harness-everything 0.31.1 → 0.31.3

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.31.1",
+  "version": "0.31.3",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.31.1",
+  "version": "0.31.3",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {
@@ -63,7 +63,7 @@
     "waza:check": "node scripts/waza-harness-check.js",
     "test:waza:compat": "node ci/mechanism-2aj-waza-reference-adapter.test.js",
     "codex:hooks": "node scripts/codex-hooks-compat.js",
-    "test:codex:hooks-compat": "node ci/mechanism-2al-codex-hooks-compat.test.js"
+    "test:codex:hooks-compat": "node ci/mechanism-2al-codex-hooks-compat.test.js && node ci/mechanism-2au-codex-runtime-safety.test.js"
   },
   "engines": {
     "node": ">=22"

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.31.1",
+  "version": "0.31.3",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/hooks/scripts/workflow-disposition.js

@@ -149,6 +149,10 @@ function activatePlan(workflow, plan) {
 }
 
 function main() {
+  if (process.argv[2] === '--help' || process.argv[2] === '-h') {
+    process.stdout.write(usage() + '\n');
+    return;
+  }
   const args = parseArgs(process.argv.slice(2));
   if (!WORKFLOW_CONTROLLER_COMMANDS.has(args.command)) throw new Error(usage());
   const sessionId = args.sessionId || readCurrentSession(getWorkspaceRoot());

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.31.1",
+  "version": "0.31.3",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/skills/fable-mode/SKILL.md

@@ -4,7 +4,7 @@ description: "Stage large tasks through plans, named fable agents, failable chec
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.31.0
+  version: 0.31.3
 ---
 
 # Fable Mode

package/plugins/harness-everything/skills/fable-mode/execution-guardrails/SKILL.md

@@ -4,7 +4,7 @@ description: "Reference guardrails for verified warnings and safe replacements;
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.31.0
+  version: 0.31.3
 ---
 
 # Execution Guardrails

package/plugins/harness-everything/skills/fable-mode/fable-haiku/SKILL.md

@@ -4,7 +4,7 @@ description: "Reference mechanical behavior profile (legacy alias haiku) for bul
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.31.0
+  version: 0.31.3
 ---
 
 # Fable Mode — Haiku

package/plugins/harness-everything/skills/fable-mode/fable-opus/SKILL.md

@@ -4,7 +4,7 @@ description: "Reference orchestrator behavior profile (legacy alias opus) for st
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.31.0
+  version: 0.31.3
 ---
 
 # Fable Mode — Opus

package/plugins/harness-everything/skills/fable-mode/fable-sonnet/SKILL.md

@@ -4,7 +4,7 @@ description: "Reference reasoning behavior profile (legacy alias sonnet/sonnect)
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.31.0
+  version: 0.31.3
 ---
 
 # Fable Mode — Sonnet

package/plugins/harness-everything/skills/fable-mode/references/execution-phases.md

@@ -2,37 +2,105 @@
 
 ```mermaid
 flowchart TD
-  Start[Qualifying Tier 3 task] --> Discover[Discover sources, runtime, and authorized scope]
-  Discover --> Plan[Write stage map and pass conditions]
-  Plan --> Select[Resolve requested model and write audit record]
-  Select --> Delegate[Delegate to named agent or visible inline fallback]
-  Delegate --> Contract[Write stage contract]
-  Contract --> Verify[Run the named failable check]
-  Verify --> Review[Cold-review high-stakes deliverables]
-  Review --> Done[Record result or escalate blocker]
+  Start[Qualifying Tier 3 task] --> Discover[Discover runtime and authorized scope]
+  Discover --> Profile[Resolve behavior profile and runtime choice]
+  Profile --> Plan[Write dependency-aware stage map and checks]
+  Plan --> Register[Write workflow-stages.json in session state]
+  Register --> Execute[Start workflow-disposition and execute ready stages]
+  Execute --> Check[Run exact check and record correlated evidence]
+  Check --> Review[Cold-review when the selected plan requires it]
+  Review --> Done[Record result or blocker]
 ```
 
 ## Discovery and planning
 
-Read the relevant files and sources before producing an artifact. Lock the
-authorized write scope in the handoff. Number the stages, assign one artifact
-and one pass condition to each. Replan counts are advisory and never a hard
-stop; three same-signature failures still require Rule-of-3 `zoom-out`.
+Read relevant files and sources before producing an artifact. Record the
+authorized write scope. Give each stage an objective, dependencies, write set,
+expected output, exact check command, and pass condition. Required and optional
+bindings belong on the stage that needs them. Replan counts are advisory; after
+three same-signature failures, use Rule-of-3 `zoom-out`.
 
-## Delegation
+## Profiles and delegation
 
-Use `fable-orchestrator` for Opus macro work, `fable-worker-sonnet` for
-reasoning and synthesis, and `fable-worker-haiku` for mechanical work. Brief
-each worker with its exact output path, context, audit record, and check.
-Workers do not spawn workers. If the named agent is unavailable, choose the
-explicit inline fallback or stop and escalate; do not silently change models.
+Resolve a requested behavior profile with Fable's profile selector and record
+it separately from the runtime choice. `fable-orchestrator`,
+`fable-worker-sonnet`, and `fable-worker-haiku` name coordination,
+reasoning/synthesis, and mechanical-work roles. These are behavior-profile
+aliases; they do not switch the runtime model. Preserve an explicit user or
+host runtime choice. Workers do not spawn workers. If a named worker is
+unavailable, use a declared inline fallback or report the gap.
 
