harness-everything 0.36.1 → 0.36.3

package/harness-everything/scripts/doc-evidence.js

@@ -72,8 +72,18 @@ function artifact(entry) {
 
 // #335 P2: a baseline-bound rename destination must declare its own digest. An inherited
 // `digest` (for example Object.create({ digest })) is not explicit candidate evidence.
-function ownArtifactDigest(entry) {
-  return isPlainObject(entry) && hasOwnEntry(entry, 'digest') ? artifact(entry) : '';
+// P2(r4321077631): reads the own digest exactly once. `artifact()` inspects `entry.digest` up
+// to three times (typeof, length, value), so a stateful accessor could validate one value and
+// have the captured destination snapshot carry another. Only the applicable rename-destination
+// snapshot uses this helper; non-baseline and inapplicable lanes keep the legacy `artifact()`
+// reads for their audit identity. A throwing digest getter propagates to the caller's guarded
+// block and fails the inspection closed there. This is the single authoritative own-digest
+// helper; nothing else in this module reads a destination's own digest.
+function ownDigestOnce(entry) {
+  if (!isPlainObject(entry)) return '';
+  if (!hasOwnEntry(entry, 'digest')) return '';
+  const digest = entry.digest;
+  return typeof digest === 'string' && digest.length > 0 ? digest : '';
 }
 
 function provenanceText(record) {
@@ -142,7 +152,20 @@ function checkDocObligations({ obligations, artifacts, baseline, executionRecord
     }
     return candidateInventoryKnown;
   };
-  const baselineDigest = isPlainObject(baseline) && nonEmptyString(baseline.digest) ? baseline.digest : '';
+  // P2(r4321077638): the whole-baseline identity is read exactly once and that same scalar is
+  // validated, so a stateful getter cannot pass validation as A and have every later comparison
+  // use B. A baseline identity whose inspection throws is unusable input: the captured digest
+  // stays '', so baseline-bound evaluations fail closed through `baseline-identity-missing`
+  // instead of escaping the checker, and non-baseline callers keep the legacy '' shape.
+  let baselineDigest = '';
+  if (isPlainObject(baseline)) {
+    try {
+      const declaredBaselineDigest = baseline.digest;
+      if (nonEmptyString(declaredBaselineDigest)) baselineDigest = declaredBaselineDigest;
+    } catch {
+      baselineDigest = '';
+    }
+  }
   const executionList = Array.isArray(executionRecords) ? executionRecords.filter(isRecord) : [];
   const reviewList = Array.isArray(reviewRecords) ? reviewRecords.filter(isRecord) : [];
 
