use strict';
+console.error('intentional fixture setup failure');
+process.exit(17);

package/behavioral-evals/fixtures/setup/noop.js

@@ -0,0 +1,4 @@
+'use strict';
+const fs = require('fs');
+const path = require('path');
+fs.writeFileSync(path.join(process.cwd(), '.fixture-setup-ok'), 'ok\n');

package/behavioral-evals/fixtures/setup/verify-worktree-submodule.js

@@ -0,0 +1,46 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+function git(cwd, args) {
+  const result = spawnSync('git', args, { cwd, encoding: 'utf8', windowsHide: true });
+  if (result.status !== 0) {
+    throw new Error((result.stderr || result.stdout || `git ${args.join(' ')} failed`).trim());
+  }
+  return result.stdout.trim();
+}
+
+function fail(message) {
+  console.error(message);
+  process.exit(1);
+}
+
+try {
+  const workspace = process.cwd();
+  const superRepo = path.join(workspace, 'super-wt');
+  const submodule = path.join(superRepo, 'libs', 'sub');
+  const content = fs.readFileSync(path.join(submodule, 'module.txt'), 'utf8');
+  if (!content.includes('feature-ready')) fail('submodule content was not updated');
+
+  const sha = git(submodule, ['rev-parse', 'HEAD']);
+  const branch = git(submodule, ['branch', '--show-current']);
+  if (!branch) fail('submodule commit remains detached');
+
+  const remoteRefs = git(submodule, [
+    'for-each-ref', '--contains', sha, '--format=%(refname:short)', 'refs/remotes/'
+  ]).split(/\r?\n/).filter(Boolean);
+  if (remoteRefs.length === 0) fail('submodule commit is not published to a remote-tracking ref');
+
+  if (git(submodule, ['status', '--porcelain'])) fail('submodule working tree is not clean');
+  if (git(superRepo, ['status', '--porcelain', '--', 'libs/sub'])) fail('superproject gitlink is not clean');
+
+  const tree = git(superRepo, ['ls-tree', 'HEAD', 'libs/sub']);
+  const match = tree.match(/^160000 commit ([0-9a-f]{40,64})\tlibs\/sub$/);
+  if (!match || match[1] !== sha) fail('superproject HEAD does not record the new submodule commit');
+
+  console.log(JSON.stringify({ ok: true, sha, branch, remoteRefs }));
+} catch (error) {
+  fail(error.message);
+}

package/behavioral-evals/fixtures/setup/worktree-submodule.js

@@ -0,0 +1,86 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..', '..', '..');
+const FIXED_GIT_DATE = '2000-01-01T00:00:00Z';
+
+function run(command, args, cwd) {
+  const result = spawnSync(command, args, {
+    cwd,
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      GIT_AUTHOR_DATE: FIXED_GIT_DATE,
+      GIT_COMMITTER_DATE: FIXED_GIT_DATE,
+    },
+    windowsHide: true,
+  });
+  if (result.status !== 0) {
+    throw new Error([
+      `${command} ${args.join(' ')} failed with ${result.status}`,
+      result.stdout,
+      result.stderr,
+    ].filter(Boolean).join('\n'));
+  }
+  return result.stdout.trim();
+}
+
+function git(cwd, args) {
+  return run('git', args, cwd);
+}
+
+function initRepo(dir) {
+  fs.mkdirSync(dir, { recursive: true });
+  git(dir, ['init', '-b', 'main']);
+  git(dir, ['config', 'user.name', 'Harness Behavioral Fixture']);
+  git(dir, ['config', 'user.email', 'behavioral-fixture@example.invalid']);
+  git(dir, ['config', 'commit.gpgSign', 'false']);
+  git(dir, ['config', 'core.autocrlf', 'false']);
+}
+
+const workspace = process.cwd();
+const child = path.join(workspace, 'child-origin');
+const superRepo = path.join(workspace, 'super');
+const worktree = path.join(workspace, 'super-wt');
+const toolsDir = path.join(workspace, '.fixture-tools');
+
+initRepo(child);
+fs.writeFileSync(path.join(child, 'module.txt'), 'seed\n');
+git(child, ['add', 'module.txt']);
+git(child, ['commit', '-m', 'seed child']);
+
+initRepo(superRepo);
+fs.writeFileSync(path.join(superRepo, 'README.md'), 'superproject fixture\n');
+git(superRepo, ['add', 'README.md']);
+git(superRepo, ['commit', '-m', 'seed superproject']);
+// Keep the committed .gitmodules URL independent of the random temp workspace.
+git(superRepo, ['-c', 'protocol.file.allow=always', 'submodule', 'add', '../child-origin', 'libs/sub']);
+git(superRepo, ['commit', '-am', 'add child submodule']);
+
+git(superRepo, ['worktree', 'add', worktree, '-b', 'eval/submodule-reachability']);
+git(worktree, ['-c', 'protocol.file.allow=always', 'submodule', 'update', '--init']);
+const linkedSub = path.join(worktree, 'libs', 'sub');
+git(linkedSub, ['config', 'user.name', 'Harness Behavioral Agent']);
+git(linkedSub, ['config', 'user.email', 'behavioral-agent@example.invalid']);
+
+fs.mkdirSync(toolsDir, { recursive: true });
+fs.copyFileSync(
+  path.join(ROOT, 'using-git-worktrees', 'scripts', 'submodule-reachability.js'),
+  path.join(toolsDir, 'submodule-reachability.js')
+);
+fs.copyFileSync(
+  path.join(__dirname, 'verify-worktree-submodule.js'),
+  path.join(toolsDir, 'verify-worktree-submodule.js')
+);
+
+fs.writeFileSync(
+  path.join(workspace, '.fixture-topology.json'),
+  JSON.stringify({
+    primary: 'super',
+    linked_worktree: 'super-wt',
+    submodule: 'super-wt/libs/sub',
+  }, null, 2) + '\n'
+);

