harness-everything 0.3.6 → 0.4.0

package/ci/mutation-check.js

@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+'use strict';
+
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+const loader = path.join(__dirname, 'mutation-loader.js');
+const checks = [
+  ['physical path boundaries', 'scripts/lib/path-boundary.js', 'ci/mechanism-2v-verifier-boundaries.test.js'],
+  ['exact execution commands', 'scripts/lib/execution-contract.js', 'ci/mechanism-2v-verifier-boundaries.test.js'],
+  ['archive output boundaries', 'behavioral-evals/evidence-tool.js', 'ci/mechanism-2t-pr66-evidence-triage.test.js'],
+  ['legacy migration boundaries', 'multi-agent-workspace/scripts/scaffold.js', 'ci/mechanism-2l-multi-agent-workspace.test.js'],
+  ['global installer fallback', 'scripts/installer.js', 'ci/mechanism-2q-installer-global-shared-store.test.js'],
+  ['transcript command qualifiers', 'behavioral-evals/transcript-parser.js', 'ci/mechanism-2t-transcript-parser.test.js'],
+  ['fixture path boundaries', 'behavioral-evals/run.js', 'ci/mechanism-2j-behavioral-runner.test.js'],
+  ['unbound workspace identity', 'scripts/lib/workspace.js', 'ci/mechanism-2u-issue-42-regressions.test.js'],
+];
+
+let failures = 0;
+for (const [label, target, testFile] of checks) {
+  const result = spawnSync(process.execPath, ['--require', loader, path.join(ROOT, testFile)], {
+    cwd: ROOT,
+    env: {
+      ...process.env,
+      HARNESS_MUTATION: {
+        'scripts/lib/path-boundary.js': 'path-boundary',
+        'scripts/lib/execution-contract.js': 'execution-contract',
+        'behavioral-evals/evidence-tool.js': 'evidence-tool',
+        'multi-agent-workspace/scripts/scaffold.js': 'scaffold-migration',
+        'scripts/installer.js': 'installer-global',
+        'behavioral-evals/transcript-parser.js': 'transcript-command',
+        'behavioral-evals/run.js': 'runner-fixture',
+        'scripts/lib/workspace.js': 'workspace-identity',
+      }[target],
+      HARNESS_MUTATION_TARGET: path.join(ROOT, target),
+      NODE_OPTIONS: `--require=${loader}`,
+    },
+    encoding: 'utf8'
+  });
+  if (result.status === 0) {
+    console.error(`FAIL mutation survived: ${label} (${target})`);
+    failures++;
+  } else {
+    console.log(`PASS mutation was caught: ${label} (${testFile})`);
+  }
+}
+
+if (failures) {
+  console.error(`Mutation check failed: ${failures} mutation(s) survived.`);
+  process.exit(1);
+}
+console.log(`Mutation check passed: ${checks.length} production mutations were rejected by focused tests.`);

