harness-everything 0.42.0 → 0.42.1

package/benchmarks/results/live-host/opencode-d1-d2-2026-10-25/evidence.json

@@ -0,0 +1,128 @@
+{
+  "schemaVersion": 1,
+  "clientDate": "2026-10-25",
+  "classification": "retained-negative-observations-only",
+  "publicReproduction": "LOCAL_ONLY supporting packets, fixtures, and runner are not shipped; this PR does not reproduce full runs",
+  "productBaseline": "37c97046cb1e620c4a3585b4da5a2593501a48be",
+  "runs": [
+    {
+      "id": "D1",
+      "engine": "OpenCode v2.1.4",
+      "requestedModel": "opencode/beam-free#default",
+      "fixtureCommit": "f486e57d1ba17d92e585b0b42dd4b9c71b2fda4a",
+      "sessionId": "ses_e8de7be3cffeBTghRaz6CN1T01",
+      "sessionOutcome": "failed",
+      "providerFailureType": "provider.free-limit",
+      "directSanitizedExportErrorTypes": [
+        "provider.free-limit",
+        "provider.free-limit"
+      ],
+      "process": {
+        "shellPipelineExit": 1,
+        "opencodeProcessExit": null,
+        "opencodeProcessExitStatus": "UNKNOWN: pipeline status captured without PIPESTATUS"
+      },
+      "sanitizedExport": {
+        "exitCode": 0,
+        "messageCount": 4,
+        "sha256": "91f80a5e8b2c94015a5a5602022aa45436cff2a52295615f7eb022aed91eee2b",
+        "source": "LOCAL_ONLY:.worktrees/packets/resume-2026-10-25/D1-current/fixture/trace/native-export.json"
+      },
+      "fixture": {
+        "gitCleanBeforeAndAfter": true,
+        "configSha256": "422eb8c6481aaadbf7910d4b415e76b2e60723bd0da4c532a94fad1879c38bcd",
+        "adrBeforeSha256": "65c903eedc1be2ca6022638fd9cab1f70c08c278e9e03be5c73ad0b2ecab4d18",
+        "adrAfterSha256": "65c903eedc1be2ca6022638fd9cab1f70c08c278e9e03be5c73ad0b2ecab4d18",
+        "taskPromptSha256": "524e58eeb6bd64e33986777b19a7fca8ec0829154fc2eb4b0c4a26b8e13b7b5e"
+      },
+      "observations": {
+        "naturalCompletionObserved": false,
+        "observerLoadMarkerObserved": false,
+        "observerTracePresent": false,
+        "pilotReportPresent": false,
+        "innerConsumerCause": "UNCHECKED",
+        "globalHarnessAbsence": "UNCHECKED"
+      },
+      "sourceArtifactSha256": {
+        "beforeState": "91018ac09c0e58537b53ffbef6adb1d2ecd5cc5b079cccc60484493aa592d474",
+        "afterState": "d2f729d1f5eb29b6a17b552fb06a31833ecbe4ef3eda5096e895ebfab212518c",
+        "filteredRunLog": "b1f1b48237c94733a6753440617e52c85ee754d1287a78b94d2513e5fdfa07a5",
+        "observerImplementation": "33a3a3c8da4f5dc495f7462952b11ee8ad46c4fa9ba0882152acd0eebf0ed56f",
+        "taskLocalPluginEntrypoint": "ad4eef698164e644e52eeb0c6f36bef56ca75a5c66d7cd71345d0091108f8fbe"
+      }
+    },
+    {
+      "id": "D2",
+      "engine": "OpenCode CLI invocation; session identity UNKNOWN",
+      "requestedModel": "nvidia/deepseek-ai/deepseek-v4.1-flash",
+      "productBaseline": "37c97046cb1e620c4a3585b4da5a2593501a48be",
+      "fixtureCommit": "39aa08987e0da2fc2ff3ea3556b84bd6d37f4e79",
+      "nvidiaPreflight": {
+        "catalogModel": "nvidia/deepseek-ai/deepseek-v4.1-flash",
+        "configuredAuthPresence": true,
+        "variant": "UNKNOWN",
+        "evidenceLayer": "non-session preflight only",
+        "providerRequestMadeDuringPreflight": false
+      },
+      "process": {
+        "exitCode": 1,
+        "signal": null,
+        "timedOut": false,
+        "spawnFailureReason": null,
+        "stdoutJsonlRecords": 1,
+        "filteredEventType": "error",
+        "sessionId": null,
+        "sessionExistence": "UNKNOWN",
+        "stderrBytes": 0,
+        "rawOutputRetained": false
+      },
+      "errorInterpretation": {
+        "errorDiscriminantRetained": false,
+        "captureLimit": "allowlist omitted the error discriminant",
+        "cause": "UNKNOWN",
+        "providerRequestStatus": "UNKNOWN"
+      },
+      "fixture": {
+        "gitCleanBeforeAndAfter": true,
+        "configSha256": "422eb8c6481aaadbf7910d4b415e76b2e60723bd0da4c532a94fad1879c38bcd",
+        "adrBeforeSha256": "65c903eedc1be2ca6022638fd9cab1f70c08c278e9e03be5c73ad0b2ecab4d18",
+        "adrAfterSha256": "65c903eedc1be2ca6022638fd9cab1f70c08c278e9e03be5c73ad0b2ecab4d18",
+        "taskPromptSha256": "524e58eeb6bd64e33986777b19a7fca8ec0829154fc2eb4b0c4a26b8e13b7b5e",
+        "adrChanged": false
+      },
+      "observations": {
+        "naturalCompletionObserved": false,
+        "observerTracePresent": false,
+        "observerLoad": "NOT_OBSERVED",
+        "sanitizedExportAttempted": false,
+        "reportCapture": "UNKNOWN: no session ID was available for lookup",
+        "globalHarnessAbsence": "UNCHECKED",
+        "isolation": "UNCHECKED"
+      },
+      "sourceArtifactSha256": {
+        "exitMetadata": "61f8904e70fa9266f52437d536a43d9f8c34b338fa1c0f55827cf1527b7f7582",
+        "filteredRunLog": "b2261fe453f0645fb8d7606979e0c4a8b7c08095a6fc1fa3dbb9a670fbf78806",
+        "observerImplementation": "33a3a3c8da4f5dc495f7462952b11ee8ad46c4fa9ba0882152acd0eebf0ed56f",
+        "taskLocalPluginEntrypoint": "ad4eef698164e644e52eeb0c6f36bef56ca75a5c66d7cd71345d0091108f8fbe"
+      }
+    }
+  ],
+  "localRunnerSelfCheck": {
+    "result": "PASS",
+    "checks": [
+      "child exit code 23",
+      "timeout and signal capture",
+      "spawn failure maps to null exit plus reason"
+    ],
+    "evidenceLayer": "deterministic mechanism only; not live-host evidence",
+    "runnerSource": "LOCAL_ONLY:.worktrees/packets/resume-2026-10-25/D2-nvidia-current/scripts/d2-runner.mjs"
+  },
+  "qualification": {
+    "e1Cycle": false,
+    "e1Go": false,
+    "behaviorBenefit": false,
+    "qualifies": false,
+    "nvidiaOutageClaim": false,
+    "prClaim": "retained negative observations only"
+  }
+}

