harness-everything 0.30.4 → 0.30.5

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.30.4",
+      "version": "0.30.5",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.30.4",
+  "version": "0.30.5",
   "author": {
     "name": "Miya Daniel"
   },

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.30.5](https://github.com/dyphn1/Harness-everything/compare/v0.30.4...v0.30.5) (2026-10-06)
+
+### Bug Fixes
+
+* align Windows PowerShell quick-start contract ([f780f77](https://github.com/dyphn1/Harness-everything/commit/f780f777559d14f9bcf929793d954ddcaf2c6cf7))
+* enforce Windows-safe shell contract ([a373a16](https://github.com/dyphn1/Harness-everything/commit/a373a16f5bdd3659e290715c971f530e66ffe2c1))
+* fit Harness routing contract within budget ([6fa9065](https://github.com/dyphn1/Harness-everything/commit/6fa90657611bcbc85f669e864a3245b469e99d23))
+* keep host-shell invariant within skill budget ([1381dc9](https://github.com/dyphn1/Harness-everything/commit/1381dc9877a0facccbea8f31a3047055eabaf5b2))
+* preserve semantic contract phrases within Waza budget ([ab29217](https://github.com/dyphn1/Harness-everything/commit/ab292175cc691c6bd01d1e0da219a15c6779f7be))
+* preserve skill metadata while restoring token budget ([189660a](https://github.com/dyphn1/Harness-everything/commit/189660ad6283ecad84d8a07232515fd80da6691c))
+* restore Harness skill token budget ([80b1eee](https://github.com/dyphn1/Harness-everything/commit/80b1eeeceb681d9551bfbe4d3c881ae2c3e5747f))
+* restore required skill sections within Waza budget ([acbb314](https://github.com/dyphn1/Harness-everything/commit/acbb314ec4e7769c2a2c253918ac67e1158052fe))
+* show Windows-safe npx entry point ([d208b77](https://github.com/dyphn1/Harness-everything/commit/d208b7735912b7282dc158068b3e5c17a5c62e0d))
+* sync packaged Windows shell contract ([201eb5a](https://github.com/dyphn1/Harness-everything/commit/201eb5a53cbea4e696db633f857b6c30c15f1855))
+
 ## [0.30.4](https://github.com/dyphn1/Harness-everything/compare/v0.30.3...v0.30.4) (2026-10-01)
 
 ### Bug Fixes

package/README.md

@@ -56,12 +56,14 @@ Harness integrates directly into your workspace. There is no heavy daemon, no pa
 #   /plugin install harness-everything
 
 # Option B: install Harness hooks/skills/advisory integrations into your workspace
-npx github:dyphn1/Harness-everything install
+npx github:dyphn1/Harness-everything install                 # POSIX shells / Git Bash
+npx.cmd github:dyphn1/Harness-everything install             # Windows PowerShell
 
 # Option C: install or update the native Claude Code/Codex plugin
-#   npx github:dyphn1/Harness-everything plugin-sync
-#   ./scripts/plugin-sync.sh              # POSIX shells / Git Bash
-#   powershell -File scripts/plugin-sync.ps1  # Windows PowerShell
+#   npx github:dyphn1/Harness-everything plugin-sync       # POSIX shells / Git Bash
+#   npx.cmd github:dyphn1/Harness-everything plugin-sync   # Windows PowerShell
+#   ./scripts/plugin-sync.sh                               # POSIX shells / Git Bash
+#   node scripts/plugin-sync.js                            # Windows-safe direct entry
 
 # OpenAI/Codex local plugin packaging is repository-owned under:
 #   .agents/plugins/marketplace.json
@@ -69,6 +71,8 @@ npx github:dyphn1/Harness-everything install
 # See docs/openai-plugin.md for local import/install and public Skills-only submission.
 ```
 
+**Windows PowerShell:** use npm-family `.cmd` shims such as `npx.cmd` rather than weakening `ExecutionPolicy`. When reading Harness Markdown from Windows PowerShell 5.1, specify UTF-8 explicitly, for example `Get-Content -Encoding UTF8 -Raw <path>`.
+
 ### Expected Behavior After Installation:
 1. **Use the selected surface's real mechanism:** Claude Code hooks, the local OpenAI plugin lifecycle hooks, OpenCode's plugin API, or advisory instructions depending on what you installed.
 2. **Preflight / session context where packaged:** Hook-capable surfaces can inject environment/session context automatically; advisory-only surfaces must not be described as if they do.
@@ -100,9 +104,15 @@ The native `plugin-sync` command detects the installed host CLIs and applies the
 The installer records its state directories in `.git/info/exclude` — a local-only git ignore file — so Harness state never lands in a commit and your working tree (including `.gitignore`) is never modified. Everything owned by the general installer is removed with the built-in uninstaller:
 