package/ci/mutation-loader.js

@@ -0,0 +1,57 @@
+'use strict';
+
+const fs = require('fs');
+const Module = require('module');
+const path = require('path');
+
+const target = process.env.HARNESS_MUTATION_TARGET && path.resolve(process.env.HARNESS_MUTATION_TARGET);
+const mutation = process.env.HARNESS_MUTATION;
+const originalLoader = Module._extensions['.js'];
+
+const mutations = {
+  'path-boundary': (source) => source.replace(
+    '  assertNoLinkComponents(root, candidate);',
+    '  // mutation: skip physical link-component validation'
+  ),
+  'execution-contract': (source) => source.replace(
+    '  return left !== null && left === right;',
+    '  return left !== null; // mutation: accept every non-null command'
+  ),
+  'evidence-tool': (source) => source
+    .replace('  const containedDestination = assertContainedPath(archiveRoot, destination).target;', '  const containedDestination = destination; // mutation: skip destination boundary')
+    .replace('  const contained = assertContainedPath(archiveRoot, target).target;', '  const contained = target; // mutation: skip archive write boundary'),
+  'scaffold-migration': (source) => source.replace(
+    '  assertContainedPath(workspaceRoot, legacyRoot);',
+    '  // mutation: skip linked legacy-root validation'
+  ),
+  'installer-global': (source) => source.replace(
+    'const workspaceRoot = detectedWorkspaceRoot || path.resolve(process.cwd());',
+    'const workspaceRoot = detectedWorkspaceRoot; // mutation: restore null global workspace'
+  ),
+  'transcript-command': (source) => source.replace(
+    '    if (target.command !== undefined && (!isObject(call.input) || !commandMatches(call.input.command, target.command))) return false;',
+    '    // mutation: ignore command qualifiers'
+  ),
+  'runner-fixture': (source) => source.replace(
+    '    const relative = normalizeRepoPath(file && file.path);',
+    '    const relative = file && file.path; // mutation: skip fixture path normalization'
+  ),
+  'workspace-identity': (source) => source.replace(
+    '  if (!workspaceRoot) return UNBOUND_WORKSPACE_KEY;',
+    '  if (!workspaceRoot) return path.basename(process.cwd()); // mutation: derive unbound identity from cwd'
+  ),
+};
+
+if (target && mutation && mutations[mutation]) {
+  const transform = mutations[mutation];
+  Module._extensions['.js'] = function loadWithMutation(mod, filename) {
+    const source = fs.readFileSync(filename, 'utf8');
+    if (path.resolve(filename) === target) {
+      const mutated = transform(source);
+      if (mutated === source) throw new Error(`mutation was not applied to ${filename}`);
+      mod._compile(mutated, filename);
+      return;
+    }
+    originalLoader(mod, filename);
+  };
+}

package/ci/negative-controls.js

@@ -7,11 +7,12 @@
  */
 const fs = require('fs');
 const path = require('path');
-const { execSync } = require('child_process');
+const { spawnSync } = require('child_process');
 
 const ROOT = path.resolve(__dirname, '..');
 let passed = 0;
 let failed = 0;
+let fixtureCounter = 0;
 
 function test(name, fn) {
   try {
@@ -29,56 +30,85 @@ function assert(condition, msg) {
   if (!condition) throw new Error(msg || 'assertion failed');
 }
 
-// --- 1. Consistency gate rejects malformed frontmatter ---------------------
-test('consistency-check rejects unquoted colon in frontmatter', () => {
-  const fixture = path.join(ROOT, 'ci/fixtures/bad-frontmatter-colon/SKILL.md');
-  assert(fs.existsSync(fixture), `fixture not found: ${fixture}`);
-  const raw = fs.readFileSync(fixture, 'utf8');
-  const fmMatch = raw.match(/^---\r?\n([\s\S]*?)\r?\n---/);
-  assert(fmMatch, 'fixture has no frontmatter');
-  const fm = fmMatch[1];
-  const desc = (fm.match(/^description:\s*(.+)$/m) || [])[1] || '';
-  // Unquoted colon in value should be caught
-  assert(desc.includes(':') && !/^["']/.test(desc), 'description should contain unquoted colon');
-});
+function runGate(script) {
+  const result = spawnSync(process.execPath, [path.join(ROOT, 'ci', script)], {
+    cwd: ROOT,
+    encoding: 'utf8',
+    env: process.env,
+  });
+  return {
+    ...result,
+    output: `${result.stdout || ''}\n${result.stderr || ''}`,
+  };
+}
 
-// --- 2. Collision gate rejects identical descriptions ----------------------
-test('collision detection rejects two skills with identical descriptions', () => {
-  const skillA = path.join(ROOT, 'ci/fixtures/duplicate-description/skill-a/SKILL.md');
-  const skillB = path.join(ROOT, 'ci/fixtures/duplicate-description/skill-b/SKILL.md');
-  assert(fs.existsSync(skillA) && fs.existsSync(skillB), 'duplicate fixtures not found');
-  const fmA = fs.readFileSync(skillA, 'utf8').match(/^---\r?\n([\s\S]*?)\r?\n---/)[1];
-  const fmB = fs.readFileSync(skillB, 'utf8').match(/^---\r?\n([\s\S]*?)\r?\n---/)[1];
-  const descA = (fmA.match(/^description:\s*(.+)$/m) || [])[1] || '';
-  const descB = (fmB.match(/^description:\s*(.+)$/m) || [])[1] || '';
-  assert(descA === descB && descA.length > 0, 'descriptions should be identical and non-empty');
-  // In a real run, collision detection would flag this
-});
+function installFixture(source, label) {
+  const target = path.join(ROOT, `issue20-negative-${process.pid}-${++fixtureCounter}-${label}`);
+  assert(!fs.existsSync(target), `refusing to overwrite existing path: ${target}`);
+  fs.cpSync(path.join(ROOT, source), target, { recursive: true });
+  return target;
+}
 
