harness-everything 0.4.1 → 0.4.3

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.4.1",
+      "version": "0.4.3",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "author": {
     "name": "Miya Daniel"
   },

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.4.3](https://github.com/dyphn1/Harness-everything/compare/v0.4.2...v0.4.3) (2026-09-16)
+
+### Bug Fixes
+
+* **codex:** add PreToolUse attribution adapter ([9c54688](https://github.com/dyphn1/Harness-everything/commit/9c54688efc647bb34311dae57abe8766567daf5b))
+* **codex:** package PreToolUse attribution adapter ([93cb459](https://github.com/dyphn1/Harness-everything/commit/93cb4592f2b3f1ebfbed71882dd0f25579b0b469))
+* **codex:** route PreToolUse through attribution adapter ([0ac9221](https://github.com/dyphn1/Harness-everything/commit/0ac922111912813635e9fbc747f7aaa22666bc94))
+
+## [0.4.2](https://github.com/dyphn1/Harness-everything/compare/v0.4.1...v0.4.2) (2026-09-16)
+
 ## [0.4.1](https://github.com/dyphn1/Harness-everything/compare/v0.4.0...v0.4.1) (2026-09-16)
 
 ## [0.4.0](https://github.com/dyphn1/Harness-everything/compare/v0.3.6...v0.4.0) (2026-09-16)

package/ci/action-gate.test.js

@@ -238,7 +238,7 @@ try {
 
   const pluginHooks = JSON.parse(fs.readFileSync(path.join(ROOT, 'plugins', 'harness-everything', 'hooks', 'hooks.json'), 'utf8'));
   const pluginPre = pluginHooks.hooks.PreToolUse.find(group => group.matcher === 'Bash|apply_patch');
-  check(pluginPre && pluginPre.hooks.some(hook => /action-gate\.js/.test(hook.command)), 'OpenAI plugin wires action-gate to Bash|apply_patch');
+  check(pluginPre && pluginPre.hooks.some(hook => /codex-action-gate-pre\.js/.test(hook.command)), 'OpenAI plugin wires the attribution-aware Codex action-gate adapter to Bash|apply_patch');
   check(!Object.prototype.hasOwnProperty.call(pluginHooks.hooks, 'PostToolUseFailure'), 'Codex plugin does not declare unsupported PostToolUseFailure lifecycle event');
   const pluginPost = pluginHooks.hooks.PostToolUse.find(group => group.matcher === 'Bash|apply_patch');
   check(pluginPost && pluginPost.hooks.some(hook => /codex-action-gate-post\.js/.test(hook.command)), 'Codex plugin infers action-gate outcome from supported PostToolUse');

package/ci/mechanism-2aa-codex-action-gate-policy.test.js

@@ -8,10 +8,13 @@ const path = require('path');
 
 const ROOT = path.resolve(__dirname, '..');
 const actionGate = require(path.join(ROOT, 'hooks', 'scripts', 'action-gate.js'));
+const preAdapter = require(path.join(ROOT, 'hooks', 'scripts', 'codex-action-gate-pre.js'));
 const permissionRequest = require(path.join(ROOT, 'hooks', 'scripts', 'codex-permission-request.js'));
 
 const pluginRoot = path.join(ROOT, 'plugins', 'harness-everything');
 const pluginHooksPath = path.join(pluginRoot, 'hooks', 'hooks.json');
+const canonicalPre = path.join(ROOT, 'hooks', 'scripts', 'codex-action-gate-pre.js');
+const packagedPre = path.join(pluginRoot, 'hooks', 'scripts', 'codex-action-gate-pre.js');
 const canonicalPost = path.join(ROOT, 'hooks', 'scripts', 'codex-action-gate-post.js');
 const packagedPost = path.join(pluginRoot, 'hooks', 'scripts', 'codex-action-gate-post.js');
 const canonicalPermission = path.join(ROOT, 'hooks', 'scripts', 'codex-permission-request.js');
@@ -49,9 +52,14 @@ function commandPaths(hooks) {
 
 const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-codex-policy-'));
 const sessionDir = path.join(tempRoot, 'session');
+const attributionDir = path.join(tempRoot, 'attribution');
 fs.mkdirSync(sessionDir, { recursive: true });
 
