harness-everything 0.41.3 → 0.42.1

package/plugins/harness-everything/hooks/scripts/action-gate.js

@@ -108,12 +108,14 @@ function safeResource(input, explicit) {
   return null;
 }
 
-function normalizeActionDescriptor(payload) {
+function normalizeActionDescriptor(payload, options = {}) {
   const tool = toolNameOf(payload);
   const input = toolInputOf(payload);
   const explicit = explicitActionDescriptor(payload);
-  const toolFamily = inferToolFamily(tool, explicit);
-  const action = inferStructuredAction(tool, explicit);
+  const codexPrUpdate = detectHost(payload, options.host) === 'codex' && isPullRequestUpdateTool(tool);
+  const toolFamily = inferToolFamily(tool, codexPrUpdate ? null : explicit);
+  const inferred = inferStructuredAction(tool, explicit);
+  const action = codexPrUpdate && !STRUCTURED_GATED_ACTIONS.has(inferred) ? 'mutate' : inferred;
   const classification = STRUCTURED_GATED_ACTIONS.has(action)
     ? 'gated'
     : (STRUCTURED_SAFE_ACTIONS.has(action) ? 'safe' : 'unknown');
@@ -140,8 +142,23 @@ function isRoutinePullRequestCreation(toolName) {
   return (last === 'create_pull_request' || name === 'create_pull_request');
 }
 
-function structuredRule(payload) {
-  const descriptor = normalizeActionDescriptor(payload);
+function isPullRequestUpdateTool(name) {
+  return name.split('__').pop() === 'update_pull_request' || name === 'mcp__codex_apps__github_update_pull_request';
+}
+
+function isPullRequestMetadataUpdate(payload) {
+  if (!isPullRequestUpdateTool(toolNameOf(payload))) return false;
+  const input = toolInputOf(payload);
+  if (!input || typeof input !== 'object' || Array.isArray(input)) return false;
+  const keys = Object.keys(input);
+  const allowed = new Set(['repository_full_name', 'pr_number', 'owner', 'repo', 'pullNumber', 'pull_number', 'title', 'body']);
+  return keys.every(key => allowed.has(key))
+    && keys.some(key => key === 'title' || key === 'body')
+    && keys.filter(key => key === 'title' || key === 'body').every(key => typeof input[key] === 'string');
+}
+
+function structuredRule(payload, options = {}) {
+  const descriptor = normalizeActionDescriptor(payload, options);
   if (descriptor.toolFamily === 'shell') return { descriptor, rule: null };
   if (descriptor.classification === 'safe') return { descriptor, rule: null };
   // Routine PR creation is a host-deferred mutation, not a Harness-gated one:
@@ -152,6 +169,10 @@ function structuredRule(payload) {
   if (isRoutinePullRequestCreation(descriptor.toolName) && !(hint && hint.required)) {
     return { descriptor, rule: null };
   }
+  if (detectHost(payload, options.host) === 'codex' && descriptor.action === 'mutate'
+      && isPullRequestMetadataUpdate(payload) && !(hint && hint.required)) {
+    return { descriptor, rule: null, hostDeferred: true };
+  }
   if (descriptor.classification === 'gated') {
     return {
       descriptor,
@@ -367,7 +388,8 @@ function routerActionGateHint(payload) {
     payload && payload.routerContract && payload.routerContract.workflowPlan && payload.routerContract.workflowPlan.actionGate,
     payload && payload.harness && payload.harness.workflowPlan && payload.harness.workflowPlan.actionGate,
   ];
-  const gate = candidates.find(candidate => candidate && typeof candidate === 'object');
+  const gate = candidates.find(candidate => candidate && typeof candidate === 'object' && candidate.required)
+    || candidates.find(candidate => candidate && typeof candidate === 'object');
   if (!gate) return null;
   return {
     required: Boolean(gate.required),
@@ -435,7 +457,7 @@ function recordDecision(payload, rule, table, host, disposition, options = {}, e
   const exact = exactPayloadText(payload);
   const commandHash = hashExact(exact);
   const now = new Date().toISOString();
-  const descriptor = normalizeActionDescriptor(payload);
+  const descriptor = normalizeActionDescriptor(payload, { host });
   const record = {
     schemaVersion: 1,
     toolName: toolNameOf(payload),
@@ -467,11 +489,15 @@ function recordDecision(payload, rule, table, host, disposition, options = {}, e
 function evaluatePreToolUse(payload, options = {}) {
   const context = sessionContext(payload, options.sessionDir);
   const table = options.ruleTable || loadRuleTable(options.rulePath || RULES_PATH);
-  const structured = structuredRule(payload);
+  const structured = structuredRule(payload, options);
   const rule = structured.rule || classify(payload, table.rules, context.sessionDir);
   const host = detectHost(payload, options.host);
 
