harness-everything 0.30.3 → 0.30.5

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.30.3",
+      "version": "0.30.5",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.30.3",
+  "version": "0.30.5",
   "author": {
     "name": "Miya Daniel"
   },

package/CHANGELOG.md

@@ -2,6 +2,40 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.30.5](https://github.com/dyphn1/Harness-everything/compare/v0.30.4...v0.30.5) (2026-10-06)
+
+### Bug Fixes
+
+* align Windows PowerShell quick-start contract ([f780f77](https://github.com/dyphn1/Harness-everything/commit/f780f777559d14f9bcf929793d954ddcaf2c6cf7))
+* enforce Windows-safe shell contract ([a373a16](https://github.com/dyphn1/Harness-everything/commit/a373a16f5bdd3659e290715c971f530e66ffe2c1))
+* fit Harness routing contract within budget ([6fa9065](https://github.com/dyphn1/Harness-everything/commit/6fa90657611bcbc85f669e864a3245b469e99d23))
+* keep host-shell invariant within skill budget ([1381dc9](https://github.com/dyphn1/Harness-everything/commit/1381dc9877a0facccbea8f31a3047055eabaf5b2))
+* preserve semantic contract phrases within Waza budget ([ab29217](https://github.com/dyphn1/Harness-everything/commit/ab292175cc691c6bd01d1e0da219a15c6779f7be))
+* preserve skill metadata while restoring token budget ([189660a](https://github.com/dyphn1/Harness-everything/commit/189660ad6283ecad84d8a07232515fd80da6691c))
+* restore Harness skill token budget ([80b1eee](https://github.com/dyphn1/Harness-everything/commit/80b1eeeceb681d9551bfbe4d3c881ae2c3e5747f))
+* restore required skill sections within Waza budget ([acbb314](https://github.com/dyphn1/Harness-everything/commit/acbb314ec4e7769c2a2c253918ac67e1158052fe))
+* show Windows-safe npx entry point ([d208b77](https://github.com/dyphn1/Harness-everything/commit/d208b7735912b7282dc158068b3e5c17a5c62e0d))
+* sync packaged Windows shell contract ([201eb5a](https://github.com/dyphn1/Harness-everything/commit/201eb5a53cbea4e696db633f857b6c30c15f1855))
+
+## [0.30.4](https://github.com/dyphn1/Harness-everything/compare/v0.30.3...v0.30.4) (2026-10-01)
+
+### Bug Fixes
+
+* **plugin:** sync skill-creator A/B contract ([2eeea6e](https://github.com/dyphn1/Harness-everything/commit/2eeea6ec3845c5affcbd38f8c44c8120155818c2))
+* **plugin:** sync to-spec design audit contract ([4a298e6](https://github.com/dyphn1/Harness-everything/commit/4a298e64477078e8c435ab90d1968d36f91bc648))
+* **plugin:** sync to-spec workspace contract ([591c50f](https://github.com/dyphn1/Harness-everything/commit/591c50f6a99819f51202e0fbebc0bdb3511746e0))
+* **skill-creator:** define executor-agnostic A/B lanes ([7294807](https://github.com/dyphn1/Harness-everything/commit/7294807da0c0c96f7baa148eb05913b476e192fa))
+* **skill-creator:** keep A/B invariant within token budget ([0e249ab](https://github.com/dyphn1/Harness-everything/commit/0e249ab2205daba3f11ad8aa7886e27821d63edb))
+* **skill-creator:** keep A/B invariant within token budget ([d0c7cba](https://github.com/dyphn1/Harness-everything/commit/d0c7cba2c9d2123a3a9c192d022dae3a70740efc))
+* **skill-creator:** keep topology router-owned in authoring guide ([842241d](https://github.com/dyphn1/Harness-everything/commit/842241dfadc98ed5983d744c9d615cf8e93b5e5e))
+* **skill-creator:** keep topology router-owned in authoring guide ([97ec713](https://github.com/dyphn1/Harness-everything/commit/97ec713580958629df11923be0acf25f4eaf92d2))
+* **skill-creator:** remove stale workspace spawner guidance ([37fbb99](https://github.com/dyphn1/Harness-everything/commit/37fbb99b992881fe4c93126c0198697e2d825240))
+* **skill-creator:** remove stale workspace spawner guidance ([14f0614](https://github.com/dyphn1/Harness-everything/commit/14f0614843d79fc1067384b1b5ffa3f22caf1b6b))
+* **to-spec:** define design audit outcome instead of executor ([ffe8e6e](https://github.com/dyphn1/Harness-everything/commit/ffe8e6e414edbb50412d48fd07cfe187b97cdc6f))
+* **to-spec:** keep audit invariant within token budget ([c29757a](https://github.com/dyphn1/Harness-everything/commit/c29757af92dc560a6fb15f16252ca931d4abc5cc))
+* **to-spec:** keep audit invariant within token budget ([5ab9667](https://github.com/dyphn1/Harness-everything/commit/5ab966710ca32e776a9cd9d8c608b92e2558898c))
+* **to-spec:** stop treating workspace as subagent executor ([32b797c](https://github.com/dyphn1/Harness-everything/commit/32b797c9fd9028ca26b8bb61f101bace23a5cd18))
+
 ## [0.30.3](https://github.com/dyphn1/Harness-everything/compare/v0.30.2...v0.30.3) (2026-10-01)
 
