harness-everything 0.42.0 → 0.42.1

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.42.0",
+      "version": "0.42.1",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.42.0",
+  "version": "0.42.1",
   "author": {
     "name": "Miya Daniel"
   },

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.42.1](https://github.com/dyphn1/Harness-everything/compare/v0.42.0...v0.42.1) (2026-10-26)
+
+### Bug Fixes
+
+* **action-gate:** defer Codex PR title and body updates to host ([fd371bf](https://github.com/dyphn1/Harness-everything/commit/fd371bf16bbba7d5ecac80b18d7e3e0ee0144ed7))
+* **action-gate:** honor required hints across conflicting envelopes ([ff796c9](https://github.com/dyphn1/Harness-everything/commit/ff796c9edda4565906ed4c0d2b0b14ed3ef6bbc0))
+* **action-gate:** prevent codex pr mutation descriptor downgrades ([e9344de](https://github.com/dyphn1/Harness-everything/commit/e9344deb0ae38a6414944db51b2b2c40b2132c34))
+* **action-gate:** retain codex pr tool identity during classification ([c170a96](https://github.com/dyphn1/Harness-everything/commit/c170a96cf856295200d2d1a62c15a552c3cb2b37))
+
 ## [0.42.0](https://github.com/dyphn1/Harness-everything/compare/v0.41.3...v0.42.0) (2026-10-25)
 
 ### Features
@@ -100,6 +109,9 @@ All notable changes to this project are documented in this file.
 
 ## [Unreleased]
 
+### Fixed
+- Codex PR title/body-only updates defer to native task scope and permissions after exact operation and argument checks; required Gate hints and high-risk fields remain gated.
+
 - Keep successful installed workflow step dispositions from advancing verification freshness while unknown workflow commands and mutations remain tracked (#365).
 
 - Accept an interior `~` in unquoted installed doc-check path tokens, and reject `%VAR%` expansion before identity and digest checks.

