harness-everything 0.43.1 → 0.45.0

package/plugins/harness-everything/hooks/scripts/lib/doc-reconciliation-provider.js

@@ -46,7 +46,9 @@ const HEX64 = /^[0-9a-f]{64}$/;
 const PRE_CAPTURE_TOOLS = ['Bash', 'PowerShell', 'Task', 'Agent'];
 const STDOUT_CAP_BYTES = 1024 * 1024;
 const DOC_CHECK_FLAGS = new Set(['--workspace', '--config', '--changed-path', '--base']);
+const DOC_CHECK_BOOLEAN_FLAGS = new Set(['--conflict-assessment']);
 const DOC_CHECK_SCHEMA = 'harness.doc-check.check.v1';
+const DOC_CHECK_CONFLICT_SCHEMA = 'harness.doc-check.conflict-assessment.v1';
 const DOC_CHECK_SHELLS = new Set(['sh', 'bash', 'dash', 'zsh', 'ksh', 'fish']);
 const DOC_CHECK_LAUNCHERS = new Set(['node', 'nodejs', 'bun', 'deno', 'tsx', 'ts-node']);
 const DOC_CHECK_LAUNCHER_VALUE_FLAGS = new Set(['-r', '--require', '--import', '--loader', '--experimental-loader', '--inspect-port', '--input-type', '--conditions', '--env-file']);
@@ -65,7 +67,7 @@ function isUncPathPrefix(token, command, index) {
   return token === '' && command[index] === '\\' && command[index + 1] === '\\';
 }
 // Canonical SHA-256 of harness-everything/scripts/doc-check.js (CRLF normalised to LF). Re-pin deliberately when that script changes.
-const SHIPPED_DOC_CHECK_DIGEST = 'da5e51a763eda6680afb63ee781b566253df9d358eec1e65436786c9ecebbbdb';
+const SHIPPED_DOC_CHECK_DIGEST = '1afd94d66b356c94206d2441529ec0b7fafa1bcb453b0f1e2cf6994b1e4858e5';
 // This install's own doc-check runtime, relative to hooks/scripts/lib: the source checkout or the packaged plugin.
 const DOC_CHECK_INSTALL_LAYOUTS = [
   ['..', '..', '..', 'harness-everything', 'scripts', 'doc-check.js'],
@@ -357,10 +359,16 @@ function resolveDocCheckInvocation(command, cwd) {
 
   const values = new Map();
   const changedPaths = [];
-  for (let index = 3; index < tokens.length; index += 2) {
-    const flag = tokens[index];
-    const value = tokens[index + 1];
+  let conflictAssessment = false;
+  for (let index = 3; index < tokens.length;) {
+    const flag = tokens[index++];
+    if (DOC_CHECK_BOOLEAN_FLAGS.has(flag)) {
+      if (conflictAssessment) return rejected('duplicate-flag');
+      conflictAssessment = true;
+      continue;
+    }
     if (!DOC_CHECK_FLAGS.has(flag)) return rejected('unknown-flag');
+    const value = tokens[index++];
     if (value === undefined || !value || value.startsWith('--')) return rejected('flag-value-missing');
     if (flag === '--changed-path') changedPaths.push(value);
     else {
@@ -371,6 +379,8 @@ function resolveDocCheckInvocation(command, cwd) {
   if (!values.has('--workspace') || !values.has('--config') || !changedPaths.length) {
     return rejected('required-flag-missing');
   }
+  if (conflictAssessment && !values.has('--base')) return rejected('conflict-assessment-base-required');
+  if (conflictAssessment && !/^[0-9a-f]{40,64}$/.test(values.get('--base'))) return rejected('conflict-assessment-base-unpinned');
 
   installed = installedDocCheck();
   if (!installed) return rejected('implementation-not-installed');
@@ -382,7 +392,8 @@ function resolveDocCheckInvocation(command, cwd) {
       if (fileDigest(registered.installed) !== SHIPPED_DOC_CHECK_DIGEST) return rejected('implementation-pin-mismatch', 'the installed doc-check is not the shipped script (canonical digest differs from SHIPPED_DOC_CHECK_DIGEST); no credit');
     }
   }
-  return { kind: 'accepted', reason: null, installed: registered.installed, digest, argv };
+  return { kind: 'accepted', reason: null, installed: registered.installed, digest, argv,
+    conflictAssessment, base: values.get('--base') || null, changedPaths };
 }
 