 ### Bug Fixes

package/README.md

@@ -56,12 +56,14 @@ Harness integrates directly into your workspace. There is no heavy daemon, no pa
 #   /plugin install harness-everything
 
 # Option B: install Harness hooks/skills/advisory integrations into your workspace
-npx github:dyphn1/Harness-everything install
+npx github:dyphn1/Harness-everything install                 # POSIX shells / Git Bash
+npx.cmd github:dyphn1/Harness-everything install             # Windows PowerShell
 
 # Option C: install or update the native Claude Code/Codex plugin
-#   npx github:dyphn1/Harness-everything plugin-sync
-#   ./scripts/plugin-sync.sh              # POSIX shells / Git Bash
-#   powershell -File scripts/plugin-sync.ps1  # Windows PowerShell
+#   npx github:dyphn1/Harness-everything plugin-sync       # POSIX shells / Git Bash
+#   npx.cmd github:dyphn1/Harness-everything plugin-sync   # Windows PowerShell
+#   ./scripts/plugin-sync.sh                               # POSIX shells / Git Bash
+#   node scripts/plugin-sync.js                            # Windows-safe direct entry
 
 # OpenAI/Codex local plugin packaging is repository-owned under:
 #   .agents/plugins/marketplace.json
@@ -69,6 +71,8 @@ npx github:dyphn1/Harness-everything install
 # See docs/openai-plugin.md for local import/install and public Skills-only submission.
 ```
 
+**Windows PowerShell:** use npm-family `.cmd` shims such as `npx.cmd` rather than weakening `ExecutionPolicy`. When reading Harness Markdown from Windows PowerShell 5.1, specify UTF-8 explicitly, for example `Get-Content -Encoding UTF8 -Raw <path>`.
+
 ### Expected Behavior After Installation:
 1. **Use the selected surface's real mechanism:** Claude Code hooks, the local OpenAI plugin lifecycle hooks, OpenCode's plugin API, or advisory instructions depending on what you installed.
 2. **Preflight / session context where packaged:** Hook-capable surfaces can inject environment/session context automatically; advisory-only surfaces must not be described as if they do.
@@ -100,9 +104,15 @@ The native `plugin-sync` command detects the installed host CLIs and applies the
 The installer records its state directories in `.git/info/exclude` — a local-only git ignore file — so Harness state never lands in a commit and your working tree (including `.gitignore`) is never modified. Everything owned by the general installer is removed with the built-in uninstaller:
 
