harness-everything 0.31.3 → 0.33.0

package/plugins/harness-everything/hooks/scripts/lib/workflow-obligations.js

@@ -1,5 +1,6 @@
 'use strict';
 
+const fs = require('fs');
 const path = require('path');
 const { atomicWriteJson, readJson } = require('./fable-contracts');
 const { resolveBinding, PACKAGED_BINDING_PATHS: BINDING_PATHS } = require('./binding-resolver');
@@ -8,13 +9,102 @@ const OBLIGATION_SCHEMA_VERSION = 1;
 const OBLIGATION_FILE = 'workflow-obligations.json';
 const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 const ALLOWED_ESCAPE_REASONS = new Set(['workflow-uncovered-scope', 'host-capability-unavailable']);
-const STEP_TYPES = new Set(['review', 'behavior-change', 'verification', 'commit']);
-const REQUIRED_BINDINGS_BY_STEP = {
-  review: [],
-  'behavior-change': ['tdd'],
-  verification: ['verification-loop'],
-  commit: ['git-commit'],
-};
+const STEP_TYPE_REGISTRY_FILE = path.join(__dirname, 'step-types.json');
+
+function validateStepTypeRegistry(registry) {
+  const errors = [];
+  if (!Array.isArray(registry) || registry.length === 0) {
+    throw new Error('invalid step-type registry: expected a non-empty array');
+  }
+  const idCounts = new Map();
+  const bindingFields = ['requiredBindings', 'optionalBindings', 'forbiddenBindings'];
+  for (const entry of registry) {
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry)) {
+      errors.push('entry must be an object');
+      continue;
+    }
+    const id = typeof entry.id === 'string' ? entry.id : '';
+    const validId = SAFE_ID.test(id) && id === id.trim();
+    const label = validId ? `step type ${id}` : 'step type with invalid id';
+    if (!validId) errors.push(`${label} must declare a stable id`);
+    else idCounts.set(id, (idCounts.get(id) || 0) + 1);
+    if (typeof entry.evidenceHint !== 'string' || !entry.evidenceHint.trim()) {
+      errors.push(`${label} evidenceHint must be a non-empty string`);
+    }
+    const valuesByField = new Map();
+    for (const field of bindingFields) {
+      if (!Array.isArray(entry[field])) {
+        errors.push(`${label} ${field} must be an array`);
+        valuesByField.set(field, []);
+        continue;
+      }
+      const values = [];
+      for (const binding of entry[field]) {
+        if (typeof binding !== 'string' || !SAFE_ID.test(binding) || binding !== binding.trim()) {
+          errors.push(`${label} ${field} entries must be stable binding ids`);
+          continue;
+        }
+        values.push(binding);
+      }
+      const unique = [...new Set(values)].sort();
+      if (unique.length !== values.length) errors.push(`${label} ${field} contains duplicate binding ids`);
+      valuesByField.set(field, unique);
+    }
+    for (const [left, right] of [
+      ['requiredBindings', 'optionalBindings'],
+      ['requiredBindings', 'forbiddenBindings'],
+      ['optionalBindings', 'forbiddenBindings'],
+    ]) {
+      const rightValues = new Set(valuesByField.get(right) || []);
+      for (const binding of valuesByField.get(left) || []) {
+        if (rightValues.has(binding)) errors.push(`${label} has conflicting ${left} and ${right} default for ${binding}`);
+      }
+    }
+  }
+  for (const id of [...idCounts.keys()].sort()) {
+    if (idCounts.get(id) > 1) errors.push(`duplicate step type id ${id}`);
+  }
+  if (errors.length) throw new Error('invalid step-type registry: ' + [...new Set(errors)].sort().join('; '));
+  return registry.map(entry => ({
+    id: entry.id,
+    requiredBindings: [...entry.requiredBindings],
+    optionalBindings: [...entry.optionalBindings],
+    forbiddenBindings: [...entry.forbiddenBindings],
+    evidenceHint: entry.evidenceHint.trim(),
+  })).sort((left, right) => left.id < right.id ? -1 : left.id > right.id ? 1 : 0);
+}
+
+const STEP_TYPE_REGISTRY_UNAVAILABLE = 'STEP_TYPE_REGISTRY_UNAVAILABLE';
+
+function readStepTypeRegistry(registryFile = STEP_TYPE_REGISTRY_FILE) {
+  const resolvedRegistryFile = path.resolve(registryFile);
+  try {
+    const parsed = JSON.parse(fs.readFileSync(resolvedRegistryFile, 'utf8'));
+    return validateStepTypeRegistry(parsed);
+  } catch (error) {
+    const unavailable = new Error(
+      `cannot load step-type registry ${resolvedRegistryFile}: ${error.message}. ` +
+      `Repair action: reinstall or update the Harness plugin so this file is restored; in a Harness source checkout, restore it and run npm run plugin:sync.`,
+    );
+    unavailable.code = STEP_TYPE_REGISTRY_UNAVAILABLE;
+    throw unavailable;
+  }
+}
+
+// Loaded on first typed use only, so registry-independent planning and execution never read it.
+let stepTypeRegistry = null;
+function loadStepTypeRegistry() {
+  if (!stepTypeRegistry) stepTypeRegistry = readStepTypeRegistry();
+  return stepTypeRegistry;
+}
+
+function stepTypeIds() {
+  return loadStepTypeRegistry().map(entry => entry.id).sort();
+}
+
+function stepTypeIndex() {
+  return new Map(loadStepTypeRegistry().map(entry => [entry.id, entry]));
+}
 