-// --- 3. Token gate rejects oversized SKILL.md -----------------------------
-test('token-budget gate exists in consistency-check.js', () => {
-  const checkSrc = fs.readFileSync(path.join(ROOT, 'ci/consistency-check.js'), 'utf8');
-  assert(checkSrc.includes('TOKEN_HARD_LIMIT'), 'consistency-check.js should define TOKEN_HARD_LIMIT');
-  assert(checkSrc.includes('word count'), 'consistency-check.js should check word count');
-});
+function removeFixtures(targets) {
+  for (const target of targets.reverse()) {
+    fs.rmSync(target, { recursive: true, force: true });
+  }
+}
 
-// --- 4. YAML frontmatter validator exists ----------------------------------
-test('frontmatter syntax validator exists in consistency-check.js', () => {
-  const checkSrc = fs.readFileSync(path.join(ROOT, 'ci/consistency-check.js'), 'utf8');
-  assert(checkSrc.includes('validateFrontmatterSyntax'), 'consistency-check.js should have validateFrontmatterSyntax');
-  assert(checkSrc.includes('unquoted colon'), 'validator should check for unquoted colons');
-});
+function expectGateFailure(name, script, fixtures, matcher) {
+  test(name, () => {
+    const targets = [];
+    try {
+      for (const fixture of fixtures) targets.push(installFixture(fixture.source, fixture.label));
+      const result = runGate(script);
+      assert(result.status !== 0, `${script} unexpectedly passed (exit ${result.status})`);
+      assert(matcher.test(result.output), `${script} failed without the expected diagnostic:\n${result.output}`);
+      console.log(`   real gate: ${script} exited ${result.status}`);
+    } finally {
+      removeFixtures(targets);
+    }
+  });
+}
+
+expectGateFailure(
+  'consistency-check rejects malformed frontmatter',
+  'consistency-check.js',
+  [{ source: 'ci/fixtures/bad-frontmatter-colon', label: 'bad-frontmatter' }],
+  /frontmatter YAML syntax valid|YAMLException|unquoted colon/i
+);
+
+expectGateFailure(
+  'consistency-check rejects a missing frontmatter delimiter',
+  'consistency-check.js',
+  [{ source: 'eval-framework/fixtures/missing-delimiter', label: 'missing-delimiter' }],
+  /delimiter|frontmatter/i
+);
+
+expectGateFailure(
+  'description-collision rejects duplicate descriptions',
+  'description-collision.js',
+  [
+    { source: 'ci/fixtures/duplicate-description/skill-a', label: 'duplicate-a' },
+    { source: 'ci/fixtures/duplicate-description/skill-b', label: 'duplicate-b' },
+  ],
+  /COLLISION/i
+);
+
+expectGateFailure(
+  'consistency-check rejects an over-budget skill',
+  'consistency-check.js',
+  [{ source: 'eval-framework/fixtures/over-budget-skill', label: 'over-budget' }],
+  /exceeds hard limit|word count/i
+);
 
-// --- 5. Consistency check actually fails on the bad fixture ----------------
-test('consistency-check.js exits non-zero when fixtures are discoverable', () => {
-  // This tests that the gate logic works; the fixture is nested so won't be
-  // discovered by the normal scan, but the validator function itself catches it.
-  const checkSrc = fs.readFileSync(path.join(ROOT, 'ci/consistency-check.js'), 'utf8');
-  // The validator should call check() with false for unquoted colons
-  assert(checkSrc.includes("check(\n") || checkSrc.includes('check(`'), 'check() function is called');
+test('normal repository passes the exercised gates', () => {
+  const consistency = runGate('consistency-check.js');
+  const collision = runGate('description-collision.js');
+  assert(consistency.status === 0, `consistency-check failed (exit ${consistency.status})`);
+  assert(collision.status === 0, `description-collision failed (exit ${collision.status})`);
+  console.log('   real gates: consistency-check.js and description-collision.js exited 0');
 });
 
