harness-everything 0.38.0 → 0.40.0

package/benchmarks/results/reviews/pr353-r6-2026-10-22/final-producer.log

@@ -0,0 +1,83 @@
+  PASS snapshot:required-fields-present [source]
+  PASS snapshot:required-fields-present [packaged]
+  PASS snapshot:identity-tuple-types-and-digest-equalities [source]
+  PASS snapshot:identity-tuple-types-and-digest-equalities [packaged]
+  PASS snapshot:obligations-equal-unchanged-derive-api-on-captured-bytes [source]
+  PASS snapshot:obligations-equal-unchanged-derive-api-on-captured-bytes [packaged]
+  PASS snapshot:derivation-reasons-cover-every-obligation [source]
+  PASS snapshot:derivation-reasons-cover-every-obligation [packaged]
+  PASS A04:docs-prd-root-positive-produces-ready-snapshot [source]
+  PASS A04:docs-prd-root-positive-produces-ready-snapshot [packaged]
+  PASS A04:custom-prd-root-unavailable-with-no-fallback [source]
+  PASS A04:custom-prd-root-unavailable-with-no-fallback [packaged]
+  PASS A05:whole-candidate-identity-is-not-the-prd-set-digest [source]
+  PASS A05:whole-candidate-identity-is-not-the-prd-set-digest [packaged]
+  PASS A05:deletion-and-rename-endpoints-are-both-bound [source]
+  PASS A05:deletion-and-rename-endpoints-are-both-bound [packaged]
+  PASS A05:deleted-tombstones-omitted-from-checker-artifacts [source]
+  PASS A05:deleted-tombstones-omitted-from-checker-artifacts [packaged]
+  PASS A05:deleted-path-differs-from-empty-file-in-candidate-digest [source]
+  PASS A05:deleted-path-differs-from-empty-file-in-candidate-digest [packaged]
+  PASS framing:path-boundary-concatenation-does-not-collide [source]
+  PASS framing:path-boundary-concatenation-does-not-collide [packaged]
+  PASS framing:mode-drift-changes-candidate-digest [source]
+  PASS framing:mode-drift-changes-candidate-digest [packaged]
+  PASS A09:pinned-baseline-remains-after-fixture-commit [source]
+  PASS A09:pinned-baseline-remains-after-fixture-commit [packaged]
+  PASS A09:head-anchored-capture-has-a-different-baseline-identity [source]
+  PASS A09:head-anchored-capture-has-a-different-baseline-identity [packaged]
+  PASS A09:rename-endpoints-stable-across-repeated-captures [source]
+  PASS A09:rename-endpoints-stable-across-repeated-captures [packaged]
+  PASS R2d-P1:reference-only-provider-context-is-baseline-unavailable [source]
+  PASS R2d-P1:reference-only-provider-context-is-baseline-unavailable [packaged]
+  PASS R2d-P1:input-baseline-re-anchored-to-moved-head-is-never-ready [source]
+  PASS R2d-P1:input-baseline-re-anchored-to-moved-head-is-never-ready [packaged]
+  PASS R2d-P1:input-baseline-equal-to-the-provider-pin-stays-ready-after-head-moved [source]
+  PASS R2d-P1:input-baseline-equal-to-the-provider-pin-stays-ready-after-head-moved [packaged]
+  PASS R2d-P2a:nested-scope-policy-status-is-a-semantic-change [source]
+  PASS R2d-P2a:nested-scope-policy-status-is-a-semantic-change [packaged]
+  PASS R2d-P2a:nested-requirement-and-binding-semantics-change-the-digest [source]
+  PASS R2d-P2a:nested-requirement-and-binding-semantics-change-the-digest [packaged]
+  PASS A10:missing-baseline-commit-yields-baseline-unavailable [source]
+  PASS A10:missing-baseline-commit-yields-baseline-unavailable [packaged]
+  PASS A10:non-repository-baseline-root-yields-baseline-unavailable [source]
+  PASS A10:non-repository-baseline-root-yields-baseline-unavailable [packaged]
+  PASS A10:normal-git-capture-succeeds [source]
+  PASS A10:normal-git-capture-succeeds [packaged]
+  PASS A11:ignored-governed-path-included-or-unavailable-never-silent [source]
+  PASS A11:ignored-governed-path-included-or-unavailable-never-silent [packaged]
+  PASS A11:index-removed-ignored-file-included-or-unavailable [source]
+  PASS A11:index-removed-ignored-file-included-or-unavailable [packaged]
+  PASS A11:ignored-irrelevant-control-has-no-new-must-and-a-justified-exclusion [source]
+  PASS A11:ignored-irrelevant-control-has-no-new-must-and-a-justified-exclusion [packaged]
+  PASS A03:captured-resolution-equals-existing-resolver-project-config [source]
+  PASS A03:captured-resolution-equals-existing-resolver-project-config [packaged]
+  PASS A03:project-overrides-host-positive-equals-existing-resolver [source]
+  PASS A03:project-overrides-host-positive-equals-existing-resolver [packaged]
+  PASS A03:equal-host-positive-equals-existing-resolver [source]
+  PASS A03:equal-host-positive-equals-existing-resolver [packaged]
+  PASS A03:capture-binds-exact-config-bytes-and-selection [source]
+  PASS A03:capture-binds-exact-config-bytes-and-selection [packaged]
+  PASS A03:absent-project-config-yields-config-unavailable [source]
+  PASS A03:absent-project-config-yields-config-unavailable [packaged]
+  PASS purity:producer-capture-writes-nothing-spawns-only-git [source]
+  PASS purity:producer-capture-writes-nothing-spawns-only-git [packaged]
+  PASS R3-P2:unchanged-binary-asset-captures-without-changing-applicability [source]
+  PASS R3-P2:unchanged-binary-asset-captures-without-changing-applicability [packaged]
+  PASS R3-P2:changed-binary-asset-changes-the-candidate-digest-without-changing-applicability [source]
+  PASS R3-P2:changed-binary-asset-changes-the-candidate-digest-without-changing-applicability [packaged]
+  PASS R3-P2:undecodable-governed-document-record-fails-closed [source]
+  PASS R3-P2:undecodable-governed-document-record-fails-closed [packaged]
+  PASS R3-P2:undecodable-derived-output-record-fails-closed [source]
+  PASS R3-P2:undecodable-derived-output-record-fails-closed [packaged]
+  PASS R3-P2:undecodable-code-input-record-fails-closed [source]
+  PASS R3-P2:undecodable-code-input-record-fails-closed [packaged]
+  PASS R3-P2:undecodable-test-input-record-fails-closed [source]
+  PASS R3-P2:undecodable-test-input-record-fails-closed [packaged]
+  PASS R3-P2:undecodable-frontmatter-plain-fails-closed [source]
+  PASS R3-P2:undecodable-frontmatter-plain-fails-closed [packaged]
+  PASS R3-P2:undecodable-frontmatter-bom-fails-closed [source]
+  PASS R3-P2:undecodable-frontmatter-bom-fails-closed [packaged]
+
+S2a producer summary: 80 PASS, 0 FAIL, 0 INFRA across 80 assertion-legs
+S2a producer suite: all assertions PASS.

