harness-everything 0.3.6 → 0.4.1

package/ci/mechanism-2u-issue-44.test.js

@@ -0,0 +1,35 @@
+const fs = require('fs');
+const path = require('path');
+const helper = require('./test-helper');
+
+console.log('\n[2u] Issue #44 release metadata regression checks...');
+
+const packageJson = JSON.parse(fs.readFileSync(path.join(helper.root, 'package.json'), 'utf8'));
+const skillText = name => fs.readFileSync(path.join(helper.root, name, 'SKILL.md'), 'utf8');
+const versionOf = text => {
+  const match = text.match(/^  version:\s*(\S+)$/m);
+  return match && match[1];
+};
+
+helper.check(
+  '2u. modified fable-mode skill uses the released package version',
+  versionOf(skillText('fable-mode')) === packageJson.version,
+  `fable-mode=${versionOf(skillText('fable-mode'))}, package=${packageJson.version}`
+);
+for (const nested of ['execution-guardrails', 'fable-haiku', 'fable-opus', 'fable-sonnet']) {
+  helper.check(
+    `2u. fable-mode/${nested} inherits the parent version`,
+    versionOf(skillText(path.join('fable-mode', nested))) === versionOf(skillText('fable-mode')),
+    `${nested}=${versionOf(skillText(path.join('fable-mode', nested)))}, parent=${versionOf(skillText('fable-mode'))}`
+  );
+}
+helper.check(
+  '2u. modified todo-driven-workflow skill uses the released package version',
+  versionOf(skillText('todo-driven-workflow')) === packageJson.version,
+  `todo-driven-workflow=${versionOf(skillText('todo-driven-workflow'))}, package=${packageJson.version}`
+);
+
+const changelog = fs.readFileSync(path.join(helper.root, 'CHANGELOG.md'), 'utf8');
+helper.check('2u. changelog records the Issue #44 disclosure policy', /#44/.test(changelog), 'CHANGELOG.md has no #44 entry');
+
+helper.finish();

package/ci/mechanism-2v-verifier-boundaries.test.js

@@ -0,0 +1,138 @@
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const helper = require('./test-helper');
+
+const { assertContainedPath } = require('../scripts/lib/path-boundary');
+const {
+  commandMatches,
+  commandsEqual,
+  extractPatchPaths,
+  patchPathsAuthorized,
+} = require('../scripts/lib/execution-contract');
+
+console.log('\n[2v] Verifier boundary contracts...');
+
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-2v-root-'));
+const outside = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-2v-outside-'));
+
+try {
+  const workspace = path.join(root, 'workspace');
+  const nested = path.join(workspace, 'nested');
+  const outsideFile = path.join(outside, 'outside.txt');
+  fs.mkdirSync(nested, { recursive: true });
+  fs.writeFileSync(outsideFile, 'outside\n');
+
+  helper.check(
+    '2v. a normal nested path is inside its physical boundary',
+    assertContainedPath(workspace, path.join(nested, 'new.txt')).target.endsWith(path.join('nested', 'new.txt'))
+  );
+
+  helper.check(
+    '2v. lexical parent traversal is rejected',
+    (() => {
+      try {
+        assertContainedPath(workspace, path.join(workspace, '..', 'escape.txt'));
+        return false;
+      } catch (error) {
+        return error.code === 'PATH_OUTSIDE_BOUNDARY';
+      }
+    })()
+  );
+
+  const link = path.join(workspace, 'linked');
+  fs.symlinkSync(outside, link, process.platform === 'win32' ? 'junction' : 'dir');
+  helper.check(
+    '2v. a junction/symlink inside the boundary cannot escape it',
+    (() => {
+      try {
+        assertContainedPath(workspace, path.join(link, 'new.txt'));
+        return false;
+      } catch (error) {
+        return error.code === 'LINK_COMPONENT_IN_BOUNDARY';
+      }
+    })()
+  );
+
+  helper.check(
+    '2v. a missing leaf reached through a link is rejected before writing',
+    (() => {
+      try {
