harness-everything 0.43.1 → 0.45.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.43.1",
+      "version": "0.45.0",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.43.1",
+  "version": "0.45.0",
   "author": {
     "name": "Miya Daniel"
   },

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.45.0](https://github.com/dyphn1/Harness-everything/compare/v0.44.0...v0.45.0) (2026-10-27)
+
+### Features
+
+* **doc-lifecycle:** produce conflict-check from a full-corpus assessment ([ec596e0](https://github.com/dyphn1/Harness-everything/commit/ec596e02de554f14778f7790551b6990a50dd0b6)), closes [#325](https://github.com/dyphn1/Harness-everything/issues/325)
+
+## [0.44.0](https://github.com/dyphn1/Harness-everything/compare/v0.43.1...v0.44.0) (2026-10-27)
+
+### Features
+
+* **governance:** accept git-aware globs in the base-owned guard ([674a96d](https://github.com/dyphn1/Harness-everything/commit/674a96d7295555926ab3bb1b8ca0204cf59dbad5)), closes [#325](https://github.com/dyphn1/Harness-everything/issues/325)
+
 ## [0.43.1](https://github.com/dyphn1/Harness-everything/compare/v0.43.0...v0.43.1) (2026-10-27)
 
 ### Bug Fixes
@@ -10,9 +22,13 @@ All notable changes to this project are documented in this file.
 
 ## [Unreleased]
 
+### Features
+
+* **doc-lifecycle:** add complete full-corpus conflict-check evidence with snapshot-bound scope and corpus identity.
+
 ### Fixed
 
-- **doc-governance:** allow regular governed-content revisions while retaining review for structural, policy, trust-surface, fixture, and derived-output changes; run the guard in its own CI job.
+- **doc-governance:** allow regular governed-content revisions and expand base-owned governed/derived globs against Git trees, while retaining review for membership, structural, policy, trust-surface, fixture, and derived-output changes; run the guard in its own CI job.
 
 ## [0.43.0](https://github.com/dyphn1/Harness-everything/compare/v0.42.2...v0.43.0) (2026-10-27)
 

package/ci/fixtures/doc-obligations/reconciliation-s2a/harness.js

@@ -400,7 +400,7 @@ function buildEvents(snapshot, repo, vec) {
       originRef: `fake-origin:event:${ref}`
     };
     if (kind === 'execution') {
-      events[ref] = {
+      const event = {
         ...common,
         kind: 'execution',
         principalId: PRINCIPALS.executor,
@@ -415,6 +415,24 @@ function buildEvents(snapshot, repo, vec) {
         resultRef: `result-${capability}`,
         artifactDigests: clone(artifactDigests)
       };
+      if (capability === 'conflict-check') {
+        const { documentCorpusPaths } = require(path.join(ROOT, 'harness-everything', 'scripts', 'doc-lifecycle.js'));
+        const configSource = snapshot.config.capture.sources.find(item => item.path === CONFIG_REL && item.presence === 'present');
+        const configBytes = Buffer.isBuffer(configSource?.bytes) ? configSource.bytes : Buffer.from(configSource?.bytes?.data || []);
+        const corpusPaths = documentCorpusPaths(snapshot.candidate.records, snapshot.config.resolution.config);
+        event.corpusBinding = {
+          complete: true,
+          paths: corpusPaths,
+          digests: Object.fromEntries(corpusPaths.map(relative => [relative,
+            snapshot.candidate.records.find(item => item.path === relative && item.presence === 'present')?.digest])),
+          config: { path: CONFIG_REL, digest: sha256(configBytes) },
+          baseCommit: snapshot.originContext.baseline.commit,
+          baselineDigest: snapshot.identity.baselineDigest,
+          candidateDigest: snapshot.identity.candidateDigest,
+          configIdentityDigest: snapshot.identity.configDigest,
+        };
+      }
+      events[ref] = event;
     } else {
       events[ref] = {
         ...common,

package/ci/mechanism-2ax-doc-lifecycle.test.js

@@ -1667,8 +1667,8 @@ checkCase('2ax. frozen Git-object guard with bootstrap and tamper controls', ()
     return fixtureGit(root, ['rev-parse', 'HEAD']).toString('ascii').trim();
   }
 