package/benchmarks/results/reviews/pr353-r6-2026-10-22/final-review.md

@@ -0,0 +1,89 @@
+# Final integration review — PR #353 (selected tree)
+
+Scope: **read-only**, tightly scoped to the selected tree `/Users/daniel.chang/Desktop/Skills/Harness-everything/.worktrees/fix-353`
+compared against frozen A `/Users/daniel.chang/Desktop/Skills/Harness-everything/.worktrees/353-r6-a`.
+No file was edited, no test suite or gate was executed, no background command was launched, no scope was widened.
+
+## Verdict
+
+**ACCEPT — no blocker found.** The only functional delta is the BOM-corrected frontmatter classifier, it
+agrees with the fatal `TextDecoder` leading-BOM semantics, and the new producer regressions pin it.
+The two known non-blocking items (malformed-record diagnostic drift, mirrored-rules maintenance risk)
+are unchanged and remain documented. **No PR-readiness claim is made here; the owner decides.**
+
+## What was compared (read-only)
+
+`diff -u` of every file in the two worktrees plus `git status --porcelain -uall` and `shasum -a 256`:
+
+| File | Delta vs frozen A |
+| --- | --- |
+| `hooks/scripts/lib/doc-reconciliation-core.js` | `opensFrontmatter` only, plus the rule comment: `subarray(0,8).toString('latin1')` → `subarray(0,11).toString('utf8').replace(/^\uFEFF/,'')`; comment gains "Match TextDecoder's BOM handling" |
+| `hooks/scripts/lib/doc-reconciliation-core.js` (rule comment) | wording tightened + `// shortcut: mirrors derive path rules, update them together until a shared classifier is exposed.` |
+| `hooks/scripts/lib/doc-reconciliation-producer.js` | **identical** to frozen A |
+| `hooks/scripts/lib/doc-reconciliation-events.js` | **identical** to frozen A |
+| `plugins/harness-everything/hooks/scripts/lib/doc-reconciliation-{core,producer}.js` | regenerated copies of the same deltas; SHA-256 identical to the canonical sources (`b4345651…`, `f8f5683f…`); events copy identical (`5fd2808a…`) |
+| `ci/mechanism-325-3b-s2a-producer.test.js` | +2 assertions: `R3-P2:undecodable-frontmatter-plain-fails-closed`, `R3-P2:undecodable-frontmatter-bom-fails-closed` (loop over prefix `''` / `'\uFEFF'`, writing `assets/role.dat` = prefix + `---\nrole: prd\n---\n` + binary bytes) |
+| `ci/mechanism-325-3b-s2a-core.test.js`, `ci/fixtures/.../harness.js`, `CHANGELOG.md` | **identical** to frozen A |
+| `docs/doc-workflow-reconciliation.md` | wording only: adds "(including one after a leading UTF-8 BOM)"; replaces "a binary asset never changes document applicability" with "irrelevant binary assets remain usable" |
+
+No public derive/checker API, identity/digest schema, S1 runtime, workflow wiring, version or dependency
+changed. Scope is exactly the stated delta — **source-traced**.
+
+## Findings
+
+1. **The BOM classifier agrees with the fatal `TextDecoder` leading-BOM semantics** — *source-traced*.
+   The derive contract reads a file through `TextDecoder('utf-8', {fatal:true})`, whose WHATWG UTF-8 decoder
+   removes a leading `EF BB BF` from the byte stream, so the decoded text starts at the byte after the BOM.
+   The classifier reproduces exactly that: `Buffer.toString('utf8')` keeps U+FEFF as a character (it does
+   **not** strip the BOM), so the explicit `replace(/^\uFEFF/, '')` restores the decoder's behaviour; a
+   leading `EF BB BF` is by definition the BOM, so the classifier never strips something the decoder would
+   keep. The 11-byte window covers the longest relevant first line — BOM(3) + `---`(3) + CRLF(2) = 8 bytes
+   — and a longer first line cannot be `---`. A truncated BOM (`EF`, `EF BB`) decodes to U+FFFD in both
+   decoders (neither skips bytes), so the classifier's `false` matches the decoder's "no frontmatter".
+   The trailing-`\r` strip mirrors `parseFrontmatter`'s own rule exactly.
+
+2. **The new tests pin the fix, and the RED arithmetic confirms the RED was the BOM case** — *source-traced
+   + coordinator-executed*. `assets/role.dat` is at a path no config glob classifies, so only the frontmatter
+   rule can catch it; the frozen latin1 classifier saw `'\u00EF\u00BB\u00BF---'` and returned `false`, i.e.
+   it dropped a document-semantic record — exactly the defect the coordinator's independent BOM transition
+   probe reported for both candidates. The frozen tree's plain variant passed and only the BOM variant
+   failed, which is what the reported **78 PASS / 2 FAIL** (one failing assertion-leg per leg) and
+   **80 / 0** GREEN over 80 legs imply; the final classifier returns `true` for both variants
+   (`'---'` and `'\uFEFF---\n…'` → stripped → `'---'`). The tests fail loudly if the BOM handling regresses
+   (the producer would become `ready` and the assertion `undecodable frontmatter must not disappear from
+   semantic inputs` would fire).