+        assertContainedPath(workspace, path.join(link, 'missing', 'new.txt'));
+        return false;
+      } catch (error) {
+        return error.code === 'LINK_COMPONENT_IN_BOUNDARY';
+      }
+    })()
+  );
+
+  const linkedInsideTarget = path.join(workspace, 'real-inside');
+  const linkedInside = path.join(workspace, 'linked-inside');
+  fs.mkdirSync(linkedInsideTarget, { recursive: true });
+  fs.symlinkSync(linkedInsideTarget, linkedInside, process.platform === 'win32' ? 'junction' : 'dir');
+  helper.check(
+    '2v. a link component is rejected even when its target stays inside the boundary',
+    (() => {
+      try {
+        assertContainedPath(workspace, path.join(linkedInside, 'new.txt'));
+        return false;
+      } catch (error) {
+        return error.code === 'LINK_COMPONENT_IN_BOUNDARY';
+      }
+    })()
+  );
+
+  const upperCaseWorkspace = workspace.toUpperCase();
+  helper.check(
+    '2v. Windows path casing does not change containment',
+    process.platform !== 'win32' || assertContainedPath(upperCaseWorkspace, path.join(workspace, 'nested', 'case.txt')).target
+  );
+
+  helper.check('2v. exact commands match after harmless whitespace normalization', commandsEqual(' npm   test ', 'npm test'));
+  helper.check('2v. invalid boundary arguments use a stable error code', (() => {
+    try {
+      assertContainedPath(null, workspace);
+      return false;
+    } catch (error) {
+      return error.code === 'INVALID_BOUNDARY_PATH';
+    }
+  })());
+  helper.check('2v. a command containing the expected text is not an exact match', !commandsEqual('echo /tmp/preflight.js', 'preflight.js'));
+  helper.check('2v. extra command arguments are not silently accepted', !commandsEqual('npm test --coverage', 'npm test'));
+  helper.check('2v. argv commands compare each argument exactly', commandsEqual(['node', 'ci/test.js'], ['node', 'ci/test.js']) && !commandsEqual(['node', 'ci/test.js', '--verbose'], ['node', 'ci/test.js']));
+  helper.check('2v. a real node script invocation can use a basename expectation', commandMatches('node C:\\temp\\preflight.js', 'preflight.js'));
+  helper.check('2v. a non-launcher mention cannot satisfy a script expectation', !commandMatches('echo C:\\temp\\preflight.js', 'preflight.js'));
+
+  const patch = [
+    '*** Begin Patch',
+    '*** Update File: behavioral-evals/run.js',
+    '@@',
+    '*** Update File: ci/mechanism-2v-verifier-boundaries.test.js',
+    '@@',
+    '*** End Patch',
+  ].join('\n');
+  helper.check(
+    '2v. patch parser returns every touched path',
+    JSON.stringify(extractPatchPaths(patch)) === JSON.stringify([
+      'behavioral-evals/run.js',
+      'ci/mechanism-2v-verifier-boundaries.test.js',
+    ])
+  );
+  helper.check(
+    '2v. a multi-file patch is authorized only when every path is allowed',
+    patchPathsAuthorized(patch, new Set(['behavioral-evals/run.js', 'ci/mechanism-2v-verifier-boundaries.test.js']))
+  );
+  helper.check(
+    '2v. one unrelated path rejects the whole patch',
+    !patchPathsAuthorized(patch, new Set(['behavioral-evals/run.js']))
+  );
+  helper.check(
+    '2v. traversal paths are never authorized even when allowlisted',
+    !patchPathsAuthorized('*** Update File: ../escape.js\n', new Set(['../escape.js']))
+  );
+} finally {
+  fs.rmSync(root, { recursive: true, force: true });
+  fs.rmSync(outside, { recursive: true, force: true });
+}
+
+helper.finish();

package/ci/mechanism-2w-platform-compatibility.test.js

@@ -0,0 +1,148 @@
+'use strict';
+
+const assert = require('assert');
+const crypto = require('crypto');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '..');