-// --- Summary ---------------------------------------------------------------
 console.log(`\nNegative control results: ${passed} passed, ${failed} failed`);
 if (failed > 0) process.exit(1);
-console.log('All negative controls verified.');
+console.log('All negative controls verified by executing the real gates.');

package/ci/openai-plugin-package.test.js

@@ -0,0 +1,182 @@
+'use strict';
+
+const assert = require('assert');
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+const PLUGIN = path.join(ROOT, 'plugins', 'harness-everything');
+const SOURCE_MANIFEST = JSON.parse(fs.readFileSync(path.join(ROOT, '.claude-plugin', 'plugin.json'), 'utf8'));
+const PLUGIN_MANIFEST = JSON.parse(fs.readFileSync(path.join(PLUGIN, '.codex-plugin', 'plugin.json'), 'utf8'));
+const PORTABLE_MANIFEST = JSON.parse(fs.readFileSync(path.join(PLUGIN, 'plugin.json'), 'utf8'));
+
+function sha256(file) {
+  const bytes = fs.readFileSync(file);
+  // Git stores text blobs with LF, while a Windows checkout may materialize
+  // canonical files with CRLF. Package parity compares canonical content, not
+  // platform checkout EOL bytes.
+  const normalized = bytes.includes(0)
+    ? bytes
+    : Buffer.from(bytes.toString('utf8').replace(/\r\n/g, '\n'), 'utf8');
+  return crypto.createHash('sha256').update(normalized).digest('hex');
+}
+
+function filesUnder(root, base = root, out = []) {
+  for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
+    const full = path.join(root, entry.name);
+    if (entry.isDirectory()) filesUnder(full, base, out);
+    else if (entry.isFile()) out.push(path.relative(base, full).replace(/\\/g, '/'));
+  }
+  return out.sort();
+}
+
+function assertTreesEqual(source, packaged, name) {
+  assert.ok(fs.existsSync(packaged), `${name}: packaged skill directory missing`);
+  const sourceFiles = filesUnder(source);
+  const packagedFiles = filesUnder(packaged);
+  assert.deepStrictEqual(packagedFiles, sourceFiles, `${name}: packaged file list drifted from canonical source`);
+  for (const relative of sourceFiles) {
+    assert.strictEqual(
+      sha256(path.join(packaged, relative)),
+      sha256(path.join(source, relative)),
+      `${name}/${relative}: packaged content drifted from canonical source`
+    );
+  }
+}
+
+assert.strictEqual(PLUGIN_MANIFEST.name, 'harness-everything');
+assert.strictEqual(PLUGIN_MANIFEST.version, SOURCE_MANIFEST.version, 'OpenAI plugin version must match canonical plugin version');
+assert.strictEqual(PLUGIN_MANIFEST.skills, './skills/');
+assert.strictEqual(PLUGIN_MANIFEST.hooks, './hooks/hooks.json');
+assert.strictEqual(PORTABLE_MANIFEST.$schema, 'https://agent-plugins.org/schemas/1.0.0/plugin.schema.json');
+assert.strictEqual(PORTABLE_MANIFEST.name, PLUGIN_MANIFEST.name);
+assert.strictEqual(PORTABLE_MANIFEST.version, PLUGIN_MANIFEST.version);
+assert.strictEqual(PORTABLE_MANIFEST.description, PLUGIN_MANIFEST.description);
+assert.deepStrictEqual(PORTABLE_MANIFEST.author, PLUGIN_MANIFEST.author);
+assert.strictEqual(PORTABLE_MANIFEST.homepage, PLUGIN_MANIFEST.homepage);
+assert.strictEqual(PORTABLE_MANIFEST.repository, PLUGIN_MANIFEST.repository);
+assert.strictEqual(PORTABLE_MANIFEST.license, PLUGIN_MANIFEST.license);
+assert.deepStrictEqual(PORTABLE_MANIFEST.keywords, PLUGIN_MANIFEST.keywords);
+assert.ok(!Object.prototype.hasOwnProperty.call(PORTABLE_MANIFEST, 'skills'), 'portable plugin manifest must use the root skills/ convention');
