harness-everything 0.43.1 → 0.44.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.43.1",
+      "version": "0.44.0",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.43.1",
+  "version": "0.44.0",
   "author": {
     "name": "Miya Daniel"
   },

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.44.0](https://github.com/dyphn1/Harness-everything/compare/v0.43.1...v0.44.0) (2026-10-27)
+
+### Features
+
+* **governance:** accept git-aware globs in the base-owned guard ([674a96d](https://github.com/dyphn1/Harness-everything/commit/674a96d7295555926ab3bb1b8ca0204cf59dbad5)), closes [#325](https://github.com/dyphn1/Harness-everything/issues/325)
+
 ## [0.43.1](https://github.com/dyphn1/Harness-everything/compare/v0.43.0...v0.43.1) (2026-10-27)
 
 ### Bug Fixes
@@ -12,7 +18,7 @@ All notable changes to this project are documented in this file.
 
 ### Fixed
 
-- **doc-governance:** allow regular governed-content revisions while retaining review for structural, policy, trust-surface, fixture, and derived-output changes; run the guard in its own CI job.
+- **doc-governance:** allow regular governed-content revisions and expand base-owned governed/derived globs against Git trees, while retaining review for membership, structural, policy, trust-surface, fixture, and derived-output changes; run the guard in its own CI job.
 
 ## [0.43.0](https://github.com/dyphn1/Harness-everything/compare/v0.42.2...v0.43.0) (2026-10-27)
 

package/ci/mechanism-2ax-doc-lifecycle.test.js

@@ -1667,8 +1667,8 @@ checkCase('2ax. frozen Git-object guard with bootstrap and tamper controls', ()
     return fixtureGit(root, ['rev-parse', 'HEAD']).toString('ascii').trim();
   }
 
-  function createFixture() {
-    const root = workspace('governance-guard-git');
+  function createFixture(name = 'governance-guard-git') {
+    const root = workspace(name);
     fs.mkdirSync(path.join(root, '.fixture-hooks'), { recursive: true });
     fixtureGit(root, ['init', '--quiet']);
     fixtureGit(root, ['config', 'user.name', 'Harness Guard Test']);
@@ -1820,6 +1820,190 @@ checkCase('2ax. frozen Git-object guard with bootstrap and tamper controls', ()
   assert.deepStrictEqual(derivedEntry.base, configuredIdentity(fixture.base, 'docs/governed-index.md'));
   assert.deepStrictEqual(derivedEntry.candidate, configuredIdentity(derivedCandidate, 'docs/governed-index.md'));
 