@@ -184,6 +207,16 @@ function evaluateObligation(obligation, context) {
   // #340: every accepted entry sharing a rename destination must validate the same own digest,
   // or the shared-destination snapshot is contradictory and the obligation fails closed.
   const validatedDestinationDigestMap = new Map();
+  // #342 P3: a rename destination whose own-digest read throws or returns an unusable value is
+  // still a visited snapshot. Its captured ('') value is recorded here so the ordinary capture
+  // and the audit identity never re-read that destination entry: the single metadata read stays
+  // the only digest read for that declaring entry, and a stateful getter cannot ship a later
+  // non-empty value into the audit key even though its entry was rejected. A poisoned
+  // destination is honored inside the metadata loop (a later declaring entry fails closed
+  // without reading it) and keeps precedence over a previously seeded successful snapshot;
+  // multiple accepted entries still read the destination once each by design, because their
+  // agreement check detects shared-destination contradictions.
+  const failedDestinationDigests = new Map();
   // #340 P2(r4320818749): the validated per-path baseline digest is captured once during
   // metadata validation. The audit mirror, the stale-baseline diagnostics, and baselineBound()
   // reuse that captured value instead of re-reading the caller map, so a stateful own getter
@@ -289,19 +322,38 @@ function evaluateObligation(obligation, context) {
           // keeps the un-gated legacy candidate read; only applicable obligations capture and
           // validate the destination snapshot.
           if (applicability === 'applicable') {
+            // #342 review P3: a destination poisoned by an earlier entry's failed snapshot is
+            // honored inside the metadata loop; the failed visited snapshot is never read again
+            // and this entry fails closed with it, so a stateful getter's later successful
+            // value cannot repair a shared destination or enter the audit.
+            if (failedDestinationDigests.has(entryRenameTo)) {
+              invalid(entryPath, `its rename destination ${JSON.stringify(entryRenameTo)} failed an earlier snapshot validation for this obligation; the failed destination is not read again and this entry fails closed with it`);
+              continue;
+            }
             let destinationDigest = '';
             try {
               if (hasOwnEntry(artifactMap, entryRenameTo)) {
-                destinationDigest = ownArtifactDigest(artifactMap[entryRenameTo]);
+                // P2(r4321077631): read the destination's own digest exactly once; the captured
+                // value is the one validated below and the one that flows to the metadata cache,
+                // binding, the stale diagnostics, and the audit identity. A stateful destination
+                // getter cannot be validated as B while a record carrying only its later C passes.
+                destinationDigest = ownDigestOnce(artifactMap[entryRenameTo]);
               }
             } catch {
               candidateInventoryInspectionFailed = true;
+              // #342 P3: the destination is a visited snapshot even when its digest read threw;
+              // record it so the capture and audit lanes never re-read it.
+              failedDestinationDigests.set(entryRenameTo, '');
               continue;
             }
-            // #340: the captured own value must be a usable non-empty string; `artifact()` can read
-            // a stateful accessor three times, so a non-string result is not carried or seeded.
+            // #340: the captured own value must be a usable non-empty string; an unusable result
+            // is not carried or seeded.
             if (!nonEmptyString(destinationDigest)) {
               invalid(entryPath, `its rename destination ${JSON.stringify(entryRenameTo)} has no candidate artifact`);
+              // #342 P3: the destination is a visited snapshot even when its own digest is
+              // unusable; record it so the capture and audit lanes never re-read it and cannot
+              // describe a stateful getter's later non-empty value.
+              failedDestinationDigests.set(entryRenameTo, '');
               continue;
             }
             // #340: entries that share one rename destination must agree on the validated own
@@ -377,7 +429,9 @@ function evaluateObligation(obligation, context) {
     // its own digest during metadata. Seed the captured snapshot from that validated value and
     // never read the destination through the raw candidate map again, so a destination accessor
     // that throws or changes after validation cannot make capture/binding/audit disagree. The
-    // seeded value is the validated own digest, never a caller-asserted rawEntry field.
+    // seeded value is the validated own digest, never a caller-asserted rawEntry field. A
+    // rejected destination is still visited: its failed capture (see failedDestinationDigests)
+    // suppresses the ordinary read below, so no destination entry is ever read twice.
     for (const entry of baselineEntries.values()) {
       if (entry.reason === 'rename-from' && nonEmptyString(entry.renameDestinationDigest)
         && !candidateDigestCache.has(entry.renameTo)) {
@@ -385,7 +439,8 @@ function evaluateObligation(obligation, context) {
       }
     }
     for (const path of scopePaths) {
-      if (baselineEntries.has(path) || candidateDigestCache.has(path)) continue;
+      if (baselineEntries.has(path) || candidateDigestCache.has(path)
+        || failedDestinationDigests.has(path)) continue;
       try {
         candidateDigestCache.set(path, artifact(artifactMap[path]));
       } catch {
@@ -428,6 +483,11 @@ function evaluateObligation(obligation, context) {
   // stale verdict disagree with the digest that actually bound evidence. Untouched paths and
   // unannotated callers keep the legacy read.
   const candidateDigestOf = (path) => {
+    // #342 P3: poisoned state takes precedence over the capture cache. A rejected rename
+    // destination keeps its visited '' capture even when an earlier accepted entry seeded a
+    // successful value, so the audit never describes a value the getter shipped after a failed
+    // snapshot made the obligation fail closed; the caller map is never read for it again.
+    if (failedDestinationDigests.has(path)) return '';
     if (candidateDigestCache.has(path)) return candidateDigestCache.get(path);
     // #340: only an applicable baseline-annotated obligation validated the source absence as
     // part of its captured snapshot. `N/A` and `unknown` obligations never bind evidence, so they
@@ -509,7 +569,7 @@ function evaluateObligation(obligation, context) {
       // candidate lane, the audit identity, and the stale diagnostics use, so a stateful nested
       // accessor cannot make binding disagree with them. Metadata validation already required the
       // destination to be an own-key candidate inventory entry carrying its own digest
-      // (ownArtifactDigest), so a non-empty captured digest is required here and the accessor is
+      // (ownDigestOnce), so a non-empty captured digest is required here and the accessor is
       // never re-read; a missing destination skips capture and lands on this guard.
       const capturedDestination = candidateDigestCache.get(entry.renameTo);
       if (!nonEmptyString(capturedDestination)) return false;

