harness-everything 0.30.9 → 0.31.0

package/ci/mechanism-2aq-fable-stage-bindings.test.js

@@ -0,0 +1,168 @@
+#!/usr/bin/env node
+'use strict';
+
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-fable-stage-bindings-'));
+const stateHome = path.join(tempRoot, 'state-home');
+const workspace = path.join(tempRoot, 'workspace');
+fs.mkdirSync(path.join(workspace, '.git'), { recursive: true });
+fs.mkdirSync(path.join(workspace, 'tdd'), { recursive: true });
+fs.mkdirSync(path.join(workspace, 'docs'), { recursive: true });
+fs.writeFileSync(path.join(workspace, 'tdd', 'SKILL.md'), '# TDD\n');
+fs.writeFileSync(path.join(workspace, 'docs', 'architecture.md'), '# Architecture\n');
+process.env.HARNESS_STATE_HOME = stateHome;
+
+const { prepareRun } = require(path.join(ROOT, 'fable-mode', 'scripts', 'workflow-plan-consumer.js'));
+const { getSessionDir } = require(path.join(ROOT, 'hooks', 'scripts', 'lib', 'harness-state.js'));
+const controller = path.join(ROOT, 'hooks', 'scripts', 'workflow-disposition.js');
+const contractTest = path.join(ROOT, 'hooks', 'scripts', 'contract-test.js');
+const stopGate = path.join(ROOT, 'hooks', 'scripts', 'workflow-stop-gate.js');
+const workflowGate = path.join(ROOT, 'hooks', 'scripts', 'workflow-gate.js');
+const kernelRouter = path.join(ROOT, 'harness-everything', 'scripts', 'kernel-router.js');
+const sessionId = 'issue297-fable-bindings';
+const workflowId = 'workflow-issue297-fable';
+const plan = { workflowPlan: { strategySelection: 'selected', strategy: 'fable-staged', tier: 'tier3' } };
+const run = prepareRun({
+  routerContract: plan,
+  workspaceRoot: workspace,
+  runId: 'issue297-stage-bindings',
+  sessionId,
+  workflowId,
+  stages: [{
+    stageId: 'implement', goal: 'implement a bounded change', agent: 'fable-worker-sonnet', task: 'use declared guidance and verify',
+    dependsOn: [], writeSet: ['src/change.js'], inputs: [], expectedOutputs: ['src/change.js'],
+    requiredBindings: [{ id: 'tdd', path: 'tdd/SKILL.md' }],
+    optionalBindings: [{ id: 'architecture-reference', path: 'docs/architecture.md' }],
+    checkCommand: 'node fixture-check.js', passCondition: 'exit 0',
+  }, {
+    stageId: 'verify', goal: 'verify the implementation', agent: 'fable-verifier', task: 'independently check the implementation',
+    dependsOn: ['implement'], writeSet: [], inputs: ['src/change.js'], expectedOutputs: ['verification evidence'],
+    requiredBindings: [{ id: 'verification-loop', path: 'verification-loop/SKILL.md' }],
+    checkCommand: 'node verifier-check.js', passCondition: 'exit 0',
+  }],
+});
+
+const sessionDir = getSessionDir(workspace, sessionId);
+fs.writeFileSync(path.join(sessionDir, 'workflow-run.json'), JSON.stringify({
+  schemaVersion: 2, sessionId, workflowId, state: 'running', strategy: 'fable-staged', tier: 'tier3', revision: 1,
+  workflowPlan: { strategySelection: 'selected', strategy: 'fable-staged', tier: 'tier3', verification: { independent: false } },
+  runId: run.runId, escapes: [],
+}, null, 2));
+
+function runNode(script, args, payload, cwd = workspace) {
+  return spawnSync(process.execPath, [script, ...(args || [])], {
+    cwd,
+    encoding: 'utf8',
+    input: payload ? JSON.stringify(payload) : undefined,
+    env: { ...process.env, HARNESS_STATE_HOME: stateHome },
+  });
+}
+function readJson(file) { return JSON.parse(fs.readFileSync(file, 'utf8')); }
+function check(condition, message) {
+  if (!condition) throw new Error('FAIL ' + message);
+  console.log('  PASS ' + message);
+}
+function runCheck() {
+  return runNode(contractTest, [], {
+    tool_name: 'Bash', session_id: sessionId, cwd: workspace, worker_id: 'worker-1',
+    tool_input: { command: 'node fixture-check.js' },
+    tool_response: { stdout: 'fixture check passed', exitCode: 0 },
+  });
+}
+
+try {
+  console.log('=== #297 Fable active-stage bindings ===');
+  const firstCheck = runCheck();
+  check(firstCheck.status === 0, 'post-tool check hook remains fail-open');
+  const contractFile = path.join(run.runRoot, 'contracts', 'implement.json');
+  let contract = readJson(contractFile);
+  check(contract.status === 'binding-unresolved' && contract.unresolvedBindings.join(',') === 'tdd,architecture-reference',
+    'a successful check does not pass a stage while its declared bindings remain unresolved');
+  const firstEvidence = readJson(path.join(run.runRoot, 'evidence', 'implement.json'));
+  check(firstEvidence.checkStatus === 'pass' && firstEvidence.status === 'binding-unresolved',
+    'check success and unresolved binding status are recorded separately');
+  const notification = runNode(kernelRouter, [], {
+    hook_event_name: 'UserPromptSubmit', session_id: sessionId, cwd: workspace,
+    prompt: '<task-notification><task-id>issue297-stage-reminder</task-id><status>completed</status></task-notification>',
+  });
+  check(notification.status === 0 && notification.stdout.includes('Active Fable stage: implement'), 'retained Fable notification shows the current stage');
+  check(notification.stdout.includes('tdd/SKILL.md') && notification.stdout.includes('docs/architecture.md'), 'retained Fable notification shows only current-stage bindings');
+  check(!notification.stdout.includes('verification-loop/SKILL.md') && !notification.stdout.includes('ROUTER WORKFLOW PLAN (JSON)'),