 function obligationPath(sessionDir) {
   return path.join(sessionDir, OBLIGATION_FILE);
@@ -125,6 +215,14 @@ function initializePlanningContract(context, plan) {
   return set;
 }
 
+function typedStepType(rawStepType) {
+  const registered = stepTypeIndex();
+  if (!registered.has(rawStepType)) {
+    throw new Error(`unsupported requirement stepType: ${rawStepType}; registered step types: ${stepTypeIds().join(', ')}`);
+  }
+  return registered.get(rawStepType);
+}
+
 function parseRequirements(requirementsJson, workspaceRoot) {
   let parsed;
   try { parsed = JSON.parse(String(requirementsJson || '')); }
@@ -145,7 +243,7 @@ function parseRequirements(requirementsJson, workspaceRoot) {
       ? [...new Set(item.suggestedSkills.filter(value => typeof value === 'string' && value.trim()).map(value => value.trim()))]
       : [];
     const rawStepType = item.stepType === undefined ? '' : String(item.stepType).trim();
-    if (rawStepType && !STEP_TYPES.has(rawStepType)) throw new Error(`unsupported requirement stepType: ${rawStepType}`);
+    const stepType = rawStepType ? typedStepType(rawStepType) : null;
     for (const field of ['requiredBindings', 'optionalBindings']) {
       if (Object.prototype.hasOwnProperty.call(item, field) && !Array.isArray(item[field])) {
         throw new Error(`${id}.${field} must be an array`);
@@ -155,17 +253,18 @@ function parseRequirements(requirementsJson, workspaceRoot) {
     if (!rawStepType) return requirement;
 