 // Observation-time digests of the checked paths, read from the workspace when the check ran. Absent paths are omitted.
@@ -714,6 +725,9 @@ const createClaudeOriginProvider = input => {
       if (cap.event !== 'PostToolUse') return rejected('capability-mismatch', 'only a PostToolUse check invocation can cover a doc capability');
       const registered = resolveDocCheckInvocation(cap.command, cap.cwd);
       if (registered.kind === 'not-candidate') return rejected('unregistered-command', 'the command is not a registered doc-check invocation; an arbitrary successful shell command never covers a doc capability');
+      if (capability === 'conflict-check' && registered.conflictAssessment !== true) {
+        return rejected('capability-mismatch', 'conflict-check requires the structurally parsed --conflict-assessment mode');
+      }
       if (registered.kind === 'rejected' && registered.reason !== 'implementation-pin-mismatch') {
         if (registered.reason === 'implementation-not-installed') return rejected('implementation-not-installed', 'the registered check does not resolve to this install\'s own doc-check runtime; a different path earns no credit');
         return rejected('unregistered-command', `doc-check invocation rejected (${registered.reason}); no credit`);
@@ -744,11 +758,55 @@ const createClaudeOriginProvider = input => {
       }
       const paths = Array.isArray(projection.checkedPaths) ? projection.checkedPaths.slice() : [];
       if (!paths.length) return rejected('scope-empty', `${capability} checked no governed paths`);
+      let corpusBinding;
+      let baselineArtifactDigests;
+      if (capability === 'conflict-check') {
+        const assessment = report.conflictAssessment;
+        const corpus = assessment && assessment.corpus;
+        const config = corpus && corpus.config;
+        if (registered.conflictAssessment !== true || report.mode !== 'conflict-assessment'
+          || assessment?.schema !== DOC_CHECK_CONFLICT_SCHEMA || assessment.state !== 'pass'
+          || projection.corpus?.complete !== true || corpus?.complete !== true
+          || !Array.isArray(corpus.paths) || !corpus.paths.length || !recordOf(corpus.digests)
+          || !recordOf(config) || !textOf(config.path) || path.isAbsolute(config.path)
+          || config.path.split(/[\\/]/).includes('..') || !HEX64.test(String(config.digest || ''))
+          || !/^[0-9a-f]{40,64}$/.test(String(corpus.baseCommit || ''))
+          || JSON.stringify([...new Set(corpus.paths)].sort(compareKeys)) !== JSON.stringify(corpus.paths)
+          || JSON.stringify(Object.keys(corpus.digests).sort(compareKeys)) !== JSON.stringify(corpus.paths)
+          || corpus.paths.some(relative => !textOf(relative) || path.isAbsolute(relative)
+            || relative.split(/[\\/]/).includes('..') || !HEX64.test(String(corpus.digests[relative] || '')))) {
+          return rejected('corpus-binding-invalid', 'conflict-check stdout does not carry a complete, structured full-corpus assessment');
+        }
+        const observedCorpus = recordOf(cap.observedCorpusDigests) ? cap.observedCorpusDigests : {};
+        if (corpus.paths.some(relative => observedCorpus[relative] !== corpus.digests[relative])) {
+          return rejected('corpus-changed-after-check', 'a full-corpus path is missing or changed between assessment and capture');
+        }
+        if (cap.observedConfigDigest !== config.digest) {
+          return rejected('config-changed-after-check', 'the project-docs config changed between assessment and capture');
+        }
+        if (!recordOf(request.identity) || !HEX64.test(String(request.identity.baselineDigest || ''))
+          || !HEX64.test(String(request.identity.candidateDigest || '')) || !HEX64.test(String(request.identity.configDigest || ''))) {
