harness-everything 0.41.3 → 0.42.1

package/ci/mechanism-341-opencode-lane.test.js

@@ -0,0 +1,465 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { pathToFileURL } = require('node:url');
+const { test } = require('node:test');
+
+const ROOT = path.resolve(__dirname, '..');
+const STOP_GATE = path.join(ROOT, 'hooks/scripts/workflow-stop-gate.js');
+const PILOT = path.join(ROOT, 'hooks/scripts/lib/doc-reconciliation-pilot.js');
+const savedEnv = Object.fromEntries(['HOME', 'HARNESS_STATE_HOME', 'HARNESS_WORKSPACE_ROOT', 'HARNESS_DOC_RECONCILIATION_PILOT'].map(key => [key, process.env[key]]));
+
+function git(cwd, args) {
+  const env = { ...process.env, GIT_AUTHOR_NAME: 'Harness test', GIT_AUTHOR_EMAIL: 'harness@example.invalid', GIT_COMMITTER_NAME: 'Harness test', GIT_COMMITTER_EMAIL: 'harness@example.invalid' };
+  for (const key of Object.keys(env)) if (key.startsWith('GIT_') && !['GIT_AUTHOR_NAME', 'GIT_AUTHOR_EMAIL', 'GIT_COMMITTER_NAME', 'GIT_COMMITTER_EMAIL'].includes(key)) delete env[key];
+  return spawnSync('git', ['-C', cwd, ...args], { encoding: 'utf8', env });
+}
+
+function runJson(script, cwd, input, env = {}) {
+  return spawnSync(process.execPath, [script], {
+    cwd: ROOT,
+    encoding: 'utf8',
+    input: JSON.stringify(input),
+    env: { ...process.env, ...env },
+  });
+}
+
+function makeFixture() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-341-opencode-workspace-'));
+  const stateHome = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-341-opencode-state-'));
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-341-opencode-home-'));
+  fs.mkdirSync(path.join(root, '.agents/harness-everything'), { recursive: true });
+  fs.mkdirSync(path.join(root, 'docs/adr'), { recursive: true });
+  fs.writeFileSync(path.join(root, '.agents/harness-everything/project-docs.json'), JSON.stringify({ governed: [{ path: 'docs/adr/**', role: 'adr' }], domains: ['GRPH'] }, null, 2) + '\n');
+  fs.writeFileSync(path.join(root, 'docs/adr/GRPH-001.md'), '# GRPH-001 Retry\n\nCheckout MUST retry once.\n');
+  fs.writeFileSync(path.join(root, 'package.json'), JSON.stringify({ name: 'fixture', version: '1.0.0', scripts: { test: 'node -e "process.exit(0)"' } }, null, 2));
+  const init = git(root, ['init', '-q']);
+  assert.equal(init.status, 0, init.stderr);
+  assert.equal(git(root, ['add', '-A']).status, 0);
+  assert.equal(git(root, ['-c', 'commit.gpgsign=false', 'commit', '-q', '-m', 'baseline']).status, 0);
+  fs.writeFileSync(path.join(root, 'docs/adr/GRPH-001.md'), '# GRPH-001 Retry\n\nCheckout MUST retry twice.\n');
+  process.env.HOME = home;
+  process.env.HARNESS_STATE_HOME = stateHome;
+  process.env.HARNESS_WORKSPACE_ROOT = root;
+  process.env.HARNESS_DOC_RECONCILIATION_PILOT = '1';
+  return {
+    root, stateHome, home,
+    cleanup: () => {
+      for (const directory of [root, stateHome, home]) fs.rmSync(directory, { recursive: true, force: true });
+    },
+  };
+}
+
+function seedWorkflow(fixture, sessionId) {
+  const payload = { session_id: sessionId, cwd: fixture.root, host_id: 'opencode' };
+  const { getSessionDir } = require(path.join(ROOT, 'hooks/scripts/lib/harness-state.js'));
+  const sessionDir = getSessionDir(fixture.root, sessionId, payload);
+  const plan = { strategySelection: 'selected', tier: 'tier2', strategy: 'iterative-single' };
+  const context = {
+    root: fixture.root,
+    sessionId,
+    sessionDir,
+    file: path.join(sessionDir, 'workflow-run.json'),
+    workflow: {
+      schemaVersion: 1,
+      workflowId: `wf-${sessionId}`,
+      revision: 1,
+      sessionId,
+      tier: 'tier2',
+      strategy: 'iterative-single',
+      state: 'running',
+      workflowPlan: plan,
+    },
+  };
+  const obligations = require(path.join(ROOT, 'hooks/scripts/lib/workflow-obligations.js'));
+  obligations.initializePlanningContract(context, plan);
+  obligations.recordPlanning(context, JSON.stringify([
+    { id: 'edit-doc', stepType: 'behavior-change', summary: 'Revise the governed retry requirement', acceptance: 'the normative requirement is updated' },
+    { id: 'verify-doc', stepType: 'verification', summary: 'Verify the governed retry change', acceptance: 'the objective checks are recorded' },
+  ]), plan, plan.strategy, 'fixture workflow for the OpenCode reconciliation path');
+  obligations.materializeExecutionObligations(context, plan);
+  require(PILOT).captureBaseline(context);
+  require(path.join(ROOT, 'hooks/scripts/lib/workflow-runtime.js')).saveWorkflow(context);
+  return { sessionDir, payload };
+}
+
+function writeEditState(sessionDir, values) {
+  fs.writeFileSync(path.join(sessionDir, 'edit-state.json'), JSON.stringify({
+    lastEditTime: null,
+    verificationPending: false,
+    editsSinceVerification: 0,
