harness-everything 0.41.3 → 0.42.1

package/benchmarks/results/codex-pr-metadata-2026-10-26/luna-codex-action-gate-prehook-smoke.js

@@ -0,0 +1,78 @@
+'use strict';
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const cp = require('child_process');
+const repoRoot = path.resolve(process.argv[2] || process.cwd());
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'luna-hook-boundary-'));
+const hook = path.join(repoRoot, 'hooks/scripts/codex-action-gate-pre.js');
+const env = {
+  ...process.env,
+  HARNESS_ACTION_GATE_HOST: 'codex',
+  HARNESS_STATE_HOME: root,
+  HARNESS_ACTION_GATE_STDIN_TIMEOUT_MS: '2000',
+};
+const input = { repository_full_name: 'acme/repo', pr_number: 376, body: 'fixture' };
+const cases = [
+  ['metadata', { tool_input: input }],
+  ['required', { tool_input: input, workflowPlan: { actionGate: { required: true } } }],
+  ['descriptor-read-shell', { tool_input: input, action_descriptor: { action: 'read', toolFamily: 'shell' } }],
+  ['unsafe-state-null-required', { tool_input: { ...input, state: null }, action_descriptor: { action: 'read', toolFamily: 'shell' }, actionGate: { required: true } }],
+  ['delete-shell', { tool_input: input, action_descriptor: { action: 'delete', toolFamily: 'shell' } }],
+  ['near-name', { tool_name: 'mcp__demo__update_pull_requests', tool_input: input }],
+  ['conflicting-harness-required', {
+    tool_input: input,
+    actionGate: { required: false },
+    workflowPlan: { actionGate: { required: false } },
+    routerContract: { workflowPlan: { actionGate: { required: false } } },
+    harness: { workflowPlan: { actionGate: { required: true } } },
+  }],
+];
+function files(dir) {
+  return fs.readdirSync(dir, { withFileTypes: true }).flatMap(entry =>
+    entry.isDirectory() ? files(path.join(dir, entry.name)) : [path.join(dir, entry.name)]);
+}
+try {
+  console.log(`Node ${process.version}; repo ${repoRoot}`);
+  for (let i = 0; i < cases.length; i++) {
+    const [label, extra] = cases[i];
+    const toolUseId = `hook-${i}`;
+    const payload = {
+      hook_event_name: 'PreToolUse',
+      session_id: `hook-review-${i}`,
+      turn_id: 'hook-review',
+      tool_use_id: toolUseId,
+      tool_name: 'mcp__codex_apps__github__update_pull_request',
+      ...extra,
+    };
+    const result = cp.spawnSync(process.execPath, [hook], {
+      cwd: root,
+      env,
+      input: JSON.stringify(payload),
+      encoding: 'utf8',
+      timeout: 20000,
+    });
+    const audit = files(root).filter(file => file.endsWith('.json')).map(file => {
+      try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; }
+    }).find(record => record?.toolUseId === toolUseId);
+    const summary = {
+      label,
+      exitCode: result.status,
+      stdout: result.stdout.trim(),
+      matchedRule: audit?.matchedRule || null,
+      disposition: audit?.disposition || null,
+      action: audit?.actionDescriptor?.action || null,
+      family: audit?.actionDescriptor?.toolFamily || null,
+      classification: audit?.actionDescriptor?.classification || null,
+      required: audit?.routerActionGate?.required ?? null,
+    };
+    console.log(JSON.stringify(summary));
+    if (result.error || result.status === null) throw result.error || new Error(`${label}: no process status`);
+    const expectedAllow = label === 'metadata' || label === 'descriptor-read-shell';
+    if (expectedAllow ? result.status !== 0 : result.status !== 2) throw new Error(`${label}: unexpected exit ${result.status}`);
+    if (expectedAllow && (audit?.actionDescriptor?.action !== 'mutate' || audit?.actionDescriptor?.toolFamily !== 'mcp')) throw new Error(`${label}: expected audited MCP mutation`);
+    if (!expectedAllow && result.status === 2 && !audit) throw new Error(`${label}: missing block audit`);
+  }
+} finally {
+  fs.rmSync(root, { recursive: true, force: true });
+}

package/benchmarks/results/codex-pr-metadata-2026-10-26/luna-codex-action-gate-prehook-smoke.log

@@ -0,0 +1,8 @@
+Node v24.22.1; repo /Users/daniel.chang/Desktop/Skills/Harness-codex-pr-metadata
+{"label":"metadata","exitCode":0,"stdout":"","matchedRule":"routine-pr-metadata-update","disposition":"deferred-to-host","action":"mutate","family":"mcp","classification":"gated","required":null}
+{"label":"required","exitCode":2,"stdout":"","matchedRule":"structured-mutate","disposition":"rejected","action":"mutate","family":"mcp","classification":"gated","required":true}
+{"label":"descriptor-read-shell","exitCode":0,"stdout":"","matchedRule":"routine-pr-metadata-update","disposition":"deferred-to-host","action":"mutate","family":"mcp","classification":"gated","required":null}
+{"label":"unsafe-state-null-required","exitCode":2,"stdout":"","matchedRule":"structured-mutate","disposition":"rejected","action":"mutate","family":"mcp","classification":"gated","required":true}
+{"label":"delete-shell","exitCode":2,"stdout":"","matchedRule":"structured-delete","disposition":"rejected","action":"delete","family":"mcp","classification":"gated","required":null}
+{"label":"near-name","exitCode":2,"stdout":"","matchedRule":"structured-mutate","disposition":"rejected","action":"mutate","family":"mcp","classification":"gated","required":null}
+{"label":"conflicting-harness-required","exitCode":2,"stdout":"","matchedRule":"structured-mutate","disposition":"rejected","action":"mutate","family":"mcp","classification":"gated","required":true}

package/benchmarks/results/codex-pr-metadata-2026-10-26/luna-review.md

@@ -0,0 +1,151 @@
+# Independent cold review: Codex PR metadata action gate
+
+## Scope and evidence
+
+- Repository: `/Users/daniel.chang/Desktop/Skills/Harness-codex-pr-metadata`
+- Base: `b733cadec17542b9ae30aabb50c1ba3481a58d74`
+- Final core SHA reviewed: `c170a96cf856295200d2d1a62c15a552c3cb2b37`
+- Current repository HEAD: `a2edf4ed2204a414dd085635d2d9bf4464c59e9e` (evidence-only commit after the core review); current worktree has two additional evidence-only paths described below.
