harness-everything 0.38.0 → 0.40.0

package/plugins/harness-everything/skills/zoom-out/SKILL.md

@@ -4,7 +4,7 @@ description: "Reflect-first circuit breaker - after 3 failures, stop edits, rebu
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.16.2
+  version: 0.40.0
 ---
 
 # Zoom Out (Circuit Breaker)
@@ -15,7 +15,7 @@ Stop repeated failures, rebuild the facts, and choose a safe next step.
 
 | Component | Specification |
 | :--- | :--- |
-| **Trigger / Input** | Three same-signature failures or an explicit loop/rethink request. |
+| **Trigger / Input** | Three same-signature failures, a repair loop, or an explicit loop/rethink request. |
 | **Expected Output** | Fact-checked report ending in `RESUME` or `ESCALATE`. |
 | **State Mutations** | Writes the session `zoom-out-report.md`; reset may clear breaker state. |
 | **Enforcement Gate** | `<skills-repo-root>/hooks/scripts/rule-of-3.js` plus a valid report; a later three-failure cycle requests another reflection. |
@@ -25,12 +25,13 @@ Stop repeated failures, rebuild the facts, and choose a safe next step.
 1. After three same-signature failures, stop edits and do not ask the user yet.
 2. Use read-only tools to restate the goal and check files, configuration, and logs.
 3. Fill `<this-skill-dir>/templates/zoom-out-report.template.md` and end with `RESUME` or `ESCALATE`.
-4. Resume only on an untried path; escalate genuine user decisions with options.
+4. Resume only on an untried path; escalate genuine user decisions with options. Repair loop: inventory sites first.
 5. If three more matching failures occur, run another zoom-out cycle. `npm run harness:reset` is only an optional manual state clear; record the insight with `self-evolve`.
 
 ## USE FOR:
 - "you are stuck in a loop"
 - "the same error keeps failing"
+- "every round finds a new edge case"
 - "rethink your assumptions"
 
 ## DO NOT USE FOR:

package/plugins/harness-everything/skills/zoom-out/references/circuit-breaker.md

@@ -27,6 +27,13 @@ flowchart TD
 ## 1. Triggers
 - **Rule of 3 (Repeated Failures)**: Attempting to fix the same error or test failure 3 times without progress.
 - **Divergence**: Fixing one bug repeatedly introduces new secondary errors.
+- **Repair loop (feature level)**: Two consecutive review or fix rounds on the same feature each surface new defects in the same decision class (for example "is this the trusted checker?"), even though every command succeeded.
+  - The Rule of 3 hook cannot see this. It counts same-signature command failures in one session. Successful review findings do not increment it, and unrelated successes can leave an existing count in place. New sessions and different failure signatures do not accumulate a feature's review history.
+  - The signal comes from review history: prior findings and their dispositions, the round count per class in an error ledger, or the reviewer noticing the pattern. It is a prompt to reflect, not a lock. The hook gate in the skill contract applies only to the three-failure trigger.
+  - "Same decision class" means the same acceptance decision under the same trust assumptions, possibly at different sites. "Same directory" or "validation" is too broad. Count a repeated or renamed finding once, and treat missing history as unknown, not zero.
+  - Phase 2 here means: list every finding so far by decision class, state the acceptance clause each violates, and inventory every site (callers, state readers, Stop consumers) that makes the same decision. Findings that map to no acceptance clause stay `unresolved` for the owner instead of becoming new fixes.
+  - RESUME by using the inventory to choose the smallest justified correction (which may be one shared fix, or no code change), then re-trace one normal end-to-end acceptance path. Unresolved findings need scope adjudication, not speculative repairs.
+  - A one-shot reviewer cannot see the previous round on its own. The packet carries the current acceptance anchor, a link to the previous comparable report with its revision, the prior finding IDs and dispositions, and the fix made since.
 - **Goal Drift**: Execution strays far from the initial task objective.
 - **User Instruction**: The user requests a step back ("zoom out", "step back", "stop and think").
 

package/plugins/harness-everything/skills/zoom-out/templates/zoom-out-report.template.md