package/ci/action-gate.test.js

@@ -353,6 +353,92 @@ try {
 
   check(fs.readFileSync(rulesPath, 'utf8') === fs.readFileSync(pluginRules, 'utf8'), 'canonical and plugin action-gate rule tables are byte-identical');
   check(fs.existsSync(pluginScript), 'OpenAI plugin packages action-gate runtime');
+
+  // Codex PR metadata scope: exact operation AND actual argument allowlist.
+  const metadataInput = { repository_full_name: 'acme/repo', pr_number: 376, body: 'metadata fixture' };
+  const metadataPayload = (input = metadataInput, tool = 'mcp__codex_apps__github__update_pull_request', extra = {}) => ({
+    ...payload('', { tool }), tool_input: input, ...extra,
+  });
+  for (const tool of ['update_pull_request', 'mcp__github__update_pull_request', 'mcp__codex_apps__github__update_pull_request', 'mcp__codex_apps__github_update_pull_request']) {
+    for (const fields of [{ body: '' }, { title: 'new title' }, { title: 'new title', body: 'new body' }]) {
+      const candidate = metadataPayload({ repository_full_name: 'acme/repo', pr_number: 376, ...fields }, tool);
+      const result = actionGate.evaluatePreToolUse(candidate, { host: 'codex', sessionDir, ruleTable: table });
+      check(result.kind === 'allow' && result.stdout === null && result.exitCode === 0, `${tool} ${Object.keys(fields)} defers without a permission decision`);
+      const descriptor = actionGate.normalizeActionDescriptor(candidate);
+      check(descriptor.action === 'mutate' && descriptor.classification === 'gated', 'metadata remains a non-safe mutation');
+    }
+  }
+  for (const selector of [{ owner: 'acme', repo: 'repo', pullNumber: 376 }, { owner: 'acme', repo: 'repo', pull_number: 376 }]) {
+    check(actionGate.evaluatePreToolUse(metadataPayload({ ...selector, body: 'provider-neutral' }), { host: 'codex', sessionDir, ruleTable: table }).kind === 'allow', 'provider-neutral selectors support metadata updates');
+  }
+  const ownUnknown = JSON.parse('{"repository_full_name":"acme/repo","pr_number":376,"body":"fixture","__proto__":{"state":"closed"}}');
+  check(actionGate.evaluatePreToolUse(metadataPayload(ownUnknown), { host: 'codex', sessionDir, ruleTable: table }).kind === 'block', 'own __proto__ field cannot escape the argument allowlist');
+  const explicitDelete = metadataPayload(metadataInput, undefined, { action_descriptor: { action: 'delete' } });
+  check(actionGate.evaluatePreToolUse(explicitDelete, { host: 'codex', sessionDir, ruleTable: table }).kind === 'block', 'explicit higher-risk action cannot inherit metadata deferral');
+  for (const extra of [
+    { state: 'closed' }, { state: 'open' }, { state: null }, { base_branch: 'other' },
+    { maintainer_can_modify: false }, { maintainer_can_modify: null }, { unknown: true },
+    { title: 'mixed', state: 'closed' }, { draft: true }, { base: 'other' },
+    { action_descriptor: { action: 'delete' } },
+  ]) {
+    const result = actionGate.evaluatePreToolUse(metadataPayload({ ...metadataInput, ...extra }), { host: 'codex', sessionDir, ruleTable: table });
+    check(result.kind === 'block' && result.exitCode === 2, `metadata with ${JSON.stringify(extra)} remains gated`);
+  }
+  for (const input of [null, [], 'body', {}, { repository_full_name: 'acme/repo', pr_number: 376 },
+    { ...metadataInput, body: null }, { ...metadataInput, title: 2 }, { ...metadataInput, body: {} }]) {
+    check(actionGate.evaluatePreToolUse(metadataPayload(input), { host: 'codex', sessionDir, ruleTable: table }).kind === 'block', 'missing or malformed metadata remains gated');
+  }
+  for (const tool of ['mcp__demo__update_pull_requests', 'mcp__demo__foo_update_pull_request', 'mcp__demo__update_pull_request_and_delete', 'mcp__codex_apps__github_update_pull_request_extra', 'mcp__demo__merge_pull_request', 'mcp__demo__close_pull_request']) {
+    check(actionGate.evaluatePreToolUse(metadataPayload(metadataInput, tool), { host: 'codex', sessionDir, ruleTable: table }).kind === 'block', `${tool} receives no metadata exception`);
+  }
+  for (const host of ['claude', 'opencode', 'unknown']) {
+    const result = actionGate.evaluatePreToolUse(metadataPayload(), { host, sessionDir, ruleTable: table });