+    followUpPending: false,
+    followUpDeliveryPending: false,
+    followUpMessage: null,
+    lastFollowUpError: null,
+    sessionStart: Date.now(),
+    ...values,
+  }));
+}
+
+function createEventStream() {
+  const queued = [];
+  const waiters = [];
+  let last = null;
+  let closed = false;
+  return {
+    subscribe(signal) {
+      const iterator = {
+        next() {
+          if (last) { last.resolve(); last = null; }
+          if (queued.length) {
+            last = queued.shift();
+            return Promise.resolve({ value: last.value, done: false });
+          }
+          if (closed) return Promise.resolve({ done: true });
+          return new Promise(resolve => waiters.push(resolve));
+        },
+        return() { closed = true; return Promise.resolve({ done: true }); },
+      };
+      signal.addEventListener('abort', () => {
+        closed = true;
+        while (waiters.length) waiters.shift()({ done: true });
+      }, { once: true });
+      return { [Symbol.asyncIterator]: () => iterator };
+    },
+    async dispatch(value) {
+      await new Promise(resolve => {
+        const item = { value, resolve };
+        if (waiters.length) {
+          if (last) { last.resolve(); last = null; }
+          last = item;
+          waiters.shift()({ value, done: false });
+        } else queued.push(item);
+      });
+    },
+  };
+}
+
+async function startPlugin(workspace) {
+  const plugin = await import(pathToFileURL(path.join(ROOT, 'opencode-plugin/index.mjs')).href);
+  const registered = new Map();
+  const stream = createEventStream();
+  const dispose = await plugin.default.setup({
+    location: { directory: workspace },
+    tool: { hook: async (name, callback) => registered.set(name, callback) },
+    session: { prompt: async () => ({}) },
+    event: { subscribe: ({ signal }) => stream.subscribe(signal) },
+  });
+  return { registered, stream, dispose };
+}
+
+function canonicalJson(value) {
+  if (Array.isArray(value)) return value.map(canonicalJson);
+  if (value && typeof value === 'object') return Object.fromEntries(Object.keys(value).sort().map(key => [key, canonicalJson(value[key])]));
+  return value;
+}
+
+function restoreEnv() {
+  for (const [key, value] of Object.entries(savedEnv)) {
+    if (value === undefined) delete process.env[key];
+    else process.env[key] = value;
+  }
+}
+
+test('existing Stop consumer writes a refused report without qualification', () => {
+  const fixture = makeFixture();
+  try {
+    const control = seedWorkflow(fixture, 'stop-positive-control');
+    const result = runJson(STOP_GATE, fixture.root, control.payload);
+    const reportPath = path.join(control.sessionDir, 'doc-reconciliation-pilot.json');
+    const report = fs.existsSync(reportPath) ? JSON.parse(fs.readFileSync(reportPath, 'utf8')) : null;
+    assert.equal(result.status, 0, result.stderr);
+    assert.equal(report?.pilotStatus, 'unresolved');
+    assert.equal(report?.pilotCredit, false);
+    assert.ok(report?.diagnostics?.length, 'existing consumer must retain a refusal diagnostic');
+  } finally {
+    fixture.cleanup();
+    restoreEnv();
+  }
+});
+
+test('OpenCode capture → idle Stop whole path is refused without live qualification', async () => {
+  const fixture = makeFixture();
+  const findings = [];
+  let dispose;
+  let originalAssess;
+  try {
+    const sessionId = 'native-v2-whole-path';
+    const { sessionDir } = seedWorkflow(fixture, sessionId);
+    const pilot = require(PILOT);
+    originalAssess = pilot.assess;
+    const assessmentSessions = [];
+    pilot.assess = function (context, ...args) {
+      assessmentSessions.push(context?.sessionId);
+      return originalAssess.call(this, context, ...args);
+    };
+
+    const plugin = await startPlugin(fixture.root);
+    dispose = plugin.dispose;
+    const nativeResult = { output: 'private-result-body', metadata: { exit: 0 } };
+    await plugin.registered.get('execute.after')({
+      tool: 'edit', sessionID: sessionId, id: 'call-1', messageID: 'message-1',
+      status: 'completed', result: nativeResult,
+      input: { filePath: path.join(fixture.root, 'docs/adr/GRPH-001.md') },
+    });
+    await plugin.registered.get('execute.after')({
+      tool: 'bash', sessionID: sessionId, id: 'call-2', messageID: 'message-2',
+      status: 'completed', error: { name: 'NativeError', message: 'native command error', code: 'NATIVE_FAILURE' },
+      input: { command: 'doc-check' },
+    });
+
+    const journal = path.join(sessionDir, 'opencode-captures.jsonl');
+    let records = [];
+    if (fs.existsSync(journal)) {
+      const lines = fs.readFileSync(journal, 'utf8').trim().split(/\r?\n/);
+      records = lines.map(line => JSON.parse(line));
