harness-everything 0.42.2 → 0.43.1

package/.agents/harness-everything/document-inventory.json

@@ -0,0 +1,167 @@
+{
+  "schemaVersion": 1,
+  "documentGlobs": [
+    "**/*.md",
+    "**/*.mdx",
+    "**/*.markdown",
+    "**/*.rst",
+    "**/*.adoc",
+    "**/*.txt",
+    "**/README",
+    "**/LICENSE",
+    "**/NOTICE",
+    "**/CONTRIBUTING",
+    "**/CHANGELOG",
+    "**/CODE_OF_CONDUCT",
+    "**/SECURITY"
+  ],
+  "rules": [
+    {
+      "match": "docs/architecture.md",
+      "role": "reference",
+      "lifecycle": "current",
+      "disposition": "applicable",
+      "reason": "The current project-docs config declares this exact path as a governed reference; inventory does not expand its policy."
+    },
+    {
+      "match": "docs/doc-workflow-reconciliation.md",
+      "role": "reference",
+      "lifecycle": "current",
+      "disposition": "applicable",
+      "reason": "The current project-docs config declares this exact path as a governed reference; inventory does not expand its policy."
+    },
+    {
+      "match": "docs/governed-index.md",
+      "role": "generated-view",
+      "lifecycle": "generated",
+      "disposition": "applicable",
+      "reason": "The current project-docs config declares this exact path as derived; generator parity remains unchecked by inventory."
+    },
+    {
+      "match": "**/legacy/**",
+      "role": "legacy/archive",
+      "lifecycle": "historical",
+      "disposition": "inventory-only",
+      "reason": "Historical path is retained in the inventory; semantic validation policy is not inferred from its extension."
+    },
+    {
+      "match": "**/archive/**",
+      "role": "legacy/archive",
+      "lifecycle": "historical",
+      "disposition": "inventory-only",
+      "reason": "Historical path is retained in the inventory; semantic validation policy is not inferred from its extension."
+    },
+    {
+      "match": "**/fixtures/**",
+      "role": "fixture",
+      "lifecycle": "retained-test-input",
+      "disposition": "excluded",
+      "reason": "Fixture purpose is preserved; this path is excluded from semantic document validation."
+    },
+    {
+      "match": "**/fixture/**",
+      "role": "fixture",
+      "lifecycle": "retained-test-input",
+      "disposition": "excluded",
+      "reason": "Fixture purpose is preserved; this path is excluded from semantic document validation."
+    },
+    {
+      "match": "**/tests/**",
+      "role": "test-input",
+      "lifecycle": "retained-test-input",
+      "disposition": "excluded",
+      "reason": "Test input is preserved; this path is excluded from production document validation."
+    },
+    {
+      "match": "benchmarks/results/**",
+      "role": "evidence",
+      "lifecycle": "retained-evidence",
+      "disposition": "excluded",
+      "reason": "Evidence purpose is preserved; inventory does not claim benchmark validation."
+    },
+    {
+      "match": "**/vendor/**",
+      "role": "vendor-document",
+      "lifecycle": "external-content",
+      "disposition": "excluded",
+      "reason": "Tracked vendor content stays inventoried but is excluded from local semantic validation."
+    },
+    {
+      "match": "**/node_modules/**",
+      "role": "vendor-document",
+      "lifecycle": "external-content",
+      "disposition": "excluded",
+      "reason": "Tracked dependency content stays inventoried but is excluded from local semantic validation."
+    },
+    {
+      "match": "**/generated/**",
+      "role": "generated-view",
+      "lifecycle": "generated",
+      "disposition": "inventory-only",
+      "reason": "Generated path is identified; generator parity is unchecked unless an explicit generator contract is verified."
+    },
+    {
+      "match": "**/SKILL.md",
+      "role": "canonical-skill",
+      "lifecycle": "current",
+      "disposition": "inventory-only",
+      "reason": "Canonical skill is inventoried; routing, token, and package gates are outside this inventory command."
+    },
+    {
+      "match": "evals/**",
+      "role": "routing-eval",
+      "lifecycle": "current",
+      "disposition": "inventory-only",
+      "reason": "Routing evaluation is inventoried; evaluation gates are outside this inventory command."
+    },
+    {
+      "match": "**/templates/**",
+      "role": "template",
+      "lifecycle": "current",
+      "disposition": "inventory-only",
+      "reason": "Template content is inventoried without inferring a document lifecycle policy."
+    },
+    {
+      "match": "references/**",
+      "role": "reference",
+      "lifecycle": "current",
+      "disposition": "inventory-only",
+      "reason": "Reference path is inventoried; no project-specific semantic policy is added."
+    },
+    {
+      "match": "docs/prd/**",
+      "role": "prd",
+      "lifecycle": "unknown",
+      "disposition": "unknown",
+      "reason": "Path suggests a PRD role, but no active project-docs rule or owner decision establishes semantic coverage."
+    },
+    {
+      "match": "docs/adr/**",
+      "role": "adr",
+      "lifecycle": "unknown",
+      "disposition": "unknown",
+      "reason": "Path suggests an ADR role, but no active project-docs rule or owner decision establishes semantic coverage."
+    },
+    {
+      "match": "**/README*",
+      "role": "repository-guide",
+      "lifecycle": "current",
+      "disposition": "inventory-only",
+      "reason": "README content is inventoried without inferring semantic validation from its filename."
+    },
+    {
+      "match": "**/CHANGELOG*",
+      "role": "change-history",
+      "lifecycle": "current",
+      "disposition": "inventory-only",
+      "reason": "Change history is inventoried without adding a document lifecycle policy."
+    },
+    {
+      "match": "docs/**",
+      "role": "project-document",
+      "lifecycle": "unknown",
+      "disposition": "unknown",
+      "reason": "No current path-specific project-docs disposition is declared for this document."
+    }
+  ]
+}

