harness-everything 0.38.0 → 0.39.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.38.0",
+      "version": "0.39.0",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.38.0",
+  "version": "0.39.0",
   "author": {
     "name": "Miya Daniel"
   },

package/AGENTS.md

@@ -1,93 +1,109 @@
 ---
-description: Operating guide for AI agents working inside the Harness-everything repository — layout, change rules, quality gates, and release policy.
+description: Operating guide for AI agents working inside the Harness-everything repository — how we work, layout, change rules, quality gates, and release policy.
 ---
 
 # AGENTS.md — Working in This Repository
 
-You are modifying **Harness**: an orchestrated agent operating system (skills + hooks/plugins + routing) for AI coding agents. Changes here ship to real agent sessions; a vague `SKILL.md`, stale manifest, contradictory platform claim, or selected workflow that remains bypassable can misroute other people's agents. Precision is the product.
+You are modifying **Harness**: an orchestrated agent operating system (skills + hooks/plugins + routing) for AI coding agents. Changes here ship to real agent sessions. A vague `SKILL.md`, a stale manifest, a contradictory platform claim or a bypassable selected workflow can misroute other people's agents. Precision is the product.
+
+## How We Work
+
+Harness exists to put agents on the **fastest path to a working result**, not to fence them in. Prefer mechanisms that make the right action the easy one over written demands that agents talk themselves out of.
+
+```mermaid
+flowchart LR
+  A["1. Wire the whole path<br/>(smallest end-to-end version)"] --> B["2. Record a baseline<br/>on that path"]
+  B --> C["3. Improve one thing per stage,<br/>compare to the baseline"]
+  C --> D["4. Lock behaviour<br/>with tests against drift"]
+  C -. "effect not measurable<br/>on the full path" .-> A
+```
+
+- **Whole path first.** Do not polish details or add tests for parts that are not connected yet.
+- **Stages follow the full path.** A stage whose effect cannot be measured end to end is split wrongly.
+- **Mechanisms over mandates.** Put recurring rules in CI, hooks, mods or templates so actions match them naturally. A new prose MUST is the last resort.
+- **Dogfood the rules.** Docs, packets and reports written here follow the same doc rules Harness ships.
+- **Coordinator role.** In multi-agent work the coordinator dispatches and analyses. Agents and the reviewer check each step; the coordinator re-verifies everything at the final stage.
+
+### Writing docs (this file included)
+
+1. **Mermaid** for anything that can be drawn: flows, stages, dependencies, state.
+2. **Short bullets or tables** for rules and facts.
+3. **Prose** only for detail that needs it; link it rather than inline it.
 
 ## Repository Layout
 
 | Path | What it is |
 |---|---|
 | `<skill-name>/SKILL.md` | One canonical skill per top-level directory. Frontmatter: `name`, `description`, `metadata.author`, `metadata.version`. |
-| `hooks/` | Claude Code lifecycle hook scripts and shared mechanisms such as circuit breaker, workflow/action/scope guards, and stop gates. Do not infer that every host packages every hook. |
+| `hooks/` | Claude Code lifecycle hooks and shared mechanisms (circuit breaker, workflow/action/scope guards, stop gates). Not every host packages every hook. |
 | `harness-everything/scripts/` | Runtime: kernel/tier routing, workflow contract, verification, bootstrap, self-heal. |
-| `opencode-plugin/` | OpenCode native plugin implementation. Mechanism-tested, with partial live-host evidence for project-scope `.js` loading and edit/verification state on OpenCode 1.18.31 (macOS); see the evidence boundary below. |
+| `opencode-plugin/` | OpenCode native plugin. Mechanism-tested, with partial live-host evidence (see the boundary below). |
 | `.agents/plugins/` + `plugins/harness-everything/` | Local OpenAI/Codex marketplace + `.codex-plugin` package with canonical skill copies and packaged session/prompt hooks. |
 | `submission/openai/` | Public OpenAI Skills-only listing/test inputs. The public artifact does not include local `.codex-plugin` lifecycle hooks. |
 | `evals/<skill>/` | Trigger/routing eval per skill (waza format). Required for every canonical routed skill. |
-| `behavioral-evals/` | LLM-behavior cases run via headless CLI sessions and structurally validated by CI. |
+| `behavioral-evals/` | LLM-behavior cases run via headless CLI sessions, structurally validated by CI. |
 | `benchmarks/` | BENCHMARK_SOP fixtures and recorded results. Evidence lives here or nowhere. |
-| `.claude-plugin/` | Claude Code plugin distribution manifests. Must list exactly the on-disk canonical skills. |
-| `docs/platform-capabilities.md` | Canonical current platform/install/enforcement/evidence matrix. |
-| `docs/repository-contract.md` | Generated current-state Node/workflow/action/gate contract. Regenerate with `npm run docs:sync`; do not hand-edit. |
-| `.nvmrc` | Primary development/CI Node runtime. `package.json#engines.node` remains the minimum supported runtime. |
-| `docs/`, `references/` | Philosophy, architecture, workflow documentation, shared checklists. |
+| `.claude-plugin/` | Claude Code plugin manifests. Must list exactly the on-disk canonical skills. |
+| `docs/platform-capabilities.md` | Canonical platform/install/enforcement/evidence matrix. |
+| `docs/repository-contract.md` | Generated Node/workflow/action/gate contract. Regenerate with `npm run docs:sync`; never hand-edit. |
+| `.nvmrc` | Primary dev/CI Node runtime. `package.json#engines.node` stays the supported minimum. |
+| `docs/`, `references/` | Philosophy, architecture, workflow docs, shared checklists. |
 