+- The code path was cold-reviewed at `e160e00`, then re-reviewed through fixes `ff796c9`, `e9344de`, and `c170a96`. Final core behavior was independently exercised at `c170a96`.
+- Requested model/effort: coordinator reports that the agent was routed with `model=gpt-6-luna`, `reasoning_effort=xhigh`. This agent has no host-issued runtime attestation, so actual model/effort identity remains unverified.
+- Read independently: repository `AGENTS.md`, `docs/codex-action-gate.md`, code-review skill/playbook, issue [#110](https://github.com/dyphn1/Harness-everything/issues/110), issue [#122](https://github.com/dyphn1/Harness-everything/issues/122), issue [#135](https://github.com/dyphn1/Harness-everything/issues/135), complete base-to-HEAD diff, original worktree diff, and retained evidence logs/artifacts.
+- Scope clauses, verbatim from the review task:
+  - C1 僅 Codex 精確 update_pull_request title/body metadata-only 例外，必須實查參數；
+  - C2 state/base_branch/maintainer_can_modify/unknown/mixed risk 不得豁免（包含 null）；
+  - C3 actionGate.required=true 必須 gate；
+  - C4 保持 mutate/gated，無 Codex permissionDecision ask/allow、Host/task scope/GitHub authorization 仍生效；
+  - C5 create_pull_request 與 merge/close/delete/force-push/publish/deploy/send 既有行為不變；
+  - C6 不擴其他 Host、canonical/plugin parity，hash/redacted audit provenance/executed success+failure/rejected/integrity 行為保持；
+  - C7 RED→GREEN→regression 必須自行執行證明，live-host 不可從 unit/mechanism 宣稱 PASS；
+  - C8 無 #376 governance 實作、#341 E1/#320 授權擴張、禁自動 merge/繞 gate。
+
+### Paths reviewed in `base..a2edf4e`
+
+- `CHANGELOG.md`
+- `benchmarks/results/codex-pr-metadata-2026-10-26/README.md`
+- `benchmarks/results/codex-pr-metadata-2026-10-26/green-final.log`
+- `benchmarks/results/codex-pr-metadata-2026-10-26/green.log`
+- `benchmarks/results/codex-pr-metadata-2026-10-26/original-rejection.json`
+- `benchmarks/results/codex-pr-metadata-2026-10-26/red.log`
+- `benchmarks/results/codex-pr-metadata-2026-10-26/review-descriptor-green.log`
+- `benchmarks/results/codex-pr-metadata-2026-10-26/review-descriptor-red.log`
+- `benchmarks/results/codex-pr-metadata-2026-10-26/review-family-green.log`
+- `benchmarks/results/codex-pr-metadata-2026-10-26/review-family-red.log`
+- `benchmarks/results/codex-pr-metadata-2026-10-26/review-hints-green.log`
+- `benchmarks/results/codex-pr-metadata-2026-10-26/review-hints-red.log`
+- `benchmarks/results/codex-pr-metadata-2026-10-26/luna-action-family-cross-product.js`
+- `benchmarks/results/codex-pr-metadata-2026-10-26/luna-action-family-cross-product.log`
+- `benchmarks/results/codex-pr-metadata-2026-10-26/luna-codex-action-gate-prehook-smoke.js`
+- `benchmarks/results/codex-pr-metadata-2026-10-26/luna-codex-action-gate-prehook-smoke.log`
+- `benchmarks/results/codex-pr-metadata-2026-10-26/verification.md` (current untracked evidence)
+- `benchmarks/results/codex-pr-metadata-2026-10-26/luna-review.md` (current untracked copied report)
+- `benchmarks/results/codex-pr-metadata-2026-10-26/live-installed-runtime-rejection.json` (current untracked installed-runtime evidence)
+- `ci/action-gate.test.js`
+- `ci/mechanism-2aa-codex-action-gate-policy.test.js`
+- `ci/mechanism-task-git-authorization.test.js`
+- `docs/codex-action-gate.md`
+- `docs/platform-capabilities.md`
+- `hooks/scripts/action-gate.js`
+- `plugins/harness-everything/hooks/scripts/action-gate.js`
+
+The current uncommitted worktree delta is evidence-only: README status and installed-runtime provenance, `verification.md`, the copied report, and `live-installed-runtime-rejection.json`. The README now records core PASS and the independent review, while keeping candidate live-host UNCHECKED. Its linked `luna-review.md` copy still predates this final evidence adjudication and must be refreshed from this `/tmp` report before commit. No repository files were changed by this reviewer. Temporary snapshots and scripts/logs were created under `/tmp`; the two retained Luna scripts/logs were byte-compared with those files.