package/benchmarks/results/codex-pr-metadata-2026-10-26/README.md

@@ -0,0 +1,68 @@
+# Codex PR metadata action-gate evidence
+
+| Item | Evidence / disposition |
+| --- | --- |
+| Scope | Codex exact PR title/body update; no #376 governance changes, #341 E1 credit or #320 promotion |
+| Base | `b733cadec17542b9ae30aabb50c1ba3481a58d74` (fresh `origin/main`, 2026-10-26) |
+| RED | `db6c29b`; [red.log](red.log): 12 expected metadata failures, dependency/baseline tests PASS |
+| GREEN | `fd371bf`; [green.log](green.log): all boundary checks PASS |
+| Reproduce | `node ci/action-gate.test.js`; `node ci/mechanism-2aa-codex-action-gate-policy.test.js`; `node ci/mechanism-task-git-authorization.test.js` |
+| Package | `npm run plugin:sync`; canonical/package action gate byte comparison and identical lifecycle tests |
+| Final core | `c170a96cf856295200d2d1a62c15a552c3cb2b37` |
+| Full regression | [Node 24 full run](verification.md): 13 PASS, 0 FAIL, 3 UNCHECKED (local Node 22 lanes); exit 0 |
+| Reviewer routing | `spawn_agent`: `fork_turns=none`, `model=gpt-6-luna`, `reasoning_effort=xhigh`; host-issued model identity/effort attestation is not exposed |
+| Independent review | [Luna cold review](luna-review.md): core PASS at `c170a96`; 1 BLOCKER + 2 MAJOR fixed and independently rechecked; no open code BLOCKER/MAJOR |
+| Candidate live Host | UNCHECKED: current session loads immutable installed runtime `0.42.0-f51078676b56`, not this candidate; no hook/trust configuration changed |
+
+## Original rejection provenance
+
+- Observed 2026-10-26T01:12:15.045Z; session `01a175b3-4583-7590-9c9d-f71a9439ae8e`, tool call `exec-8e76e1be-e5a3-493d-807b-2ad6cdbc7c31`.
+- Actual tool: `mcp__codex_apps__github__update_pull_request`; arguments: `repository_full_name`, `pr_number: 376`, `body` only.
+- Audit: `structured-mutate`, `mutate`/`gated`, host `codex`, `rejected`, reason `host-ask-decision-unverified-or-unsupported`.
+- Recomputed from the original transcript CommandExecution output at 2026-10-26T01:12:14.917Z (1,840 characters): MATCH. The temporary body file changed later and is not used as original evidence.
+- Exact input SHA-256: `b9bda7116fb01c045edd71a6b4fc3091c0ab707e0b797f1b4efca6e7a4edc87b`. Audit intentionally omits raw body.
+- Local audit: `~/.agents/harness-everything/workspaces/harness-everything-4534d9804d9c/state/sessions/01a175b3-4583-7590-9c9d-f71a9439ae8e/action-gate/exec-8e76e1be-e5a3-493d-807b-2ad6cdbc7c31.json`.
+- Transcript: `~/.codex/sessions/2026/10/26/rollout-2026-10-26T08-54-05-01a175b3-4583-7590-9c9d-f71a9439ae8e.jsonl`, call `call_0a3ca81d5e134c76a9339a116e7fe417` supplies only those keys and records the matching Hook rejection.
+- Current connected GitHub tool schema exposes those selectors, optional title/body and separate state/base_branch/maintainer_can_modify; new exception rejects the latter keys even when null.
+
+## Boundary controls
+
+- Body-only, title-only and combined payloads; exact bare/provider operation and both connected Codex naming forms.
+- State/reopen/retarget/maintainer/unknown/mixed/malformed payloads and similar names retain Gate; all supported required-hint envelopes retain Gate.
+- Other hosts retain existing structured rules. Create PR, merge, close, delete, deploy, publish, send and force-push controls remain unchanged.
+- Canonical/package tests verify descriptor/hash, redacted audit provenance, PostToolUse success/failure, changed-payload integrity violation and rejected mutation outcomes.
+- No actual destructive remote negative control is executed. Mechanism PASS is not live Host PASS.
+
+
+## Independent review corrections and replay
+
+| Finding | RED evidence | Fix / GREEN evidence |
+| --- | --- | --- |
+| Earlier optional hint masked required hint | `1e77c26`, [9 failures](review-hints-red.log) | `ff796c9`, [PASS](review-hints-green.log) |
+| Exact Codex PR mutation downgraded by read/unknown descriptor | `06a66c2`, [11 failures](review-descriptor-red.log) | `e9344de`, [PASS](review-descriptor-green.log) |
+| MCP update disguised as shell family | `16f5e20`, [14 failures](review-family-red.log) | `c170a96`, [PASS](review-family-green.log) |
+
+- Conflicting-hint precedence now preserves any required hint across all supported envelopes. Ordinary PR creation controls are unchanged; contradictory required hints honor the existing required-Gate contract.
+- Exact-update descriptor/family hardening is Codex-only. Other hosts keep their prior descriptor behavior; higher-risk Codex descriptors remain gated.
+- Initial RED/GREEN runs used Node 26.12.1 in the sibling-worktree shell; Luna independently replayed original RED under Node 24.22.1. Correction RED/GREEN and final regression use explicit Node 24 PATH.
+- Earlier full runs were superseded, never claimed complete: Node 26 reached 128-suite self-regression PASS before stopping during mutations; the first Node 24 run stopped for the descriptor/family review correction.
+
+Reproduce the independently authored checks from the repository root (Node 24):
+
+```sh
+node benchmarks/results/codex-pr-metadata-2026-10-26/luna-action-family-cross-product.js .
+node benchmarks/results/codex-pr-metadata-2026-10-26/luna-codex-action-gate-prehook-smoke.js .
+```
+
+- [Cross-product log](luna-action-family-cross-product.log): 2,709 cases, 4,729 assertions, 0 failures.
+- [Stdin smoke log](luna-codex-action-gate-prehook-smoke.log): seven actual pre-hook subprocess cases PASS, covering host deferral and rejected cases with persisted audit fields.
+- These are deterministic mechanism evidence, not live Codex Host evidence.
+
+
+## Controlled GitHub delivery probe
+
+- Draft [PR #377](https://github.com/dyphn1/Harness-everything/pull/377) was created via the normal GitHub MCP create path (no merge).
+- The same body was then submitted via normal `github_update_pull_request`, with only repository_full_name/pr_number/body. The installed old runtime rejected it before execution as `structured-mutate`.
+- [Preserved live rejection](live-installed-runtime-rejection.json) binds the attempted body to its payload hash and installed rule-table provenance. No alternate PR edit path was used after rejection; the PR body was not changed by this probe.
+- This is live evidence of the installed old version's rejection, not candidate live PASS. Candidate update/title/body and comment lifecycle live-host execution remain UNCHECKED; no comment-operation exemption was added.
+- CI: [initial PR workflow](https://github.com/dyphn1/Harness-everything/actions/runs/40275422862); final HEAD status must be checked separately after evidence commits.

