harness-everything 0.41.1 → 0.41.3

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.41.1",
+      "version": "0.41.3",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.41.1",
+  "version": "0.41.3",
   "author": {
     "name": "Miya Daniel"
   },

package/.github/workflows/ci.yml

@@ -36,9 +36,9 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7
         with:
-          node-version: '24.20.0'
+          node-version: '24.22.1'
       - name: Verify exact patched runtime
-        run: node -e "if (process.versions.node !== '24.20.0') process.exit(1)"
+        run: node -e "if (process.versions.node !== '24.22.1') process.exit(1)"
       - name: Exercise real evaluator subprocess and repeated resident teardown
         run: node --test ci/mechanism-system-one-resident.test.js
 

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.41.3](https://github.com/dyphn1/Harness-everything/compare/v0.41.2...v0.41.3) (2026-10-25)
+
+### Bug Fixes
+
+* **codex:** drop format-bound task approvals ([7125220](https://github.com/dyphn1/Harness-everything/commit/71252205e469cda13744a733ff2dca6bbff5db47))
+
+## [0.41.2](https://github.com/dyphn1/Harness-everything/compare/v0.41.1...v0.41.2) (2026-10-25)
+
+### Bug Fixes
+
+* **codex:** bind explicit action approvals ([eeec25c](https://github.com/dyphn1/Harness-everything/commit/eeec25c204bae89fa293e77a1d7de9e8f7135e13))
+
 ## [0.41.1](https://github.com/dyphn1/Harness-everything/compare/v0.41.0...v0.41.1) (2026-10-23)
 
 ### Bug Fixes

package/ci/action-gate.test.js

@@ -273,6 +273,30 @@ try {
   check(empty.degraded === false && empty.rules.length === 0, 'valid empty rule table does not silently activate built-in defaults');
   check(actionGate.evaluatePreToolUse(payload('git push --force origin main', { toolUseId: 'empty' }), { host: 'claude', sessionDir, ruleTable: empty }).kind === 'allow', 'empty-table mutation control disables detection, proving production non-empty assertion is meaningful');
 
+  // Independent full-input fingerprint regression: an own JSON __proto__ key must
+  // remain part of the structured payload digest (null-prototype stableValue fix).
+  const protoInput = JSON.parse('{"__proto__":{"changed":true},"record_id":"record-123"}');
+  const protoPayload = {
+    session_id: 'phase5-test',
+    hook_event_name: 'PreToolUse',
+    tool_name: 'mcp__demo__delete_record',
+    tool_use_id: 'proto-fingerprint',
+    tool_input: protoInput,
+    cwd: ROOT,
+  };
+  const basePayload = {
+    session_id: 'phase5-test',
+    hook_event_name: 'PreToolUse',
+    tool_name: 'mcp__demo__delete_record',
+    tool_use_id: 'proto-fingerprint',
+    tool_input: { record_id: 'record-123' },
+    cwd: ROOT,
+  };
+  const protoText = actionGate.exactPayloadText(protoPayload);
+  const baseText = actionGate.exactPayloadText(basePayload);
+  check(protoText.includes('__proto__'), 'null-prototype serialization preserves an own __proto__ key');
+  check(actionGate.hashExact(protoText) !== actionGate.hashExact(baseText), 'own __proto__ key changes the full-input digest');
+
   const execPayload = payload('npm publish', { toolUseId: 'exec-ok' });
   actionGate.evaluatePreToolUse(execPayload, { host: 'claude', sessionDir, ruleTable: table });
   const execResult = actionGate.processEvent({ ...execPayload, hook_event_name: 'PostToolUse' }, { sessionDir });