+    'retained Fable notification hides future bindings and avoids repeating the full plan');
+
+  const ordinaryTool = runNode(workflowGate, [], {
+    tool_name: 'Write', session_id: sessionId, cwd: workspace,
+    tool_input: { file_path: path.join(workspace, 'src', 'change.js'), content: 'change' },
+  });
+  check(ordinaryTool.status === 0, 'unresolved Fable bindings do not hard-block ordinary mutation tools');
+  const stop = runNode(stopGate, [], { hook_event_name: 'Stop', session_id: sessionId, cwd: workspace });
+  check(stop.status === 0, 'unresolved Fable bindings do not hard-block Stop');
+  const workflow = readJson(path.join(sessionDir, 'workflow-run.json'));
+  check(workflow.state === 'running' && workflow.unresolved.some(value => value.startsWith('implement:binding-unresolved:')),
+    'Stop exposes the binding gap without locking the workflow');
+
+  const loaded = runNode(controller, [
+    'stage-binding', '--session-id', sessionId, '--stage-id', 'implement', '--binding-id', 'tdd',
+    '--disposition', 'loaded', '--evidence', 'Read tdd/SKILL.md before implementation.',
+  ]);
+  check(loaded.status === 0 && JSON.parse(loaded.stdout).binding.status === 'loaded', 'active required stage binding can be explicitly resolved');
+  contract = readJson(contractFile);
+  check(contract.status === 'binding-unresolved', 'resolving one binding does not pass the stage while an optional binding is undecided');
+
+  const notNeeded = runNode(controller, [
+    'stage-binding', '--session-id', sessionId, '--stage-id', 'implement', '--binding-id', 'architecture-reference',
+    '--disposition', 'not-needed', '--evidence', 'The implementation does not touch documented architecture.',
+  ]);
+  check(notNeeded.status === 0 && JSON.parse(notNeeded.stdout).binding.status === 'not-needed', 'optional binding can be explicitly declined with evidence');
+  const finalCheck = runCheck();
+  check(finalCheck.status === 0, 'stage check remains callable after binding resolution');
+  check(finalCheck.stdout.includes('verification-loop/SKILL.md'), 'successful stage check discloses the newly dependency-ready verifier binding');
+  contract = readJson(contractFile);
+  check(contract.status === 'pass' && contract.unresolvedBindings.length === 0, 'stage passes only after check and binding dispositions both resolve');
+  const finalEvidence = readJson(path.join(run.runRoot, 'evidence', 'implement.json'));
+  check(finalEvidence.status === 'pass' && finalEvidence.exitCode === 0, 'passing stage retains correlated check evidence');
+  const implementContract = readJson(contractFile);
+  const sameFile = (left, right) => fs.realpathSync(left).toLowerCase() === fs.realpathSync(right).toLowerCase();
+  check(implementContract.requiredBindings[0].availability === 'available' &&
+    sameFile(implementContract.requiredBindings[0].resolvedPath, path.join(ROOT, 'tdd', 'SKILL.md')),
+    'packaged skill binding resolves to the installed Harness skill at run preparation');
+  check(implementContract.optionalBindings[0].availability === 'available' &&
+    sameFile(implementContract.optionalBindings[0].resolvedPath, path.join(workspace, 'docs', 'architecture.md')),
+    'workspace reference binding resolves to the workspace file, not the Harness copy');
+
+  const ghostSession = 'pr303-fable-missing-binding';
+  const ghostRun = prepareRun({
+    routerContract: plan, workspaceRoot: workspace, runId: 'pr303-missing-stage-binding', sessionId: ghostSession, workflowId,
+    stages: [{
+      stageId: 'ghost', goal: 'use a missing reference', agent: 'fable-worker-sonnet', task: 'load a reference that does not exist',
+      dependsOn: [], writeSet: ['src/ghost.js'], inputs: [], expectedOutputs: ['src/ghost.js'],
+      requiredBindings: [{ id: 'ghost-reference', path: 'docs/pr303-ghost.md' }],
+      checkCommand: 'node ghost-check.js', passCondition: 'exit 0',
+    }],
+  });
+  const ghostContractFile = path.join(ghostRun.runRoot, 'contracts', 'ghost.json');
+  check(readJson(ghostContractFile).requiredBindings[0].availability === 'missing',
+    'a declared stage path with no file is recorded as missing, not available');
+  fs.writeFileSync(path.join(getSessionDir(workspace, ghostSession), 'workflow-run.json'), JSON.stringify({
+    schemaVersion: 2, sessionId: ghostSession, workflowId, state: 'running', strategy: 'fable-staged', tier: 'tier3', revision: 1,
+    workflowPlan: { strategySelection: 'selected', strategy: 'fable-staged', tier: 'tier3', verification: { independent: false } },
+    runId: ghostRun.runId, escapes: [],
+  }, null, 2));
+  const ghostLoad = runNode(controller, [
+    'stage-binding', '--session-id', ghostSession, '--stage-id', 'ghost', '--binding-id', 'ghost-reference',
+    '--disposition', 'loaded', '--evidence', 'claimed to read the ghost reference',
+  ]);
+  const ghostBinding = readJson(ghostContractFile).requiredBindings[0];
+  check(ghostLoad.status === 0 && ghostBinding.status === 'unavailable' && ghostBinding.reasonCode === 'binding-path-missing',
+    'a missing stage binding cannot be recorded as loaded');
+  console.log('PASS: #297 Fable stage binding gate mechanics');
+} finally {
+  if (!tempRoot.startsWith(path.join(os.tmpdir(), 'harness-fable-stage-bindings-'))) throw new Error('unsafe fixture cleanup');
+  fs.rmSync(tempRoot, { recursive: true, force: true });
+}

