harness-everything 0.3.6 → 0.4.0

package/ci/doc-capability-consistency.test.js

@@ -0,0 +1,180 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '..');
+let failures = 0;
+
+function fail(message) {
+  console.error(`❌ ${message}`);
+  failures++;
+}
+
+function pass(message) {
+  console.log(`✅ ${message}`);
+}
+
+function read(rel) {
+  const p = path.join(ROOT, rel);
+  if (!fs.existsSync(p)) {
+    fail(`missing documentation surface: ${rel}`);
+    return '';
+  }
+  return fs.readFileSync(p, 'utf8');
+}
+
+function requireText(rel, patterns) {
+  const text = read(rel);
+  for (const { name, re } of patterns) {
+    if (!re.test(text)) fail(`${rel}: missing ${name}`);
+    else pass(`${rel}: ${name}`);
+  }
+}
+
+const CURRENT_SURFACES = [
+  'README.md',
+  'AGENTS.md',
+  'BENCHMARK_SOP.md',
+  'VERIFICATION.md',
+  'docs/architecture.md',
+  'docs/mechanism-first-skill-mesh.md',
+  'docs/philosophy.md',
+  'docs/platform-capabilities.md',
+  'docs/reflection.md',
+  'docs/routing.md',
+  'docs/troubleshooting.md',
+  'docs/openai-plugin.md',
+  'submission/openai/README.md',
+  'opencode-plugin/README.md',
+];
+
+const STALE_PATTERNS = [
+  /OpenAI\/Codex plugin hook packaging is tracked separately in \[#72\]/i,
+  /Plugin adapter tracked in #72/i,
+  /plugin target pending/i,
+  /Codex[^\n]{0,120}adapter[^\n]{0,80}pending/i,
+  /Only Claude Code gets the hard-boundary hooks/i,
+  /Only possible on Claude Code \(the only platform with a hook\/exit-code execution system\)/i,
+  /On platforms with no hook system at all \(Cursor, Copilot, Codex/i,
+  /hooks[^\n]{0,100}Hard enforcement, Claude Code only/i,
+  /Codex[^\n]{0,180}\.codex\/skills\//i,
+];
+
+for (const rel of CURRENT_SURFACES) {
+  const text = read(rel);
+  for (const re of STALE_PATTERNS) {
+    if (re.test(text)) fail(`${rel}: contains stale capability claim ${re}`);
+  }
+}
+
+requireText('docs/platform-capabilities.md', [
+  { name: 'local Codex plugin boundary', re: /Codex \/ local OpenAI plugin/i },
+  { name: 'public Skills-only boundary', re: /Public OpenAI Skills-only plugin/i },
+  { name: 'OpenCode live-unverified boundary', re: /live plugin loading remains unverified/i },
+  { name: 'general Codex installer boundary', re: /general `--codex` installer|Legacy\/general installer target/i },
+  { name: 'Codex project skill target', re: /Codex[^\n]*`\.agents\/skills\/`/i },
+  { name: 'Continue global skill target', re: /Continue\.dev[^\n]*`~\/\.continue\/skills\/`/i },
+  { name: 'Hermes global skill target', re: /Hermes Agent[^\n]*`~\/\.hermes\/skills\/`/i },
+  { name: 'Hermes trust boundary', re: /Hermes[^\n]{0,160}trust/i },
+  { name: 'installer ownership boundary', re: /Install\/uninstall ownership boundary/i },
+  { name: 'three-OS round-trip boundary', re: /Linux, Windows, and macOS/i },
+]);
+
+requireText('docs/platform-compatibility.json', [
+  { name: 'machine-readable matrix format', re: /harness-platform-compatibility-v1/ },
+  { name: 'ten-dimension coverage', re: /standaloneSkills[\s\S]*liveHostVerification/ },
+  { name: 'official OpenAI source', re: /https:\/\/developers\.openai\.com\/plugins\/deploy\/submission/ },
+  { name: 'Continue unknown discovery boundary', re: /"id": "continue"[\s\S]{0,3000}"status": "Unknown"/ },
+]);
+
+requireText('README.md', [
+  { name: 'local Codex plugin surface', re: /Codex \/ local OpenAI plugin|local OpenAI plugin/i },
+  { name: 'public Skills-only distinction', re: /Public OpenAI[^\n]*Skills-only|public OpenAI \*\*Skills-only\*\*/i },
+  { name: 'OpenCode live-unverified qualifier', re: /OpenCode[^\n]*(?:live plugin loading|live loading) remains unverified/i },
+  { name: 'canonical matrix link', re: /docs\/platform-capabilities\.md/ },
+  { name: 'Codex repo Agent Skills path', re: /Codex[^\n]*`?\.agents\/skills\/?`?/i },
+  { name: 'Continue native global skills path', re: /`~\/\.continue\/skills\/`/i },