     const requiredBindings = normalizeBindingDeclarations([
-      ...(REQUIRED_BINDINGS_BY_STEP[rawStepType] || []),
+      ...(stepType.requiredBindings || []),
       ...(item.requiredBindings || []),
     ]);
     const requiredIds = new Set(requiredBindings.map(binding => binding.id));
     const optionalBindings = normalizeBindingDeclarations([
+      ...(stepType.optionalBindings || []),
       ...(item.optionalBindings || []),
       ...suggestedSkills,
     ]).filter(binding => !requiredIds.has(binding.id));
-    if (rawStepType === 'review' && [...requiredBindings, ...optionalBindings].some(binding => binding.id === 'tdd')) {
-      throw new Error('review steps cannot bind tdd');
-    }
+    const forbiddenBinding = [...requiredBindings, ...optionalBindings]
+      .find(binding => stepType.forbiddenBindings.includes(binding.id));
+    if (forbiddenBinding) throw new Error(`${rawStepType} steps cannot bind ${forbiddenBinding.id}`);
     requirement.stepType = rawStepType;
     requirement.status = 'pending';
     requirement.evidence = null;
@@ -268,7 +367,7 @@ function recordPlanning(context, requirementsJson, selectedPlan, requestedStrate
   }
   const isFable = String(selectedPlan.strategy || '').startsWith('fable-');
   if (!isFable && !hasTypedSteps) {
-    throw new Error('selected single-agent workflows require ordered stepType values: review, behavior-change, verification, or commit');
+    throw new Error(`selected single-agent workflows require ordered stepType values: ${stepTypeIds().join(', ')}`);
   }
   if (!isFable && !requirements.some(item => item.stepType === 'verification')) {
     throw new Error('step-bound workflows require an explicit verification step');
@@ -360,7 +459,8 @@ function validateObligationSet(context, set, plan = context.workflow?.pendingPla
     if (!['pending', 'pass', 'escaped', 'blocked'].includes(obligation.status)) return 'obligation-status-invalid';
   }
   if (set.stepBindingsEnabled === true) {
-    if (set.requirements.some(item => !item || !STEP_TYPES.has(item.stepType) ||
+    const registered = stepTypeIndex();
+    if (set.requirements.some(item => !item || !registered.has(item.stepType) ||
         !['pending', 'pass', 'blocked'].includes(item.status) || !Array.isArray(item.requiredBindings) ||
         !Array.isArray(item.optionalBindings))) return 'steps-invalid';
     for (const step of set.requirements) {
@@ -585,6 +685,9 @@ function unresolvedObligations(context) {
 module.exports = {
   OBLIGATION_FILE,
   ALLOWED_ESCAPE_REASONS,
+  loadStepTypeRegistry,
+  stepTypeIds,
+  validateStepTypeRegistry,
   obligationPath,
   needsPlanningContract,
   needsGenericExecutionObligations,

package/plugins/harness-everything/hooks/scripts/workflow-disposition.js

@@ -7,15 +7,20 @@ const { loadWorkflow, saveWorkflow, matchingRun, OPEN_STATES, WORKFLOW_CONTROLLE
 const { getWorkspaceRoot, readCurrentSession } = require('./lib/harness-state');
 const { atomicWriteJson, readJson } = require('./lib/fable-contracts');
 const { resolveBinding } = require('./lib/binding-resolver');
-const {
-  planningUnresolved,
-  recordPlanning,
-  materializeExecutionObligations,
-  updateObligation,
-  updateBinding,
-  updateStep,
-  activeStepSnapshot,
-} = require('./lib/workflow-obligations');
+
+let obligationApi;
+function workflowObligations() {
+  if (!obligationApi) obligationApi = require('./lib/workflow-obligations');
+  return obligationApi;
+}
+
+const planningUnresolved = (...args) => workflowObligations().planningUnresolved(...args);
+const recordPlanning = (...args) => workflowObligations().recordPlanning(...args);
+const materializeExecutionObligations = (...args) => workflowObligations().materializeExecutionObligations(...args);
+const updateObligation = (...args) => workflowObligations().updateObligation(...args);
+const updateBinding = (...args) => workflowObligations().updateBinding(...args);
+const updateStep = (...args) => workflowObligations().updateStep(...args);
+const activeStepSnapshot = (...args) => workflowObligations().activeStepSnapshot(...args);
 
 const ALLOWED_ESCAPE_REASONS = new Set(['workflow-uncovered-scope', 'host-capability-unavailable']);
 
@@ -149,6 +154,8 @@ function activatePlan(workflow, plan) {
 }
 
 function main() {
+  // The step-type registry loads lazily through the wrappers above, only for commands that
+  // consume typed obligations; the top-level handler turns a load failure into one semantic line.
   if (process.argv[2] === '--help' || process.argv[2] === '-h') {
     process.stdout.write(usage() + '\n');
     return;

package/plugins/harness-everything/hooks/scripts/workflow-stop-gate.js

@@ -3,35 +3,58 @@
 const path = require('path');
 const { readJson } = require('./lib/fable-contracts');
 const { loadWorkflow, saveWorkflow, matchingRun, unresolvedStages, readHookInput } = require('./lib/workflow-runtime');
-const { planningUnresolved, unresolvedObligations } = require('./lib/workflow-obligations');
+
+const REGISTRY_UNAVAILABLE = 'step-type-registry-unavailable';
+const STEP_TYPE_REGISTRY_UNAVAILABLE = 'STEP_TYPE_REGISTRY_UNAVAILABLE';
 