 ```bash
-npx github:dyphn1/Harness-everything uninstall            # interactive
-npx github:dyphn1/Harness-everything uninstall --local --skills -y   # non-interactive, workspace only
-npx github:dyphn1/Harness-everything uninstall --global   # also remove Harness-owned global state
+# POSIX shells / Git Bash
+npx github:dyphn1/Harness-everything uninstall
+npx github:dyphn1/Harness-everything uninstall --local --skills -y
+npx github:dyphn1/Harness-everything uninstall --global
+
+# Windows PowerShell
+npx.cmd github:dyphn1/Harness-everything uninstall
+npx.cmd github:dyphn1/Harness-everything uninstall --local --skills -y
+npx.cmd github:dyphn1/Harness-everything uninstall --global
 ```
 
 ---

package/bin/cli.js

@@ -55,6 +55,11 @@ Harness OS - AI Agent Operating System CLI
 
 Usage:
   npx github:dyphn1/Harness-everything <command> [options]
+  npx.cmd github:dyphn1/Harness-everything <command> [options]  # Windows PowerShell
+
+Windows PowerShell note:
+  Use npx.cmd so restrictive ExecutionPolicy cannot redirect this command to npx.ps1.
+  Harness does not require changing ExecutionPolicy.
   
 Commands:
   install            Install Harness OS hooks & skills into the local repository

package/ci/mechanism-2w-platform-compatibility.test.js

@@ -152,7 +152,46 @@ try {
   fs.rmSync(tempOutput.replace(/\.zip$/i, '') + '.manifest.json', { force: true });
 }
 
+// Windows PowerShell 5.1 treats BOM-less UTF-8 as a legacy code page when
+// Get-Content has no explicit encoding, and resolves bare npm-family commands
+// to .ps1 shims before .cmd. The routing skill is the agent-facing boundary
+// that must prevent both failures before Harness itself starts.
+const canonicalHarnessSkill = fs.readFileSync(path.join(ROOT, 'harness-everything', 'SKILL.md'), 'utf8');
+const packagedHarnessSkill = fs.readFileSync(path.join(ROOT, 'plugins', 'harness-everything', 'skills', 'harness-everything', 'SKILL.md'), 'utf8');
+assert.match(canonicalHarnessSkill, /Windows PowerShell/);
+assert.match(canonicalHarnessSkill, /npx\.cmd/);
+assert.match(canonicalHarnessSkill, /Get-Content -Encoding UTF8 -Raw/);
+assert.strictEqual(packagedHarnessSkill, canonicalHarnessSkill, 'packaged Harness skill must preserve the Windows shell contract byte-for-text');
+assert.match(canonicalHarnessSkill, /—/u, 'UTF-8 em dash must remain intact');
+assert.match(canonicalHarnessSkill, /🚦 Harness Status/u, 'UTF-8 Harness Status marker must remain intact');
+
+const readme = fs.readFileSync(path.join(ROOT, 'README.md'), 'utf8');
+assert.match(readme, /npx\.cmd github:dyphn1\/Harness-everything install/);
+assert.match(readme, /npx\.cmd github:dyphn1\/Harness-everything uninstall/);
+assert.match(readme, /npx\.cmd github:dyphn1\/Harness-everything uninstall --local --skills -y/);
+assert.match(readme, /npx\.cmd github:dyphn1\/Harness-everything uninstall --global/);
+assert.match(readme, /Get-Content -Encoding UTF8 -Raw/);
+assert.doesNotMatch(readme, /powershell -File scripts\/plugin-sync\.ps1/);
+
+const troubleshootingDocs = fs.readFileSync(path.join(ROOT, 'docs', 'troubleshooting.md'), 'utf8');
+for (const command of [
+  'install',
+  'install --global',
+  'uninstall',
+  'install --cursor',
+  'install --codex',
+  'plugin-sync --json'
+]) {
+  assert.ok(
+    troubleshootingDocs.includes(`npx.cmd github:dyphn1/Harness-everything ${command}`),
+    `troubleshooting must include Windows PowerShell form for: ${command}`
+  );
+}
+
 const capabilityDocs = fs.readFileSync(path.join(ROOT, 'docs', 'platform-capabilities.md'), 'utf8');
+assert.match(capabilityDocs, /npx\.cmd github:dyphn1\/Harness-everything plugin-sync/);
+assert.match(capabilityDocs, /node scripts\/plugin-sync\.js/);
+assert.doesNotMatch(capabilityDocs, /powershell -File scripts\/plugin-sync\.ps1/);
 assert.match(capabilityDocs, /platform-compatibility\.json/);
 assert.match(capabilityDocs, /Continue\.dev[\s\S]*`Unknown` for standalone `SKILL\.md` discovery/);
 assert.match(capabilityDocs, /live-host evidence|Partial` live-host loading/i);

package/ci/prompt-contract-regressions.test.js

@@ -44,6 +44,52 @@ for (const rel of [
 }
 assert.ok(/section order MAY vary/i.test(skillStyle), 'skill-style explicitly permits readability-driven section ordering');
 
+// #266: older callers must describe review/evaluation outcomes, not treat
+// multi-agent-workspace as a generic subagent executor. Topology remains
+// router-owned, and canonical skill files must stay in sync with packaged copies.
+const contractPairs = [
+  ['to-spec/SKILL.md', 'plugins/harness-everything/skills/to-spec/SKILL.md'],
+  ['to-spec/references/process.md', 'plugins/harness-everything/skills/to-spec/references/process.md'],
+  ['skill-creator/SKILL.md', 'plugins/harness-everything/skills/skill-creator/SKILL.md'],
+  ['skill-creator/references/testing-workflow.md', 'plugins/harness-everything/skills/skill-creator/references/testing-workflow.md'],
+  ['skill-creator/references/authoring-workflow.md', 'plugins/harness-everything/skills/skill-creator/references/authoring-workflow.md'],
+];
+for (const [canonical, packaged] of contractPairs) {
+  assert.strictEqual(read(packaged), read(canonical), canonical + ' packaged mirror must match');
+}
+const contractSurfaces = [
+  'to-spec/SKILL.md',
+  'to-spec/references/process.md',
+  'skill-creator/SKILL.md',
+  'skill-creator/references/testing-workflow.md',
+  'skill-creator/references/authoring-workflow.md',
+  'docs/workflows/skill-creator.md',
+];
+const staleExecutorClaims = [
+  /Design Audit \(\`multi-agent-workspace\`\)/i,
+  /recommend invoking \`multi-agent-workspace\`/i,
+  /A\/B-test via \`multi-agent-workspace\` subagents/i,
+  /multi-agent-workspace subagents/i,
+  /`multi-agent-workspace` skill for bounded sub-agent spawning/i,
+  /Use `multi-agent-workspace` to spawn/i,
+  /multi-agent entrypoint is `multi-agent-workspace`; it owns\s+bounded delegation/i,
+];
+for (const rel of contractSurfaces) {
+  const body = read(rel);
+  for (const pattern of staleExecutorClaims) {
+    assert.ok(!pattern.test(body), rel + ' must not treat multi-agent-workspace as a generic executor: ' + pattern);
+  }
+}
+assert.ok(/independent Design Audit findings/i.test(read('to-spec/SKILL.md')), 'to-spec requires independent Design Audit evidence');
+assert.ok(/Describe the required audit outcome, not an executor/i.test(read('to-spec/references/process.md')), 'to-spec process specifies audit outcome rather than executor');
+assert.ok(/A\/B-test isolated control/i.test(read('skill-creator/SKILL.md')), 'skill-creator defines isolated A/B lanes');
+assert.ok(/control \(without skill\) vs treatment \(with skill\)/i.test(read('skill-creator/SKILL.md')), 'skill-creator preserves control/treatment semantics');
+assert.ok(/topology owned by the active router\/host/i.test(read('skill-creator/references/testing-workflow.md')), 'testing guide keeps evaluation topology router-owned');
+assert.ok(/Execution topology belongs to the router\/host/i.test(read('skill-creator/references/authoring-workflow.md')), 'authoring guide keeps execution topology router-owned');
+const workspaceContract = read('multi-agent-workspace/SKILL.md');
+assert.ok(/router owns that decision/i.test(workspaceContract), 'multi-agent-workspace keeps router-owned topology');
+assert.ok(/does not spawn workers/i.test(workspaceContract), 'multi-agent-workspace remains a topology/workspace consumer');
+
 // #272: preserve one detailed checkpoint plus the invariant; remove duplicate
 // restatements from later sections of the same router injection.
 const kernel = path.join(ROOT, 'harness-everything/scripts/kernel-router.js');

package/docs/platform-capabilities.md

@@ -69,10 +69,15 @@ The package is tested at the mechanism layer and remains subject to the host’s
 The repository also ships a host-facing synchronization command for the native marketplace/plugin surfaces:
 