+const matrix = JSON.parse(fs.readFileSync(path.join(ROOT, 'docs', 'platform-compatibility.json'), 'utf8'));
+const platforms = require('../hooks/scripts/lib/platforms');
+const manifest = require('../scripts/lib/manifest');
+const { build } = require('../scripts/build-openai-submission');
+
+const DIMENSIONS = [
+  'standaloneSkills',
+  'pluginSupport',
+  'bundledSkills',
+  'hooksLifecycle',
+  'projectScope',
+  'globalScope',
+  'installUninstallSymmetry',
+  'assetsReferences',
+  'updateSync',
+  'liveHostVerification'
+];
+const STATUSES = new Set(['Supported', 'Mechanism verified', 'Live verified', 'Partial', 'Unsupported', 'Unknown']);
+const OFFICIAL_HOSTS = {
+  codex: new Set(['learn.chatgpt.com']),
+  'chatgpt-openai-plugin': new Set(['help.openai.com', 'developers.openai.com']),
+  'claude-code': new Set(['code.claude.com']),
+  opencode: new Set(['opencode.ai']),
+  'github-copilot': new Set(['docs.github.com']),
+  cursor: new Set(['cursor.com', 'prod.cursor.com']),
+  continue: new Set(['docs.continue.dev']),
+  hermes: new Set(['hermes-agent.nousresearch.com'])
+};
+
+function filesUnder(root, base = root, out = []) {
+  for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
+    const full = path.join(root, entry.name);
+    if (entry.isDirectory()) filesUnder(full, base, out);
+    else if (entry.isFile()) out.push(path.relative(base, full).replace(/\\/g, '/'));
+  }
+  return out.sort();
+}
+
+function sha256(file) {
+  return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+}
+
+assert.strictEqual(matrix.format, 'harness-platform-compatibility-v1');
+assert.deepStrictEqual(Object.keys(matrix.status_vocabulary).sort(), [...STATUSES].sort());
+assert.deepStrictEqual(matrix.dimensions, DIMENSIONS);
+assert.strictEqual(matrix.platforms.length, 8, 'compatibility matrix must cover every issue #82 platform');
+assert.deepStrictEqual(
+  matrix.platforms.map(platform => platform.id).sort(),
+  Object.keys(OFFICIAL_HOSTS).sort()
+);
+
+for (const platform of matrix.platforms) {
+  assert.ok(Array.isArray(platform.official_sources) && platform.official_sources.length > 0, `${platform.id}: official source list missing`);
+  for (const source of platform.official_sources) {
+    const url = new URL(source);
+    assert.strictEqual(url.protocol, 'https:', `${platform.id}: source must use HTTPS`);
+    assert.ok(OFFICIAL_HOSTS[platform.id].has(url.hostname), `${platform.id}: source is not an approved official documentation host: ${source}`);
+  }
+  assert.deepStrictEqual(Object.keys(platform.capabilities).sort(), [...DIMENSIONS].sort(), `${platform.id}: dimension coverage drifted`);
+  for (const dimension of DIMENSIONS) {
+    const capability = platform.capabilities[dimension];
+    assert.ok(capability && STATUSES.has(capability.status), `${platform.id}/${dimension}: invalid status`);
+  }
+  assert.strictEqual(
+    platform.capabilities.liveHostVerification.status,
+    'Unknown',
+    `${platform.id}: a live status requires a preserved host artifact before publication`
+  );
+}
+
+const installerTargetSpecs = {
+  codex: { platform: 'codex', project: '.agents/skills', global: '~/.agents/skills' },
+  'claude-code': { platform: 'claude', project: '.claude/skills', global: '~/.claude/skills' },
+  cursor: { platform: 'cursor', project: '.cursor/skills', global: '~/.agents/skills' },
+  'github-copilot': { platform: 'copilot', project: '.github/skills', global: '~/.agents/skills' },
+  continue: { platform: 'continue', project: '.continue/skills', global: '~/.continue/skills' },
+  hermes: { platform: 'hermes', project: '.agents/skills', global: '~/.hermes/skills' }
+};
+assert.deepStrictEqual(Object.keys(matrix.installer_targets).sort(), Object.keys(OFFICIAL_HOSTS).sort());