+const portableOpenAI = PORTABLE_MANIFEST.extensions?.['com.openai'];
+assert.ok(portableOpenAI, 'portable plugin manifest must expose the OpenAI extension');
+assert.strictEqual(portableOpenAI.hooks, PLUGIN_MANIFEST.hooks);
+assert.deepStrictEqual(portableOpenAI.interface, PLUGIN_MANIFEST.interface, 'portable and compatibility interface metadata drifted');
+assert.ok(!Object.prototype.hasOwnProperty.call(PLUGIN_MANIFEST, 'agents'), 'OpenAI manifest must not claim an undocumented agents field');
+assert.ok(!Object.prototype.hasOwnProperty.call(PLUGIN_MANIFEST, 'mcpServers'), 'skill-only package must not add MCP without a demonstrated requirement');
+assert.ok(!Object.prototype.hasOwnProperty.call(PLUGIN_MANIFEST, 'apps'), 'skill-only package must not claim a connected app');
+
+const requiredInterfaceFields = [
+  'displayName',
+  'shortDescription',
+  'longDescription',
+  'developerName',
+  'category',
+  'capabilities',
+  'websiteURL',
+  'privacyPolicyURL',
+  'termsOfServiceURL',
+  'defaultPrompt'
+];
+for (const field of requiredInterfaceFields) {
+  assert.ok(Object.prototype.hasOwnProperty.call(PLUGIN_MANIFEST.interface || {}, field), `OpenAI interface missing ${field}`);
+}
+assert.strictEqual(PLUGIN_MANIFEST.interface.displayName, 'Harness Everything');
+assert.strictEqual(PLUGIN_MANIFEST.interface.category, 'Developer Tools');
+assert.deepStrictEqual(PLUGIN_MANIFEST.interface.capabilities, ['Interactive', 'Read', 'Write']);
+assert.ok(Array.isArray(PLUGIN_MANIFEST.interface.defaultPrompt), 'defaultPrompt must be an array');
+assert.ok(PLUGIN_MANIFEST.interface.defaultPrompt.length > 0 && PLUGIN_MANIFEST.interface.defaultPrompt.length <= 3, 'defaultPrompt must contain 1-3 entries');
+for (const prompt of PLUGIN_MANIFEST.interface.defaultPrompt) {
+  assert.ok(prompt.length <= 128, `defaultPrompt exceeds 128 characters: ${prompt}`);
+}
+
+const publicationDocs = [
+  ['privacyPolicyURL', 'PRIVACY.md'],
+  ['termsOfServiceURL', 'TERMS.md']
+];
+for (const [field, filename] of publicationDocs) {
+  const value = PLUGIN_MANIFEST.interface[field];
+  assert.match(value, /^https:\/\/github\.com\/dyphn1\/Harness-everything\/blob\/main\//, `${field} must use a public HTTPS repository URL`);
+  assert.ok(fs.existsSync(path.join(ROOT, filename)), `${field} target document is missing: ${filename}`);
+}
+
+const skillNames = (SOURCE_MANIFEST.skills || []).map(entry => path.basename(entry)).sort();
+const packagedSkillNames = fs.readdirSync(path.join(PLUGIN, 'skills'), { withFileTypes: true })
+  .filter(entry => entry.isDirectory())
+  .map(entry => entry.name)
+  .sort();
+assert.strictEqual(skillNames.length, 26, 'canonical suite should contain 26 skills');
+assert.deepStrictEqual(packagedSkillNames, skillNames, 'OpenAI package must contain exactly the canonical skill set');
+for (const entry of SOURCE_MANIFEST.skills) {
+  const source = path.resolve(ROOT, entry);
+  const name = path.basename(source);
+  assertTreesEqual(source, path.join(PLUGIN, 'skills', name), name);
+}
+
+const marketplace = JSON.parse(fs.readFileSync(path.join(ROOT, '.agents', 'plugins', 'marketplace.json'), 'utf8'));
+assert.strictEqual(marketplace.name, 'harness-everything', 'marketplace should use the publication name, not a local-only label');
+assert.strictEqual(marketplace.interface?.displayName, 'Harness Everything');
+const marketEntry = marketplace.plugins.find(plugin => plugin.name === 'harness-everything');