+
+3. **The change is confined to the classifier; no behaviour elsewhere moved** — *source-traced*.
+   `semanticRelevance`, `deriveFiles`, `originBound`, `configBytesBound`, the identity framing and the
+   producer/event modules are untouched, so the previously accepted P1 binding, the binary byte identity
+   (`candidateDigest`/`baselineDigest` framing), producer/core parity and the fail-closed reason codes are
+   unchanged. Packaged copies are byte-identical to the canonical files.
+
+4. **The docs delta is wording-only and removes an over-claim** — *source-traced*. The frozen sentence
+   "a binary asset never changes document applicability" was inaccurate (a *relevant* binary asset does
+   change applicability — it fails closed); the replacement "irrelevant binary assets remain usable while
+   the identity still covers their bytes" is the accurate statement, and the BOM case is now named in the
+   contract text. No normative claim was weakened.
+
+5. **The shortcut comment follows the repository convention** — *source-traced*. It states the limit
+   (the mirrored derive-contract path rules) and the upgrade condition ("until a shared classifier is
+   exposed"), matching the `shortcut: <limit>, <when to upgrade>` form. It also names the real risk my
+   earlier cross-review raised, so the drift exposure is now visible in the code itself.
+
+6. **The two known non-blocking items are unchanged and remain non-blocking** — *source-traced*.
+   (a) *Malformed-record diagnostic drift*: the core catch still maps the plain `Error('inventory-unsupported')`
+   thrown by the shared `bytes()` helper to `inventory-unsupported` where the base reported `invalid-input`;
+   credit is withheld either way because any diagnostic makes `reconcileDocResults` return before the
+   eligibility branch. (b) *Mirrored-rules maintenance risk*: `CODE_EXTENSION`/`TEST_PATH`/glob semantics are
+   still mirrored inside the reconciliation module; the drift guard remains a follow-up, now documented
+   in-code. Neither is a blocker for this change, which does not touch that surface.
+
+## Not assessed in this review
+
+The coordinator's executed evidence was taken as given (32 independent probes pass; `verify:all`
+13 PASS / 0 FAIL / 3 UNCHECKED; consistency rerun PASS; producer RED 78/2 → GREEN 80/0; core 195/0).
+This review executed no tests, gates or suites, made no file edits, and did not examine live-host
+provenance, the S1 runtime, workflow wiring or E1 readiness — all outside S2a. PR readiness is not
+certified here.
+
+STATUS: DONE

package/benchmarks/results/reviews/pr353-r6-2026-10-22/final-transitions.log

@@ -0,0 +1,5 @@
+PASS source frontmatter unavailable
+PASS source req-test unavailable
+PASS packaged frontmatter unavailable
+PASS packaged req-test unavailable
+{"passed":4,"failed":0}

package/benchmarks/results/reviews/pr353-r6-2026-10-22/implementation-a.md

@@ -0,0 +1,166 @@
+# PR #353 — Leg A implementation report
+
+Worktree: `/Users/daniel.chang/Desktop/Skills/Harness-everything/.worktrees/353-r6-a`
+Base: `59421f41a8ce2b00250c96634a4a43ae0ba782bf`
+Node: v24.14.1 (`/Users/daniel.chang/.nvm/versions/node/v24.14.1/bin/node`), TMPDIR isolated to
+`/tmp/harness-353-r6-a/legA/tmp`.
+Evidence dir: `/tmp/harness-353-r6-a/legA` (logs in `legA/logs`).
+No git/gh write commands were run; the coordinator owns git, packaging upload and PR readiness.
+
+## Changed files (write-set only)
+
+| File | Change |
+| --- | --- |
+| `hooks/scripts/lib/doc-reconciliation-core.js` | P1: `originBound()` binds the captured origin identity to `snapshot.identity`, the captured plan and the selected active host; `configBytesBound()` binds the captured config bytes to the captured inventory. P2: `deriveFiles()` converts only decodable records and fails closed for records the derive contract can observe; `semanticRelevance()` + `opensFrontmatter()`; coded error mapping in `validateSnapshot`. |
+| `hooks/scripts/lib/doc-reconciliation-producer.js` | P2: the producer uses the shared `U.deriveFiles()` with the captured config (identical handling to the core re-derivation). |
+| `plugins/harness-everything/hooks/scripts/lib/doc-reconciliation-{core,producer}.js` | Generated by `npm run plugin:sync` (byte-identical to the canonical files). |
+| `ci/mechanism-325-3b-s2a-core.test.js` | P1 identity/plan/host/config-link regressions; P2 binary-record regressions. |
+| `ci/mechanism-325-3b-s2a-producer.test.js` | P2 binary capture and fail-closed regressions. |
+| `ci/fixtures/doc-obligations/reconciliation-s2a/harness.js` | Fixture-only binary support: `writeBinary()`, `makeRepo(base, binary)`, `BINARY_BYTES`, `BINARY_BYTES_CHANGED`. |
+| `docs/doc-workflow-reconciliation.md` | S2a contract text for the origin-identity binding and the binary-record rule. |
+| `CHANGELOG.md` | Two new topmost `[Unreleased]` entries. |
+
+`hooks/scripts/lib/doc-reconciliation-events.js` was **not** changed: it already compares the provider
+context with the captured origin context and calls `validateSnapshot`, so it inherits the P1 binding.
+No public derive/checker API, identity/digest schema, S1 runtime, workflow wiring, version or dependency
+changed. No scratch `.js` file was left in the repo (`git status` shows no untracked files).
+
+## Design choices
+
+### P1 — the captured origin identity must be the snapshot identity
+
+`validateSnapshot()` now calls `originBound(snapshot)` (new, pure):
+
+1. `originContext.{workspaceId,sessionId,workflowId,workflowRevision,taskId}` must equal
+   `identity.{...}` — the five fields of the origin-correlated identity.
+2. The captured plan must agree with that identity: `taskSemantics.workflow.{workflowId,
+   workflowRevision,sessionId}`, `taskSemantics.task.taskId`, `taskSemantics.prdRoot`,
+   `taskSemantics.configDigest`.
+3. The captured `originContext.activeHost` must equal the host the captured config was selected for
+   (`config.capture.activeHost`); the comparison is skipped only when neither side represents a host.