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.42.2",
+      "version": "0.43.1",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.42.2",
+  "version": "0.43.1",
   "author": {
     "name": "Miya Daniel"
   },

package/.github/workflows/ci.yml

@@ -9,6 +9,88 @@ on:
   workflow_call:
 
 jobs:
+  doc-governance:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+      - name: Run base-owned document governance guard
+        env:
+          HARNESS_GUARD_EVENT: ${{ github.event_name }}
+          HARNESS_GUARD_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HARNESS_GUARD_CANDIDATE_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          node -e 'const crypto = require("node:crypto");
+          const fs = require("node:fs");
+          const os = require("node:os");
+          const path = require("node:path");
+          const { spawnSync } = require("node:child_process");
+          (function main() {
+          const guardPath = "scripts/doc-governance-guard.js";
+          const event = process.env.HARNESS_GUARD_EVENT || "unknown";
+          const baseInput = process.env.HARNESS_GUARD_BASE_SHA || "";
+          const candidateInput = process.env.HARNESS_GUARD_CANDIDATE_SHA || "";
+          function warn(state, message) {
+            console.log("::warning title=" + state + "::" + message);
+            if (process.env.GITHUB_STEP_SUMMARY) fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY, "## Document governance guard\n\n**" + state + "**: " + message + "\n\n", "utf8");
+          }
+          function git(args) {
+            const result = spawnSync("git", args, { encoding: "buffer", maxBuffer: 16 * 1024 * 1024, env: { ...process.env, GIT_CONFIG_NOSYSTEM: "1", GIT_NO_REPLACE_OBJECTS: "1", GIT_PAGER: "cat", GIT_TERMINAL_PROMPT: "0" } });
+            if (result.error) throw result.error;
+            if (result.status !== 0) throw new Error("git " + args[0] + " failed: " + Buffer.from(result.stderr || result.stdout || "").toString("utf8").trim());
+            return Buffer.from(result.stdout || "");
+          }
+          function resolveCommit(input, label) {
+            if (!/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i.test(input)) throw new Error(label + " is not a full commit SHA");
+            const resolved = git(["rev-parse", "--verify", "--quiet", "--end-of-options", input + "^{commit}"]).toString("ascii").trim().toLowerCase();
+            if (resolved !== input.toLowerCase()) throw new Error(label + " did not resolve to the supplied commit SHA");
+            return resolved;
+          }
+          if (event !== "pull_request") {
+            warn("UNCHECKED", "No externally selected PR base/head is available for event " + event + "; the base-owned guard was not executed.");
+            return;
+          }
+          try {
+            const base = resolveCommit(baseInput, "PR base SHA");
+            const candidate = resolveCommit(candidateInput, "PR head SHA");
+            const checkout = process.env.GITHUB_SHA || "unavailable";
+            console.log("PR head SHA used by the guard: " + candidate);
+            console.log("GITHUB_SHA used by checkout and the ordinary suite: " + checkout + " (the pull_request checkout may be a synthetic merge commit).");
+            const entries = git(["ls-tree", "-z", "--full-tree", base, "--", guardPath]);
+            if (entries.length === 0) {
+              warn("BOOTSTRAP_UNCHECKED", "Trusted base " + base + " has no " + guardPath + "; candidate guard was not executed. Independent review of the frozen candidate guard is required.");