 ## OpenCode evidence boundary
 
-The retained [OpenCode evidence](benchmarks/results/live-host/opencode-2026-09-16/README.md) supports project-scope `.js` loading and edit/verification state on OpenCode 1.18.31 (macOS). The final snapshot is post-reset (`hardLock: false`, `count: 1`). Hard lock is only an interactive observation with no retained blocked-tool trace; reflection was operator-seeded, then agent-rewritten. Agent-controlled state deletion resets the breaker. Global scope, npm-package installation, and other OpenCode versions remain unverified.
-
-## Non-Negotiable Change Rules
-
-1. **Every canonical SKILL.md keeps ≤ 500 tokens** (hard CI gate) and must contain `## USE FOR:` and `## DO NOT USE FOR:`. Deep detail goes in references/guides.
-2. **Descriptions are routing surfaces.** Differentiate neighboring skills deliberately; `test:collision` guards overlap.
-3. **A new canonical skill ships with a routing eval.** Positive task `description:` must exactly match the skill frontmatter description.
-4. **Release version policy:** normal PRs do not manually bump package/plugin versions. `semantic-release` owns stable SemVer and `scripts/sync-release-version.js` owns distribution synchronization. Nested sub-skills inherit their parent skill version.
-5. **Distribution manifests are generated facts:** add/remove/rename changes must sync every copied/listed distribution. Run `npm run plugin:sync`, `npm run test:consistency`, and `npm run test:plugin:openai`.
-6. **Platform capability claims are tested contracts.** Update `docs/platform-capabilities.md` with integration behavior changes. Package/mechanism evidence is not live-host evidence, and public Skills-only behavior does not include local lifecycle hooks.
-7. **Runtime/workflow claims are generated facts.** `package.json`, `.nvmrc`, Dockerfile, and active workflows feed `scripts/repository-contract.js`; run `npm run docs:sync` after relevant changes.
-8. **CHANGELOG.md keeps pending human-authored notes under `[Unreleased]`.** Semantic-release owns stable headings/tags/release notes.
-9. **Conventional Commit type is release input.** Breaking→major; `feat`→minor; `fix`/`perf`/`refactor`/`build`/`revert`→patch; docs/test/ci/style/chore do not release by themselves.
-10. **Selected workflow is a semantic contract; tactics remain flexible.** Compose ordered requirement steps with declared required/optional skill or reference bindings. Load/resolve bindings only when their step (or dependency-ready Fable stage) is active; required bindings MUST resolve before that step passes, and applicable skill core contracts MUST be followed. Unknown/unavailable bindings stay visible and unresolved. Selected-topology obligations MUST resolve; missing host evidence may produce reminders, not a persistent Harness lock.
-11. **User-visible Harness Status is mandatory for non-trivial work.** Render one readable Markdown block headed `### 🚦 Harness Status`, with bullet-aligned bold `Current`, `Read / Evidence`, `Next`, plus optional `Risk / Blocked`; use nested evidence bullets when useful. Emit it before substantive execution, after major phases, on direction changes, during long work at meaningful boundaries, and before final completion. The routing checkpoint is internal source state, not a second user-facing block. This semantic MUST does not create a hard lock.
-12. **Tier-3/Fable isolation disposition is mandatory before broad mutation.** Use/reuse a verified linked Git worktree, or record an explicit degraded fallback when isolation is unavailable or the user explicitly chooses to stay in place. Ordinary isolation SHOULD be used when it materially reduces collision/risk. Failure to isolate is a visible semantic gap, not a Harness-owned deadlock. See [workflow-runtime.md](docs/workflow-runtime.md).
-13. **Use contract strength deliberately.** MUST = required semantic obligation; SHOULD = expected default with an evidence-based exception; MAY = optional optimization. Do not use recommend/prefer/advisory/guidance to weaken a MUST. See [philosophy.md](docs/philosophy.md#contract-strength-must--should--may).
-14. **The turn label line is mandatory on every turn, trivial ones included.** End the final message of every turn — short answers, lookups, questions back to the user — with one hidden `<!-- harness-label {...} -->` line: your own post-work judgement of validity, context dependence, tier, intents, workflow and skills used ([docs/routing.md](docs/routing.md#turn-label-line)). It records data and never gates routing.
+The retained [OpenCode evidence](benchmarks/results/live-host/opencode-2026-09-16/README.md) supports project-scope `.js` loading and edit/verification state on OpenCode 1.18.31 (macOS).
 
-## Verification Before You Claim Done
+- The final snapshot is post-reset (`hardLock: false`, `count: 1`).
+- Hard lock is only an interactive observation with no retained blocked-tool trace.
+- Reflection was operator-seeded, then agent-rewritten. Agent-controlled state deletion resets the breaker.
+- Global scope, npm-package installation, and other OpenCode versions remain unverified.
 