+
+This closes the disconnect: events compare provider↔captured origin context and event identity↔
+`snapshot.identity`, so binding the captured origin context to the identity connects the two halves. A
+joint substitution of the captured origin context and the provider context now yields
+`identity-mismatch` in **both** `verification` and `review` mode, in the fresh-acceptance path and in the
+cached-acceptance path (the cached acceptance is re-validated against the snapshot on every core call, so
+it cannot bypass the invariant).
+
+Adjacent link closed in the same class: `configBytesBound()` requires the captured config source bytes to
+be the bytes the captured inventory holds for the same path — the producer's own rule
+(`doc-reconciliation-producer.js`), which the core previously did not re-check. A substituted config
+digest is `config-capture-mismatch`.
+
+### P2 — a whole-project inventory may contain binary records
+
+* Stored bytes are untouched: every record's bytes stay in the `candidateDigest`/`baselineDigest`
+  framing, so a changed binary asset changes `candidateDigest`.
+* Semantic derivation needs decoded text. A record whose bytes are not valid UTF-8 is **omitted** from
+  derivation only when the derive contract cannot observe it, and **fails closed**
+  (`inventory-unsupported`) when it can.
+* Relevance is taken from the derive contract's own surface, not from a binary-extension allowlist:
+  the configured `governed`/`legacy` globs, the `derived` output/source globs, the derive contract's
+  code-extension and REQ-test path rules (`doc-obligations.js` `CODE_EXTENSION`, `TEST_PATH`), plus any
+  record that opens a frontmatter block (the derive contract reads the frontmatter of every captured
+  file and treats a frontmatter `role` as governed).
+* Producer and core re-derivation share one implementation (`_internals.deriveFiles`), so both handle
+  binary records identically.
+* The lifecycle reader, its byte-conversion rule (`workingStoredBytes`: a NUL byte means no text
+  conversion) and the producer's explicit `MAX_FILES`/`MAX_BYTES` budgets were not altered; no public
+  lifecycle helper behavior changed.
+
+## RED / GREEN evidence
+
+| Stage | Command | Result | Log |
+| --- | --- | --- | --- |
+| RED core (tests first, production unchanged) | `node ci/mechanism-325-3b-s2a-core.test.js` | **175 PASS, 18 FAIL, 0 INFRA** / 193 assertion-legs | `legA/logs/red-core.log` |
+| RED producer | `node ci/mechanism-325-3b-s2a-producer.test.js` | **72 PASS, 4 FAIL, 0 INFRA** / 76 assertion-legs | `legA/logs/red-producer.log` |
+| GREEN core (run 1) | same | **195 PASS, 0 FAIL, 0 INFRA** / 195 assertion-legs | `legA/logs/final-core-run1.log` |
+| GREEN core (run 2, identical input) | same | **195 PASS, 0 FAIL, 0 INFRA**, assertion lines byte-identical to run 1 | `legA/logs/final-core-run2.log` |
+| GREEN producer (run 1) | same | **76 PASS, 0 FAIL, 0 INFRA** / 76 assertion-legs | `legA/logs/final-producer-run1.log` |
+| GREEN producer (run 2, identical input) | same | **76 PASS, 0 FAIL, 0 INFRA**, assertion lines byte-identical to run 1 | `legA/logs/final-producer-run2.log` |
+
+Actual RED failure reasons (from the unchanged production code):
+
+* Core — `12 × verification: a substituted origin identity must not earn credit`
+  (joint substitution of `workspaceId`, `sessionId`, `workflowId`, `workflowRevision`, `taskId` and
+  `activeHost` in the captured origin context **and** the provider context earned credit).
+* Core — `2 × verification: a substituted plan and identity must not earn credit`.
+* Core — `2 × capture with an irrelevant binary record: no decision` (the producer was unavailable for a
+  tracked binary asset).
+* Core — `2 × the core must fail closed on a relevant undecodable record: [{"code":"invalid-input",…}]`
+  (the core had no relevance-specific reason).
+* Producer — `4 × capture with an unchanged binary asset: state unavailable with codes
+  ["inventory-unsupported"]`.
+
+Non-vacuity probe for the added config↔inventory link (the check was temporarily disabled in the
+production file, then restored byte-for-byte): the new assertion failed with
+`config bytes the captured inventory contradicts must not earn credit` on both legs
+(`legA/logs/red-config-link-3.log`), i.e. the substituted-config snapshot was **eligible** without the
+new check. After restoring the file: 195 PASS / 0 FAIL (`legA/logs/green-core-3.log`).
+
+## Tests executed
+
+* `node ci/mechanism-325-3b-s2a-core.test.js` — both legs (canonical + packaged), twice.
+* `node ci/mechanism-325-3b-s2a-producer.test.js` — both legs (canonical + packaged), twice.
+* `npm run plugin:sync` — regenerated `plugins/harness-everything/hooks/scripts/lib/`; the packaged core
+  and producer are byte-identical to the canonical files (sha256 verified).
+* `npm run test:consistency` — PASS (`legA/logs/final-gate-consistency.log`).
+* `npm run test:plugin:openai` — PASS (`legA/logs/final-gate-plugin-openai.log`).
+* `npm run test:portability` — PASS (`legA/logs/final-gate-portability.log`).
+
+Not run (coordinator owns the full gates): `npm test`, `npm run verify:all`,
+`ci/mechanism-test.js`, `npm run test:mechanism`.
+
+## Source-anchored findings
+
+* **executed** — On base `59421f4`, a joint substitution of the captured origin context and the provider
+  context (identity, events and cached acceptance left at the original tuple) earned
+  `eligible` credit in verification mode: the provider half and the event half of the trust contract were
+  disconnected (`legA/logs/red-core.log`).
+* **executed** — On base `59421f4`, a normal tracked binary asset (`assets/logo.png`, invalid UTF-8)
+  made the producer return `inventory-unsupported`, so the whole-project capture was unusable for an
+  ordinary repository (`legA/logs/red-producer.log`).
+* **executed** — With the P2 fix, a changed binary asset changes `candidateDigest` while the MUST set
+  stays the normative set; an unchanged binary asset leaves the capture usable and the core's
+  re-derivation accepts the snapshot.