+  const globPatterns = [
+    'docs/adr/*.md',
+    'empty/*.md',
+    'corpus/one*.md', // portability-lint: allow glob pattern string, never created as a file
+    'corpus/*.md',
+    'deep/**/*.md',
+    'repeat/**/repeat/*.md',
+    'literal.v1/**/*.md'
+  ];
+  const corpusPaths = [
+    'docs/adr/one.md', 'docs/adr/two.md', 'generated/view.md', 'generated/nested/view.md',
+    'corpus/one.md', 'corpus/many-a.md', 'corpus/many-b.md',
+    'deep/zero.md', 'deep/a/b.md',
+    'repeat/repeat/first.md', 'repeat/a/repeat/second.md',
+    'literal.v1/top.md', 'literal.v1/sub/nested.md', 'literalXv1/no.md'
+  ];
+  const globFixture = createFixture('governance-guard-glob-git');
+  resetFixture(globFixture);
+  const globPolicy = {
+    governed: globPatterns.map(pattern => ({ path: pattern, role: 'reference' })),
+    derived: [{ path: 'generated/**/*.md', generator: 'build' }]
+  };
+  writeRelative(globFixture.root, '.agents/harness-everything/project-docs.json', `${JSON.stringify(globPolicy, null, 2)}\n`);
+  for (const relativePath of corpusPaths) writeRelative(globFixture.root, relativePath, `baseline ${relativePath}\n`);
+  globFixture.base = commitFixture(globFixture.root, 'glob policy baseline');
+
+  const globAccepted = runFrozenGuard(globFixture, globFixture.base, globFixture.base);
+  assert.strictEqual(globAccepted.report.verdict, 'PASS', globAccepted.report.errors[0]?.message);
+  const globSummaries = globAccepted.report.policyPreservation.configuredPaths.patterns;
+  assert.ok(globSummaries, 'glob records report their base and candidate member counts');
+  assert.strictEqual(globAccepted.report.policyPreservation.configuredPaths.paths.find(item => item.path === 'docs/adr/one.md').state, 'pass', 'unchanged glob members pass');
+  assert.deepStrictEqual(runFrozenGuard(globFixture, globFixture.base, globFixture.base), globAccepted, 'glob reports are deterministic for identical Git inputs');
+  const lifecycleSource = fs.readFileSync(modulePath, 'utf8');
+  const lifecycleMatcherSource = lifecycleSource.match(/function globToRegExp\(glob\) \{[\s\S]*?\n\}/);
+  assert.ok(lifecycleMatcherSource, 'doc-lifecycle globToRegExp remains available for the consistency check');
+  const lifecycleGlobToRegExp = new Function(`${lifecycleMatcherSource[0]}\nreturn globToRegExp;`)();
+  for (const pattern of globPatterns) {
+    const expected = corpusPaths.filter(relativePath => lifecycleGlobToRegExp(pattern).test(relativePath)).length;
+    const summary = globSummaries.find(item => item.kind === 'governed' && item.path === pattern);
+    assert.ok(summary, `glob summary exists for ${pattern}`);
+    assert.strictEqual(summary.baseMembers, expected, `guard matcher agrees with doc-lifecycle for ${pattern}`);
+    assert.strictEqual(summary.candidateMembers, expected, `candidate matcher agrees with doc-lifecycle for ${pattern}`);
+    const expectedPaths = corpusPaths.filter(relativePath => lifecycleGlobToRegExp(pattern).test(relativePath)).sort((left, right) => Buffer.compare(Buffer.from(left), Buffer.from(right)));
+    const actualPaths = globAccepted.report.policyPreservation.configuredPaths.paths
+      .filter(item => item.kind === 'governed' && item.pattern === pattern).map(item => item.path);
+    assert.deepStrictEqual(actualPaths, expectedPaths, `guard matcher returns the same members as doc-lifecycle for ${pattern}`);
+  }
+  assert.strictEqual(globSummaries.find(item => item.path === 'empty/*.md').baseMembers, 0, 'an empty glob is legal and reports zero members');
+
+  resetFixture(globFixture);
+  writeRelative(globFixture.root, 'docs/adr/one.md', 'revised governed glob member\n');
+  const globRevisionCandidate = commitFixture(globFixture.root, 'revise glob member');
+  const globRevision = runFrozenGuard(globFixture, globFixture.base, globRevisionCandidate);
+  assert.strictEqual(globRevision.status, 0, 'a regular governed glob member revision passes');
+  const globRevisionEntry = globRevision.report.policyPreservation.configuredPaths.paths.find(item => item.path === 'docs/adr/one.md');
+  assert.strictEqual(globRevisionEntry.state, 'revised');
+
+  resetFixture(globFixture);
+  writeRelative(globFixture.root, 'docs/adr/new.md', 'new governed glob member\n');
+  const globAdditionCandidate = commitFixture(globFixture.root, 'add glob member');
+  const globAddition = runFrozenGuard(globFixture, globFixture.base, globAdditionCandidate);
+  assert.strictEqual(globAddition.status, 2, 'a new glob member requires review');