+    check(result.rule && result.rule.id === 'structured-mutate', `${host} retains existing mutation rule`);
+  }
+  for (const hint of [{ actionGate: { required: true } }, { workflowPlan: { actionGate: { required: true } } }, { harness: { workflowPlan: { actionGate: { required: true } } } }, { routerContract: { workflowPlan: { actionGate: { required: true } } } }]) {
+    check(actionGate.evaluatePreToolUse(metadataPayload(metadataInput, undefined, hint), { host: 'codex', sessionDir, ruleTable: table }).kind === 'block', 'explicit required metadata gate cannot be bypassed');
+  }
+  for (const action of ['read', 'unknown']) {
+    for (const descriptor of [{ action_descriptor: { action } }, { actionDescriptor: { action } }, { harness: { actionDescriptor: { action } } }]) {
+      const candidate = metadataPayload({ ...metadataInput, state: 'closed' }, undefined, {
+        ...descriptor, workflowPlan: { actionGate: { required: true } },
+      });
+      const result = actionGate.evaluatePreToolUse(candidate, { host: 'codex', sessionDir, ruleTable: table });
+      check(result.kind === 'block' && result.exitCode === 2, `known Codex PR mutation cannot be downgraded to ${action}`);
+      check(result.record && result.record.actionDescriptor.action === 'mutate', 'downgrade refusal remains an audited mutation');
+    }
+    const inputDescriptor = metadataPayload({ ...metadataInput, state: 'closed', action_descriptor: { action } }, undefined, { actionGate: { required: true } });
+    check(actionGate.evaluatePreToolUse(inputDescriptor, { host: 'codex', sessionDir, ruleTable: table }).kind === 'block', `input ${action} descriptor cannot hide a required PR mutation gate`);
+  }
+  const misleadingProvider = metadataPayload({ ...metadataInput, state: 'closed' }, 'mcp__get_provider__update_pull_request');
+  check(actionGate.evaluatePreToolUse(misleadingProvider, { host: 'codex', sessionDir, ruleTable: table }).kind === 'block', 'provider namespace read token cannot downgrade exact PR mutation');
+  for (const host of ['claude', 'opencode', 'unknown']) {
+    const describedRead = metadataPayload(metadataInput, undefined, { action_descriptor: { action: 'read' } });
+    check(actionGate.evaluatePreToolUse(describedRead, { host, sessionDir, ruleTable: table }).kind === 'allow', `${host} explicit descriptor behavior remains unchanged`);
+  }
+  for (const action of ['read', 'unknown', 'mutate', 'delete', 'publish', 'deploy', 'send']) {
+    const candidate = metadataPayload({ ...metadataInput, state: 'closed', action_descriptor: { toolFamily: 'shell', action } }, undefined, { actionGate: { required: true } });
+    const result = actionGate.evaluatePreToolUse(candidate, { host: 'codex', sessionDir, ruleTable: table });
+    check(result.kind === 'block' && result.exitCode === 2, `shell family cannot disguise exact Codex PR ${action}`);
+    check(result.record && result.record.actionDescriptor.toolFamily === 'mcp', 'known MCP identity is preserved in audit');
+  }
+  const gateEnvelopes = gate => [
+    { actionGate: gate }, { workflowPlan: { actionGate: gate } },
+    { routerContract: { workflowPlan: { actionGate: gate } } },
+    { harness: { workflowPlan: { actionGate: gate } } },
+  ];
+  for (let requiredAt = 0; requiredAt < 4; requiredAt++) {
+    const optionalHints = Object.assign({}, ...gateEnvelopes({ required: false }));
+    const hints = { ...optionalHints, ...gateEnvelopes({ required: true })[requiredAt] };
+    const candidate = metadataPayload(metadataInput, undefined, hints);
+    const result = actionGate.evaluatePreToolUse(candidate, { host: 'codex', sessionDir, ruleTable: table });
+    check(result.kind === 'block' && result.exitCode === 2, `required hint envelope ${requiredAt} wins over optional envelopes`);
+    check(result.record && result.record.routerActionGate.required === true, 'audit retains required hint instead of a conflicting optional hint');
+    const creation = { ...candidate, tool_name: 'mcp__github__create_pull_request' };
+    check(actionGate.evaluatePreToolUse(creation, { host: 'codex', sessionDir, ruleTable: table }).kind === 'block', 'PR creation still honors the documented explicit required gate');
+  }
+
+
 } catch (err) {
   console.error(err.stack || err.message);
   failed++;