+* **source-traced** — The derive contract's applicability surface is governed/legacy globs, derived
+  output/source globs, `CODE_EXTENSION`, `TEST_PATH` and frontmatter `role`
+  (`harness-everything/scripts/doc-obligations.js`: `CODE_EXTENSION`/`TEST_PATH` lines 17-18,
+  `governedEntry`/`matchesAny` lines 92-95, `roleAt`/`isGoverned` lines 1055-1068,
+  `derivedEntryAffected` lines 1313-1322). These are the paths whose bytes can change applicability and
+  therefore the relevance surface used by the fix.
+* **source-traced** — The producer already required the captured config bytes to equal the captured
+  inventory bytes for the same path (`doc-reconciliation-producer.js`, config-source loop); the core
+  re-checks the same rule now.
+* **source-traced** — The lifecycle reader's conversion rule and the producer's explicit capture budgets
+  (`MAX_FILES`, `MAX_BYTES`) are unchanged; no public lifecycle helper was touched.
+* **inconclusive** — Whether a production origin provider context always carries an `activeHost` is not
+  observable from this repository (the S2a fake provider carries one). The host check is skipped only
+  when neither the captured context nor the captured config represents a host.
+
+## Remaining risks
+
+1. The relevance rules mirror the derive contract's path rules inside the reconciliation module, because
+   `doc-obligations.js` is outside this write-set. A future change to the derive contract's code/test
+   path rules or glob semantics must be mirrored here. The duplication is two regexes plus the glob
+   semantics; the behaviour is pinned by the new tests.
+2. A record whose first line is exactly `---` fails closed even when it is an irrelevant binary asset.
+   This is deliberate (the derive contract observes such a file's frontmatter) but can turn an exotic
+   binary asset into `inventory-unsupported`.
+3. In the core, a relevant undecodable record is reported as `inventory-unsupported` and the decision is
+   `unresolved` (not `unavailable`). Credit is withheld either way; the reason code differs from the
+   producer's `state: "unavailable"`.
+4. The producer's whole-project walk still traverses `node_modules` and is bounded by the pre-existing
+   `MAX_FILES`/`MAX_BYTES` limits. That is unchanged pre-existing behavior and out of scope here.
+5. Evidence is deterministic mechanism evidence only: the origin provider is an explicit test fake, so
+   nothing here proves live-host provenance, reviewer independence in deployment, host loading or E1
+   readiness.
+
+## Handover
+
+Leg A is complete and self-contained in its worktree. Nothing was committed, staged or pushed; the
+coordinator owns git and PR readiness. This implementation is independent of leg B: it was developed
+without reading the other worktree or its artifacts.
+
+STATUS: DONE

package/benchmarks/results/reviews/pr353-r6-2026-10-22/implementation-b.md

@@ -0,0 +1,264 @@
+# PR #353 — Implementation report (leg B)
+
+Base: `59421f41a8ce2b00250c96634a4a43ae0ba782bf` (read-only `git show`/`git log` only; no git/gh write
+commands were run, no commits, no worktree mutation, no remote messages).
+
+Worktree: `/Users/daniel.chang/Desktop/Skills/Harness-everything/.worktrees/353-r6-b`
+Evidence dir: `/tmp/harness-353-r6-b` (logs under `logs/`, scratch probes under `probe/`, both outside the repo)
+
+## Round 2 — coordinator defect (executed omission defect) and its fix
+
+**Defect (executed, coordinator-found).** The coordinator's transition probe
+(`/tmp/harness-353-r6-coordinator/semantic-transitions.js`, log `b-transitions.log`) failed all four
+source/packaged cases. My first implementation probed relevance with
+`base.undecodable[path] → same text + "\n"` only: it read the **baseline** record's lossy text and never the
+candidate's. A capture whose baseline record is nonsemantic while the candidate record's bytes carry a
+`role: prd` frontmatter or a REQ-citing test therefore looked irrelevant, and the candidate's document
+meaning was silently dropped from the derivation. Two further weaknesses: a same-text modification cannot
+show new/deleted test identity, and no addition/deletion transition was probed at all.
+
+**Fix (minimal, in the shared helper).** `deriveCapturedFacts` now probes relevance through the unchanged
+derivation with each undecodable record's **own** bytes and three transition witnesses:
+
+| Witness | Baseline side | Candidate side | Shows |
+| --- | --- | --- | --- |
+| actual | the record's baseline lossy text (if present) | the record's candidate lossy text (if present) | the real transition of this capture, carrying the candidate's own semantics |
+| addition | the record absent | the record's lossy text | new document / new REQ-citing test identity |
+| deletion | the record's lossy text | the record absent | deleted document / deleted test identity |
+
+If any witness changes the derived obligations (applicability **and** scope included), the record is
+semantically relevant and the capture fails closed as `inventory-unsupported`; otherwise it is omitted from
+the derivation inputs. The stored bytes of every record stay in the whole-project hash, so the inventory
+byte identity is intact (`candidateDigest` still covers binary bytes; `baselineDigest` unchanged).
+
+**Honest scope of the claim.** These witnesses are lossy-text probes of the unchanged derivation, not a
+proof about the true bytes of an undecodable file. They establish that the unchanged derivation finds no
+document meaning for the record under the actual, addition and deletion transitions; they do **not**
+establish full decision equivalence for every possible undecodable byte sequence. Where the witnesses
+disagree the implementation fails closed, which is the safe branch.