 ```bash
+# POSIX shells / Git Bash
 npx github:dyphn1/Harness-everything plugin-sync
 # or, from a checkout:
 ./scripts/plugin-sync.sh
-powershell -File scripts/plugin-sync.ps1
+
+# Windows PowerShell
+npx.cmd github:dyphn1/Harness-everything plugin-sync
+# or, from a checkout:
+node scripts/plugin-sync.js
 ```
 
 The command detects Claude Code and Codex independently, ensures the Harness marketplace is configured, reads the installed-plugin state, then refreshes that marketplace before choosing the operation:

package/docs/troubleshooting.md

@@ -9,6 +9,8 @@ This guide helps you resolve common issues with Harness OS installation and usag
 **Symptom:** `EACCES: permission denied` during installation
 
 **Solution:**
+
+POSIX shells / Git Bash:
 ```bash
 # Option 1: Install without sudo (recommended)
 npx github:dyphn1/Harness-everything install
@@ -22,6 +24,12 @@ npm config set prefix '~/.npm-global'
 export PATH=~/.npm-global/bin:$PATH
 ```
 
+Windows PowerShell:
+```powershell
+npx.cmd github:dyphn1/Harness-everything install
+npx.cmd github:dyphn1/Harness-everything install --global
+```
+
 ### Node.js Version Issues
 
 **Symptom:** `SyntaxError` or unsupported engine errors
@@ -93,11 +101,17 @@ which node
 # Check if hooks directory exists
 ls -la hooks/scripts/
 
-# Reinstall Harness
+# Reinstall Harness (POSIX shells / Git Bash)
 npx github:dyphn1/Harness-everything uninstall
 npx github:dyphn1/Harness-everything install
 ```
 
+Windows PowerShell:
+```powershell
+npx.cmd github:dyphn1/Harness-everything uninstall
+npx.cmd github:dyphn1/Harness-everything install
+```
+
 ### Circuit Breaker Tripping Too Often
 
 **Symptom:** `RULE OF 3 CIRCUIT BREAKER TRIGGERED!` frequently
@@ -129,8 +143,13 @@ Do not expect this Claude Code state file merely because Harness skills or an in
    ```
 2. If missing, reinstall with Cursor flag:
    ```bash
+   # POSIX shells / Git Bash
    npx github:dyphn1/Harness-everything install --cursor
    ```
+   ```powershell
+   # Windows PowerShell
+   npx.cmd github:dyphn1/Harness-everything install --cursor
+   ```
 3. Restart Cursor.
 
 ### Copilot Not Following Rules
@@ -156,8 +175,13 @@ Do not expect this Claude Code state file merely because Harness skills or an in
    ```
 2. Reinstall the advisory Codex target if needed:
    ```bash
+   # POSIX shells / Git Bash
    npx github:dyphn1/Harness-everything install --codex
    ```
+   ```powershell
+   # Windows PowerShell
+   npx.cmd github:dyphn1/Harness-everything install --codex
+   ```
 3. Remember that this is the instruction-oriented installer path. It is different from the **local OpenAI plugin** package described below.
 
 ### Codex / local OpenAI plugin not appearing
@@ -192,9 +216,15 @@ The local plugin mechanically injects the session policy and invariant-first rou
 For the native host install/update path, run:
 
 ```bash
+# POSIX shells / Git Bash
 npx github:dyphn1/Harness-everything plugin-sync --json
 ```
 
+```powershell
+# Windows PowerShell
+npx.cmd github:dyphn1/Harness-everything plugin-sync --json
+```
+
 The command installs only when the plugin is absent. An installed Claude plugin uses the explicit Claude update command; an installed Codex plugin uses marketplace upgrade. If plugin state cannot be read, synchronization stops without re-adding or overwriting the plugin.
 
 Host CLIs differ in which options and subcommands they implement, so the synchronizer degrades instead of failing:

package/docs/workflows/skill-creator.md

@@ -13,7 +13,7 @@ graph TD
   NewReq["Trigger: new skill, SKILL.md audit, or self-evolve packaging"] --> DupGrep["Grep registry for near-duplicates; when-to-fire sentence becomes description"]
   DupGrep --> DraftContract["Draft Contract table first, then USE FOR and DO NOT USE FOR, then steps or flat reference"]
   DraftContract --> PushRef["Push branch-only detail to references/"]
-  PushRef --> ABTest["A/B-test via multi-agent-workspace subagents; read both transcripts"]
+  PushRef --> ABTest["A/B-test in isolated control/treatment lanes; capture and read both transcripts"]
   ABTest --> QualityGate["Quality Checklist gate before registering"]
   QualityGate --> RegisterOut["Output: SKILL.md passing Quality Checklist; writes SKILL.md and updates registry or generated folder"]
 ```
@@ -38,7 +38,8 @@ graph LR
 