package/ci/mechanism-2aa-codex-action-gate-policy.test.js

@@ -127,6 +127,53 @@ try {
   assert.strictEqual(attributedBlock.exitCode, 2);
   assert.ok(attributedBlock.attribution.file && fs.existsSync(attributedBlock.attribution.file), 'destructive hook entry must be attributable before the block result');
 
+  // Execute both canonical and packaged pre-entrypoints with real MCP argument shapes.
+  for (const gate of [actionGate, require(path.join(pluginRoot, 'hooks', 'scripts', 'action-gate.js'))]) {
+    for (const outcome of ['success', 'failure']) {
+      const candidate = {
+        ...payload('', { toolUseId: `metadata-${outcome}`, turnId: 'metadata-turn' }),
+        tool_name: 'mcp__codex_apps__github__update_pull_request',
+        tool_input: { repository_full_name: 'acme/repo', pr_number: 376, body: 'private fixture body' },
+      };
+      const pre = gate.evaluatePreToolUse(candidate, { host: 'codex', sessionDir, ruleTable: table });
+      assert.strictEqual(pre.kind, 'allow');
+      assert.strictEqual(pre.stdout, null);
+      assert.strictEqual(pre.record.disposition, 'deferred-to-host');
+      assert.strictEqual(pre.record.host, 'codex');
+      assert.strictEqual(pre.record.toolUseId, candidate.tool_use_id);
+      assert.strictEqual(pre.record.matchedRule, 'routine-pr-metadata-update');
+      const hash = gate.hashExact(gate.exactPayloadText(candidate));
+      assert.strictEqual(pre.record.commandHash, hash);
+      assert.strictEqual(pre.record.actionDescriptor.payloadHash, hash);
+      assert.ok(!JSON.stringify(pre.record).includes('private fixture body'));
+      const post = gate.finalizeExecution(candidate, outcome, { sessionDir });
+      assert.strictEqual(post.record.disposition, 'executed');
+      assert.strictEqual(post.record.executionOutcome, outcome);
+      assert.strictEqual(post.record.commandHash, hash);
+
+      gate.evaluatePreToolUse(candidate, { host: 'codex', sessionDir, ruleTable: table });
+      const altered = { ...candidate, tool_input: { ...candidate.tool_input, state: 'closed' } };
+      assert.strictEqual(gate.finalizeExecution(altered, 'success', { sessionDir }).record.disposition, 'integrity-violation');
+      const denied = gate.evaluatePreToolUse(altered, { host: 'codex', sessionDir, ruleTable: table });
+      assert.strictEqual(denied.kind, 'block');
+      assert.strictEqual(denied.exitCode, 2);
+      assert.strictEqual(denied.stdout, null);
+      assert.strictEqual(denied.record.disposition, 'rejected');
+      assert.strictEqual(denied.record.rejectionReason, 'host-ask-decision-unverified-or-unsupported');
+      assert.notStrictEqual(denied.record.commandHash, hash);
+    }
+  }
+  const metadataEntry = preAdapter.processPayload({
+    ...payload('', { toolUseId: 'metadata-entry' }),
+    tool_name: 'mcp__codex_apps__github_update_pull_request',
+    tool_input: { repository_full_name: 'acme/repo', pr_number: 376, title: 'fixture' },
+  }, { host: 'codex', sessionDir, ruleTable: table, attributionDir, runNonce: 'metadata-fixture' });
+  assert.strictEqual(metadataEntry.kind, 'allow');
+  assert.strictEqual(metadataEntry.attribution.record.payloadHash, metadataEntry.record.commandHash);
+  assert.strictEqual(metadataEntry.attribution.record.toolUseId, metadataEntry.record.toolUseId);
+  assert.strictEqual(fs.readFileSync(path.join(ROOT, 'hooks/scripts/action-gate.js'), 'utf8'),
+    fs.readFileSync(path.join(pluginRoot, 'hooks/scripts/action-gate.js'), 'utf8'));
+
   const blockedParent = path.join(tempRoot, 'not-a-directory');
   fs.writeFileSync(blockedParent, 'fixture', 'utf8');
   const failedAttribution = preAdapter.processPayload(payload('git push --force origin main', {

package/ci/mechanism-task-git-authorization.test.js

@@ -131,6 +131,18 @@ try {
   }));
   assert.strictEqual(neutralResult.status, 0, 'exact create_pull_request operation must be host-deferred on Codex (currently exits 2: RED)');
 