package/benchmarks/results/codex-pr-metadata-2026-10-26/green-final.log

@@ -0,0 +1,162 @@
+=== Issue #85 Phase 5 — Pre-action gate ===
+  PASS production action-gate rule table loads without fallback
+  PASS production rule table is non-empty and keeps the destructive baseline
+  PASS rule table contains git-force-push
+  PASS rule table contains git-reset-hard
+  PASS rule table contains git-clean-force-delete
+  PASS rule table contains recursive-delete
+  PASS rule table contains powershell-recursive-force-delete
+  PASS rule table contains sql-destructive-ddl
+  PASS rule table contains package-publish
+  PASS rule table contains github-release-create
+  PASS rule table contains production-deploy
+  PASS Claude force-push defers to the host permission flow without forcing a prompt
+  PASS deferred decision still names the matched rule
+  PASS matched Claude action is audited as deferred-to-host
+  PASS audit records matched rule
+  PASS audit hashes the exact command payload
+  PASS always-ask policy restores the forced Claude prompt
+  PASS ask decision uses Claude PreToolUse hookSpecificOutput
+  PASS ask reason names the matched rule
+  PASS always-ask action is audited as pending-approval
+  PASS git status passes untouched
+  PASS safe unmatched command creates no gate audit record
+  PASS permission_mode=default defers to the host without a forced prompt
+  PASS audit records permission_mode=default
+  PASS permission_mode=acceptEdits defers to the host without a forced prompt
+  PASS audit records permission_mode=acceptEdits
+  PASS permission_mode=plan defers to the host without a forced prompt
+  PASS audit records permission_mode=plan
+  PASS permission_mode=auto defers to the host without a forced prompt
+  PASS audit records permission_mode=auto
+  PASS permission_mode=dontAsk defers to the host without a forced prompt
+  PASS audit records permission_mode=dontAsk
+  PASS permission_mode=bypassPermissions defers to the host without a forced prompt
+  PASS audit records permission_mode=bypassPermissions
+  PASS permission_mode=missing defers to the host without a forced prompt
+  PASS audit records permission_mode=missing
+  PASS command classification gates destructive action even when router hint says not required
+  PASS router actionGate hint is recorded without controlling enforcement
+  PASS safe command is not gated solely because prompt router predicted risk
+  PASS structured MCP delete is gated before execution
+  PASS audit retains normalized structured action identity
+  PASS structured action audit binds to exact payload hash
+  PASS structured action audit does not persist raw secret arguments
+  PASS read-only MCP fixture passes without a false gate
+  PASS obvious structured mutation is classified from tool identity
+  PASS non-shell local-function destructive fixture uses the same structured gate
+  PASS unknown structured action fails closed when workflow requires a gate
+  PASS unknown structured action is not fabricated as destructive without a gate requirement
+  PASS changed structured payload cannot reuse a prior approval/audit decision
+  PASS PowerShell recursive force delete outside scratch is gated
+  PASS PowerShell recursive force delete inside session scratch is exempt
+  PASS rm -rf outside scratch is gated
+  PASS rm -rf inside OS temp is exempt
+  PASS git reset --hard HEAD matches git-reset-hard
+  PASS git clean -fd matches git-clean-force-delete
+  PASS psql -c "DROP TABLE users" matches sql-destructive-ddl
+  PASS npm publish matches package-publish
+  PASS gh release create v1.2.3 matches github-release-create
+  PASS npm run deploy matches production-deploy
+  PASS host without verified ask-style decision blocks with exit 2
+  PASS non-ask host block reason names the matched rule
+  PASS non-ask host block is audited as rejected
+  PASS internal action-gate error on Claude defers to the host instead of allowing or forcing a prompt
+  PASS internal error is shown to the user as a systemMessage without a permission decision
+  PASS internal error on Claude is audited as deferred-to-host
+  PASS internal action-gate error under always-ask fails closed to ask
+  PASS internal error on host without ask fails closed to block
+  PASS missing/invalid rule table visibly falls back to built-in defaults
+  PASS built-in fallback still classifies and audits destructive action
+  PASS fallback degradation is shown to the user as a systemMessage
+  PASS valid empty rule table does not silently activate built-in defaults
+  PASS empty-table mutation control disables detection, proving production non-empty assertion is meaningful
+  PASS null-prototype serialization preserves an own __proto__ key
+  PASS own __proto__ key changes the full-input digest
+  PASS PostToolUse closes a deferred payload as executed
+  PASS executed audit keeps exact approved payload hash
+  PASS PostToolUseFailure records attempted execution without pretending success