 ```mermaid
 graph LR
-  CreatorSkill2["skill-creator / SKILL.md"] -->|A-B tests with| MultiAgent["multi-agent-workspace subagents"]
+  CreatorSkill2["skill-creator / SKILL.md"] -->|Defines isolated A/B lanes and evidence| EvalLanes["Control: without candidate skill / Treatment: with candidate skill"]
+  EvalLanes --> RouterExec["Router/host selects execution topology"]
   NonSkillDocs["Non-skill project docs"] -->|Use instead| RepoDocs["repo-docs or to-spec"]
   ThirdParty["Third-party skill discovery"] -->|Use instead| FindSkills["find-skills"]
   StyleOnly["Code style outside SKILL.md files"] -->|Out of scope| NotCreator["Not skill-creator"]
@@ -46,7 +47,7 @@ graph LR
 
 ## 3. Real-World Use Case
 
-A team wants a new `deploy-preview` skill. The author greps the registry for near-duplicates, writes the when-to-fire sentence as the description, drafts the Contract table first with its enforcement gate, then `USE FOR` and `DO NOT USE FOR`, then the steps, pushing long detail to `references/`. They A/B-test via `multi-agent-workspace` subagents, read both transcripts, run the Quality Checklist (`skill-creator/references/quality-checklist.md`), and only then register. A separate small tip discovered mid-session does not qualify as a dynamic skill and goes to `<workspace>/memories/repo/RULES.md`.
+A team wants a new `deploy-preview` skill. The author greps the registry for near-duplicates, writes the when-to-fire sentence as the description, drafts the Contract table first with its enforcement gate, then `USE FOR` and `DO NOT USE FOR`, then the steps, pushing long detail to `references/`. They A/B-test in two isolated lanes (control without the candidate skill; treatment with it), capture and read both transcripts, let the router/host select the execution topology, run the Quality Checklist (`skill-creator/references/quality-checklist.md`), and only then register. A separate small tip discovered mid-session does not qualify as a dynamic skill and goes to `<workspace>/memories/repo/RULES.md`.
 
 ## 4. Verification Check
 
@@ -54,7 +55,7 @@ A team wants a new `deploy-preview` skill. The author greps the registry for nea
 - [ ] Contract table drafted first to force the enforcement gate
 - [ ] `USE FOR` and `DO NOT USE FOR` present before steps or flat reference
 - [ ] Branch-only detail pushed to `references/` (e.g. `skill-creator/references/quality-checklist.md`)
-- [ ] A/B-tested via `multi-agent-workspace` subagents and both transcripts read
+- [ ] A/B-tested in isolated control/treatment lanes; both transcripts captured and read; execution topology left to the router/host
 - [ ] Quality Checklist passed before registering, including `USE FOR` / `DO NOT USE FOR` consistency
 - [ ] Output is a SKILL.md passing the Quality Checklist; `<skill>/SKILL.md` written and registry or generated folder updated
 - [ ] Dynamic path gated by Quality Checklist first; location, frontmatter triggers, generated type, and draft status correct

package/harness-everything/SKILL.md

@@ -4,35 +4,32 @@ description: "Route software/project work through Harness: classify tier/topolog
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.30.3
+  version: 0.30.5
 ---
 
 # Harness Everything
 
-Kernel routing entry.
-
 ## USE FOR:
 - Software/project triage, routing, re-routing, workflow selection.
-- Work that names or matches another skill.
+- Work naming or matching another skill.
 
 ## DO NOT USE FOR:
 - General Q&A or non-software writing.
 
 ## Invariants
-1. **Route (MUST)** — establish scope/tier and selected/deferred topology.
-2. **Verify (MUST)** — completion claims need objective evidence; `verify-gate.js --json` distinguishes passed, failed, discovered-but-unrun, and absent project checks.
+1. **Route (MUST)** — scope/tier plus selected/deferred topology.
+2. **Verify (MUST)** — objective evidence via `verify-gate.js --json`.
 3. **Zoom out (MUST)** — after 3 same-signature failures, use `zoom-out`.
-4. **Resolve suggestions (MUST)** — read/evaluate each suggested `SKILL.md`; applicable core contracts MUST run, otherwise retain a flow-grounded reason.
-5. **Surface status (MUST)** — non-trivial work renders `### 🚦 Harness Status` with bold `Current`, `Read / Evidence`, `Next`; optional `Risk / Blocked`.
-6. **Keep agency** — required obligations are MUST; tactics MAY adapt. Numeric planning values MAY guide, never hard-stop.
+4. **Resolve suggestions (MUST)** — evaluate each suggested `SKILL.md`; run applicable core contracts or retain a flow-grounded reason.
+5. **Surface status (MUST)** — non-trivial work renders `### 🚦 Harness Status` with bold `Current`, `Read / Evidence`, `Next`; `Risk / Blocked` optional.
+6. **Keep agency** — required obligations are MUST; tactics MAY adapt. Numeric planning MAY guide, never hard-stop; only Rule-of-3 reflection and explicit user/host permission boundaries may block.
+7. **Windows PowerShell (MUST)** — `Get-Content -Encoding UTF8 -Raw`; npm `.cmd` shims (`npx.cmd`); never weaken `ExecutionPolicy`.
 