+  assert.strictEqual(globAddition.report.policyPreservation.configuredPaths.paths.find(item => item.path === 'docs/adr/new.md').state, 'review_required');
+
+  resetFixture(globFixture);
+  fixtureGit(globFixture.root, ['rm', '--quiet', '--', 'docs/adr/two.md']);
+  const globDeletionCandidate = commitFixture(globFixture.root, 'delete glob member');
+  const globDeletion = runFrozenGuard(globFixture, globFixture.base, globDeletionCandidate);
+  assert.strictEqual(globDeletion.status, 2, 'a deleted glob member requires review');
+  assert.strictEqual(globDeletion.report.policyPreservation.configuredPaths.paths.find(item => item.path === 'docs/adr/two.md').candidate, null);
+
+  resetFixture(globFixture);
+  fixtureGit(globFixture.root, ['mv', '--', 'docs/adr/one.md', 'docs/adr/renamed.md']);
+  const globRenameCandidate = commitFixture(globFixture.root, 'rename glob member');
+  const globRename = runFrozenGuard(globFixture, globFixture.base, globRenameCandidate);
+  const globRenamePaths = globRename.report.policyPreservation.configuredPaths.paths;
+  assert.strictEqual(globRename.status, 2, 'a rename within a glob requires review');
+  assert.strictEqual(globRenamePaths.find(item => item.path === 'docs/adr/one.md').candidate, null, 'rename retains the old endpoint');
+  assert.strictEqual(globRenamePaths.find(item => item.path === 'docs/adr/renamed.md').base, null, 'rename retains the new endpoint');
+
+  for (const mutation of ['mode', 'symlink', 'gitlink']) {
+    resetFixture(globFixture);
+    if (mutation === 'mode') {
+      const candidate = commitFixture(globFixture.root, 'change glob member mode', 'docs/adr/one.md');
+      const result = runFrozenGuard(globFixture, globFixture.base, candidate);
+      assert.strictEqual(result.status, 2, 'a glob member mode change requires review');
+      assert.strictEqual(result.report.policyPreservation.configuredPaths.paths.find(item => item.path === 'docs/adr/one.md').state, 'review_required');
+      continue;
+    }
+    fs.rmSync(path.join(globFixture.root, 'docs', 'adr', 'one.md'));
+    if (mutation === 'symlink') {
+      const oid = fixtureGit(globFixture.root, ['hash-object', '-w', '--stdin'], Buffer.from('../outside-target.md\n')).toString('ascii').trim();
+      fixtureGit(globFixture.root, ['add', '-A']);
+      fixtureGit(globFixture.root, ['update-index', '--add', '--cacheinfo', `120000,${oid},docs/adr/one.md`]);
+    } else {
+      fixtureGit(globFixture.root, ['add', '-A']);
+      fixtureGit(globFixture.root, ['update-index', '--add', '--cacheinfo', `160000,${globFixture.base},docs/adr/one.md`]);
+    }
+    fixtureGit(globFixture.root, ['commit', '--quiet', '-m', `replace glob member with ${mutation}`]);
+    const candidate = fixtureGit(globFixture.root, ['rev-parse', 'HEAD']).toString('ascii').trim();
+    const result = runFrozenGuard(globFixture, globFixture.base, candidate);
+    assert.strictEqual(result.status, 2, `a glob member ${mutation} requires review`);
+    assert.strictEqual(result.report.policyPreservation.configuredPaths.paths.find(item => item.path === 'docs/adr/one.md').state, 'review_required');
+  }
+
+  resetFixture(globFixture);
+  writeRelative(globFixture.root, 'generated/view.md', 'changed derived glob output\n');
+  const derivedGlobCandidate = commitFixture(globFixture.root, 'change derived glob member');
+  const derivedGlob = runFrozenGuard(globFixture, globFixture.base, derivedGlobCandidate);
+  assert.strictEqual(derivedGlob.status, 2, 'a derived glob member content change requires review');
+  assert.strictEqual(derivedGlob.report.policyPreservation.configuredPaths.paths.find(item => item.path === 'generated/view.md').state, 'review_required');
+
+  if (process.platform !== 'win32') {
+    resetFixture(globFixture);
+    const unusualPath = 'docs/adr/new\nfile.md';
+    const oid = fixtureGit(globFixture.root, ['hash-object', '-w', '--stdin'], Buffer.from('unusual glob member\n')).toString('ascii').trim();
+    fixtureGit(globFixture.root, ['update-index', '--add', '--cacheinfo', `100644,${oid},${unusualPath}`]);
+    fixtureGit(globFixture.root, ['commit', '--quiet', '-m', 'add unusual glob member']);
+    const unusualCandidate = fixtureGit(globFixture.root, ['rev-parse', 'HEAD']).toString('ascii').trim();
+    const unusual = runFrozenGuard(globFixture, globFixture.base, unusualCandidate);
+    assert.strictEqual(unusual.status, 2, 'a glob matches paths containing unusual LF bytes');