package/ci/mechanism-2ar-binding-resolution.test.js

@@ -0,0 +1,211 @@
+#!/usr/bin/env node
+'use strict';
+
+// PR #303 review: binding availability must come from a real readable file
+// under the workspace or an installed skill root, and self-evolved skills stay
+// discoverable as metadata-only ids until their declaring step is active.
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+const stateHome = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-binding-resolution-'));
+const fakeHome = path.join(stateHome, 'home');
+fs.mkdirSync(fakeHome, { recursive: true });
+delete process.env.CLAUDE_PLUGIN_ROOT;
+delete process.env.PLUGIN_ROOT;
+process.env.HARNESS_STATE_HOME = stateHome;
+process.env.HOME = fakeHome;
+process.env.USERPROFILE = fakeHome;
+
+const kernel = path.join(ROOT, 'harness-everything/scripts/kernel-router.js');
+const tierRouter = path.join(ROOT, 'harness-everything/scripts/tier-router.js');
+const controller = path.join(ROOT, 'hooks/scripts/workflow-disposition.js');
+
+let failed = 0;
+function check(condition, message) {
+  if (condition) console.log('  PASS ' + message);
+  else { console.error('  FAIL ' + message); failed++; }
+}
+function run(script, args, workspace, input = null) {
+  return spawnSync(process.execPath, [script, ...args], {
+    cwd: workspace,
+    encoding: 'utf8',
+    input: input === null ? undefined : JSON.stringify(input),
+    env: { ...process.env, HARNESS_WORKSPACE_ROOT: workspace },
+  });
+}
+function responseOf(result) {
+  try { return JSON.parse(result.stdout || ''); } catch (_) { return null; }
+}
+function sessionFile(workspace, sessionId, payload, name) {
+  const { getSessionDir } = require(path.join(ROOT, 'hooks/scripts/lib/harness-state.js'));
+  return path.join(getSessionDir(workspace, sessionId, payload), name);
+}
+function readJson(file) { return JSON.parse(fs.readFileSync(file, 'utf8')); }
+function samePath(left, right) {
+  if (!left || !right) return false;
+  const real = value => { try { return fs.realpathSync(value); } catch (_) { return path.resolve(value); } };
+  return real(left).toLowerCase() === real(right).toLowerCase();
+}
+
+console.log('=== PR #303 binding resolution ===');
+
+// 1. Declared paths: syntax alone is not availability.
+const missingSession = 'pr303-missing-binding';
+const missingPayload = { session_id: missingSession, cwd: ROOT, prompt: 'Fix this checkout bug and add a regression test.' };
+check(run(kernel, [], ROOT, missingPayload).status === 0, 'Tier 2 route persists for declared-path coverage');
+const missingRequirements = JSON.stringify([
+  {
+    id: 'req-change', stepType: 'behavior-change', summary: 'Correct the checkout behavior', acceptance: 'the behavior is corrected',
+    requiredBindings: [{ id: 'domain-reference', path: 'docs/pr303-missing-reference.md' }],
+    optionalBindings: [{ id: 'routing-reference', path: 'docs/routing.md' }],
+  },
+  { id: 'req-verify', stepType: 'verification', summary: 'Verify the change', acceptance: 'verification evidence is recorded' },
+]);
+check(run(controller, [
+  'plan', '--session-id', missingSession, '--requirements-json', missingRequirements,
+  '--strategy', 'iterative-single', '--evidence', 'behavior change then verification',
+], ROOT).status === 0, 'plan with a missing declared path is still recorded');
+const obligationsFile = sessionFile(ROOT, missingSession, missingPayload, 'workflow-obligations.json');
+let state = readJson(obligationsFile);
+const missingBinding = state.requirements[0].requiredBindings.find(item => item.id === 'domain-reference');
+const presentBinding = state.requirements[0].optionalBindings.find(item => item.id === 'routing-reference');
+check(missingBinding.availability === 'missing' && missingBinding.resolvedPath === null,
+  'a declared path with no file is recorded as missing, not available');
+check(presentBinding.availability === 'available' && samePath(presentBinding.resolvedPath, path.join(ROOT, 'docs/routing.md')),
+  'a declared path that exists resolves to its readable file');
+check(run(controller, ['start', '--session-id', missingSession], ROOT).status === 0, 'workflow starts with a visible missing binding');
+const missingLoad = run(controller, [
+  'binding', '--session-id', missingSession, '--step-id', 'req-change', '--binding-id', 'domain-reference',
+  '--disposition', 'loaded', '--evidence', 'claimed to read the reference',
+], ROOT);
+check(missingLoad.status !== 0, 'a missing required binding cannot be marked loaded');
+state = readJson(obligationsFile);
+const afterLoad = state.requirements[0].requiredBindings.find(item => item.id === 'domain-reference');
+check(afterLoad.status === 'unavailable' && afterLoad.reasonCode === 'binding-path-missing',
+  'the failed load leaves the required binding visibly unavailable');