+
+## Findings and dispositions
+
+### [BLOCKER, resolved] Earlier optional hint hid a later required hint
+
+- **Location:** `hooks/scripts/action-gate.js:380-392` @ `e160e00d265a2b427cdf6eb25783744470b0cb81`
+- **Trigger:** Codex `PreToolUse` for exact `mcp__codex_apps__github__update_pull_request`, metadata input `{repository_full_name:"acme/repo",pr_number:376,body:"fixture"}`, top-level `actionGate:{required:false}`, and `workflowPlan.actionGate:{required:true}`.
+- **Behavior → impact:** `routerActionGateHint` selected the first object. The new metadata branch saw `required:false`, returned `allow`/`deferred-to-host`, and bypassed an explicitly required gate.
+- **Violates:** C3.
+- **Witness:** Base `b733cade` blocked this mutation; `e160e00` exited 0 with empty stdout. Positive controls: plain metadata exited 0; a single required hint exited 2. The actual Codex PreToolUse stdin entrypoint reproduced the same outcomes.
+- **Evidence tier:** executed/reproduced under Node 24.22.1.
+- **Correction / regression:** `ff796c9` now prioritizes any supported `required:true` hint. The RED test from `1e77c26` failed 9 assertions on `e160e00`; the GREEN test passed. The retained test covers all four supported hint envelopes with conflicting optional hints.
+- **Disposition:** resolved at `ff796c9`, rechecked at `c170a96`.
+
+### [MAJOR, resolved] Read/unknown action descriptors bypassed required gating and mixed-risk checks
+
+- **Location:** `hooks/scripts/action-gate.js:156-159` @ `e160e00d265a2b427cdf6eb25783744470b0cb81`
+- **Trigger:** exact Codex PR update with `tool_input` containing `state:"closed"` and `action_descriptor:{action:"read"}`, plus `workflowPlan.actionGate.required:true`.
+- **Behavior → impact:** `structuredRule` returned early for a descriptor classified `safe`, before checking the required hint or the metadata allowlist. The hook returned allow with no audit; a mixed high-risk input escaped the intended metadata-only check.
+- **Violates:** C2 and C3.
+- **Witness:** Starting state: this behavior existed at base. Expected: block because `state` is an additional high-risk field and the workflow requires a gate. Actual: `allow`, exit 0, no decision record. Positive controls: replacing `read` with `delete` or removing the explicit descriptor blocks with exit 2.
+- **Evidence tier:** executed across base, `e160e00`, and `ff796c9`; actual external reachability of an `action_descriptor` parameter depends on the active tool schema/adapter and was not established. The Codex PR connector schema recorded in the evidence does not list that input field.
+- **Correction / regression:** `e9344de` normalizes read/unknown descriptor actions to `mutate` for exact Codex PR-update operations before the early safe branch. The RED test from `06a66c2` failed 11 assertions on `ff796c9`; GREEN passed. Final action/family cross-product and stdin smoke confirm `mutate`/`gated` audit provenance and rejection of mixed fields.
+- **Disposition:** resolved for exact Codex PR update at `e9344de`, rechecked at `c170a96`. The pre-existing behavior for unrelated tools/hosts was not changed.
+
+### [MAJOR, resolved] Explicit shell family disguised an MCP PR update
+
+- **Location:** `hooks/scripts/action-gate.js:156-159` @ `e9344de` (same early shell-family return in `e160e00`)
+- **Trigger:** exact Codex PR update with `action_descriptor:{toolFamily:"shell",action:"delete"}` and otherwise metadata-only arguments.
+- **Behavior → impact:** explicit descriptor family overrode the actual `mcp__...` tool identity; `structuredRule` returned at its shell branch without gating the `delete` action.
+- **Violates:** C2, C3 and C4.
+- **Witness:** Expected: a `delete` descriptor on a GitHub MCP update must be blocked and audited as MCP. Actual before the family fix: `allow`, exit 0, no record. Positive control: the same descriptor with `toolFamily:"mcp"` blocked with exit 2. The direct mechanism case was reproduced at the intermediate `e9344de` state.
+- **Evidence tier:** executed at mechanism level; external reachability is subject to the same tool-schema boundary above.
+- **Correction / regression:** `c170a96` derives the family from exact Codex PR tool identity, ignores a descriptor's family downgrade, and preserves `delete`/`publish`/`deploy`/`send` classifications. The RED test from `16f5e20` failed 14 assertions on `e9344de`; GREEN passed.
+- **Disposition:** resolved at `c170a96`.
+
+### [MINOR, resolved in README; copied report refresh pending] README review status was stale
+
+- **Location:** `benchmarks/results/codex-pr-metadata-2026-10-26/README.md` (uncommitted worktree delta)
+- **Trigger:** The report and independent checks are now complete, while the README still says `Independent review | Pending Luna xhigh cold review`.
+- **Behavior → impact:** The evidence index understates completed review status.
+- **Violates:** C7 evidence-record accuracy.
+- **Witness:** Starting state/input: README pending row plus completed `/tmp/luna-pr-metadata-review.md`. Expected: row updated to review result. Actual: pending text remains.
+- **Evidence tier:** source-traced.
+- **Minimal correction:** Update the status row with the final core review result and retain the separate full-regression/live-host boundaries.
