harness-everything 0.3.6 → 0.4.1

package/.agents/plugins/marketplace.json

@@ -0,0 +1,20 @@
+{
+  "name": "harness-everything",
+  "interface": {
+    "displayName": "Harness Everything"
+  },
+  "plugins": [
+    {
+      "name": "harness-everything",
+      "source": {
+        "source": "local",
+        "path": "./plugins/harness-everything"
+      },
+      "policy": {
+        "installation": "AVAILABLE",
+        "authentication": "ON_INSTALL"
+      },
+      "category": "Developer Tools"
+    }
+  ]
+}

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.3.6",
+      "version": "0.4.1",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,16 +1,13 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.3.6",
+  "version": "0.4.1",
   "author": {
     "name": "Miya Daniel"
   },
   "license": "Apache-2.0",
   "homepage": "https://github.com/dyphn1/Harness-everything#readme",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/dyphn1/Harness-everything.git"
-  },
+  "repository": "https://github.com/dyphn1/Harness-everything",
   "keywords": [
     "agent-harness",
     "orchestration",
@@ -18,8 +15,12 @@
     "tdd",
     "verification"
   ],
-  "hooks": "./hooks/hooks.json",
-  "agents": "./fable-mode/agents",
+  "agents": [
+    "./fable-mode/agents/fable-orchestrator.md",
+    "./fable-mode/agents/fable-verifier.md",
+    "./fable-mode/agents/fable-worker-haiku.md",
+    "./fable-mode/agents/fable-worker-sonnet.md"
+  ],
   "skills": [
     "./multi-agent-workspace",
     "./environment-detection",

package/.github/workflows/behavioral-evals.yml

@@ -9,10 +9,10 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
-          node-version: 20
+          node-version: 24
       - name: Validate eval case structure (free)
         run: node behavioral-evals/run.js validate
       - name: Install Harness for eval

package/.github/workflows/ci.yml

@@ -4,39 +4,61 @@ on:
   push:
     branches: [main]
   pull_request:
+  # release.yml calls this workflow so a tag push is gated by exactly the same
+  # jobs as a pull request - including installer-e2e and the full OS matrix.
+  workflow_call:
 
 jobs:
   self-regression:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest]
+        os: [ubuntu-latest, windows-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
         with:
-          node-version: 20
+          fetch-depth: 0
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
       - name: Install dependencies for regression suite
         run: npm ci
       - name: Run hermetic self-regression suite
         run: npm test
+      - name: Run focused mutation checks
+        run: npm run test:mutations
+
+  runtime-floor:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+      - name: Install dependencies on minimum supported Node
+        run: npm ci
+      - name: Run representative regression suite on Node 22
+        run: npm test
+      - name: Verify installer contract on Node 22
+        run: node ci/installer-roundtrip.test.js
 
   skill-quality:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Install waza CLI
         run: curl -fsSL https://raw.githubusercontent.com/microsoft/waza/main/install.sh | bash
-      - name: Check every SKILL.md passes waza readiness gates
+      - name: Check every canonical SKILL.md passes waza readiness gates
         run: |
           fail=0
-          for dir in $(find . -name "SKILL.md" -not -path "./node_modules/*" -not -path "./.git/*" -not -path "./ci/fixtures/*" -not -path "./eval-framework/fixtures/*" -exec dirname {} \; | sort); do
+          for dir in $(find . -name "SKILL.md" -not -path "./node_modules/*" -not -path "./.git/*" -not -path "./plugins/*" -not -path "./ci/fixtures/*" -not -path "./eval-framework/fixtures/*" -exec dirname {} \; | sort); do
             out=$(waza check "$dir" 2>&1) || true
             echo "=== $dir"
-            # Hard gates: spec compliance, token budget, trigger sections.
             if echo "$out" | grep -q "Does not fully meet"; then
               echo "::error file=$dir/SKILL.md::waza spec compliance failed"
               fail=1
@@ -64,22 +86,22 @@ jobs:
             waza spec verify "$skill" "$eval" --fail --threshold 1 || fail=1
           done
           exit $fail
-      - name: Block SKILL.md token growth vs base branch
+      - name: Block canonical SKILL.md token growth vs base branch
         run: waza tokens compare "${{ github.event.pull_request.base.ref || 'HEAD' }}" --strict --threshold 10 --skills
 