   if (!rule) {
+    const record = structured.hostDeferred ? recordDecision(payload, {
+      id: 'routine-pr-metadata-update',
+      reason: 'Codex PR title/body metadata update defers to native task scope and permissions.',
+    }, table, host, 'deferred-to-host', { ...options, sessionDir: context.sessionDir }) : null;
     return {
       kind: 'allow',
       exitCode: 0,
@@ -480,6 +506,7 @@ function evaluatePreToolUse(payload, options = {}) {
       rule: null,
       table,
       descriptor: structured.descriptor,
+      ...(record ? { record } : {}),
     };
   }
 

package/plugins/harness-everything/hooks/scripts/lib/doc-reconciliation-pilot.js

@@ -114,9 +114,17 @@ function collect(context) {
 // S2b credit chain (F4): produce the snapshot, accept the origin-provider events, and check them against the expected
 // MUSTs. Credit only when the core marks the evidence eligible. Production has no qualification, so it stays withheld.
 function creditChain(context, set, dependencies = {}) {
-  if (require('./doc-reconciliation-provider').readCaptureView(context.sessionDir).tampered) {
+  const hostId = activeHostFor(context);
+  const providerModule = require('./doc-reconciliation-provider');
+  const captureView = hostId === 'opencode' ? providerModule.readOpencodeCaptureView(context.sessionDir)
+    : hostId === 'claude-code' ? providerModule.readCaptureView(context.sessionDir)
+      : { records: [], tampered: false };
+  if (captureView.tampered) {
     return { eligible: false, diagnostics: [{ code: 'journal-tampered', message: 'the capture journal no longer matches its immutable event records' }] };
   }
+  if (!['claude-code', 'opencode'].includes(hostId)) {
+    return { eligible: false, diagnostics: [{ code: 'unsupported-host', message: `no document origin provider is registered for ${String(hostId)}` }] };
+  }
   const { produceDocSnapshot } = require('./doc-reconciliation-producer');
   const { acceptDocEvents } = require('./doc-reconciliation-events');
   const { checkAcceptedDocEvidence } = require('./doc-reconciliation-core');
@@ -124,29 +132,38 @@ function creditChain(context, set, dependencies = {}) {
   const requirements = Array.isArray(set?.requirements) ? set.requirements : [];
   const taskId = `task-${requirements.map(item => item.id).join('+') || 'none'}`;
   const sessionId = context.sessionId;
-  const { createClaudeOriginProvider, journalExecutors } = require('./doc-reconciliation-provider');
-  const captures = readCaptures(context);
-  const originProvider = dependencies.originProvider || createClaudeOriginProvider({
-    hostId: 'claude-code',
+  const { createClaudeOriginProvider, createOpencodeOriginProvider, journalExecutors } = providerModule;
+  const captures = captureView.records;
+  const principals = hostId === 'opencode'
+    ? { author: sessionId, executors: [sessionId] }
+    : { author: sessionId, executors: journalExecutors(captures, sessionId) };
+  const createOriginProvider = hostId === 'opencode' ? createOpencodeOriginProvider : createClaudeOriginProvider;
+  const providerInput = {
+    hostId,
     sessionId,
     workspaceRoot: context.root,
     workflowId: context.workflow.workflowId,
     workflowRevision: context.workflow.revision,
     taskId,
-    principals: { author: sessionId, executors: journalExecutors(captures, sessionId) },
+    principals,
     baseline,
     captures,
-  });
+  };
+  const originProvider = dependencies.originProvider || createOriginProvider(providerInput);
   const produced = produceDocSnapshot({
     workspaceRoot: context.root,
     baseline,
     workflow: { workflowId: context.workflow.workflowId, sessionId, workflowRevision: context.workflow.revision },
     task: { taskId, requirements },
     scope: { prdRoot: 'docs/prd/' },
-    activeHost: 'claude-code',
+    activeHost: hostId,
     prdRoot: 'docs/prd/',
   }, { originProvider });
-  if (produced.state !== 'ready' || !produced.snapshot) return { eligible: false, diagnostics: produced.diagnostics, unsatisfied: [] };
+  if (produced.state !== 'ready' || !produced.snapshot) return {
+    eligible: false,
+    diagnostics: produced.diagnostics || [],
+    unsatisfied: [],
+  };
   const eventRefs = captureReferences(context);
   const accepted = acceptDocEvents({ snapshot: produced.snapshot, eventRefs }, { originProvider });
   const checked = checkAcceptedDocEvidence({ snapshot: produced.snapshot, accepted, mode: 'verification' });
@@ -181,6 +198,7 @@ function reviewRequired(set) {
 // The review step is independent of credit qualification: the step records host-observed independence, while document
 // credit itself still needs the validated qualification (assess).
 function independentReviewAccepted(context) {
+  if (activeHostFor(context) !== 'claude-code') return false;
   const { reviewRecordIndependent, journalExecutors } = require('./doc-reconciliation-provider');
   const view = require('./doc-reconciliation-provider').readCaptureView(context.sessionDir);
   if (view.tampered) return false;
@@ -196,10 +214,18 @@ function independentReviewAccepted(context) {
 