@@ -3,12 +3,14 @@
 
 ## Failed Attempts
 <attempt → underlying assumption → observed outcome>
-**Failure Category:** <syntax|environment|test|timeout|permission|dependency|unknown>
+**Failure Category:** <syntax|environment|test|timeout|permission|dependency|repair-loop|unknown>
+**Repair-loop rounds (repair loop only):** <round → new finding → decision class → violated acceptance clause or `unresolved`>
 
 ## Verified Facts
 <facts re-checked in Phase 2 with file paths>
 **Files Checked:** <list at least 3 related files you actually read>
-**Error Message Verified:** <copy the exact error message from the last failure>
+**Error Message Verified:** <copy the exact error message from the last failure; for a repair loop with no error, write `none` and cite the latest finding instead>
+**Sites Inventoried (repair loop only):** <every site making the same decision, including unchanged callers and consumers>
 
 ## Diagnosis
 <comprehensive explanation of root cause>

package/sbom.cdx.json

@@ -2,23 +2,23 @@
   "$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.7",
-  "serialNumber": "urn:uuid:69acfc0d-3ec2-541a-b60f-99d93b8cf29c",
+  "serialNumber": "urn:uuid:ec1ab676-b0e1-5aa7-869d-8317e5674765",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-21T11:38:13.404Z",
+    "timestamp": "2026-10-23T07:24:05.300Z",
     "tools": [
       {
         "vendor": "Harness Everything",
         "name": "generate-sbom.js",
-        "version": "0.38.0"
+        "version": "0.40.0"
       }
     ],
     "component": {
       "type": "application",
-      "bom-ref": "pkg:npm/harness-everything@0.38.0",
+      "bom-ref": "pkg:npm/harness-everything@0.40.0",
       "name": "harness-everything",
-      "version": "0.38.0",
-      "purl": "pkg:npm/harness-everything@0.38.0"
+      "version": "0.40.0",
+      "purl": "pkg:npm/harness-everything@0.40.0"
     }
   },
   "components": [
@@ -2033,7 +2033,7 @@
       ]
     },
     {
-      "ref": "pkg:npm/harness-everything@0.38.0",
+      "ref": "pkg:npm/harness-everything@0.40.0",
       "dependsOn": [
         "pkg:npm/%40commitlint/cli@19.8.1",
         "pkg:npm/%40commitlint/config-conventional@19.8.1",