package/harness-everything/scripts/project-docs-resolver.js

@@ -78,6 +78,25 @@ function isPlainObject(value) {
   return prototype === Object.prototype || prototype === null;
 }
 
+function normalizeHostProjectDocs(projectDocs) {
+  if (!isPlainObject(projectDocs)) return { projectDocs, warnings: [] };
+
+  const normalized = { ...projectDocs };
+  const warnings = [];
+  if (typeof normalized.domains === 'string') {
+    if (typeof normalized.domainLocation !== 'string' || !normalized.domainLocation.trim()) {
+      normalized.domainLocation = normalized.domains;
+    }
+    delete normalized.domains;
+    warnings.push({
+      code: 'deprecated-domains-string',
+      severity: 'warning',
+      message: 'host projectDocs.domains as a string is deprecated; use domainLocation for the zone path and domains as the ID-prefix array'
+    });
+  }
+  return { projectDocs: normalized, warnings };
+}
+
 function projectDocsConfigPath(workspaceRoot) {
   return path.join(workspaceRoot, PROJECT_DOCS_CONFIG);
 }
@@ -148,22 +167,12 @@ function inspectHostProjectDocs(workspaceRoot) {
       continue;
     }
 
-    const projectDocs = { ...manifest.projectDocs };
-    if (typeof projectDocs.domains === 'string') {
-      if (typeof projectDocs.domainLocation !== 'string' || !projectDocs.domainLocation.trim()) {
-        projectDocs.domainLocation = projectDocs.domains;
-      }
-      delete projectDocs.domains;
-      entry.warnings.push({
-        code: 'deprecated-domains-string',
-        severity: 'warning',
-        path: configSource(workspaceRoot, file),
-        message: 'host projectDocs.domains as a string is deprecated; use domainLocation for the zone path and domains as the ID-prefix array'
-      });
-    }
+    const normalizedHost = normalizeHostProjectDocs(manifest.projectDocs);
+    const projectDocs = normalizedHost.projectDocs;
 
     const validation = validateDocsConfig(projectDocs);
     const source = configSource(workspaceRoot, file);
+    entry.warnings.push(...normalizedHost.warnings.map(item => ({ ...item, path: source })));
     entry.warnings.push(...validation.warnings.map(item => ({ ...item, path: source })));
     if (!validation.valid) {
       const details = validation.diagnostics.map(item => item.message).join('; ');
@@ -236,6 +245,13 @@ function validateDocsConfig(config) {
     return { valid: false, diagnostics, warnings };
   }
 
+  for (const field of ['docLocation', 'tracker', 'issueDefinition']) {
+    if (config[field] !== undefined && typeof config[field] !== 'string') {
+      const diagnosticField = field.replace(/[A-Z]/g, letter => `-${letter.toLowerCase()}`);
+      invalid(`invalid-${diagnosticField}-type`, `${field} must be a string when provided`);
+    }
+  }
+
   for (const key of Object.keys(config).sort()) {
     if (!PROJECT_DOC_CONFIG_KEYS.has(key)) {
       warnings.push({
@@ -754,6 +770,7 @@ module.exports = {
   readProjectDocs,
   resolveDocsConfig,
   validateDocsConfig,
+  normalizeHostProjectDocs,
   parseContextMap,
   resolveProjectDocs,
   detectProjectDocsConventions,

package/multi-agent-workspace/SKILL.md

@@ -4,7 +4,7 @@ description: "Scaffold a verified multi-agent workspace and select bounded speci
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.34.0
+  version: 0.36.3
 ---
 