+check(run(controller, [
+  'step', '--session-id', missingSession, '--step-id', 'req-change', '--disposition', 'pass', '--evidence', 'done',
+], ROOT).status !== 0, 'the step cannot pass while its required binding is unresolved');
+check(run(controller, [
+  'binding', '--session-id', missingSession, '--step-id', 'req-change', '--binding-id', 'routing-reference',
+  '--disposition', 'loaded', '--evidence', 'read the routing reference',
+], ROOT).status === 0, 'an existing optional binding can be loaded');
+
+// 2. Deployed plugin layouts resolve built-in skill bindings.
+const emptyWorkspace = fs.mkdtempSync(path.join(stateHome, 'empty-workspace-'));
+const canonicalResolver = require(path.join(ROOT, 'hooks/scripts/lib/binding-resolver.js'));
+const canonical = canonicalResolver.resolveBinding({ id: 'tdd', path: 'tdd/SKILL.md' }, emptyWorkspace);
+check(canonical.availability === 'available' && samePath(canonical.file, path.join(ROOT, 'tdd/SKILL.md')),
+  'repository/Claude plugin layout resolves tdd/SKILL.md at the package root');
+const codexResolverPath = path.join(ROOT, 'plugins/harness-everything/hooks/scripts/lib/binding-resolver.js');
+check(fs.existsSync(codexResolverPath), 'Codex plugin package ships the binding resolver');
+if (fs.existsSync(codexResolverPath)) {
+  const packaged = require(codexResolverPath).resolveBinding({ id: 'tdd', path: 'tdd/SKILL.md' }, emptyWorkspace);
+  check(packaged.availability === 'available' &&
+    samePath(packaged.file, path.join(ROOT, 'plugins/harness-everything/skills/tdd/SKILL.md')),
+    'Codex plugin layout resolves tdd/SKILL.md under its skills/ root');
+}
+const absent = canonicalResolver.resolveBinding({ id: 'nowhere', path: 'nowhere/SKILL.md' }, emptyWorkspace);
+check(absent.availability === 'missing', 'a path absent from workspace and package roots is missing');
+
+// 2b. A workspace reference never falls back to a same-named Harness file.
+check(fs.existsSync(path.join(ROOT, 'docs/architecture.md')), 'fixture precondition: Harness ships docs/architecture.md');
+const collision = canonicalResolver.resolveBinding({ id: 'architecture-reference', path: 'docs/architecture.md' }, emptyWorkspace);
+check(collision.availability === 'missing' && collision.file === null,
+  'a missing workspace reference does not resolve to the Harness package copy');
+const packagedSkill = canonicalResolver.resolveBinding({ id: 'verification-loop', path: 'verification-loop/SKILL.md' }, emptyWorkspace);
+check(packagedSkill.availability === 'available', 'a skill id naming its own SKILL.md still resolves from the package');
+const disguised = canonicalResolver.resolveBinding({ id: 'tdd', path: 'docs/architecture.md' }, emptyWorkspace);
+check(disguised.availability === 'missing', 'a registered id at an unregistered path is treated as a workspace reference');
+
+const collisionSession = 'pr303-collision-binding';
+const collisionPayload = { session_id: collisionSession, cwd: emptyWorkspace, prompt: 'Fix this checkout bug and add a regression test.' };
+check(run(kernel, [], emptyWorkspace, collisionPayload).status === 0, 'Tier 2 route persists in a client workspace');
+check(run(controller, [
+  'plan', '--session-id', collisionSession, '--requirements-json', JSON.stringify([
+    { id: 'req-change', stepType: 'behavior-change', summary: 'Change behavior', acceptance: 'changed',
+      requiredBindings: [{ id: 'architecture-reference', path: 'docs/architecture.md' }] },
+    { id: 'req-verify', stepType: 'verification', summary: 'Verify', acceptance: 'verified' },
+  ]),
+  '--strategy', 'iterative-single', '--evidence', 'client workspace without its own architecture doc',
+], emptyWorkspace).status === 0, 'client plan declares a workspace reference that collides with a Harness file');
+const collisionState = readJson(sessionFile(emptyWorkspace, collisionSession, collisionPayload, 'workflow-obligations.json'));
+check(collisionState.requirements[0].requiredBindings.find(item => item.id === 'architecture-reference').availability === 'missing',
+  'step flow records the colliding workspace reference as missing');
+check(run(controller, ['start', '--session-id', collisionSession], emptyWorkspace).status === 0, 'client workflow starts');
+check(run(controller, [
+  'binding', '--session-id', collisionSession, '--step-id', 'req-change', '--binding-id', 'architecture-reference',
+  '--disposition', 'loaded', '--evidence', 'claimed to read the architecture doc',
+], emptyWorkspace).status !== 0, 'step flow cannot load the Harness copy as the workspace reference');
+
+const { prepareRun } = require(path.join(ROOT, 'fable-mode/scripts/workflow-plan-consumer.js'));
+const stageRun = prepareRun({
+  routerContract: { workflowPlan: { strategySelection: 'selected', strategy: 'fable-staged', tier: 'tier3' } },