-## Verification and handoff
+## Active workflow
+
+For an active mandatory workflow, use the router-displayed session path for
+`workflow-stages.json` and the router-displayed `workflow-disposition.js`
+controller. Do not register active stages in a repository-local contracts
+directory. Every required stage needs `dependsOn`, `writeSet`, `checkCommand`,
+and `passCondition`; an independent plan also needs a read-only `fable-verifier`
+stage that depends on all implementation stages.
+
+Start the selected run with the controller path and session id from the router:
+
+```bash
+node "<workflow-disposition.js path from the router>" start --session-id "<session-id>"
+```
+
+The controller creates correlated run-scoped contracts. Load only bindings on
+dependency-ready stages. Record each disposition with evidence:
+
+```bash
+node "<workflow-disposition.js path from the router>" stage-binding \
+  --session-id "<session-id>" --stage-id "<stage-id>" \
+  --binding-id "<binding-id>" --disposition loaded \
+  --evidence "Read the resolved required reference for this stage."
+```
+
+Run the exact `checkCommand`; the post-tool `contract-test.js` records the
+session, run, stage, worker identity, numeric exit code, and check evidence. If
+bindings are unresolved, resolve them and rerun the exact check before passing
+the stage. Keep results under the run's `contracts/<stageId>.json` and
+`evidence/<stageId>.json` records. Stage checks, required bindings, and selected
+independent verification remain semantic MUSTs. The controller and lifecycle
+hooks are reminder-only: unresolved evidence stays visible without locking
+ordinary tools or Stop. See [`../CONTRACT-FORMAT.md`](../CONTRACT-FORMAT.md) for
+the schema and correlation rules.
+
+## Blocked recovery
 
-Before each spot-check, create `.claude/harness-everything/state/contracts/<stage>.json`
-using `CONTRACT-FORMAT.md`, then run the exact command in that contract. A
-stage is not complete until the command passes and the audit record contains
-the verifier result. Use `fable-verifier` with only the spec and artifact for
-high-stakes or unsupervised delivery. Review scope-guard output before merging.
+If `start` is called while the workflow is running, it exits 2 with
+`workflow already running; record a blocker before replanning`. From that
+running state, record evidence with `block`:
+
+```bash
+node "<workflow-disposition.js path from the router>" block \
+  --session-id "<session-id>" \
+  --evidence "The current stage map needs a bounded recovery update."
+```
+
+Update the same session's `workflow-stages.json`, retaining the approved
+requirements, workflow selection, dependencies, and required bindings. Then
+start the revised stage map:
+
+```bash
+node "<workflow-disposition.js path from the router>" start --session-id "<session-id>"
+```
+
+This starts a new run and clears the recorded block reason. If the session is
+already `blocked`, update its stage map and run `start` directly. Do not call
+`plan` from `blocked`: planning is accepted only while the workflow is pending
+or active. When an explicitly authorized scope change requires new requirement
+composition, route a new session instead of replacing approved requirements.
+
+## Legacy/manual fallback
+
+The path `.claude/harness-everything/state/contracts/<stage>.json` belongs only
+to an explicitly selected legacy/manual workflow without an active mandatory
+run. It does not register stages or correlated evidence for the current
+workflow controller. Do not use it for an active Fable workflow.
+
+## Verification and handoff
 
-When macro scaffolding ends, transition to `tdd` for focused implementation.
+Run each named check and review scope-guard evidence before delivery. When the
+selected plan requires independent verification, the verifier is read-only and
+uses a distinct worker identity after all other stages pass. Record a blocker
+or an evidence-backed result; do not discard unresolved requirements.

package/plugins/harness-everything/skills/self-evolve/SKILL.md

@@ -4,7 +4,7 @@ description: "Extract root causes from resolved problems and persist them as def
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.12.0
+  version: 0.31.3
 ---
 
 # Self-evolve

package/plugins/harness-everything/skills/self-evolve/scripts/self-regression.js

@@ -6,7 +6,6 @@
  * their results must not be confused with a local tracker simulation.
  */
 
-const { spawnSync } = require('child_process');
 const path = require('path');
 const fs = require('fs');
 
@@ -22,12 +21,15 @@ if (pkgName !== 'harness-everything') {
   process.exit(0);
 }
 