   consistency:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest]
+        os: [ubuntu-latest, windows-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
-          node-version: 20
+          node-version: 24
       - name: Install Node dependencies
         run: npm ci
       - name: Docs, manifest, and eval-coverage consistency
@@ -90,28 +112,27 @@ jobs:
         run: npm run test:release
       - name: Skill description collision detection
         run: npm run test:collision
+      - name: OpenAI plugin package is in sync and runnable
+        run: npm run test:plugin:openai
+      - name: OpenAI public submission artifacts are reproducible
+        run: npm run test:plugin:submission
+      - name: Platform compatibility matrix matches official-source and installer contracts
+        run: npm run test:platform:compatibility
 
   installer-e2e:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest]
+        os: [ubuntu-latest, windows-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
         with:
-          node-version: 20
+          fetch-depth: 0
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
       - name: CLI --help works
         run: node bin/cli.js --help
-      - name: Install into fresh temp directory
-        shell: bash
-        run: |
-          TMPDIR=$(mktemp -d)
-          cd "$TMPDIR"
-          git init
-          node "$GITHUB_WORKSPACE/bin/cli.js" install --all -y
-          node "$GITHUB_WORKSPACE/bin/cli.js" verify-install
-          # Verify at least one platform file was created
-          ls -la .claude/settings.json .cursorrules .github/copilot-instructions.md 2>/dev/null || true
-          echo "✅ Installer e2e passed"
+      - name: Install, verify, uninstall, and restore seeded user files
+        run: node ci/installer-roundtrip.test.js

package/.github/workflows/release.yml

@@ -2,44 +2,69 @@ name: Release
 
 on:
   push:
-    tags:
-      - '*'
+    branches: [main]
+  workflow_dispatch:
+
+# A release owns the version/tag transaction. Never cancel one release halfway
+# through because a newer main push arrived; the next queued run will analyze
+# from the tag produced by the first one.
+concurrency:
+  group: release-main
+  cancel-in-progress: false
 
 permissions:
-  contents: read
+  contents: write
+  issues: write
+  pull-requests: write
   id-token: write
 
 jobs:
+  # Release publication is gated by exactly the same test matrix as a PR.
   gate:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-      - name: Install dependencies for release checks
-        run: npm ci
-      - name: Self-regression suite
-        run: npm test
-      - name: Mechanism checks
-        run: npm run test:mechanism
-      - name: Consistency check
-        run: npm run test:consistency
-      - name: Description collision detection
-        run: npm run test:collision
-
-  publish:
+    uses: ./.github/workflows/ci.yml
+
+  release:
     needs: gate
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - name: Checkout full release history
+        uses: actions/checkout@v7
         with:
-          node-version: 20
+          fetch-depth: 0
+
+      # Release tooling uses the repository's primary Node runtime.
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: npm
           registry-url: https://registry.npmjs.org
-      - name: Install dependencies for publishing
+
+      - name: Install project dependencies
         run: npm ci
-      - name: Publish to npm
-        run: npm publish --provenance --access public
+
+      # Keep release tooling out of the product dependency graph/package-lock.
+      # Versions are pinned so release behavior cannot float between runs.
+      # release-notes-generator 14 uses conventional-changelog-writer 8;
+      # conventionalcommits 10 requires writer 9+, so keep the preset on 9.x
+      # until the stable release-notes-generator line upgrades its writer.
+      - name: Install pinned release tooling
+        run: >-
+          npm install --no-save --package-lock=false --ignore-scripts
+          semantic-release@25.0.9
+          @semantic-release/changelog@7.0.0
+          @semantic-release/commit-analyzer@13.0.1
+          @semantic-release/exec@7.1.0
+          @semantic-release/git@11.0.1
+          @semantic-release/github@12.0.9
+          @semantic-release/npm@13.1.5
+          @semantic-release/release-notes-generator@14.1.1
+          conventional-changelog-conventionalcommits@9.3.1
+
+      - name: Calculate, prepare, and publish release
         env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: "true"
+        run: npx --no-install semantic-release