+    }
+    const canonical = JSON.stringify(canonicalJson(nativeResult));
+    const record = records[0];
+    const errorRecord = records[1];
+    if (records.length !== 2 || !record || record.hostId !== 'opencode' || record.session_id !== sessionId || record.call_id !== 'call-1' ||
+        record.message_id !== 'message-1' || record.status !== 'completed' || record.exit !== 0 ||
+        record.cwd !== undefined || record.result_digest !== crypto.createHash('sha256').update(canonical).digest('hex') ||
+        record.result_bytes !== Buffer.byteLength(canonical) || fs.readFileSync(journal, 'utf8').includes('private-result-body')) {
+      findings.push(`native result was not retained as one host-labelled digest-only record: ${JSON.stringify(record)}`);
+    }
+    if (!errorRecord || errorRecord.hostId !== 'opencode' || errorRecord.call_id !== 'call-2' ||
+        errorRecord.error?.name !== 'NativeError' || errorRecord.error?.message !== 'native command error' ||
+        errorRecord.error?.code !== 'NATIVE_FAILURE' || errorRecord.exit === 0) {
+      findings.push(`native error was not preserved as failure without fabricated exit zero: ${JSON.stringify(errorRecord)}`);
+    }
+
+    await plugin.stream.dispatch({ type: 'session.idle', sessionID: sessionId });
+    const reportPath = path.join(sessionDir, 'doc-reconciliation-pilot.json');
+    const report = fs.existsSync(reportPath) ? JSON.parse(fs.readFileSync(reportPath, 'utf8')) : null;
+    if (assessmentSessions.filter(id => id === sessionId).length !== 1) {
+      findings.push(`idle Stop dispatch count=${assessmentSessions.filter(id => id === sessionId).length}, expected exactly one`);
+    }
+    if (!report || report.pilotCredit !== false || report.pilotStatus !== 'unresolved' || !report.diagnostics?.length) {
+      findings.push(`idle did not write the actual refused/unavailable report: ${JSON.stringify(report)}`);
+    }
+    assert.deepEqual(findings, []);
+  } finally {
+    if (dispose) dispose();
+    if (originalAssess) require(PILOT).assess = originalAssess;
+    fixture.cleanup();
+    restoreEnv();
+  }
+});
+
+test('session idle dispatches the real consumer once across every existing early return', async () => {
+  const fixture = makeFixture();
+  let dispose;
+  const findings = [];
+  const pilot = require(PILOT);
+  const originalAssess = pilot.assess;
+  const assessmentSessions = [];
+  pilot.assess = function (context, ...args) {
+    assessmentSessions.push(context?.sessionId);
+    return originalAssess.call(this, context, ...args);
+  };
+  try {
+    const plugin = await startPlugin(fixture.root);
+    dispose = plugin.dispose;
+    const cases = [
+      ['follow-up-pending', { followUpPending: true }],
+      ['follow-up-delivery-pending', { followUpDeliveryPending: true, followUpMessage: 'deliver once' }],
+      ['no-verification-pending', { verificationPending: false, editsSinceVerification: 0 }],
+      ['verification-succeeds', { verificationPending: true, editsSinceVerification: 1 }],
+    ];
+    for (const [suffix, state] of cases) {
+      const sessionId = `idle-${suffix}`;
+      const { sessionDir } = seedWorkflow(fixture, sessionId);
+      writeEditState(sessionDir, state);
+      await plugin.stream.dispatch({ type: 'session.idle', sessionID: sessionId });
+      const reportPath = path.join(sessionDir, 'doc-reconciliation-pilot.json');
+      const report = fs.existsSync(reportPath) ? JSON.parse(fs.readFileSync(reportPath, 'utf8')) : null;
+      if (assessmentSessions.filter(id => id === sessionId).length !== 1) {
+        findings.push(`${suffix}: consumer assessment count=${assessmentSessions.filter(id => id === sessionId).length}, expected exactly one`);
+      }
+      if (!report || report.pilotCredit !== false || report.pilotStatus !== 'unresolved') {
+        findings.push(`${suffix}: expected one refused/unavailable report, received ${JSON.stringify(report)}`);
+      }
+    }
+    const cleanupSession = 'idle-no-verification-pending';
+    await plugin.stream.dispatch({ type: 'session.idle', sessionID: cleanupSession });
+    if (assessmentSessions.filter(id => id === cleanupSession).length !== 2) {
+      findings.push(`finally did not release the per-session idle guard for a second event: ${assessmentSessions.filter(id => id === cleanupSession).length} assessments`);
+    }
+    assert.deepEqual(findings, []);
+  } finally {
+    if (dispose) dispose();
+    pilot.assess = originalAssess;
+    fixture.cleanup();
+    restoreEnv();
+  }
+});
+
+test('V1/no-status, pilot-OFF, no-workflow, and Claude host controls stay fail-closed', async () => {
+  const fixture = makeFixture();
+  let dispose;
+  try {
+    const plugin = await startPlugin(fixture.root);