 function warn(message) { console.error('[Workflow Reminder] ' + message); }
 
 function decide(payload) {
   if (!payload) return;
   try {
+    const { planningUnresolved, unresolvedObligations } = require('./lib/workflow-obligations');
     const context = loadWorkflow(payload);
     const { workflow, sessionDir } = context;
     if (!workflow || workflow.state === 'deferred') return;
     const handoff = readJson(path.join(sessionDir, 'handoff-state.json'));
-    let unresolved = planningUnresolved(context);
+    const unresolved = [];
+    const diagnostics = [];
+    let requiredFault = false;
+
+    // Only a validation that actually reads the registry can fail here. It records the
+    // semantic diagnostic and the unresolved token itself; other checks keep running.
+    const required = check => {
+      try {
+        unresolved.push(...check());
+      } catch (error) {
+        if (error.code !== STEP_TYPE_REGISTRY_UNAVAILABLE) throw error;
+        diagnostics.push(error.message);
+        unresolved.push(REGISTRY_UNAVAILABLE);
+        requiredFault = true;
+      }
+    };
 
+    required(() => planningUnresolved(context));
     if (String(workflow.strategy || '').startsWith('fable-')) {
       const match = matchingRun(context);
       unresolved.push(...(match ? unresolvedStages(match, workflow, handoff?.lastEditAt || 0) : ['correlated-run-missing']));
     } else {
-      unresolved.push(...unresolvedObligations(context));
+      required(() => unresolvedObligations(context));
       const lastEdit = Math.max(workflow.lastMutationAt || 0, handoff?.lastEditAt || 0);
       if (lastEdit && (handoff?.lastVerifyAt || 0) < lastEdit) unresolved.push('verification-after-edit-missing');
     }
 
-    unresolved = [...new Set(unresolved)];
+    const pending = [...new Set(unresolved)];
     const wasBlocked = workflow.state === 'blocked';
     if (wasBlocked) warn('Workflow is marked BLOCKED; report or revisit the recorded blocker, but Harness will not trap the session.');
-    if (unresolved.length) {
-      workflow.unresolved = unresolved;
-      saveWorkflow(context);
-      warn('Unresolved workflow evidence: ' + unresolved.join(', ') + '. Resolve/verify before claiming completion.');
+    [...new Set(diagnostics)].forEach(message => warn(message));
+    if (pending.length) {
+      // A failed required validation leaves the workflow file as recorded; it is never marked satisfied.
+      if (!requiredFault) {
+        workflow.unresolved = pending;
+        saveWorkflow(context);
+      }
+      warn('Unresolved workflow evidence: ' + pending.join(', ') + '. Resolve/verify before claiming completion.');
       return;
     }
     if (wasBlocked) return;

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.31.3",
+  "version": "0.33.0",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/skills/code-review/SKILL.md

@@ -0,0 +1,41 @@
+---
+name: code-review
+description: "Independently review a PR, diff or finished implementation for correctness, contract and negative-path defects, with source-anchored findings labelled executed, source-traced or inconclusive; read-only by default. USE FOR: \"review this PR before merge\", \"re-review the fix at the new HEAD\". DO NOT USE FOR: \"security threat modeling\", \"implementing or fixing the code\"."
+license: Apache-2.0
+metadata:
+  author: Miya Daniel
+  version: 0.33.0
+---
+
+# Code Review
+
+Independently review completed changes for correctness, contract violations, and negative-path defects. Default to read-only.
+
+## 📋 Skill Contract
+
+| Component | Specification |
+| :--- | :--- |
+| **Trigger / Input** | Requested review of a PR, diff, implementation, or revised HEAD. |
+| **Expected Output** | Source-anchored findings and an evidence-qualified summary. |
+| **State Mutations** | None unless the user explicitly authorizes an action. |
+| **Enforcement Gate** | Apply the checklist in `<this-skill-dir>/references/review-playbook.md`. |
+
+## USE FOR:
+- Review a PR / diff / finished implementation before merge
+- Re-review a revised HEAD: prior-finding disposition + new risks
+
+## DO NOT USE FOR:
+- Security-only threat modeling / secrets / OWASP (use `security-review`)
+- Design or plan stress-testing (use `grill-me`); running gates (use `verification-loop`); writing the fix (use `tdd`)
+
+## Workflow
+
+1. Pin repository, contract, base/head, changed scope, and CI state; inspect relevant callers and consumers.
+2. Independently trace behavior and test applicable counterexamples. Separate severity from safety conditions.
+3. Report only supported findings with evidence tier, smallest correction, regression, and positive control. Use `<this-skill-dir>/templates/finding.template.md`.
+4. On re-review, disposition every prior finding at the new HEAD, then inspect for regressions.
+5. Keep review read-only unless explicitly authorized. Do not claim “bug-free.”
+
+In the interim, bind explicitly on an existing review step: `{"stepType":"review","optionalBindings":["code-review"]}`.
+
+Deep dive: <this-skill-dir>/references/review-playbook.md

package/plugins/harness-everything/skills/code-review/references/review-playbook.md