+assert.ok(marketEntry, 'repo marketplace must expose harness-everything');
+assert.strictEqual(marketEntry.source.source, 'local');
+assert.strictEqual(marketEntry.source.path, './plugins/harness-everything');
+assert.strictEqual(marketEntry.policy?.installation, 'AVAILABLE');
+assert.strictEqual(marketEntry.policy?.authentication, 'ON_INSTALL');
+assert.strictEqual(marketEntry.category, 'Developer Tools');
+assert.ok(fs.existsSync(path.join(ROOT, marketEntry.source.path, '.codex-plugin', 'plugin.json')), 'marketplace source must resolve to an installable plugin');
+
+const hooks = JSON.parse(fs.readFileSync(path.join(PLUGIN, 'hooks', 'hooks.json'), 'utf8'));
+assert.ok(hooks.hooks.SessionStart?.length, 'SessionStart hook missing');
+assert.ok(hooks.hooks.UserPromptSubmit?.length, 'UserPromptSubmit hook missing');
+assert.ok(hooks.hooks.PreToolUse?.length, 'PreToolUse hook missing');
+assert.ok(hooks.hooks.PostToolUse?.length, 'PostToolUse hook missing');
+assert.ok(hooks.hooks.SubagentStart?.length, 'SubagentStart hook missing');
+assert.ok(hooks.hooks.SubagentStop?.length, 'SubagentStop hook missing');
+assert.ok(hooks.hooks.Stop?.length, 'Stop hook missing');
+const hookText = JSON.stringify(hooks);
+assert.match(hookText, /PLUGIN_ROOT/, 'plugin hooks must resolve from PLUGIN_ROOT');
+assert.match(hookText, /commandWindows/, 'plugin hooks need a Windows command override');
+
+const session = spawnSync(process.execPath, [path.join(PLUGIN, 'hooks', 'session-start.js')], { encoding: 'utf8' });
+assert.strictEqual(session.status, 0, session.stderr);
+assert.match(session.stdout, /Cognitive OS policy is active/);
+assert.match(session.stdout, /Route before execution/);
+assert.match(session.stdout, /Verify before claim/);
+assert.match(session.stdout, /3 same-signature failures/);
+
+const kernel = path.join(PLUGIN, 'skills', 'harness-everything', 'scripts', 'kernel-router.js');
+function route(prompt) {
+  return spawnSync(process.execPath, [kernel], {
+    input: JSON.stringify({ prompt }),
+    encoding: 'utf8',
+    cwd: ROOT,
+    env: { ...process.env }
+  });
+}
+
+const prompt = 'Fix a bug in an API endpoint and add a unit test.';
+const first = route(prompt);
+const second = route(prompt);
+assert.strictEqual(first.status, 0, first.stderr);
+assert.strictEqual(second.status, 0, second.stderr);
+assert.strictEqual(first.stdout, second.stdout, 'identical routing input must produce identical output');
+assert.match(first.stdout, /RECOMMENDED TIER:\s*Tier 2/i);
+assert.match(first.stdout, /REQUIRED HARNESS INVARIANTS/);
+assert.match(first.stdout, /SUGGESTED SKILLS \(ADVISORY/);
+assert.doesNotMatch(first.stdout, /BASE EXECUTION LOOP/);
+assert.match(first.stdout, /Do not enforce workflow order/);
+
+const trivial = route('Update one README typo');
+assert.strictEqual(trivial.status, 0, trivial.stderr);
+assert.match(trivial.stdout, /RECOMMENDED TIER:\s*Tier 1/i);
+assert.match(trivial.stdout, /No mandatory domain skill/);
+
+const unmatched = route('frobnicate the quux');
+assert.strictEqual(unmatched.status, 0, unmatched.stderr);
+assert.match(unmatched.stdout, /RECOMMENDED TIER:\s*Unclassified/i);
+assert.match(unmatched.stdout, /"tier":"unclassified"/i);
+assert.doesNotMatch(unmatched.stdout, /RECOMMENDED TIER:\s*Tier 1/i);
+
+console.log(`OpenAI plugin package verified: ${skillNames.length} skills, publication metadata, hooks, marketplace, deterministic routing.`);