+for (const [id, spec] of Object.entries(installerTargetSpecs)) {
+  const targetSpec = matrix.installer_targets[id];
+  assert.strictEqual(targetSpec.project, spec.project, `${id}: project installer target drifted`);
+  assert.strictEqual(targetSpec.global, spec.global, `${id}: global installer target drifted`);
+  assert.ok(STATUSES.has(targetSpec.host_discovery_status), `${id}: installer target status is invalid`);
+}
+
+const workspaceRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-2w-workspace-'));
+const userHome = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-2w-home-'));
+try {
+  for (const [id, spec] of Object.entries(installerTargetSpecs)) {
+    const adapter = platforms.find(platform => platform.name === spec.platform);
+    assert.ok(adapter, `${id}: installer adapter missing`);
+    const local = adapter.getSkillsTarget({ workspaceRoot, userHome, isGlobal: false, manifest });
+    const global = adapter.getSkillsTarget({ workspaceRoot, userHome, isGlobal: true, manifest });
+    const expectedLocal = path.join(workspaceRoot, ...spec.project.split('/'));
+    const expectedGlobal = path.join(userHome, ...spec.global.replace('~/', '').split('/'));
+    assert.strictEqual(path.resolve(local.path), path.resolve(expectedLocal), `${id}: local adapter target drifted`);
+    assert.strictEqual(path.resolve(global.path), path.resolve(expectedGlobal), `${id}: global adapter target drifted`);
+  }
+} finally {
+  fs.rmSync(workspaceRoot, { recursive: true, force: true });
+  fs.rmSync(userHome, { recursive: true, force: true });
+}
+
+const portableManifest = JSON.parse(fs.readFileSync(path.join(ROOT, 'plugins', 'harness-everything', 'plugin.json'), 'utf8'));
+const compatibilityManifest = JSON.parse(fs.readFileSync(path.join(ROOT, 'plugins', 'harness-everything', '.codex-plugin', 'plugin.json'), 'utf8'));
+assert.strictEqual(portableManifest.$schema, 'https://agent-plugins.org/schemas/1.0.0/plugin.schema.json');
+assert.strictEqual(portableManifest.extensions?.['com.openai']?.hooks, './hooks/hooks.json');
+assert.deepStrictEqual(portableManifest.extensions?.['com.openai']?.interface, compatibilityManifest.interface);
+assert.ok(fs.existsSync(path.join(ROOT, 'plugins', 'harness-everything', 'skills', 'harness-everything', 'SKILL.md')));
+
+const marketplace = JSON.parse(fs.readFileSync(path.join(ROOT, '.agents', 'plugins', 'marketplace.json'), 'utf8'));
+const marketplaceEntry = marketplace.plugins.find(plugin => plugin.name === 'harness-everything');
+assert.strictEqual(marketplaceEntry?.source?.path, './plugins/harness-everything');
+assert.ok(fs.existsSync(path.join(ROOT, marketplaceEntry.source.path, '.codex-plugin', 'plugin.json')));
+const claudeMarketplace = JSON.parse(fs.readFileSync(path.join(ROOT, '.claude-plugin', 'marketplace.json'), 'utf8'));
+assert.ok(claudeMarketplace.plugins.some(plugin => plugin.source === './'), 'Claude marketplace must remain a repository-root import path');
+
+const tempOutput = path.join(os.tmpdir(), `harness-2w-submission-${process.pid}.zip`);
+try {
+  const result = build(tempOutput);
+  const publicManifest = JSON.parse(fs.readFileSync(result.manifestPath, 'utf8'));
+  const packagedFiles = filesUnder(path.join(ROOT, 'plugins', 'harness-everything', 'skills')).map(file => `skills/${file}`);
+  assert.deepStrictEqual(publicManifest.files.map(file => file.path), packagedFiles);
+  assert.ok(publicManifest.files.every(file => file.path.startsWith('skills/')));
+  assert.ok(publicManifest.files.every(file => !/(^|\/)(hooks|\.codex-plugin)(\/|$)/.test(file.path)));
+  assert.strictEqual(publicManifest.bundle_sha256, sha256(tempOutput));