package/.nvmrc

@@ -0,0 +1 @@
+24

package/.releaserc.json

@@ -0,0 +1,113 @@
+{
+  "branches": [
+    "main"
+  ],
+  "tagFormat": "v${version}",
+  "plugins": [
+    [
+      "@semantic-release/commit-analyzer",
+      {
+        "preset": "conventionalcommits",
+        "presetConfig": {},
+        "releaseRules": [
+          {
+            "breaking": true,
+            "release": "major"
+          },
+          {
+            "type": "feat",
+            "release": "minor"
+          },
+          {
+            "type": "fix",
+            "release": "patch"
+          },
+          {
+            "type": "perf",
+            "release": "patch"
+          },
+          {
+            "type": "refactor",
+            "release": "patch"
+          },
+          {
+            "type": "build",
+            "release": "patch"
+          },
+          {
+            "type": "revert",
+            "release": "patch"
+          }
+        ],
+        "parserOpts": {
+          "noteKeywords": [
+            "BREAKING CHANGE",
+            "BREAKING CHANGES"
+          ]
+        }
+      }
+    ],
+    [
+      "@semantic-release/release-notes-generator",
+      {
+        "preset": "conventionalcommits",
+        "presetConfig": {},
+        "parserOpts": {
+          "noteKeywords": [
+            "BREAKING CHANGE",
+            "BREAKING CHANGES"
+          ]
+        }
+      }
+    ],
+    [
+      "@semantic-release/exec",
+      {
+        "verifyReleaseCmd": "node scripts/sync-release-version.js --validate ${nextRelease.version}",
+        "prepareCmd": "node scripts/sync-release-version.js ${nextRelease.version} --base ${lastRelease.gitTag} && npm run plugin:sync && node scripts/sync-release-version.js --check ${nextRelease.version} --base ${lastRelease.gitTag} && npm run test:consistency && npm run test:plugin:openai && npm run test:plugin:submission"
+      }
+    ],
+    [
+      "@semantic-release/changelog",
+      {
+        "changelogFile": "CHANGELOG.md",
+        "changelogTitle": "# Changelog\n\nAll notable changes to this project are documented in this file."
+      }
+    ],
+    [
+      "@semantic-release/npm",
+      {
+        "npmPublish": true
+      }
+    ],
+    [
+      "@semantic-release/git",
+      {
+        "assets": [
+          "CHANGELOG.md",
+          "package.json",
+          "package-lock.json",
+          ".claude-plugin/plugin.json",
+          ".claude-plugin/marketplace.json",
+          "*/SKILL.md",
+          "*/**/SKILL.md",
+          "plugins/harness-everything/plugin.json",
+          "plugins/harness-everything/.codex-plugin/plugin.json",
+          "plugins/harness-everything/skills",
+          "plugins/harness-everything/hooks",
+          "opencode-plugin/plugin.json"
+        ],
+        "message": "chore(release): ${nextRelease.version} [skip ci]"
+      }
+    ],
+    [
+      "@semantic-release/github",
+      {
+        "successComment": false,
+        "failTitle": false,
+        "labels": false,
+        "releasedLabels": false
+      }
+    ]
+  ]
+}

package/AGENTS.md

@@ -4,57 +4,77 @@ description: Operating guide for AI agents working inside the Harness-everything
 
 # AGENTS.md — Working in This Repository
 
-You are modifying **Harness**: an orchestrated agent operating system (skills + hooks + routing) for AI coding agents. Changes here ship to real agent sessions; a vague SKILL.md or a stale manifest misroutes other people's agents. Precision is the product.
+You are modifying **Harness**: an orchestrated agent operating system (skills + hooks/plugins + routing) for AI coding agents. Changes here ship to real agent sessions; a vague `SKILL.md`, stale manifest, or contradictory platform claim can misroute other people's agents. Precision is the product.
 