+- **Regression:** Negative: status remains pending after report is accepted; positive control: the same README correctly labels candidate live-host as UNCHECKED.
+- **Disposition:** resolved in the current README, which now links the core PASS result. Refresh the copied `luna-review.md` so it does not retain the old pending statement; this is evidence-copy synchronization only, not a runtime blocker.
+
+## Independent verification
+
+All local Node commands below explicitly used `/Users/daniel.chang/.nvm/versions/node/v24.22.1/bin` (`v24.22.1`).
+
+| Check | Result / evidence |
+| --- | --- |
+| `node ci/action-gate.test.js` at `c170a96` | PASS, 0 failures |
+| `node ci/mechanism-2aa-codex-action-gate-policy.test.js` at `c170a96` | PASS |
+| `node ci/mechanism-task-git-authorization.test.js` at `c170a96` | PASS |
+| `npm run test:plugin:openai` at `c170a96` | PASS; canonical/package parity and runtime checks |
+| `npm run test:consistency` at `e160e00`; final `verify:all` at `c170a96` | PASS in both reviewed evidence runs |
+| `npm run test:platform:compatibility` at `e160e00`; final `verify:all` at `c170a96` | PASS in both reviewed evidence runs |
+| `npm run test:plugin:submission` at `e160e00`; final `verify:all` at `c170a96` | PASS in both reviewed evidence runs |
+| Original RED: base archive `b733cade` + `db6c29b:ci/action-gate.test.js` | 12 expected failures; preceding baseline/dependency controls passed |
+| Required-hint RED: `e160e00` archive + `1e77c26:ci/action-gate.test.js` | 9 expected failures |
+| Descriptor RED: `ff796c9` archive + `06a66c2:ci/action-gate.test.js` | 11 expected failures |
+| Family RED: `e9344de` archive + `16f5e20:ci/action-gate.test.js` | 14 expected failures |
+| Final GREEN: `node ci/action-gate.test.js` at `c170a96` | PASS, 0 failures |
+| Independent action × family × descriptor-envelope × required-hint/unsafe-field cross-product | PASS: 2,709 cases, 4,729 assertions, 0 failures; `/tmp/luna-action-family-cross-product-final.log` |
+| Independent Codex PreToolUse stdin smoke | PASS: 7 subprocess cases; `/tmp/luna-codex-action-gate-prehook-smoke-final.log` |
+| Base-versus-candidate controls: create, merge, close, delete, force-push, publish, deploy, send | Same outcomes; create remained host-deferred/mutate, all risky controls blocked |
+| Original rejection hash provenance | PASS: parsed the cited transcript `CommandExecution.aggregated_output` (1,840 chars), reconstructed sorted compact JSON for repository/pr/body, SHA-256 matched audit `b9bda711…c87b` |
+| Full `npm run verify:all` at final core SHA | PASS: exit 0, 13 PASS / 0 FAIL / 3 UNCHECKED (local Node 22 lanes); log SHA-256 `630159501b19d1d0178683262f0bfe7c0ec9cacb29a336057bb95094481129f4` |
+| Candidate live-host behavior | UNCHECKED. The retained `live-installed-runtime-rejection.json` is an old installed runtime rejection, not candidate evidence. |
+
+## Contract review summary
+
+- C1/C2: exact Codex operation plus strict parameter allowlist; additional fields including null remain gated; metadata descriptor stays `mutate`/`gated`; high-risk action descriptors remain gated.
+- C3: any `required:true` hint across supported envelopes wins; audit preserves the required hint.
+- C4: the prehook emits no Codex `permissionDecision` allow/ask for the deferred metadata call. Host task scope, Codex permissions, and GitHub authorization remain the execution authorities.
+- C5: create-PR behavior and risky controls matched the base; regression tests retain the explicit required-gate case.
+- C6: canonical/plugin byte parity, redacted audit, exact payload hash, execution success/failure, rejection, and integrity behavior passed mechanism tests. No other Host was widened.
+- C7: RED/GREEN was independently reproduced at each correction boundary; no package/mechanism result is called a candidate live-host PASS.
+- C8: reviewed changes contain no #376 governance implementation, #341 E1 credit, #320 authorization expansion, auto-merge, or gate bypass.
+
+## Final recommendation
+
+No open runtime/code blocker remains at `c170a96`; the three code findings were fixed and rechecked. The final Node 24 full suite passed, with only the three explicit Node 22 lanes UNCHECKED. Candidate live-host behavior remains UNCHECKED. The README review-status minor is fixed in the current README; refresh the copied report before committing the evidence package.
+
+## Final evidence-only adjudication
+
+- Raw log `/tmp/pr-metadata-verify-final.log`: independently hashed to `630159501b19d1d0178683262f0bfe7c0ec9cacb29a336057bb95094481129f4` (matches `verification.md`). Header pins core `c170a96cf856295200d2d1a62c15a552c3cb2b37`, Node `v24.22.1`, Darwin, default full gate set. Process exit is `0`.
+- Summary verified from the raw log: 13 PASS, 0 FAIL, 3 UNCHECKED. The three unchecked lanes are Node 22 self-regression smoke, installer roundtrip smoke, and `npm ci` install; optional Waza readiness passed.
+- `verification.md` matches the raw log hash, header, per-gate results, and summary.
+- Current README closes the earlier pending-review row, reports the full-suite summary, preserves the `gpt-6-luna`/`xhigh` routing request with no host-issued runtime attestation, and keeps candidate live-host status UNCHECKED. It does not claim final-head CI is all green; its PR workflow reference is explicitly the initial run and says final-head status must be checked separately.