+  workspaceRoot: emptyWorkspace, runId: 'pr303-collision-stage', sessionId: 'pr303-collision-stage',
+  stages: [{
+    stageId: 'design', goal: 'design', agent: 'fable-worker-sonnet', task: 'use the architecture doc',
+    dependsOn: [], writeSet: [], inputs: [], expectedOutputs: ['notes'],
+    requiredBindings: [{ id: 'architecture-reference', path: 'docs/architecture.md' }],
+    checkCommand: 'node check.js', passCondition: 'exit 0',
+  }],
+});
+const stageBinding = readJson(path.join(stageRun.runRoot, 'contracts', 'design.json')).requiredBindings[0];
+check(stageBinding.availability === 'missing' && stageBinding.resolvedPath === null,
+  'stage flow records the colliding workspace reference as missing');
+
+// 3. Self-evolved skills: ids at routing time, file only at the active step.
+const workspace = fs.mkdtempSync(path.join(stateHome, 'generated-workspace-'));
+const generatedDir = path.join(workspace, '.claude', 'harness-everything', 'skills', 'generated', 'flaky-retry-lesson');
+fs.mkdirSync(generatedDir, { recursive: true });
+fs.writeFileSync(path.join(generatedDir, 'SKILL.md'), '---\nname: flaky-retry-lesson\n---\n# Flaky retry lesson\n');
+fs.writeFileSync(path.join(workspace, '.claude', 'harness-everything', 'manifest.json'), JSON.stringify({
+  package: 'harness-everything',
+  generated: [{ id: 'flaky-retry-lesson', dirPath: generatedDir, description: 'Retry lesson', triggers: ['flaky', 'retry'] }],
+}));
+
+const prompt = 'Fix the flaky retry handling in the payment client and add a regression test.';
+const routed = run(tierRouter, [prompt], workspace);
+check(routed.status === 0, 'router runs against a workspace with a generated-skill manifest');
+check(routed.stdout.includes('SELF-EVOLVED SKILL SIGNALS (STEP INPUT ONLY): flaky-retry-lesson'),
+  'matching self-evolved skill surfaces as a metadata-only id');
+check(!routed.stdout.includes(generatedDir) && !routed.stdout.includes('flaky-retry-lesson/SKILL.md'),
+  'router does not disclose the generated skill path or text');
+const unmatched = run(tierRouter, ['Rename the payment client constant.'], workspace);
+check(!unmatched.stdout.includes('SELF-EVOLVED SKILL SIGNALS'), 'unrelated prompts do not surface the generated skill');
+
+const genSession = 'pr303-generated-binding';
+const genPayload = { session_id: genSession, cwd: workspace, prompt };
+check(run(kernel, [], workspace, genPayload).status === 0, 'Tier 2 route persists in the generated-skill workspace');
+const genRequirements = JSON.stringify([
+  { id: 'req-fix', stepType: 'behavior-change', summary: 'Fix retry handling', acceptance: 'flaky retry no longer fails' },
+  { id: 'req-verify', stepType: 'verification', summary: 'Verify retry handling', acceptance: 'verification evidence recorded', optionalBindings: ['flaky-retry-lesson'] },
+]);
+check(run(controller, [
+  'plan', '--session-id', genSession, '--requirements-json', genRequirements,
+  '--strategy', 'iterative-single', '--evidence', 'fix then verify with the retry lesson',
+], workspace).status === 0, 'a step can declare the generated skill id as a binding');
+const genStart = responseOf(run(controller, ['start', '--session-id', genSession], workspace)) || {};
+check(genStart.activeStep?.id === 'req-fix' && !JSON.stringify(genStart).includes('flaky-retry-lesson'),
+  'the generated binding is not disclosed before its step is active');
+check(run(controller, [
+  'binding', '--session-id', genSession, '--step-id', 'req-fix', '--binding-id', 'tdd',
+  '--disposition', 'loaded', '--evidence', 'read the TDD contract',
+], workspace).status === 0, 'built-in TDD binding resolves from the package root outside the Harness repo');
+const advanced = responseOf(run(controller, [
+  'step', '--session-id', genSession, '--step-id', 'req-fix', '--disposition', 'pass', '--evidence', 'retry fix complete',
+], workspace)) || {};
+const generatedBinding = advanced.activeStep?.optionalBindings?.find(item => item.id === 'flaky-retry-lesson');
+check(advanced.activeStep?.id === 'req-verify' && generatedBinding?.availability === 'available' &&
+  samePath(generatedBinding.resolvedPath, path.join(generatedDir, 'SKILL.md')),
+  'the generated binding becomes available with its SKILL.md once its step is active');
+check(run(controller, [
+  'binding', '--session-id', genSession, '--step-id', 'req-verify', '--binding-id', 'flaky-retry-lesson',
+  '--disposition', 'loaded', '--evidence', 'read the retry lesson',
+], workspace).status === 0, 'the active generated binding can be loaded');
+
+fs.rmSync(stateHome, { recursive: true, force: true });
+console.log('\n' + (failed === 0 ? 'PASS' : 'FAIL') + ': PR #303 binding resolution (' + failed + ' failures)');
+process.exit(failed === 0 ? 0 : 1);