 try {
+  assert.ok(fs.existsSync(canonicalPre), 'Codex PreToolUse adapter must live in canonical hooks/scripts');
+  assert.ok(fs.existsSync(packagedPre), 'Codex PreToolUse adapter must be packaged');
+  assert.strictEqual(fs.readFileSync(canonicalPre, 'utf8'), fs.readFileSync(packagedPre, 'utf8'), 'canonical and packaged Codex PreToolUse adapters must be byte-equivalent');
+
   assert.ok(fs.existsSync(canonicalPost), 'Codex PostToolUse adapter must live in canonical hooks/scripts so plugin:sync cannot delete it');
   assert.ok(fs.existsSync(packagedPost), 'Codex PostToolUse adapter must be packaged');
   assert.strictEqual(fs.readFileSync(canonicalPost, 'utf8'), fs.readFileSync(packagedPost, 'utf8'), 'canonical and packaged Codex PostToolUse adapters must be byte-equivalent');
@@ -63,6 +71,8 @@ try {
   const hookConfig = JSON.parse(fs.readFileSync(pluginHooksPath, 'utf8'));
   assert.ok(Array.isArray(hookConfig.hooks.PermissionRequest), 'Codex plugin must declare PermissionRequest');
   assert.ok(!Object.prototype.hasOwnProperty.call(hookConfig.hooks, 'PostToolUseFailure'), 'Codex plugin must not invent PostToolUseFailure');
+  const preCommands = hookConfig.hooks.PreToolUse.flatMap(group => (group.hooks || []).map(hook => hook.command || ''));
+  assert.ok(preCommands.some(command => command.includes('codex-action-gate-pre.js')), 'Codex PreToolUse must invoke the attribution-aware action-gate adapter');
   const permissionCommands = hookConfig.hooks.PermissionRequest.flatMap(group => (group.hooks || []).map(hook => hook.command || ''));
   assert.ok(permissionCommands.some(command => command.includes('codex-permission-request.js')), 'PermissionRequest must invoke the native approval observer');
 
@@ -78,6 +88,59 @@ try {
   assert.strictEqual(pre.stdout, null, 'Codex PreToolUse must never emit permissionDecision=ask');
   assert.ok(pre.stderr.includes('git-force-push'), 'Codex block reason must identify the matched rule');
 