 function recordOf(value) { return value !== null && typeof value === 'object' && !Array.isArray(value); }
 
+function activeHostFor(context) {
+  return context.activeHost === undefined || context.activeHost === null ? 'claude-code' : context.activeHost;
+}
+
 // The session capture records are the only host-event source. A missing journal means no events; a journal that no longer
 // equals its immutable event files is tampered and yields no events, so the chain withholds.
 function readCaptures(context) {
-  return require('./doc-reconciliation-provider').readCaptureView(context.sessionDir).records;
+  const provider = require('./doc-reconciliation-provider');
+  const hostId = activeHostFor(context);
+  if (hostId === 'opencode') return provider.readOpencodeCaptureView(context.sessionDir).records;
+  if (hostId === 'claude-code') return provider.readCaptureView(context.sessionDir).records;
+  return [];
 }
 
 // Only explicit PostToolUse doc-check candidates are offered; ordinary Edit or Agent results are not (R3-01).
@@ -208,6 +234,10 @@ const docCheckCandidate = item => item.event === 'PostToolUse'
 
 function captureReferences(context) {
   const captures = readCaptures(context);
+  if (activeHostFor(context) === 'opencode') {
+    return captures.filter(item => typeof item?.call_id === 'string' && item.call_id.trim())
+      .flatMap(item => ['doc-lint', 'link-check'].map(capability => `${item.call_id}#${capability}`));
+  }
   const candidates = captures
     .filter(item => item && typeof item.ref === 'string' && (item.event === 'SubagentStop' || docCheckCandidate(item)))
     .filter(item => item.event !== 'SubagentStop');

package/plugins/harness-everything/hooks/scripts/lib/doc-reconciliation-provider.js

@@ -15,8 +15,8 @@
 //   qualification object ({ source: 'fake-test-fixture', faked: true }) is a
 //   test-only construct for mechanism tests; production passes no
 //   qualification and stays gated.
-// - Unsupported hosts (opencode/codex) never borrow the Claude exit mapping:
-//   both seam methods report `unavailable` with diagnostics.
+// - The Claude provider accepts only Claude. OpenCode has a separate
+//   fail-closed mapping and never borrows Claude's exit or reviewer rules.
 // - Exit mapping (owner decision row 1): for a given `tool_use_id`, a captured
 //   `PostToolUse` with `interrupted === false` and no `PostToolUseFailure`
 //   arrival maps to exit 0. This is a named mapping of the host's own
@@ -37,6 +37,10 @@ const path = require('path');
 
 const HOST_ID = 'claude-code';
 const CAPTURE_RECORD_VERSION = 'claude-capture-record/1';
+const OPENCODE_HOST_ID = 'opencode';
+const OPENCODE_CAPTURE_RECORD_VERSION = 'opencode-capture-record/1';
+const OPENCODE_CAPTURE_FILE = 'opencode-captures.jsonl';
+const OPENCODE_CAPTURE_LIMIT_BYTES = 4 * 1024 * 1024;
 const QUALIFICATION_EXPORT_SCHEMA = 'harness.doc-reconciliation.qualification.v1';
 const HEX64 = /^[0-9a-f]{64}$/;
 const PRE_CAPTURE_TOOLS = ['Bash', 'PowerShell', 'Task', 'Agent'];
@@ -522,10 +526,14 @@ function observedCorrelation(records) {
 