package/ci/mechanism-2w-platform-compatibility.test.js

@@ -85,6 +85,18 @@ for (const platform of matrix.platforms) {
     assert.ok(compliance.totalEdits > 0);
     assert.ok(fs.statSync(path.join(session, 'edit-state.json')).size > 0);
     assert.ok(fs.statSync(path.join(session, 'zoom-out-report.md')).size > 0);
+  } else if (platform.id === 'codex') {
+    const capability = platform.capabilities.liveHostVerification;
+    assert.strictEqual(capability.status, 'Partial');
+    assert.strictEqual(capability.evidence, 'benchmarks/results/live-host/codex-2026-10-13/README.md');
+    const artifactRoot = path.dirname(path.join(ROOT, capability.evidence));
+    for (const file of ['README.md', 'observation-records.json']) {
+      assert.ok(fs.statSync(path.join(artifactRoot, file)).size > 0, `Missing Codex evidence: ${file}`);
+    }
+    const evidence = JSON.parse(fs.readFileSync(path.join(artifactRoot, 'observation-records.json'), 'utf8'));
+    assert.strictEqual(evidence.format, 'harness-codex-live-observation-evidence-v1');
+    assert.strictEqual(evidence.turns.length, 2, 'Codex artifact must preserve both consecutive turns');
+    assert.ok(evidence.turns.every(turn => turn.host === 'codex' && turn.selfReportReason === null));
   } else {
     assert.strictEqual(platform.capabilities.liveHostVerification.status, 'Unknown', `${platform.id}: no preserved live evidence`);
   }

package/ci/mechanism-34-observations.test.js

@@ -58,6 +58,45 @@ test('commands are classified without keeping their text', () => {
   assert.strictEqual(lib.classifyCommand('cd x && git push'), 'git', 'the first recognizable segment decides');
 });
 
+test('detailed appends distinguish duplicates and bounded lock timeouts', () => {
+  const s = sandbox();
+  const record = {
+    id: 'append-detail-one',
+    host: 'codex',
+    turn: 1,
+    writer: { sessionId: 'append-detail-session' },
+    contentSha256: 'append-detail-content-one',
+  };
+  const options = { dedupeById: true, dedupeByTurn: true };
+  assert.deepStrictEqual(lib.appendRecordDetailed(s.store, record, { prompt: 'first' }, options), { status: 'appended' });
+  assert.strictEqual(lib.appendRecord(s.store, record, { prompt: 'first' }, options), false,
+    'the legacy boolean wrapper still reports a duplicate as false');
+  assert.deepStrictEqual(lib.appendRecordDetailed(s.store, {
+    ...record,
+    id: 'append-detail-ambiguous',
+    captureMethod: 'session-backfill',
+    writer: { sessionId: 'append-detail-session', turnId: 'turn-one' },
+    contentSha256: 'different-content-for-legacy-turn',
+  }, { prompt: 'uncertain match' }, options), { status: 'ambiguous' },
+  'a partial legacy live-turn match is checked under the append lock and remains distinct from an exact duplicate');
+
+  const lockPath = path.join(s.store, '.index.lock');
+  fs.writeFileSync(lockPath, 'held by deterministic fixture');
+  const blocked = lib.appendRecordDetailed(s.store, {
+    ...record,
+    id: 'append-detail-two',
+    turn: 2,
+    writer: { sessionId: 'append-detail-session', turnId: 'turn-two' },
+    contentSha256: 'append-detail-content-two',
+  }, { prompt: 'second' }, { ...options, lockTimeoutMs: 25 });
+  assert.deepStrictEqual(blocked, { status: 'lock-timeout' }, 'lock contention is distinct from a duplicate');
+  assert.strictEqual(lib.markSessionBackfillBehaviorUnobserved(s.store, { lockTimeoutMs: 25 }), null,
+    'migration reports lock acquisition failure consistently');
+  assert.strictEqual(JSON.parse(fs.readFileSync(path.join(s.store, 'observations-index.json'), 'utf8')).records.length, 1,
+    'a timed out append leaves no durable index record');
+  fs.unlinkSync(lockPath);
+});
+
 test('tier comes from the self-report, owner review overrides, behavior only flags contradictions', () => {
   assert.strictEqual(typeof lib.breadthTier, 'undefined', 'no file-count tier rule');
   assert.deepStrictEqual(lib.labelTier({ tier: 'tier2' }, null), { tier: 'tier2', source: 'self-report' });
@@ -222,6 +261,31 @@ test('exporter derives labels, splits by time and reports agreement', () => {
   assert(!fs.readFileSync(path.join(out, 'export-report.json'), 'utf8').includes('parser'), 'the report holds no text');
 });
 