-Run the gates that cover the same contract categories as CI:
-
-```bash
-npm test
-npm run test:mutations
-npm run test:mechanism
-npm run test:consistency
-npm run test:repo-contract
-npm run test:docs:capabilities
-npm run test:references
-npm run test:release
-npm run test:collision
-npm run test:routing:skills
-npm run test:routing:invariants
-npm run test:plugin:openai
-npm run test:plugin:submission
-npm run test:platform:compatibility
-npm run test:portability
-```
+## Change Rules
 
-`npm run verify:all` runs this set in CI order and prints paste-ready evidence; every known gate stays in the report as PASS/FAIL/UNCHECKED with a reason. `-- --fast` runs the pre-push subset, `-- --clean` runs every gate in a fresh detached worktree of HEAD, and `-- --node22` adds the Node.js 22 execution smoke-test lane (Node 22 dependency-install compatibility stays UNCHECKED locally; CI's runtime-floor job owns it).
+**Skills and routing**
 
-If waza is installed (`~/bin/waza`), also run:
+1. **Every canonical SKILL.md keeps ≤ 500 tokens** (CI gate) and contains `## USE FOR:` and `## DO NOT USE FOR:`. Detail goes in references/guides.
+2. **Descriptions are routing surfaces.** Differentiate neighbouring skills deliberately; `test:collision` guards overlap.
+3. **A new canonical skill ships with a routing eval.** The positive task `description:` exactly matches the skill frontmatter description.
 
-```bash
-waza check <skill-dir>
-waza spec verify <skill> evals/<skill>/eval.yaml --fail --threshold 1
-waza tokens check
-```
+**Release and distribution**
 
-Node.js 24 is primary CI across Ubuntu/Windows/macOS; a Node.js 22 lane protects the supported minimum. See [docs/repository-contract.md](docs/repository-contract.md).
+4. **Versions:** normal PRs never bump versions. `semantic-release` owns SemVer; `scripts/sync-release-version.js` syncs distributions. Nested sub-skills inherit their parent's version.
+5. **Distribution manifests are generated facts.** After add/remove/rename run `npm run plugin:sync`, `npm run test:consistency` and `npm run test:plugin:openai`.
+6. **Platform capability claims are tested contracts.** Update `docs/platform-capabilities.md` with integration changes. Package/mechanism evidence is not live-host evidence; public Skills-only behavior has no local lifecycle hooks.
+7. **Runtime/workflow claims are generated facts.** `package.json`, `.nvmrc`, Dockerfile and active workflows feed `scripts/repository-contract.js`; run `npm run docs:sync` after relevant changes.
+8. **CHANGELOG.md:** human notes go under `[Unreleased]`; semantic-release owns stable headings, tags and release notes.
+9. **Conventional Commit type is release input:** breaking→major, `feat`→minor, `fix`/`perf`/`refactor`/`build`/`revert`→patch; docs/test/ci/style/chore do not release alone.
 
-Do not report "it works" from code reading. State the evidence layer proved: package, deterministic mechanism, live host, or behavior.
+**Workflow behaviour**
 
-## Behavioral & Benchmark Evidence
+10. **Selected workflow is a semantic contract; tactics remain flexible.** Compose ordered requirement steps with declared required/optional skill or reference bindings. Resolve a binding only when its step (or dependency-ready Fable stage) is active; required bindings MUST resolve before that step passes, and applicable skill core contracts MUST be followed. Unknown/unavailable bindings stay visible. Selected-topology obligations MUST resolve; missing host evidence yields reminders, not a persistent Harness lock.
+11. **User-visible Harness Status is mandatory for non-trivial work.** One Markdown block headed `### 🚦 Harness Status` with bold `Current`, `Read / Evidence`, `Next`, optional `Risk / Blocked`; use nested evidence bullets when useful. Emit it before substantive execution, after major phases, on direction changes, at long-run boundaries and before completion. The routing checkpoint is internal state, not a second block. Not a hard lock.
+12. **Tier-3/Fable isolation disposition is mandatory before broad mutation.** Use a verified linked Git worktree, or record an explicit degraded fallback when isolation is unavailable or the user chooses to stay in place. Ordinary isolation SHOULD be used when it materially reduces collision risk. Failure to isolate is a visible gap, not a Harness deadlock. See [workflow-runtime.md](docs/workflow-runtime.md).
+13. **Use contract strength deliberately** ([philosophy.md](docs/philosophy.md#contract-strength-must--should--may)): MUST = required semantic obligation, SHOULD = default with an evidence-based exception, MAY = optional. Do not use recommend/prefer/advisory/guidance to weaken a MUST.
+14. **The turn label line is mandatory on every turn, trivial ones included.** End each turn's final message with one hidden `<!-- harness-label {...} -->` line giving your post-work judgement ([docs/routing.md](docs/routing.md#turn-label-line)). It records data and never gates routing.
 