-  function createFixture() {
-    const root = workspace('governance-guard-git');
+  function createFixture(name = 'governance-guard-git') {
+    const root = workspace(name);
     fs.mkdirSync(path.join(root, '.fixture-hooks'), { recursive: true });
     fixtureGit(root, ['init', '--quiet']);
     fixtureGit(root, ['config', 'user.name', 'Harness Guard Test']);
@@ -1820,6 +1820,190 @@ checkCase('2ax. frozen Git-object guard with bootstrap and tamper controls', ()
   assert.deepStrictEqual(derivedEntry.base, configuredIdentity(fixture.base, 'docs/governed-index.md'));
   assert.deepStrictEqual(derivedEntry.candidate, configuredIdentity(derivedCandidate, 'docs/governed-index.md'));
 
+  const globPatterns = [
+    'docs/adr/*.md',
+    'empty/*.md',
+    'corpus/one*.md', // portability-lint: allow glob pattern string, never created as a file
+    'corpus/*.md',
+    'deep/**/*.md',
+    'repeat/**/repeat/*.md',
+    'literal.v1/**/*.md'
+  ];
+  const corpusPaths = [
+    'docs/adr/one.md', 'docs/adr/two.md', 'generated/view.md', 'generated/nested/view.md',
+    'corpus/one.md', 'corpus/many-a.md', 'corpus/many-b.md',
+    'deep/zero.md', 'deep/a/b.md',
+    'repeat/repeat/first.md', 'repeat/a/repeat/second.md',
+    'literal.v1/top.md', 'literal.v1/sub/nested.md', 'literalXv1/no.md'
+  ];
+  const globFixture = createFixture('governance-guard-glob-git');
+  resetFixture(globFixture);
+  const globPolicy = {
+    governed: globPatterns.map(pattern => ({ path: pattern, role: 'reference' })),
+    derived: [{ path: 'generated/**/*.md', generator: 'build' }]
+  };
+  writeRelative(globFixture.root, '.agents/harness-everything/project-docs.json', `${JSON.stringify(globPolicy, null, 2)}\n`);
+  for (const relativePath of corpusPaths) writeRelative(globFixture.root, relativePath, `baseline ${relativePath}\n`);
+  globFixture.base = commitFixture(globFixture.root, 'glob policy baseline');
+
+  const globAccepted = runFrozenGuard(globFixture, globFixture.base, globFixture.base);
+  assert.strictEqual(globAccepted.report.verdict, 'PASS', globAccepted.report.errors[0]?.message);
+  const globSummaries = globAccepted.report.policyPreservation.configuredPaths.patterns;
+  assert.ok(globSummaries, 'glob records report their base and candidate member counts');
+  assert.strictEqual(globAccepted.report.policyPreservation.configuredPaths.paths.find(item => item.path === 'docs/adr/one.md').state, 'pass', 'unchanged glob members pass');
+  assert.deepStrictEqual(runFrozenGuard(globFixture, globFixture.base, globFixture.base), globAccepted, 'glob reports are deterministic for identical Git inputs');
+  const lifecycleSource = fs.readFileSync(modulePath, 'utf8');
+  const lifecycleMatcherSource = lifecycleSource.match(/function globToRegExp\(glob\) \{[\s\S]*?\n\}/);
+  assert.ok(lifecycleMatcherSource, 'doc-lifecycle globToRegExp remains available for the consistency check');
+  const lifecycleGlobToRegExp = new Function(`${lifecycleMatcherSource[0]}\nreturn globToRegExp;`)();
+  for (const pattern of globPatterns) {
+    const expected = corpusPaths.filter(relativePath => lifecycleGlobToRegExp(pattern).test(relativePath)).length;
+    const summary = globSummaries.find(item => item.kind === 'governed' && item.path === pattern);
+    assert.ok(summary, `glob summary exists for ${pattern}`);
+    assert.strictEqual(summary.baseMembers, expected, `guard matcher agrees with doc-lifecycle for ${pattern}`);
+    assert.strictEqual(summary.candidateMembers, expected, `candidate matcher agrees with doc-lifecycle for ${pattern}`);
+    const expectedPaths = corpusPaths.filter(relativePath => lifecycleGlobToRegExp(pattern).test(relativePath)).sort((left, right) => Buffer.compare(Buffer.from(left), Buffer.from(right)));
+    const actualPaths = globAccepted.report.policyPreservation.configuredPaths.paths
+      .filter(item => item.kind === 'governed' && item.pattern === pattern).map(item => item.path);
+    assert.deepStrictEqual(actualPaths, expectedPaths, `guard matcher returns the same members as doc-lifecycle for ${pattern}`);
+  }
+  assert.strictEqual(globSummaries.find(item => item.path === 'empty/*.md').baseMembers, 0, 'an empty glob is legal and reports zero members');
+
+  resetFixture(globFixture);
+  writeRelative(globFixture.root, 'docs/adr/one.md', 'revised governed glob member\n');
+  const globRevisionCandidate = commitFixture(globFixture.root, 'revise glob member');
+  const globRevision = runFrozenGuard(globFixture, globFixture.base, globRevisionCandidate);
+  assert.strictEqual(globRevision.status, 0, 'a regular governed glob member revision passes');
+  const globRevisionEntry = globRevision.report.policyPreservation.configuredPaths.paths.find(item => item.path === 'docs/adr/one.md');