+  const attributedSafe = preAdapter.processPayload(payload('git status --short', {
+    toolUseId: 'codex-attribution-safe',
+    turnId: 'turn_attribution_user',
+  }), {
+    host: 'codex',
+    sessionDir,
+    ruleTable: table,
+    attributionDir,
+    runNonce: 'reviewer-user',
+  });
+  assert.strictEqual(attributedSafe.kind, 'allow', 'attribution must not change an otherwise-safe action-gate result');
+  assert.strictEqual(attributedSafe.attribution.enabled, true, 'explicit attribution mode must write hook-entry evidence');
+  assert.ok(attributedSafe.attribution.file && fs.existsSync(attributedSafe.attribution.file), 'hook-entry attribution artifact must exist');
+  const attribution = JSON.parse(fs.readFileSync(attributedSafe.attribution.file, 'utf8'));
+  assert.strictEqual(attribution.eventKind, 'codex-pretooluse-enter');
+  assert.strictEqual(attribution.detectedHost, 'codex');
+  assert.strictEqual(attribution.toolName, 'Bash');
+  assert.strictEqual(attribution.toolUseId, 'codex-attribution-safe');
+  assert.strictEqual(attribution.turnId, 'turn_attribution_user');
+  assert.strictEqual(attribution.runNonce, 'reviewer-user');
+  assert.strictEqual(attribution.payloadHash, actionGate.hashExact('git status --short'));
+  assert.ok(!Object.prototype.hasOwnProperty.call(attribution, 'command'), 'attribution evidence must not persist raw command text');
+  assert.ok(!Object.prototype.hasOwnProperty.call(attribution, 'toolInput'), 'attribution evidence must not persist raw tool input');
+  assert.ok(!Object.prototype.hasOwnProperty.call(attribution, 'cwd'), 'attribution evidence must not persist the working directory');
+
+  const attributedBlock = preAdapter.processPayload(payload('git push --force origin main', {
+    toolUseId: 'codex-attribution-block',
+    turnId: 'turn_attribution_auto_review',
+  }), {
+    host: 'codex',
+    sessionDir,
+    ruleTable: table,
+    attributionDir,
+    runNonce: 'reviewer-auto-review',
+  });
+  assert.strictEqual(attributedBlock.kind, 'block', 'attribution must not weaken the Codex hard-block fallback');
+  assert.strictEqual(attributedBlock.exitCode, 2);
+  assert.ok(attributedBlock.attribution.file && fs.existsSync(attributedBlock.attribution.file), 'destructive hook entry must be attributable before the block result');
+
+  const blockedParent = path.join(tempRoot, 'not-a-directory');
+  fs.writeFileSync(blockedParent, 'fixture', 'utf8');
+  const failedAttribution = preAdapter.processPayload(payload('git push --force origin main', {
+    toolUseId: 'codex-attribution-write-failure',
+  }), {
+    host: 'codex',
+    sessionDir,
+    ruleTable: table,
+    attributionDir: path.join(blockedParent, 'child'),
+  });
+  assert.strictEqual(failedAttribution.kind, 'block', 'attribution write failure must never authorize a destructive action');
+  assert.strictEqual(failedAttribution.exitCode, 2);
+  assert.ok(failedAttribution.attribution.error, 'diagnostic write failure should be observable to deterministic tests');
+
   const approvalPayload = payload('git push --force origin main', {
     event: 'PermissionRequest',
     toolUseId: undefined,
@@ -111,7 +174,7 @@ try {
   assert.strictEqual(error.stdout, null, 'PermissionRequest audit failure must not emit allow/deny/ask');
   assert.ok(/Native Codex approval flow remains authoritative/.test(error.stderr));
 
-  console.log('PASS: Codex action-gate uses supported hard blocking plus non-authorizing native PermissionRequest observation.');
+  console.log('PASS: Codex action-gate uses supported hard blocking, attributable PreToolUse entry evidence, and non-authorizing PermissionRequest observation.');
 } finally {
   fs.rmSync(tempRoot, { recursive: true, force: true });
 }

package/ci/mechanism-2ab-openai-plugin-sync-integrity.test.js

@@ -71,6 +71,7 @@ try {
     assert.ok(fs.existsSync(path.join(pluginRoot, relative)), `sync must preserve every hook target: ${relative}`);
   }
 
+  assert.ok(fs.existsSync(path.join(pluginRoot, 'hooks', 'scripts', 'codex-action-gate-pre.js')), 'sync must preserve the Codex PreToolUse adapter');
   assert.ok(fs.existsSync(path.join(pluginRoot, 'hooks', 'scripts', 'codex-action-gate-post.js')), 'sync must preserve the Codex PostToolUse adapter');
   assert.ok(fs.existsSync(path.join(pluginRoot, 'hooks', 'scripts', 'codex-permission-request.js')), 'sync must preserve the Codex PermissionRequest adapter');
 

package/ci/mechanism-2u-issue-44.test.js

@@ -1,32 +1,38 @@
 const fs = require('fs');
 const path = require('path');
 const helper = require('./test-helper');
+const { isStableSemVer } = require('../scripts/sync-release-version');
 
 console.log('\n[2u] Issue #44 release metadata regression checks...');
 
-const packageJson = JSON.parse(fs.readFileSync(path.join(helper.root, 'package.json'), 'utf8'));
 const skillText = name => fs.readFileSync(path.join(helper.root, name, 'SKILL.md'), 'utf8');
 const versionOf = text => {
   const match = text.match(/^  version:\s*(\S+)$/m);
   return match && match[1];
 };
 