 // Validates the qualification export against the sanitized capture it names: schema, host, capture-record version, the
 // capture's digest, and every claimed kind, field and correlation. Returns null when valid, else the reason.
-function validateQualificationExport() {
+function validateQualificationExport(expectedHost = HOST_ID) {
   const exported = JSON.parse(fs.readFileSync(path.join(__dirname, EXPORT_FILE), 'utf8'));
   if (!recordOf(exported) || exported.schema !== QUALIFICATION_EXPORT_SCHEMA) return 'qualification export schema is not recognized';
-  if (exported.host !== HOST_ID || !textOf(exported.hostVersion)) return 'qualification export host or host version is missing';
+  if (!textOf(exported.hostVersion)) return 'qualification export host or host version is missing';
+  if (exported.host !== expectedHost) {
+    if (expectedHost === HOST_ID) return 'qualification export host or host version is missing';
+    return 'qualification export host does not match the selected provider';
+  }
   if (exported.captureRecordVersion !== CAPTURE_RECORD_VERSION) return 'qualification export capture record version is not supported';
   const source = recordOf(exported.sanitizedCapture) ? exported.sanitizedCapture : {};
   // The sanitized capture is a sibling of the export, so source and packaged copies resolve it the same way.
@@ -547,7 +555,7 @@ function validateQualificationExport() {
   return null;
 }
 
-function evaluateQualification(input) {
+function evaluateQualification(input, expectedHost = HOST_ID) {
   if (recordOf(input) && input.qualification !== undefined && input.qualification !== null) {
     const supplied = input.qualification;
     // Test-only DI path: an explicitly fake qualification object. Anything else
@@ -567,7 +575,7 @@ function evaluateQualification(input) {
   // against the sanitized capture it names. Nothing is read from the environment, capture flags or ancestor directories.
   let reason = null;
   try {
-    reason = validateQualificationExport();
+    reason = validateQualificationExport(expectedHost);
   } catch (error) {
     reason = `qualification evidence could not be read (${error.code || 'error'})`;
   }
@@ -582,11 +590,11 @@ function evaluateQualification(input) {
 
 // ---- Shared provider state ------------------------------------------------------
 
-function supportedHostCheck(input) {
-  if (recordOf(input) && input.hostId === HOST_ID) return null;
+function supportedHostCheck(input, expectedHost = HOST_ID) {
+  if ([HOST_ID, OPENCODE_HOST_ID].includes(expectedHost) && recordOf(input) && input.hostId === expectedHost) return null;
   const host = recordOf(input) && typeof input.hostId === 'string' ? input.hostId : 'unknown';
   return diagnostic('unsupported-host', {
-    reason: `unsupported host ${host} has no supported capture implementation; OpenCode/Codex must not borrow the Claude exit mapping`,
+    reason: `unsupported host ${host} has no matching capture implementation; hosts must not borrow another host's exit mapping`,
   });
 }
 
@@ -892,6 +900,127 @@ const createClaudeOriginProvider = input => {
   return { resolveContext, resolveEvent };
 };
 