+  { name: 'Hermes native global skills path', re: /`~\/\.hermes\/skills\/`/i },
+  { name: 'installer round-trip evidence', re: /install[^\n]{0,40}(?:→|->)[^\n]{0,40}verify[^\n]{0,40}(?:→|->)[^\n]{0,40}uninstall/i },
+]);
+
+requireText('AGENTS.md', [
+  { name: 'canonical platform matrix rule', re: /docs\/platform-capabilities\.md/ },
+  { name: 'Codex local plugin distribution', re: /plugins\/harness-everything/ },
+  { name: 'public Skills-only boundary', re: /public artifact does not include local `\.codex-plugin` lifecycle hooks/i },
+]);
+
+requireText('BENCHMARK_SOP.md', [
+  { name: 'behavior vs mechanism separation', re: /behavior[^\n]{0,120}mechanism|mechanism\/live-host evidence/i },
+  { name: 'Codex multi-surface distinction', re: /Codex \/ local OpenAI plugin|general Codex installer path/i },
+  { name: 'OpenCode live-unverified qualifier', re: /OpenCode[^\n]*(?:live plugin loading|live loading) remains unverified/i },
+]);
+
+requireText('docs/architecture.md', [
+  { name: 'Codex local plugin host adapter', re: /Codex[^\n]*local OpenAI plugin/i },
+  { name: 'OpenCode live loading remains unverified', re: /live (plugin )?loading remains unverified/i },
+]);
+
+requireText('VERIFICATION.md', [
+  { name: 'mechanism/behavior distinction', re: /Mechanism evidence[\s\S]{0,700}Behavior evidence/i },
+  { name: 'Codex local plugin verification surface', re: /Codex \/ local OpenAI plugin/i },
+  { name: 'public Skills-only verification boundary', re: /Public OpenAI Skills-only/i },
+  { name: 'live-host evidence layer', re: /Live-host evidence/i },
+  { name: 'Codex repo Agent Skills path', re: /Codex[^\n]*`\.agents\/skills\/`/i },
+  { name: 'Continue native global skills path', re: /`~\/\.continue\/skills\/`/i },
+  { name: 'Hermes native global skills path', re: /`~\/\.hermes\/skills\/`/i },
+]);
+
+requireText('docs/philosophy.md', [
+  { name: 'platform-specific mechanism boundary', re: /platform-specific|installation surface/i },
+  { name: 'canonical capability link', re: /platform-capabilities\.md/ },
+  { name: 'automatic mechanism qualifier', re: /On surfaces that package|On integration surfaces that expose/i },
+]);
+
+requireText('docs/reflection.md', [
+  { name: 'runtime state vs durable learning distinction', re: /Runtime session state[\s\S]{0,500}Durable workspace learning/i },
+  { name: 'Codex local plugin WAL boundary', re: /Codex \/ local OpenAI plugin/i },
+  { name: 'public Skills-only hook exclusion', re: /public OpenAI \*\*Skills-only\*\* artifact has no local `\.codex-plugin` lifecycle hooks/i },
+]);
+
+requireText('docs/routing.md', [
+  { name: 'host-specific enforcement boundary', re: /Enforcement strength/i },
+  { name: 'no cross-host parity inference', re: /do not infer cross-host parity/i },
+]);
+
+requireText('docs/troubleshooting.md', [
+  { name: 'Codex advisory installer troubleshooting', re: /Codex advisory installer/i },
+  { name: 'Codex local plugin troubleshooting', re: /Codex \/ local OpenAI plugin not appearing/i },
+  { name: 'public Skills-only troubleshooting boundary', re: /Public OpenAI Skills-only plugin behaves differently/i },
+]);
+
+requireText('docs/openai-plugin.md', [
+  { name: 'public submission excludes local hooks', re: /does \*\*not\*\* include the local `\.codex-plugin` lifecycle hooks/i },
+]);
+
+requireText('submission/openai/README.md', [
+  { name: 'submission excludes local hooks', re: /does not contain the local `\.codex-plugin` lifecycle hooks/i },
+]);
+
+requireText('opencode-plugin/README.md', [
+  { name: 'live OpenCode evidence limitation', re: /Live opencode plugin loading remains unverified/i },
+]);
+
+requireText('docs/audit.md', [
+  { name: 'historical snapshot boundary', re: /Historical snapshot boundary/i },
+  { name: 'current platform matrix link', re: /platform-capabilities\.md/ },
+]);
+
+requireText('CHANGELOG.md', [