 ```bash
-npx github:dyphn1/Harness-everything uninstall            # interactive
-npx github:dyphn1/Harness-everything uninstall --local --skills -y   # non-interactive, workspace only
-npx github:dyphn1/Harness-everything uninstall --global   # also remove Harness-owned global state
+# POSIX shells / Git Bash
+npx github:dyphn1/Harness-everything uninstall
+npx github:dyphn1/Harness-everything uninstall --local --skills -y
+npx github:dyphn1/Harness-everything uninstall --global
+
+# Windows PowerShell
+npx.cmd github:dyphn1/Harness-everything uninstall
+npx.cmd github:dyphn1/Harness-everything uninstall --local --skills -y
+npx.cmd github:dyphn1/Harness-everything uninstall --global
 ```
 
 ---

package/bin/cli.js

@@ -55,6 +55,11 @@ Harness OS - AI Agent Operating System CLI
 
 Usage:
   npx github:dyphn1/Harness-everything <command> [options]
+  npx.cmd github:dyphn1/Harness-everything <command> [options]  # Windows PowerShell
+
+Windows PowerShell note:
+  Use npx.cmd so restrictive ExecutionPolicy cannot redirect this command to npx.ps1.
+  Harness does not require changing ExecutionPolicy.
   
 Commands:
   install            Install Harness OS hooks & skills into the local repository

package/ci/mechanism-2w-platform-compatibility.test.js

@@ -152,7 +152,46 @@ try {
   fs.rmSync(tempOutput.replace(/\.zip$/i, '') + '.manifest.json', { force: true });
 }
 
+// Windows PowerShell 5.1 treats BOM-less UTF-8 as a legacy code page when
+// Get-Content has no explicit encoding, and resolves bare npm-family commands
+// to .ps1 shims before .cmd. The routing skill is the agent-facing boundary
+// that must prevent both failures before Harness itself starts.
+const canonicalHarnessSkill = fs.readFileSync(path.join(ROOT, 'harness-everything', 'SKILL.md'), 'utf8');
+const packagedHarnessSkill = fs.readFileSync(path.join(ROOT, 'plugins', 'harness-everything', 'skills', 'harness-everything', 'SKILL.md'), 'utf8');
+assert.match(canonicalHarnessSkill, /Windows PowerShell/);
+assert.match(canonicalHarnessSkill, /npx\.cmd/);
+assert.match(canonicalHarnessSkill, /Get-Content -Encoding UTF8 -Raw/);
+assert.strictEqual(packagedHarnessSkill, canonicalHarnessSkill, 'packaged Harness skill must preserve the Windows shell contract byte-for-text');
+assert.match(canonicalHarnessSkill, /—/u, 'UTF-8 em dash must remain intact');
+assert.match(canonicalHarnessSkill, /🚦 Harness Status/u, 'UTF-8 Harness Status marker must remain intact');
+
+const readme = fs.readFileSync(path.join(ROOT, 'README.md'), 'utf8');
+assert.match(readme, /npx\.cmd github:dyphn1\/Harness-everything install/);
+assert.match(readme, /npx\.cmd github:dyphn1\/Harness-everything uninstall/);
+assert.match(readme, /npx\.cmd github:dyphn1\/Harness-everything uninstall --local --skills -y/);
+assert.match(readme, /npx\.cmd github:dyphn1\/Harness-everything uninstall --global/);
+assert.match(readme, /Get-Content -Encoding UTF8 -Raw/);
+assert.doesNotMatch(readme, /powershell -File scripts\/plugin-sync\.ps1/);
+
+const troubleshootingDocs = fs.readFileSync(path.join(ROOT, 'docs', 'troubleshooting.md'), 'utf8');
+for (const command of [
+  'install',
+  'install --global',
+  'uninstall',
+  'install --cursor',
+  'install --codex',
+  'plugin-sync --json'
+]) {
+  assert.ok(
+    troubleshootingDocs.includes(`npx.cmd github:dyphn1/Harness-everything ${command}`),
+    `troubleshooting must include Windows PowerShell form for: ${command}`
+  );
+}
+
 const capabilityDocs = fs.readFileSync(path.join(ROOT, 'docs', 'platform-capabilities.md'), 'utf8');
+assert.match(capabilityDocs, /npx\.cmd github:dyphn1\/Harness-everything plugin-sync/);
+assert.match(capabilityDocs, /node scripts\/plugin-sync\.js/);
+assert.doesNotMatch(capabilityDocs, /powershell -File scripts\/plugin-sync\.ps1/);
 assert.match(capabilityDocs, /platform-compatibility\.json/);
 assert.match(capabilityDocs, /Continue\.dev[\s\S]*`Unknown` for standalone `SKILL\.md` discovery/);
 assert.match(capabilityDocs, /live-host evidence|Partial` live-host loading/i);

package/docs/platform-capabilities.md

@@ -69,10 +69,15 @@ The package is tested at the mechanism layer and remains subject to the host’s
 The repository also ships a host-facing synchronization command for the native marketplace/plugin surfaces:
 