+  for (const tool of ['mcp__codex_apps__github__update_pull_request', 'mcp__codex_apps__github_update_pull_request', 'mcp__github__update_pull_request']) {
+    for (const fields of [{ body: 'replacement body' }, { title: 'replacement title' }, { title: 'both', body: '' }]) {
+      const result = run(payload(tool, { repository_full_name: 'acme/repo', pr_number: 1, ...fields }));
+      assert.strictEqual(result.status, 0, 'metadata-only actual stdin payload must be host-deferred');
+      assert.strictEqual(result.stdout.trim(), '', 'metadata deferral must emit no permission decision');
+    }
+    const denied = run(payload(tool, { repository_full_name: 'acme/repo', pr_number: 1, body: 'mixed', state: 'closed' }));
+    assert.strictEqual(denied.status, 2, 'mixed metadata/state actual stdin payload must fail closed');
+    assert.strictEqual(denied.stdout.trim(), '');
+    assert.match(denied.stderr, /structured-mutate/);
+  }
+
   // Genuine mutations remain blocked, but the fixed-format approval protocol is retired.
   const legacyMutation = run(payload('mcp__demo__update_issue', { issue_id: 1, title: 'changed' }));
   assert.strictEqual(legacyMutation.status, 2, 'genuine mutation must remain blocked on Codex');

package/docs/codex-action-gate.md

@@ -132,7 +132,8 @@ Harness does not parse, bind, or intercept any fixed approval syntax in user
 prompts. Native agent task-scope authorization and native permissions remain
 authoritative.
 
-Routine exact `create_pull_request` operations are host-deferred (below). All
+Routine exact `create_pull_request` operations and Codex title/body-only
+`update_pull_request` operations are host-deferred (below). All
 other risky actions (merge/delete/deploy/publish/send/force-push and unrelated
 genuine mutations) remain hard PreToolUse blocks; an explicitly required
 `actionGate` hint still gates. These are deterministic mechanism changes, not
@@ -153,3 +154,28 @@ risky actions (merge/delete/deploy/publish/send/force-push and unrelated genuine
 mutations) remain gated; exact operation matching is used, with no substring
 exemption, so misleading names such as `create_pull_requests` or
 `foo_create_pull_request` still block.
+
+
+## Codex PR title/body updates (host-deferred)
+
+The Codex-only metadata exception checks the actual tool input, with all of these conditions:
+
+- Exact final `__` operation `update_pull_request`, or exact flattened connector name `mcp__codex_apps__github_update_pull_request`.
+- A non-array object containing at least one string `title` or `body` (empty body is supported).
+- Only `title`, `body`, and selector keys `repository_full_name`, `pr_number`, `owner`, `repo`, `pullNumber`, `pull_number` are present.
+- Exact Codex PR updates cannot be downgraded to `read`/`unknown` by an explicit descriptor or a provider namespace; higher-risk action descriptors remain gated. Their tool family comes from the actual tool identity, so a descriptor cannot disguise the MCP update as shell input.
+- No explicit required `actionGate` hint in any supported envelope (a required hint wins over conflicting optional hints); the action descriptor remains `mutate`/`gated`.
+
+Any additional key, including `state`, `base_branch`, `base`, `maintainer_can_modify`, `draft`, or an unknown key, prevents the exception, even when its value is null. Mixed metadata/high-risk inputs and similar operation names retain the existing Gate. Claude, OpenCode and unknown hosts retain their prior mutation rules. PR creation behavior is unchanged.
+
+```mermaid
+flowchart LR
+  A["Exact PR update + actual arguments"] --> B{"Codex + title/body only<br/>+ no required Gate?"}
+  B -->|Yes| C["Host-deferred mutation<br/>no permission decision"]
+  B -->|No| D["Existing structured Gate"]
+  C --> E["Native task scope + permissions<br/>+ GitHub authorization"]
+```
+
+Host-deferred does not grant authorization. Harness emits no `permissionDecision` allow/ask; native permissions, task scope, and GitHub access still decide execution. The audit records `routine-pr-metadata-update`, `deferred-to-host`, host/tool provenance and the exact payload hash, without storing title/body. PostToolUse records execution success/failure; Stop rejects an unexecuted deferral. A changed payload cannot reuse the original hash.
+
+Evidence: [RED/GREEN and independent review](../benchmarks/results/codex-pr-metadata-2026-10-26/README.md). Package/mechanism verification is separate from live Host verification (#110, #122, #135; affected PR #376).

package/docs/doc-workflow-reconciliation.md

@@ -6,7 +6,7 @@ status: active
 # Document workflow reconciliation — Phase 3b S1 runtime
 
 **Status: the runtime ships default OFF; opt in with `HARNESS_DOC_RECONCILIATION_PILOT=1`.
-With the pilot ON, F4 ([#358](https://github.com/dyphn1/Harness-everything/pull/358)) grants limited positive credit for exactly `doc-lint` and `link-check`, from a host-captured run of the installed doc-check on Claude Code 2.1.309 (live runs 4–5). S3 provider integration is pending; E1 has not started.**
+With the pilot ON, F4 ([#358](https://github.com/dyphn1/Harness-everything/pull/358)) grants limited positive credit for exactly `doc-lint` and `link-check`, from a host-captured run of the installed doc-check on Claude Code 2.1.309 (live runs 4–5). S3 provider integration is pending; E1 remains OPEN with insufficient qualifying exposure. The recorded OpenCode [D1/D2 attempts](../benchmarks/results/live-host/opencode-d1-d2-2026-10-25/README.md) do not qualify as E1 cycles.**
 This document refines the [document lifecycle contract](document-lifecycle.md#phase-3b--narrow-integration-contract-s1-default-off-f4-limited-credit).
 The [accepted E0](https://github.com/dyphn1/Harness-everything/issues/341#issuecomment-6308604128)
 permits this limited, reversible consumer under the
@@ -336,7 +336,7 @@ Preparation assertion rows do not carry `reportOrigin`; the S1 runtime report ca
 marker is never presented as a production report.
 ## S1 — switch, trusted scope and fail-closed no-credit gate
 