+} finally {
+  fs.rmSync(tempOutput, { force: true });
+  fs.rmSync(tempOutput.replace(/\.zip$/i, '') + '.manifest.json', { force: true });
+}
+
+const capabilityDocs = fs.readFileSync(path.join(ROOT, 'docs', 'platform-capabilities.md'), 'utf8');
+assert.match(capabilityDocs, /platform-compatibility\.json/);
+assert.match(capabilityDocs, /Continue\.dev[\s\S]*`Unknown` for standalone `SKILL\.md` discovery/);
+assert.match(capabilityDocs, /live plugin loading remains unverified/i);
+assert.match(capabilityDocs, /no fresh host-session artifacts/i);
+
+console.log('Platform compatibility verified: official-source matrix, installer targets, package manifests, and public bundle boundaries.');

package/ci/mechanism-2x-release-automation.test.js

@@ -0,0 +1,157 @@
+'use strict';
+
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFileSync } = require('child_process');
+const { VERSION_TARGETS, isStableSemVer, syncReleaseVersion } = require('../scripts/sync-release-version');
+
+const ROOT = path.resolve(__dirname, '..');
+const config = JSON.parse(fs.readFileSync(path.join(ROOT, '.releaserc.json'), 'utf8'));
+
+assert.deepStrictEqual(config.branches, ['main']);
+assert.ok(config.branches.every(branch => typeof branch === 'string'), 'release branches must not declare prerelease channels');
+assert.strictEqual(config.tagFormat, 'v${version}');
+
+const analyzer = config.plugins.find(plugin => Array.isArray(plugin) && plugin[0] === '@semantic-release/commit-analyzer');
+assert.ok(analyzer, 'commit analyzer configuration missing');
+const rules = new Map(analyzer[1].releaseRules.filter(rule => rule.type).map(rule => [rule.type, rule.release]));
+for (const [type, release] of Object.entries({
+  feat: 'minor',
+  fix: 'patch',
+  perf: 'patch',
+  refactor: 'patch',
+  build: 'patch',
+  revert: 'patch'
+})) {
+  assert.strictEqual(rules.get(type), release, `${type} release rule`);
+}
+for (const type of ['docs', 'test', 'ci', 'style', 'chore']) {
+  assert.ok(!rules.has(type), `${type} must fall through to semantic-release's no-release default`);
+}
+assert.ok(analyzer[1].releaseRules.some(rule => rule.breaking === true && rule.release === 'major'));
+
+const execPlugin = config.plugins.find(plugin => Array.isArray(plugin) && plugin[0] === '@semantic-release/exec');
+assert.ok(execPlugin, 'release preparation hook missing');
+assert.match(execPlugin[1].verifyReleaseCmd, /--validate \$\{nextRelease\.version\}/);
+assert.match(execPlugin[1].prepareCmd, /sync-release-version\.js \$\{nextRelease\.version\}/);
+assert.match(execPlugin[1].prepareCmd, /--base \$\{lastRelease\.gitTag\}/, 'changed skills must be computed from the previous release tag');
+assert.match(execPlugin[1].prepareCmd, /--check \$\{nextRelease\.version\} --base \$\{lastRelease\.gitTag\}/);
+
+const gitPlugin = config.plugins.find(plugin => Array.isArray(plugin) && plugin[0] === '@semantic-release/git');
+assert.ok(gitPlugin, 'release commit plugin missing');
+assert.match(gitPlugin[1].message, /\[skip ci\]/);
+assert.ok(gitPlugin[1].assets.includes('package-lock.json'));
+assert.ok(gitPlugin[1].assets.includes('opencode-plugin/plugin.json'));
+assert.ok(gitPlugin[1].assets.includes('*/SKILL.md'));
+assert.ok(gitPlugin[1].assets.includes('*/**/SKILL.md'));
+
+assert.ok(isStableSemVer('1.2.3'));
+for (const invalid of ['1.2.3-beta', '1.2.3+build', '01.2.3', '1.2', 'v1.2.3', '']) {
+  assert.ok(!isStableSemVer(invalid), invalid);
+}
+
+// Normal CI gates every checked-in runtime/plugin manifest against package.json.
+// package-lock is intentionally release-owned: the synchronizer fixes its root
+// version when semantic-release prepares the actual release transaction.