 ```bash
+# POSIX shells / Git Bash
 npx github:dyphn1/Harness-everything plugin-sync
 # or, from a checkout:
 ./scripts/plugin-sync.sh
-powershell -File scripts/plugin-sync.ps1
+
+# Windows PowerShell
+npx.cmd github:dyphn1/Harness-everything plugin-sync
+# or, from a checkout:
+node scripts/plugin-sync.js
 ```
 
 The command detects Claude Code and Codex independently, ensures the Harness marketplace is configured, reads the installed-plugin state, then refreshes that marketplace before choosing the operation:

package/docs/troubleshooting.md

@@ -9,6 +9,8 @@ This guide helps you resolve common issues with Harness OS installation and usag
 **Symptom:** `EACCES: permission denied` during installation
 
 **Solution:**
+
+POSIX shells / Git Bash:
 ```bash
 # Option 1: Install without sudo (recommended)
 npx github:dyphn1/Harness-everything install
@@ -22,6 +24,12 @@ npm config set prefix '~/.npm-global'
 export PATH=~/.npm-global/bin:$PATH
 ```
 
+Windows PowerShell:
+```powershell
+npx.cmd github:dyphn1/Harness-everything install
+npx.cmd github:dyphn1/Harness-everything install --global
+```
+
 ### Node.js Version Issues
 
 **Symptom:** `SyntaxError` or unsupported engine errors
@@ -93,11 +101,17 @@ which node
 # Check if hooks directory exists
 ls -la hooks/scripts/
 
-# Reinstall Harness
+# Reinstall Harness (POSIX shells / Git Bash)
 npx github:dyphn1/Harness-everything uninstall
 npx github:dyphn1/Harness-everything install
 ```
 
+Windows PowerShell:
+```powershell
+npx.cmd github:dyphn1/Harness-everything uninstall
+npx.cmd github:dyphn1/Harness-everything install
+```
+
 ### Circuit Breaker Tripping Too Often
 
 **Symptom:** `RULE OF 3 CIRCUIT BREAKER TRIGGERED!` frequently
@@ -129,8 +143,13 @@ Do not expect this Claude Code state file merely because Harness skills or an in
    ```
 2. If missing, reinstall with Cursor flag:
    ```bash
+   # POSIX shells / Git Bash
    npx github:dyphn1/Harness-everything install --cursor
    ```
+   ```powershell
+   # Windows PowerShell
+   npx.cmd github:dyphn1/Harness-everything install --cursor
+   ```
 3. Restart Cursor.
 
 ### Copilot Not Following Rules
@@ -156,8 +175,13 @@ Do not expect this Claude Code state file merely because Harness skills or an in
    ```
 2. Reinstall the advisory Codex target if needed:
    ```bash
+   # POSIX shells / Git Bash
    npx github:dyphn1/Harness-everything install --codex
    ```
+   ```powershell
+   # Windows PowerShell
+   npx.cmd github:dyphn1/Harness-everything install --codex
+   ```
 3. Remember that this is the instruction-oriented installer path. It is different from the **local OpenAI plugin** package described below.
 