+    dispose = plugin.dispose;
+
+    const v1Session = 'v1-no-status';
+    const { sessionDir: v1Dir } = seedWorkflow(fixture, v1Session);
+    await plugin.registered.get('execute.after')({
+      tool: 'edit', sessionID: v1Session, id: 'v1-call', input: { filePath: path.join(fixture.root, 'docs/adr/GRPH-001.md') },
+    });
+    assert.equal(fs.existsSync(path.join(v1Dir, 'opencode-captures.jsonl')), false, 'V1/no-status output must not create a native capture');
+
+    const noWorkflow = 'no-workflow';
+    const { getSessionDir } = require(path.join(ROOT, 'hooks/scripts/lib/harness-state.js'));
+    const noWorkflowDir = getSessionDir(fixture.root, noWorkflow, { session_id: noWorkflow, cwd: fixture.root, host_id: 'opencode' });
+    await plugin.stream.dispatch({ type: 'session.idle', sessionID: noWorkflow });
+    assert.equal(fs.existsSync(path.join(noWorkflowDir, 'doc-reconciliation-pilot.json')), false, 'no workflow must not write a pilot report');
+
+    const offSession = 'pilot-off';
+    const { sessionDir: offDir } = seedWorkflow(fixture, offSession);
+    process.env.HARNESS_DOC_RECONCILIATION_PILOT = '0';
+    await plugin.stream.dispatch({ type: 'session.idle', sessionID: offSession });
+    assert.equal(fs.existsSync(path.join(offDir, 'doc-reconciliation-pilot.json')), false, 'pilot OFF must not write a reconciliation report');
+
+    const { createClaudeOriginProvider } = require(path.join(ROOT, 'hooks/scripts/lib/doc-reconciliation-provider.js'));
+    const claudeProvider = createClaudeOriginProvider({ hostId: 'opencode', sessionId: 'native-host-control' });
+    const claudeContext = claudeProvider.resolveContext({ workspaceRoot: fixture.root });
+    assert.equal(claudeContext.status, 'unavailable', 'OpenCode must not enter through Claude provider semantics');
+    assert.ok(claudeContext.diagnostics.some(item => item.code === 'unsupported-host'));
+  } finally {
+    if (dispose) dispose();
+    fixture.cleanup();
+    restoreEnv();
+  }
+});
+
+const OPENCODE_SESSION = 'provider-session';
+const OPENCODE_QUALIFICATION = {
+  source: 'fake-test-fixture', faked: true, toolUseIdPopulated: true, agentIdPopulated: true,
+};
+
+function opencodeCapture(overrides = {}) {
+  return {
+    schema: 'opencode-capture-record/1', hostId: 'opencode', session_id: OPENCODE_SESSION,
+    call_id: 'provider-call', tool: 'bash', command: 'npm test', cwd: ROOT,
+    status: 'completed', exit: 0, result_digest: 'a'.repeat(64), result_bytes: 1,
+    observedIdentity: { workflowId: 'provider-workflow', workflowRevision: 3, baselinePin: null },
+    ...overrides,
+  };
+}
+
+function opencodeProvider(captures, overrides = {}) {
+  const { createOpencodeOriginProvider } = require(path.join(ROOT, 'hooks/scripts/lib/doc-reconciliation-provider.js'));
+  return createOpencodeOriginProvider({
+    hostId: 'opencode', sessionId: OPENCODE_SESSION, workspaceRoot: ROOT,
+    workflowId: 'provider-workflow', workflowRevision: 3, taskId: 'provider-task',
+    principals: { author: 'provider-author', executors: ['provider-executor'] },
+    qualification: OPENCODE_QUALIFICATION, captures,
+    ...overrides,
+  });
+}
+
+function diagnosticCode(result) { return result.diagnostics?.[0]?.code; }
+
+test('fake-DI OpenCode origin accepts the complete native execution record shape', () => {
+  const provider = opencodeProvider([opencodeCapture({ unrecognizedPrivateField: 'must-not-leak' })]);
+  const context = provider.resolveContext({ workspaceRoot: ROOT });
+  const result = provider.resolveEvent({
+    reference: 'provider-call',
+    identity: { workspaceId: 'ws-provider', sessionId: OPENCODE_SESSION, workflowId: 'provider-workflow', workflowRevision: 3 },
+  });
+  assert.equal(context.status, 'accepted');
+  assert.match(context.originRef, /^origin:\/\/opencode\//);
+  assert.equal(context.context.activeHost, 'opencode');
+  assert.equal(result.status, 'accepted');
+  assert.equal(result.originRef, context.originRef);
+  assert.equal(result.event.originRef, context.originRef);
+  assert.deepEqual(Object.keys(result.event).sort(), [
+    'argv', 'artifactDigests', 'captured', 'capability', 'command', 'cwd', 'endIdentity', 'eventId',
+    'exitCode', 'identity', 'kind', 'originRef', 'paths', 'principalId', 'producerId', 'provenance', 'resultRef',
+    'signal', 'startIdentity', 'toolCorrelationId',
+  ].sort());
+  assert.equal(result.event.producerId, 'opencode-origin-provider');
+  assert.equal(result.event.capability, 'shell-command');
+  assert.equal(result.event.kind, 'execution');
+  assert.equal(result.event.exitCode, 0);
+  assert.equal(result.event.cwd, ROOT);
+  assert.equal(result.event.toolCorrelationId, 'provider-call');
+  assert.equal(result.event.captured.responseDigest, 'a'.repeat(64));