 ## Workflow
 1. Reuse kernel output or run `node "<this-skill-dir>/scripts/kernel-router.js" "<prompt summary>"`.
 2. Keep the routing checkpoint internal.
-3. Resolve each suggestion as `use`, `not-applicable`, or `unresolved`; `use` follows its core contract.
-4. Resolve selected-topology required invariants/stages/checks before completion.
-5. Tier-3/Fable broad mutation MUST resolve isolation: linked worktree or explicit degraded fallback.
-
-**Rule:** semantic MUST is not hard blocking; only Rule-of-3 reflection and explicit user/host permission boundaries may block.
+3. Resolve suggestions as `use`, `not-applicable`, or `unresolved`.
+4. Complete selected-topology invariants/stages/checks.
+5. Tier-3/Fable broad mutation MUST use a linked worktree or explicit degraded fallback.
 
 Deep dive: <this-skill-dir>/references/triage-and-tiers.md

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.30.3",
+  "version": "0.30.5",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.30.3",
+  "version": "0.30.5",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.30.3",
+  "version": "0.30.5",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.30.3",
+  "version": "0.30.5",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/skills/harness-everything/SKILL.md

@@ -4,35 +4,32 @@ description: "Route software/project work through Harness: classify tier/topolog
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.30.3
+  version: 0.30.5
 ---
 
 # Harness Everything
 
-Kernel routing entry.
-
 ## USE FOR:
 - Software/project triage, routing, re-routing, workflow selection.
-- Work that names or matches another skill.
+- Work naming or matching another skill.
 
 ## DO NOT USE FOR:
 - General Q&A or non-software writing.
 
 ## Invariants
-1. **Route (MUST)** — establish scope/tier and selected/deferred topology.
-2. **Verify (MUST)** — completion claims need objective evidence; `verify-gate.js --json` distinguishes passed, failed, discovered-but-unrun, and absent project checks.
+1. **Route (MUST)** — scope/tier plus selected/deferred topology.
+2. **Verify (MUST)** — objective evidence via `verify-gate.js --json`.
 3. **Zoom out (MUST)** — after 3 same-signature failures, use `zoom-out`.
-4. **Resolve suggestions (MUST)** — read/evaluate each suggested `SKILL.md`; applicable core contracts MUST run, otherwise retain a flow-grounded reason.
-5. **Surface status (MUST)** — non-trivial work renders `### 🚦 Harness Status` with bold `Current`, `Read / Evidence`, `Next`; optional `Risk / Blocked`.
-6. **Keep agency** — required obligations are MUST; tactics MAY adapt. Numeric planning values MAY guide, never hard-stop.
+4. **Resolve suggestions (MUST)** — evaluate each suggested `SKILL.md`; run applicable core contracts or retain a flow-grounded reason.
+5. **Surface status (MUST)** — non-trivial work renders `### 🚦 Harness Status` with bold `Current`, `Read / Evidence`, `Next`; `Risk / Blocked` optional.
+6. **Keep agency** — required obligations are MUST; tactics MAY adapt. Numeric planning MAY guide, never hard-stop; only Rule-of-3 reflection and explicit user/host permission boundaries may block.
+7. **Windows PowerShell (MUST)** — `Get-Content -Encoding UTF8 -Raw`; npm `.cmd` shims (`npx.cmd`); never weaken `ExecutionPolicy`.
 
 ## Workflow
 1. Reuse kernel output or run `node "<this-skill-dir>/scripts/kernel-router.js" "<prompt summary>"`.
 2. Keep the routing checkpoint internal.
-3. Resolve each suggestion as `use`, `not-applicable`, or `unresolved`; `use` follows its core contract.
-4. Resolve selected-topology required invariants/stages/checks before completion.
-5. Tier-3/Fable broad mutation MUST resolve isolation: linked worktree or explicit degraded fallback.
-
-**Rule:** semantic MUST is not hard blocking; only Rule-of-3 reflection and explicit user/host permission boundaries may block.
+3. Resolve suggestions as `use`, `not-applicable`, or `unresolved`.
+4. Complete selected-topology invariants/stages/checks.
+5. Tier-3/Fable broad mutation MUST use a linked worktree or explicit degraded fallback.
 
 Deep dive: <this-skill-dir>/references/triage-and-tiers.md

package/plugins/harness-everything/skills/skill-creator/SKILL.md

@@ -4,7 +4,7 @@ description: Author, audit, and refactor SKILL.md files against one quality bar
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.13.0
+  version: 0.30.4
 ---
 
 # Skill Creator
@@ -31,8 +31,8 @@ metadata:
 ## Authoring Workflow
 
 1. Grep the registry for near-duplicates; the when-to-fire sentence becomes the description.
-2. Draft the Contract table first (forces the Enforcement Gate), then `## USE FOR:`/`## DO NOT USE FOR:`, then steps/flat reference; push branch-only detail to references/.
-3. A/B-test via `multi-agent-workspace` subagents; read both transcripts.
+2. Draft Contract table first, then `## USE FOR:`/`## DO NOT USE FOR:`, then steps; move branch-only detail to references/.
+3. A/B-test isolated control (without skill) vs treatment (with skill); read both transcripts; router owns topology.
 4. Run the Quality Checklist; register (static quotes the description; dynamic below).
 
 ## Dynamic Skill Generation Contract

package/plugins/harness-everything/skills/skill-creator/references/authoring-workflow.md

@@ -5,10 +5,10 @@ the enforcement gate. Use short ordered steps for actions and move branch-only
 detail into references or guides.
 