 ## Repository Layout
 
 | Path | What it is |
 |---|---|
-| `<skill-name>/SKILL.md` | One skill per top-level directory. Frontmatter: `name`, `description`, `metadata.author`, `metadata.version`. |
-| `hooks/` | Lifecycle hook scripts (circuit breaker, scope guard, stop gate). Hard enforcement, Claude Code only. |
-| `harness-everything/scripts/` | Runtime: tier router, todo state machine, verify gate, bootstrap. |
-| `evals/<skill>/` | Trigger/routing eval per skill (waza format). Required for every skill — no exceptions. |
-| `behavioral-evals/` | LLM-behavior cases run via headless CLI sessions. On-demand only; costs tokens; never CI. |
+| `<skill-name>/SKILL.md` | One canonical skill per top-level directory. Frontmatter: `name`, `description`, `metadata.author`, `metadata.version`. |
+| `hooks/` | Claude Code lifecycle hook scripts and shared mechanisms such as circuit breaker, scope guard, and stop gate. Do not infer that every host packages every hook. |
+| `harness-everything/scripts/` | Runtime: kernel/tier routing, verification, bootstrap, self-heal. |
+| `opencode-plugin/` | OpenCode native plugin implementation. Mechanism-tested; live plugin loading remains unverified until real host evidence exists. |
+| `.agents/plugins/` + `plugins/harness-everything/` | Local OpenAI/Codex marketplace + `.codex-plugin` package with canonical skill copies and packaged session/prompt hooks. |
+| `submission/openai/` | Public OpenAI Skills-only listing/test inputs. The public artifact does not include local `.codex-plugin` lifecycle hooks. |
+| `evals/<skill>/` | Trigger/routing eval per skill (waza format). Required for every canonical routed skill. |
+| `behavioral-evals/` | LLM-behavior cases run via headless CLI sessions. They can be run on demand and are also structurally validated by the weekly `behavioral-evals.yml` workflow; live cases run there only when the Claude CLI is available. |
 | `benchmarks/` | BENCHMARK_SOP fixtures and recorded results. Evidence lives here or nowhere. |
-| `.claude-plugin/` | Plugin distribution manifests. Must list exactly the on-disk skills. |
-| `docs/`, `references/` | Philosophy, architecture, shared checklists. |
+| `.claude-plugin/` | Claude Code plugin distribution manifests. Must list exactly the on-disk canonical skills. |
+| `docs/platform-capabilities.md` | Canonical current platform/install/enforcement/evidence matrix. |
+| `docs/repository-contract.md` | Generated current-state Node/workflow/action/gate contract. Regenerate with `npm run docs:sync`; do not hand-edit. |
+| `.nvmrc` | Primary development/CI Node runtime. `package.json#engines.node` remains the minimum supported runtime. |
+| `docs/`, `references/` | Philosophy, architecture, workflow documentation, shared checklists. |
 
 ## Non-Negotiable Change Rules
 
-1. **Every SKILL.md keeps ≤ 500 tokens** (hard CI gate) and must contain `## USE FOR:` and `## DO NOT USE FOR:` sections. Deep detail goes in the skill's `references/` or `guides/`.
+1. **Every canonical SKILL.md keeps ≤ 500 tokens** (hard CI gate) and must contain `## USE FOR:` and `## DO NOT USE FOR:` sections. Deep detail goes in the skill's `references/` or `guides/`.
 2. **Descriptions are routing surfaces.** Two skills whose descriptions overlap enough that a router cannot distinguish them will fail `test:collision`. When adding a skill, differentiate its description from near neighbors deliberately.
-3. **A new skill ships with a routing eval** (`evals/<skill>/eval.yaml` + positive/negative tasks). The positive task's `description:` field must carry the skill's exact frontmatter description — waza's deterministic matcher requires it verbatim.
-4. **Version policy:** skill frontmatter versions move in lockstep with releases. Skills modified after a release get bumped to that next version; nothing may exceed the package version's numeric base (`package.json`). Nested sub-skills (`<skill>/<sub>/SKILL.md`) are not routed independently — they inherit the parent skill's version and must always match it. The consistency check enforces both rules.
-5. **Manifests are generated facts, not opinions:** if you add/remove/rename a skill directory, update `.claude-plugin/plugin.json` (and marketplace entry version) in the same change. `npm run test:consistency` fails otherwise.
-6. **CHANGELOG.md is append-only history.** Every user-visible change gets an entry under the current `-beta` heading before merge.
+3. **A new canonical skill ships with a routing eval** (`evals/<skill>/eval.yaml` + positive/negative tasks). The positive task's `description:` field must carry the skill's exact frontmatter description — waza's deterministic matcher requires it verbatim.
+4. **Release version policy:** normal PRs do not manually bump package/plugin versions. `semantic-release` determines the next stable SemVer from Conventional Commits on `main`, and `scripts/sync-release-version.js` owns distribution-version synchronization. Skill frontmatter versions remain release metadata and must never exceed the package version's numeric base. Nested sub-skills (`<skill>/<sub>/SKILL.md`) inherit the parent skill's version and must always match it.
+5. **Distribution manifests are generated facts, not opinions:** if you add/remove/rename a canonical skill, update/sync every distribution that copies or lists it. Run `npm run plugin:sync`, `npm run test:consistency`, and `npm run test:plugin:openai` rather than updating only `.claude-plugin/plugin.json`.
+6. **Platform capability claims are tested contracts.** If host integration behavior changes, update `docs/platform-capabilities.md` and every affected current-state surface in the same change. Never turn package/mechanism evidence into a live-host claim, and never describe public Skills-only behavior as if it includes local lifecycle hooks.
+7. **Runtime/workflow claims are generated facts.** `package.json`, `.nvmrc`, `Dockerfile`, and active `.github/workflows/*.yml` are parsed by `scripts/repository-contract.js`. After changing them, run `npm run docs:sync`; `test:repo-contract` rejects stale generated docs, unsupported action majors, Node runtimes below the support floor, or loss of the Node 22 compatibility lane.
+8. **CHANGELOG.md keeps pending human-authored notes under `[Unreleased]`.** Do not create new alpha/beta/rc release headings; semantic-release owns stable release headings, tags, and release notes.
+9. **Conventional Commit type is release input.** The final commit/squash title that lands on `main` must follow the convention. Breaking changes release major; `feat` releases minor; `fix`, `perf`, `refactor`, `build`, and `revert` release patch; `docs`, `test`, `ci`, `style`, and `chore` do not release by themselves.
 