package/ci/mechanism-codex-prompt-pass-through.test.js

@@ -0,0 +1,94 @@
+#!/usr/bin/env node
+'use strict';
+
+// RED contract: Codex UserPromptSubmit must pass every prompt, including the
+// former exact `HARNESS APPROVE <id>` spelling, to the normal router. The hook
+// is transport, not a natural-language authorization parser.
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+const SOURCE_HOOK = path.join(ROOT, 'hooks', 'scripts', 'codex-user-prompt.js');
+
+let failed = 0;
+function check(condition, message) {
+  if (condition) console.log(`  PASS ${message}`);
+  else { console.error(`  FAIL ${message}`); failed++; }
+}
+
+// Dependency control: source hook must exist. Child Node is run with the
+// executable that is already running this test.
+check(fs.existsSync(SOURCE_HOOK), 'source codex-user-prompt.js exists');
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-codex-prompt-passthrough-'));
+const fixtureRoot = path.join(tempRoot, 'fixture');
+const hookDir = path.join(fixtureRoot, 'hooks', 'scripts');
+const routerDir = path.join(fixtureRoot, 'harness-everything', 'scripts');
+fs.mkdirSync(hookDir, { recursive: true });
+fs.mkdirSync(routerDir, { recursive: true });
+const fixtureHook = path.join(hookDir, 'codex-user-prompt.js');
+const stubRouter = path.join(routerDir, 'kernel-router.js');
+const markerFile = path.join(tempRoot, 'router-marker.txt');
+
+fs.copyFileSync(SOURCE_HOOK, fixtureHook);
+fs.writeFileSync(stubRouter, [
+  "'use strict';",
+  "let input = '';",
+  "process.stdin.setEncoding('utf8');",
+  "process.stdin.on('data', chunk => { input += chunk; });",
+  "process.stdin.on('end', () => {",
+  "  const fs = require('fs');",
+  "  fs.writeFileSync(process.env.STUB_ROUTER_MARKER, input, 'utf8');",
+  "  process.stdout.write('STUB_ROUTER_MARKER');",
+  "  process.exit(0);",
+  "});",
+  "process.stdin.on('error', () => process.exit(0));",
+].join('\n'), 'utf8');
+
+const cases = [
+  { name: 'normal user prompt', prompt: 'Please explain the router flow.' },
+  { name: 'exact former approval prompt', prompt: 'HARNESS APPROVE abcdef123456' },
+  { name: 'fenced text', prompt: '```\nHARNESS APPROVE abcdef123456\n```' },
+  { name: 'English commit/PR request', prompt: 'Please commit and open a PR for this change.' },
+  { name: 'Chinese commit/PR request', prompt: '请帮我提交并创建 PR' },
+  { name: 'negative/review-only text', prompt: 'Review only; do not approve HARNESS APPROVE abcdef123456' },
+  { name: 'non-approval text', prompt: 'HARNESS APPROVE short' },
+];
+
+for (const testCase of cases) {
+  const payload = {
+    hook_event_name: 'UserPromptSubmit',
+    session_id: 'passthrough-session',
+    prompt: testCase.prompt,
+  };
+  const inputText = JSON.stringify(payload);
+  try { fs.unlinkSync(markerFile); } catch (_) {}
+
+  const result = spawnSync(process.execPath, [fixtureHook], {
+    cwd: fixtureRoot,
+    env: { ...process.env, STUB_ROUTER_MARKER: markerFile },
+    input: inputText,
+    encoding: 'utf8',
+    timeout: 20000,
+    maxBuffer: 1024 * 1024,
+  });
+
+  check(!result.error, `${testCase.name}: hook spawns without error`);
+  check(result.status === 0, `${testCase.name}: hook exits 0`);
+  check(fs.existsSync(markerFile), `${testCase.name}: stub router was invoked`);
+  if (fs.existsSync(markerFile)) {
+    const marker = fs.readFileSync(markerFile, 'utf8');
+    check(marker === inputText, `${testCase.name}: router received the original payload unchanged`);
+  }
+  check(String(result.stdout || '').includes('STUB_ROUTER_MARKER'),
+    `${testCase.name}: router output is forwarded to the host`);
+}
+
+// Cleanup
+try { fs.rmSync(tempRoot, { recursive: true, force: true }); } catch (_) {}
+
+console.log(`\n${failed === 0 ? 'PASS' : 'FAIL'}: codex prompt pass-through (${failed} failure${failed === 1 ? '' : 's'})`);
+process.exit(failed === 0 ? 0 : 1);