-Deterministic mechanism tests prove the tested hook/plugin contract; they do **not** prove a real host loaded it or that behavior improved. For behavior:
+## Verification Before You Claim Done
+
+```mermaid
+flowchart LR
+  F["npm run verify:all -- --fast<br/>(pre-push subset)"] --> V["npm run verify:all<br/>(CI order, PASS/FAIL/UNCHECKED report)"]
+  V -. optional .-> C["-- --clean<br/>(fresh worktree of HEAD)"]
+  V -. optional .-> N["-- --node22<br/>(Node 22 smoke lane)"]
+```
 
-- `node behavioral-evals/run.js run --engine opencode` (or `--engine claude`) — on-demand, token-costing.
-- Weekly behavioral workflow validates case structure and runs live cases only when its runner has the required CLI.
-- `node benchmarks/run.js scaffold <scenario>` → run both variants → `record` with evidence logs.
+- `npm run verify:all` runs every CI gate category and prints paste-ready evidence. Individual gates: `npm test`, `npm run test:mutations`, `test:mechanism`, `test:consistency`, `test:repo-contract`, `test:docs:capabilities`, `test:references`, `test:release`, `test:collision`, `test:routing:skills`, `test:routing:invariants`, `test:plugin:openai`, `test:plugin:submission`, `test:platform:compatibility`, `test:portability`.
+- With waza (`~/bin/waza`): `waza check <skill-dir>`, `waza spec verify <skill> evals/<skill>/eval.yaml --fail --threshold 1`, `waza tokens check`.
+- CI runs Node.js 24 on Ubuntu/Windows/macOS plus a Node.js 22 floor lane ([repository-contract.md](docs/repository-contract.md)). Node 22 install compatibility stays UNCHECKED locally.
+- Never report "it works" from code reading. Name the evidence layer: package, deterministic mechanism, live host or behavior.
+
+## Behavioral & Benchmark Evidence
+
+| Claim | Evidence required |
+|---|---|
+| Hook/plugin contract holds | Deterministic mechanism test |
+| A real host loaded and fired it | Preserved host/session artifact |
+| Behavior improved | Paired evidence per #71 (baseline vs treatment) |
 
-For a live-host enforcement claim, preserve a host/session artifact showing the mechanism loaded and fired. For an effectiveness claim, use the paired evidence discipline in #71 rather than inferring improvement from mechanism presence.
+- Behavior runs: `node behavioral-evals/run.js run --engine opencode` (or `--engine claude`). On demand; costs tokens. The weekly workflow validates structure and runs live cases only where the CLI exists.
+- Benchmarks: `node benchmarks/run.js scaffold <scenario>`, run both variants, then `record` with evidence logs.

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.39.0](https://github.com/dyphn1/Harness-everything/compare/v0.38.0...v0.39.0) (2026-10-21)
+
+### Features
+
+* **doc-lifecycle:** add s2a document evidence producer and reconciliation core ([#325](https://github.com/dyphn1/Harness-everything/issues/325)) ([7d54802](https://github.com/dyphn1/Harness-everything/commit/7d5480292891f4cbac126bfa4ed6dc43be9173f2))
+
+### Bug Fixes
+
+* **doc-lifecycle:** bind captured origin pin to the s2a baseline ([#353](https://github.com/dyphn1/Harness-everything/issues/353)) ([59421f4](https://github.com/dyphn1/Harness-everything/commit/59421f41a8ce2b00250c96634a4a43ae0ba782bf))
+* **doc-lifecycle:** bind s2a start pin, scope progress keys, stop should/n/a gating ([#325](https://github.com/dyphn1/Harness-everything/issues/325)) ([5e48a91](https://github.com/dyphn1/Harness-everything/commit/5e48a9119b511d60c23cccdbd06ca3f865d82d83))
+* **doc-lifecycle:** make the s2a producer inventory portable to windows ([#325](https://github.com/dyphn1/Harness-everything/issues/325)) ([f1a9fb5](https://github.com/dyphn1/Harness-everything/commit/f1a9fb50e055e9ce21782d1ede96b926f08ff486))
+* **doc-lifecycle:** reconcile s2a origin identity and binary records ([#353](https://github.com/dyphn1/Harness-everything/issues/353)) ([475fcfc](https://github.com/dyphn1/Harness-everything/commit/475fcfc26cf4c16a6ed5af40bc55c09281fe98c0))
+* **doc-lifecycle:** reject prototype-sensitive s2a inventory ([#353](https://github.com/dyphn1/Harness-everything/issues/353)) ([b2b93ea](https://github.com/dyphn1/Harness-everything/commit/b2b93ea3d52ab9316d679b323343b5abe0525ccd))
+* **doc-lifecycle:** resolve s2a workspace identity with native realpath on windows ([#325](https://github.com/dyphn1/Harness-everything/issues/325)) ([c663fd8](https://github.com/dyphn1/Harness-everything/commit/c663fd8479869d6a3c7930bd47a067d4323cb6c9)), closes [#353](https://github.com/dyphn1/Harness-everything/issues/353)
+* **doc-lifecycle:** revalidate the s2a start pin at event acceptance ([#325](https://github.com/dyphn1/Harness-everything/issues/325)) ([2cf466d](https://github.com/dyphn1/Harness-everything/commit/2cf466d04e52dd92f8df2b7263348287f9eef2da))
+
 ## [0.38.0](https://github.com/dyphn1/Harness-everything/compare/v0.37.0...v0.38.0) (2026-10-21)
 