 # Multi-Agent Workspace

package/multi-agent-workspace/scripts/project-docs-resolver.js

@@ -78,6 +78,25 @@ function isPlainObject(value) {
   return prototype === Object.prototype || prototype === null;
 }
 
+function normalizeHostProjectDocs(projectDocs) {
+  if (!isPlainObject(projectDocs)) return { projectDocs, warnings: [] };
+
+  const normalized = { ...projectDocs };
+  const warnings = [];
+  if (typeof normalized.domains === 'string') {
+    if (typeof normalized.domainLocation !== 'string' || !normalized.domainLocation.trim()) {
+      normalized.domainLocation = normalized.domains;
+    }
+    delete normalized.domains;
+    warnings.push({
+      code: 'deprecated-domains-string',
+      severity: 'warning',
+      message: 'host projectDocs.domains as a string is deprecated; use domainLocation for the zone path and domains as the ID-prefix array'
+    });
+  }
+  return { projectDocs: normalized, warnings };
+}
+
 function projectDocsConfigPath(workspaceRoot) {
   return path.join(workspaceRoot, PROJECT_DOCS_CONFIG);
 }
@@ -148,22 +167,12 @@ function inspectHostProjectDocs(workspaceRoot) {
       continue;
     }
 
-    const projectDocs = { ...manifest.projectDocs };
-    if (typeof projectDocs.domains === 'string') {
-      if (typeof projectDocs.domainLocation !== 'string' || !projectDocs.domainLocation.trim()) {
-        projectDocs.domainLocation = projectDocs.domains;
-      }
-      delete projectDocs.domains;
-      entry.warnings.push({
-        code: 'deprecated-domains-string',
-        severity: 'warning',
-        path: configSource(workspaceRoot, file),
-        message: 'host projectDocs.domains as a string is deprecated; use domainLocation for the zone path and domains as the ID-prefix array'
-      });
-    }
+    const normalizedHost = normalizeHostProjectDocs(manifest.projectDocs);
+    const projectDocs = normalizedHost.projectDocs;
 
     const validation = validateDocsConfig(projectDocs);
     const source = configSource(workspaceRoot, file);
+    entry.warnings.push(...normalizedHost.warnings.map(item => ({ ...item, path: source })));
     entry.warnings.push(...validation.warnings.map(item => ({ ...item, path: source })));
     if (!validation.valid) {
       const details = validation.diagnostics.map(item => item.message).join('; ');
@@ -236,6 +245,13 @@ function validateDocsConfig(config) {
     return { valid: false, diagnostics, warnings };
   }
 
+  for (const field of ['docLocation', 'tracker', 'issueDefinition']) {
+    if (config[field] !== undefined && typeof config[field] !== 'string') {
+      const diagnosticField = field.replace(/[A-Z]/g, letter => `-${letter.toLowerCase()}`);
+      invalid(`invalid-${diagnosticField}-type`, `${field} must be a string when provided`);
+    }
+  }
+
   for (const key of Object.keys(config).sort()) {
     if (!PROJECT_DOC_CONFIG_KEYS.has(key)) {
       warnings.push({
@@ -754,6 +770,7 @@ module.exports = {
   readProjectDocs,
   resolveDocsConfig,
   validateDocsConfig,
+  normalizeHostProjectDocs,
   parseContextMap,
   resolveProjectDocs,
   detectProjectDocsConventions,

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.36.1",
+  "version": "0.36.3",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.36.1",
+  "version": "0.36.3",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.36.1",
+  "version": "0.36.3",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.36.1",
+  "version": "0.36.3",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/skills/harness-everything/SKILL.md