+// Skill metadata records the release in which that skill last changed; it is
+// intentionally not required to equal the current package version. The
+// changed-skill bump policy itself is exercised dynamically by
+// mechanism-2x-release-automation.test.js.
+const fableVersion = versionOf(skillText('fable-mode'));
 helper.check(
-  '2u. modified fable-mode skill uses the released package version',
-  versionOf(skillText('fable-mode')) === packageJson.version,
-  `fable-mode=${versionOf(skillText('fable-mode'))}, package=${packageJson.version}`
+  '2u. fable-mode carries stable release metadata',
+  isStableSemVer(fableVersion),
+  `fable-mode=${fableVersion}`
 );
 for (const nested of ['execution-guardrails', 'fable-haiku', 'fable-opus', 'fable-sonnet']) {
   helper.check(
     `2u. fable-mode/${nested} inherits the parent version`,
-    versionOf(skillText(path.join('fable-mode', nested))) === versionOf(skillText('fable-mode')),
-    `${nested}=${versionOf(skillText(path.join('fable-mode', nested)))}, parent=${versionOf(skillText('fable-mode'))}`
+    versionOf(skillText(path.join('fable-mode', nested))) === fableVersion,
+    `${nested}=${versionOf(skillText(path.join('fable-mode', nested)))}, parent=${fableVersion}`
   );
 }
+const todoVersion = versionOf(skillText('todo-driven-workflow'));
 helper.check(
-  '2u. modified todo-driven-workflow skill uses the released package version',
-  versionOf(skillText('todo-driven-workflow')) === packageJson.version,
-  `todo-driven-workflow=${versionOf(skillText('todo-driven-workflow'))}, package=${packageJson.version}`
+  '2u. todo-driven-workflow carries stable release metadata',
+  isStableSemVer(todoVersion),
+  `todo-driven-workflow=${todoVersion}`
 );
 
 const changelog = fs.readFileSync(path.join(helper.root, 'CHANGELOG.md'), 'utf8');

package/ci/repository-contract.test.js

@@ -2,16 +2,26 @@
 'use strict';
 
 const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
 const { collectContract, renderContractMarkdown, validateContract } = require('../scripts/repository-contract');
 
 const contract = collectContract();
 const failures = validateContract(contract);
 assert.deepStrictEqual(failures, [], `Repository contract drift:\n- ${failures.join('\n- ')}`);
 
+const packageJson = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8'));
+const packageLock = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'package-lock.json'), 'utf8'));
+assert.strictEqual(
+  packageLock.packages?.['']?.engines?.node,
+  packageJson.engines?.node,
+  'package-lock.json root engines.node must mirror package.json engines.node; run npm install --package-lock-only after changing the Node runtime contract',
+);
+
 const rendered = renderContractMarkdown(contract);
 assert.match(rendered, /Minimum supported Node\.js/);
 assert.match(rendered, /GitHub Actions runtime majors/);
 assert.ok(contract.ci.qualityGates.includes('test:consistency'), 'CI contract must expose test:consistency');
 assert.ok(contract.behavioralEvals.scheduled, 'Behavioral eval schedule must remain visible to the contract');
 
-console.log('Repository contract verified: runtime, workflows, action majors, schedule, gates, and generated docs are synchronized.');
+console.log('Repository contract verified: runtime, lockfile, workflows, action majors, schedule, gates, and generated docs are synchronized.');

package/docs/codex-action-gate.md

@@ -4,23 +4,52 @@ This document records the Codex-specific action-gate contract. It intentionally
 
 ## Current official capability boundary
 
-Harness treats the current Codex hooks documentation as the release-behavior contract.
+Harness treats the current Codex hooks documentation as the release-behavior contract. Non-managed command hooks must be reviewed/trusted before they run, so plugin installed/enabled state alone is not live-hook evidence.
 
 ### PreToolUse
 
 For Codex, Harness may safely block a covered local tool call with a supported deny/block result or exit code 2. Harness must not emit `permissionDecision: "ask"`: Codex currently parses that value but does not support it as an authorization decision, so relying on it would be fail-open.
 