+function opencodeContentSignature(cap) {
+  return captureJson({
+    hostId: cap.hostId,
+    tool: cap.tool === undefined ? null : cap.tool,
+    command: cap.command === undefined ? null : cap.command,
+    cwd: cap.cwd === undefined ? null : cap.cwd,
+    status: cap.status === undefined ? null : cap.status,
+    exit: cap.exit === undefined ? null : cap.exit,
+    resultDigest: cap.result_digest === undefined ? null : cap.result_digest,
+    error: cap.error === undefined ? null : cap.error,
+  });
+}
+
+const createOpencodeOriginProvider = input => {
+  const safeInput = recordOf(input) ? input : {};
+
+  function resolveContext(request) {
+    const hostFail = supportedHostCheck(safeInput, OPENCODE_HOST_ID);
+    if (hostFail) return { status: 'unavailable', diagnostics: [hostFail] };
+    const qualification = evaluateQualification(safeInput, OPENCODE_HOST_ID);
+    if (!qualification.open) return { status: 'unavailable', diagnostics: [qualification.fail] };
+    const workspaceRoot = textOf(safeInput.workspaceRoot) ? safeInput.workspaceRoot : (recordOf(request) && textOf(request.workspaceRoot) ? request.workspaceRoot : '');
+    const sessionId = textOf(safeInput.sessionId) ? safeInput.sessionId : '';
+    const workflowId = textOf(safeInput.workflowId) ? safeInput.workflowId : '';
+    const workflowRevision = Number.isInteger(safeInput.workflowRevision) ? safeInput.workflowRevision : null;
+    const taskId = textOf(safeInput.taskId) ? safeInput.taskId : '';
+    if (!workspaceRoot || !sessionId || !workflowId || workflowRevision === null || !taskId) {
+      return { status: 'unavailable', diagnostics: [diagnostic('invalid-input', { reason: 'OpenCode origin requires the recorded workspace, session, workflow, revision and task identity' })] };
+    }
+    const suppliedPrincipals = recordOf(safeInput.principals) ? safeInput.principals : {};
+    const author = textOf(suppliedPrincipals.author) ? suppliedPrincipals.author : sessionId;
+    const executors = Array.isArray(suppliedPrincipals.executors) ? suppliedPrincipals.executors.filter(textOf) : [sessionId];
+    const originRef = 'origin://opencode/' + digestText(captureJson({
+      hostId: OPENCODE_HOST_ID, sessionId, workspaceRoot, taskId, workflowId, workflowRevision,
+      author, executors, qualificationSource: qualification.source,
+    }));
+    return {
+      status: 'accepted', originRef,
+      context: {
+        workspaceId: 'ws-' + digestText(captureJson({ workspaceRoot })), sessionId, workflowId, workflowRevision, taskId,
+        principals: { author, executors: executors.slice() }, activeHost: OPENCODE_HOST_ID,
+        baselineReference: `retained-live-capture:opencode-341:${digestText(originRef)}`,
+        ...(recordOf(safeInput.baseline) && textOf(safeInput.baseline.commit) && textOf(safeInput.baseline.root)
+          ? { baseline: { commit: safeInput.baseline.commit, root: safeInput.baseline.root } } : {}),
+        workspaceRoot,
+      },
+    };
+  }
+
+  function resolveEvent(request) {
+    if (!recordOf(request) || !textOf(request.reference)) return unavailable('invalid-input', 'resolveEvent requires a nonempty event reference');
+    const hostFail = supportedHostCheck(safeInput, OPENCODE_HOST_ID);
+    if (hostFail) return { status: 'unavailable', diagnostics: [hostFail] };
+    const qualification = evaluateQualification(safeInput, OPENCODE_HOST_ID);
+    if (!qualification.open) return { status: 'unavailable', diagnostics: [qualification.fail] };
+    const [captureRef, capability] = String(request.reference).split('#');
+    const captures = Array.isArray(safeInput.captures) ? safeInput.captures : [];
+    const matches = captures.map((item, index) => ({ item, index })).filter(({ item }) => recordOf(item) && item.call_id === captureRef);
+    if (!matches.length) return unavailable('origin-unavailable', `no captured OpenCode event is retained for reference ${request.reference}`);
+    if (matches.length > 1) return rejected('replayed-record', 'multiple OpenCode records share this call id');
+    const { item: cap, index } = matches[0];
+    if (cap.hostId !== OPENCODE_HOST_ID || cap.schema !== OPENCODE_CAPTURE_RECORD_VERSION
+      || cap.session_id !== safeInput.sessionId) {
+      return rejected('record-origin-mismatch', 'the capture host and session must match this OpenCode provider invocation');
+    }
+    const observed = cap.observedIdentity;
+    const pin = recordOf(safeInput.baseline) ? safeInput.baseline : null;
+    if (!recordOf(observed)) return rejected('identity-missing', 'OpenCode capture lacks workflow identity observed at capture time');
+    const sameWorkflow = observed.workflowId === safeInput.workflowId && observed.workflowRevision === safeInput.workflowRevision;