+  assert.deepEqual(result.correlation, { toolCorrelationId: 'provider-call', resultRef: result.event.resultRef });
+
+  const emptyResultDigest = crypto.createHash('sha256').update('').digest('hex');
+  const minimum = opencodeProvider([opencodeCapture({ call_id: 'empty-result', result_digest: emptyResultDigest, result_bytes: 0 })])
+    .resolveEvent({ reference: 'empty-result', identity: { workflowId: 'provider-workflow' } });
+  assert.equal(minimum.status, 'accepted', 'zero result bytes are the valid minimum boundary');
+  assert.equal(minimum.event.captured.responseDigest, emptyResultDigest);
+});
+
+test('production OpenCode qualification remains unmet with otherwise valid origin input', () => {
+  const provider = opencodeProvider([opencodeCapture()], { qualification: undefined });
+  const context = provider.resolveContext({ workspaceRoot: ROOT });
+  const result = provider.resolveEvent({ reference: 'provider-call', identity: { workflowId: 'provider-workflow' } });
+  assert.equal(context.status, 'unavailable');
+  assert.equal(diagnosticCode(context), 'live-gate-unmet');
+  assert.equal(result.status, 'unavailable');
+  assert.equal(diagnosticCode(result), 'live-gate-unmet');
+});
+
+test('OpenCode provider rejects native error, incomplete outcome, and missing cwd', () => {
+  const cases = [
+    ['native-error', { error: { name: 'Error', message: 'failed' } }, 'failure-not-credited', 'provider-call'],
+    ['missing-status', { status: undefined }, 'outcome-ambiguous', 'provider-call'],
+    ['empty-status', { status: '' }, 'outcome-ambiguous', 'provider-call'],
+    ['null-status', { status: null }, 'outcome-ambiguous', 'provider-call'],
+    ['wrong-type-status', { status: 1 }, 'outcome-ambiguous', 'provider-call'],
+    ['ambiguous-status', { status: 'running' }, 'outcome-ambiguous', 'provider-call'],
+    ['missing-process-exit', { exit: undefined }, 'outcome-ambiguous', 'provider-call'],
+    ['negative-result-bytes', { result_bytes: -1 }, 'stdout-withheld', 'provider-call'],
+    ['missing-doc-check-cwd', { cwd: undefined, command: 'node harness-everything/scripts/doc-check.js' }, 'unregistered-command', 'provider-call#doc-lint'],
+  ];
+  for (const [name, changes, expected, reference] of cases) {
+    const result = opencodeProvider([opencodeCapture(changes)]).resolveEvent({ reference, identity: { workflowId: 'provider-workflow' } });
+    assert.equal(result.status, 'rejected', `${name}: ${JSON.stringify(result)}`);
+    assert.equal(diagnosticCode(result), expected, name);
+  }
+});
+
+test('OpenCode provider rejects malformed references and unsupported host input', () => {
+  const invalidReference = opencodeProvider([opencodeCapture()]).resolveEvent({ reference: '' });
+  assert.equal(invalidReference.status, 'unavailable');
+  assert.equal(diagnosticCode(invalidReference), 'invalid-input');
+
+  const unsupportedContext = opencodeProvider([], { hostId: 'codex' }).resolveContext({ workspaceRoot: ROOT });
+  assert.equal(unsupportedContext.status, 'unavailable');
+  assert.equal(diagnosticCode(unsupportedContext), 'unsupported-host');
+
+  const unsupportedEvent = opencodeProvider([], { hostId: 'claude-code' }).resolveEvent({ reference: 'provider-call' });
+  assert.equal(unsupportedEvent.status, 'unavailable');
+  assert.equal(diagnosticCode(unsupportedEvent), 'unsupported-host');
+});
+
+test('OpenCode provider rejects stale, replayed, and Claude-origin records', () => {
+  const identity = { workflowId: 'provider-workflow', workflowRevision: 3 };
+  const stale = opencodeCapture({ observedIdentity: { workflowId: 'provider-workflow', workflowRevision: 2, baselinePin: null } });
+  assert.equal(diagnosticCode(opencodeProvider([stale]).resolveEvent({ reference: stale.call_id, identity })), 'identity-mismatch');
+
+  const first = opencodeCapture({ call_id: 'first-call' });
+  const replay = opencodeCapture({ call_id: 'replayed-call' });
+  const replayProvider = opencodeProvider([first, replay]);
+  assert.equal(diagnosticCode(replayProvider.resolveEvent({ reference: replay.call_id, identity })), 'replayed-record');
+
+  const claudeRecord = opencodeCapture({ hostId: 'claude-code' });
+  assert.equal(diagnosticCode(opencodeProvider([claudeRecord]).resolveEvent({ reference: claudeRecord.call_id, identity })), 'record-origin-mismatch');
+});
+
+test('OpenCode quality-review record is refused when reviewer equals the author', () => {
+  const record = opencodeCapture({ agent_id: 'provider-author' });
+  const result = opencodeProvider([record]).resolveEvent({ reference: `${record.call_id}#quality-review` });
+  assert.equal(result.status, 'rejected');
+  assert.equal(diagnosticCode(result), 'reviewer-not-independent');
+});