-**S1 runtime ships default OFF (`HARNESS_DOC_RECONCILIATION_PILOT=1` opts in). With the pilot ON, F4 (#358) grants limited positive credit for `doc-lint` and `link-check` only; S3 provider integration is pending and E1 has not started.**
+**S1 runtime ships default OFF (`HARNESS_DOC_RECONCILIATION_PILOT=1` opts in). With the pilot ON, F4 (#358) grants limited positive credit for `doc-lint` and `link-check` only; S3 provider integration is pending; E1 remains OPEN with insufficient qualifying exposure, and D1/D2 are non-qualifying.**
 The [accepted E0](https://github.com/dyphn1/Harness-everything/issues/341#issuecomment-6308604128)
 permits this limited implementation; the [posted execution plan](https://github.com/dyphn1/Harness-everything/issues/325)
 orders Docs → RED → GREEN → independent review → green CI for each slice. S1 was the temporary
@@ -1085,7 +1085,8 @@ provider adapter remains pending. Require every expected applicable MUST and
 freshness check before positive credit, plus source/package compatibility, negative cases and
 relevant green CI including Windows. The S1 suites establish their tested mechanism/package
 contracts; they do not establish independent host provenance, live-host loading or architectural
-benefit. E1 has not started and begins only after a creditable S2; E1 GO and H1–H4/paired evidence
+benefit. E1 observation remains OPEN with insufficient qualifying exposure; it begins only after
+a creditable S2, and the D1/D2 attempts are non-qualifying. E1 GO and H1–H4/paired evidence
 remain separate gates.
 
 ## F4: credited reconciliation (Claude-only, pilot ON)

package/docs/document-lifecycle.md

@@ -4,7 +4,7 @@ Contract for the documentation family: project docs configuration (D5), document
 
 Documentation is a **consumer** of the #320 workflow/obligation abstractions. Nothing here is a second router, a standing maintenance loop or a cognitive lock: every check is a pure function that reports diagnostics.
 
-## Scope of this slice (status as of 2026-10-20)
+## Scope of this slice (original 2026-10-20 checkpoint; Phase 3b/3c status updated 2026-10-25)
 
 This table distinguishes merged mechanism code from end-to-end workflow integration. The last reviewed `main` commit is `29b1d65b398e2622af97bf067078373b7fa76b26` (v0.36.2). That release commit carries `[skip ci]` and only bumps package/distribution versions on top of `e5d22584e243d5b5e587ee0279625e97a9033160`, whose full-gate `CI` run [39374474269](https://github.com/dyphn1/Harness-everything/actions/runs/39374474269) completed with every job succeeded. The historical Windows System One resident teardown (`S1-RS15`) was observed in attempt 1 of [run 39175240370](https://github.com/dyphn1/Harness-everything/actions/runs/39175240370) on `main@75e04359ae5bf11a41739f8eb04d25a76ee8f3a7`; that run completed successfully on attempt 2 and says nothing about `29b1d65`. Treat the resident teardown as a known platform limitation only when a current run on the exact SHA reproduces it, and require an all-green full-gate run for that SHA before calling any baseline green.
 