+    assert.strictEqual(unusual.report.policyPreservation.configuredPaths.paths.find(item => item.path === unusualPath).state, 'review_required');
+  }
+
+  if (process.platform !== 'win32') {
+    // Known divergence: doc-lifecycle.js still excludes line terminators in glob segments.
+    const newlineGlobFixture = createFixture('governance-guard-newline-glob-git');
+    resetFixture(newlineGlobFixture);
+    writeRelative(newlineGlobFixture.root, '.agents/harness-everything/project-docs.json', `${JSON.stringify({
+      governed: [{ path: 'docs/**/*.md', role: 'reference' }],
+      derived: []
+    }, null, 2)}\n`);
+    writeRelative(newlineGlobFixture.root, 'docs/anchor.md', 'baseline direct child\n');
+    writeRelative(newlineGlobFixture.root, 'docs/a\nb/file.md', 'baseline newline directory member\n');
+    writeRelative(newlineGlobFixture.root, 'docs/a/b/file.md', 'baseline regular directory member\n');
+    newlineGlobFixture.base = commitFixture(newlineGlobFixture.root, 'newline glob policy baseline');
+
+    fixtureGit(newlineGlobFixture.root, ['rm', '--quiet', '--', 'docs/a\nb/file.md']);
+    const newlineDeletionCandidate = commitFixture(newlineGlobFixture.root, 'delete newline directory member');
+    const newlineDeletion = runFrozenGuard(newlineGlobFixture, newlineGlobFixture.base, newlineDeletionCandidate);
+
+    resetFixture(newlineGlobFixture);
+    writeRelative(newlineGlobFixture.root, 'docs/a\nb/new.md', 'new newline directory member\n');
+    const newlineAdditionCandidate = commitFixture(newlineGlobFixture.root, 'add newline directory member');
+    const newlineAddition = runFrozenGuard(newlineGlobFixture, newlineGlobFixture.base, newlineAdditionCandidate);
+
+    resetFixture(newlineGlobFixture);
+    fixtureGit(newlineGlobFixture.root, ['rm', '--quiet', '--', 'docs/a/b/file.md']);
+    const regularDeletionCandidate = commitFixture(newlineGlobFixture.root, 'delete regular directory member');
+    const regularDeletion = runFrozenGuard(newlineGlobFixture, newlineGlobFixture.base, regularDeletionCandidate);
+
+    assert.deepStrictEqual({
+      newlineDirectoryDeletion: newlineDeletion.status,
+      newlineDirectoryAddition: newlineAddition.status,
+      regularDirectoryDeletion: regularDeletion.status
+    }, {
+      newlineDirectoryDeletion: 2,
+      newlineDirectoryAddition: 2,
+      regularDirectoryDeletion: 2
+    }, 'newline-directory deletions and additions require review; regular-directory deletion is the positive control');
+  }
+
+  resetFixture(globFixture);
+  const narrowedPolicy = JSON.parse(fs.readFileSync(path.join(globFixture.root, '.agents/harness-everything/project-docs.json'), 'utf8'));
+  narrowedPolicy.governed[0].path = 'docs/adr/one.md';
+  writeRelative(globFixture.root, '.agents/harness-everything/project-docs.json', `${JSON.stringify(narrowedPolicy, null, 2)}\n`);
+  fixtureGit(globFixture.root, ['rm', '--quiet', '--', 'docs/adr/two.md']);
+  const narrowedCandidate = commitFixture(globFixture.root, 'narrow governed glob');
+  const narrowed = runFrozenGuard(globFixture, globFixture.base, narrowedCandidate);
+  assert.strictEqual(narrowed.status, 2, 'candidate policy cannot narrow base glob coverage');
+  assert.strictEqual(narrowed.report.policyPreservation.governed.state, 'review_required', 'candidate glob changes remain policy review');
+  assert.strictEqual(narrowed.report.policyPreservation.configuredPaths.paths.find(item => item.path === 'docs/adr/two.md').candidate, null);
+
+  for (const unsupported of ['docs/adr/*.md?', 'docs/adr/[a].md', 'docs/adr/{a}.md', '/docs/adr/*.md', 'docs/../*.md']) {
+    resetFixture(globFixture);
+    const invalidPolicy = JSON.parse(fs.readFileSync(path.join(globFixture.root, '.agents/harness-everything/project-docs.json'), 'utf8'));
+    invalidPolicy.governed.push({ path: unsupported, role: 'reference' });
+    writeRelative(globFixture.root, '.agents/harness-everything/project-docs.json', `${JSON.stringify(invalidPolicy, null, 2)}\n`);
+    const invalidCandidate = commitFixture(globFixture.root, `unsupported pattern ${unsupported}`);
+    const invalid = runFrozenGuard(globFixture, globFixture.base, invalidCandidate);
+    assert.strictEqual(invalid.status, 1, `unsupported glob syntax fails closed: ${unsupported}`);
+    assert.strictEqual(invalid.report.verdict, 'FAIL');
+  }
+
   for (const mutation of ['rename', 'mode', 'symlink']) {
     resetFixture(fixture);
     const relativePath = 'docs/architecture.md';