+    const samePin = !pin || (recordOf(observed.baselinePin) && observed.baselinePin.commit === pin.commit && observed.baselinePin.root === pin.root);
+    if (!sameWorkflow || !samePin) return rejected('identity-mismatch', 'the observed workflow revision or baseline pin differs from the current one; stale evidence loses credit');
+    const signature = opencodeContentSignature(cap);
+    const firstOccurrence = captures.findIndex(item => recordOf(item) && opencodeContentSignature(item) === signature);
+    if (firstOccurrence !== index) return rejected('replayed-record', `identical OpenCode tool content already recorded (first occurrence index ${firstOccurrence})`);
+    if (cap.error !== undefined && cap.error !== null) return rejected('failure-not-credited', 'the native tool event carries an error');
+    if (typeof cap.status !== 'string' || !cap.status) return rejected('outcome-ambiguous', 'the native tool status is missing');
+    if (cap.status !== 'completed') return rejected(cap.status === 'error' ? 'failure-not-credited' : 'outcome-ambiguous', `native tool status ${cap.status} does not prove completion`);
+    const processTool = ['bash', 'shell', 'powershell', 'cmd'].includes(String(cap.tool).toLowerCase());
+    if (processTool && !Number.isInteger(cap.exit)) return rejected('outcome-ambiguous', 'a process result without a numeric native exit is ambiguous');
+    if (processTool && cap.exit !== 0) return rejected('failure-not-credited', `the native process exit was ${cap.exit}`);
+    if (!/^[0-9a-f]{64}$/.test(String(cap.result_digest || '')) || !Number.isInteger(cap.result_bytes) || cap.result_bytes < 0) {
+      return rejected('stdout-withheld', 'the native result digest and byte count are absent');
+    }
+    const author = recordOf(safeInput.principals) && textOf(safeInput.principals.author) ? safeInput.principals.author : safeInput.sessionId;
+    if (capability === 'quality-review') {
+      if (!textOf(cap.agent_id)) return rejected('reviewer-principal-missing', 'OpenCode supplied no host-issued reviewer identity');
+      if (cap.agent_id === author) return rejected('reviewer-not-independent', 'the reviewer identity equals the author session principal');
+      return rejected('reviewer-principal-missing', 'OpenCode supplied no host-issued independent-review record');
+    }
+    if (capability) {
+      if (!['doc-lint', 'link-check'].includes(capability)) return rejected('capability-mismatch', `OpenCode cannot supply capability ${capability}`);
+      if (!textOf(cap.command)) return rejected('command-missing', 'the native record has no command for a registered doc-check');
+      if (!textOf(cap.cwd)) return rejected('unregistered-command', 'the host omitted per-tool cwd, so the doc-check invocation cannot be validated');
+      const registered = resolveDocCheckInvocation(cap.command, cap.cwd);
+      if (registered.kind !== 'accepted') return rejected('unregistered-command', `doc-check invocation rejected (${registered.reason}); no credit`);
+      return rejected('stdout-withheld', 'the OpenCode result body is retained only as a digest and cannot prove doc-check output');
+    }
+    if (!textOf(cap.command)) return rejected('command-missing', 'captured OpenCode record has no retained process command');
+    if (!textOf(cap.cwd)) return rejected('outcome-ambiguous', 'the host omitted per-tool cwd');
+    if (!processTool) return rejected('capture-event-unsupported', `tool ${String(cap.tool)} has no OpenCode process mapping`);
+    if (!recordOf(request.identity)) return rejected('identity-missing', 'execution evidence needs a snapshot identity');
+    const contextResponse = resolveContext(request);
+    if (contextResponse.status !== 'accepted') return unavailable('origin-unavailable', 'origin context did not resolve');
+    const identity = JSON.parse(JSON.stringify(request.identity));
+    const resultRef = `opencode-result/${cap.call_id}/${cap.result_digest}`;
+    const event = {
+      eventId: 'opencode-exec-' + digestText(signature + ':execution'),
+      producerId: 'opencode-origin-provider', originRef: contextResponse.originRef,
+      principalId: cap.session_id, provenance: 'opencode-capture:' + cap.call_id,
+      capability: 'shell-command', kind: 'execution', command: cap.command, argv: [cap.command], cwd: cap.cwd,
+      exitCode: cap.exit, signal: null, toolCorrelationId: cap.call_id, resultRef,
+      identity, startIdentity: identity, endIdentity: identity,
+      paths: [], artifactDigests: {}, captured: { responseRef: resultRef, responseDigest: cap.result_digest },
+    };
+    return { status: 'accepted', originRef: contextResponse.originRef, event,
+      correlation: { toolCorrelationId: cap.call_id, resultRef } };
+  }
+
+  return { resolveContext, resolveEvent };
+};
+
 // ---- Capture record builder (consumed by state-persist.js) ----------------------
 