+- No runtime or plugin path changed after frozen core `c170a96`; the post-core commit `a2edf4e` and worktree delta are evidence-only. The old installed runtime rejection audit points to installed runtime `0.42.0-f51078676b56`; it is not candidate live proof.
+- Candidate live-host execution remains UNCHECKED. No new destructive remote operation was attempted by this reviewer.
+- The copied `luna-review.md` currently contains the pre-final pending text and must be recopied from this report before the evidence commit.
+
+Skipped: no Node 22 lane rerun and no candidate live-host execution. Risk: those evidence boundaries remain unverified; final core Node 24 gates passed.
+
+STATUS: DONE

package/benchmarks/results/codex-pr-metadata-2026-10-26/original-rejection.json

@@ -0,0 +1,31 @@
+{
+  "schemaVersion": 1,
+  "toolName": "mcp__codex_apps__github__update_pull_request",
+  "toolUseId": "exec-8e76e1be-e5a3-493d-807b-2ad6cdbc7c31",
+  "commandHash": "b9bda7116fb01c045edd71a6b4fc3091c0ab707e0b797f1b4efca6e7a4edc87b",
+  "actionDescriptor": {
+    "schemaVersion": 1,
+    "toolFamily": "mcp",
+    "toolName": "mcp__codex_apps__github__update_pull_request",
+    "action": "mutate",
+    "resource": "dyphn1/Harness-everything",
+    "payloadHash": "b9bda7116fb01c045edd71a6b4fc3091c0ab707e0b797f1b4efca6e7a4edc87b",
+    "classification": "gated",
+    "reasonCodes": [
+      "tool-identity-inference"
+    ]
+  },
+  "matchedRule": "structured-mutate",
+  "ruleReason": "Structured mutate action requires pre-action authorization.",
+  "disposition": "rejected",
+  "host": "codex",
+  "permissionMode": "bypassPermissions",
+  "gatePolicy": "defer-to-host",
+  "routerActionGate": null,
+  "ruleTableSource": "/Users/daniel.chang/.codex/harness-everything/compat-hooks/runtime/0.42.0-f51078676b56/hooks/scripts/action-gate-rules.json",
+  "degradedRuleTable": false,
+  "degradationReason": null,
+  "createdAt": "2026-10-26T01:12:15.045Z",
+  "updatedAt": "2026-10-26T01:12:15.045Z",
+  "rejectionReason": "host-ask-decision-unverified-or-unsupported"
+}

package/benchmarks/results/codex-pr-metadata-2026-10-26/red.log

@@ -0,0 +1,158 @@
+=== Issue #85 Phase 5 — Pre-action gate ===
+  PASS production action-gate rule table loads without fallback
+  PASS production rule table is non-empty and keeps the destructive baseline
+  PASS rule table contains git-force-push
+  PASS rule table contains git-reset-hard
+  PASS rule table contains git-clean-force-delete
+  PASS rule table contains recursive-delete
+  PASS rule table contains powershell-recursive-force-delete
+  PASS rule table contains sql-destructive-ddl
+  PASS rule table contains package-publish
+  PASS rule table contains github-release-create
+  PASS rule table contains production-deploy
+  PASS Claude force-push defers to the host permission flow without forcing a prompt
+  PASS deferred decision still names the matched rule
+  PASS matched Claude action is audited as deferred-to-host
+  PASS audit records matched rule
+  PASS audit hashes the exact command payload
+  PASS always-ask policy restores the forced Claude prompt
+  PASS ask decision uses Claude PreToolUse hookSpecificOutput
+  PASS ask reason names the matched rule
+  PASS always-ask action is audited as pending-approval
+  PASS git status passes untouched
+  PASS safe unmatched command creates no gate audit record
+  PASS permission_mode=default defers to the host without a forced prompt
+  PASS audit records permission_mode=default
+  PASS permission_mode=acceptEdits defers to the host without a forced prompt
+  PASS audit records permission_mode=acceptEdits
+  PASS permission_mode=plan defers to the host without a forced prompt
+  PASS audit records permission_mode=plan
+  PASS permission_mode=auto defers to the host without a forced prompt
+  PASS audit records permission_mode=auto
+  PASS permission_mode=dontAsk defers to the host without a forced prompt
+  PASS audit records permission_mode=dontAsk
+  PASS permission_mode=bypassPermissions defers to the host without a forced prompt
+  PASS audit records permission_mode=bypassPermissions
+  PASS permission_mode=missing defers to the host without a forced prompt
+  PASS audit records permission_mode=missing
+  PASS command classification gates destructive action even when router hint says not required
+  PASS router actionGate hint is recorded without controlling enforcement
+  PASS safe command is not gated solely because prompt router predicted risk
+  PASS structured MCP delete is gated before execution
+  PASS audit retains normalized structured action identity
+  PASS structured action audit binds to exact payload hash
+  PASS structured action audit does not persist raw secret arguments
+  PASS read-only MCP fixture passes without a false gate
+  PASS obvious structured mutation is classified from tool identity
+  PASS non-shell local-function destructive fixture uses the same structured gate
+  PASS unknown structured action fails closed when workflow requires a gate
+  PASS unknown structured action is not fabricated as destructive without a gate requirement
+  PASS changed structured payload cannot reuse a prior approval/audit decision
+  PASS PowerShell recursive force delete outside scratch is gated
+  PASS PowerShell recursive force delete inside session scratch is exempt
+  PASS rm -rf outside scratch is gated
+  PASS rm -rf inside OS temp is exempt
+  PASS git reset --hard HEAD matches git-reset-hard
+  PASS git clean -fd matches git-clean-force-delete
+  PASS psql -c "DROP TABLE users" matches sql-destructive-ddl
+  PASS npm publish matches package-publish
+  PASS gh release create v1.2.3 matches github-release-create
+  PASS npm run deploy matches production-deploy
+  PASS host without verified ask-style decision blocks with exit 2
+  PASS non-ask host block reason names the matched rule
+  PASS non-ask host block is audited as rejected