package/docs/own-repo-governance-e1-plan-2026-10-25-2139.md

@@ -236,6 +236,8 @@ Private byte-identical backups of all three queue files and this turn's scope, p
 | Evidence / limits | These are deterministic mechanism and local step-simulation results, not hosted GitHub Actions or live-host evidence. Full `npm test` and `verify:all` are not established here. The independent review of the earlier frozen guard found the fixture-oracle gap and left semantic MUST preservation unresolved; independent re-review of the fixed guard against the final exact SHAs remains pending. Candidate-controlled `.github/workflows/ci.yml` can remove the invocation, and no external required-status check is enabled. |
 | E1 / authority | P2 is CI engineering evidence only. E1 remains at 0 qualifying cycles; status is NOT GO / owner GO is NOT ISSUED, and #320 remains unauthorized. |
 
+On 2026-10-27, the base-owned guard added a self-contained POSIX `*`/`**` matcher and expands governed and derived globs from the base and candidate Git trees. New or missing members and non-regular or mode-changed entries remain `REVIEW_REQUIRED`; regular governed revisions remain informational, derived object changes still require review, empty globs report zero members, and candidate policy changes remain review-required.
+
 ### Next session
 
 | Remaining item | Next action / boundary |

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.43.1",
+  "version": "0.44.0",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.43.1",
+  "version": "0.44.0",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.43.1",
+  "version": "0.44.0",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.43.1",
+  "version": "0.44.0",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/sbom.cdx.json