+  { name: 'OpenAI/Codex plugin packaging release note', re: /OpenAI\/Codex plugin packaging/i },
+  { name: 'platform capability documentation drift gate release note', re: /platform capability documentation consistency|documentation capability drift/i },
+]);
+
+if (failures) {
+  console.error(`\nDocumentation capability consistency: FAILED (${failures} issue${failures === 1 ? '' : 's'})`);
+  process.exit(1);
+}
+
+console.log('\nDocumentation capability consistency: PASSED');

package/ci/fixtures/phase4/parallel-disjoint.stages.json

@@ -0,0 +1,32 @@
+{
+  "stages": [
+    {
+      "stageId": "security-doc",
+      "goal": "Write the security review artifact",
+      "agent": "fable-worker-sonnet",
+      "task": "Produce the security review only in its declared output scope.",
+      "inputs": ["src/auth"],
+      "expectedOutputs": ["docs/security/review.md"],
+      "outputPath": "docs/security/review.md",
+      "dependsOn": [],
+      "writeSet": ["docs/security"],
+      "checkCommand": null,
+      "passCondition": "security review artifact exists",
+      "failureReturn": "failure summary + evidence + missing prerequisite"
+    },
+    {
+      "stageId": "architecture-doc",
+      "goal": "Write the architecture review artifact",
+      "agent": "fable-worker-sonnet",
+      "task": "Produce the architecture review only in its declared output scope.",
+      "inputs": ["src"],
+      "expectedOutputs": ["docs/architecture/review.md"],
+      "outputPath": "docs/architecture/review.md",
+      "dependsOn": [],
+      "writeSet": ["docs/architecture"],
+      "checkCommand": null,
+      "passCondition": "architecture review artifact exists",
+      "failureReturn": "failure summary + evidence + missing prerequisite"
+    }
+  ]
+}

package/ci/fixtures/phase4/parallel-read-only.stages.json

@@ -0,0 +1,32 @@
+{
+  "stages": [
+    {
+      "stageId": "security-audit",
+      "goal": "Audit authentication security without editing files",
+      "agent": "fable-worker-sonnet",
+      "task": "Inspect the authentication surface and return evidence-backed findings.",
+      "inputs": ["src/auth"],
+      "expectedOutputs": ["security findings"],
+      "outputPath": null,
+      "dependsOn": [],
+      "writeSet": [],
+      "checkCommand": null,
+      "passCondition": "evidence-backed findings returned",
+      "failureReturn": "failure summary + evidence + missing prerequisite"
+    },
+    {
+      "stageId": "architecture-audit",
+      "goal": "Audit architecture boundaries without editing files",
+      "agent": "fable-worker-sonnet",
+      "task": "Inspect architecture boundaries and return evidence-backed findings.",
+      "inputs": ["src"],
+      "expectedOutputs": ["architecture findings"],
+      "outputPath": null,
+      "dependsOn": [],
+      "writeSet": [],
+      "checkCommand": null,
+      "passCondition": "evidence-backed findings returned",
+      "failureReturn": "failure summary + evidence + missing prerequisite"
+    }
+  ]
+}

package/ci/installer-roundtrip.test.js

@@ -0,0 +1,159 @@
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const root = path.resolve(__dirname, '..');
+const cli = path.join(root, 'bin', 'cli.js');
+const ws = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-roundtrip-ws-'));
+const home = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-roundtrip-home-'));
+const prompts = path.join(home, 'vscode-prompts');
+
+function fail(message, detail = '') {
+  console.error(`❌ ${message}${detail ? `\n   ${detail}` : ''}`);
+  cleanup();
+  process.exit(1);
+}
+
+function check(message, condition, detail = '') {
+  if (!condition) fail(message, detail);
+  console.log(`✅ ${message}`);
+}
+
+function writeUnder(base, rel, content) {
+  const target = path.join(base, rel);
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.writeFileSync(target, content, 'utf8');
+  return target;