+const packageVersion = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8')).version;
+assert.ok(isStableSemVer(packageVersion), `package.json must use stable SemVer, got ${packageVersion}`);
+for (const target of VERSION_TARGETS.filter(target => target.file !== 'package-lock.json')) {
+  const data = JSON.parse(fs.readFileSync(path.join(ROOT, target.file), 'utf8'));
+  const current = target.get(data);
+  const values = Array.isArray(current) ? current : [current];
+  assert.ok(values.every(value => value === packageVersion), `${target.file} must match package.json version ${packageVersion}`);
+  assert.ok(values.every(isStableSemVer), `${target.file} must not carry a prerelease/build suffix`);
+}
+
+function json(file, value) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`);
+}
+
+function skill(file, name, version) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, `---\nname: ${name}\nmetadata:\n  author: Test\n  version: ${version}\n---\n\n# ${name}\n`);
+}
+
+function versionOfSkill(file) {
+  const match = fs.readFileSync(file, 'utf8').match(/^  version:\s*(\S+)$/m);
+  return match && match[1];
+}
+
+function fixture() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-release-'));
+  json(path.join(root, 'package.json'), { name: 'harness-everything', version: '0.3.8-beta' });
+  json(path.join(root, 'package-lock.json'), {
+    name: 'harness-everything',
+    version: '0.3.7-beta',
+    packages: { '': { name: 'harness-everything', version: '0.3.7-beta' } }
+  });
+  json(path.join(root, '.claude-plugin/plugin.json'), { name: 'harness-everything', version: '0.3.8-beta', skills: [] });
+  json(path.join(root, '.claude-plugin/marketplace.json'), { plugins: [{ name: 'harness-everything', version: '0.3.8-beta' }] });
+  json(path.join(root, 'plugins/harness-everything/plugin.json'), { name: 'harness-everything', version: '0.3.8-beta' });
+  json(path.join(root, 'plugins/harness-everything/.codex-plugin/plugin.json'), { name: 'harness-everything', version: '0.3.8-beta' });
+  json(path.join(root, 'opencode-plugin/plugin.json'), { name: 'harness-enforcement', version: '0.3.6' });
+  return root;
+}
+
+const root = fixture();
+const files = syncReleaseVersion(root, '1.2.3');
+assert.strictEqual(files.length, 7);
+syncReleaseVersion(root, '1.2.3', { checkOnly: true });
+
+const first = new Map(files.map(file => [file, fs.readFileSync(path.join(root, file), 'utf8')]));
+syncReleaseVersion(root, '1.2.3');
+for (const file of files) {
+  assert.strictEqual(fs.readFileSync(path.join(root, file), 'utf8'), first.get(file), `${file} must be idempotent`);
+}
+
+const lock = JSON.parse(fs.readFileSync(path.join(root, 'package-lock.json'), 'utf8'));
+assert.strictEqual(lock.version, '1.2.3');
+assert.strictEqual(lock.packages[''].version, '1.2.3');
+const market = JSON.parse(fs.readFileSync(path.join(root, '.claude-plugin/marketplace.json'), 'utf8'));
+assert.strictEqual(market.plugins[0].version, '1.2.3');
+
+const portable = path.join(root, 'plugins/harness-everything/plugin.json');
+const tampered = JSON.parse(fs.readFileSync(portable, 'utf8'));
+tampered.version = '1.2.2';
+json(portable, tampered);
+assert.throws(() => syncReleaseVersion(root, '1.2.3', { checkOnly: true }), /Release version drift/);
+assert.throws(() => syncReleaseVersion(root, '1.2.3-beta'), /stable SemVer/);
+
+const missing = fixture();
+const packageBefore = fs.readFileSync(path.join(missing, 'package.json'), 'utf8');
+fs.rmSync(path.join(missing, 'opencode-plugin/plugin.json'));
+assert.throws(() => syncReleaseVersion(missing, '2.0.0'), /Missing release version target/);
+assert.strictEqual(fs.readFileSync(path.join(missing, 'package.json'), 'utf8'), packageBefore, 'validation failure must happen before writes');
+
+// A release bumps only canonical skills changed since the previous release tag.
+// Nested sub-skills inherit the parent version whenever any file under that
+// top-level skill changed, while untouched skills keep their last-change version.