@@ -2,23 +2,23 @@
   "$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.7",
-  "serialNumber": "urn:uuid:e4de25fd-21a9-593b-841e-c8e0c3a9d6ad",
+  "serialNumber": "urn:uuid:062d938e-8477-5564-9f89-fa21e9121182",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-27T09:10:22.642Z",
+    "timestamp": "2026-10-27T10:11:43.769Z",
     "tools": [
       {
         "vendor": "Harness Everything",
         "name": "generate-sbom.js",
-        "version": "0.43.1"
+        "version": "0.44.0"
       }
     ],
     "component": {
       "type": "application",
-      "bom-ref": "pkg:npm/harness-everything@0.43.1",
+      "bom-ref": "pkg:npm/harness-everything@0.44.0",
       "name": "harness-everything",
-      "version": "0.43.1",
-      "purl": "pkg:npm/harness-everything@0.43.1"
+      "version": "0.44.0",
+      "purl": "pkg:npm/harness-everything@0.44.0"
     }
   },
   "components": [
@@ -2033,7 +2033,7 @@
       ]
     },
     {
-      "ref": "pkg:npm/harness-everything@0.43.1",
+      "ref": "pkg:npm/harness-everything@0.44.0",
       "dependsOn": [
         "pkg:npm/%40commitlint/cli@19.8.1",
         "pkg:npm/%40commitlint/config-conventional@19.8.1",

package/scripts/doc-governance-guard.js

@@ -121,9 +121,8 @@ function validateProjectDocs(value, label) {
       if (!isRecord(record) || typeof record.path !== 'string' || !record.path || typeof record[field] !== 'string' || !record[field]) {
         throw new Error(`${label} has a malformed ${kind} record`);
       }
-      if (record.path.startsWith('/') || record.path.split('/').includes('..') || /[*?\[\]]/.test(record.path)) {
-        // shortcut: the baseline registry uses exact Git paths; glob support needs a Git-aware matcher before adoption.
-        throw new Error(`${label} has a non-exact governed or derived path: ${record.path}`);
+      if (record.path.startsWith('/') || record.path.split('/').includes('..') || ['?', '[', ']', '{', '}'].some(char => record.path.includes(char))) {
+        throw new Error(`${label} has an unsupported governed or derived path pattern: ${record.path}`);
       }
       const key = `${kind}:${record.path}`;
       if (seen.has(key)) throw new Error(`${label} has duplicate ${kind} path: ${record.path}`);
@@ -159,8 +158,9 @@ function policyChanges(base, candidate, kind) {
     path: record.path,
     base: record,
     candidate: byPath.get(record.path) || null
-  }));
-  const added = candidate[kind].filter(record => !basePaths.has(record.path));
+  })).sort((left, right) => Buffer.compare(Buffer.from(left.path), Buffer.from(right.path)));
+  const added = candidate[kind].filter(record => !basePaths.has(record.path))
+    .sort((left, right) => Buffer.compare(Buffer.from(left.path), Buffer.from(right.path)));
   return { state: missingOrChanged.length || added.length ? 'review_required' : 'pass', preserved: base[kind].length - missingOrChanged.length, missingOrChanged, added };
 }
 
@@ -173,6 +173,32 @@ function pathText(pathBytes) {
   return Buffer.from(value, 'utf8').equals(pathBytes) ? value : null;
 }
 
+function globToRegExp(glob) {
+  const source = Buffer.from(String(glob).replace(/\\/g, '/'), 'utf8').toString('latin1');
+  let pattern = '^';
+  for (let index = 0; index < source.length; index++) {
+    const char = source[index];
+    if (char === '*' && source[index + 1] === '*') {
+      if (source[index + 2] === '/') {
+        pattern += '(?:[\\s\\S]*/)?';
+        index += 2;
+      } else {
+        pattern += '[\\s\\S]*';
+        index++;
+      }
+    } else if (char === '*') {
+      pattern += '[^/]*';
+    } else {
+      pattern += char.replace(/[|\\{}()[\]^$+?.]/g, '\\$&');
+    }
+  }
+  return new RegExp(`${pattern}$`);
+}
+
+function matchesConfiguredPath(record, pathBytes, matcher) {
+  return matcher ? matcher.test(pathBytes.toString('latin1')) : Buffer.from(record.path, 'utf8').equals(pathBytes);
+}
+
 function identity(entry) {
   return entry ? { mode: entry.mode, type: entry.type, oid: entry.oid } : null;
 }
@@ -223,27 +249,57 @@ function unknownNewDocuments(baseTree, candidateTree) {
 