@@ -15,8 +15,8 @@ This table distinguishes merged mechanism code from end-to-end workflow integrat
 | 2 — roles, IDs, aliases, legacy, supersession, index, D6.9 PRD revisions | **Merged** in #327; do not rebuild this lifecycle logic for Phase 3 |
 | Step-type prerequisite (#326) | **Complete:** PR #328 merged; Harness-owned `doc-change` is explicitly declared, has no implicit TDD binding, and is not auto-inserted by router/System One |
 | 3a — document facts, obligations and evidence producer | **Merged** in #334: `harness-everything/scripts/doc-obligations.js` and `doc-evidence.js`. H3/H4 have *partial deterministic mechanism* coverage, not integrated workflow evidence. Known limitations: caller-attested envelope; `configDigest` presence-only; `candidateDigest` restricted to `docs/prd/`; missing independent task-scope binding. Deleted and old rename paths are bound to trusted per-path baseline evidence ([doc-evidence-baseline-binding.md](doc-evidence-baseline-binding.md), #335 fixed by #342), with workflow-disposition reconciliation left out of scope |
-| 3b — pilot-local provider suggestions and workflow evidence reconciliation | **S1 runtime ships default OFF** (opt in with `HARNESS_DOC_RECONCILIATION_PILOT=1`), with trusted scope assessment and fail-closed withholding. **F4 (#358) adds limited positive credit** for exactly `doc-lint` and `link-check` from a host-captured run of the installed doc-check (Claude Code only; live runs on 2.1.309). See [S1 switch, trusted scope and no-credit contract](doc-workflow-reconciliation.md#s1--switch-trusted-scope-and-fail-closed-no-credit-gate). S3 pure advisory provider suggestions shipped in 0.37.0 (not wired); E1 has not started. Accepted #341 E0 permits this limited reversible consumer; the live runs are not E1 GO; preserve existing required-binding compatibility |
-| 3c — H1–H4 and paired-task evaluation | **Not started.** Mechanism tests alone are insufficient for architecture promotion; compare frozen baseline and treatment on real bounded tasks, success/failure first, then conditional cost and latency |
+| 3b — pilot-local provider suggestions and workflow evidence reconciliation | **S1 runtime ships default OFF** (opt in with `HARNESS_DOC_RECONCILIATION_PILOT=1`), with trusted scope assessment and fail-closed withholding. **F4 (#358) adds limited positive credit** for exactly `doc-lint` and `link-check` from a host-captured run of the installed doc-check (Claude Code only; live runs on 2.1.309). See [S1 switch, trusted scope and no-credit contract](doc-workflow-reconciliation.md#s1--switch-trusted-scope-and-fail-closed-no-credit-gate). S3 pure advisory provider suggestions shipped in 0.37.0 (not wired); E1 remains OPEN with insufficient qualifying exposure, and D1/D2 are non-qualifying. Accepted #341 E0 permits this limited reversible consumer; the live runs are not E1 GO; preserve existing required-binding compatibility |
+| 3c — H1–H4 and paired-task evaluation | **H1 preparation only** in [#373](https://github.com/dyphn1/Harness-everything/pull/373) ([retained evidence](../benchmarks/results/h1-provider-independence-qualification/README.md)); full H1–H4 and paired-task evaluation remain pending. Mechanism tests alone are insufficient for architecture promotion; compare frozen baseline and treatment on real bounded tasks, success/failure first, then conditional cost and latency |
 | 1b — shared documentation craft and family metadata | **Shared craft delivered** in F2 (#356): shared references with thin skill consumers. Family metadata is not established. A small optional logical-family metadata seam may be piloted; physical skill directory moves remain blocked on #320 identity/path separation |
 | 4 — derived-view generators and `describes:` drift | **Regenerate-equals delivered** in F3 (#357) for authorized generators; `describes:` drift reminders and broader maintenance are not established. Preserve generator authorization, deterministic regenerate-equals and scoped reminder semantics |
 

package/docs/platform-capabilities.md

@@ -17,6 +17,10 @@ Statuses are intentionally explicit:
 
 Codex and OpenCode are `Partial` in `liveHostVerification`. The Codex artifact verifies user-hook compatibility capture for two consecutive turns on one Windows Codex CLI host; native plugin-hook mounting and other host/version combinations remain unverified. OpenCode's retained evidence supports project-scope `.js` loading and edit/verification state on OpenCode 1.18.31 (macOS), not durable hard enforcement. No fresh artifacts exist yet for the other surfaces, managed-workspace import, or public OpenAI approval.
 
+### Codex PR metadata action-gate boundary
+
+Exact title/body-only `update_pull_request` calls are Codex-only host-deferred mutations after an argument allowlist check; explicit required Gate hints and all additional fields retain the existing Gate. Native task scope, permissions and GitHub authorization remain authoritative. Canonical/package mechanism tests cover hashes, audit provenance, outcomes and negative controls; this does not establish candidate live-host coverage. See [Codex policy](codex-action-gate.md#codex-pr-titlebody-updates-host-deferred).
+
 ### Routing contract vs. host evidence
 
 The workflow plan controller rejects present non-array required/optional binding declarations before recording a requirement plan. This input-validation contract is covered by deterministic mechanism tests and does not change live-host evidence status.
@@ -27,7 +31,8 @@ This is a **repository/agent contract**, not an automatic upgrade to any platfor
 
 ### Action-gate mechanism vs. host semantic boundary
 
-Routine exact `create_pull_request` operations are host-deferred at the mechanism level:
+Routine exact `create_pull_request` operations and Codex title/body-only
+`update_pull_request` operations are host-deferred at the mechanism level:
 their descriptor remains a mutation (not read/safe), and no Harness consent or
 `permissionDecision` is emitted. Native agent task-scope authorization and native
 permissions stay authoritative; an explicit required `actionGate` hint still gates.
@@ -140,7 +145,8 @@ The public OpenAI Skills-only plugin is narrower again. Its ZIP contains the pac
 Codex `UserPromptSubmit` prompts pass through to the normal router unchanged;
 Harness does not parse or intercept a fixed approval syntax. Native agent
 task-scope authorization and native permissions remain authoritative. Routine
-exact `create_pull_request` operations are host-deferred at the mechanism level:
+exact `create_pull_request` operations and Codex title/body-only
+`update_pull_request` operations are host-deferred at the mechanism level:
 their descriptor remains a mutation (not read/safe), and no Harness consent or
 `permissionDecision` is emitted. All other risky actions remain hard PreToolUse
 blocks; an explicitly required `actionGate` hint still gates. These are

package/hooks/scripts/action-gate.js

@@ -108,12 +108,14 @@ function safeResource(input, explicit) {
   return null;
 }
 