+}
+
+function write(rel, content) {
+  return writeUnder(ws, rel, content);
+}
+
+function writeHome(rel, content) {
+  return writeUnder(home, rel, content);
+}
+
+function run(args) {
+  const env = {
+    ...process.env,
+    HOME: home,
+    USERPROFILE: home,
+    APPDATA: path.join(home, 'AppData', 'Roaming'),
+    VSCODE_USER_PROMPTS_FOLDER: prompts,
+  };
+  return spawnSync(process.execPath, [cli, ...args], { cwd: ws, env, encoding: 'utf8' });
+}
+
+function cleanup() {
+  fs.rmSync(ws, { recursive: true, force: true });
+  fs.rmSync(home, { recursive: true, force: true });
+}
+
+fs.mkdirSync(path.join(ws, '.git'), { recursive: true });
+
+// -------------------------------------------------------------------------
+// Local round trip: seed real user files, install all platform integrations
+// with physical copies, then verify uninstall returns those bytes exactly.
+// -------------------------------------------------------------------------
+const seeded = new Map([
+  ['.claude/settings.json', JSON.stringify({ customSetting: true, permissions: { allow: ['Bash(git status)'] } }, null, 2)],
+  ['.cursorrules', 'user cursor rule\n'],
+  ['.github/copilot-instructions.md', 'user copilot instruction\n'],
+  ['AGENTS.md', 'user codex instruction\n'],
+  ['.hermes.md', 'user hermes context\n'],
+  ['.continue/rules/user.md', '# user continue rule\n'],
+]);
+for (const [rel, content] of seeded) write(rel, content);
+
+const customSkill = write(
+  '.agents/skills/custom-user-skill/SKILL.md',
+  '---\nname: custom-user-skill\ndescription: user owned\nmetadata:\n  author: Someone Else\n  version: 1.0.0\n---\n# User skill\n'
+);
+
+const install = run(['install', '--all', '--copy', '-y']);
+check('local install --all --copy succeeds', install.status === 0, `${install.stdout}\n${install.stderr}`);
+const verify = run(['verify-install']);
+check('verify-install succeeds after local installation', verify.status === 0, `${verify.stdout}\n${verify.stderr}`);
+
+const targetChecks = [
+  '.claude/skills/tdd/SKILL.md',
+  '.cursor/skills/tdd/SKILL.md',
+  '.github/skills/tdd/SKILL.md',
+  '.agents/skills/tdd/SKILL.md',
+  '.continue/skills/tdd/SKILL.md',
+];
+for (const rel of targetChecks) check(`installed ${rel}`, fs.existsSync(path.join(ws, rel)));
+check('Hermes/Codex shared project skill is discoverable through .agents/skills', fs.existsSync(path.join(ws, '.agents', 'skills', 'tdd', 'SKILL.md')));
+check('user-owned shared skill survives local install', fs.existsSync(customSkill));
+
+const uninstall = run(['uninstall', '--local', '--skills', '-y']);
+check('local uninstall --local --skills succeeds', uninstall.status === 0, `${uninstall.stdout}\n${uninstall.stderr}`);
+
+for (const [rel, expected] of seeded) {
+  const target = path.join(ws, rel);
+  check(`restored pre-existing ${rel}`, fs.existsSync(target) && fs.readFileSync(target, 'utf8') === expected,
+    fs.existsSync(target) ? JSON.stringify(fs.readFileSync(target, 'utf8')) : 'file missing');
+}
+check('Harness Continue rule is removed', !fs.existsSync(path.join(ws, '.continue', 'rules', 'harness.md')));
+check('user-owned shared skill survives local uninstall', fs.existsSync(customSkill));
+for (const rel of targetChecks) check(`removed Harness skill ${rel}`, !fs.existsSync(path.join(ws, rel)));
+
+const ownedHarnessDirs = [
+  '.claude/harness-everything',
+  '.cursor/harness-everything',
+  '.github/harness-everything',
+  '.codex/harness-everything',
+  '.continue/harness-everything',
+  '.hermes/harness-everything',
+];
+for (const rel of ownedHarnessDirs) check(`no orphaned local ${rel}`, !fs.existsSync(path.join(ws, rel)));
+
+// -------------------------------------------------------------------------
+// Global round trip: prove each host-native user skill root is used and that
+// a shared ~/.agents/skills directory can contain unrelated user content.