 ### Features
@@ -16,6 +32,15 @@ All notable changes to this project are documented in this file.
 
 ## [Unreleased]
 
+- Reject root-level `__proto__` files in S2a snapshot capture and validation instead of silently dropping their document obligations (#353).
+
+- Bind the S2a captured origin identity to the snapshot identity (workspace, session, workflow, revision, task), the captured plan and the selected active host, so a jointly substituted origin context and provider context cannot earn credit in either reconciliation mode; bind the captured config bytes to the captured inventory (#353).
+
+- Keep a whole-project S2a inventory usable when it contains binary records: every stored byte stays in the candidate digest, records the derive contract cannot observe are omitted from semantic derivation, and governed/derived/code/test records that cannot be decoded fail closed as inventory-unsupported (#353).
+
+- Reject S2a document evidence when the captured origin commit disagrees with the hashed baseline, including joint provider/context commit replacement; also reject inconsistent roots within the snapshot (#353).
+
+- Ship the unwired S2a document evidence producer and reconciliation core (snapshot capture, captured config, accepted-origin adapter, expected-set reconciliation); S1 stays no-credit until S2b host integration.
 - Ship default-OFF Phase 3b S1 scope assessment and no-credit runtime gate (opt in with `HARNESS_DOC_RECONCILIATION_PILOT=1`); S2 pending (S3 shipped in 0.37.0), E1 not started.
 
 ## [0.37.0](https://github.com/dyphn1/Harness-everything/compare/v0.36.4...v0.37.0) (2026-10-21)

package/benchmarks/results/reviews/pr353-r6-2026-10-22/README.md

@@ -0,0 +1,76 @@
+# PR #353 — two independent implementations and cross-validation
+
+- Base: `59421f41a8ce2b00250c96634a4a43ae0ba782bf`.
+- Environment: macOS, Node 24.14.1; per-worktree temporary directories.
+- Selected: **A plus the coordinator's BOM fix**. Both OpenCode reviewers accept A; B accepts the final delta.
+- Scope: S2a only. No runtime wiring, public derive/checker API, digest schema, version or dependency change.
+- Evidence layer: **deterministic mechanism**, with fake origin providers; no host provenance or live-host claim.
+
+```mermaid
+flowchart LR
+  Base["59421f4"] --> A["OpenCode A: independent implementation"]
+  Base --> B["OpenCode B: independent implementation"]
+  A --> X["Swap tests + independent probes + peer reviews"]
+  B --> X
+  X --> S["Select A; add BOM regression and fix"]
+  S --> V["Full gates + final OpenCode review"]
+```
+
+## Requirements addressed
+
+| Comment | Final behavior |
+| --- | --- |
+| P1: disconnected origin and event identity halves | Match all five origin-correlated identity fields, captured plan fields and selected active host; reject partial substitutions in verification, review and cached evidence. |
+| P1 same-class config link | Captured config source bytes must match the captured candidate inventory. |
+| P2: ordinary binary assets reject a complete capture | Keep all captured bytes in baseline/candidate hashes; omit undecodable data only outside the conservative document/code/test/derived/frontmatter relevance surface. Producer and core use one helper. |
+| Coordinator's BOM defect | A leading UTF-8 BOM cannot conceal undecodable frontmatter from the relevance check. |
+
+## Comparison and selection (executed unless marked)
+
+| Check | A | Revised B |
+| --- | --- | --- |
+| Own core / producer suites | 195/0; 76/0 | 193/0; 78/0 |
+| Common coordinator probes | 26/0 | 26/0 |
+| Candidate-content transition probes | 4/0 | 4/0 (initial B was 0/4; fixed before comparison) |
+| BOM frontmatter probe | 0/2 | 0/2 |
+| B's tests against A | 193/0 core; 78/0 producer | — |
+| A's tests against B | — | 193/2 core; 74/2 producer |
+| Peer assessment | accepted by B | A found plan/config links and masked-frontmatter gaps; not accepted as-is |
+
+A closes more represented identity links and fails closed on ambiguous semantic inputs. Its relevance rule avoids extra derivation passes but mirrors existing path rules; this maintenance cost is stated in code with a `shortcut:` comment. The BOM gap was independently reproduced for both candidates, then fixed in the selected tree.
+
+Peer reviews are [A reviews B](a-reviews-b.md) and [B reviews A](b-reviews-a.md). [Final integration review](final-review.md): **ACCEPT**, source-traced (no tests rerun by the reviewer).
+
+## Final evidence
+
+| Check | Result |
+| --- | --- |
+| Baseline coordinator probes | 10 PASS / 16 FAIL |
+| BOM regression before fix | 78 PASS / 2 FAIL / 0 INFRA |
+| Final core | **195 PASS / 0 FAIL / 0 INFRA** |
+| Final producer | **80 PASS / 0 FAIL / 0 INFRA** |
+| Final independent probes | **26 + 4 + 2 = 32 PASS / 0 FAIL** |
+| `npm run verify:all` | **13 PASS / 0 FAIL / 3 UNCHECKED** |
+| `verify-gate.js --json` after cleanup | Discovered `package-test` ran with exit **0**; gate status `UNCHECKED_DISCOVERED` because no declared project verification contract exists (not a contract PASS). |
+| Post-review comment/wording-only cleanup | consistency and diff whitespace PASS; no functional delta after full gates |
+
+The three UNCHECKED entries are Node 22 execution/install lanes. CI owns the cross-platform and runtime-floor evidence. Focused stdout, swapped-suite logs, losslessly compressed full-gate logs and source hashes are retained beside this README. Probe scripts are retained as `.txt` evidence; they were run outside the repository and are not installed runtime code. Full OpenCode JSON streams remain local rather than being shipped.
+
+## Limits and follow-ups
+
+- Undecodable files under code/test/governed/derived paths remain **unavailable by design**, including harmless binary test fixtures or diagrams under governed globs. This conservative acceptance boundary is explicit in the S2a contract; exploratory probes confirm B accepts a no-REQ test fixture while A refuses it. No claim that every binary file in every path is accepted.
+- A mirrors the derive contract's code/test/glob rules. Keep them synchronized until a shared classifier is exposed.
+- Malformed byte records may now report `inventory-unsupported` rather than the old `invalid-input`; both withhold credit. This is a non-blocking diagnostic drift noted by B.
+- Fully self-consistent restatement of all detached metadata and cached accepted structures is outside S2a attestation: external origin authentication remains S2b. Both independent implementations share this boundary.
+- The owner decides PR readiness, merge and release.
+
+## Trust-boundary review
+
+| Threat | Check |
+| --- | --- |
+| Context spoofing / metadata tampering | Five tuple fields, plan/config/host and config bytes linked before credit. |
+| Binary omission | Relevant undecodable inputs fail closed; byte hashes retain every captured file. |
+| Invalid snapshot | No event adaptation or eligibility. |
+| Secrets / injected execution | Targeted changed-source scan found no added secret literal or dynamic execution; no endpoint/auth/dependency added. |
+
+STATUS: DONE