 ### Codex / local OpenAI plugin not appearing
@@ -192,9 +216,15 @@ The local plugin mechanically injects the session policy and invariant-first rou
 For the native host install/update path, run:
 
 ```bash
+# POSIX shells / Git Bash
 npx github:dyphn1/Harness-everything plugin-sync --json
 ```
 
+```powershell
+# Windows PowerShell
+npx.cmd github:dyphn1/Harness-everything plugin-sync --json
+```
+
 The command installs only when the plugin is absent. An installed Claude plugin uses the explicit Claude update command; an installed Codex plugin uses marketplace upgrade. If plugin state cannot be read, synchronization stops without re-adding or overwriting the plugin.
 
 Host CLIs differ in which options and subcommands they implement, so the synchronizer degrades instead of failing:

package/harness-everything/SKILL.md

@@ -4,35 +4,32 @@ description: "Route software/project work through Harness: classify tier/topolog
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.30.3
+  version: 0.30.5
 ---
 
 # Harness Everything
 
-Kernel routing entry.
-
 ## USE FOR:
 - Software/project triage, routing, re-routing, workflow selection.
-- Work that names or matches another skill.
+- Work naming or matching another skill.
 
 ## DO NOT USE FOR:
 - General Q&A or non-software writing.
 
 ## Invariants
-1. **Route (MUST)** — establish scope/tier and selected/deferred topology.
-2. **Verify (MUST)** — completion claims need objective evidence; `verify-gate.js --json` distinguishes passed, failed, discovered-but-unrun, and absent project checks.
+1. **Route (MUST)** — scope/tier plus selected/deferred topology.
+2. **Verify (MUST)** — objective evidence via `verify-gate.js --json`.
 3. **Zoom out (MUST)** — after 3 same-signature failures, use `zoom-out`.
-4. **Resolve suggestions (MUST)** — read/evaluate each suggested `SKILL.md`; applicable core contracts MUST run, otherwise retain a flow-grounded reason.
-5. **Surface status (MUST)** — non-trivial work renders `### 🚦 Harness Status` with bold `Current`, `Read / Evidence`, `Next`; optional `Risk / Blocked`.
-6. **Keep agency** — required obligations are MUST; tactics MAY adapt. Numeric planning values MAY guide, never hard-stop.
+4. **Resolve suggestions (MUST)** — evaluate each suggested `SKILL.md`; run applicable core contracts or retain a flow-grounded reason.
+5. **Surface status (MUST)** — non-trivial work renders `### 🚦 Harness Status` with bold `Current`, `Read / Evidence`, `Next`; `Risk / Blocked` optional.
+6. **Keep agency** — required obligations are MUST; tactics MAY adapt. Numeric planning MAY guide, never hard-stop; only Rule-of-3 reflection and explicit user/host permission boundaries may block.
+7. **Windows PowerShell (MUST)** — `Get-Content -Encoding UTF8 -Raw`; npm `.cmd` shims (`npx.cmd`); never weaken `ExecutionPolicy`.
 
 ## Workflow
 1. Reuse kernel output or run `node "<this-skill-dir>/scripts/kernel-router.js" "<prompt summary>"`.
 2. Keep the routing checkpoint internal.
-3. Resolve each suggestion as `use`, `not-applicable`, or `unresolved`; `use` follows its core contract.
-4. Resolve selected-topology required invariants/stages/checks before completion.
-5. Tier-3/Fable broad mutation MUST resolve isolation: linked worktree or explicit degraded fallback.
-
-**Rule:** semantic MUST is not hard blocking; only Rule-of-3 reflection and explicit user/host permission boundaries may block.
+3. Resolve suggestions as `use`, `not-applicable`, or `unresolved`.
+4. Complete selected-topology invariants/stages/checks.
+5. Tier-3/Fable broad mutation MUST use a linked worktree or explicit degraded fallback.
 
 Deep dive: <this-skill-dir>/references/triage-and-tiers.md

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.30.4",
+  "version": "0.30.5",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.30.4",
+  "version": "0.30.5",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.30.4",
+  "version": "0.30.5",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.30.4",
+  "version": "0.30.5",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/skills/harness-everything/SKILL.md

@@ -4,35 +4,32 @@ description: "Route software/project work through Harness: classify tier/topolog
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.30.3
+  version: 0.30.5
 ---
 
 # Harness Everything
 
-Kernel routing entry.
-
 ## USE FOR:
 - Software/project triage, routing, re-routing, workflow selection.
-- Work that names or matches another skill.
+- Work naming or matching another skill.
 