+The documented Codex `PreToolUse` payload includes `session_id`, `turn_id`, `tool_name`, `tool_use_id`, `tool_input`, and the current permission mode. Harness uses the stable identifiers only for audit/attribution and never treats them as authorization.
+
 The packaged action gate therefore keeps the existing fail-closed behavior for a destructive rule match:
 
 ```text
 covered local tool
-    -> PreToolUse
+    -> codex-action-gate-pre.js
+    -> PreToolUse attribution (only when explicitly enabled)
+    -> action-gate.js classifier
     -> Harness destructive rule match
     -> exit 2 / block
 ```
 
 An internal failure in this pre-action path also remains fail-closed.
 
+### Live PreToolUse attribution probe
+
+`codex-action-gate-pre.js` is a Codex-specific adapter around the shared action-gate core. Its attribution mode is disabled by default and does not change authorization semantics.
+
+Enable it only for live verification by setting:
+
+```text
+HARNESS_ACTION_GATE_ATTRIBUTION_DIR=<known output directory>
+HARNESS_ACTION_GATE_RUN_NONCE=<optional test-run label>
+```
+
+When the `PreToolUse` entry point actually runs, the adapter writes a small JSON artifact containing:
+
+- event kind (`codex-pretooluse-enter`);
+- timestamp;
+- detected host;
+- session / turn / tool-use identifiers when available;
+- tool name and permission mode;
+- SHA-256 of the exact tool payload;
+- optional run nonce.
+
+The artifact does **not** persist the raw command/tool input, working directory, or transcript path. If diagnostic writing fails, the adapter still delegates to the normal action-gate result; attribution failure cannot convert a destructive block into authorization.
+
+For the #110 live matrix, compare at least `approvals_reviewer = "user"` and `approvals_reviewer = "auto_review"` with distinct run nonces. A persisted entry artifact proves that the Codex PreToolUse adapter was launched for that invocation; the resulting action-gate exit/output still determines the Harness disposition.
+
 ### PermissionRequest
 
 Codex exposes a separate `PermissionRequest` lifecycle event when Codex is already going to request approval. A PermissionRequest hook can refine that request, but the event is not a mechanism for manufacturing an approval prompt for an otherwise permitted command.
@@ -41,9 +70,15 @@ Codex uses the documented `PostToolUse` lifecycle for completion evidence, inclu
 
 `codex-action-gate-post.js` is kept in canonical `hooks/scripts/` and copied into the plugin package by `sync-openai-plugin.js`. This prevents a package sync from deleting the Codex-only adapter.
 
+## Approval reviewer boundary
+
+`approvals_reviewer = "auto_review"` changes who reviews **eligible approval requests**. The official configuration reference explicitly says it does not change sandboxing or actions already allowed inside the sandbox. The reviewer only sees actions that already need approval.
+
+Therefore a command that executes under `auto_review` is not, by itself, evidence that the Harness action-gate was bypassed. First preserve the PreToolUse attribution artifact and determine whether the Harness hook actually fired for that invocation.
+
 ## Native execpolicy prompt rules
 
-Codex rules/execpolicy can express native `prompt` decisions for command prefixes. That is a promising native confirmation path, but Harness does not automatically install or bundle those rules yet.
+Codex rules/execpolicy can express native `prompt` decisions for command prefixes. The current Rules documentation describes this mechanism as controlling commands Codex may run **outside the sandbox**, and the feature remains experimental. That is a promising native confirmation path, but Harness does not automatically install or bundle those rules yet.
 
 Reasons:
 