-function normalizeActionDescriptor(payload) {
+function normalizeActionDescriptor(payload, options = {}) {
   const tool = toolNameOf(payload);
   const input = toolInputOf(payload);
   const explicit = explicitActionDescriptor(payload);
-  const toolFamily = inferToolFamily(tool, explicit);
-  const action = inferStructuredAction(tool, explicit);
+  const codexPrUpdate = detectHost(payload, options.host) === 'codex' && isPullRequestUpdateTool(tool);
+  const toolFamily = inferToolFamily(tool, codexPrUpdate ? null : explicit);
+  const inferred = inferStructuredAction(tool, explicit);
+  const action = codexPrUpdate && !STRUCTURED_GATED_ACTIONS.has(inferred) ? 'mutate' : inferred;
   const classification = STRUCTURED_GATED_ACTIONS.has(action)
     ? 'gated'
     : (STRUCTURED_SAFE_ACTIONS.has(action) ? 'safe' : 'unknown');
@@ -140,8 +142,23 @@ function isRoutinePullRequestCreation(toolName) {
   return (last === 'create_pull_request' || name === 'create_pull_request');
 }
 
-function structuredRule(payload) {
-  const descriptor = normalizeActionDescriptor(payload);
+function isPullRequestUpdateTool(name) {
+  return name.split('__').pop() === 'update_pull_request' || name === 'mcp__codex_apps__github_update_pull_request';
+}
+
+function isPullRequestMetadataUpdate(payload) {
+  if (!isPullRequestUpdateTool(toolNameOf(payload))) return false;
+  const input = toolInputOf(payload);
+  if (!input || typeof input !== 'object' || Array.isArray(input)) return false;
+  const keys = Object.keys(input);
+  const allowed = new Set(['repository_full_name', 'pr_number', 'owner', 'repo', 'pullNumber', 'pull_number', 'title', 'body']);
+  return keys.every(key => allowed.has(key))
+    && keys.some(key => key === 'title' || key === 'body')
+    && keys.filter(key => key === 'title' || key === 'body').every(key => typeof input[key] === 'string');
+}
+
+function structuredRule(payload, options = {}) {
+  const descriptor = normalizeActionDescriptor(payload, options);
   if (descriptor.toolFamily === 'shell') return { descriptor, rule: null };
   if (descriptor.classification === 'safe') return { descriptor, rule: null };
   // Routine PR creation is a host-deferred mutation, not a Harness-gated one:
@@ -152,6 +169,10 @@ function structuredRule(payload) {
   if (isRoutinePullRequestCreation(descriptor.toolName) && !(hint && hint.required)) {
     return { descriptor, rule: null };
   }
+  if (detectHost(payload, options.host) === 'codex' && descriptor.action === 'mutate'
+      && isPullRequestMetadataUpdate(payload) && !(hint && hint.required)) {
+    return { descriptor, rule: null, hostDeferred: true };
+  }
   if (descriptor.classification === 'gated') {
     return {
       descriptor,
@@ -367,7 +388,8 @@ function routerActionGateHint(payload) {
     payload && payload.routerContract && payload.routerContract.workflowPlan && payload.routerContract.workflowPlan.actionGate,
     payload && payload.harness && payload.harness.workflowPlan && payload.harness.workflowPlan.actionGate,
   ];
-  const gate = candidates.find(candidate => candidate && typeof candidate === 'object');
+  const gate = candidates.find(candidate => candidate && typeof candidate === 'object' && candidate.required)
+    || candidates.find(candidate => candidate && typeof candidate === 'object');
   if (!gate) return null;
   return {
     required: Boolean(gate.required),
@@ -435,7 +457,7 @@ function recordDecision(payload, rule, table, host, disposition, options = {}, e
   const exact = exactPayloadText(payload);
   const commandHash = hashExact(exact);
   const now = new Date().toISOString();
-  const descriptor = normalizeActionDescriptor(payload);
+  const descriptor = normalizeActionDescriptor(payload, { host });
   const record = {
     schemaVersion: 1,
     toolName: toolNameOf(payload),
@@ -467,11 +489,15 @@ function recordDecision(payload, rule, table, host, disposition, options = {}, e
 function evaluatePreToolUse(payload, options = {}) {
   const context = sessionContext(payload, options.sessionDir);
   const table = options.ruleTable || loadRuleTable(options.rulePath || RULES_PATH);
-  const structured = structuredRule(payload);
+  const structured = structuredRule(payload, options);
   const rule = structured.rule || classify(payload, table.rules, context.sessionDir);
   const host = detectHost(payload, options.host);
 
   if (!rule) {
+    const record = structured.hostDeferred ? recordDecision(payload, {
+      id: 'routine-pr-metadata-update',
+      reason: 'Codex PR title/body metadata update defers to native task scope and permissions.',
+    }, table, host, 'deferred-to-host', { ...options, sessionDir: context.sessionDir }) : null;
     return {
       kind: 'allow',
       exitCode: 0,
@@ -480,6 +506,7 @@ function evaluatePreToolUse(payload, options = {}) {
       rule: null,
       table,
       descriptor: structured.descriptor,
+      ...(record ? { record } : {}),
     };
   }
 

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.42.0",
+  "version": "0.42.1",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.42.0",
+  "version": "0.42.1",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.42.0",
+  "version": "0.42.1",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",