@@ -4,7 +4,7 @@ description: "Route software/project work through Harness: classify tier/topolog
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.36.1
+  version: 0.36.3
 ---
 
 # Harness Everything

package/plugins/harness-everything/skills/harness-everything/scripts/doc-evidence.js

@@ -72,8 +72,18 @@ function artifact(entry) {
 
 // #335 P2: a baseline-bound rename destination must declare its own digest. An inherited
 // `digest` (for example Object.create({ digest })) is not explicit candidate evidence.
-function ownArtifactDigest(entry) {
-  return isPlainObject(entry) && hasOwnEntry(entry, 'digest') ? artifact(entry) : '';
+// P2(r4321077631): reads the own digest exactly once. `artifact()` inspects `entry.digest` up
+// to three times (typeof, length, value), so a stateful accessor could validate one value and
+// have the captured destination snapshot carry another. Only the applicable rename-destination
+// snapshot uses this helper; non-baseline and inapplicable lanes keep the legacy `artifact()`
+// reads for their audit identity. A throwing digest getter propagates to the caller's guarded
+// block and fails the inspection closed there. This is the single authoritative own-digest
+// helper; nothing else in this module reads a destination's own digest.
+function ownDigestOnce(entry) {
+  if (!isPlainObject(entry)) return '';
+  if (!hasOwnEntry(entry, 'digest')) return '';
+  const digest = entry.digest;
+  return typeof digest === 'string' && digest.length > 0 ? digest : '';
 }
 
 function provenanceText(record) {
@@ -142,7 +152,20 @@ function checkDocObligations({ obligations, artifacts, baseline, executionRecord
     }
     return candidateInventoryKnown;
   };
-  const baselineDigest = isPlainObject(baseline) && nonEmptyString(baseline.digest) ? baseline.digest : '';
+  // P2(r4321077638): the whole-baseline identity is read exactly once and that same scalar is
+  // validated, so a stateful getter cannot pass validation as A and have every later comparison
+  // use B. A baseline identity whose inspection throws is unusable input: the captured digest
+  // stays '', so baseline-bound evaluations fail closed through `baseline-identity-missing`
+  // instead of escaping the checker, and non-baseline callers keep the legacy '' shape.
+  let baselineDigest = '';
+  if (isPlainObject(baseline)) {
+    try {
+      const declaredBaselineDigest = baseline.digest;
+      if (nonEmptyString(declaredBaselineDigest)) baselineDigest = declaredBaselineDigest;
+    } catch {
+      baselineDigest = '';
+    }
+  }
   const executionList = Array.isArray(executionRecords) ? executionRecords.filter(isRecord) : [];
   const reviewList = Array.isArray(reviewRecords) ? reviewRecords.filter(isRecord) : [];
 