+  PASS internal action-gate error on Claude defers to the host instead of allowing or forcing a prompt
+  PASS internal error is shown to the user as a systemMessage without a permission decision
+  PASS internal error on Claude is audited as deferred-to-host
+  PASS internal action-gate error under always-ask fails closed to ask
+  PASS internal error on host without ask fails closed to block
+  PASS missing/invalid rule table visibly falls back to built-in defaults
+  PASS built-in fallback still classifies and audits destructive action
+  PASS fallback degradation is shown to the user as a systemMessage
+  PASS valid empty rule table does not silently activate built-in defaults
+  PASS empty-table mutation control disables detection, proving production non-empty assertion is meaningful
+  PASS null-prototype serialization preserves an own __proto__ key
+  PASS own __proto__ key changes the full-input digest
+  PASS PostToolUse closes a deferred payload as executed
+  PASS executed audit keeps exact approved payload hash
+  PASS PostToolUseFailure records attempted execution without pretending success
+  PASS post-tool payload mismatch is never accepted as the approved command
+  PASS Stop closes unexecuted deferred and pending payloads
+  PASS unexecuted deferred payload is audited as rejected
+  PASS unexecuted always-ask approval is audited as rejected
+  PASS hook process returns no decision for a matched command under the default policy
+  PASS hook process audits the deferred command with its permission mode
+  PASS HARNESS_ACTION_GATE_POLICY=always-ask makes the hook process emit ask
+  PASS Claude hook manifest wires action-gate to shell and MCP pre-action surfaces
+  PASS Claude hook manifest audits successful tool execution
+  PASS Claude hook manifest audits failed tool execution
+  PASS Claude hook manifest closes unresolved approvals on Stop
+  PASS OpenAI plugin preserves the attribution-aware Codex shell action-gate adapter
+  PASS OpenAI plugin packages an isolated structured MCP pre-action adapter without widening unrelated hooks
+  PASS OpenAI plugin packages an isolated structured MCP post-action audit adapter
+  PASS Codex plugin does not declare unsupported PostToolUseFailure lifecycle event
+  PASS Codex plugin infers action-gate outcome from supported PostToolUse
+  PASS Codex PostToolUse maps zero exit code to success
+  PASS Codex PostToolUse maps non-zero exit code to failure
+  PASS Codex PostToolUse conservatively recognizes failure stderr without exit code
+  PASS OpenAI plugin closes pending approvals at Stop
+  PASS canonical and plugin action-gate rule tables are byte-identical
+  PASS OpenAI plugin packages action-gate runtime
+  FAIL update_pull_request body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  FAIL update_pull_request title defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  FAIL update_pull_request title,body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  FAIL mcp__github__update_pull_request body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  FAIL mcp__github__update_pull_request title defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  FAIL mcp__github__update_pull_request title,body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  FAIL mcp__codex_apps__github__update_pull_request body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  FAIL mcp__codex_apps__github__update_pull_request title defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  FAIL mcp__codex_apps__github__update_pull_request title,body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  FAIL mcp__codex_apps__github_update_pull_request body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  FAIL mcp__codex_apps__github_update_pull_request title defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  FAIL mcp__codex_apps__github_update_pull_request title,body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS metadata with {"state":"closed"} remains gated
+  PASS metadata with {"state":"open"} remains gated
+  PASS metadata with {"state":null} remains gated
+  PASS metadata with {"base_branch":"other"} remains gated
+  PASS metadata with {"maintainer_can_modify":false} remains gated
+  PASS metadata with {"maintainer_can_modify":null} remains gated
+  PASS metadata with {"unknown":true} remains gated
+  PASS metadata with {"title":"mixed","state":"closed"} remains gated
+  PASS metadata with {"draft":true} remains gated
+  PASS metadata with {"base":"other"} remains gated
+  PASS metadata with {"action_descriptor":{"action":"delete"}} remains gated
+  PASS missing or malformed metadata remains gated
+  PASS missing or malformed metadata remains gated
+  PASS missing or malformed metadata remains gated
+  PASS missing or malformed metadata remains gated
+  PASS missing or malformed metadata remains gated
+  PASS missing or malformed metadata remains gated
+  PASS missing or malformed metadata remains gated
+  PASS missing or malformed metadata remains gated
+  PASS mcp__demo__update_pull_requests receives no metadata exception
+  PASS mcp__demo__foo_update_pull_request receives no metadata exception
+  PASS mcp__demo__update_pull_request_and_delete receives no metadata exception
+  PASS mcp__codex_apps__github_update_pull_request_extra receives no metadata exception
+  PASS mcp__demo__merge_pull_request receives no metadata exception
+  PASS mcp__demo__close_pull_request receives no metadata exception
+  PASS claude retains existing mutation rule
+  PASS opencode retains existing mutation rule
+  PASS unknown retains existing mutation rule
+  PASS explicit required metadata gate cannot be bypassed
+  PASS explicit required metadata gate cannot be bypassed
+  PASS explicit required metadata gate cannot be bypassed
+  PASS explicit required metadata gate cannot be bypassed
+
+FAIL: action-gate phase 5 (12 failures)