@@ -0,0 +1,40 @@
+# Review Playbook
+
+Use this checklist for the applicable risks; do not force irrelevant categories.
+
+## Establish scope and evidence
+
+- [ ] Pin repository, PR, base/head SHA, user requirement or PRD/ADR, changed files, relevant callers/callees, and current CI state. Avoid unrelated checkout areas.
+- [ ] Make an independent pass. Treat author explanations and tests as leads, not proof; derive expected behavior from contracts and source.
+- [ ] Label evidence honestly: **executed/reproduced** (command, result, environment, SHA); **source-traced** (concrete path and preconditions); **inconclusive** (missing facts or ambiguous semantics; do not present as a proven blocker).
+- [ ] Inventory user-facing entry points and configuration handoffs (CLI flags, cwd, path spellings, config loading). Exercise them end-to-end, not only the recently edited internals.
+- [ ] Reproduce a candidate finding against the PR base before classifying it as new. Pre-existing defects are follow-ups, not new blockers.
+
+## Try applicable counterexamples
+
+- [ ] Missing, null, malformed input; old persisted state; base-to-candidate transitions; tenant/scope boundaries.
+- [ ] Missing or broken dependencies: enumerate every entry point, including help, recovery, and stop paths; inspect fallback behavior.
+- [ ] OS/shell differences; concurrency, crash, retry; user paths and symlinks; API/migration compatibility; downstream or generated views.
+- [ ] Follow each important diagnostic/fact through every consumer and ancestor. Check whether required facts are computed before derived authority, indexes, or output.
+- [ ] Compare new rules with previously accepted rules and controls. Separate display severity from safety prerequisites.
+
+## Check tests and output
+
+- [ ] Ask whether each test still passes if the behavior is disabled, bypassed, or broken (mutation thought experiment). Confirm the test is included in CI.
+- [ ] When output text changes, compare the intended changed lines with literal templates; do not exclude changed lines from assertions.
+- [ ] Dedupe findings. Use P1 for severe merge blockers, P2 for meaningful correctness/contract defects, P3 for low-risk issues; avoid speculation.
+- [ ] For each finding, include exact path:line or diff anchor at HEAD SHA, trigger, observed behavior, violated contract and impact, evidence tier, smallest fix, negative regression, positive control, and disposition.
+
+## Re-review and conclude
+
+- [ ] Pin the new HEAD. Disposition every prior finding separately: resolved, still open, superseded, or inconclusive. Then inspect fix-induced side effects and new changes.
+- [ ] Stay read-only unless the user/workflow explicitly authorizes action. Do not edit, comment, label, or merge on review authority alone.
+- [ ] Summarize scope/SHA, CI, covered and unexamined risks, fixed/open/new counts, and evidence-grounded merge recommendation. “No actionable findings in examined scope” does not mean “bug-free.” Distinguish repository tests from live-host evidence.
+
+## Per-finding format
+
+`[P1/P2/P3] Title` — `path:line @ <HEAD SHA>`
+
+**Trigger** → **behavior** → **contract violation / impact**. **Evidence:** executed / source-traced / inconclusive. **Minimal correction:** … **Regression:** negative case …; positive control … **Disposition:** blocker / follow-up / owner decision.
+
+Use `<this-skill-dir>/templates/finding.template.md` for the complete findings and summary form.

package/plugins/harness-everything/skills/code-review/templates/finding.template.md