@@ -184,6 +207,16 @@ function evaluateObligation(obligation, context) {
   // #340: every accepted entry sharing a rename destination must validate the same own digest,
   // or the shared-destination snapshot is contradictory and the obligation fails closed.
   const validatedDestinationDigestMap = new Map();
+  // #342 P3: a rename destination whose own-digest read throws or returns an unusable value is
+  // still a visited snapshot. Its captured ('') value is recorded here so the ordinary capture
+  // and the audit identity never re-read that destination entry: the single metadata read stays
+  // the only digest read for that declaring entry, and a stateful getter cannot ship a later
+  // non-empty value into the audit key even though its entry was rejected. A poisoned
+  // destination is honored inside the metadata loop (a later declaring entry fails closed
+  // without reading it) and keeps precedence over a previously seeded successful snapshot;
+  // multiple accepted entries still read the destination once each by design, because their
+  // agreement check detects shared-destination contradictions.
+  const failedDestinationDigests = new Map();
   // #340 P2(r4320818749): the validated per-path baseline digest is captured once during
   // metadata validation. The audit mirror, the stale-baseline diagnostics, and baselineBound()
   // reuse that captured value instead of re-reading the caller map, so a stateful own getter
@@ -289,19 +322,38 @@ function evaluateObligation(obligation, context) {
           // keeps the un-gated legacy candidate read; only applicable obligations capture and
           // validate the destination snapshot.
           if (applicability === 'applicable') {
+            // #342 review P3: a destination poisoned by an earlier entry's failed snapshot is
+            // honored inside the metadata loop; the failed visited snapshot is never read again
+            // and this entry fails closed with it, so a stateful getter's later successful
+            // value cannot repair a shared destination or enter the audit.
+            if (failedDestinationDigests.has(entryRenameTo)) {
+              invalid(entryPath, `its rename destination ${JSON.stringify(entryRenameTo)} failed an earlier snapshot validation for this obligation; the failed destination is not read again and this entry fails closed with it`);
+              continue;
+            }
             let destinationDigest = '';
             try {
               if (hasOwnEntry(artifactMap, entryRenameTo)) {
-                destinationDigest = ownArtifactDigest(artifactMap[entryRenameTo]);
+                // P2(r4321077631): read the destination's own digest exactly once; the captured
+                // value is the one validated below and the one that flows to the metadata cache,
+                // binding, the stale diagnostics, and the audit identity. A stateful destination
+                // getter cannot be validated as B while a record carrying only its later C passes.
+                destinationDigest = ownDigestOnce(artifactMap[entryRenameTo]);
               }
             } catch {
               candidateInventoryInspectionFailed = true;
+              // #342 P3: the destination is a visited snapshot even when its digest read threw;
+              // record it so the capture and audit lanes never re-read it.
+              failedDestinationDigests.set(entryRenameTo, '');
               continue;
             }
-            // #340: the captured own value must be a usable non-empty string; `artifact()` can read
-            // a stateful accessor three times, so a non-string result is not carried or seeded.
+            // #340: the captured own value must be a usable non-empty string; an unusable result
+            // is not carried or seeded.
             if (!nonEmptyString(destinationDigest)) {
               invalid(entryPath, `its rename destination ${JSON.stringify(entryRenameTo)} has no candidate artifact`);
+              // #342 P3: the destination is a visited snapshot even when its own digest is
+              // unusable; record it so the capture and audit lanes never re-read it and cannot
+              // describe a stateful getter's later non-empty value.
+              failedDestinationDigests.set(entryRenameTo, '');
               continue;
             }
             // #340: entries that share one rename destination must agree on the validated own
@@ -377,7 +429,9 @@ function evaluateObligation(obligation, context) {
     // its own digest during metadata. Seed the captured snapshot from that validated value and
     // never read the destination through the raw candidate map again, so a destination accessor
     // that throws or changes after validation cannot make capture/binding/audit disagree. The
-    // seeded value is the validated own digest, never a caller-asserted rawEntry field.
+    // seeded value is the validated own digest, never a caller-asserted rawEntry field. A
+    // rejected destination is still visited: its failed capture (see failedDestinationDigests)
+    // suppresses the ordinary read below, so no destination entry is ever read twice.
     for (const entry of baselineEntries.values()) {
       if (entry.reason === 'rename-from' && nonEmptyString(entry.renameDestinationDigest)
         && !candidateDigestCache.has(entry.renameTo)) {
@@ -385,7 +439,8 @@ function evaluateObligation(obligation, context) {
       }
     }
     for (const path of scopePaths) {
-      if (baselineEntries.has(path) || candidateDigestCache.has(path)) continue;
+      if (baselineEntries.has(path) || candidateDigestCache.has(path)
+        || failedDestinationDigests.has(path)) continue;
       try {
         candidateDigestCache.set(path, artifact(artifactMap[path]));
       } catch {
@@ -428,6 +483,11 @@ function evaluateObligation(obligation, context) {
   // stale verdict disagree with the digest that actually bound evidence. Untouched paths and
   // unannotated callers keep the legacy read.
   const candidateDigestOf = (path) => {
+    // #342 P3: poisoned state takes precedence over the capture cache. A rejected rename
+    // destination keeps its visited '' capture even when an earlier accepted entry seeded a
+    // successful value, so the audit never describes a value the getter shipped after a failed
+    // snapshot made the obligation fail closed; the caller map is never read for it again.
+    if (failedDestinationDigests.has(path)) return '';
     if (candidateDigestCache.has(path)) return candidateDigestCache.get(path);
     // #340: only an applicable baseline-annotated obligation validated the source absence as
     // part of its captured snapshot. `N/A` and `unknown` obligations never bind evidence, so they
@@ -509,7 +569,7 @@ function evaluateObligation(obligation, context) {
       // candidate lane, the audit identity, and the stale diagnostics use, so a stateful nested
       // accessor cannot make binding disagree with them. Metadata validation already required the
       // destination to be an own-key candidate inventory entry carrying its own digest
-      // (ownArtifactDigest), so a non-empty captured digest is required here and the accessor is
+      // (ownDigestOnce), so a non-empty captured digest is required here and the accessor is
       // never re-read; a missing destination skips capture and lands on this guard.
       const capturedDestination = candidateDigestCache.get(entry.renameTo);
       if (!nonEmptyString(capturedDestination)) return false;