+// -------------------------------------------------------------------------
+const seededHome = new Map([
+  ['.claude/settings.json', JSON.stringify({ globalUserSetting: true }, null, 2)],
+  ['.cursorrules', 'global user cursor rule\n'],
+  ['.continue/rules/user.md', '# global user continue rule\n'],
+]);
+for (const [rel, content] of seededHome) writeHome(rel, content);
+
+const customGlobalSkill = writeHome(
+  '.agents/skills/custom-global-skill/SKILL.md',
+  '---\nname: custom-global-skill\ndescription: user owned global skill\nmetadata:\n  author: Someone Else\n  version: 1.0.0\n---\n# User global skill\n'
+);
+
+const globalInstall = run(['install', '--all', '--global', '--copy', '-y']);
+check('global install --all --copy succeeds', globalInstall.status === 0, `${globalInstall.stdout}\n${globalInstall.stderr}`);
+
+const globalTargets = [
+  ['Claude global', path.join(home, '.claude', 'skills', 'tdd', 'SKILL.md')],
+  ['shared Agent Skills global', path.join(home, '.agents', 'skills', 'tdd', 'SKILL.md')],
+  ['Continue global', path.join(home, '.continue', 'skills', 'tdd', 'SKILL.md')],
+  ['Hermes global', path.join(home, '.hermes', 'skills', 'tdd', 'SKILL.md')],
+];
+for (const [label, target] of globalTargets) check(`${label} target contains tdd`, fs.existsSync(target), target);
+check('Hermes global ownership marker exists', fs.existsSync(path.join(home, '.agents', 'harness-everything', 'hermes-global.json')));
+check('user-owned global Agent Skill survives global install', fs.existsSync(customGlobalSkill));
+
+const globalUninstall = run(['uninstall', '--global', '--skills', '-y']);
+check('global uninstall --global --skills succeeds', globalUninstall.status === 0, `${globalUninstall.stdout}\n${globalUninstall.stderr}`);
+
+for (const [rel, expected] of seededHome) {
+  const target = path.join(home, rel);
+  check(`restored pre-existing global ${rel}`, fs.existsSync(target) && fs.readFileSync(target, 'utf8') === expected,
+    fs.existsSync(target) ? JSON.stringify(fs.readFileSync(target, 'utf8')) : 'file missing');
+}
+check('user-owned global Agent Skill survives global uninstall', fs.existsSync(customGlobalSkill));
+for (const [label, target] of globalTargets) check(`${label} Harness skill removed`, !fs.existsSync(target), target);
+check('Hermes global ownership marker removed', !fs.existsSync(path.join(home, '.agents', 'harness-everything', 'hermes-global.json')));
+
+for (const rel of ['.claude/harness-everything', '.agents/harness-everything', '.continue/harness-everything', '.hermes/harness-everything']) {
+  check(`no orphaned global ${rel}`, !fs.existsSync(path.join(home, rel)));
+}
+
+cleanup();
+console.log('\nInstaller local + global round-trip: PASSED');

package/ci/invariant-routing.test.js

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+let failed = 0;
+
+function check(condition, message) {
+  if (condition) {
+    console.log(`  PASS ${message}`);
+  } else {
+    console.error(`  FAIL ${message}`);
+    failed++;
+  }
+}
+
+function read(rel) {
+  return fs.readFileSync(path.join(ROOT, rel), 'utf8');
+}
+
+console.log('=== Invariant-First Routing Contract ===');
+
+const kernel = path.join(ROOT, 'harness-everything', 'scripts', 'kernel-router.js');
+const tier2 = spawnSync(process.execPath, [kernel, 'add a login endpoint with tests and update the implementation'], {
+  cwd: ROOT,
+  encoding: 'utf8',
+});
+
+check(tier2.status === 0, 'kernel router exits successfully');
+check(/RECOMMENDED TIER:\s*Tier 2/i.test(tier2.stdout), 'classifier result is preserved');
+check(tier2.stdout.includes('"strategy":"iterative-single"'), 'Tier 2 structured plan selects iterative-single');