package/ci/mechanism-task-git-authorization.test.js

@@ -131,6 +131,18 @@ try {
   }));
   assert.strictEqual(neutralResult.status, 0, 'exact create_pull_request operation must be host-deferred on Codex (currently exits 2: RED)');
 
+  for (const tool of ['mcp__codex_apps__github__update_pull_request', 'mcp__codex_apps__github_update_pull_request', 'mcp__github__update_pull_request']) {
+    for (const fields of [{ body: 'replacement body' }, { title: 'replacement title' }, { title: 'both', body: '' }]) {
+      const result = run(payload(tool, { repository_full_name: 'acme/repo', pr_number: 1, ...fields }));
+      assert.strictEqual(result.status, 0, 'metadata-only actual stdin payload must be host-deferred');
+      assert.strictEqual(result.stdout.trim(), '', 'metadata deferral must emit no permission decision');
+    }
+    const denied = run(payload(tool, { repository_full_name: 'acme/repo', pr_number: 1, body: 'mixed', state: 'closed' }));
+    assert.strictEqual(denied.status, 2, 'mixed metadata/state actual stdin payload must fail closed');
+    assert.strictEqual(denied.stdout.trim(), '');
+    assert.match(denied.stderr, /structured-mutate/);
+  }
+
   // Genuine mutations remain blocked, but the fixed-format approval protocol is retired.
   const legacyMutation = run(payload('mcp__demo__update_issue', { issue_id: 1, title: 'changed' }));
   assert.strictEqual(legacyMutation.status, 2, 'genuine mutation must remain blocked on Codex');

package/docs/codex-action-gate.md

@@ -132,7 +132,8 @@ Harness does not parse, bind, or intercept any fixed approval syntax in user
 prompts. Native agent task-scope authorization and native permissions remain
 authoritative.
 
-Routine exact `create_pull_request` operations are host-deferred (below). All
+Routine exact `create_pull_request` operations and Codex title/body-only
+`update_pull_request` operations are host-deferred (below). All
 other risky actions (merge/delete/deploy/publish/send/force-push and unrelated
 genuine mutations) remain hard PreToolUse blocks; an explicitly required
 `actionGate` hint still gates. These are deterministic mechanism changes, not
@@ -153,3 +154,28 @@ risky actions (merge/delete/deploy/publish/send/force-push and unrelated genuine
 mutations) remain gated; exact operation matching is used, with no substring
 exemption, so misleading names such as `create_pull_requests` or
 `foo_create_pull_request` still block.
+
+
+## Codex PR title/body updates (host-deferred)
+
+The Codex-only metadata exception checks the actual tool input, with all of these conditions:
+
+- Exact final `__` operation `update_pull_request`, or exact flattened connector name `mcp__codex_apps__github_update_pull_request`.
+- A non-array object containing at least one string `title` or `body` (empty body is supported).
+- Only `title`, `body`, and selector keys `repository_full_name`, `pr_number`, `owner`, `repo`, `pullNumber`, `pull_number` are present.
+- Exact Codex PR updates cannot be downgraded to `read`/`unknown` by an explicit descriptor or a provider namespace; higher-risk action descriptors remain gated. Their tool family comes from the actual tool identity, so a descriptor cannot disguise the MCP update as shell input.
+- No explicit required `actionGate` hint in any supported envelope (a required hint wins over conflicting optional hints); the action descriptor remains `mutate`/`gated`.
+
+Any additional key, including `state`, `base_branch`, `base`, `maintainer_can_modify`, `draft`, or an unknown key, prevents the exception, even when its value is null. Mixed metadata/high-risk inputs and similar operation names retain the existing Gate. Claude, OpenCode and unknown hosts retain their prior mutation rules. PR creation behavior is unchanged.
+
+```mermaid
+flowchart LR
+  A["Exact PR update + actual arguments"] --> B{"Codex + title/body only<br/>+ no required Gate?"}
+  B -->|Yes| C["Host-deferred mutation<br/>no permission decision"]
+  B -->|No| D["Existing structured Gate"]
+  C --> E["Native task scope + permissions<br/>+ GitHub authorization"]
+```
+
+Host-deferred does not grant authorization. Harness emits no `permissionDecision` allow/ask; native permissions, task scope, and GitHub access still decide execution. The audit records `routine-pr-metadata-update`, `deferred-to-host`, host/tool provenance and the exact payload hash, without storing title/body. PostToolUse records execution success/failure; Stop rejects an unexecuted deferral. A changed payload cannot reuse the original hash.
+
+Evidence: [RED/GREEN and independent review](../benchmarks/results/codex-pr-metadata-2026-10-26/README.md). Package/mechanism verification is separate from live Host verification (#110, #122, #135; affected PR #376).

package/docs/doc-workflow-reconciliation.md

@@ -6,7 +6,7 @@ status: active
 # Document workflow reconciliation — Phase 3b S1 runtime
 