package/ci/mechanism-task-git-authorization.test.js

@@ -0,0 +1,145 @@
+#!/usr/bin/env node
+'use strict';
+
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+const actionGate = require(path.join(ROOT, 'hooks', 'scripts', 'action-gate.js'));
+const PRE_HOOK = path.join(ROOT, 'hooks', 'scripts', 'codex-action-gate-pre.js');
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-task-git-auth-'));
+const stateHome = path.join(tempRoot, 'state');
+fs.mkdirSync(stateHome, { recursive: true });
+
+const env = {
+  ...process.env,
+  HARNESS_ACTION_GATE_HOST: 'codex',
+  HARNESS_STATE_HOME: stateHome,
+  HARNESS_ACTION_GATE_STDIN_TIMEOUT_MS: '2000',
+};
+
+function run(payload) {
+  const result = spawnSync(process.execPath, [PRE_HOOK], {
+    cwd: tempRoot,
+    env,
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    timeout: 20000,
+    maxBuffer: 1024 * 1024,
+  });
+  assert.ifError(result.error);
+  return result;
+}
+
+function payload(toolName, toolInput, extra = {}) {
+  return {
+    hook_event_name: 'PreToolUse',
+    session_id: 'task-git-auth-codex-session',
+    turn_id: 'turn-task-git-auth',
+    tool_use_id: `call-${Math.random().toString(16).slice(2)}`,
+    tool_name: toolName,
+    tool_input: toolInput,
+    permission_mode: 'default',
+    cwd: tempRoot,
+    ...extra,
+  };
+}
+
+const actualPrPayload = payload('mcp__codex_apps__github__create_pull_request', {
+  repository_full_name: 'openai/codex',
+  base: 'main',
+  head: 'feature/task-authorization',
+  title: 'Phase complete PR',
+  body: '## Summary\n\nPhase complete PR created after task authorization.',
+  draft: true,
+});
+
+try {
+  assert.ok(fs.existsSync(PRE_HOOK), 'Codex PreToolUse entrypoint must exist');
+
+  // Read control on the real Codex path.
+  const readResult = run(payload('mcp__demo__get_pull_request', { pull_request: 1 }));
+  assert.strictEqual(readResult.status, 0, 'read-only structured action must pass on Codex');
+  assert.strictEqual(String(readResult.stdout || '').trim(), '', 'read control must not emit a Harness permission decision');
+
+  // Dangerous controls remain hard Codex blocks.
+  for (const [toolName, toolInput] of [
+    ['mcp__demo__merge_pull_request', { id: 'target' }],
+    ['mcp__demo__delete_pull_request', { id: 'target' }],
+    ['mcp__demo__deploy_release', { id: 'target' }],
+    ['mcp__demo__publish_package', { id: 'target' }],
+    ['mcp__demo__send_message', { id: 'target' }],
+  ]) {
+    const result = run(payload(toolName, toolInput));
+    assert.strictEqual(result.status, 2, `${toolName} must remain a Codex block`);
+  }
+  const forcePush = run(payload('Bash', { command: 'git push --force origin main' }));
+  assert.strictEqual(forcePush.status, 2, 'git push --force must remain a Codex block');
+
+  // Normal non-destructive commit keeps its existing ungated behavior.
+  const normalCommit = run(payload('Bash', { command: 'git commit -m "phase complete"' }));
+  assert.strictEqual(normalCommit.status, 0, 'normal git commit must remain ungated on Codex');
+
+  // Misleading names containing create_pull_request must not inherit the exemption.
+  for (const toolName of [
+    'mcp__demo__create_pull_request_and_delete',
+    'mcp__demo__delete_create_pull_request',
+    'mcp__demo__create_pull_requests',
+    'mcp__demo__foo_create_pull_request',
+  ]) {
+    const result = run(payload(toolName, { id: 'target' }));
+    assert.strictEqual(result.status, 2, `${toolName} must remain a Codex block`);
+  }
+
+  // Explicit required gate is carried in the supported payload hint shape
+  // (payload.workflowPlan.actionGate — the shape routerActionGateHint reads),
+  // not a made-up options API.
+  const requiredDecision = actionGate.evaluatePreToolUse({
+    ...actualPrPayload,
+    tool_use_id: 'call-required-gate-witness',
+    workflowPlan: { actionGate: { required: true, reasonCodes: ['external-side-effect'], disposition: 'pending-approval' } },
+  }, {
+    host: 'codex',
+    ruleTable: actionGate.loadRuleTable(path.join(ROOT, 'hooks', 'scripts', 'action-gate-rules.json')),
+  });
+  assert.strictEqual(requiredDecision.kind, 'block', 'required-gate PR must remain gated');
+  assert.strictEqual(requiredDecision.exitCode, 2, 'required-gate PR must remain a Codex block');
+  assert.ok(requiredDecision.rule, 'required-gate PR must match a gated rule');
+  assert.strictEqual(requiredDecision.rule.id, 'structured-mutate', 'required-gate PR must keep structured-mutate');
+
+  // Recognized PR creation is a routine host-deferred operation. Its descriptor
+  // stays a mutation; it is not read or safe, and it must not use Harness consent.
+  const descriptor = actionGate.normalizeActionDescriptor(actualPrPayload);
+  assert.strictEqual(descriptor.action, 'mutate', 'recognized PR creation must remain classified as a mutation');
+  assert.notStrictEqual(descriptor.classification, 'safe', 'recognized PR creation must not be safe/read');
+  const prResult = run(actualPrPayload);
+  assert.strictEqual(prResult.status, 0, 'recognized PR creation must be host-deferred on Codex (currently exits 2: RED)');
+  assert.strictEqual(String(prResult.stdout || '').trim(), '', 'recognized PR creation must not emit permissionDecision allow/ask');
+  assert.ok(!/HARNESS APPROVE/i.test(`${prResult.stdout || ''}\n${prResult.stderr || ''}`), 'recognized PR creation must not require a Harness approval phrase');
+
+  // Provider-neutral exact create_pull_request operation, if used, has the same contract.
+  const neutralResult = run(payload('mcp__demo__create_pull_request', {
+    repository: 'acme/harness',
+    head: 'feature/task-authorization',
+    base: 'main',
+    title: 'Phase complete PR',
+    body: 'Provider-neutral PR body.',
+  }));
+  assert.strictEqual(neutralResult.status, 0, 'exact create_pull_request operation must be host-deferred on Codex (currently exits 2: RED)');
+
+  // Genuine mutations remain blocked, but the fixed-format approval protocol is retired.
+  const legacyMutation = run(payload('mcp__demo__update_issue', { issue_id: 1, title: 'changed' }));
+  assert.strictEqual(legacyMutation.status, 2, 'genuine mutation must remain blocked on Codex');
+  assert.ok(!/HARNESS APPROVE/i.test(`${legacyMutation.stdout || ''}\n${legacyMutation.stderr || ''}`), 'genuine mutation must not expose the retired Harness approval phrase');
+
+  console.log('PASS: task git authorization Codex controls and host-deferred PR creation');
+} catch (err) {
+  console.error(err && err.stack ? err.stack : err);
+  process.exitCode = 1;
+} finally {
+  try { fs.rmSync(tempRoot, { recursive: true, force: true }); } catch (_) {}
+}

package/docs/codex-action-gate.md

@@ -124,3 +124,32 @@ Current Harness PreToolUse enforcement remains wired to the tool set explicitly
 - Codex configuration reference: https://developers.openai.com/codex/config-reference
 