+test('exporter can select post-cutoff rows with self-reported labels for training', () => {
+  const s = sandbox();
+  writeFixtureStore(s);
+  const indexFile = path.join(s.store, 'observations-index.json');
+  const index = JSON.parse(fs.readFileSync(indexFile, 'utf8'));
+  index.records[0].observedAt = '2026-09-26T23:59:59.000Z';
+  index.records.push({ ...index.records[1], id: 'missing-self-report', selfReport: null });
+  fs.writeFileSync(indexFile, JSON.stringify(index));
+  const out = path.join(s.dir, 'filtered-export');
+  const r = spawnSync('node', [EXPORTER, '--store', s.store, '--out', out, '--since', '2026-09-27', '--self-report-only'], {
+    encoding: 'utf8',
+    env: s.env,
+  });
+  assert.strictEqual(r.status, 0, r.stderr);
+  const prompts = fs.readFileSync(path.join(out, 'prompts-observed.jsonl'), 'utf8').trim().split('\n').map(JSON.parse);
+  const labels = fs.readFileSync(path.join(out, 'labels-observed.jsonl'), 'utf8').trim().split('\n').map(JSON.parse);
+  assert.strictEqual(prompts.length, 3);
+  assert.strictEqual(labels.length, 3);
+  assert(labels.every(label => label.validity && label.intents.length >= 0), 'only self-reported turns are included');
+  const report = JSON.parse(fs.readFileSync(path.join(out, 'export-report.json'), 'utf8'));
+  assert.strictEqual(report.since, '2026-09-27');
+  assert.strictEqual(report.selfReportOnly, true);
+  assert.strictEqual(report.skippedBeforeSince, 1);
+  assert.strictEqual(report.skippedUnlabeled, 1);
+});
 test('review page lists disagreements blind and owner decisions override', () => {
   const s = sandbox();
   writeFixtureStore(s);

package/ci/mechanism-35-verification-contract.test.js

@@ -16,7 +16,7 @@ function run(command, args, cwd, options = {}) {
   const result = spawnSync(command, args, {
     cwd,
     encoding: 'utf8',
-    env: { ...process.env, ...(options.env || {}) },
+    env: { ...process.env, HARNESS_SKIP_PROJECT_CHECKS: '', ...(options.env || {}) },
     timeout: options.timeout || 30000,
   });
   if (!options.allowFailure && result.status !== 0) {

package/ci/mutation-check.js

@@ -17,6 +17,7 @@ const checks = [
   ['unbound workspace identity', 'scripts/lib/workspace.js', 'ci/mechanism-2u-issue-42-regressions.test.js'],
   ['worktree submodule reachability', 'using-git-worktrees/scripts/submodule-reachability.js', 'ci/mechanism-34-worktree-submodule-reachability.test.js'],
   ['verification contract precedence', 'harness-everything/scripts/verify-gate.js', 'ci/mechanism-35-verification-contract.test.js'],
+  ['positive skill-eval relevance', 'harness-everything/scripts/tier-router.js', 'ci/skill-routing-check.js'],
 ];
 
 let failures = 0;
@@ -36,6 +37,7 @@ for (const [label, target, testFile] of checks) {
         'scripts/lib/workspace.js': 'workspace-identity',
         'using-git-worktrees/scripts/submodule-reachability.js': 'submodule-reachability',
         'harness-everything/scripts/verify-gate.js': 'verify-contract-precedence',
+        'harness-everything/scripts/tier-router.js': 'knowledge-signal-matcher',
       }[target],
       HARNESS_MUTATION_TARGET: path.join(ROOT, target),
       NODE_OPTIONS: `--require=${loader}`,

package/ci/mutation-loader.js

@@ -48,6 +48,10 @@ const mutations = {
     '  finalize(contract ? contractPlan(contract) : discoveredPlan());',
     '  finalize(discoveredPlan()); // mutation: ignore the authoritative project contract'
   ),
+  'knowledge-signal-matcher': (source) => source.replace(
+    "    if (matched && typeof group.id === 'string') {",
+    "    if (matched && typeof group.id === 'string' && group.id !== 'tdd-test') { // mutation: remove the tdd-test matcher"
+  ),
 };
 