 **Status: the runtime ships default OFF; opt in with `HARNESS_DOC_RECONCILIATION_PILOT=1`.
-With the pilot ON, F4 ([#358](https://github.com/dyphn1/Harness-everything/pull/358)) grants limited positive credit for exactly `doc-lint` and `link-check`, from a host-captured run of the installed doc-check on Claude Code 2.1.309 (live runs 4–5). S3 provider integration is pending; E1 has not started.**
+With the pilot ON, F4 ([#358](https://github.com/dyphn1/Harness-everything/pull/358)) grants limited positive credit for exactly `doc-lint` and `link-check`, from a host-captured run of the installed doc-check on Claude Code 2.1.309 (live runs 4–5). S3 provider integration is pending; E1 remains OPEN with insufficient qualifying exposure. The recorded OpenCode [D1/D2 attempts](../benchmarks/results/live-host/opencode-d1-d2-2026-10-25/README.md) do not qualify as E1 cycles.**
 This document refines the [document lifecycle contract](document-lifecycle.md#phase-3b--narrow-integration-contract-s1-default-off-f4-limited-credit).
 The [accepted E0](https://github.com/dyphn1/Harness-everything/issues/341#issuecomment-6308604128)
 permits this limited, reversible consumer under the
@@ -336,7 +336,7 @@ Preparation assertion rows do not carry `reportOrigin`; the S1 runtime report ca
 marker is never presented as a production report.
 ## S1 — switch, trusted scope and fail-closed no-credit gate
 
-**S1 runtime ships default OFF (`HARNESS_DOC_RECONCILIATION_PILOT=1` opts in). With the pilot ON, F4 (#358) grants limited positive credit for `doc-lint` and `link-check` only; S3 provider integration is pending and E1 has not started.**
+**S1 runtime ships default OFF (`HARNESS_DOC_RECONCILIATION_PILOT=1` opts in). With the pilot ON, F4 (#358) grants limited positive credit for `doc-lint` and `link-check` only; S3 provider integration is pending; E1 remains OPEN with insufficient qualifying exposure, and D1/D2 are non-qualifying.**
 The [accepted E0](https://github.com/dyphn1/Harness-everything/issues/341#issuecomment-6308604128)
 permits this limited implementation; the [posted execution plan](https://github.com/dyphn1/Harness-everything/issues/325)
 orders Docs → RED → GREEN → independent review → green CI for each slice. S1 was the temporary
@@ -1085,7 +1085,8 @@ provider adapter remains pending. Require every expected applicable MUST and
 freshness check before positive credit, plus source/package compatibility, negative cases and
 relevant green CI including Windows. The S1 suites establish their tested mechanism/package
 contracts; they do not establish independent host provenance, live-host loading or architectural
-benefit. E1 has not started and begins only after a creditable S2; E1 GO and H1–H4/paired evidence
+benefit. E1 observation remains OPEN with insufficient qualifying exposure; it begins only after
+a creditable S2, and the D1/D2 attempts are non-qualifying. E1 GO and H1–H4/paired evidence
 remain separate gates.
 
 ## F4: credited reconciliation (Claude-only, pilot ON)

package/docs/document-lifecycle.md

@@ -4,7 +4,7 @@ Contract for the documentation family: project docs configuration (D5), document
 
 Documentation is a **consumer** of the #320 workflow/obligation abstractions. Nothing here is a second router, a standing maintenance loop or a cognitive lock: every check is a pure function that reports diagnostics.
 
-## Scope of this slice (status as of 2026-10-20)
+## Scope of this slice (original 2026-10-20 checkpoint; Phase 3b/3c status updated 2026-10-25)
 
 This table distinguishes merged mechanism code from end-to-end workflow integration. The last reviewed `main` commit is `29b1d65b398e2622af97bf067078373b7fa76b26` (v0.36.2). That release commit carries `[skip ci]` and only bumps package/distribution versions on top of `e5d22584e243d5b5e587ee0279625e97a9033160`, whose full-gate `CI` run [39374474269](https://github.com/dyphn1/Harness-everything/actions/runs/39374474269) completed with every job succeeded. The historical Windows System One resident teardown (`S1-RS15`) was observed in attempt 1 of [run 39175240370](https://github.com/dyphn1/Harness-everything/actions/runs/39175240370) on `main@75e04359ae5bf11a41739f8eb04d25a76ee8f3a7`; that run completed successfully on attempt 2 and says nothing about `29b1d65`. Treat the resident teardown as a known platform limitation only when a current run on the exact SHA reproduces it, and require an all-green full-gate run for that SHA before calling any baseline green.
 