package/benchmarks/results/codex-pr-metadata-2026-10-26/review-descriptor-green.log

@@ -0,0 +1,192 @@
+=== Issue #85 Phase 5 — Pre-action gate ===
+  PASS production action-gate rule table loads without fallback
+  PASS production rule table is non-empty and keeps the destructive baseline
+  PASS rule table contains git-force-push
+  PASS rule table contains git-reset-hard
+  PASS rule table contains git-clean-force-delete
+  PASS rule table contains recursive-delete
+  PASS rule table contains powershell-recursive-force-delete
+  PASS rule table contains sql-destructive-ddl
+  PASS rule table contains package-publish
+  PASS rule table contains github-release-create
+  PASS rule table contains production-deploy
+  PASS Claude force-push defers to the host permission flow without forcing a prompt
+  PASS deferred decision still names the matched rule
+  PASS matched Claude action is audited as deferred-to-host
+  PASS audit records matched rule
+  PASS audit hashes the exact command payload
+  PASS always-ask policy restores the forced Claude prompt
+  PASS ask decision uses Claude PreToolUse hookSpecificOutput
+  PASS ask reason names the matched rule
+  PASS always-ask action is audited as pending-approval
+  PASS git status passes untouched
+  PASS safe unmatched command creates no gate audit record
+  PASS permission_mode=default defers to the host without a forced prompt
+  PASS audit records permission_mode=default
+  PASS permission_mode=acceptEdits defers to the host without a forced prompt
+  PASS audit records permission_mode=acceptEdits
+  PASS permission_mode=plan defers to the host without a forced prompt
+  PASS audit records permission_mode=plan
+  PASS permission_mode=auto defers to the host without a forced prompt
+  PASS audit records permission_mode=auto
+  PASS permission_mode=dontAsk defers to the host without a forced prompt
+  PASS audit records permission_mode=dontAsk
+  PASS permission_mode=bypassPermissions defers to the host without a forced prompt
+  PASS audit records permission_mode=bypassPermissions
+  PASS permission_mode=missing defers to the host without a forced prompt
+  PASS audit records permission_mode=missing
+  PASS command classification gates destructive action even when router hint says not required
+  PASS router actionGate hint is recorded without controlling enforcement
+  PASS safe command is not gated solely because prompt router predicted risk
+  PASS structured MCP delete is gated before execution
+  PASS audit retains normalized structured action identity
+  PASS structured action audit binds to exact payload hash
+  PASS structured action audit does not persist raw secret arguments
+  PASS read-only MCP fixture passes without a false gate
+  PASS obvious structured mutation is classified from tool identity
+  PASS non-shell local-function destructive fixture uses the same structured gate
+  PASS unknown structured action fails closed when workflow requires a gate
+  PASS unknown structured action is not fabricated as destructive without a gate requirement
+  PASS changed structured payload cannot reuse a prior approval/audit decision
+  PASS PowerShell recursive force delete outside scratch is gated
+  PASS PowerShell recursive force delete inside session scratch is exempt
+  PASS rm -rf outside scratch is gated
+  PASS rm -rf inside OS temp is exempt
+  PASS git reset --hard HEAD matches git-reset-hard
+  PASS git clean -fd matches git-clean-force-delete
+  PASS psql -c "DROP TABLE users" matches sql-destructive-ddl
+  PASS npm publish matches package-publish
+  PASS gh release create v1.2.3 matches github-release-create
+  PASS npm run deploy matches production-deploy
+  PASS host without verified ask-style decision blocks with exit 2
+  PASS non-ask host block reason names the matched rule
+  PASS non-ask host block is audited as rejected
+  PASS internal action-gate error on Claude defers to the host instead of allowing or forcing a prompt
+  PASS internal error is shown to the user as a systemMessage without a permission decision
+  PASS internal error on Claude is audited as deferred-to-host
+  PASS internal action-gate error under always-ask fails closed to ask
+  PASS internal error on host without ask fails closed to block
+  PASS missing/invalid rule table visibly falls back to built-in defaults
+  PASS built-in fallback still classifies and audits destructive action
+  PASS fallback degradation is shown to the user as a systemMessage
+  PASS valid empty rule table does not silently activate built-in defaults
+  PASS empty-table mutation control disables detection, proving production non-empty assertion is meaningful
+  PASS null-prototype serialization preserves an own __proto__ key
+  PASS own __proto__ key changes the full-input digest
+  PASS PostToolUse closes a deferred payload as executed
+  PASS executed audit keeps exact approved payload hash
+  PASS PostToolUseFailure records attempted execution without pretending success
+  PASS post-tool payload mismatch is never accepted as the approved command
+  PASS Stop closes unexecuted deferred and pending payloads
+  PASS unexecuted deferred payload is audited as rejected
+  PASS unexecuted always-ask approval is audited as rejected
+  PASS hook process returns no decision for a matched command under the default policy
+  PASS hook process audits the deferred command with its permission mode
+  PASS HARNESS_ACTION_GATE_POLICY=always-ask makes the hook process emit ask
+  PASS Claude hook manifest wires action-gate to shell and MCP pre-action surfaces
+  PASS Claude hook manifest audits successful tool execution
+  PASS Claude hook manifest audits failed tool execution
+  PASS Claude hook manifest closes unresolved approvals on Stop
+  PASS OpenAI plugin preserves the attribution-aware Codex shell action-gate adapter
+  PASS OpenAI plugin packages an isolated structured MCP pre-action adapter without widening unrelated hooks