+const changed = fixture();
+const sourceManifest = JSON.parse(fs.readFileSync(path.join(changed, '.claude-plugin/plugin.json'), 'utf8'));
+sourceManifest.skills = ['./alpha', './beta'];
+json(path.join(changed, '.claude-plugin/plugin.json'), sourceManifest);
+skill(path.join(changed, 'alpha/SKILL.md'), 'alpha', '0.1.0');
+skill(path.join(changed, 'alpha/nested/SKILL.md'), 'nested', '0.1.0');
+skill(path.join(changed, 'beta/SKILL.md'), 'beta', '0.1.0');
+execFileSync('git', ['init'], { cwd: changed, stdio: 'ignore' });
+execFileSync('git', ['config', 'user.email', 'release-test@example.com'], { cwd: changed });
+execFileSync('git', ['config', 'user.name', 'Release Test'], { cwd: changed });
+execFileSync('git', ['add', '.'], { cwd: changed });
+execFileSync('git', ['commit', '-m', 'feat: baseline'], { cwd: changed, stdio: 'ignore' });
+execFileSync('git', ['tag', 'v0.1.0'], { cwd: changed });
+fs.writeFileSync(path.join(changed, 'alpha/behavior.txt'), 'changed\n');
+execFileSync('git', ['add', '.'], { cwd: changed });
+execFileSync('git', ['commit', '-m', 'feat(alpha): change behavior'], { cwd: changed, stdio: 'ignore' });
+const changedFiles = syncReleaseVersion(changed, '0.2.0', { base: 'v0.1.0' });
+assert.ok(changedFiles.includes('alpha/SKILL.md'));
+assert.ok(changedFiles.includes('alpha/nested/SKILL.md'));
+assert.ok(!changedFiles.includes('beta/SKILL.md'));
+assert.strictEqual(versionOfSkill(path.join(changed, 'alpha/SKILL.md')), '0.2.0');
+assert.strictEqual(versionOfSkill(path.join(changed, 'alpha/nested/SKILL.md')), '0.2.0');
+assert.strictEqual(versionOfSkill(path.join(changed, 'beta/SKILL.md')), '0.1.0');
+syncReleaseVersion(changed, '0.2.0', { base: 'v0.1.0', checkOnly: true });
+
+console.log('Release automation contract verified: stable SemVer rules, changed-skill versioning, manifest sync, drift detection, idempotency, and fail-before-write behavior.');

package/ci/mechanism-2x-release-commit-message.test.js

@@ -0,0 +1,66 @@
+'use strict';
+
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+const config = JSON.parse(fs.readFileSync(path.join(ROOT, '.releaserc.json'), 'utf8'));
+const gitPlugin = config.plugins.find(plugin => Array.isArray(plugin) && plugin[0] === '@semantic-release/git');
+
+assert.ok(gitPlugin, 'release commit plugin missing');
+const template = gitPlugin[1].message;
+assert.match(template, /\$\{nextRelease\.version\}/, 'release commit must include the calculated version');
+assert.match(template, /\[skip ci\]/, 'release commit must not recursively trigger CI');
+assert.ok(!template.includes('${nextRelease.notes}'), 'release notes must not be copied into the release commit message');
+
+const currentMessage = template.replace('${nextRelease.version}', '0.4.0');
+const currentLines = currentMessage.split(/\r?\n/);
+assert.strictEqual(currentLines.length, 1, 'release commit must remain a single-line control message');
+assert.ok(currentLines.every(line => line.length <= 100), 'release commit must remain within commitlint line limits');
+
+const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-release-commitlint-'));
+const currentFile = path.join(temp, 'current-message.txt');
+const legacyFile = path.join(temp, 'legacy-message.txt');
+fs.writeFileSync(currentFile, `${currentMessage}\n`);
+
+// Negative control: this reproduces the production failure from release run
+// 34970424994. Generated notes contain long Markdown links, so copying them
+// into the Git commit body violates body-max-line-length/footer constraints.