@@ -0,0 +1,33 @@
+# Code Review — <PR or change>
+
+## Scope and evidence
+
+- Repository / PR:
+- Base SHA → reviewed HEAD SHA:
+- Requirement / PRD / ADR:
+- Changed files and relevant callers/consumers:
+- CI state and commands observed:
+- Counterexample categories covered:
+- Risks not examined / evidence limits:
+
+## Findings
+
+### [P1/P2/P3] <Short, specific title>
+
+- **Location:** `<path>:<line or diff anchor> @ <HEAD SHA>`
+- **Trigger:** <minimal input, state transition, or interleaving>
+- **Behavior → impact:** <observed or source-traced behavior and violated contract>
+- **Evidence tier:** <executed/reproduced | source-traced | inconclusive; include exact command/result or preconditions>
+- **Minimal correction:** <smallest feasible fix>
+- **Regression:** Negative case: <case that fails before fix>; positive control: <valid behavior that remains valid>
+- **Disposition:** <blocker | follow-up | owner decision; for re-review, resolved | still open | superseded | inconclusive>
+
+<!-- Duplicate this finding section as needed. Remove headings for which there are no findings. -->
+
+## Summary
+
+- **Scope / reviewed SHA:**
+- **CI evidence:**
+- **Covered / unexamined risks:**
+- **Findings:** <fixed / open / new counts on re-review>
+- **Conclusion:** <merge recommendation grounded in evidence; “no actionable findings in examined scope” is not a claim of bug-free code>

package/plugins/harness-everything/skills/harness-everything/SKILL.md

@@ -4,7 +4,7 @@ description: "Route software/project work through Harness: classify tier/topolog
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.31.0
+  version: 0.33.0
 ---
 
 # Harness Everything

package/plugins/harness-everything/skills/harness-everything/references/router-workflow-plan.md

@@ -118,6 +118,24 @@ Examples:
 
 There is no universal `TODO → TDD → verification` pipeline.
 
+## Step types
+
+The allowed step types are the entries of `hooks/scripts/lib/step-types.json`. The list below is rendered from that registry and checked against it by `ci/mechanism-2ba-step-type-docs.test.js`; examples elsewhere may name a subset.
+
+<!-- step-types:start -->
+- `behavior-change` — required bindings: `tdd` — forbidden bindings: none
+- `commit` — required bindings: `git-commit` — forbidden bindings: none
+- `doc-change` — required bindings: none — forbidden bindings: none
+- `review` — required bindings: none — forbidden bindings: `tdd`
+- `verification` — required bindings: `verification-loop` — forbidden bindings: none
+<!-- step-types:end -->
+
+`doc-change` is declared-only: a plan author chooses it explicitly, and router classification, keyword routing and System One never infer or insert it. It has no default bindings, and an explicitly declared `tdd` binding stays legal. Mixed documentation and code work is written as ordered `doc-change` and `behavior-change` steps, and one shared verification step may verify both.
+
+Old runtimes reject a persisted non-Fable `doc-change` plan visibly at the controller and Stop boundaries (`planning:steps-invalid`). The old retained router does not show that rejection: it shows no active step. Persisted bytes are not renamed or reset. Inert Fable planning metadata is not rejected by old runtimes, because step bindings are disabled there.
+
+Registry revisions: binding defaults and required/forbidden binding policy are materialized when a plan is recorded and are not reapplied on ordinary load. Existing typed plans must still reference currently registered step types; removing a type can invalidate a plan rather than migrate or waive its stored bindings. A policy fingerprint or migration path is future work and is not implemented today.
+
 ## Binding and disclosure rule
 
 Each ordered requirement or Fable stage may declare `requiredBindings` and `optionalBindings` by stable id and concrete repository-relative path. Only the active requirement or dependency-ready stage exposes its paths. Required bindings must resolve before that step/stage passes; unknown required bindings remain visible and unresolved. Future-step paths and keyword-matched documents are never preloaded.

package/plugins/harness-everything/skills/harness-everything/references/skill-registry.md

@@ -18,6 +18,7 @@ Every skill in this repository is reachable from this router. If a task matches
 | `grill-me` | Tier 2 | User asks to be grilled on a plan (pure Q&A). |
 | `improve-codebase-architecture` | Tier 2 | Deep architectural analysis / refactor planning. |
 | `eval-harness` | Tier 2 | Scoring, stress testing, benchmark comparison. |
+| `code-review` | Tier 2 | Explicit review requests of a PR/diff/finished implementation: correctness, contract, and negative-path findings with evidence tiers, read-only by default — not threat modeling (`security-review`), plan interrogation (`grill-me`), or gate running (`verification-loop`). |
 | `verification-loop` | Tier 2/3 gate | Before declaring done or creating a PR. |
 | `security-review` | Tier 2/3 gate | Changes touching auth, input handling, secrets, network boundaries. |
 | `fable-mode` | Tier 3 | v3 staged planning, named-agent delegation, model selection, failable gates, and cold review. |

package/plugins/harness-everything/skills/harness-everything/scripts/kernel-router.js