 Related tracking: #82, #85, #98, #100, #109, #110.
+
+## Prompt handling and authorization
+
+Codex `UserPromptSubmit` prompts pass through to the normal router unchanged.
+Harness does not parse, bind, or intercept any fixed approval syntax in user
+prompts. Native agent task-scope authorization and native permissions remain
+authoritative.
+
+Routine exact `create_pull_request` operations are host-deferred (below). All
+other risky actions (merge/delete/deploy/publish/send/force-push and unrelated
+genuine mutations) remain hard PreToolUse blocks; an explicitly required
+`actionGate` hint still gates. These are deterministic mechanism changes, not
+live-host proof.
+
+## Routine task Git operations (host-deferred)
+
+Ordinary exact `create_pull_request` operations (including
+`mcp__codex_apps__github__create_pull_request` and provider-neutral
+`mcp__*__create_pull_request`) are host-deferred: Harness does not issue an
+additional challenge merely because the generic `create` heuristic classifies
+them as `mutate`. Their action descriptor stays `mutate` and non-safe; Harness
+does not pretend a write is a read or emit `permissionDecision` allow/ask.
+
+Native agent task-scope authorization and native permissions remain authoritative.
+An explicitly supplied required `actionGate` hint still gates the call. All other
+risky actions (merge/delete/deploy/publish/send/force-push and unrelated genuine
+mutations) remain gated; exact operation matching is used, with no substring
+exemption, so misleading names such as `create_pull_requests` or
+`foo_create_pull_request` still block.

package/docs/doc-workflow-reconciliation.md

@@ -5,13 +5,13 @@ status: active
 
 # Document workflow reconciliation — Phase 3b S1 runtime
 
-**Status: S1 runtime ships default OFF; opt in with `HARNESS_DOC_RECONCILIATION_PILOT=1`.
-S1 grants no positive document verification credit. S2/S3 are pending; E1 has not started.**
-This document refines the [document lifecycle contract](document-lifecycle.md#phase-3b--narrow-integration-contract-s1-shipped-default-off-positive-reconciliation-not-shipped).
+**Status: the runtime ships default OFF; opt in with `HARNESS_DOC_RECONCILIATION_PILOT=1`.
+With the pilot ON, F4 ([#358](https://github.com/dyphn1/Harness-everything/pull/358)) grants limited positive credit for exactly `doc-lint` and `link-check`, from a host-captured run of the installed doc-check on Claude Code 2.1.309 (live runs 4–5). S3 provider integration is pending; E1 has not started.**
+This document refines the [document lifecycle contract](document-lifecycle.md#phase-3b--narrow-integration-contract-s1-default-off-f4-limited-credit).
 The [accepted E0](https://github.com/dyphn1/Harness-everything/issues/341#issuecomment-6308604128)
 permits this limited, reversible consumer under the
 [owner's E0/E1 decision](https://github.com/dyphn1/Harness-everything/issues/325#issuecomment-6283237637).
-Current evidence establishes deterministic mechanism/package behavior, not live-host loading or E1 GO.
+Current evidence establishes deterministic mechanism/package behavior and bounded Claude Code 2.1.309 live credit runs; it is not E1 GO.
 
 ## Entry gates and ownership
 
@@ -336,12 +336,12 @@ Preparation assertion rows do not carry `reportOrigin`; the S1 runtime report ca
 marker is never presented as a production report.
 ## S1 — switch, trusted scope and fail-closed no-credit gate
 
-**S1 runtime ships default OFF (`HARNESS_DOC_RECONCILIATION_PILOT=1` opts in). It grants no positive document verification credit; S2/S3 are pending and E1 has not started.**
+**S1 runtime ships default OFF (`HARNESS_DOC_RECONCILIATION_PILOT=1` opts in). With the pilot ON, F4 (#358) grants limited positive credit for `doc-lint` and `link-check` only; S3 provider integration is pending and E1 has not started.**
 The [accepted E0](https://github.com/dyphn1/Harness-everything/issues/341#issuecomment-6308604128)
 permits this limited implementation; the [posted execution plan](https://github.com/dyphn1/Harness-everything/issues/325)
-orders Docs → RED → GREEN → independent review → green CI for each slice. S1 is a temporary
-negative-credit slice. S2 supplies trusted producer records, independent review provenance,
-positive reconciliation and freshness; only then can E1 observation begin. S3 adds optional
+orders Docs → RED → GREEN → independent review → green CI for each slice. S1 was the temporary
+negative-credit slice; F4 added the limited positive credit. The S2 requirements (trusted producer records, independent review provenance,
+positive reconciliation and freshness) gate E1 observation. S3 adds optional
 provider suggestions. None of these slices authorizes wider #320 integration.
 
 ### Switch and scope decision
@@ -1080,8 +1080,8 @@ provider, discovery execution, public checker change or new attestation service/
 ## Implementation and acceptance after E0
 
 S1 ships the default-OFF switch, narrow disposition/completion no-credit integration and runtime
-status reporting. S2's trusted producer, positive reconciliation and freshness remain pending;
-S3's optional provider adapter remains pending. Require every expected applicable MUST and
+status reporting. F4 adds limited positive reconciliation behind the same switch. S3's optional
+provider adapter remains pending. Require every expected applicable MUST and
 freshness check before positive credit, plus source/package compatibility, negative cases and
 relevant green CI including Windows. The S1 suites establish their tested mechanism/package
 contracts; they do not establish independent host provenance, live-host loading or architectural
@@ -1090,7 +1090,7 @@ remain separate gates.
 