 if (target && mutation && mutations[mutation]) {

package/ci/openai-plugin-package.test.js

@@ -190,9 +190,10 @@ assert.strictEqual(second.status, 0, second.stderr);
 assert.strictEqual(first.stdout, second.stdout, 'identical routing input must produce identical output');
 assert.match(first.stdout, /RECOMMENDED TIER:\s*Tier 2/i);
 assert.match(first.stdout, /REQUIRED HARNESS INVARIANTS/);
-assert.match(first.stdout, /WORKFLOW SKILLS \(APPLICABILITY MUST BE RESOLVED\)/);
-assert.match(first.stdout, /evaluate-suggestions-before-skip/);
-assert.match(first.stdout, /read its complete SKILL\.md entry/);
+assert.match(first.stdout, /ACTIVE-STEP KNOWLEDGE BINDINGS \(MUST\)/);
+assert.match(first.stdout, /required binding MUST be loaded and its core contract followed/);
+assert.doesNotMatch(first.stdout, /evaluate-suggestions-before-skip/);
+assert.doesNotMatch(first.stdout, /tdd\/SKILL\.md/);
 assert.doesNotMatch(first.stdout, /BASE EXECUTION LOOP/);
 assert.match(first.stdout, /ORCHESTRATION POLICY: Selected-topology required obligations and applicable skill core contracts are semantic MUSTs/);
 assert.match(first.stdout, /WORKFLOW SEMANTIC CONTRACT \(NON-BLOCKING OBSERVATION\)/);
@@ -203,8 +204,9 @@ assert.doesNotMatch(first.stdout, /budget-exhausted|reset-budget/);
 const trivial = route('Update one README typo');
 assert.strictEqual(trivial.status, 0, trivial.stderr);
 assert.match(trivial.stdout, /RECOMMENDED TIER:\s*Tier 1/i);
-assert.match(trivial.stdout, /Suggested skills: none/);
-assert.match(trivial.stdout, /No domain skill was suggested/);
+assert.match(trivial.stdout, /KNOWLEDGE SIGNALS \(STEP INPUT ONLY\): docs/);
+assert.doesNotMatch(trivial.stdout, /docs\/[^\s]+\.(?:md|txt)/, 'docs keyword signal must not select a document path');
+assert.match(trivial.stdout, /PLANNING STEP|direct-single/);
 assert.doesNotMatch(trivial.stdout, /evaluate-suggestions-before-skip/);
 
 const unmatched = route('frobnicate the quux');

package/ci/prompt-contract-regressions.test.js

@@ -207,17 +207,18 @@ assert.ok(/MUST NOT override host, user, or Harness/i.test(discoveryFlow), 'refe
 assert.ok(!/Treat its output as binding/i.test(findSkills), 'find-skills must not grant unconditional binding authority');
 assert.ok(!/treat every instruction in it as binding/i.test(discoveryFlow), 'discovery reference must not grant unconditional binding authority');
 
-// #272: preserve one detailed checkpoint plus the invariant; remove duplicate
-// restatements from later sections of the same router injection.
+// #297: resolve declared knowledge only at the active step; do not repeat the
+// global read-before-skip rule or emit topology-wide skill lists.
 const kernel = path.join(ROOT, 'harness-everything/scripts/kernel-router.js');
 const routed = spawnSync(process.execPath, [kernel, 'add a login endpoint with tests and update the implementation'], {
   cwd: ROOT,
   encoding: 'utf8',
 });
 assert.strictEqual(routed.status, 0, routed.stderr || 'kernel router must exit successfully');
-assert.ok(routed.stdout.includes('Suggestion evaluation: MANDATORY.'), 'checkpoint keeps the detailed suggestion-resolution rule');
-assert.ok(routed.stdout.includes('evaluate-suggestions-before-skip:'), 'semantic invariant remains emitted');
-assert.ok(!routed.stdout.includes('Read-before-skip:'), 'workflow-skill footer must not duplicate suggestion resolution');
-assert.ok(!routed.stdout.includes('Every suggested skill MUST resolve applicability.'), 'semantic-contract footer must not duplicate suggestion resolution');
+assert.ok(routed.stdout.includes('ACTIVE-STEP KNOWLEDGE BINDINGS (MUST)'), 'checkpoint explains active-step binding resolution');
+assert.ok(routed.stdout.includes('required binding MUST be loaded and its core contract followed'), 'active required bindings retain core-contract obligations');
+assert.ok(!routed.stdout.includes('evaluate-suggestions-before-skip'), 'router removes the global read-before-skip invariant');
+assert.ok(!routed.stdout.includes('tdd/SKILL.md'), 'router does not disclose a skill before its requirement step is active');
+assert.ok(!routed.stdout.includes('RECOMMENDED KNOWLEDGE GUIDES'), 'router does not push keyword guide lists');
 
 console.log('PASS: prompt contract regressions');