+  assert.strictEqual(globRevisionEntry.state, 'revised');
+
+  resetFixture(globFixture);
+  writeRelative(globFixture.root, 'docs/adr/new.md', 'new governed glob member\n');
+  const globAdditionCandidate = commitFixture(globFixture.root, 'add glob member');
+  const globAddition = runFrozenGuard(globFixture, globFixture.base, globAdditionCandidate);
+  assert.strictEqual(globAddition.status, 2, 'a new glob member requires review');
+  assert.strictEqual(globAddition.report.policyPreservation.configuredPaths.paths.find(item => item.path === 'docs/adr/new.md').state, 'review_required');
+
+  resetFixture(globFixture);
+  fixtureGit(globFixture.root, ['rm', '--quiet', '--', 'docs/adr/two.md']);
+  const globDeletionCandidate = commitFixture(globFixture.root, 'delete glob member');
+  const globDeletion = runFrozenGuard(globFixture, globFixture.base, globDeletionCandidate);
+  assert.strictEqual(globDeletion.status, 2, 'a deleted glob member requires review');
+  assert.strictEqual(globDeletion.report.policyPreservation.configuredPaths.paths.find(item => item.path === 'docs/adr/two.md').candidate, null);
+
+  resetFixture(globFixture);
+  fixtureGit(globFixture.root, ['mv', '--', 'docs/adr/one.md', 'docs/adr/renamed.md']);
+  const globRenameCandidate = commitFixture(globFixture.root, 'rename glob member');
+  const globRename = runFrozenGuard(globFixture, globFixture.base, globRenameCandidate);
+  const globRenamePaths = globRename.report.policyPreservation.configuredPaths.paths;
+  assert.strictEqual(globRename.status, 2, 'a rename within a glob requires review');
+  assert.strictEqual(globRenamePaths.find(item => item.path === 'docs/adr/one.md').candidate, null, 'rename retains the old endpoint');
+  assert.strictEqual(globRenamePaths.find(item => item.path === 'docs/adr/renamed.md').base, null, 'rename retains the new endpoint');
+
+  for (const mutation of ['mode', 'symlink', 'gitlink']) {
+    resetFixture(globFixture);
+    if (mutation === 'mode') {
+      const candidate = commitFixture(globFixture.root, 'change glob member mode', 'docs/adr/one.md');
+      const result = runFrozenGuard(globFixture, globFixture.base, candidate);
+      assert.strictEqual(result.status, 2, 'a glob member mode change requires review');
+      assert.strictEqual(result.report.policyPreservation.configuredPaths.paths.find(item => item.path === 'docs/adr/one.md').state, 'review_required');
+      continue;
+    }
+    fs.rmSync(path.join(globFixture.root, 'docs', 'adr', 'one.md'));
+    if (mutation === 'symlink') {
+      const oid = fixtureGit(globFixture.root, ['hash-object', '-w', '--stdin'], Buffer.from('../outside-target.md\n')).toString('ascii').trim();
+      fixtureGit(globFixture.root, ['add', '-A']);
+      fixtureGit(globFixture.root, ['update-index', '--add', '--cacheinfo', `120000,${oid},docs/adr/one.md`]);
+    } else {
+      fixtureGit(globFixture.root, ['add', '-A']);
+      fixtureGit(globFixture.root, ['update-index', '--add', '--cacheinfo', `160000,${globFixture.base},docs/adr/one.md`]);
+    }
+    fixtureGit(globFixture.root, ['commit', '--quiet', '-m', `replace glob member with ${mutation}`]);
+    const candidate = fixtureGit(globFixture.root, ['rev-parse', 'HEAD']).toString('ascii').trim();
+    const result = runFrozenGuard(globFixture, globFixture.base, candidate);
+    assert.strictEqual(result.status, 2, `a glob member ${mutation} requires review`);
+    assert.strictEqual(result.report.policyPreservation.configuredPaths.paths.find(item => item.path === 'docs/adr/one.md').state, 'review_required');
+  }
+
+  resetFixture(globFixture);
+  writeRelative(globFixture.root, 'generated/view.md', 'changed derived glob output\n');
+  const derivedGlobCandidate = commitFixture(globFixture.root, 'change derived glob member');
+  const derivedGlob = runFrozenGuard(globFixture, globFixture.base, derivedGlobCandidate);
+  assert.strictEqual(derivedGlob.status, 2, 'a derived glob member content change requires review');
+  assert.strictEqual(derivedGlob.report.policyPreservation.configuredPaths.paths.find(item => item.path === 'generated/view.md').state, 'review_required');
+
+  if (process.platform !== 'win32') {
+    resetFixture(globFixture);
+    const unusualPath = 'docs/adr/new\nfile.md';
+    const oid = fixtureGit(globFixture.root, ['hash-object', '-w', '--stdin'], Buffer.from('unusual glob member\n')).toString('ascii').trim();
+    fixtureGit(globFixture.root, ['update-index', '--add', '--cacheinfo', `100644,${oid},${unusualPath}`]);
+    fixtureGit(globFixture.root, ['commit', '--quiet', '-m', 'add unusual glob member']);
+    const unusualCandidate = fixtureGit(globFixture.root, ['rev-parse', 'HEAD']).toString('ascii').trim();