package/scripts/errors-sync.js

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+'use strict';
+
+// Regenerates .agents/harness-everything/errors/index.jsonl from the E-*.md records.
+// `--check` compares instead of writing. Not wired into CI or hooks on purpose.
+
+const fs = require('fs');
+const path = require('path');
+const yaml = require('js-yaml');
+
+const ROOT = path.resolve(__dirname, '..');
+const DIR = path.join(ROOT, '.agents', 'harness-everything', 'errors');
+const INDEX = path.join(DIR, 'index.jsonl');
+const RECORD = /^E-\d{4}-[a-z0-9-]+\.md$/;
+const REQUIRED = ['id', 'signature', 'class', 'scope', 'status'];
+const SCOPES = new Set(['in', 'out', 'unresolved']);
+const STATUSES = new Set(['open', 'lesson', 'mechanism']);
+
+function parseRecord(file) {
+  const text = fs.readFileSync(path.join(DIR, file), 'utf8').replace(/\r\n/g, '\n');
+  const match = /^---\n([\s\S]*?)\n---\n/.exec(text);
+  if (!match) throw new Error(`${file}: missing YAML frontmatter`);
+  const meta = yaml.load(match[1]);
+  if (!meta || typeof meta !== 'object') throw new Error(`${file}: frontmatter is not a mapping`);
+  for (const key of REQUIRED) {
+    if (meta[key] === undefined || meta[key] === null || meta[key] === '') throw new Error(`${file}: missing ${key}`);
+  }
+  if (!file.startsWith(`${meta.id}-`)) throw new Error(`${file}: id ${meta.id} does not match the file name`);
+  if (!SCOPES.has(meta.scope)) throw new Error(`${file}: scope must be in, out or unresolved`);
+  if (!STATUSES.has(meta.status)) throw new Error(`${file}: status must be open, lesson or mechanism`);
+  const episodes = Array.isArray(meta.episodes) ? meta.episodes : [];
+  return {
+    id: meta.id,
+    signature: meta.signature,
+    class: meta.class,
+    title: meta.title || null,
+    scope: meta.scope,
+    status: meta.status,
+    sites: Array.isArray(meta.sites) ? meta.sites : [],
+    violates: meta.violates || null,
+    mechanism_ref: meta.mechanism_ref || null,
+    episodes: episodes.length,
+    rounds: episodes.map(e => ({
+      episode: e.episode || null,
+      // Round 0 is discovery, so the attempt count is the highest round number.
+      rounds: Array.isArray(e.rounds) ? Math.max(0, ...e.rounds.map(r => Number(r.round) || 0)) : null,
+      closed: e.closed === true,
+    })),
+    file: path.posix.join('.agents/harness-everything/errors', file),
+  };
+}
+
+function render() {
+  const files = fs.readdirSync(DIR).filter(f => RECORD.test(f)).sort();
+  const ids = new Set();
+  const lines = files.map(file => {
+    const record = parseRecord(file);
+    if (ids.has(record.id)) throw new Error(`${file}: duplicate id ${record.id}`);
+    ids.add(record.id);
+    return JSON.stringify(record);
+  });
+  return lines.length ? `${lines.join('\n')}\n` : '';
+}
+
+function main() {
+  const check = process.argv.includes('--check');
+  let next;
+  try {
+    next = render();
+  } catch (error) {
+    console.error(`errors:sync: ${error.message}`);
+    process.exit(1);
+  }
+  const rel = path.relative(ROOT, INDEX).replace(/\\/g, '/');
+  if (check) {
+    const current = fs.existsSync(INDEX) ? fs.readFileSync(INDEX, 'utf8') : null;
+    if (current !== next) {
+      console.error(`${rel} is stale. Run npm run errors:sync.`);
+      process.exit(1);
+    }
+    console.log(`${rel} is current.`);
+    return;
+  }
+  fs.writeFileSync(INDEX, next, 'utf8');
+  console.log(`Updated ${rel}`);
+}
+
+if (require.main === module) main();
+
+module.exports = { render };

package/to-spec/SKILL.md

@@ -4,7 +4,7 @@ description: "Turn the conversation into a written spec — feature PRD, CLI/API
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.36.3
+  version: 0.39.0
 ---
 
 # To Spec

package/to-spec/scripts/project-docs-resolver.js

@@ -122,15 +122,17 @@ function readHostProjectDocsConfigs(workspaceRoot) {
   return manifests;
 }
 
-function inspectHostProjectDocs(workspaceRoot) {
+function inspectHostProjectDocs(workspaceRoot, readSource = null) {
   const entries = [];
   for (const home of PLATFORM_HOMES) {
     const file = path.join(workspaceRoot, home, 'harness-everything', 'manifest.json');
-    if (!fs.existsSync(file)) continue;
+    const captured = readSource ? readSource(file) : null;
+    if (captured ? captured.presence === 'absent' : !fs.existsSync(file)) continue;
     const entry = { file, home, projectDocs: null, warnings: [], diagnostics: [], hasProjectDocs: false };
     let manifest;
     try {
-      manifest = JSON.parse(fs.readFileSync(file, 'utf8'));
+      if (captured && captured.presence !== 'present') throw new Error('unreadable source');
+      manifest = JSON.parse(captured ? captured.bytes.toString('utf8') : fs.readFileSync(file, 'utf8'));
     } catch {
       entry.diagnostics.push({
         code: 'invalid-host-config',
@@ -349,16 +351,18 @@ function configSource(workspaceRoot, file) {
   return relativePath(workspaceRoot, file);
 }
 
-function resolveDocsConfig(workspaceRoot, options = {}) {
+function resolveDocsConfigSelection(workspaceRoot, options, readSource) {
   const resolvedRoot = workspaceRoot || getWorkspaceRoot();
   if (!resolvedRoot) throw new Error('cannot resolve project docs outside a git workspace; pass a workspace root explicitly');
   const root = path.resolve(resolvedRoot);
   const projectFile = projectDocsConfigPath(root);
-  if (fs.existsSync(projectFile)) {
+  const capturedProject = readSource(projectFile);
+  if (capturedProject.presence !== 'absent') {
     const source = configSource(root, projectFile);
     let config;
     try {
-      config = JSON.parse(fs.readFileSync(projectFile, 'utf8'));
+      if (capturedProject.presence !== 'present') throw new Error('unreadable source');
+      config = JSON.parse(capturedProject.bytes.toString('utf8'));
     } catch {
       return {
         status: 'invalid',
@@ -376,7 +380,7 @@ function resolveDocsConfig(workspaceRoot, options = {}) {
       return { status: 'invalid', sources: [source], config: null, warnings, diagnostics };
     }
 