 ## F4: credited reconciliation (Claude-only, pilot ON)
 
-Status: **implemented behind the pilot switch; mechanism and package evidence, plus one live field-availability capture.** Credit works for `doc-lint` and `link-check` (a registered `doc-check` run) and for an independent `quality-review` (a host reviewer with bound path digests). One live capture (Claude Code 2.1.308, macOS, one session) proves field availability, not live-host credit. There is no live-host credit run yet. Deterministic mechanism tests prove the chain. Design source: the A3 advisor report (`.worktrees/packets/feat-path/A3-advisor-report.md`, a local coordination file, not a shipped doc).
+Status: **implemented behind the pilot switch; mechanism and package evidence, plus live credit runs on Claude Code 2.1.309 (runs 4–5), which credited exactly `doc-lint` and `link-check`.** Mechanism tests cover credit for `doc-lint` and `link-check` (a registered `doc-check` run) and for an independent `quality-review` (a host reviewer with bound path digests). The earlier Claude Code 2.1.308 capture (macOS, one session) proves field availability only. Deterministic mechanism tests prove the chain. Design source: the A3 advisor report (`.worktrees/packets/feat-path/A3-advisor-report.md`, a local coordination file, not a shipped doc).
 
 ### Whole path
 
@@ -1200,8 +1200,8 @@ claude -p "<fixed capture prompt, containing the exact check command>" \
 ### Scope and limits
 
 - The first positive scope is a body-only edit to an existing governed reference, with no derived declaration, code, test, PRD or ADR normative change. Its applicable MUSTs are lint and links.
-- Simulated replay and one live field capture are not E1 GO, and they do not permit a wider rollout.
-- Not claimed: cryptographic attestation, a sandbox, a forced review provider, default-ON, live-host behaviour beyond the capture, or support for OpenCode or Codex.
+- Simulated replay and the recorded live credit runs are not E1 GO, and they do not permit a wider rollout.
+- Not claimed: cryptographic attestation, a sandbox, a forced review provider, default-ON, live-host behaviour beyond the recorded runs, or support for OpenCode or Codex.
 
 **Executor rationale.** The owner's text (#325, 2026-10-21) says the reviewer "must differ from the author's `session_id` and from every executor principal". An executor principal is the principal of execution evidence used in this assessment. A reviewer that read or computed digests with plain tool calls is not an executor. A reviewer whose registered doc-check run is refused still counts, which keeps the rule fail-closed.
 

package/docs/document-lifecycle.md

@@ -15,19 +15,21 @@ This table distinguishes merged mechanism code from end-to-end workflow integrat
 | 2 — roles, IDs, aliases, legacy, supersession, index, D6.9 PRD revisions | **Merged** in #327; do not rebuild this lifecycle logic for Phase 3 |
 | Step-type prerequisite (#326) | **Complete:** PR #328 merged; Harness-owned `doc-change` is explicitly declared, has no implicit TDD binding, and is not auto-inserted by router/System One |
 | 3a — document facts, obligations and evidence producer | **Merged** in #334: `harness-everything/scripts/doc-obligations.js` and `doc-evidence.js`. H3/H4 have *partial deterministic mechanism* coverage, not integrated workflow evidence. Known limitations: caller-attested envelope; `configDigest` presence-only; `candidateDigest` restricted to `docs/prd/`; missing independent task-scope binding. Deleted and old rename paths are bound to trusted per-path baseline evidence ([doc-evidence-baseline-binding.md](doc-evidence-baseline-binding.md), #335 fixed by #342), with workflow-disposition reconciliation left out of scope |
-| 3b — pilot-local provider suggestions and workflow evidence reconciliation | **S1 runtime ships default OFF** (opt in with `HARNESS_DOC_RECONCILIATION_PILOT=1`), with trusted scope assessment and fail-closed withholding; **no positive document verification credit**. See [S1 switch, trusted scope and no-credit contract](doc-workflow-reconciliation.md#s1--switch-trusted-scope-and-fail-closed-no-credit-gate). **S3 pure advisory provider suggestions shipped in 0.37.0 (not wired); S2 trusted producer/positive reconciliation/freshness is pending; E1 has not started.** Accepted #341 E0 permits this limited reversible consumer. Current evidence is deterministic mechanism/package coverage, not live-host loading or E1 GO; preserve existing required-binding compatibility |
+| 3b — pilot-local provider suggestions and workflow evidence reconciliation | **S1 runtime ships default OFF** (opt in with `HARNESS_DOC_RECONCILIATION_PILOT=1`), with trusted scope assessment and fail-closed withholding. **F4 (#358) adds limited positive credit** for exactly `doc-lint` and `link-check` from a host-captured run of the installed doc-check (Claude Code only; live runs on 2.1.309). See [S1 switch, trusted scope and no-credit contract](doc-workflow-reconciliation.md#s1--switch-trusted-scope-and-fail-closed-no-credit-gate). S3 pure advisory provider suggestions shipped in 0.37.0 (not wired); E1 has not started. Accepted #341 E0 permits this limited reversible consumer; the live runs are not E1 GO; preserve existing required-binding compatibility |
 | 3c — H1–H4 and paired-task evaluation | **Not started.** Mechanism tests alone are insufficient for architecture promotion; compare frozen baseline and treatment on real bounded tasks, success/failure first, then conditional cost and latency |
-| 1b — shared documentation craft and family metadata | **Splittable.** Shared references and thin skill consumers can proceed independently. A small optional logical-family metadata seam may be piloted; physical skill directory moves remain blocked on #320 identity/path separation |
-| 4 — derived-view generators and `describes:` drift | **Not started.** Preserve generator authorization, deterministic regenerate-equals and scoped reminder semantics |
+| 1b — shared documentation craft and family metadata | **Shared craft delivered** in F2 (#356): shared references with thin skill consumers. Family metadata is not established. A small optional logical-family metadata seam may be piloted; physical skill directory moves remain blocked on #320 identity/path separation |
+| 4 — derived-view generators and `describes:` drift | **Regenerate-equals delivered** in F3 (#357) for authorized generators; `describes:` drift reminders and broader maintenance are not established. Preserve generator authorization, deterministic regenerate-equals and scoped reminder semantics |
 