+
+### Round-2 evidence
+
+| Suite | RED (v1 implementation, new tests) | GREEN (fixed) | Log |
+| --- | --- | --- | --- |
+| S2a core | **191 PASS, 2 FAIL, 0 INFRA** / 193 assertion-legs | **193 PASS, 0 FAIL, 0 INFRA** | `logs/RED2-core.log` → `logs/GREEN-core.log` |
+| S2a producer | **74 PASS, 4 FAIL, 0 INFRA** / 78 assertion-legs | **78 PASS, 0 FAIL, 0 INFRA** | `logs/RED2-producer.log` → `logs/GREEN-producer.log` |
+
+RED2 failure reason, identical on the `source` and `packaged` legs and equal to the coordinator's finding:
+
+```
+FAIL R2h-P2:prd-frontmatter-binary-semantics-are-never-omitted — the candidate semantics of the binary record at assets/role.dat were omitted
+FAIL R2h-P2:req-citing-test-binary-semantics-are-never-omitted — the candidate semantics of the binary record at tests/fixture.dat were omitted
+FAIL R2h-P2:candidate-binary-semantics-never-earn-credit-while-omitted — the candidate semantics of the binary record at assets/role.dat were omitted
+```
+
+Shipped regression tests (run on both legs by the S2a runner):
+
+- `ci/mechanism-325-3b-s2a-producer.test.js` — `R2h-P2:prd-frontmatter-binary-semantics-are-never-omitted`
+  and `R2h-P2:req-citing-test-binary-semantics-are-never-omitted`: a capture is acceptable only if it fails
+  closed with `inventory-unsupported`, or if the derived obligations still carry the candidate's semantics
+  (`role: prd` in a MUST scope / a non-N/A `requirement-sync`).
+- `ci/mechanism-325-3b-s2a-core.test.js` — `R2h-P2:candidate-binary-semantics-never-earn-credit-while-omitted`:
+  the same property through the full produce → accept → decide flow, and no credit without accepted evidence.
+
+Coordinator probes re-executed read-only against the fixed implementation:
+
+```
+node /tmp/harness-353-r6-coordinator/semantic-transitions.js <worktree>   → 4 passed, 0 failed   (all four now FAIL-CLOSED: state "unavailable")
+node /tmp/harness-353-r6-coordinator/probes.js <worktree>                 → 26 passed, 0 failed
+```
+
+Logs: `logs/GATE-coordinator-transitions.log`, `logs/GATE-coordinator-probes.log`.
+
+## Changed files (write-set respected)
+
+| File | Change |
+| --- | --- |
+| `hooks/scripts/lib/doc-reconciliation-core.js` | P1 origin↔identity binding in `validateSnapshot`; P2 binary-safe shared derivation (`readRecords`, `decodeUtf8`, `deriveCapturedFacts`); `inventory-unsupported` mapped out of the validation catch |
+| `hooks/scripts/lib/doc-reconciliation-producer.js` | Producer now derives through the shared `U.deriveCapturedFacts`; local `filesOf` and the now-unused derive import removed |
+| `plugins/harness-everything/hooks/scripts/lib/doc-reconciliation-core.js` | generated copy (`npm run plugin:sync`), byte-identical to source |
+| `plugins/harness-everything/hooks/scripts/lib/doc-reconciliation-producer.js` | generated copy (`npm run plugin:sync`), byte-identical to source |
+| `ci/mechanism-325-3b-s2a-core.test.js` | 8 new P1/P2 assertions (7 round 1 + 1 round 2); `withVector` now returns the callback value |
+| `ci/mechanism-325-3b-s2a-producer.test.js` | 7 new P2 assertions (5 round 1 + 2 round 2) |
+| `ci/fixtures/doc-obligations/reconciliation-s2a/harness.js` | shared `BINARY_ASSET` / `BINARY_ASSET_CHANGED` byte fixtures (raw bytes, invalid UTF-8) |
+| `docs/doc-workflow-reconciliation.md` | S2a contract: origin-identity binding paragraph; binary-record derivation paragraph |
+| `CHANGELOG.md` | topmost `[Unreleased]` entry only |
+
+Not changed (deliberately): `doc-reconciliation-events.js` needed no change — it already compares the
+provider context with `snapshot.originContext` and calls `validateSnapshot`, so it inherits both fixes.
+No public derive/checker API, identity/digest schema, S1 runtime, workflow wiring, version or dependency
+was touched. No scratch `.js` file was left inside the repo (`git status --porcelain -uall` shows only the
+nine modified files above).
+
+## P1 — the whole captured origin identity must agree with the hashed identity
+
+**Finding (source-traced → executed).** `validateSnapshot` bound only the baseline pin
+(`context.baseline.commit` / `context.baseline.root`); `acceptDocEvents` compared the provider context with
+`snapshot.originContext`, and the event's `identity` was compared with `snapshot.identity`. The
+`originContext ↔ identity` link was missing, so the two halves never met. `snapshot.originContext` is not
+hashed by anything (`snapshotDigest` covers baseline/coverage/records, `configDigest` covers the config,
+`taskScopeDigest` covers the plan), so it was an unbound field.
+
+**Fix.** In `validateSnapshot` (pure, no I/O):
+
+- every origin-correlated identity field — `workspaceId`, `sessionId`, `workflowId`, `workflowRevision`,
+  `taskId` — must equal the same field in `snapshot.identity`; a disagreement is `identity-mismatch`;
+- the captured `activeHost` must equal the selected config capture's `activeHost`
+  (`snapshot.config.capture.activeHost`), which is the selection context already hashed into
+  `configDigest`.
+
+Because `validateSnapshot` runs in `acceptDocEvents` **and** in `reconcileDocResults`, the binding holds at
+event acceptance, in `verification` mode, in `review` mode, and for a cached `accepted` report replayed
+against the tampered snapshot. The plan side was already bound: `taskScopeDigest` covers task id, workflow
+id/revision/session, scope, coverage and the PRD root, so a joint plan/digest change is caught by the event
+identity check (pinned as a regression, it already passed on the RED base).
+
+Represented tuple links inspected (not just two examples): identity↔originContext (5 fields),
+identity↔activeHost, identity↔plan (via `taskScopeDigest`), identity↔baseline pin, identity↔baseline/
+candidate digests, identity↔config digest, identity↔PRD root.
+
+## P2 — a binary asset must not make the whole-project capture unsupported
+
+**Finding (source-traced → executed).** `filesOf` decoded every captured record with
+`new TextDecoder('utf-8', {fatal: true})`, so one ordinary tracked asset (`assets/logo.png`) made the whole
+producer `inventory-unsupported` — fatal decoding was applied to a whole-project inventory.