-    const hosts = inspectHostProjectDocs(root);
+    const hosts = inspectHostProjectDocs(root, readSource);
     const hostDiagnostics = hosts.flatMap(entry => entry.diagnostics);
     const hostWarnings = hosts.flatMap(entry => entry.warnings);
     const validHosts = hosts.filter(entry => entry.projectDocs);
@@ -393,7 +397,7 @@ function resolveDocsConfig(workspaceRoot, options = {}) {
     return { status: 'project', sources: [source], config, warnings: [...warnings, ...hostWarnings], diagnostics: [...diagnostics, ...hostDiagnostics] };
   }
 
-  const hosts = inspectHostProjectDocs(root);
+  const hosts = inspectHostProjectDocs(root, readSource);
   const hostDiagnostics = hosts.flatMap(entry => entry.diagnostics);
   const hostWarnings = hosts.flatMap(entry => entry.warnings);
   const activeHome = normalizedHostHome(options.activeHost);
@@ -457,6 +461,35 @@ function resolveDocsConfig(workspaceRoot, options = {}) {
   };
 }
 
+function resolveDocsConfigCaptured(workspaceRoot, options = {}) {
+  const resolvedRoot = workspaceRoot || getWorkspaceRoot();
+  if (!resolvedRoot) throw new Error('cannot resolve project docs outside a git workspace; pass a workspace root explicitly');
+  const root = path.resolve(resolvedRoot);
+  const records = new Map();
+  const readSource = file => {
+    const key = configSource(root, file);
+    if (!records.has(key)) {
+      let bytes = Buffer.alloc(0);
+      let presence = 'present';
+      try { bytes = Buffer.from(fs.readFileSync(file)); }
+      catch (error) { presence = error.code === 'ENOENT' ? 'absent' : 'unreadable'; }
+      records.set(key, { path: key, presence, bytes, digest: crypto.createHash('sha256').update(bytes).digest('hex') });
+    }
+    return records.get(key);
+  };
+  const resolution = resolveDocsConfigSelection(root, options, readSource);
+  let activeHost = null;
+  try { activeHost = JSON.parse(JSON.stringify(options.activeHost)); } catch { /* no serializable host context */ }
+  const sources = [...records.values()].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  const selectionInputs = sources.map(({ path: sourcePath, presence }) => ({ path: sourcePath, presence }));
+  selectionInputs.push({ status: resolution.status, sources: [...resolution.sources], activeHost, config: resolution.config });
+  return { resolution, capture: { activeHost, sources, selectionInputs } };
+}
+
+function resolveDocsConfig(workspaceRoot, options = {}) {
+  return resolveDocsConfigCaptured(workspaceRoot, options).resolution;
+}
+
 function cleanConfiguredPath(value) {
   if (typeof value !== 'string') return null;
   const trimmed = value.trim();
@@ -769,6 +802,7 @@ module.exports = {
   getRepoManifestHomes,
   readProjectDocs,
   resolveDocsConfig,
+  resolveDocsConfigCaptured,
   validateDocsConfig,
   normalizeHostProjectDocs,
   parseContextMap,

package/zoom-out/SKILL.md

@@ -4,7 +4,7 @@ description: "Reflect-first circuit breaker - after 3 failures, stop edits, rebu
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.16.2
+  version: 0.40.0
 ---
 