 // Builds the retained capture record for a Claude hook payload. The field names
@@ -1028,6 +1157,24 @@ function readCaptureView(sessionDir) {
   return { records: view, tampered: false };
 }
 
+function readOpencodeCaptureView(sessionDir) {
+  const file = path.join(sessionDir, OPENCODE_CAPTURE_FILE);
+  try {
+    if (fs.statSync(file).size > OPENCODE_CAPTURE_LIMIT_BYTES) return { records: [], tampered: true };
+    const text = fs.readFileSync(file, 'utf8');
+    const records = text.split(/\r?\n/).filter(Boolean).map(line => JSON.parse(line));
+    if (!records.every(item => recordOf(item) && item.schema === OPENCODE_CAPTURE_RECORD_VERSION
+      && item.hostId === OPENCODE_HOST_ID && textOf(item.session_id) && textOf(item.call_id)
+      && textOf(item.tool) && Object.prototype.hasOwnProperty.call(item, 'status'))) {
+      return { records: [], tampered: true };
+    }
+    return { records, tampered: false };
+  } catch (error) {
+    if (error.code === 'ENOENT') return { records: [], tampered: false };
+    return { records: [], tampered: true };
+  }
+}
+
 // Observation-time identity: the workflow and pin the host event was captured under. Absent before a workflow starts.
 function observedIdentityFor(sessionDir) {
   try {
@@ -1053,7 +1200,8 @@ function reviewRecordIndependent(cap, captures, principals) {
 }
 
 // Keep the old state-persist seam as an alias; it points at the single resolver above.
-module.exports = { createClaudeOriginProvider, buildCaptureRecord, resolveDocCheckInvocation,
+module.exports = { createClaudeOriginProvider, createOpencodeOriginProvider, buildCaptureRecord, resolveDocCheckInvocation,
   registeredInstalledCheck: resolveDocCheckInvocation, installedDocCheck,
   fileDigest, SHIPPED_DOC_CHECK_DIGEST, trustRisk, journalExecutors, reviewRecordIndependent,
-  writeImmutableEvent, rebuildJournalView, readCaptureView, observedIdentityFor, _internals: { captureJson, captureDigest, digestText, canonicalCapture } };
+  writeImmutableEvent, rebuildJournalView, readCaptureView, readOpencodeCaptureView, observedIdentityFor,
+  _internals: { captureJson, captureDigest, digestText, canonicalCapture } };

package/plugins/harness-everything/hooks/scripts/workflow-stop-gate.js

@@ -14,6 +14,7 @@ function decide(payload) {
   try {
     const { planningUnresolved, unresolvedObligations } = require('./lib/workflow-obligations');
     const context = loadWorkflow(payload);
+    context.activeHost = payload && typeof payload.host_id === 'string' ? payload.host_id : undefined;
     const { workflow, sessionDir } = context;
     if (!workflow || workflow.state === 'deferred') return;
     const handoffFile = path.join(sessionDir, 'handoff-state.json');
@@ -93,4 +94,6 @@ function decide(payload) {
   } catch (error) { warn(error && error.message ? error.message : String(error)); }
 }
 
-readHookInput(decide);
+if (require.main === module) readHookInput(decide);
+
+module.exports = { decide };

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.41.3",
+  "version": "0.42.1",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/sbom.cdx.json

@@ -2,23 +2,23 @@
   "$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.7",
-  "serialNumber": "urn:uuid:e4948d5f-cae4-5b4e-84bc-19997b97c420",
+  "serialNumber": "urn:uuid:e3ce04bb-3f54-5090-bffc-a7fca1d360db",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-25T06:53:03.342Z",
+    "timestamp": "2026-10-26T06:57:43.886Z",
     "tools": [
       {
         "vendor": "Harness Everything",
         "name": "generate-sbom.js",
-        "version": "0.41.3"
+        "version": "0.42.1"
       }
     ],
     "component": {
       "type": "application",
-      "bom-ref": "pkg:npm/harness-everything@0.41.3",
+      "bom-ref": "pkg:npm/harness-everything@0.42.1",
       "name": "harness-everything",
-      "version": "0.41.3",
-      "purl": "pkg:npm/harness-everything@0.41.3"
+      "version": "0.42.1",
+      "purl": "pkg:npm/harness-everything@0.42.1"
     }
   },
   "components": [
@@ -2033,7 +2033,7 @@
       ]
     },
     {
-      "ref": "pkg:npm/harness-everything@0.41.3",
+      "ref": "pkg:npm/harness-everything@0.42.1",
       "dependsOn": [
         "pkg:npm/%40commitlint/cli@19.8.1",
         "pkg:npm/%40commitlint/config-conventional@19.8.1",