+
+**Relevance is decided by the unchanged derivation, not by an extension allowlist.** The relevance rule is
+the derivation's own path classification (governed/legacy globs, derived paths and sources, code
+extensions, test paths), and the unchanged `deriveDocFacts`/`deriveDocObligations` decide it: an
+undecodable record is **probed** through the derivation with its own bytes, under the actual, addition and
+deletion transitions (round 2), and the derived obligations (applicability *and* scope) must stay
+identical. Only then is the record omitted from the derivation inputs; otherwise the record is semantically
+relevant and the capture fails closed as `inventory-unsupported`. The stored bytes of every record remain
+in the whole-project hash, so `candidateDigest` still changes when a binary asset changes.
+
+Consequences, verified: `assets/logo.png` (irrelevant) → capture stays ready, MUST set unchanged,
+`candidateDigest` changes; `docs/prd/logo.png` (governed), `docs/roadmap/index.md` (derived output) and
+`src/logo.js` (code) → `inventory-unsupported`; a candidate binary carrying a `role: prd` frontmatter or a
+REQ-citing test → `inventory-unsupported` (round 2, coordinator defect).
+
+The bounded readers are untouched: the producer's `MAX_BYTES`, the lifecycle's bounded blob read and the
+public lifecycle helpers (`parseFrontmatter`, `scanWorkspaceFiles`, `analyzeDocs`) are unchanged; only the
+byte-to-text step in the S2a modules changed. Producer and core re-derivation call the same shared
+`deriveCapturedFacts`, so a captured snapshot and its re-derivation always agree (asserted by comparing the
+derived facts and obligations of the same repository with and without the asset).
+
+## RED → GREEN evidence (deterministic mechanism only)
+
+Logs: `/tmp/harness-353-r6-b/logs/`. RED was produced by restoring the two production modules (and their
+packaged copies) from `HEAD` with read-only `git show`, running the **final** test files, then restoring the
+implementation. Every RED failure below is the stated reason, not an artefact.
+
+| Suite | RED (base code, final tests) | GREEN (implementation) | Log |
+| --- | --- | --- | --- |
+| S2a core | **177 PASS, 14 FAIL, 0 INFRA** / 191 assertion-legs | **193 PASS, 0 FAIL, 0 INFRA** / 193 | `logs/RED-core.log` → `logs/GREEN-core.log` |
+| S2a producer | **70 PASS, 4 FAIL, 0 INFRA** / 74 assertion-legs | **78 PASS, 0 FAIL, 0 INFRA** / 78 | `logs/RED-producer.log` → `logs/GREEN-producer.log` |
+
+Round 2 (after the coordinator defect) is reported in its own section above: `logs/RED2-*.log` →
+`logs/GREEN-*.log`.
+
+RED failure reasons (identical on the `source` and `packaged` legs):
+
+```
+FAIL R2g-P1:joint-origin-and-provider-workspaceId-substitution-rejected — expected one of ["identity-mismatch"] in []
+FAIL R2g-P1:joint-origin-and-provider-sessionId-substitution-rejected — expected one of ["identity-mismatch"] in []
+FAIL R2g-P1:joint-origin-and-provider-workflowId-substitution-rejected — expected one of ["identity-mismatch"] in []
+FAIL R2g-P1:joint-origin-and-provider-workflowRevision-substitution-rejected — expected one of ["identity-mismatch"] in []
+FAIL R2g-P1:joint-origin-and-provider-taskId-substitution-rejected — expected one of ["identity-mismatch"] in []
+FAIL R2g-P1:joint-origin-and-provider-active-host-substitution-rejected — expected one of ["identity-mismatch"] in []
+FAIL R2g-P2:binary-asset-capture-stays-eligible-and-derives-as-without-the-asset — no decision (producer unavailable: inventory-unsupported)
+FAIL R2g-P2:unchanged-binary-asset-captures-and-keeps-the-document-must-set — state unavailable with codes ["inventory-unsupported"]
+FAIL R2g-P2:changed-binary-asset-changes-the-candidate-digest-and-keeps-the-must-set — state unavailable with codes ["inventory-unsupported"]
+```
+
+i.e. on the base code the joint origin/provider substitution produced **no** diagnostic at all and stayed
+eligible, and a binary asset made the capture unavailable.
+
+Repeat-identical-input evidence: the two suites were run twice after the fix and the per-assertion
+PASS/FAIL lines are identical (`logs/GREEN-core-run2.log`, `logs/GREEN-producer-run2.log`; `diff` clean).
+
+## Tests executed
+
+```
+node ci/mechanism-325-3b-s2a-core.test.js        PASS (193/193)         logs/GREEN-core.log
+node ci/mechanism-325-3b-s2a-producer.test.js     PASS (78/78)           logs/GREEN-producer.log
+node ci/mechanism-325-3b-s1.test.js               PASS                   logs/GATE-mechanism-325-3b-s1.log
+node ci/mechanism-325-3b-s1-review.test.js        PASS                   logs/GATE-mechanism-325-3b-s1-review.log
+node ci/mechanism-325-3b-preparation.test.js      PASS                   logs/GATE-mechanism-325-3b-preparation.log
+node ci/mechanism-2ax-doc-lifecycle.test.js       PASS                   logs/GATE-mechanism-2ax-doc-lifecycle.log
+npm run test:consistency                          PASS                   logs/GATE-consistency3.log (and 1, 2)
+npm run test:plugin:openai                        PASS                   logs/GATE-plugin-openai.log
+npm run test:portability                          PASS                   logs/GATE-portability.log
+npm run test:repo-contract                        PASS                   logs/GATE-repo-contract.log
+npm run test:docs:capabilities                    PASS                   logs/GATE-docs-capabilities.log
+npm run plugin:sync                               generated copies synced
+```
+
+Round-2 additions: the coordinator's `semantic-transitions.js` (4/4 PASS) and `probes.js` (26/26 PASS),
+both re-executed read-only — `logs/GATE-coordinator-transitions.log`, `logs/GATE-coordinator-probes.log`.
+Source and packaged copies of all three S2a modules are byte-identical (SHA-256 checked).
+
+Not run by instruction: `npm test`, `npm run verify:all`, `ci/mechanism-test.js` (the coordinator runs the
+full gates once).
+
+## Findings by evidence layer
+
+- **executed** — P1 joint substitution of every origin-correlated identity field and of `activeHost` is
+  rejected at event acceptance, in `verification`, in `review`, and against a cached accepted report; the
+  unchanged-context control stays eligible.