+    const unusual = runFrozenGuard(globFixture, globFixture.base, unusualCandidate);
+    assert.strictEqual(unusual.status, 2, 'a glob matches paths containing unusual LF bytes');
+    assert.strictEqual(unusual.report.policyPreservation.configuredPaths.paths.find(item => item.path === unusualPath).state, 'review_required');
+  }
+
+  if (process.platform !== 'win32') {
+    // Known divergence: doc-lifecycle.js still excludes line terminators in glob segments.
+    const newlineGlobFixture = createFixture('governance-guard-newline-glob-git');
+    resetFixture(newlineGlobFixture);
+    writeRelative(newlineGlobFixture.root, '.agents/harness-everything/project-docs.json', `${JSON.stringify({
+      governed: [{ path: 'docs/**/*.md', role: 'reference' }],
+      derived: []
+    }, null, 2)}\n`);
+    writeRelative(newlineGlobFixture.root, 'docs/anchor.md', 'baseline direct child\n');
+    writeRelative(newlineGlobFixture.root, 'docs/a\nb/file.md', 'baseline newline directory member\n');
+    writeRelative(newlineGlobFixture.root, 'docs/a/b/file.md', 'baseline regular directory member\n');
+    newlineGlobFixture.base = commitFixture(newlineGlobFixture.root, 'newline glob policy baseline');
+
+    fixtureGit(newlineGlobFixture.root, ['rm', '--quiet', '--', 'docs/a\nb/file.md']);
+    const newlineDeletionCandidate = commitFixture(newlineGlobFixture.root, 'delete newline directory member');
+    const newlineDeletion = runFrozenGuard(newlineGlobFixture, newlineGlobFixture.base, newlineDeletionCandidate);
+
+    resetFixture(newlineGlobFixture);
+    writeRelative(newlineGlobFixture.root, 'docs/a\nb/new.md', 'new newline directory member\n');
+    const newlineAdditionCandidate = commitFixture(newlineGlobFixture.root, 'add newline directory member');
+    const newlineAddition = runFrozenGuard(newlineGlobFixture, newlineGlobFixture.base, newlineAdditionCandidate);
+
+    resetFixture(newlineGlobFixture);
+    fixtureGit(newlineGlobFixture.root, ['rm', '--quiet', '--', 'docs/a/b/file.md']);
+    const regularDeletionCandidate = commitFixture(newlineGlobFixture.root, 'delete regular directory member');
+    const regularDeletion = runFrozenGuard(newlineGlobFixture, newlineGlobFixture.base, regularDeletionCandidate);
+
+    assert.deepStrictEqual({
+      newlineDirectoryDeletion: newlineDeletion.status,
+      newlineDirectoryAddition: newlineAddition.status,
+      regularDirectoryDeletion: regularDeletion.status
+    }, {
+      newlineDirectoryDeletion: 2,
+      newlineDirectoryAddition: 2,
+      regularDirectoryDeletion: 2
+    }, 'newline-directory deletions and additions require review; regular-directory deletion is the positive control');
+  }
+
+  resetFixture(globFixture);
+  const narrowedPolicy = JSON.parse(fs.readFileSync(path.join(globFixture.root, '.agents/harness-everything/project-docs.json'), 'utf8'));
+  narrowedPolicy.governed[0].path = 'docs/adr/one.md';
+  writeRelative(globFixture.root, '.agents/harness-everything/project-docs.json', `${JSON.stringify(narrowedPolicy, null, 2)}\n`);
+  fixtureGit(globFixture.root, ['rm', '--quiet', '--', 'docs/adr/two.md']);
+  const narrowedCandidate = commitFixture(globFixture.root, 'narrow governed glob');
+  const narrowed = runFrozenGuard(globFixture, globFixture.base, narrowedCandidate);
+  assert.strictEqual(narrowed.status, 2, 'candidate policy cannot narrow base glob coverage');
+  assert.strictEqual(narrowed.report.policyPreservation.governed.state, 'review_required', 'candidate glob changes remain policy review');
+  assert.strictEqual(narrowed.report.policyPreservation.configuredPaths.paths.find(item => item.path === 'docs/adr/two.md').candidate, null);
+
+  for (const unsupported of ['docs/adr/*.md?', 'docs/adr/[a].md', 'docs/adr/{a}.md', '/docs/adr/*.md', 'docs/../*.md']) {
+    resetFixture(globFixture);
+    const invalidPolicy = JSON.parse(fs.readFileSync(path.join(globFixture.root, '.agents/harness-everything/project-docs.json'), 'utf8'));
+    invalidPolicy.governed.push({ path: unsupported, role: 'reference' });
+    writeRelative(globFixture.root, '.agents/harness-everything/project-docs.json', `${JSON.stringify(invalidPolicy, null, 2)}\n`);
+    const invalidCandidate = commitFixture(globFixture.root, `unsupported pattern ${unsupported}`);
+    const invalid = runFrozenGuard(globFixture, globFixture.base, invalidCandidate);
+    assert.strictEqual(invalid.status, 1, `unsupported glob syntax fails closed: ${unsupported}`);
+    assert.strictEqual(invalid.report.verdict, 'FAIL');
+  }
+
   for (const mutation of ['rename', 'mode', 'symlink']) {
     resetFixture(fixture);
     const relativePath = 'docs/architecture.md';