package/benchmarks/results/reviews/pr353-r6-2026-10-22/a-reviews-b.md

@@ -0,0 +1,191 @@
+# PR #353 — Cross-review of peer leg B (reviewer: leg A)
+
+Reviewed: peer worktree `/Users/daniel.chang/Desktop/Skills/Harness-everything/.worktrees/353-r6-b`
+(base `59421f41a8ce2b00250c96634a4a43ae0ba782bf`), report `/tmp/harness-353-r6-b/REPORT.md`, and B's
+working-tree diff against `59421f4`.
+Method: read B's current source, its test and doc diffs; ran **one** independent probe
+(`/tmp/harness-353-r6-a/probe/cross-review-probe.js`, scratch, outside both repositories) against **both**
+worktrees; no suite was re-run, no implementation was edited, no git/gh write was issued, no full gate
+was run. The probe builds its own Git fixture repositories, its own fake origin provider and its own
+event builder; it depends on neither leg's fixture harness.
+
+## Verdict
+
+| | Peer B | Leg A |
+| --- | --- | --- |
+| P1 origin tuple (`workspaceId`, `sessionId`, `workflowId`, `workflowRevision`, `taskId`) | closed | closed |
+| P1 `activeHost` ↔ captured selected config | closed | closed |
+| P1 captured plan ↔ identity | **open** (F1) | closed |
+| P1 captured config bytes ↔ captured inventory | **open** (F2) | closed |
+| P2 binary bytes stay in both digests | closed | closed |
+| P2 irrelevant binary asset does not break the capture | closed | closed |
+| P2 baseline/candidate/new/deleted relevance class | closed | closed |
+| P2 relevance decided by the unchanged derivation (no rule duplication) | **yes** | no (F5) |
+| P2 a record that opens a frontmatter block cannot vanish | not guaranteed (F4) | closed |
+
+**Peer B is not accepted as-is.** One blocker-class finding (F1) and two recommended additions (F2, F4),
+all in the packet's own P1/P2 scope and all reproducible with the probe. With the minimal delta
+described below, I accept B. **Leg A has no blocker-class finding** in this review; its only weakness is
+a maintenance coupling (F5), not a present trust gap.
+
+## Probe results (one probe, both worktrees)
+
+| Probe case | Expected | A | B |
+| --- | --- | --- | --- |
+| `p1-control-eligible` | eligible | eligible | eligible |
+| `p1-joint-origin-task-substitution` (the packet's named attack) | rejected | rejected | rejected |
+| `p1-plan-only-substitution` | rejected | rejected (`identity-mismatch`) | **accepted (eligible)** |
+| `p1-config-bytes-substitution` | rejected | rejected (`config-capture-mismatch`) | **accepted (eligible)** |
+| `p1-fully-joint-self-consistent-substitution` | rejected | accepted (eligible) | accepted (eligible) |
+| `p2-asset-irrelevant` | ready | ready | ready |
+| `p2-governed-path-unchanged` | unavailable | unavailable | unavailable |
+| `p2-role-frontmatter-asset` | unavailable | unavailable | unavailable |
+| `p2-masked-frontmatter-asset` | unavailable | unavailable | **ready** |
+| `p2-new-binary-governed-record` | unavailable | unavailable | unavailable |
+| `p2-deleted-binary-governed-record` | unavailable | unavailable | unavailable |
+| `p2-binary-bytes-covered-by-both-digests` | differ | differ | differ |
+| `p2-producer-core-parity` | no errors | no errors | no errors |
+| `p2-malformed-record-rejected` | `invalid-input` | `invalid-input` | `invalid-input` |
+
+Probe definitions: *plan-only* = the captured plan names another workflow and `taskScopeDigest` is
+recomputed correctly, the identity and the captured origin context keep the original tuple; *config-bytes* =
+the captured config source bytes are replaced and every digest that names them is recomputed, and the
+cached acceptance is restated; *fully joint* = the captured origin context, the identity, the captured plan,
+the digests and the cached acceptance are restated together; *masked frontmatter* = the record's bytes open
+a `---` block whose closing delimiter is separated from it by one invalid UTF-8 byte.
+
+## Findings
+
+**F1 — executed — peer B — blocker-class (P1 scope): the captured plan is not bound to the identity.**
+`validateSnapshot` checks `originContext` against `identity` and `activeHost` against the config capture,
+but nothing compares the captured plan with the identity. `taskScopeDigest` binds the plan *content* to the
+identity's digest field; it does not bind the plan's workflow triple / task id to the identity's. A
+snapshot whose plan describes another workflow, with the digest correctly recomputed, verifies as
+`eligible` (probe `p1-plan-only-substitution`). The packet asks to "inspect all represented tuple links,
+not only two examples" and to check the plan "where represented"; the plan represents `workflowId`,
+`workflowRevision`, `sessionId` and `taskId`, which the identity also represents. B's shipped doc text
+("The plan stays bound through `taskScopeDigest`") states more than the code enforces. Fix: compare