 ## DO NOT USE FOR:
 - General Q&A or non-software writing.
 
 ## Invariants
-1. **Route (MUST)** — establish scope/tier and selected/deferred topology.
-2. **Verify (MUST)** — completion claims need objective evidence; `verify-gate.js --json` distinguishes passed, failed, discovered-but-unrun, and absent project checks.
+1. **Route (MUST)** — scope/tier plus selected/deferred topology.
+2. **Verify (MUST)** — objective evidence via `verify-gate.js --json`.
 3. **Zoom out (MUST)** — after 3 same-signature failures, use `zoom-out`.
-4. **Resolve suggestions (MUST)** — read/evaluate each suggested `SKILL.md`; applicable core contracts MUST run, otherwise retain a flow-grounded reason.
-5. **Surface status (MUST)** — non-trivial work renders `### 🚦 Harness Status` with bold `Current`, `Read / Evidence`, `Next`; optional `Risk / Blocked`.
-6. **Keep agency** — required obligations are MUST; tactics MAY adapt. Numeric planning values MAY guide, never hard-stop.
+4. **Resolve suggestions (MUST)** — evaluate each suggested `SKILL.md`; run applicable core contracts or retain a flow-grounded reason.
+5. **Surface status (MUST)** — non-trivial work renders `### 🚦 Harness Status` with bold `Current`, `Read / Evidence`, `Next`; `Risk / Blocked` optional.
+6. **Keep agency** — required obligations are MUST; tactics MAY adapt. Numeric planning MAY guide, never hard-stop; only Rule-of-3 reflection and explicit user/host permission boundaries may block.
+7. **Windows PowerShell (MUST)** — `Get-Content -Encoding UTF8 -Raw`; npm `.cmd` shims (`npx.cmd`); never weaken `ExecutionPolicy`.
 
 ## Workflow
 1. Reuse kernel output or run `node "<this-skill-dir>/scripts/kernel-router.js" "<prompt summary>"`.
 2. Keep the routing checkpoint internal.
-3. Resolve each suggestion as `use`, `not-applicable`, or `unresolved`; `use` follows its core contract.
-4. Resolve selected-topology required invariants/stages/checks before completion.
-5. Tier-3/Fable broad mutation MUST resolve isolation: linked worktree or explicit degraded fallback.
-
-**Rule:** semantic MUST is not hard blocking; only Rule-of-3 reflection and explicit user/host permission boundaries may block.
+3. Resolve suggestions as `use`, `not-applicable`, or `unresolved`.
+4. Complete selected-topology invariants/stages/checks.
+5. Tier-3/Fable broad mutation MUST use a linked worktree or explicit degraded fallback.
 
 Deep dive: <this-skill-dir>/references/triage-and-tiers.md

package/sbom.cdx.json

@@ -2,23 +2,23 @@
   "$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.7",
-  "serialNumber": "urn:uuid:29356e45-bc4a-52e1-86a1-e76ba7221fbe",
+  "serialNumber": "urn:uuid:681ee313-d384-5851-8f3a-9ec7af56fc28",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-01T08:19:06.883Z",
+    "timestamp": "2026-10-06T03:46:28.900Z",
     "tools": [
       {
         "vendor": "Harness Everything",
         "name": "generate-sbom.js",
-        "version": "0.30.4"
+        "version": "0.30.5"
       }
     ],
     "component": {
       "type": "application",
-      "bom-ref": "pkg:npm/harness-everything@0.30.4",
+      "bom-ref": "pkg:npm/harness-everything@0.30.5",
       "name": "harness-everything",
-      "version": "0.30.4",
-      "purl": "pkg:npm/harness-everything@0.30.4"
+      "version": "0.30.5",
+      "purl": "pkg:npm/harness-everything@0.30.5"
     }
   },
   "components": [
@@ -1999,7 +1999,7 @@
       ]
     },
     {
-      "ref": "pkg:npm/harness-everything@0.30.4",
+      "ref": "pkg:npm/harness-everything@0.30.5",
       "dependsOn": [
         "pkg:npm/%40commitlint/cli@19.8.1",
         "pkg:npm/%40commitlint/config-conventional@19.8.1",