-### Phase 3b — narrow integration contract (S1 shipped default OFF; positive reconciliation not shipped)
+<a id="phase-3b--narrow-integration-contract-s1-shipped-default-off-positive-reconciliation-not-shipped"></a>
+
+### Phase 3b — narrow integration contract (S1 default OFF; F4 limited credit)
 
 The preparation design, test-only provider/trust contracts, and qualified RED replay are complete:
 [Document workflow reconciliation](doc-workflow-reconciliation.md),
 [case corpus](../ci/fixtures/doc-obligations/reconciliation-prep/cases.json),
 [pending-RED registry](../ci/fixtures/doc-obligations/reconciliation-prep/pending-red.json), and
 [preparation suite](../ci/mechanism-325-3b-preparation.test.js). #341 E0 is accepted; S1 ships the
-default-OFF no-credit gate only. Positive reconciliation (S2) remains unshipped.
+default-OFF gate, and F4 (#358) adds limited positive credit for `doc-lint` and `link-check` behind the same switch. S3 provider integration remains pending.
 
 - **Inputs:** explicit active `doc-change` step, D6.5 diff facts, Phase 3a obligations/evidence, available provider *metadata*, and host capabilities.
 - **Entry and activation gates (#341):** parallel preparatory work — provider metadata, adapter/interface design and RED fixtures — may proceed while #341 Phase 0A–0C runs, but the **runtime** Evidence Reconciliation must not merge or activate until **#341 E0** is reviewed and accepted (initial evidence read/binding/outcome conformance, mutation and read-order compatibility, source/package parity, zero false MUST PASS on applicable adversarial cases, and applicable green CI including Windows). After E0, only the **bounded, opt-in, reversible** documentation consumer is eligible for runtime integration at the existing verification/disposition path (no second router, forced provider, new lock, or weakened authorization, with a documented rollback), and it supplies the observed exposure for **#341 E1** (initial target 2–3 genuine development/review cycles with sufficient case mix, not elapsed time). **#341 E1 GO / REVISE / NO-GO gates expansion beyond the limited pilot, not the pilot's own observation** (missing or unrepresentative exposure is `UNCHECKED`, never an automatic GO). The H1–H4 paired-task architectural gate below stays required for any #320 promotion in addition to E1. Shared evidence-read/binding/decision defects route to #341 (fixture-first correction, regression replay, re-observation); documentation policy and the trusted host/VCS producer remain #325 deliverables here.

package/docs/platform-capabilities.md

@@ -25,6 +25,15 @@ The repository routing contract uses **step-scoped workflow selection**. Normali
 
 This is a **repository/agent contract**, not an automatic upgrade to any platform row below. A hook can prove that the contract was injected and record an agent's binding disposition; neither proves that a live host actually loaded or followed the referenced content. Instruction-only surfaces can carry the same rule without mechanically enforcing it. Promoting behavior to live-host compliance requires retained host/session evidence under the #82 compatibility program. Claude and local OpenAI packages carry workflow entry/completion **reminders** plus separate Rule-of-3/permission boundaries, but this package/mechanism change does not upgrade `platform-compatibility.json` live-host status values. See [workflow runtime](workflow-runtime.md) for scope, worktree isolation, and failure behavior. OpenCode and instruction-only/public Skills-only surfaces do not acquire equivalent runtime gating. Shell inspection is not a filesystem sandbox; absent hooks, agent-writable state, and indirect script effects remain limits.
 
+### Action-gate mechanism vs. host semantic boundary
+
+Routine exact `create_pull_request` operations are host-deferred at the mechanism level:
+their descriptor remains a mutation (not read/safe), and no Harness consent or
+`permissionDecision` is emitted. Native agent task-scope authorization and native
+permissions stay authoritative; an explicit required `actionGate` hint still gates.
+This is a deterministic mechanism change, not live-host proof, and does not
+upgrade any platform row's live-host status.
+
 ## Current capability summary
 
 | Platform surface | Standalone skills | Plugin support | Hooks/lifecycle | Project scope | Global scope | Current evidence boundary |
@@ -126,6 +135,18 @@ The compatibility path registers hook commands in Codex user configuration and c
 
 The public OpenAI Skills-only plugin is narrower again. Its ZIP contains the packaged `skills/` tree and referenced files, but not the local `.codex-plugin` lifecycle hooks. Public submission readiness is therefore a package/form contract, not evidence of public-directory approval or live hook execution.
 