+  PASS post-tool payload mismatch is never accepted as the approved command
+  PASS Stop closes unexecuted deferred and pending payloads
+  PASS unexecuted deferred payload is audited as rejected
+  PASS unexecuted always-ask approval is audited as rejected
+  PASS hook process returns no decision for a matched command under the default policy
+  PASS hook process audits the deferred command with its permission mode
+  PASS HARNESS_ACTION_GATE_POLICY=always-ask makes the hook process emit ask
+  PASS Claude hook manifest wires action-gate to shell and MCP pre-action surfaces
+  PASS Claude hook manifest audits successful tool execution
+  PASS Claude hook manifest audits failed tool execution
+  PASS Claude hook manifest closes unresolved approvals on Stop
+  PASS OpenAI plugin preserves the attribution-aware Codex shell action-gate adapter
+  PASS OpenAI plugin packages an isolated structured MCP pre-action adapter without widening unrelated hooks
+  PASS OpenAI plugin packages an isolated structured MCP post-action audit adapter
+  PASS Codex plugin does not declare unsupported PostToolUseFailure lifecycle event
+  PASS Codex plugin infers action-gate outcome from supported PostToolUse
+  PASS Codex PostToolUse maps zero exit code to success
+  PASS Codex PostToolUse maps non-zero exit code to failure
+  PASS Codex PostToolUse conservatively recognizes failure stderr without exit code
+  PASS OpenAI plugin closes pending approvals at Stop
+  PASS canonical and plugin action-gate rule tables are byte-identical
+  PASS OpenAI plugin packages action-gate runtime
+  PASS update_pull_request body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS update_pull_request title defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS update_pull_request title,body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS mcp__github__update_pull_request body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS mcp__github__update_pull_request title defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS mcp__github__update_pull_request title,body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS mcp__codex_apps__github__update_pull_request body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS mcp__codex_apps__github__update_pull_request title defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS mcp__codex_apps__github__update_pull_request title,body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS mcp__codex_apps__github_update_pull_request body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS mcp__codex_apps__github_update_pull_request title defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS mcp__codex_apps__github_update_pull_request title,body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS provider-neutral selectors support metadata updates
+  PASS provider-neutral selectors support metadata updates
+  PASS own __proto__ field cannot escape the argument allowlist
+  PASS explicit higher-risk action cannot inherit metadata deferral
+  PASS metadata with {"state":"closed"} remains gated
+  PASS metadata with {"state":"open"} remains gated
+  PASS metadata with {"state":null} remains gated
+  PASS metadata with {"base_branch":"other"} remains gated
+  PASS metadata with {"maintainer_can_modify":false} remains gated
+  PASS metadata with {"maintainer_can_modify":null} remains gated
+  PASS metadata with {"unknown":true} remains gated
+  PASS metadata with {"title":"mixed","state":"closed"} remains gated
+  PASS metadata with {"draft":true} remains gated
+  PASS metadata with {"base":"other"} remains gated
+  PASS metadata with {"action_descriptor":{"action":"delete"}} remains gated
+  PASS missing or malformed metadata remains gated
+  PASS missing or malformed metadata remains gated
+  PASS missing or malformed metadata remains gated
+  PASS missing or malformed metadata remains gated
+  PASS missing or malformed metadata remains gated
+  PASS missing or malformed metadata remains gated
+  PASS missing or malformed metadata remains gated
+  PASS missing or malformed metadata remains gated
+  PASS mcp__demo__update_pull_requests receives no metadata exception
+  PASS mcp__demo__foo_update_pull_request receives no metadata exception
+  PASS mcp__demo__update_pull_request_and_delete receives no metadata exception
+  PASS mcp__codex_apps__github_update_pull_request_extra receives no metadata exception
+  PASS mcp__demo__merge_pull_request receives no metadata exception
+  PASS mcp__demo__close_pull_request receives no metadata exception
+  PASS claude retains existing mutation rule
+  PASS opencode retains existing mutation rule
+  PASS unknown retains existing mutation rule
+  PASS explicit required metadata gate cannot be bypassed
+  PASS explicit required metadata gate cannot be bypassed
+  PASS explicit required metadata gate cannot be bypassed
+  PASS explicit required metadata gate cannot be bypassed
+
+PASS: action-gate phase 5 (0 failures)