+check(tier2.stdout.includes('REQUIRED HARNESS INVARIANTS'), 'kernel emits mandatory invariants');
+check(tier2.stdout.includes('Route before execution'), 'route-before-execution invariant is present');
+check(tier2.stdout.includes('Verify before claim'), 'verify-before-claim invariant is present');
+check(tier2.stdout.includes('after 3 same-signature failures'), 'failure escalation invariant is present');
+check(tier2.stdout.includes('loop-budget:'), 'iterative-single loop budget invariant is present');
+check(tier2.stdout.includes('SUGGESTED SKILLS (ADVISORY'), 'domain skills are explicitly advisory');
+check(tier2.stdout.includes('tdd:'), 'Tier 2 can still recommend TDD');
+check(!tier2.stdout.includes('BASE EXECUTION LOOP'), 'legacy fixed base-execution-loop output is suppressed');
+check(tier2.stdout.includes('Do not enforce workflow order'), 'self-orchestration policy is explicit');
+
+const tier3 = spawnSync(process.execPath, [kernel, 'audit the entire repository architecture and coordinate multiple modules'], {
+  cwd: ROOT,
+  encoding: 'utf8',
+});
+check(tier3.status === 0, 'Tier 3 kernel routing exits successfully');
+check(/RECOMMENDED TIER:\s*Tier 3/i.test(tier3.stdout), 'macro task remains Tier 3');
+check(tier3.stdout.includes('"strategy":"fable-staged"'), 'Tier 3 dependent/unproven work selects fable-staged');
+check(tier3.stdout.includes('fable-mode / fable-discipline'), 'Tier 3 selected plan suggests Fable capabilities');
+check(tier3.stdout.includes('suggested skills remain advisory'), 'Tier 3 suggestions remain non-mandatory');
+
+const harnessSkill = read('harness-everything/SKILL.md');
+check(!/Requests that already name a skill/i.test(harnessSkill), 'harness entrypoint no longer opts out when another skill is named');
+check(/including work that already names or strongly matches another skill/i.test(harnessSkill), 'named domain skills still pass through Harness routing');
+check(/not a fixed pipeline/i.test(harnessSkill), 'skill contract rejects fixed pipeline semantics');
+
+const cognitiveSkill = read('install-cognitive-os/SKILL.md');
+check(/policy, not a required peer-skill selection/i.test(cognitiveSkill), 'Cognitive OS is defined as policy rather than peer-skill dependency');
+check(!/Tasks already governed by a more specific domain skill/i.test(cognitiveSkill), 'domain skill selection no longer disables Cognitive OS policy');
+
+const hooks = JSON.parse(read('hooks/hooks.json'));
+const promptHooks = hooks.hooks && hooks.hooks.UserPromptSubmit;
+const command = promptHooks && promptHooks[0] && promptHooks[0].hooks && promptHooks[0].hooks[0] && promptHooks[0].hooks[0].command;
+check(command === 'node "${CLAUDE_PLUGIN_ROOT}/harness-everything/scripts/kernel-router.js"', 'UserPromptSubmit anchors the Harness kernel to the Claude plugin root');
+
+const triageDoc = read('harness-everything/references/triage-and-tiers.md');
+check(triageDoc.includes('Do not enforce workflow order. Enforce workflow invariants.'), 'architecture reference records the invariant-first decision');
+check(triageDoc.includes('A tier is **not** a fixed pipeline'), 'tier documentation rejects rigid orchestration');
+check(!triageDoc.includes('MUST load `todo-driven-workflow`'), 'documentation no longer mandates TODO as universal Tier 2/3 first step');
+check(triageDoc.includes('```mermaid'), 'updated architecture retains executable flowchart documentation');
+
+console.log(`\n${failed === 0 ? 'PASS' : 'FAIL'}: invariant routing contract (${failed} failure${failed === 1 ? '' : 's'})`);
+process.exit(failed === 0 ? 0 : 1);