@@ -68,6 +103,7 @@ A future change may delegate selected destructive rules to Codex-native promptin
 The evidence must distinguish:
 
 ```text
+Harness PreToolUse entry attribution
 Harness PreToolUse block
 Codex execpolicy/native prompt
 PermissionRequest defer/allow/deny
@@ -78,7 +114,7 @@ Package and mechanism tests must not be promoted to `Live verified` in the compa
 
 ## Tool coverage
 
-Current Harness PreToolUse enforcement remains wired to the tool set explicitly covered by the package (`Bash|apply_patch`). Codex hooks can cover additional local function/MCP tools, but those tools must not be claimed as action-gated until Harness has a safe classifier/rule representation for their structured inputs. Hosted or specialized tool paths may have different hook behavior and remain outside this guarantee unless separately verified.
+Current Harness PreToolUse enforcement remains wired to the tool set explicitly covered by the package (`Bash|apply_patch`). Codex hooks can cover additional local function/MCP tools, but those tools must not be claimed as action-gated until Harness has a safe classifier/rule representation for their structured inputs. Hosted tools do not use the local function-tool hook path, and specialized tool paths may opt out; Codex documents tool hooks as a useful guardrail rather than a complete enforcement boundary.
 
 ## References
 

package/hooks/scripts/codex-action-gate-pre.js

@@ -0,0 +1,141 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const actionGate = require('./action-gate');
+
+const ATTRIBUTION_DIR_ENV = 'HARNESS_ACTION_GATE_ATTRIBUTION_DIR';
+const ATTRIBUTION_NONCE_ENV = 'HARNESS_ACTION_GATE_RUN_NONCE';
+const EVENT_KIND = 'codex-pretooluse-enter';
+
+function textOrNull(value, maxLength = 200) {
+  if (value === undefined || value === null || value === '') return null;
+  return String(value).slice(0, maxLength);
+}
+
+function attributionDirectory(options = {}) {
+  return options.attributionDir || process.env[ATTRIBUTION_DIR_ENV] || null;
+}
+
+function attributionRecord(payload, options = {}) {
+  let detectedHost = 'unknown';
+  try { detectedHost = actionGate.detectHost(payload, options.host); } catch (_) { /* diagnostic only */ }
+
+  return {
+    schemaVersion: 1,
+    eventKind: EVENT_KIND,
+    observedAt: new Date().toISOString(),
+    hookEventName: actionGate.hookEventOf(payload),
+    detectedHost,
+    sessionId: textOrNull(payload && (payload.session_id || payload.sessionId)),
+    turnId: textOrNull(payload && (payload.turn_id || payload.turnId)),
+    toolUseId: textOrNull(payload && (payload.tool_use_id || payload.toolUseId)),
+    toolName: textOrNull(payload && (payload.tool_name || payload.toolName)),
+    permissionMode: textOrNull(payload && (payload.permission_mode || payload.permissionMode)),
+    payloadHash: actionGate.hashExact(actionGate.exactPayloadText(payload)),
+    runNonce: textOrNull(options.runNonce || process.env[ATTRIBUTION_NONCE_ENV]),
+  };
+}
+
+function safeFileToken(value) {
+  return String(value || 'event').replace(/[^A-Za-z0-9._-]+/g, '_').slice(0, 120) || 'event';
+}
+
+function writeAttribution(payload, options = {}) {
+  const dir = attributionDirectory(options);
+  if (!dir) return { enabled: false, file: null, record: null, error: null };
+
+  const record = attributionRecord(payload, options);
+  const key = record.toolUseId || record.turnId || record.payloadHash.slice(0, 20);
+  const file = path.join(dir, `${Date.now()}-${process.pid}-${safeFileToken(key)}.json`);
+  const temp = `${file}.${process.pid}.tmp`;
+
+  try {
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(temp, `${JSON.stringify(record, null, 2)}\n`, 'utf8');
+    fs.renameSync(temp, file);
+    return { enabled: true, file, record, error: null };
+  } catch (err) {
+    try { if (fs.existsSync(temp)) fs.rmSync(temp, { force: true }); } catch (_) { /* best effort */ }
+    return {
+      enabled: true,
+      file: null,
+      record,