 ## Verification Before You Claim Done
 
-Run the full local gate — all of these mirror CI:
+Run the local gates that cover the same contract categories as CI:
 
 ```bash
-npm test                    # self-regression: syntax, routing tiers, mechanism checks
-npm run test:mechanism      # hook-level mechanism suite alone
-npm run test:consistency    # manifests, versions, trigger sections, dead links, eval coverage
-npm run test:collision      # description collision detection
-npm run test:routing:skills # every positive skill route reaches its target
+npm test                         # self-regression: syntax, routing, mechanisms
+npm run test:mutations           # focused mutation checks
+npm run test:mechanism           # mechanism suites alone
+npm run test:consistency         # manifests, versions, docs links, eval coverage + repository contract
+npm run test:repo-contract       # runtime/workflow/action/schedule drift gate
+npm run test:docs:capabilities   # platform documentation drift gate
+npm run test:references          # executable/deep-dive references
+npm run test:release             # release catalog + semantic-release/version-sync contract
+npm run test:collision           # description collision detection
+npm run test:routing:skills      # every positive skill route reaches its target
+npm run test:plugin:openai       # local OpenAI/Codex plugin package
+npm run test:plugin:submission   # public Skills-only submission inputs/bundle parity
+npm run test:platform:compatibility
 ```
 
 If waza is installed (`~/bin/waza`), also run what CI runs:
 
 ```bash
-waza check <skill-dir>                                  # readiness gates per skill
+waza check <skill-dir>
 waza spec verify <skill> evals/<skill>/eval.yaml --fail --threshold 1
-waza tokens check                                       # token budgets
+waza tokens check
 ```
 
-Do not report "it works" from reading code. Every check above names a command; run it and paste nothing less than its exit code.
+Node.js 24 is the primary CI runtime across Ubuntu, Windows, and macOS. A separate Ubuntu Node.js 22 lane protects the advertised minimum runtime. See [docs/repository-contract.md](docs/repository-contract.md) for the generated current state.
+
+Do not report "it works" from reading code. Record which evidence layer you actually proved: package, deterministic mechanism, live host, or behavior.
 
 ## Behavioral & Benchmark Evidence
 
-Mechanism tests prove hooks fire; they cannot prove agents behave differently. For that:
+Deterministic mechanism tests prove the tested hook/plugin contract; they do **not** prove a real host loaded it or that agents behave differently. For behavior:
 
 - `node behavioral-evals/run.js run --engine opencode` (or `--engine claude`) — on-demand, token-costing.
+- The weekly `behavioral-evals.yml` workflow always validates case structure and runs live cases only when its runner has the Claude CLI.
 - `node benchmarks/run.js scaffold <scenario>` → run both variants → `record` with evidence logs.
 
-Results are committed. A benchmark run without a recorded result is indistinguishable from one that never happened.
+For a live-host enforcement claim, preserve a host/session artifact showing the mechanism was actually loaded and fired. Results are committed where the relevant evidence workflow requires it. A benchmark run without a recorded result is indistinguishable from one that never happened.