package/benchmarks/results/codex-pr-metadata-2026-10-26/green.log

@@ -0,0 +1,158 @@
+=== Issue #85 Phase 5 — Pre-action gate ===
+  PASS production action-gate rule table loads without fallback
+  PASS production rule table is non-empty and keeps the destructive baseline
+  PASS rule table contains git-force-push
+  PASS rule table contains git-reset-hard
+  PASS rule table contains git-clean-force-delete
+  PASS rule table contains recursive-delete
+  PASS rule table contains powershell-recursive-force-delete
+  PASS rule table contains sql-destructive-ddl
+  PASS rule table contains package-publish
+  PASS rule table contains github-release-create
+  PASS rule table contains production-deploy
+  PASS Claude force-push defers to the host permission flow without forcing a prompt
+  PASS deferred decision still names the matched rule
+  PASS matched Claude action is audited as deferred-to-host
+  PASS audit records matched rule
+  PASS audit hashes the exact command payload
+  PASS always-ask policy restores the forced Claude prompt
+  PASS ask decision uses Claude PreToolUse hookSpecificOutput
+  PASS ask reason names the matched rule
+  PASS always-ask action is audited as pending-approval
+  PASS git status passes untouched
+  PASS safe unmatched command creates no gate audit record
+  PASS permission_mode=default defers to the host without a forced prompt
+  PASS audit records permission_mode=default
+  PASS permission_mode=acceptEdits defers to the host without a forced prompt
+  PASS audit records permission_mode=acceptEdits
+  PASS permission_mode=plan defers to the host without a forced prompt
+  PASS audit records permission_mode=plan
+  PASS permission_mode=auto defers to the host without a forced prompt
+  PASS audit records permission_mode=auto
+  PASS permission_mode=dontAsk defers to the host without a forced prompt
+  PASS audit records permission_mode=dontAsk
+  PASS permission_mode=bypassPermissions defers to the host without a forced prompt
+  PASS audit records permission_mode=bypassPermissions
+  PASS permission_mode=missing defers to the host without a forced prompt
+  PASS audit records permission_mode=missing
+  PASS command classification gates destructive action even when router hint says not required
+  PASS router actionGate hint is recorded without controlling enforcement
+  PASS safe command is not gated solely because prompt router predicted risk
+  PASS structured MCP delete is gated before execution
+  PASS audit retains normalized structured action identity
+  PASS structured action audit binds to exact payload hash
+  PASS structured action audit does not persist raw secret arguments
+  PASS read-only MCP fixture passes without a false gate
+  PASS obvious structured mutation is classified from tool identity
+  PASS non-shell local-function destructive fixture uses the same structured gate
+  PASS unknown structured action fails closed when workflow requires a gate
+  PASS unknown structured action is not fabricated as destructive without a gate requirement
+  PASS changed structured payload cannot reuse a prior approval/audit decision
+  PASS PowerShell recursive force delete outside scratch is gated
+  PASS PowerShell recursive force delete inside session scratch is exempt
+  PASS rm -rf outside scratch is gated
+  PASS rm -rf inside OS temp is exempt
+  PASS git reset --hard HEAD matches git-reset-hard
+  PASS git clean -fd matches git-clean-force-delete
+  PASS psql -c "DROP TABLE users" matches sql-destructive-ddl
+  PASS npm publish matches package-publish
+  PASS gh release create v1.2.3 matches github-release-create
+  PASS npm run deploy matches production-deploy
+  PASS host without verified ask-style decision blocks with exit 2
+  PASS non-ask host block reason names the matched rule
+  PASS non-ask host block is audited as rejected
+  PASS internal action-gate error on Claude defers to the host instead of allowing or forcing a prompt
+  PASS internal error is shown to the user as a systemMessage without a permission decision
+  PASS internal error on Claude is audited as deferred-to-host
+  PASS internal action-gate error under always-ask fails closed to ask
+  PASS internal error on host without ask fails closed to block
+  PASS missing/invalid rule table visibly falls back to built-in defaults
+  PASS built-in fallback still classifies and audits destructive action
+  PASS fallback degradation is shown to the user as a systemMessage
+  PASS valid empty rule table does not silently activate built-in defaults
+  PASS empty-table mutation control disables detection, proving production non-empty assertion is meaningful
+  PASS null-prototype serialization preserves an own __proto__ key
+  PASS own __proto__ key changes the full-input digest
+  PASS PostToolUse closes a deferred payload as executed
+  PASS executed audit keeps exact approved payload hash
+  PASS PostToolUseFailure records attempted execution without pretending success
+  PASS post-tool payload mismatch is never accepted as the approved command
+  PASS Stop closes unexecuted deferred and pending payloads
+  PASS unexecuted deferred payload is audited as rejected
+  PASS unexecuted always-ask approval is audited as rejected
+  PASS hook process returns no decision for a matched command under the default policy
+  PASS hook process audits the deferred command with its permission mode
+  PASS HARNESS_ACTION_GATE_POLICY=always-ask makes the hook process emit ask
+  PASS Claude hook manifest wires action-gate to shell and MCP pre-action surfaces
+  PASS Claude hook manifest audits successful tool execution
+  PASS Claude hook manifest audits failed tool execution
+  PASS Claude hook manifest closes unresolved approvals on Stop
+  PASS OpenAI plugin preserves the attribution-aware Codex shell action-gate adapter
+  PASS OpenAI plugin packages an isolated structured MCP pre-action adapter without widening unrelated hooks
+  PASS OpenAI plugin packages an isolated structured MCP post-action audit adapter
+  PASS Codex plugin does not declare unsupported PostToolUseFailure lifecycle event
+  PASS Codex plugin infers action-gate outcome from supported PostToolUse
+  PASS Codex PostToolUse maps zero exit code to success
+  PASS Codex PostToolUse maps non-zero exit code to failure
+  PASS Codex PostToolUse conservatively recognizes failure stderr without exit code
+  PASS OpenAI plugin closes pending approvals at Stop
+  PASS canonical and plugin action-gate rule tables are byte-identical
+  PASS OpenAI plugin packages action-gate runtime
+  PASS update_pull_request body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS update_pull_request title defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS update_pull_request title,body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS mcp__github__update_pull_request body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS mcp__github__update_pull_request title defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS mcp__github__update_pull_request title,body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS mcp__codex_apps__github__update_pull_request body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS mcp__codex_apps__github__update_pull_request title defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS mcp__codex_apps__github__update_pull_request title,body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS mcp__codex_apps__github_update_pull_request body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS mcp__codex_apps__github_update_pull_request title defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS mcp__codex_apps__github_update_pull_request title,body defers without a permission decision
+  PASS metadata remains a non-safe mutation
+  PASS metadata with {"state":"closed"} remains gated
+  PASS metadata with {"state":"open"} remains gated
+  PASS metadata with {"state":null} remains gated
+  PASS metadata with {"base_branch":"other"} remains gated
+  PASS metadata with {"maintainer_can_modify":false} remains gated
+  PASS metadata with {"maintainer_can_modify":null} remains gated
+  PASS metadata with {"unknown":true} remains gated
+  PASS metadata with {"title":"mixed","state":"closed"} remains gated
+  PASS metadata with {"draft":true} remains gated
+  PASS metadata with {"base":"other"} remains gated
+  PASS metadata with {"action_descriptor":{"action":"delete"}} remains gated
+  PASS missing or malformed metadata remains gated
+  PASS missing or malformed metadata remains gated
+  PASS missing or malformed metadata remains gated
+  PASS missing or malformed metadata remains gated
+  PASS missing or malformed metadata remains gated
+  PASS missing or malformed metadata remains gated
+  PASS missing or malformed metadata remains gated
+  PASS missing or malformed metadata remains gated
+  PASS mcp__demo__update_pull_requests receives no metadata exception
+  PASS mcp__demo__foo_update_pull_request receives no metadata exception
+  PASS mcp__demo__update_pull_request_and_delete receives no metadata exception
+  PASS mcp__codex_apps__github_update_pull_request_extra receives no metadata exception
+  PASS mcp__demo__merge_pull_request receives no metadata exception
+  PASS mcp__demo__close_pull_request receives no metadata exception
+  PASS claude retains existing mutation rule
+  PASS opencode retains existing mutation rule
+  PASS unknown retains existing mutation rule
+  PASS explicit required metadata gate cannot be bypassed
+  PASS explicit required metadata gate cannot be bypassed
+  PASS explicit required metadata gate cannot be bypassed
+  PASS explicit required metadata gate cannot be bypassed
+
+PASS: action-gate phase 5 (0 failures)