package/behavioral-evals/paired-benchmark.js

@@ -7,11 +7,12 @@ const path = require('path');
 const crypto = require('crypto');
 const { execFileSync, spawnSync } = require('child_process');
 const {
-  buildWorkspace,
+  prepareWorkspace,
   grade,
   parseSimpleYaml,
 } = require('./run');
 const { verifyEvidence: verifyOpenCodeReflectionEvidence } = require('./opencode-reflection-gate-live');
+const { resolveFixtureSetup } = require('./case-validator');
 
 const ROOT = path.resolve(__dirname, '..');
 const CASES_DIR = path.join(__dirname, 'cases');
@@ -40,6 +41,11 @@ function stableJson(value) {
   return JSON.stringify(stable(value));
 }
 
+function fixtureSetupSha256(c) {
+  const resolved = resolveFixtureSetup(c && c.fixture && c.fixture.setup);
+  return resolved ? sha256File(resolved.absolute) : null;
+}
+
 function discoverCases() {
   return fs.readdirSync(CASES_DIR)
     .filter((file) => file.endsWith('.yaml'))
@@ -216,7 +222,9 @@ function retrieveLesson(c, memoryStore, stateHome, exposed) {
 }
 
 function prepareArmWorkspace(c, effectType, arm, engine) {
-  const ws = buildWorkspace(c);
+  const prepared = prepareWorkspace(c);
+  const ws = prepared.workspace;
+  if (!prepared.ok) return { ...prepared, ws, fixture_setup: prepared.setup };
   const namedSkills = treatmentSkills(c);
   const treatment = arm === 'treatment';
   let skills = [];
@@ -245,6 +253,8 @@ function prepareArmWorkspace(c, effectType, arm, engine) {
   }
 
   return {
+    ok: true,
+    fixture_setup: prepared.setup,
     ws,
     namedSkills,
     loadedSkills: skills,
@@ -367,8 +377,25 @@ function usageTotal(usage) {
   return typeof input === 'number' && typeof output === 'number' ? input + output : null;
 }
 