+### Codex prompt pass-through and authorization (mechanism only)
+
+Codex `UserPromptSubmit` prompts pass through to the normal router unchanged;
+Harness does not parse or intercept a fixed approval syntax. Native agent
+task-scope authorization and native permissions remain authoritative. Routine
+exact `create_pull_request` operations are host-deferred at the mechanism level:
+their descriptor remains a mutation (not read/safe), and no Harness consent or
+`permissionDecision` is emitted. All other risky actions remain hard PreToolUse
+blocks; an explicitly required `actionGate` hint still gates. These are
+deterministic mechanism changes, not live-host proof. Codex ask-style decisions
+are not supported.
+
 ## Install/uninstall ownership boundary
 
 The general installer merges shared files only through Harness-owned markers and removes only manifest-tracked artifacts. Malformed configuration and pre-existing user-owned files fail closed. Install/uninstall round-trip coverage protects user skills and runs on Linux, Windows, and macOS fixtures.

package/hooks/scripts/action-gate.js

@@ -9,7 +9,6 @@ const {
   getWorkspaceRoot,
   getSessionDir,
 } = require('./lib/harness-state');
-
 const RULES_PATH = process.env.HARNESS_ACTION_GATE_RULES_PATH || path.join(__dirname, 'action-gate-rules.json');
 const ASK_CAPABLE_HOSTS = new Set(['claude']);
 const VALID_SCOPES = new Set(['always', 'outside-scratch']);
@@ -52,10 +51,12 @@ function toolInputOf(payload) {
 function stableValue(value) {
   if (Array.isArray(value)) return value.map(stableValue);
   if (!value || typeof value !== 'object') return value;
+  // Use a null-prototype accumulator so an own `__proto__` key is stored as data
+  // instead of mutating the accumulator's prototype (which would drop it).
   return Object.keys(value).sort().reduce((acc, key) => {
     acc[key] = stableValue(value[key]);
     return acc;
-  }, {});
+  }, Object.create(null));
 }
 
 function exactPayloadText(payload) {
@@ -132,10 +133,25 @@ function normalizeActionDescriptor(payload) {
   };
 }
 
+function isRoutinePullRequestCreation(toolName) {
+  const name = String(toolName || '');
+  const segments = name.split('__');
+  const last = segments[segments.length - 1];
+  return (last === 'create_pull_request' || name === 'create_pull_request');
+}
+
 function structuredRule(payload) {
   const descriptor = normalizeActionDescriptor(payload);
   if (descriptor.toolFamily === 'shell') return { descriptor, rule: null };
   if (descriptor.classification === 'safe') return { descriptor, rule: null };
+  // Routine PR creation is a host-deferred mutation, not a Harness-gated one:
+  // the generic create=>mutate heuristic must not add an extra challenge. The
+  // descriptor stays a mutation (not read/safe). An explicit required
+  // actionGate hint still gates it.
+  const hint = routerActionGateHint(payload);
+  if (isRoutinePullRequestCreation(descriptor.toolName) && !(hint && hint.required)) {
+    return { descriptor, rule: null };
+  }
   if (descriptor.classification === 'gated') {
     return {
       descriptor,
@@ -145,7 +161,6 @@ function structuredRule(payload) {
       },
     };
   }
-  const hint = routerActionGateHint(payload);
   if (hint && hint.required) {
     return {
       descriptor,
@@ -445,11 +460,17 @@ function recordDecision(payload, rule, table, host, disposition, options = {}, e
   return record;
 }
 
+
+
+
+
 function evaluatePreToolUse(payload, options = {}) {
   const context = sessionContext(payload, options.sessionDir);
   const table = options.ruleTable || loadRuleTable(options.rulePath || RULES_PATH);
   const structured = structuredRule(payload);
   const rule = structured.rule || classify(payload, table.rules, context.sessionDir);
+  const host = detectHost(payload, options.host);
+
   if (!rule) {
     return {
       kind: 'allow',
@@ -462,7 +483,6 @@ function evaluatePreToolUse(payload, options = {}) {
     };
   }
 
-  const host = detectHost(payload, options.host);
   const reason = decisionReason(rule, table);
   if (hostSupportsAsk(host) && gatePolicy(options) === ALWAYS_ASK_POLICY) {
     const record = recordDecision(payload, rule, table, host, 'pending-approval', { ...options, sessionDir: context.sessionDir });
@@ -655,4 +675,5 @@ module.exports = {
   validateRuleTable,
   normalizeActionDescriptor,
   structuredRule,
+  isRoutinePullRequestCreation,
 };

package/hooks/scripts/codex-user-prompt.js

@@ -22,6 +22,14 @@ function finish() {
   if (finished) return;
   finished = true;
   clearTimeout(timer);
+
+  let payload = null;
+  try { payload = JSON.parse(input || '{}'); } catch (_) { payload = null; }
+
+  // All prompts, including any legacy approval spelling, pass through unchanged
+  // to the normal router. Harness does not parse or intercept authorization
+  // syntax in user prompts; native agent/task scope and native permissions
+  // remain authoritative.
   if (!ROUTER) process.exit(0);
   const result = spawnSync(process.execPath, [ROUTER], { input, encoding: 'utf8', env: process.env, timeout: 25000 });
   const stderr = String(result.stderr || '');

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.41.1",
+  "version": "0.41.3",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.41.1",
+  "version": "0.41.3",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.41.1",
+  "version": "0.41.3",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/hooks/scripts/action-gate.js