package/plugins/harness-everything/skills/harness-everything/scripts/project-docs-resolver.js

@@ -78,6 +78,25 @@ function isPlainObject(value) {
   return prototype === Object.prototype || prototype === null;
 }
 
+function normalizeHostProjectDocs(projectDocs) {
+  if (!isPlainObject(projectDocs)) return { projectDocs, warnings: [] };
+
+  const normalized = { ...projectDocs };
+  const warnings = [];
+  if (typeof normalized.domains === 'string') {
+    if (typeof normalized.domainLocation !== 'string' || !normalized.domainLocation.trim()) {
+      normalized.domainLocation = normalized.domains;
+    }
+    delete normalized.domains;
+    warnings.push({
+      code: 'deprecated-domains-string',
+      severity: 'warning',
+      message: 'host projectDocs.domains as a string is deprecated; use domainLocation for the zone path and domains as the ID-prefix array'
+    });
+  }
+  return { projectDocs: normalized, warnings };
+}
+
 function projectDocsConfigPath(workspaceRoot) {
   return path.join(workspaceRoot, PROJECT_DOCS_CONFIG);
 }
@@ -148,22 +167,12 @@ function inspectHostProjectDocs(workspaceRoot) {
       continue;
     }
 
-    const projectDocs = { ...manifest.projectDocs };
-    if (typeof projectDocs.domains === 'string') {
-      if (typeof projectDocs.domainLocation !== 'string' || !projectDocs.domainLocation.trim()) {
-        projectDocs.domainLocation = projectDocs.domains;
-      }
-      delete projectDocs.domains;
-      entry.warnings.push({
-        code: 'deprecated-domains-string',
-        severity: 'warning',
-        path: configSource(workspaceRoot, file),
-        message: 'host projectDocs.domains as a string is deprecated; use domainLocation for the zone path and domains as the ID-prefix array'
-      });
-    }
+    const normalizedHost = normalizeHostProjectDocs(manifest.projectDocs);
+    const projectDocs = normalizedHost.projectDocs;
 
     const validation = validateDocsConfig(projectDocs);
     const source = configSource(workspaceRoot, file);
+    entry.warnings.push(...normalizedHost.warnings.map(item => ({ ...item, path: source })));
     entry.warnings.push(...validation.warnings.map(item => ({ ...item, path: source })));
     if (!validation.valid) {
       const details = validation.diagnostics.map(item => item.message).join('; ');
@@ -236,6 +245,13 @@ function validateDocsConfig(config) {
     return { valid: false, diagnostics, warnings };
   }
 