+- **executed** — a tracked binary asset no longer makes the producer unavailable; `candidateDigest` still
+  changes when the asset changes; the document MUST set is unchanged; producer and core re-derivation agree.
+- **executed** — a binary record at a governed path, a derived output path or a code path fails closed with
+  `inventory-unsupported`; the unchanged-binary and changed-binary variants are both covered.
+- **executed (round 2)** — a candidate binary record whose bytes carry a `role: prd` frontmatter or a
+  REQ-citing test is no longer omitted: the capture fails closed, on both the source and the packaged leg.
+  The coordinator's four transition cases now pass; its 26-case probe suite still passes.
+- **source-traced** — the plan side of the tuple (`taskId`, workflow id/revision/session, scope, coverage,
+  PRD root) is bound by `taskScopeDigest`; a joint plan/digest change is rejected by the event identity
+  check. The regression test for it already passed on the RED base (it is a pin, not a new RED).
+- **source-traced** — the root half of the workspace binding stays out of scope, exactly as the S2a
+  contract already states: root metadata is not in the hashed identity and external worktree
+  authentication remains outside this guarantee (`docs/doc-workflow-reconciliation.md`).
+- **inconclusive** — the completeness of the relevance witnesses. They are lossy-text probes of the
+  unchanged derivation under the actual, addition and deletion transitions. They show that the derivation
+  finds no document meaning for the record under those transitions; they do **not** prove decision
+  equivalence for every possible undecodable byte sequence, and they are not a proof about the true bytes
+  of an undecodable file.
+- **inconclusive** — live-host provenance. Every origin in these suites is an explicit fake provider
+  (`H.FakeOrigin`). The suites prove the acceptance/decision algorithm only; they prove nothing about
+  authentic host provenance, reviewer independence in deployment, live-host loading or E1 readiness.
+- **inconclusive** — platform coverage. The suites ran on macOS only. `test:portability` passed (no
+  Windows-hostile paths in the scanned test sources), but the Windows lane and the Node 22 runtime floor
+  were not executed locally; CI owns them.
+
+## Remaining risks
+
+1. **Binary relevance is decided by lossy-text witnesses of the unchanged derivation** (round 2). A record
+   whose bytes the witnesses cannot read as meaningful document structure is omitted, so
+   `facts.changedPaths` and `facts.documentAnalysis` do not mention it. Applicability and scope are
+   unchanged under every probed transition, but the informational facts no longer list the omitted path.
+   Where the witnesses disagree the capture fails closed, which is the safe branch. Documented in
+   `docs/doc-workflow-reconciliation.md`.
+2. **The witnesses cost up to three extra `deriveDocFacts` calls** when a capture contains undecodable
+   records (batched over all such records, short-circuiting on the first difference). No extra call for
+   text-only repositories.
+3. **`workspaceRoot` is still not hashed into the identity.** The joint provider/context pin-root
+   replacement remains detectable only for snapshot-internal consistency, as the contract already states.
+   Closing it needs a root-bound identity, which would change the identity schema — out of scope here.
+4. **`activeHost` comparison treats "absent" on both sides as equal**, because the producer's own check
+   requires the provider's and the input's `activeHost` to be strictly equal, and an undefined input host
+   is captured as `null` by the resolver. A snapshot with an absent host on one side and a present host on
+   the other is rejected.
+5. **Cross-leg coordination.** This leg edits `ci/fixtures/doc-obligations/reconciliation-s2a/harness.js`
+   (shared constants). If leg A edited the same fixture, the coordinator's selection must take one harness,
+   not merge both.
+6. **The coordinator's transition probe asserts "fail closed or semantics retained"**, not which of the two
+   happens. This implementation always fails closed on those inputs. If a later revision keeps such a
+   capture ready, the shipped regression tests still require the semantics to be present in the obligations.
+
+## Not certified
+
+PR readiness is not certified here. The owner decides. The coordinator still owes the full `npm test` /
+`npm run verify:all` run (including the Windows and Node 22 lanes) and the cross-validation against leg A.
+
+STATUS: DONE

package/benchmarks/results/reviews/pr353-r6-2026-10-22/logs.sha256

@@ -0,0 +1,15 @@
+220657f085fd148dc8e5fc0523a3d01070b2ae8a1a3eae04ed9da17f34e031d7  baseline-probes.log
+90349aceb2bdb4df1444d89f80494754c3a4d1e323afca5d02cacf7a3c930147  bom-red.log
+7209e2448ea0b9ab78aa0df98d6be76facf023a50a5bc0c0825cd678f8035ec5  final-bom.log
+d83f299638acec8476ec0801aa3cf58db98f466a226e587fa16c0a3b8e482674  final-consistency.log.gz
+7bea7e1ff27064f04d2f5268c1e65cae547716b4970a606c2ac7316ec2d5a896  final-core.log
+ac922d20de98c4c247d764d77b2dd4164200885e83a8cff7ef5588a9ef9a0dc2  final-probes.log
+5b6de979d4342827c2bd0ef49867c60c60fc0e017b3ced9eb5a88b4db4f9ea78  final-producer.log
+279830701f9804c77c778bf11d3e858c5cb20dfa8ab75288a47655bebd87855e  final-transitions.log
+67d2e42ca0a5258a7f497c1a0bb1ab9c4b743de451c57b89645339b67536d7be  peer-a-probe.log
+8ed56e3da122ebc3cacf3550b9cc2e0b71df895968cddfd30e8047f485db24f7  peer-b-probe.log
+1c7068c0f0aa12e2eb6e4e6f59945b7b934bb38f12764380d6a8837c211c5a28  tests-a-on-b-core.log
+30f403cd24e448bec96767f0ff42efede99d74fc2f25a59ff8e4112f9a9b9f6f  tests-a-on-b-producer.log
+7fc384d85d9f48175b7920c292772a6607f73bd458f8b3a8a20767e56c2879d1  tests-b-on-a-core.log
+dacd3b67443223b400ce283883c20831cce1063211a3c22868477b5a28bcaec7  tests-b-on-a-producer.log
+71d59834355033a53db6311ed53fd735a948f53fc9ac914ae76fc6a9f022cf46  verify-all.log.gz