+const longReleaseNote = `* **behavioral-evals:** ${'x'.repeat(110)} ([90e36c2](https://github.com/dyphn1/Harness-everything/commit/90e36c2071fb5a71e16cdc99b1060cd3d699c43b)), closes #52`;
+const legacyMessage = `chore(release): 0.4.0 [skip ci]\n\n${longReleaseNote}\n`;
+fs.writeFileSync(legacyFile, legacyMessage);
+
+const commitlintPackageFile = require.resolve('@commitlint/cli/package.json');
+const commitlintPackage = JSON.parse(fs.readFileSync(commitlintPackageFile, 'utf8'));
+const commitlintBin = typeof commitlintPackage.bin === 'string'
+  ? commitlintPackage.bin
+  : commitlintPackage.bin && commitlintPackage.bin.commitlint;
+assert.ok(commitlintBin, '@commitlint/cli must expose a commitlint executable');
+const commitlintCli = path.resolve(path.dirname(commitlintPackageFile), commitlintBin);
+
+function commitlint(file) {
+  return spawnSync(process.execPath, [commitlintCli, '--edit', file], {
+    cwd: ROOT,
+    encoding: 'utf8'
+  });
+}
+
+const currentResult = commitlint(currentFile);
+assert.strictEqual(
+  currentResult.status,
+  0,
+  `current semantic-release commit must pass commitlint:\n${currentResult.stdout}\n${currentResult.stderr}`
+);
+
+const legacyResult = commitlint(legacyFile);
+assert.notStrictEqual(legacyResult.status, 0, 'legacy release-notes-in-commit behavior must fail commitlint');
+assert.match(
+  `${legacyResult.stdout}\n${legacyResult.stderr}`,
+  /body-max-line-length|footer-max-line-length/,
+  'negative control must fail for the same long-line class seen in production'
+);
+
+console.log('Release commit contract verified: compact message passes commitlint and legacy release-note embedding is rejected.');

package/ci/mechanism-2y-release-tooling-compat.test.js

@@ -0,0 +1,47 @@
+'use strict';
+
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '..');
+const workflow = fs.readFileSync(path.join(ROOT, '.github/workflows/release.yml'), 'utf8');
+
+function pinnedVersion(packageName, source = workflow) {
+  const escaped = packageName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const match = source.match(new RegExp(`${escaped}@(\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?)`));
+  assert.ok(match, `release workflow must pin ${packageName}`);
+  return match[1];
+}
+
+function major(version) {
+  return Number(version.split('.')[0]);
+}
+
+function assertCompatible(generatorVersion, presetVersion) {
+  if (major(generatorVersion) === 14 && major(presetVersion) >= 10) {
+    throw new Error(
+      `incompatible release-note tooling: @semantic-release/release-notes-generator@${generatorVersion} ` +
+      `uses conventional-changelog-writer 8, but conventional-changelog-conventionalcommits@${presetVersion} requires writer 9+`
+    );
+  }
+}
+
+const generatorVersion = pinnedVersion('@semantic-release/release-notes-generator');
+const presetVersion = pinnedVersion('conventional-changelog-conventionalcommits');
+
+assert.strictEqual(generatorVersion, '14.1.1', 'stable release-notes-generator pin changed; re-evaluate writer compatibility');
+assert.strictEqual(presetVersion, '9.3.1', 'preset must stay on the writer-8-compatible line while generator 14 is used');
+assert.doesNotThrow(() => assertCompatible(generatorVersion, presetVersion));
+assert.throws(
+  () => assertCompatible('14.1.1', '10.4.0'),
+  /incompatible release-note tooling/,
+  'negative control must reject the exact #113 failure pairing'
+);
+assert.doesNotMatch(
+  workflow,
+  /(?:^|\s)conventional-changelog-writer@\d/m,
+  'do not force writer 9 into release-notes-generator 14; upgrade the generator as one compatible stack instead'
+);
+
+console.log('Release tooling compatibility verified: generator 14 is paired with conventionalcommits 9.x, and the v10 regression is rejected.');

package/ci/mechanism-2z-claude-plugin-manifest.test.js

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+
+const projectRoot = path.resolve(__dirname, '..');
+const manifestPath = path.join(projectRoot, '.claude-plugin', 'plugin.json');
+const conventionalHooksPath = path.join(projectRoot, 'hooks', 'hooks.json');
+
+assert.ok(fs.existsSync(manifestPath), '.claude-plugin/plugin.json must exist');
+assert.ok(fs.existsSync(conventionalHooksPath), 'hooks/hooks.json must remain available for convention-based discovery');
+
+const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+const hooks = manifest.hooks;
+
+if (hooks !== undefined) {
+  const refs = Array.isArray(hooks) ? hooks : [hooks];
+  const normalized = refs
+    .filter(ref => typeof ref === 'string')
+    .map(ref => ref.replace(/\\/g, '/').replace(/^\.\//, ''));
+
+  assert.ok(
+    !normalized.includes('hooks/hooks.json'),
+    'Do not explicitly register hooks/hooks.json in .claude-plugin/plugin.json; Claude Code auto-discovers the conventional hook file and duplicate registration prevents the plugin from loading.'
+  );
+}
+
+console.log('PASS: Claude plugin manifest does not duplicate the conventional hooks/hooks.json registration.');