+              return;
+            }
+            if (entries[entries.length - 1] !== 0) throw new Error("base guard tree entry is not NUL terminated");
+            const entry = entries.subarray(0, entries.length - 1);
+            const tab = entry.indexOf(9);
+            if (tab < 0 || entry.subarray(tab + 1).toString("utf8") !== guardPath) throw new Error("base guard tree entry is malformed");
+            const [mode, type, oid] = entry.subarray(0, tab).toString("ascii").split(" ");
+            if (!(["100644", "100755"].includes(mode)) || type !== "blob" || !/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i.test(oid || "")) throw new Error("base guard is not a regular Git blob");
+            const guardBytes = git(["cat-file", "blob", oid]);
+            const digest = crypto.createHash("sha256").update(guardBytes).digest("hex");
+            console.log("Base guard blob: " + oid + "; SHA-256: " + digest);
+            const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "harness-doc-governance-"));
+            const tempGuard = path.join(tempDir, "doc-governance-guard.js");
+            try {
+              fs.writeFileSync(tempGuard, guardBytes, { mode: 0o600 });
+              const result = spawnSync(process.execPath, [tempGuard, "--repo", process.cwd(), "--base", base, "--candidate", candidate], { encoding: "buffer", maxBuffer: 64 * 1024 * 1024, env: { ...process.env, GIT_CONFIG_NOSYSTEM: "1", GIT_NO_REPLACE_OBJECTS: "1", GIT_PAGER: "cat", GIT_TERMINAL_PROMPT: "0" } });
+              if (result.error) throw result.error;
+              if (result.stdout) process.stdout.write(result.stdout);
+              if (result.stderr) process.stderr.write(result.stderr);
+              process.exitCode = result.status === null ? 1 : result.status;
+            } finally {
+              fs.rmSync(tempDir, { recursive: true, force: true });
+            }
+          } catch (error) {
+            console.error("Document governance guard setup failed: " + (error.message || String(error)));
+            process.exitCode = 1;
+          }
+          })();'
   self-regression:
     strategy:
       fail-fast: false

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.43.1](https://github.com/dyphn1/Harness-everything/compare/v0.43.0...v0.43.1) (2026-10-27)
+
+### Bug Fixes
+
+* **governance:** let the guard pass governed content revisions ([31af03d](https://github.com/dyphn1/Harness-everything/commit/31af03d02475e150210cc6b5ba0e5b90fea0163e))
+
+## [Unreleased]
+
+### Fixed
+
+- **doc-governance:** allow regular governed-content revisions while retaining review for structural, policy, trust-surface, fixture, and derived-output changes; run the guard in its own CI job.
+
+## [0.43.0](https://github.com/dyphn1/Harness-everything/compare/v0.42.2...v0.43.0) (2026-10-27)
+
+### Features
+
+* **doc-lifecycle:** add base-owned governance guard with tamper controls ([f195bc5](https://github.com/dyphn1/Harness-everything/commit/f195bc5fc5374e52cae1df69f3b9f157a21fa06c))
+* **doc-lifecycle:** inventory tracked documentation ([9aaa86f](https://github.com/dyphn1/Harness-everything/commit/9aaa86fe3e2fc54efe092fe717747ae51ac1cca9))
+
+### Bug Fixes
+
+* **doc-lifecycle:** require review for fixture and governed content drift ([40f8ab0](https://github.com/dyphn1/Harness-everything/commit/40f8ab0e738432ea15d3ecf9c9c20aa99a8d46ff))
+
 ## [0.42.2](https://github.com/dyphn1/Harness-everything/compare/v0.42.1...v0.42.2) (2026-10-26)
 
 ### Bug Fixes