+      error: err && err.message ? err.message : String(err),
+    };
+  }
+}
+
+function processPayload(payload, options = {}) {
+  // Attribution is deliberately diagnostic-only. A write failure cannot turn a
+  // Harness decision into allow, deny, or ask; the action-gate remains the sole
+  // authorization path for this hook invocation.
+  const attribution = writeAttribution(payload, options);
+  let result;
+  try {
+    result = actionGate.processEvent(payload, options);
+  } catch (err) {
+    result = actionGate.internalErrorDecision(payload, err, options);
+  }
+  return { ...result, attribution };
+}
+
+function emitResult(result) {
+  if (result.stderr) console.error(result.stderr);
+  if (result.stdout) process.stdout.write(`${JSON.stringify(result.stdout)}\n`);
+  return result.exitCode || 0;
+}
+
+function runPayload(payload) {
+  return emitResult(processPayload(payload));
+}
+
+function setExitCodeIfDefined(code) {
+  if (Number.isInteger(code)) process.exitCode = code;
+}
+
+function readStdinAndRun() {
+  if (process.stdin.isTTY) return runPayload(null);
+  let raw = '';
+  let finished = false;
+  const finish = () => {
+    if (finished) return undefined;
+    finished = true;
+    let payload = {};
+    try { payload = JSON.parse(raw || '{}'); } catch (err) {
+      return emitResult(actionGate.internalErrorDecision({}, new Error(`invalid hook JSON: ${err.message}`)));
+    }
+    return runPayload(payload);
+  };
+
+  const timeoutMsRaw = Number(process.env.HARNESS_ACTION_GATE_STDIN_TIMEOUT_MS);
+  const timeoutMs = Number.isFinite(timeoutMsRaw) && timeoutMsRaw > 0 ? timeoutMsRaw : 500;
+  const timer = setTimeout(() => setExitCodeIfDefined(finish()), timeoutMs);
+  process.stdin.setEncoding('utf8');
+  process.stdin.on('data', chunk => { raw += chunk; });
+  process.stdin.on('end', () => {
+    clearTimeout(timer);
+    setExitCodeIfDefined(finish());
+  });
+  process.stdin.on('error', err => {
+    clearTimeout(timer);
+    setExitCodeIfDefined(emitResult(actionGate.internalErrorDecision({}, err)));
+  });
+  return 0;
+}
+
+if (require.main === module) {
+  setExitCodeIfDefined(readStdinAndRun());
+}
+
+module.exports = {
+  ATTRIBUTION_DIR_ENV,
+  ATTRIBUTION_NONCE_ENV,
+  EVENT_KIND,
+  attributionDirectory,
+  attributionRecord,
+  processPayload,
+  readStdinAndRun,
+  writeAttribution,
+};

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/hooks/hooks.json

@@ -36,8 +36,8 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"$PLUGIN_ROOT/hooks/scripts/action-gate.js\"",
-            "commandWindows": "node \"%PLUGIN_ROOT%\\hooks\\scripts\\action-gate.js\"",
+            "command": "node \"$PLUGIN_ROOT/hooks/scripts/codex-action-gate-pre.js\"",
+            "commandWindows": "node \"%PLUGIN_ROOT%\\hooks\\scripts\\codex-action-gate-pre.js\"",
             "timeout": 15,
             "statusMessage": "Checking Harness pre-action approval gate"
           },

package/plugins/harness-everything/hooks/scripts/codex-action-gate-pre.js

@@ -0,0 +1,141 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const actionGate = require('./action-gate');
+
+const ATTRIBUTION_DIR_ENV = 'HARNESS_ACTION_GATE_ATTRIBUTION_DIR';
+const ATTRIBUTION_NONCE_ENV = 'HARNESS_ACTION_GATE_RUN_NONCE';
+const EVENT_KIND = 'codex-pretooluse-enter';
+
+function textOrNull(value, maxLength = 200) {
+  if (value === undefined || value === null || value === '') return null;
+  return String(value).slice(0, maxLength);
+}
+
+function attributionDirectory(options = {}) {
+  return options.attributionDir || process.env[ATTRIBUTION_DIR_ENV] || null;
+}
+
+function attributionRecord(payload, options = {}) {
+  let detectedHost = 'unknown';
+  try { detectedHost = actionGate.detectHost(payload, options.host); } catch (_) { /* diagnostic only */ }
+
+  return {
+    schemaVersion: 1,
+    eventKind: EVENT_KIND,
+    observedAt: new Date().toISOString(),
+    hookEventName: actionGate.hookEventOf(payload),
+    detectedHost,