 Before registering a skill, check the Harness registry for overlap, define one
-human-readable frontmatter description, run realistic with/without tests using
-`multi-agent-workspace`, and complete the Quality Checklist. Static skills
-belong in the root catalog and need a routing eval; dynamic skills use the
-generated manifest flow from `self-evolve`.
+human-readable frontmatter description, run realistic isolated with/without
+tests, and complete the Quality Checklist. Static skills belong in the root
+catalog and need a routing eval; dynamic skills use the generated manifest flow
+from `self-evolve`.
 
-The canonical multi-agent entrypoint is `multi-agent-workspace`; it owns
-bounded delegation and workspace isolation.
+Execution topology belongs to the router/host. `multi-agent-workspace` is only
+consumed when the router already selected its workspace topology.

package/plugins/harness-everything/skills/skill-creator/references/testing-workflow.md

@@ -1,14 +1,14 @@
 # Testing Workflow
 
 Read this when `skill-creator/SKILL.md` asks for realistic trigger tests or a
-with/without comparison. Harness uses deterministic routing and the merged
-`multi-agent-workspace` skill for bounded sub-agent spawning.
+with/without comparison. Use isolated control/treatment lanes and keep execution
+topology owned by the active router/host.
 
 ## With/without comparison
 
 1. Write 2-3 realistic prompts with paths, framework names, and near-misses.
-2. Use `multi-agent-workspace` to spawn one sub-agent with the draft skill
-   loaded and one baseline with no mention of it.
+2. Run the treatment with the draft skill loaded and the control without it in
+   isolated lanes selected by the active router/host.
 3. Read both transcripts, not only final answers; record thrashing and missed
    gates as evidence.
 4. Construct one prompt that should trigger the skill's enforcement gate and

package/plugins/harness-everything/skills/to-spec/SKILL.md

@@ -4,7 +4,7 @@ description: "Turn the conversation into a written spec — feature PRD, CLI/API
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.12.0
+  version: 0.30.4
 ---
 
 # To Spec
@@ -26,7 +26,7 @@ Turns the conversation into one published spec artifact. No interviewing — `gr
 2. Zero-trust context: cite `Evidence: <file:line> -> Finding: <meaning>`; blocking forks mean run `grill-me`/`grill-with-docs` first.
 3. Mandatory outline preview (closest fit, 10-20 lines + target path); write only after user confirms.
 4. Publish to `specs/<feature-slug>.md` (`Status: ready-for-agent`) or `reference/`, `adr/`.
-5. Golden Flow: Feature spec needs a Design Audit (`multi-agent-workspace`) before `/to-tickets`.
+5. Golden Flow: Feature specs require independent Design Audit findings before `/to-tickets`; router owns topology.
 
 Deep dive: <this-skill-dir>/references/process.md
 

package/plugins/harness-everything/skills/to-spec/references/process.md

@@ -100,4 +100,4 @@ No additional triage needed beyond the `issueDefinition` marker. A clearly-shape
 
 ## Golden Flow rationale
 
-After publishing a `Feature spec` (Tier 3), do NOT immediately instruct the user to run `/to-tickets`. Instead, instruct the user to initiate a Design Audit first: recommend invoking `multi-agent-workspace` (or manually starting parallel Sub-agents) to conduct a Fan-out architectural audit (e.g., Security Auditor, Senior Architect) on the newly published spec. State explicitly: "This specification must pass a Design Audit before being broken down by `/to-tickets`. Any architectural flaws or over-engineering must be caught now, not during implementation."
+After publishing a `Feature spec` (Tier 3), do NOT immediately instruct the user to run `/to-tickets`. Instead, require a Design Audit with at least two independent reviewer perspectives (for example, Security Auditor and Senior Architect) and preserve their findings as audit evidence. Describe the required audit outcome, not an executor: the Harness router/host selects the execution topology. `multi-agent-workspace` is valid only when the router contract has already selected `strategy=fable-multi-agent-workspace` with `workspace.required=true`; otherwise use the independent review lanes available on the active host/router. State explicitly: "This specification must pass a Design Audit before being broken down by `/to-tickets`. Any architectural flaws or over-engineering must be caught now, not during implementation."

package/sbom.cdx.json

@@ -2,23 +2,23 @@
   "$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.7",
-  "serialNumber": "urn:uuid:557653e9-e704-5fd3-b675-167e0cadb8c9",
+  "serialNumber": "urn:uuid:681ee313-d384-5851-8f3a-9ec7af56fc28",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-01T06:19:24.870Z",
+    "timestamp": "2026-10-06T03:46:28.900Z",
     "tools": [
       {
         "vendor": "Harness Everything",
         "name": "generate-sbom.js",
-        "version": "0.30.3"
+        "version": "0.30.5"
       }
     ],
     "component": {
       "type": "application",
-      "bom-ref": "pkg:npm/harness-everything@0.30.3",
+      "bom-ref": "pkg:npm/harness-everything@0.30.5",
       "name": "harness-everything",
-      "version": "0.30.3",
-      "purl": "pkg:npm/harness-everything@0.30.3"
+      "version": "0.30.5",
+      "purl": "pkg:npm/harness-everything@0.30.5"
     }
   },
   "components": [
@@ -1999,7 +1999,7 @@
       ]
     },
     {
-      "ref": "pkg:npm/harness-everything@0.30.3",
+      "ref": "pkg:npm/harness-everything@0.30.5",
       "dependsOn": [
         "pkg:npm/%40commitlint/cli@19.8.1",
         "pkg:npm/%40commitlint/config-conventional@19.8.1",

package/skill-creator/SKILL.md

@@ -4,7 +4,7 @@ description: Author, audit, and refactor SKILL.md files against one quality bar
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.13.0
+  version: 0.30.4
 ---
 