 function checkConfiguredPaths(baseTree, candidateTree, config) {
   const details = [];
+  const patterns = [];
   for (const kind of ['governed', 'derived']) {
     for (const record of config[kind]) {
-      const key = pathKey(record.path);
-      const before = baseTree.get(key);
-      const after = candidateTree.get(key);
-      if (!regularBlob(before)) throw new Error(`baseline ${kind} path is missing or not a regular file: ${record.path}`);
-      const sameRegularMode = regularBlob(after) && before.mode === after.mode;
-      const revised = kind === 'governed' && sameRegularMode && before.oid !== after.oid;
-      const identityPreserved = sameRegularMode && before.oid === after.oid;
-      details.push({
-        kind,
-        path: record.path,
-        state: revised ? 'revised' : identityPreserved ? 'pass' : 'review_required',
-        base: identity(before),
-        candidate: identity(after),
-        ...(revised ? { reason: 'Content revisions are tracked by Git identity but are not semantically validated by the guard.' } : {})
-      });
+      const glob = record.path.includes('*');
+      const matcher = glob ? globToRegExp(record.path) : null;
+      const collect = sourceTree => {
+        if (!glob) {
+          const key = pathKey(record.path);
+          const entry = sourceTree.get(key);
+          return new Map(entry ? [[key, entry]] : []);
+        }
+        const matches = new Map();
+        for (const [key, entry] of sourceTree) {
+          if (matchesConfiguredPath(record, entry.pathBytes, matcher)) matches.set(key, entry);
+        }
+        return matches;
+      };
+      const baseMembers = collect(baseTree);
+      const candidateMembers = collect(candidateTree);
+      if (!glob && !regularBlob(baseMembers.values().next().value)) {
+        throw new Error(`baseline ${kind} path is missing or not a regular file: ${record.path}`);
+      }
+      if (glob) patterns.push({ kind, path: record.path, baseMembers: baseMembers.size, candidateMembers: candidateMembers.size });
+      const keys = new Set([...baseMembers.keys(), ...candidateMembers.keys()]);
+      for (const key of keys) {
+        const before = baseMembers.get(key) || null;
+        const after = candidateMembers.get(key) || null;
+        const entry = before || after;
+        const sameRegularMode = regularBlob(before) && regularBlob(after) && before.mode === after.mode;
+        const revised = kind === 'governed' && sameRegularMode && before.oid !== after.oid;
+        const identityPreserved = sameRegularMode && before.oid === after.oid;
+        const memberPath = pathText(entry.pathBytes);
+        details.push({
+          kind,
+          ...(glob ? { pattern: record.path } : {}),
+          path: memberPath,
+          ...(memberPath === null ? { pathBase64: key } : {}),
+          state: revised ? 'revised' : identityPreserved ? 'pass' : 'review_required',
+          base: identity(before),
+          candidate: identity(after),
+          ...(revised ? { reason: 'Content revisions are tracked by Git identity but are not semantically validated by the guard.' } : {})
+        });
+      }
     }
   }
+  patterns.sort((left, right) => Buffer.compare(Buffer.from(left.kind), Buffer.from(right.kind)) || Buffer.compare(Buffer.from(left.path), Buffer.from(right.path)));
+  details.sort((left, right) => Buffer.compare(Buffer.from(left.pathBase64 || Buffer.from(left.path, 'utf8').toString('base64'), 'base64'), Buffer.from(right.pathBase64 || Buffer.from(right.path, 'utf8').toString('base64'), 'base64'))
+    || Buffer.compare(Buffer.from(left.kind), Buffer.from(right.kind))
+    || Buffer.compare(Buffer.from(left.pattern || ''), Buffer.from(right.pattern || '')));
   const failures = details.filter(item => item.state === 'review_required');
-  return { state: failures.length ? 'review_required' : 'pass', paths: details, missingOrChanged: failures };
+  return { state: failures.length ? 'review_required' : 'pass', patterns, paths: details, missingOrChanged: failures };
 }
 
 function parseArgs(argv) {