+    sessionId: textOrNull(payload && (payload.session_id || payload.sessionId)),
+    turnId: textOrNull(payload && (payload.turn_id || payload.turnId)),
+    toolUseId: textOrNull(payload && (payload.tool_use_id || payload.toolUseId)),
+    toolName: textOrNull(payload && (payload.tool_name || payload.toolName)),
+    permissionMode: textOrNull(payload && (payload.permission_mode || payload.permissionMode)),
+    payloadHash: actionGate.hashExact(actionGate.exactPayloadText(payload)),
+    runNonce: textOrNull(options.runNonce || process.env[ATTRIBUTION_NONCE_ENV]),
+  };
+}
+
+function safeFileToken(value) {
+  return String(value || 'event').replace(/[^A-Za-z0-9._-]+/g, '_').slice(0, 120) || 'event';
+}
+
+function writeAttribution(payload, options = {}) {
+  const dir = attributionDirectory(options);
+  if (!dir) return { enabled: false, file: null, record: null, error: null };
+
+  const record = attributionRecord(payload, options);
+  const key = record.toolUseId || record.turnId || record.payloadHash.slice(0, 20);
+  const file = path.join(dir, `${Date.now()}-${process.pid}-${safeFileToken(key)}.json`);
+  const temp = `${file}.${process.pid}.tmp`;
+
+  try {
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(temp, `${JSON.stringify(record, null, 2)}\n`, 'utf8');
+    fs.renameSync(temp, file);
+    return { enabled: true, file, record, error: null };
+  } catch (err) {
+    try { if (fs.existsSync(temp)) fs.rmSync(temp, { force: true }); } catch (_) { /* best effort */ }
+    return {
+      enabled: true,
+      file: null,
+      record,
+      error: err && err.message ? err.message : String(err),
+    };
+  }
+}
+
+function processPayload(payload, options = {}) {
+  // Attribution is deliberately diagnostic-only. A write failure cannot turn a
+  // Harness decision into allow, deny, or ask; the action-gate remains the sole
+  // authorization path for this hook invocation.
+  const attribution = writeAttribution(payload, options);
+  let result;
+  try {
+    result = actionGate.processEvent(payload, options);
+  } catch (err) {
+    result = actionGate.internalErrorDecision(payload, err, options);
+  }
+  return { ...result, attribution };
+}
+
+function emitResult(result) {
+  if (result.stderr) console.error(result.stderr);
+  if (result.stdout) process.stdout.write(`${JSON.stringify(result.stdout)}\n`);
+  return result.exitCode || 0;
+}
+
+function runPayload(payload) {
+  return emitResult(processPayload(payload));
+}
+
+function setExitCodeIfDefined(code) {
+  if (Number.isInteger(code)) process.exitCode = code;
+}
+
+function readStdinAndRun() {
+  if (process.stdin.isTTY) return runPayload(null);
+  let raw = '';
+  let finished = false;
+  const finish = () => {
+    if (finished) return undefined;
+    finished = true;
+    let payload = {};
+    try { payload = JSON.parse(raw || '{}'); } catch (err) {
+      return emitResult(actionGate.internalErrorDecision({}, new Error(`invalid hook JSON: ${err.message}`)));
+    }
+    return runPayload(payload);
+  };
+
+  const timeoutMsRaw = Number(process.env.HARNESS_ACTION_GATE_STDIN_TIMEOUT_MS);
+  const timeoutMs = Number.isFinite(timeoutMsRaw) && timeoutMsRaw > 0 ? timeoutMsRaw : 500;
+  const timer = setTimeout(() => setExitCodeIfDefined(finish()), timeoutMs);
+  process.stdin.setEncoding('utf8');
+  process.stdin.on('data', chunk => { raw += chunk; });
+  process.stdin.on('end', () => {
+    clearTimeout(timer);
+    setExitCodeIfDefined(finish());
+  });
+  process.stdin.on('error', err => {
+    clearTimeout(timer);
+    setExitCodeIfDefined(emitResult(actionGate.internalErrorDecision({}, err)));
+  });
+  return 0;
+}
+
+if (require.main === module) {
+  setExitCodeIfDefined(readStdinAndRun());
+}
+
+module.exports = {
+  ATTRIBUTION_DIR_ENV,
+  ATTRIBUTION_NONCE_ENV,
+  EVENT_KIND,
+  attributionDirectory,
+  attributionRecord,
+  processPayload,
+  readStdinAndRun,
+  writeAttribution,
+};

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",