@@ -15,8 +15,8 @@ This table distinguishes merged mechanism code from end-to-end workflow integrat
 | 2 — roles, IDs, aliases, legacy, supersession, index, D6.9 PRD revisions | **Merged** in #327; do not rebuild this lifecycle logic for Phase 3 |
 | Step-type prerequisite (#326) | **Complete:** PR #328 merged; Harness-owned `doc-change` is explicitly declared, has no implicit TDD binding, and is not auto-inserted by router/System One |
 | 3a — document facts, obligations and evidence producer | **Merged** in #334: `harness-everything/scripts/doc-obligations.js` and `doc-evidence.js`. H3/H4 have *partial deterministic mechanism* coverage, not integrated workflow evidence. Known limitations: caller-attested envelope; `configDigest` presence-only; `candidateDigest` restricted to `docs/prd/`; missing independent task-scope binding. Deleted and old rename paths are bound to trusted per-path baseline evidence ([doc-evidence-baseline-binding.md](doc-evidence-baseline-binding.md), #335 fixed by #342), with workflow-disposition reconciliation left out of scope |
-| 3b — pilot-local provider suggestions and workflow evidence reconciliation | **S1 runtime ships default OFF** (opt in with `HARNESS_DOC_RECONCILIATION_PILOT=1`), with trusted scope assessment and fail-closed withholding. **F4 (#358) adds limited positive credit** for exactly `doc-lint` and `link-check` from a host-captured run of the installed doc-check (Claude Code only; live runs on 2.1.309). See [S1 switch, trusted scope and no-credit contract](doc-workflow-reconciliation.md#s1--switch-trusted-scope-and-fail-closed-no-credit-gate). S3 pure advisory provider suggestions shipped in 0.37.0 (not wired); E1 has not started. Accepted #341 E0 permits this limited reversible consumer; the live runs are not E1 GO; preserve existing required-binding compatibility |
-| 3c — H1–H4 and paired-task evaluation | **Not started.** Mechanism tests alone are insufficient for architecture promotion; compare frozen baseline and treatment on real bounded tasks, success/failure first, then conditional cost and latency |
+| 3b — pilot-local provider suggestions and workflow evidence reconciliation | **S1 runtime ships default OFF** (opt in with `HARNESS_DOC_RECONCILIATION_PILOT=1`), with trusted scope assessment and fail-closed withholding. **F4 (#358) adds limited positive credit** for exactly `doc-lint` and `link-check` from a host-captured run of the installed doc-check (Claude Code only; live runs on 2.1.309). See [S1 switch, trusted scope and no-credit contract](doc-workflow-reconciliation.md#s1--switch-trusted-scope-and-fail-closed-no-credit-gate). S3 pure advisory provider suggestions shipped in 0.37.0 (not wired); E1 remains OPEN with insufficient qualifying exposure, and D1/D2 are non-qualifying. Accepted #341 E0 permits this limited reversible consumer; the live runs are not E1 GO; preserve existing required-binding compatibility |
+| 3c — H1–H4 and paired-task evaluation | **H1 preparation only** in [#373](https://github.com/dyphn1/Harness-everything/pull/373) ([retained evidence](../benchmarks/results/h1-provider-independence-qualification/README.md)); full H1–H4 and paired-task evaluation remain pending. Mechanism tests alone are insufficient for architecture promotion; compare frozen baseline and treatment on real bounded tasks, success/failure first, then conditional cost and latency |
 | 1b — shared documentation craft and family metadata | **Shared craft delivered** in F2 (#356): shared references with thin skill consumers. Family metadata is not established. A small optional logical-family metadata seam may be piloted; physical skill directory moves remain blocked on #320 identity/path separation |
 | 4 — derived-view generators and `describes:` drift | **Regenerate-equals delivered** in F3 (#357) for authorized generators; `describes:` drift reminders and broader maintenance are not established. Preserve generator authorization, deterministic regenerate-equals and scoped reminder semantics |
 

package/docs/platform-capabilities.md

@@ -17,6 +17,10 @@ Statuses are intentionally explicit:
 
 Codex and OpenCode are `Partial` in `liveHostVerification`. The Codex artifact verifies user-hook compatibility capture for two consecutive turns on one Windows Codex CLI host; native plugin-hook mounting and other host/version combinations remain unverified. OpenCode's retained evidence supports project-scope `.js` loading and edit/verification state on OpenCode 1.18.31 (macOS), not durable hard enforcement. No fresh artifacts exist yet for the other surfaces, managed-workspace import, or public OpenAI approval.
 
+### Codex PR metadata action-gate boundary
+
+Exact title/body-only `update_pull_request` calls are Codex-only host-deferred mutations after an argument allowlist check; explicit required Gate hints and all additional fields retain the existing Gate. Native task scope, permissions and GitHub authorization remain authoritative. Canonical/package mechanism tests cover hashes, audit provenance, outcomes and negative controls; this does not establish candidate live-host coverage. See [Codex policy](codex-action-gate.md#codex-pr-titlebody-updates-host-deferred).
+
 ### Routing contract vs. host evidence
 
 The workflow plan controller rejects present non-array required/optional binding declarations before recording a requirement plan. This input-validation contract is covered by deterministic mechanism tests and does not change live-host evidence status.
@@ -27,7 +31,8 @@ This is a **repository/agent contract**, not an automatic upgrade to any platfor
 
 ### Action-gate mechanism vs. host semantic boundary
 
-Routine exact `create_pull_request` operations are host-deferred at the mechanism level:
+Routine exact `create_pull_request` operations and Codex title/body-only
+`update_pull_request` operations are host-deferred at the mechanism level:
 their descriptor remains a mutation (not read/safe), and no Harness consent or
 `permissionDecision` is emitted. Native agent task-scope authorization and native
 permissions stay authoritative; an explicit required `actionGate` hint still gates.
@@ -140,7 +145,8 @@ The public OpenAI Skills-only plugin is narrower again. Its ZIP contains the pac
 Codex `UserPromptSubmit` prompts pass through to the normal router unchanged;
 Harness does not parse or intercept a fixed approval syntax. Native agent
 task-scope authorization and native permissions remain authoritative. Routine
-exact `create_pull_request` operations are host-deferred at the mechanism level:
+exact `create_pull_request` operations and Codex title/body-only
+`update_pull_request` operations are host-deferred at the mechanism level:
 their descriptor remains a mutation (not read/safe), and no Harness consent or
 `permissionDecision` is emitted. All other risky actions remain hard PreToolUse
 blocks; an explicitly required `actionGate` hint still gates. These are