+  PASS OpenAI plugin packages an isolated structured MCP post-action audit adapter
+  PASS Codex plugin does not declare unsupported PostToolUseFailure lifecycle event
+  PASS Codex plugin infers action-gate outcome from supported PostToolUse
+  PASS Codex PostToolUse maps zero exit code to success
+  PASS Codex PostToolUse maps non-zero exit code to failure
+  PASS Codex PostToolUse conservatively recognizes failure stderr without exit code
+  PASS OpenAI plugin closes pending approvals at Stop
+  PASS canonical and plugin action-gate rule tables are byte-identical
+  PASS OpenAI plugin packages action-gate runtime
+  PASS update_pull_request body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS update_pull_request title defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS update_pull_request title,body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS mcp__github__update_pull_request body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS mcp__github__update_pull_request title defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS mcp__github__update_pull_request title,body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS mcp__codex_apps__github__update_pull_request body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS mcp__codex_apps__github__update_pull_request title defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS mcp__codex_apps__github__update_pull_request title,body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS mcp__codex_apps__github_update_pull_request body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS mcp__codex_apps__github_update_pull_request title defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS mcp__codex_apps__github_update_pull_request title,body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS provider-neutral selectors support metadata updates
+  PASS provider-neutral selectors support metadata updates
+  PASS own __proto__ field cannot escape the argument allowlist
+  PASS explicit higher-risk action cannot inherit metadata deferral
+  PASS metadata with {"state":"closed"} remains gated
+  PASS metadata with {"state":"open"} remains gated
+  PASS metadata with {"state":null} remains gated
+  PASS metadata with {"base_branch":"other"} remains gated
+  PASS metadata with {"maintainer_can_modify":false} remains gated
+  PASS metadata with {"maintainer_can_modify":null} remains gated
+  PASS metadata with {"unknown":true} remains gated
+  PASS metadata with {"title":"mixed","state":"closed"} remains gated
+  PASS metadata with {"draft":true} remains gated
+  PASS metadata with {"base":"other"} remains gated
+  PASS metadata with {"action_descriptor":{"action":"delete"}} remains gated
+  PASS missing or malformed metadata remains gated
+  PASS missing or malformed metadata remains gated
+  PASS missing or malformed metadata remains gated
+  PASS missing or malformed metadata remains gated
+  PASS missing or malformed metadata remains gated
+  PASS missing or malformed metadata remains gated
+  PASS missing or malformed metadata remains gated
+  PASS missing or malformed metadata remains gated
+  PASS mcp__demo__update_pull_requests receives no metadata exception
+  PASS mcp__demo__foo_update_pull_request receives no metadata exception
+  PASS mcp__demo__update_pull_request_and_delete receives no metadata exception
+  PASS mcp__codex_apps__github_update_pull_request_extra receives no metadata exception
+  PASS mcp__demo__merge_pull_request receives no metadata exception
+  PASS mcp__demo__close_pull_request receives no metadata exception
+  PASS claude retains existing mutation rule
+  PASS opencode retains existing mutation rule
+  PASS unknown retains existing mutation rule
+  PASS explicit required metadata gate cannot be bypassed
+  PASS explicit required metadata gate cannot be bypassed
+  PASS explicit required metadata gate cannot be bypassed
+  PASS explicit required metadata gate cannot be bypassed
+  PASS known Codex PR mutation cannot be downgraded to read
+  PASS downgrade refusal remains an audited mutation
+  PASS known Codex PR mutation cannot be downgraded to read
+  PASS downgrade refusal remains an audited mutation
+  PASS known Codex PR mutation cannot be downgraded to read
+  PASS downgrade refusal remains an audited mutation
+  PASS input read descriptor cannot hide a required PR mutation gate
+  PASS known Codex PR mutation cannot be downgraded to unknown
+  PASS downgrade refusal remains an audited mutation
+  PASS known Codex PR mutation cannot be downgraded to unknown
+  PASS downgrade refusal remains an audited mutation
+  PASS known Codex PR mutation cannot be downgraded to unknown
+  PASS downgrade refusal remains an audited mutation
+  PASS input unknown descriptor cannot hide a required PR mutation gate
+  PASS provider namespace read token cannot downgrade exact PR mutation
+  PASS claude explicit descriptor behavior remains unchanged
+  PASS opencode explicit descriptor behavior remains unchanged
+  PASS unknown explicit descriptor behavior remains unchanged
+  PASS required hint envelope 0 wins over optional envelopes
+  PASS audit retains required hint instead of a conflicting optional hint
+  PASS PR creation still honors the documented explicit required gate
+  PASS required hint envelope 1 wins over optional envelopes
+  PASS audit retains required hint instead of a conflicting optional hint
+  PASS PR creation still honors the documented explicit required gate
+  PASS required hint envelope 2 wins over optional envelopes
+  PASS audit retains required hint instead of a conflicting optional hint
+  PASS PR creation still honors the documented explicit required gate
+  PASS required hint envelope 3 wins over optional envelopes
+  PASS audit retains required hint instead of a conflicting optional hint
+  PASS PR creation still honors the documented explicit required gate
+
+PASS: action-gate phase 5 (0 failures)