+`taskSemantics.workflow.{workflowId,workflowRevision,sessionId}`, `taskSemantics.task.taskId`,
+`taskSemantics.prdRoot` and `taskSemantics.configDigest` with the identity inside the existing
+`validateSnapshot` (A: `originBound`, ~6 lines, pure, no I/O).
+
+**F2 — executed — peer B — recommended (same class): the captured config bytes are not bound to the
+captured inventory.** Replacing the captured config source bytes and recomputing every digest that names
+them (`configDigest`, `identity.configDigest`, the plan's `configDigest`, `taskScopeDigest`) plus
+restating the cached acceptance verifies as `eligible` (probe `p1-config-bytes-substitution`). The
+producer already enforces exactly this rule at capture (its config-source loop compares the captured
+source bytes with the candidate records); the core re-checks nothing, so the two halves of the capture
+can describe different files. Fix: the producer's rule as a core check → `config-capture-mismatch`
+(A: `configBytesBound`, ~8 lines).
+
+**F3 — executed — shared by both legs — contract-bounded, not a defect of either: a fully joint,
+self-consistent restatement is accepted.** Restating the captured origin context, the identity, the
+captured plan, the digests and the cached acceptance together yields `eligible` under A and B
+(probe `p1-fully-joint-self-consistent-substitution`). The snapshot is detached and self-authenticating;
+the only external anchor is the origin provider, which `acceptDocEvents` consults on a fresh acceptance
+and the pure core never re-reads. This matches the S2a contract's own boundary ("external worktree
+authentication remains outside this S2a guarantee"; S2b recollects every tuple and accepted binding before
+credit). Consequence for the selection: F1 and F2 are *partial* defenses — they reject partial
+substitutions, not a full restatement. Both legs share that boundary, so it is not a differentiator.
+
+**F4 — executed — divergence — peer B: a record that opens a frontmatter block can still be omitted.**
+The lifecycle decides "is this a frontmatter document" by the first line being exactly `---`
+(`harness-everything/scripts/doc-lifecycle.js`, `parseFrontmatter`). B's relevance decision is the
+unchanged derivation applied to the *lossy* reading of the record; when the invalid byte sits inside the
+frontmatter block, the lossy reading is unterminated, carries no role, and the record is omitted
+(probe `p2-masked-frontmatter-asset`: B → ready, A → unavailable). A governed document with one stray
+invalid byte in its frontmatter can therefore be dropped from the derivation, so `doc-lint` / `link-check`
+would not fire where a tolerant reader would see a governed PRD. Exotic, but it is the one probed case
+where the two legs differ on a trust-relevant outcome. Fix on B: fail closed when a record's first line is
+exactly `---` — the lifecycle's own test, independent of the witnesses (~3 lines).
+
+**F5 — source-traced — leg A (for balance): A mirrors the derive contract's path rules inside the
+reconciliation module.** Because `doc-obligations.js` is outside the write-set, A duplicates
+`CODE_EXTENSION`, `TEST_PATH` and the contract's glob semantics to decide relevance. The duplication is
+currently exact (the probe shows A and B agreeing on 8 of 9 P2 cases), but a later change to the derive
+contract's code/test/glob rules would silently make A *omit* a record the contract treats as relevant —
+the dangerous direction — with no test failure. B has no such surface: its relevance decision is the
+derivation's own. Removing A's coupling needs either a public export of the contract's classification
+(out of this packet's scope) or B's witness approach.
+
+**F6 — executed — shared residual: a binary record at a governed path makes the capture unavailable even
+when unchanged.** Both legs fail closed for `docs/prd/diagram.png` (probe `p2-governed-path-unchanged`;
+B via the addition witness, A via the path rule). This matches the S2a contract ("Unsupported
+encodings ... that prevent faithful identity yield unavailable") and is conservative in both, but it means
+a repository holding a binary diagram under `docs/prd/` can never be captured. Availability cost, not a
+trust gap; identical in both legs.
+
+**F7 — executed — shared: the new/deleted record identity class is closed in both.** A binary record that
+exists on only one side of the capture fails closed in both legs (probes `p2-new-binary-governed-record`,
+`p2-deleted-binary-governed-record`), and both agree with the coordinator's transition probe. B's
+round-2 witnesses (actual / addition / deletion) close the candidate-only omission the coordinator found
+in B's first implementation; A's path rules cover the same paths. Neither leg depends on a newline-only