@@ -33,6 +33,14 @@ function issueMemoryCapability(workflow) {
   return token;
 }
 
+function needsStepTypeRegistry(plan) {
+  return Boolean(
+    plan && plan.strategySelection === 'selected' &&
+    ['tier2', 'tier3'].includes(plan.tier) && plan.strategy &&
+    !String(plan.strategy).startsWith('fable-')
+  );
+}
+
 // Host-generated background-task notifications arrive as UserPromptSubmit
 // hook payloads but are not user input (#168). Routing them like prompts
 // replaces the workflow contract mid-turn (e.g. deferred -> a new Tier-2).
@@ -44,11 +52,28 @@ function isHostNotificationPrompt(prompt) {
   return /^<task-notification[\s>][\s\S]*<\/task-notification>\s*$/i.test(text);
 }
 
+function stepTypeIdsFor(hooksRoot) {
+  try {
+    return require(path.join(hooksRoot, 'lib/workflow-obligations')).stepTypeIds();
+  } catch {
+    return null;
+  }
+}
+
 function persistWorkflow(contract, payload, prompt) {
   const plan = contract && contract.workflowPlan;
   if (!payload || !(payload.session_id || payload.sessionId)) return null;
   const { runtime, hooksRoot } = loadRuntime();
   const context = runtime.loadWorkflow(payload);
+  const hasRetainedWorkflow = Boolean(context.workflow && runtime.OPEN_STATES.has(context.workflow.state));
+  const activePlan = hasRetainedWorkflow ? context.workflow.workflowPlan : plan;
+  if (needsStepTypeRegistry(activePlan)) {
+    try { require(path.join(hooksRoot, 'lib/workflow-obligations')).loadStepTypeRegistry(); }
+    catch (error) {
+      if (hasRetainedWorkflow) return { ...context, hooksRoot, retained: true, registryError: error };
+      throw error;
+    }
+  }
   const { writeCurrentSession } = require(path.join(hooksRoot, 'lib/harness-state'));
   writeCurrentSession(context.root, context.sessionId);
   if (isHostNotificationPrompt(prompt)) {
@@ -121,8 +146,8 @@ function activeExecutionFor(persisted, plan) {
     const obligations = require(path.join(persisted.hooksRoot, 'lib/workflow-obligations'));
     const loaded = obligations.loadObligationSet(persisted, plan);
     return { activeStep: loaded.set ? obligations.activeStepSnapshot(loaded.set) : null };
-  } catch (_) {
-    return null;
+  } catch (error) {
+    return { error: error && error.message ? error.message : String(error) };
   }
 }
 