-function runArm(c, context, arm, pairDir) {
+function runArm(c, context, arm, pairDir, execute = spawnSync) {
   const prepared = prepareArmWorkspace(c, context.effect_type, arm, context.engine);
+  if (!prepared.ok) {
+    if (prepared.ws) fs.rmSync(prepared.ws, { recursive: true, force: true });
+    return {
+      arm,
+      outcome: 'fixture-error',
+      fixture_setup: prepared.fixture_setup,
+      infrastructure_reason: prepared.error,
+      loaded_skills: [],
+      model_name: null,
+      cost: null,
+      usage: null,
+      total_tokens: null,
+      tool_call_count: null,
+      duration_ms: null,
+      expectations: [],
+    };
+  }
   const stateHome = fs.mkdtempSync(path.join(os.tmpdir(), `harness-paired-state-${arm}-`));
   const transcriptFile = path.join(pairDir, `${arm}.transcript.jsonl`);
   const stderrFile = path.join(pairDir, `${arm}.stderr.txt`);
@@ -388,6 +415,7 @@ function runArm(c, context, arm, pairDir) {
     fs.rmSync(stateHome, { recursive: true, force: true });
     return {
       arm,
+      fixture_setup: prepared.fixture_setup,
       intervention: prepared.intervention,
       loaded_skills: prepared.loadedSkills,
       plugin_sha256: null,
@@ -404,7 +432,7 @@ function runArm(c, context, arm, pairDir) {
   }
   const invocation = buildInvocation(context.engine, context.model, armPrompt, prepared.ws, c.max_turns);
   const started = Date.now();
-  const result = spawnSync(invocation.command, invocation.args, {
+  const result = execute(invocation.command, invocation.args, {
     cwd: prepared.ws,
     env: { ...process.env, HARNESS_STATE_HOME: stateHome },
     encoding: 'utf8',
@@ -420,6 +448,7 @@ function runArm(c, context, arm, pairDir) {
 
   const base = {
     arm,
+    fixture_setup: prepared.fixture_setup,
     intervention: prepared.intervention,
     loaded_skills: prepared.loadedSkills,
     plugin_sha256: prepared.plugin ? prepared.plugin.sha256 : null,
@@ -566,6 +595,7 @@ function pairContract(c, context) {
     max_turns: c.max_turns,
     loaded_skills: treatmentSkills(c).slice().sort(),
     fixture_sha256: sha256(stableJson(c.fixture)),
+    fixture_setup_sha256: fixtureSetupSha256(c),
     prompt_sha256: sha256(c.prompt),
     rubric_sha256: sha256(stableJson(c.expectations)),
     lesson_fixture_sha256: context.effect_type === 'lesson-retrieval' ? sha256(stableJson(c.lesson)) : null,
@@ -781,6 +811,8 @@ function summarizePairs(records, minEffectPp) {
     requested_pairs: records.length,
     included_pairs: included.length,
     excluded_pairs: excluded.length,
+    fixture_failures: records.filter(record => Object.values(record.arms || {})
+      .some(arm => arm.outcome === 'fixture-error')).length,
     exclusions: excluded,
     arm_outcomes: {
       baseline: { pass: baselinePass, fail: included.length - baselinePass },
@@ -941,7 +973,8 @@ function main(argv = process.argv.slice(2)) {
       min_effect_pp: Number(flag(argv, '--min-effect-pp')),
       preflight: flag(argv, '--opencode-preflight'),
     };
-    runExperiment(options);
+    const { summary } = runExperiment(options);
+    if (summary.fixture_failures) process.exitCode = 1;
     return;
   }
   if (command === 'summarize') {
@@ -978,6 +1011,7 @@ module.exports = {
   lessonContextFromRetrieval,
   lessonFixtureRecord,
   prepareArmWorkspace,
+  runArm,
   retrieveLesson,
   summarizePairs,
   validateLessonCase,

package/behavioral-evals/run-with-plugin.js

@@ -9,7 +9,7 @@
 const fs = require('fs');
 const path = require('path');
 const { execFileSync } = require('child_process');
-const { buildWorkspace, validate: validateCases } = require('./run');
+const { prepareWorkspace, validate: validateCases } = require('./run');
 
 const ROOT = path.resolve(__dirname, '..');
 const CASES_DIR = path.join(__dirname, 'cases');
@@ -243,6 +243,36 @@ function grade(c, ws, transcriptPath) {
   return { results, passed: gating.length > 0 && gating.every((g) => g.pass) };
 }
 