+  for (const field of ['docLocation', 'tracker', 'issueDefinition']) {
+    if (config[field] !== undefined && typeof config[field] !== 'string') {
+      const diagnosticField = field.replace(/[A-Z]/g, letter => `-${letter.toLowerCase()}`);
+      invalid(`invalid-${diagnosticField}-type`, `${field} must be a string when provided`);
+    }
+  }
+
   for (const key of Object.keys(config).sort()) {
     if (!PROJECT_DOC_CONFIG_KEYS.has(key)) {
       warnings.push({
@@ -754,6 +770,7 @@ module.exports = {
   readProjectDocs,
   resolveDocsConfig,
   validateDocsConfig,
+  normalizeHostProjectDocs,
   parseContextMap,
   resolveProjectDocs,
   detectProjectDocsConventions,

package/plugins/harness-everything/skills/multi-agent-workspace/SKILL.md

@@ -4,7 +4,7 @@ description: "Scaffold a verified multi-agent workspace and select bounded speci
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.34.0
+  version: 0.36.3
 ---
 
 # Multi-Agent Workspace

package/plugins/harness-everything/skills/multi-agent-workspace/scripts/project-docs-resolver.js

@@ -78,6 +78,25 @@ function isPlainObject(value) {
   return prototype === Object.prototype || prototype === null;
 }
 
+function normalizeHostProjectDocs(projectDocs) {
+  if (!isPlainObject(projectDocs)) return { projectDocs, warnings: [] };
+
+  const normalized = { ...projectDocs };
+  const warnings = [];
+  if (typeof normalized.domains === 'string') {
+    if (typeof normalized.domainLocation !== 'string' || !normalized.domainLocation.trim()) {
+      normalized.domainLocation = normalized.domains;
+    }
+    delete normalized.domains;
+    warnings.push({
+      code: 'deprecated-domains-string',
+      severity: 'warning',
+      message: 'host projectDocs.domains as a string is deprecated; use domainLocation for the zone path and domains as the ID-prefix array'
+    });
+  }
+  return { projectDocs: normalized, warnings };
+}
+
 function projectDocsConfigPath(workspaceRoot) {
   return path.join(workspaceRoot, PROJECT_DOCS_CONFIG);
 }
@@ -148,22 +167,12 @@ function inspectHostProjectDocs(workspaceRoot) {
       continue;
     }
 
-    const projectDocs = { ...manifest.projectDocs };
-    if (typeof projectDocs.domains === 'string') {
-      if (typeof projectDocs.domainLocation !== 'string' || !projectDocs.domainLocation.trim()) {
-        projectDocs.domainLocation = projectDocs.domains;
-      }
-      delete projectDocs.domains;
-      entry.warnings.push({
-        code: 'deprecated-domains-string',
-        severity: 'warning',
-        path: configSource(workspaceRoot, file),
-        message: 'host projectDocs.domains as a string is deprecated; use domainLocation for the zone path and domains as the ID-prefix array'
-      });
-    }
+    const normalizedHost = normalizeHostProjectDocs(manifest.projectDocs);
+    const projectDocs = normalizedHost.projectDocs;
 
     const validation = validateDocsConfig(projectDocs);
     const source = configSource(workspaceRoot, file);
+    entry.warnings.push(...normalizedHost.warnings.map(item => ({ ...item, path: source })));
     entry.warnings.push(...validation.warnings.map(item => ({ ...item, path: source })));
     if (!validation.valid) {
       const details = validation.diagnostics.map(item => item.message).join('; ');
@@ -236,6 +245,13 @@ function validateDocsConfig(config) {
     return { valid: false, diagnostics, warnings };
   }
 
+  for (const field of ['docLocation', 'tracker', 'issueDefinition']) {
+    if (config[field] !== undefined && typeof config[field] !== 'string') {
+      const diagnosticField = field.replace(/[A-Z]/g, letter => `-${letter.toLowerCase()}`);
+      invalid(`invalid-${diagnosticField}-type`, `${field} must be a string when provided`);
+    }
+  }
+
   for (const key of Object.keys(config).sort()) {
     if (!PROJECT_DOC_CONFIG_KEYS.has(key)) {
       warnings.push({
@@ -754,6 +770,7 @@ module.exports = {
   readProjectDocs,
   resolveDocsConfig,
   validateDocsConfig,
+  normalizeHostProjectDocs,
   parseContextMap,
   resolveProjectDocs,
   detectProjectDocsConventions,