package/ci/openai-plugin-runtime.test.js

@@ -0,0 +1,175 @@
+'use strict';
+
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+const PLUGIN = path.join(ROOT, 'plugins', 'harness-everything');
+const HOOKS_FILE = path.join(PLUGIN, 'hooks', 'hooks.json');
+const hooks = JSON.parse(fs.readFileSync(HOOKS_FILE, 'utf8')).hooks;
+
+const EXPECTED_EVENTS = [
+  'SessionStart',
+  'UserPromptSubmit',
+  'PreToolUse',
+  'PostToolUse',
+  'SubagentStart',
+  'SubagentStop',
+  'Stop'
+];
+
+for (const event of EXPECTED_EVENTS) {
+  assert.ok(Array.isArray(hooks[event]) && hooks[event].length > 0, `${event} hook missing`);
+}
+
+const hookText = JSON.stringify(hooks);
+assert.match(hookText, /PLUGIN_ROOT/, 'OpenAI hooks must resolve from PLUGIN_ROOT');
+assert.match(hookText, /commandWindows/, 'OpenAI hooks need Windows command overrides');
+
+const commandPaths = [];
+for (const entries of Object.values(hooks)) {
+  for (const entry of entries) {
+    for (const command of entry.hooks || []) {
+      assert.strictEqual(command.type, 'command');
+      assert.ok(command.commandWindows, 'every packaged command hook needs a Windows override');
+      const match = command.command.match(/\$PLUGIN_ROOT\/([^"']+)/);
+      if (match) commandPaths.push(path.join(PLUGIN, match[1]));
+    }
+  }
+}
+for (const commandPath of commandPaths) {
+  assert.ok(fs.existsSync(commandPath), `packaged hook command is missing: ${path.relative(PLUGIN, commandPath)}`);
+}
+
+function filesUnder(root, out = []) {
+  for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
+    const full = path.join(root, entry.name);
+    if (entry.isDirectory()) filesUnder(full, out);
+    else if (entry.isFile()) out.push(full);
+  }
+  return out;
+}
+
+for (const file of filesUnder(path.join(PLUGIN, 'hooks')).filter(file => file.endsWith('.js'))) {
+  const syntax = spawnSync(process.execPath, ['--check', file], { encoding: 'utf8' });
+  assert.strictEqual(syntax.status, 0, `${path.relative(PLUGIN, file)} does not parse: ${syntax.stderr}`);
+}
+assert.ok(fs.existsSync(path.join(PLUGIN, 'scripts', 'lib', 'advisory-text.js')));
+const packagedState = fs.readFileSync(path.join(PLUGIN, 'hooks', 'scripts', 'lib', 'harness-state.js'), 'utf8');
+assert.doesNotMatch(packagedState, /\.\.\/\.\.\/\.\.\/scripts[\\/]lib[\\/]workspace/);
+
+function runHook(relative, payload, stateHome) {
+  return spawnSync(process.execPath, [path.join(PLUGIN, relative)], {
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    cwd: ROOT,
+    env: { ...process.env, HARNESS_STATE_HOME: stateHome }
+  });
+}
+
+const fixture = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-openai-runtime-'));
+const stateHome = path.join(fixture, 'state-home');
+const gitInit = spawnSync('git', ['init', '--quiet'], { cwd: fixture, encoding: 'utf8' });
+assert.strictEqual(gitInit.status, 0, gitInit.stderr);
+const sessionPayload = {
+  hook_event_name: 'SessionStart',
+  session_id: 'openai-runtime-test',
+  cwd: fixture,
+  source: 'startup'
+};
+
+const session = runHook('hooks/session-start.js', sessionPayload, stateHome);
+assert.strictEqual(session.status, 0, session.stderr);
+const sessionOutput = JSON.parse(session.stdout);
+assert.strictEqual(sessionOutput.hookSpecificOutput.hookEventName, 'SessionStart');
+assert.match(sessionOutput.hookSpecificOutput.additionalContext, /Route before execution/);
+assert.match(sessionOutput.hookSpecificOutput.additionalContext, /Verify before claim/);