+function runCase(c, execute = runHeadless) {
+  const prepared = prepareWorkspace(c);
+  const ws = prepared.workspace;
+  const record = {
+    id: c.id,
+    engine: 'opencode-with-plugin',
+    model: process.env.BEHAVIORAL_MODEL || 'openai/gpt-5-mini',
+    pressure: !!c.pressure,
+    date: new Date().toISOString(),
+    workspace: ws,
+    fixture_setup: prepared.setup,
+    expectations: [],
+  };
+  if (!prepared.ok) return { ...record, outcome: 'fixture-error', error: prepared.error };
+  try {
+    installHarnessWithPlugin(ws);
+    if (c.fixture.git) gitSnapshot(ws);
+    const transcriptPath = execute(c.prompt, ws, c.max_turns);
+    const { results, passed } = grade(c, ws, transcriptPath);
+    return {
+      ...record,
+      transcript: transcriptPath,
+      expectations: results.map(({ description, pass, informational }) => ({ description, pass, ...(informational ? { informational: true } : {}) })),
+      outcome: passed ? 'pass' : 'fail',
+    };
+  } catch (error) {
+    return { ...record, outcome: 'session-error', error: error.message.slice(0, 500) };
+  }
+}
+
 function runLive(filter) {
   console.log('Engine: opencode (with plugin hooks)');
   const cases = discoverCases().filter((c) => !filter || c.id === filter);
@@ -252,49 +282,33 @@ function runLive(filter) {
   let failed = 0;
   for (const c of cases) {
     console.log(`\n=== ${c.id}${c.pressure ? ' [PRESSURE]' : ''} ===`);
-    const ws = buildWorkspace(c);
-    installHarnessWithPlugin(ws);
-    if (c.fixture.git) gitSnapshot(ws);
-    let transcriptPath;
-    try {
-      transcriptPath = runHeadless(c.prompt, ws, c.max_turns);
-    } catch (err) {
-      console.error(`❌ session failed: ${err.message.slice(0, 300)}`);
-      failed++;
-      continue;
-    }
-    const { results: graded, passed } = grade(c, ws, transcriptPath);
-    const record = {
-      id: c.id,
-      engine: 'opencode-with-plugin',
-      model: process.env.BEHAVIORAL_MODEL || 'openai/gpt-5-mini',
-      pressure: !!c.pressure,
-      date: new Date().toISOString(),
-      workspace: ws,
-      transcript: transcriptPath,
-      expectations: graded.map(({ description, pass }) => ({ description, pass })),
-      outcome: passed ? 'pass' : 'fail',
-    };
+    const record = runCase(c);
     const outFile = path.join(RESULTS_DIR, `plugin-${record.date.slice(0, 10)}-${c.id}.json`);
     fs.writeFileSync(outFile, JSON.stringify(record, null, 2));
-    for (const g of graded) console.log(`  ${g.pass ? '✅' : '❌'}${g.informational ? ' (info)' : ''} ${g.description}`);
-    console.log(`${passed ? '✅ PASS' : '❌ FAIL'} -> ${outFile}`);
-    if (!passed) failed++;
+    for (const g of record.expectations) console.log(`  ${g.pass ? '✅' : '❌'}${g.informational ? ' (info)' : ''} ${g.description}`);
+    console.log(`${record.outcome} -> ${outFile}`);
+    if (record.error) console.error(record.error);
+    if (record.outcome !== 'pass') failed++;
   }
   console.log(failed ? `\n❌ ${failed} case(s) failed.` : '\n🎉 all cases passed.');
   process.exit(failed ? 1 : 0);
 }
 
-const args = process.argv.slice(2);
-function flag(name) {
-  const i = args.indexOf(name);
-  return i >= 0 ? args[i + 1] : undefined;
-}
-if (args[0] === 'validate') validateCases(discoverCases());
-else if (args[0] === 'run') {
-  const filter = args.includes('--case') ? flag('--case') : undefined;
-  runLive(filter);
-} else {
-  console.log('Usage:\n  node behavioral-evals/run-with-plugin.js run [--case <id>]');
-  process.exit(args.length ? 1 : 0);
+function main() {
+  const args = process.argv.slice(2);
+  function flag(name) {
+    const i = args.indexOf(name);
+    return i >= 0 ? args[i + 1] : undefined;
+  }
+  if (args[0] === 'validate') validateCases(discoverCases());
+  else if (args[0] === 'run') {
+    const filter = args.includes('--case') ? flag('--case') : undefined;
+    runLive(filter);
+  } else {
+    console.log('Usage:\n  node behavioral-evals/run-with-plugin.js run [--case <id>]');
+    process.exit(args.length ? 1 : 0);
+  }
 }
+
+if (require.main === module) main();
+module.exports = { runCase };