package/benchmarks/results/codex-pr-metadata-2026-10-26/live-installed-runtime-rejection.json

@@ -0,0 +1,31 @@
+{
+  "schemaVersion": 1,
+  "toolName": "mcp__codex_apps__github__update_pull_request",
+  "toolUseId": "exec-77d1176e-229f-4453-b63a-93b42534a096",
+  "commandHash": "f31fc211c0806cea786a4746147685d783325fd765a3baef3ee04157b625a73e",
+  "actionDescriptor": {
+    "schemaVersion": 1,
+    "toolFamily": "mcp",
+    "toolName": "mcp__codex_apps__github__update_pull_request",
+    "action": "mutate",
+    "resource": "dyphn1/Harness-everything",
+    "payloadHash": "f31fc211c0806cea786a4746147685d783325fd765a3baef3ee04157b625a73e",
+    "classification": "gated",
+    "reasonCodes": [
+      "tool-identity-inference"
+    ]
+  },
+  "matchedRule": "structured-mutate",
+  "ruleReason": "Structured mutate action requires pre-action authorization.",
+  "disposition": "rejected",
+  "host": "codex",
+  "permissionMode": "bypassPermissions",
+  "gatePolicy": "defer-to-host",
+  "routerActionGate": null,
+  "ruleTableSource": "/Users/daniel.chang/.codex/harness-everything/compat-hooks/runtime/0.42.0-f51078676b56/hooks/scripts/action-gate-rules.json",
+  "degradedRuleTable": false,
+  "degradationReason": null,
+  "createdAt": "2026-10-26T05:39:48.827Z",
+  "updatedAt": "2026-10-26T05:39:48.827Z",
+  "rejectionReason": "host-ask-decision-unverified-or-unsupported"
+}

package/benchmarks/results/codex-pr-metadata-2026-10-26/luna-action-family-cross-product.js