 # Zoom Out (Circuit Breaker)
@@ -15,7 +15,7 @@ Stop repeated failures, rebuild the facts, and choose a safe next step.
 
 | Component | Specification |
 | :--- | :--- |
-| **Trigger / Input** | Three same-signature failures or an explicit loop/rethink request. |
+| **Trigger / Input** | Three same-signature failures, a repair loop, or an explicit loop/rethink request. |
 | **Expected Output** | Fact-checked report ending in `RESUME` or `ESCALATE`. |
 | **State Mutations** | Writes the session `zoom-out-report.md`; reset may clear breaker state. |
 | **Enforcement Gate** | `<skills-repo-root>/hooks/scripts/rule-of-3.js` plus a valid report; a later three-failure cycle requests another reflection. |
@@ -25,12 +25,13 @@ Stop repeated failures, rebuild the facts, and choose a safe next step.
 1. After three same-signature failures, stop edits and do not ask the user yet.
 2. Use read-only tools to restate the goal and check files, configuration, and logs.
 3. Fill `<this-skill-dir>/templates/zoom-out-report.template.md` and end with `RESUME` or `ESCALATE`.
-4. Resume only on an untried path; escalate genuine user decisions with options.
+4. Resume only on an untried path; escalate genuine user decisions with options. Repair loop: inventory sites first.
 5. If three more matching failures occur, run another zoom-out cycle. `npm run harness:reset` is only an optional manual state clear; record the insight with `self-evolve`.
 
 ## USE FOR:
 - "you are stuck in a loop"
 - "the same error keeps failing"
+- "every round finds a new edge case"
 - "rethink your assumptions"
 
 ## DO NOT USE FOR:

package/zoom-out/references/circuit-breaker.md

@@ -27,6 +27,13 @@ flowchart TD
 ## 1. Triggers
 - **Rule of 3 (Repeated Failures)**: Attempting to fix the same error or test failure 3 times without progress.
 - **Divergence**: Fixing one bug repeatedly introduces new secondary errors.
+- **Repair loop (feature level)**: Two consecutive review or fix rounds on the same feature each surface new defects in the same decision class (for example "is this the trusted checker?"), even though every command succeeded.
+  - The Rule of 3 hook cannot see this. It counts same-signature command failures in one session. Successful review findings do not increment it, and unrelated successes can leave an existing count in place. New sessions and different failure signatures do not accumulate a feature's review history.
+  - The signal comes from review history: prior findings and their dispositions, the round count per class in an error ledger, or the reviewer noticing the pattern. It is a prompt to reflect, not a lock. The hook gate in the skill contract applies only to the three-failure trigger.
+  - "Same decision class" means the same acceptance decision under the same trust assumptions, possibly at different sites. "Same directory" or "validation" is too broad. Count a repeated or renamed finding once, and treat missing history as unknown, not zero.
+  - Phase 2 here means: list every finding so far by decision class, state the acceptance clause each violates, and inventory every site (callers, state readers, Stop consumers) that makes the same decision. Findings that map to no acceptance clause stay `unresolved` for the owner instead of becoming new fixes.
+  - RESUME by using the inventory to choose the smallest justified correction (which may be one shared fix, or no code change), then re-trace one normal end-to-end acceptance path. Unresolved findings need scope adjudication, not speculative repairs.
+  - A one-shot reviewer cannot see the previous round on its own. The packet carries the current acceptance anchor, a link to the previous comparable report with its revision, the prior finding IDs and dispositions, and the fix made since.
 - **Goal Drift**: Execution strays far from the initial task objective.
 - **User Instruction**: The user requests a step back ("zoom out", "step back", "stop and think").
 

package/zoom-out/templates/zoom-out-report.template.md

@@ -3,12 +3,14 @@
 
 ## Failed Attempts
 <attempt → underlying assumption → observed outcome>
-**Failure Category:** <syntax|environment|test|timeout|permission|dependency|unknown>
+**Failure Category:** <syntax|environment|test|timeout|permission|dependency|repair-loop|unknown>
+**Repair-loop rounds (repair loop only):** <round → new finding → decision class → violated acceptance clause or `unresolved`>
 
 ## Verified Facts
 <facts re-checked in Phase 2 with file paths>
 **Files Checked:** <list at least 3 related files you actually read>
-**Error Message Verified:** <copy the exact error message from the last failure>
+**Error Message Verified:** <copy the exact error message from the last failure; for a repair loop with no error, write `none` and cite the latest finding instead>
+**Sites Inventoried (repair loop only):** <every site making the same decision, including unchanged callers and consumers>
 
 ## Diagnosis
 <comprehensive explanation of root cause>