 # Skill Creator
@@ -31,8 +31,8 @@ metadata:
 ## Authoring Workflow
 
 1. Grep the registry for near-duplicates; the when-to-fire sentence becomes the description.
-2. Draft the Contract table first (forces the Enforcement Gate), then `## USE FOR:`/`## DO NOT USE FOR:`, then steps/flat reference; push branch-only detail to references/.
-3. A/B-test via `multi-agent-workspace` subagents; read both transcripts.
+2. Draft Contract table first, then `## USE FOR:`/`## DO NOT USE FOR:`, then steps; move branch-only detail to references/.
+3. A/B-test isolated control (without skill) vs treatment (with skill); read both transcripts; router owns topology.
 4. Run the Quality Checklist; register (static quotes the description; dynamic below).
 
 ## Dynamic Skill Generation Contract

package/skill-creator/references/authoring-workflow.md

@@ -5,10 +5,10 @@ the enforcement gate. Use short ordered steps for actions and move branch-only
 detail into references or guides.
 
 Before registering a skill, check the Harness registry for overlap, define one
-human-readable frontmatter description, run realistic with/without tests using
-`multi-agent-workspace`, and complete the Quality Checklist. Static skills
-belong in the root catalog and need a routing eval; dynamic skills use the
-generated manifest flow from `self-evolve`.
+human-readable frontmatter description, run realistic isolated with/without
+tests, and complete the Quality Checklist. Static skills belong in the root
+catalog and need a routing eval; dynamic skills use the generated manifest flow
+from `self-evolve`.
 
-The canonical multi-agent entrypoint is `multi-agent-workspace`; it owns
-bounded delegation and workspace isolation.
+Execution topology belongs to the router/host. `multi-agent-workspace` is only
+consumed when the router already selected its workspace topology.

package/skill-creator/references/testing-workflow.md

@@ -1,14 +1,14 @@
 # Testing Workflow
 
 Read this when `skill-creator/SKILL.md` asks for realistic trigger tests or a
-with/without comparison. Harness uses deterministic routing and the merged
-`multi-agent-workspace` skill for bounded sub-agent spawning.
+with/without comparison. Use isolated control/treatment lanes and keep execution
+topology owned by the active router/host.
 
 ## With/without comparison
 
 1. Write 2-3 realistic prompts with paths, framework names, and near-misses.
-2. Use `multi-agent-workspace` to spawn one sub-agent with the draft skill
-   loaded and one baseline with no mention of it.
+2. Run the treatment with the draft skill loaded and the control without it in
+   isolated lanes selected by the active router/host.
 3. Read both transcripts, not only final answers; record thrashing and missed
    gates as evidence.
 4. Construct one prompt that should trigger the skill's enforcement gate and

package/to-spec/SKILL.md

@@ -4,7 +4,7 @@ description: "Turn the conversation into a written spec — feature PRD, CLI/API
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.12.0
+  version: 0.30.4
 ---
 
 # To Spec
@@ -26,7 +26,7 @@ Turns the conversation into one published spec artifact. No interviewing — `gr
 2. Zero-trust context: cite `Evidence: <file:line> -> Finding: <meaning>`; blocking forks mean run `grill-me`/`grill-with-docs` first.
 3. Mandatory outline preview (closest fit, 10-20 lines + target path); write only after user confirms.
 4. Publish to `specs/<feature-slug>.md` (`Status: ready-for-agent`) or `reference/`, `adr/`.
-5. Golden Flow: Feature spec needs a Design Audit (`multi-agent-workspace`) before `/to-tickets`.
+5. Golden Flow: Feature specs require independent Design Audit findings before `/to-tickets`; router owns topology.
 
 Deep dive: <this-skill-dir>/references/process.md
 

package/to-spec/references/process.md

@@ -100,4 +100,4 @@ No additional triage needed beyond the `issueDefinition` marker. A clearly-shape
 
 ## Golden Flow rationale
 
-After publishing a `Feature spec` (Tier 3), do NOT immediately instruct the user to run `/to-tickets`. Instead, instruct the user to initiate a Design Audit first: recommend invoking `multi-agent-workspace` (or manually starting parallel Sub-agents) to conduct a Fan-out architectural audit (e.g., Security Auditor, Senior Architect) on the newly published spec. State explicitly: "This specification must pass a Design Audit before being broken down by `/to-tickets`. Any architectural flaws or over-engineering must be caught now, not during implementation."
+After publishing a `Feature spec` (Tier 3), do NOT immediately instruct the user to run `/to-tickets`. Instead, require a Design Audit with at least two independent reviewer perspectives (for example, Security Auditor and Senior Architect) and preserve their findings as audit evidence. Describe the required audit outcome, not an executor: the Harness router/host selects the execution topology. `multi-agent-workspace` is valid only when the router contract has already selected `strategy=fable-multi-agent-workspace` with `workspace.required=true`; otherwise use the independent review lanes available on the active host/router. State explicitly: "This specification must pass a Design Audit before being broken down by `/to-tickets`. Any architectural flaws or over-engineering must be caught now, not during implementation."