@@ -0,0 +1,143 @@
+'use strict';
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const repoRoot = path.resolve(process.argv[2] || process.cwd());
+const gate = require(path.join(repoRoot, 'hooks/scripts/action-gate.js'));
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'luna-action-cross-'));
+const table = gate.loadRuleTable(path.join(repoRoot, 'hooks/scripts/action-gate-rules.json'));
+const families = [undefined, 'mcp', 'local-function', 'shell', 'bogus'];
+const actions = [undefined, 'read', 'unknown', 'mutate', 'delete', 'publish', 'deploy', 'send', 'bogus'];
+const envelopes = [
+  ['payload.action_descriptor', d => ({ action_descriptor: d })],
+  ['payload.actionDescriptor', d => ({ actionDescriptor: d })],
+  ['tool_input.action_descriptor', d => ({ tool_input: { ...baseInput, action_descriptor: d } })],
+  ['tool_input.actionDescriptor', d => ({ tool_input: { ...baseInput, actionDescriptor: d } })],
+  ['harness.action_descriptor', d => ({ harness: { action_descriptor: d } })],
+  ['harness.actionDescriptor', d => ({ harness: { actionDescriptor: d } })],
+];
+const hintEnvelopes = [
+  gateValue => ({ actionGate: gateValue }),
+  gateValue => ({ workflowPlan: { actionGate: gateValue } }),
+  gateValue => ({ routerContract: { workflowPlan: { actionGate: gateValue } } }),
+  gateValue => ({ harness: { workflowPlan: { actionGate: gateValue } } }),
+];
+const unsafeFields = [
+  { state: null },
+  { base_branch: null },
+  { maintainer_can_modify: null },
+  { unknown_future_flag: null },
+  { draft: null },
+];
+const baseInput = { repository_full_name: 'acme/repo', pr_number: 376, body: 'fixture' };
+let sequence = 0;
+let assertions = 0;
+const failures = [];
+function check(ok, label, actual) {
+  assertions++;
+  if (!ok && failures.length < 20) failures.push({ label, actual });
+}
+function merge(a, b) {
+  const out = { ...a };
+  for (const [key, value] of Object.entries(b || {})) {
+    const left = out[key];
+    if (left && value && typeof left === 'object' && typeof value === 'object' && !Array.isArray(left) && !Array.isArray(value)) out[key] = merge(left, value);
+    else out[key] = value;
+  }
+  return out;
+}
+function candidate(envelopeBuilder, descriptor, extra = {}) {
+  let payload = {
+    hook_event_name: 'PreToolUse',
+    session_id: 'cross-product',
+    tool_use_id: `cross-${sequence++}`,
+    tool_name: 'mcp__codex_apps__github__update_pull_request',
+    tool_input: { ...baseInput },
+  };
+  payload = merge(payload, extra);
+  if (envelopeBuilder) payload = merge(payload, envelopeBuilder(descriptor));
+  return payload;
+}
+function evaluate(payload) {
+  return gate.evaluatePreToolUse(payload, {
+    host: 'codex',
+    ruleTable: table,
+    sessionDir: path.join(root, 'session'),
+  });
+}
+function descriptorFor(action, family) {
+  const d = {};
+  if (action !== undefined) d.action = action;
+  if (family !== undefined) d.toolFamily = family;
+  return d;
+}
+try {
+  // Valid metadata arguments: every descriptor location/family/action combination.
+  for (const [envelopeName, build] of envelopes) {
+    for (const family of families) {
+      for (const action of actions) {
+        const p = candidate(build, descriptorFor(action, family));
+        const result = evaluate(p);
+        const expectedAction = ['delete', 'publish', 'deploy', 'send'].includes(action) ? action : 'mutate';
+        const expectedDisposition = ['delete', 'publish', 'deploy', 'send'].includes(action) || envelopeName.startsWith('tool_input.') ? 'block' : 'allow';
+        check(result.kind === expectedDisposition, `metadata action/family/envelope ${String(action)}/${String(family)}/${envelopeName}`, { kind: result.kind, rule: result.rule?.id });
+        if (result.record) {
+          check(result.record.actionDescriptor.action === expectedAction, `decision descriptor action ${String(action)}/${String(family)}/${envelopeName}`, { action: result.record.actionDescriptor.action });
+          check(result.record.actionDescriptor.toolFamily === 'mcp', `decision descriptor family ${String(action)}/${String(family)}/${envelopeName}`, { family: result.record.actionDescriptor.toolFamily });
+        }
+        if (expectedDisposition === 'allow') {