+modification to detect the transition.
+
+**F8 — executed — shared: byte integrity, parity and malformed inputs.** Both legs keep the binary bytes
+in `candidateDigest` *and* `baselineDigest` (probe `p2-binary-bytes-covered-by-both-digests`), the core's
+re-derivation accepts the producer's snapshot with a binary asset in both (probe
+`p2-producer-core-parity`), and a record whose stored bytes do not match its digest is refused with
+`invalid-input` in both (probe `p2-malformed-record-rejected`).
+
+**F9 — source-traced — scope, API and parity between the legs.** Both legs touch the same nine files
+inside the packet's write-set, change no public derive/checker API, no identity/digest schema, no S1
+runtime and no workflow wiring, add no new `.js` file to the repository, and leave
+`doc-reconciliation-events.js` untouched — correct, because that module already compares the provider
+context with the captured origin context and calls `validateSnapshot`, so it inherits the P1 binding. Both
+cores stay pure (no file, process or network activity); B's extra derivation calls are pure computations.
+B's packaged copies are byte-identical to its canonical files (sha256 verified); A's parity is asserted
+by its own suite. B's doc text and CHANGELOG entries accurately describe B's behaviour except for the
+plan-binding claim noted in F1.
+
+**F10 — inconclusive.** The completeness of B's relevance witnesses is not provable for every byte
+sequence (B's own report says so; F4 is the demonstrated instance). Live-host provenance is out of reach
+in both legs (the origin provider is an explicit fake). Platform coverage is macOS-only in both; the
+Windows lane and the Node 22 floor remain CI's.
+
+## Comparison of the two approaches
+
+**Peer B — strengths.** The relevance decision is the *unchanged derivation's own*, so there is no
+extension allowlist and no duplicated path rules to drift (the packet's "inspect existing derive/lifecycle
+semantics to justify relevance" in its strongest form). The three witnesses (actual transition, addition,
+deletion) directly answer the coordinator's class requirement, and B's round-2 fix is a real improvement
+over a naive path-rule approach. Its P1 origin binding is exactly equivalent to A's for the five tuple
+fields and the host. Its test set is larger and pins the semantic-binary regressions.
+
+**Peer B — defects.** F1 (blocker-class, P1 scope), F2 (same class), F4 (one probed omission case). Its
+report's plan-binding claim is stronger than its code.
+
+**Leg A — strengths.** Strictly more of the P1 class is closed (F1, F2), the derivation-relevant omission
+cannot happen for a frontmatter-opening record (F4), the implementation is cheaper (no extra derivation
+calls) and the reason codes are explicit.
+
+**Leg A — defects.** F5: the relevance rule is a mirror of the derive contract rather than the contract
+itself, so it can drift silently; and it fails closed on any record whose first line is `---`, which is
+stricter than the derivation requires (an availability cost, the mirror image of B's F4).
+
+**Shared.** F3 (no external anchor in the cached path), F6 (a binary under a governed path is
+unavailable), F10 (residual limits). Neither leg's extra checks change F3.
+
+## Recommendation
+
+**Minimal combination, base B**: keep B's derivation-grounded relevance (no duplicated rules, no drift
+surface, and it already answers the baseline/candidate/new/deleted class), and add A's three small
+additions to B's core — the plan↔identity comparison (F1), the config-bytes↔inventory check (F2) and the
+frontmatter-opener guard (F4). Cost: ≈17 lines in `hooks/scripts/lib/doc-reconciliation-core.js` plus the
+three corresponding test cases; no public API, digest schema, event module or producer change; the
+packaged copy is regenerated with `npm run plugin:sync`.
+
+**If the owner selects one leg without merging**: take **A**. The P1 gaps in B are current and
+demonstrated, and this PR exists to close that class; A's weakness is a maintenance coupling that can be
+removed later (exporting the derive contract's classification, or porting B's witness approach) without
+changing any trust guarantee. B's grounding is the better long-term shape for the P2 rule, so it is worth
+recording as the follow-up. B should not be selected unmodified: F1 alone is inside the packet's stated
+P1 scope, and B's documentation currently claims that scope is closed.
+
+**Acceptance.** Leg A: accepted (no blocker-class finding; F5 is a recorded residual). Peer B: not
+accepted as-is (F1); accepted once F1, F2 and F4 are applied and pinned by the three probe cases above.
+
+This review does not certify PR readiness and does not judge the live-host provenance of either leg; the
+owner decides.
+
+STATUS: DONE