+// This development-only helper is absent from installed skill packages.
+const { spawnTestNode } = require('../../ci/lib/isolated-test-process');
+
 console.log('=================================================');
 console.log('     Harness OS - Self-Regression Test Suite     ');
 console.log('=================================================');
 
 function runNode(label, script, args = [], options = {}) {
-  const result = spawnSync('node', [script, ...args], {
+  const result = spawnTestNode([script, ...args], {
     cwd: projectRoot,
     stdio: 'inherit',
     ...options,
@@ -54,7 +56,7 @@ function walkDir(dir) {
 }
 for (const folder of foldersToScan) walkDir(path.join(projectRoot, folder));
 for (const file of jsFiles) {
-  const check = spawnSync('node', ['--check', file]);
+  const check = spawnTestNode(['--check', file]);
   if (check.status !== 0) {
     console.error(`  FAIL syntax: ${path.relative(projectRoot, file)}`);
     console.error(check.stderr.toString().trim());
@@ -65,7 +67,7 @@ console.log(`  PASS syntax: ${jsFiles.length} JavaScript file(s)`);
 
 console.log('\n[Phase 1b] CLI Command Smoke Test...');
 const cliPath = path.join(projectRoot, 'bin', 'cli.js');
-const nextCheck = spawnSync('node', [cliPath, 'next', 'add a new login endpoint with tests'], { cwd: projectRoot });
+const nextCheck = spawnTestNode([cliPath, 'next', 'add a new login endpoint with tests'], { cwd: projectRoot });
 if (nextCheck.status !== 0 || !nextCheck.stdout.toString().includes('RECOMMENDED TIER')) {
   console.error('  FAIL `harness next` did not produce a routing recommendation.');
   hasErrors = true;
@@ -73,7 +75,7 @@ if (nextCheck.status !== 0 || !nextCheck.stdout.toString().includes('RECOMMENDED
   console.error('  FAIL `harness next` did not establish the invariant-first kernel contract.');
   hasErrors = true;
 } else console.log('  PASS `harness next` produced routing + invariant contract.');
-const verifyCheck = spawnSync('node', [cliPath, 'verify'], {
+const verifyCheck = spawnTestNode([cliPath, 'verify'], {
   cwd: projectRoot,
   env: { ...process.env, HARNESS_SKIP_PROJECT_CHECKS: '1' },
 });
@@ -105,7 +107,7 @@ runNode('behavioral case validation', path.join(projectRoot, 'behavioral-evals',
 console.log('\n[Phase 3b] Fable Model Mode Contract Tests...');
 const fableModeTestPath = path.join(projectRoot, 'ci', 'fable-mode-test.js');
 if (fs.existsSync(fableModeTestPath)) {
-  const fableModeCheck = spawnSync('node', [fableModeTestPath], { stdio: 'inherit', cwd: projectRoot });
+  const fableModeCheck = spawnTestNode([fableModeTestPath], { stdio: 'inherit', cwd: projectRoot });
   if (fableModeCheck.status !== 0) {
     console.error("\n  ❌ Fable model mode contract suite failed!");
     hasErrors = true;

package/sbom.cdx.json

@@ -2,23 +2,23 @@
   "$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.7",
-  "serialNumber": "urn:uuid:1eaedc2c-236e-55be-b84d-9f710a2e88a2",
+  "serialNumber": "urn:uuid:8fcaff79-dd3a-5e6d-8ae9-f34d935267de",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-13T09:35:47.413Z",
+    "timestamp": "2026-10-16T05:41:55.836Z",
     "tools": [
       {
         "vendor": "Harness Everything",
         "name": "generate-sbom.js",
-        "version": "0.31.1"
+        "version": "0.31.3"
       }
     ],
     "component": {
       "type": "application",
-      "bom-ref": "pkg:npm/harness-everything@0.31.1",
+      "bom-ref": "pkg:npm/harness-everything@0.31.3",
       "name": "harness-everything",
-      "version": "0.31.1",
-      "purl": "pkg:npm/harness-everything@0.31.1"
+      "version": "0.31.3",
+      "purl": "pkg:npm/harness-everything@0.31.3"
     }
   },
   "components": [
@@ -920,15 +920,15 @@
     },
     {
       "type": "library",
-      "bom-ref": "pkg:npm/fast-uri@3.1.6",
+      "bom-ref": "pkg:npm/fast-uri@3.1.8",
       "name": "fast-uri",
-      "version": "3.1.6",
+      "version": "3.1.8",
       "scope": "excluded",
-      "purl": "pkg:npm/fast-uri@3.1.6",
+      "purl": "pkg:npm/fast-uri@3.1.8",
       "hashes": [
         {
           "alg": "SHA-512",
-          "content": "7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q=="
+          "content": "GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg=="
         }
       ]
     },
@@ -1896,7 +1896,7 @@
       "ref": "pkg:npm/ajv@8.20.0",
       "dependsOn": [
         "pkg:npm/fast-deep-equal@3.1.3",
-        "pkg:npm/fast-uri@3.1.6",
+        "pkg:npm/fast-uri@3.1.8",
         "pkg:npm/json-schema-traverse@1.0.0",
         "pkg:npm/require-from-string@2.0.2"
       ]
@@ -1999,7 +1999,7 @@
       ]
     },
     {
-      "ref": "pkg:npm/harness-everything@0.31.1",
+      "ref": "pkg:npm/harness-everything@0.31.3",
       "dependsOn": [
         "pkg:npm/%40commitlint/cli@19.8.1",
         "pkg:npm/%40commitlint/config-conventional@19.8.1",