+          check(result.record?.disposition === 'deferred-to-host', `metadata audit ${String(action)}/${String(family)}/${envelopeName}`, { record: result.record?.disposition });
+          check(result.record?.actionDescriptor.action === expectedAction, `metadata descriptor action ${String(action)}/${String(family)}/${envelopeName}`, { action: result.record?.actionDescriptor.action });
+          check(result.record?.actionDescriptor.classification === 'gated', `metadata descriptor class ${String(action)}/${String(family)}/${envelopeName}`, { classification: result.record?.actionDescriptor.classification });
+          check(result.record?.actionDescriptor.toolFamily === 'mcp', `metadata descriptor family ${String(action)}/${String(family)}/${envelopeName}`, { family: result.record?.actionDescriptor.toolFamily });
+        }
+      }
+    }
+  }
+  // All four required hint envelopes must win over all optional envelopes for every action/family/descriptor source.
+  for (const [envelopeName, build] of envelopes) {
+    for (const family of families) {
+      for (const action of actions) {
+        for (let requiredAt = 0; requiredAt < hintEnvelopes.length; requiredAt++) {
+          const hints = Object.assign({}, ...hintEnvelopes.map((make, i) => make({ required: i === requiredAt })));
+          const p = candidate(build, descriptorFor(action, family), hints);
+          const result = evaluate(p);
+          check(result.kind === 'block' && result.exitCode === 2, `required hint ${requiredAt}/${String(action)}/${String(family)}/${envelopeName}`, { kind: result.kind, code: result.exitCode });
+          check(result.record?.routerActionGate?.required === true, `required hint audit ${requiredAt}/${String(action)}/${String(family)}/${envelopeName}`, { hint: result.record?.routerActionGate });
+        }
+      }
+    }
+  }
+  // Every additional field remains gated, including null values, across action/family/envelope variants.
+  for (const [envelopeName, build] of envelopes) {
+    for (const family of families) {
+      for (const action of actions) {
+        for (const unsafe of unsafeFields) {
+          const p = candidate(build, descriptorFor(action, family));
+          p.tool_input = { ...p.tool_input, ...unsafe };
+          const result = evaluate(p);
+          check(result.kind === 'block' && result.exitCode === 2, `unsafe field ${Object.keys(unsafe)[0]}/${String(action)}/${String(family)}/${envelopeName}`, { kind: result.kind, code: result.exitCode });
+        }
+      }
+    }
+  }
+  // Bare/provider/flattened operation shapes and near misses.
+  for (const name of [
+    'update_pull_request',
+    'mcp__github__update_pull_request',
+    'mcp__codex_apps__github__update_pull_request',
+    'mcp__codex_apps__github_update_pull_request',
+    'mcp__demo__update_pull_request',
+  ]) {
+    const result = evaluate({ hook_event_name: 'PreToolUse', session_id: 'names', tool_use_id: `name-${sequence++}`, tool_name: name, tool_input: baseInput });
+    check(result.kind === 'allow' && result.record?.actionDescriptor.action === 'mutate' && result.record?.actionDescriptor.classification === 'gated', `valid exact operation ${name}`, { kind: result.kind, action: result.record?.actionDescriptor.action });
+  }
+  for (const name of ['mcp__demo__update_pull_requests', 'mcp__demo__foo_update_pull_request', 'mcp__demo__update_pull_request_and_delete', 'mcp__codex_apps__github_update_pull_request_extra']) {
+    const result = evaluate({ hook_event_name: 'PreToolUse', session_id: 'names', tool_use_id: `near-${sequence++}`, tool_name: name, tool_input: baseInput });
+    check(result.kind === 'block' && result.exitCode === 2, `near-miss operation ${name}`, { kind: result.kind, code: result.exitCode });
+  }
+  console.log(JSON.stringify({ node: process.version, assertions, cases: sequence, failures: failures.length, firstFailures: failures }, null, 2));
+  process.exitCode = failures.length ? 1 : 0;
+} finally {
+  fs.rmSync(root, { recursive: true, force: true });
+}

package/benchmarks/results/codex-pr-metadata-2026-10-26/luna-action-family-cross-product.log

@@ -0,0 +1,7 @@
+{
+  "node": "v24.22.1",
+  "assertions": 4729,
+  "cases": 2709,
+  "failures": 0,
+  "firstFailures": []
+}