package/ci/mechanism-325-f2-doc-craft.test.js

@@ -502,8 +502,8 @@ function mp2Apply() {
   const dir = scriptCopy('f2 doc craft mp2 ');
   const file = path.join(dir, MODULE);
   const original = fs.readFileSync(file, 'utf8');
-  const emitMatches = [...original.matchAll(/return emit\(result[^;]*\);/g)];
-  if (emitMatches.length !== 1) throw new ProbeApplyError(`could not uniquely locate the final emit (${emitMatches.length} candidates); update this probe for the green shape`);
+  const emitMatches = [...original.matchAll(/return emit\(result, lintExit === 1 \|\| broken\.length \? 1 : 0\);/g)];
+  if (emitMatches.length !== 1) throw new ProbeApplyError(`could not uniquely locate the plain-check exit mapping (${emitMatches.length} candidates); update this probe for the green shape`);
   const injected = `if (result.reminders && result.reminders.length) return emit(result, 1);\n  ${emitMatches[0][0]}`;
   fs.writeFileSync(file, original.replace(emitMatches[0][0], injected));
   return dir;

package/ci/mechanism-325-f3-derived-views.test.js

@@ -356,8 +356,11 @@ function caseD13(leg) {
   const candidate = path.join(dir, 'candidate.md');
   fs.writeFileSync(candidate, Buffer.from(TARGET_BYTES.toString('utf8').replace(/\n/g, '\r\n'), 'utf8'));
   const result = runCompare(leg.dir, { workspace: ws, config: CONFIG, view: 'docs/index.md', candidate, status: 'ok' });
-  same(result.status, 1, 'exit');
-  if (!JSON.stringify(jsonOut(result)).includes('stale')) throw new Error(`CRLF candidate accepted: ${truncate(result.stdout)}`);
+  let comparison;
+  try { comparison = JSON.parse(result.stdout); } catch { comparison = null; }
+  const detail = `compare-derived JSON: ${JSON.stringify(comparison)}; stdout: ${truncate(result.stdout)}; stderr: ${truncate(result.stderr)}`;
+  same(result.status, 1, `exit; ${detail}`);
+  if (!comparison || !JSON.stringify(comparison).includes('stale')) throw new Error(`CRLF candidate accepted; ${detail}`);
 }
 assertPerLeg('case-d13:crlf-candidate-not-normalized', leg => caseD13(leg));