@@ -163,10 +188,15 @@ function run(raw) {
   if (persisted?.retained && persisted.workflow) {
     if (persisted.hostNotification) console.log('\n=> Host notification: routing unchanged; keeping the active execution contract.');
     else console.log('\n=> Retaining unresolved workflow; showing its compact active contract.');
-    const activeExecution = activeExecutionFor(persisted, plan) || {};
+    const activeExecution = persisted.registryError
+      ? { error: persisted.registryError.message || String(persisted.registryError) }
+      : activeExecutionFor(persisted, plan) || {};
     const activeStep = activeExecution.activeStep || null;
     const activeStages = activeExecution.activeStages || [];
     core.printRetainedWorkflow(plan, persisted.workflow, activeStep, activeStages);
+    if (activeExecution.error) {
+      console.log('   - [Workflow Reminder] Active-step context unavailable: ' + activeExecution.error);
+    }
     if (activeStep) {
       const controller = path.join(persisted.hooksRoot, 'workflow-disposition.js');
       console.log('   - Resolve only bindings for this active step, then pass this step with evidence.');
@@ -205,8 +235,10 @@ function run(raw) {
     if (plan.strategySelection === 'selected' && ['tier2', 'tier3'].includes(plan.tier)) {
       console.log('   - Planning contract: ' + path.join(persisted.sessionDir, 'workflow-obligations.json'));
       console.log('   - Requirements first: decompose intent into requirement fragments, then confirm the smallest sufficient workflow.');
-      console.log('   - Record ordered step types (review, behavior-change, verification, commit) and their bindings before execution.');
-      console.log('   - Record plan: node "' + controller + '" plan --session-id "' + persisted.sessionId + '" --requirements-json "[{\\"id\\":\\"req-1\\",\\"stepType\\":\\"behavior-change\\",\\"summary\\":\\"...\\",\\"acceptance\\":\\"...\\"},{\\"id\\":\\"req-verify\\",\\"stepType\\":\\"verification\\",\\"summary\\":\\"...\\",\\"acceptance\\":\\"...\\"}]" --strategy "' + plan.strategy + '" --evidence "<why this workflow fits>"');
+      const stepTypeIds = stepTypeIdsFor(persisted.hooksRoot);
+      console.log('   - Record ordered step types' + (stepTypeIds ? ' (' + stepTypeIds.join(', ') + ')' : '') + ' and their bindings before execution.');
+      console.log('   - Replace <step-type-id> with a registered type you choose explicitly; mixed docs+code work uses separate doc-change and behavior-change steps; keep the verification step.');
+      console.log('   - Record plan: node "' + controller + '" plan --session-id "' + persisted.sessionId + '" --requirements-json "[{\\"id\\":\\"req-1\\",\\"stepType\\":\\"<step-type-id>\\",\\"summary\\":\\"...\\",\\"acceptance\\":\\"...\\"},{\\"id\\":\\"req-verify\\",\\"stepType\\":\\"verification\\",\\"summary\\":\\"...\\",\\"acceptance\\":\\"...\\"}]" --strategy "' + plan.strategy + '" --evidence "<why this workflow fits>"');
     }
     console.log('   - Enter selected workflow after planning: node "' + controller + '" start --session-id "' + persisted.sessionId + '"');
     console.log('   - Escape one declared stage: node "' + controller + '" escape --session-id "' + persisted.sessionId + '" --stage-id "<id>" --reason-code workflow-uncovered-scope --scope "<uncovered scope>" --evidence "<evidence>"');

package/plugins/harness-everything/skills/harness-everything/scripts/routing-keywords.json

@@ -611,6 +611,13 @@
       "bindings": [
         "zoom-out"
       ]
+    },
+    {
+      "id": "review",
+      "bindings": [
+        "code-review"
+      ],
+      "regex": "\\b(?:code[- ]review|pr review)\\b|\\b(?:re-)?review\\s+(?:(?:(?:this|the|my)\\s+)?(?:pr\\b|pull request\\b|diff\\b|(?:finished\\s+)?implementation\\b(?!\\s+plan\\b))|the\\s+(?:fix\\b|new\\s+head\\b))|程式碼審查|代码审查"
     }
   ]
 }

package/sbom.cdx.json

@@ -2,23 +2,23 @@
   "$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.7",
-  "serialNumber": "urn:uuid:8fcaff79-dd3a-5e6d-8ae9-f34d935267de",
+  "serialNumber": "urn:uuid:52f0d0e2-1bad-500d-83b5-0965e29f6e5d",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-16T05:41:55.836Z",
+    "timestamp": "2026-10-17T15:47:14.418Z",
     "tools": [
       {
         "vendor": "Harness Everything",
         "name": "generate-sbom.js",
-        "version": "0.31.3"
+        "version": "0.33.0"
       }
     ],
     "component": {
       "type": "application",
-      "bom-ref": "pkg:npm/harness-everything@0.31.3",
+      "bom-ref": "pkg:npm/harness-everything@0.33.0",
       "name": "harness-everything",
-      "version": "0.31.3",
-      "purl": "pkg:npm/harness-everything@0.31.3"
+      "version": "0.33.0",
+      "purl": "pkg:npm/harness-everything@0.33.0"
     }
   },
   "components": [
@@ -1999,7 +1999,7 @@
       ]
     },
     {
-      "ref": "pkg:npm/harness-everything@0.31.3",
+      "ref": "pkg:npm/harness-everything@0.33.0",
       "dependsOn": [
         "pkg:npm/%40commitlint/cli@19.8.1",
         "pkg:npm/%40commitlint/config-conventional@19.8.1",