+
+const persist = runHook('hooks/scripts/state-persist.js', {
+  hook_event_name: 'PostToolUse',
+  session_id: 'openai-runtime-test',
+  cwd: fixture,
+  tool_name: 'apply_patch',
+  tool_input: { command: '*** Begin Patch\n*** Update File: src/example.js\n*** End Patch' },
+  tool_response: { exitCode: 0, stdout: '', stderr: '' }
+}, stateHome);
+assert.strictEqual(persist.status, 0, persist.stderr);
+
+function findFile(root, filename) {
+  if (!fs.existsSync(root)) return null;
+  for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
+    const full = path.join(root, entry.name);
+    if (entry.isDirectory()) {
+      const found = findFile(full, filename);
+      if (found) return found;
+    } else if (entry.isFile() && entry.name === filename) {
+      return full;
+    }
+  }
+  return null;
+}
+
+const handoff = findFile(stateHome, 'handoff-state.json');
+assert.ok(handoff, 'SessionStart/state-persist should create a handoff state file');
+assert.ok(JSON.parse(fs.readFileSync(handoff, 'utf8')).lastEditAt, 'apply_patch must count as an edit');
+
+const sessionDir = path.dirname(handoff);
+fs.writeFileSync(path.join(sessionDir, 'rule-of-3-state.json'), JSON.stringify({
+  count: 3,
+  threshold: 3,
+  lastHash: 'runtime-test-failure',
+  lastFailureAt: 0
+}), 'utf8');
+const reportFile = path.join(sessionDir, 'zoom-out-report.md');
+const reportWrite = runHook('hooks/scripts/rule-of-3.js', {
+  hook_event_name: 'PreToolUse',
+  session_id: 'openai-runtime-test',
+  cwd: fixture,
+  tool_name: 'apply_patch',
+  tool_input: { patch: `*** Add File: ${reportFile}\n## Goal` }
+}, stateHome);
+assert.strictEqual(reportWrite.status, 0, 'apply_patch must be allowed to write the zoom-out report');
+
+const mixedPatch = runHook('hooks/scripts/rule-of-3.js', {
+  hook_event_name: 'PreToolUse',
+  session_id: 'openai-runtime-test',
+  cwd: fixture,
+  tool_name: 'apply_patch',
+  tool_input: { patch: `*** Update File: ${reportFile}\n@@\n*** Update File: unrelated.txt\n@@` }
+}, stateHome);
+assert.strictEqual(mixedPatch.status, 2, 'report exemption must not allow a mixed apply_patch');
+
+const blockedPatch = runHook('hooks/scripts/rule-of-3.js', {
+  hook_event_name: 'PreToolUse',
+  session_id: 'openai-runtime-test',
+  cwd: fixture,
+  tool_name: 'apply_patch',
+  tool_input: { patch: '*** Update File: unrelated.txt\n@@' }
+}, stateHome);
+assert.strictEqual(blockedPatch.status, 2, 'tripped circuit breaker must block unrelated apply_patch writes');
+
+const subagentStart = runHook('hooks/scripts/subagent-start.js', {
+  hook_event_name: 'SubagentStart',
+  session_id: 'openai-runtime-test',
+  cwd: fixture,
+  agent_type: 'worker'
+}, stateHome);
+assert.strictEqual(subagentStart.status, 0, subagentStart.stderr);
+const subagentOutput = JSON.parse(subagentStart.stdout);
+assert.strictEqual(subagentOutput.hookSpecificOutput.hookEventName, 'SubagentStart');
+assert.match(subagentOutput.hookSpecificOutput.additionalContext, /scope/i);
+
+fs.writeFileSync(path.join(fixture, 'unplanned-change.txt'), 'scope regression\n', 'utf8');
+const subagentStop = runHook('hooks/scripts/subagent-stop.js', {
+  hook_event_name: 'SubagentStop',
+  session_id: 'openai-runtime-test',
+  cwd: fixture,
+  agent_type: 'worker'
+}, stateHome);
+assert.strictEqual(subagentStop.status, 2, subagentStop.stderr);
+assert.match(subagentStop.stderr, /Subagent Scope Guard/);
+
+console.log('OpenAI plugin runtime compatibility verified.');