@@ -9,7 +9,6 @@ const {
   getWorkspaceRoot,
   getSessionDir,
 } = require('./lib/harness-state');
-
 const RULES_PATH = process.env.HARNESS_ACTION_GATE_RULES_PATH || path.join(__dirname, 'action-gate-rules.json');
 const ASK_CAPABLE_HOSTS = new Set(['claude']);
 const VALID_SCOPES = new Set(['always', 'outside-scratch']);
@@ -52,10 +51,12 @@ function toolInputOf(payload) {
 function stableValue(value) {
   if (Array.isArray(value)) return value.map(stableValue);
   if (!value || typeof value !== 'object') return value;
+  // Use a null-prototype accumulator so an own `__proto__` key is stored as data
+  // instead of mutating the accumulator's prototype (which would drop it).
   return Object.keys(value).sort().reduce((acc, key) => {
     acc[key] = stableValue(value[key]);
     return acc;
-  }, {});
+  }, Object.create(null));
 }
 
 function exactPayloadText(payload) {
@@ -132,10 +133,25 @@ function normalizeActionDescriptor(payload) {
   };
 }
 
+function isRoutinePullRequestCreation(toolName) {
+  const name = String(toolName || '');
+  const segments = name.split('__');
+  const last = segments[segments.length - 1];
+  return (last === 'create_pull_request' || name === 'create_pull_request');
+}
+
 function structuredRule(payload) {
   const descriptor = normalizeActionDescriptor(payload);
   if (descriptor.toolFamily === 'shell') return { descriptor, rule: null };
   if (descriptor.classification === 'safe') return { descriptor, rule: null };
+  // Routine PR creation is a host-deferred mutation, not a Harness-gated one:
+  // the generic create=>mutate heuristic must not add an extra challenge. The
+  // descriptor stays a mutation (not read/safe). An explicit required
+  // actionGate hint still gates it.
+  const hint = routerActionGateHint(payload);
+  if (isRoutinePullRequestCreation(descriptor.toolName) && !(hint && hint.required)) {
+    return { descriptor, rule: null };
+  }
   if (descriptor.classification === 'gated') {
     return {
       descriptor,
@@ -145,7 +161,6 @@ function structuredRule(payload) {
       },
     };
   }
-  const hint = routerActionGateHint(payload);
   if (hint && hint.required) {
     return {
       descriptor,
@@ -445,11 +460,17 @@ function recordDecision(payload, rule, table, host, disposition, options = {}, e
   return record;
 }
 
+
+
+
+
 function evaluatePreToolUse(payload, options = {}) {
   const context = sessionContext(payload, options.sessionDir);
   const table = options.ruleTable || loadRuleTable(options.rulePath || RULES_PATH);
   const structured = structuredRule(payload);
   const rule = structured.rule || classify(payload, table.rules, context.sessionDir);
+  const host = detectHost(payload, options.host);
+
   if (!rule) {
     return {
       kind: 'allow',
@@ -462,7 +483,6 @@ function evaluatePreToolUse(payload, options = {}) {
     };
   }
 
-  const host = detectHost(payload, options.host);
   const reason = decisionReason(rule, table);
   if (hostSupportsAsk(host) && gatePolicy(options) === ALWAYS_ASK_POLICY) {
     const record = recordDecision(payload, rule, table, host, 'pending-approval', { ...options, sessionDir: context.sessionDir });
@@ -655,4 +675,5 @@ module.exports = {
   validateRuleTable,
   normalizeActionDescriptor,
   structuredRule,
+  isRoutinePullRequestCreation,
 };

package/plugins/harness-everything/hooks/scripts/codex-user-prompt.js

@@ -22,6 +22,14 @@ function finish() {
   if (finished) return;
   finished = true;
   clearTimeout(timer);
+
+  let payload = null;
+  try { payload = JSON.parse(input || '{}'); } catch (_) { payload = null; }
+
+  // All prompts, including any legacy approval spelling, pass through unchanged
+  // to the normal router. Harness does not parse or intercept authorization
+  // syntax in user prompts; native agent/task scope and native permissions
+  // remain authoritative.
   if (!ROUTER) process.exit(0);
   const result = spawnSync(process.execPath, [ROUTER], { input, encoding: 'utf8', env: process.env, timeout: 25000 });
   const stderr = String(result.stderr || '');

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.41.1",
+  "version": "0.41.3",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/sbom.cdx.json

@@ -2,23 +2,23 @@
   "$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.7",
-  "serialNumber": "urn:uuid:c067e2e8-259d-5b73-a1bf-780a0d33156e",
+  "serialNumber": "urn:uuid:e4948d5f-cae4-5b4e-84bc-19997b97c420",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-23T19:34:50.360Z",
+    "timestamp": "2026-10-25T06:53:03.342Z",
     "tools": [
       {
         "vendor": "Harness Everything",
         "name": "generate-sbom.js",
-        "version": "0.41.1"
+        "version": "0.41.3"
       }
     ],
     "component": {
       "type": "application",
-      "bom-ref": "pkg:npm/harness-everything@0.41.1",
+      "bom-ref": "pkg:npm/harness-everything@0.41.3",
       "name": "harness-everything",
-      "version": "0.41.1",
-      "purl": "pkg:npm/harness-everything@0.41.1"
+      "version": "0.41.3",
+      "purl": "pkg:npm/harness-everything@0.41.3"
     }
   },
   "components": [
@@ -2033,7 +2033,7 @@
       ]
     },
     {
-      "ref": "pkg:npm/harness-everything@0.41.1",
+      "ref": "pkg:npm/harness-everything@0.41.3",
       "dependsOn": [
         "pkg:npm/%40commitlint/cli@19.8.1",
         "pkg:npm/%40commitlint/config-conventional@19.8.1",