+          return rejected('identity-missing', 'conflict-check needs the complete snapshot identity');
+        }
+        corpusBinding = {
+          complete: true,
+          paths: corpus.paths.slice(),
+          digests: { ...corpus.digests },
+          config: { ...config },
+          baseCommit: corpus.baseCommit,
+          baselineDigest: request.identity.baselineDigest,
+          candidateDigest: request.identity.candidateDigest,
+          configIdentityDigest: request.identity.configDigest,
+        };
+        baselineArtifactDigests = recordOf(assessment.baselineArtifacts) ? assessment.baselineArtifacts : {};
+      }
       const observed = recordOf(cap.observedDigests) ? cap.observedDigests : {};
       const artifactDigests = {};
+      const baselineArtifacts = {};
       for (const relative of paths) {
-        if (typeof observed[relative] !== 'string') return rejected('artifact-unobserved', `no observation-time digest for ${relative}`);
-        artifactDigests[relative] = observed[relative];
+        if (typeof observed[relative] === 'string') artifactDigests[relative] = observed[relative];
+        else if (capability === 'conflict-check' && HEX64.test(String(baselineArtifactDigests[relative] || ''))) baselineArtifacts[relative] = baselineArtifactDigests[relative];
+        else return rejected('artifact-unobserved', `no observation-time digest for ${relative}`);
       }
       const argv = ['node', ...registered.argv];
       const command = argv.join(' ');
@@ -772,6 +830,8 @@ const createClaudeOriginProvider = input => {
         endIdentity: recordOf(request.identity) ? JSON.parse(JSON.stringify(request.identity)) : null,
         paths,
         artifactDigests,
+        ...(Object.keys(baselineArtifacts).length ? { baselineArtifacts } : {}),
+        ...(corpusBinding ? { corpusBinding } : {}),
         captured: { responseRef: cap.responseRef, responseDigest: cap.responseDigest },
       };
       return { status: 'accepted', originRef, event, correlation: { toolCorrelationId: cap.tool_use_id, resultRef: cap.responseRef } };
@@ -1086,12 +1146,25 @@ function buildCaptureRecord(payload, eventName, workspaceRoot) {
         record.toolResponse = toolResponse;
       } else { record.stdout = null; record.stdoutTruncated = true; }
       let checkedPaths = [];
+      let conflictCorpus = null;
       try {
         const report = JSON.parse(stdout);
         checkedPaths = ['doc-lint', 'link-check'].flatMap(capability => (recordOf(report.capabilities) && recordOf(report.capabilities[capability])
           && Array.isArray(report.capabilities[capability].checkedPaths) ? report.capabilities[capability].checkedPaths : []));
+        const conflict = recordOf(report.capabilities) && report.capabilities['conflict-check'];
+        if (installedCheck.conflictAssessment === true && report.mode === 'conflict-assessment'
+          && recordOf(conflict) && conflict.state === 'pass' && recordOf(conflict.corpus)) {
+          checkedPaths.push(...(Array.isArray(conflict.checkedPaths) ? conflict.checkedPaths : []));
+          conflictCorpus = report.conflictAssessment && report.conflictAssessment.corpus;
+        }
       } catch { /* not JSON: no paths observed, the event will be withheld */ }
       record.observedDigests = typeof workspaceRoot === 'string' && workspaceRoot ? observedDigestsFor(workspaceRoot, [...new Set(checkedPaths)]) : {};
+      if (recordOf(conflictCorpus) && Array.isArray(conflictCorpus.paths) && recordOf(conflictCorpus.config)) {
+        record.observedCorpusDigests = typeof workspaceRoot === 'string' && workspaceRoot
+          ? observedDigestsFor(workspaceRoot, conflictCorpus.paths) : {};
+        record.observedConfigDigest = typeof workspaceRoot === 'string' && workspaceRoot
+          ? observedDigestsFor(workspaceRoot, [conflictCorpus.config.path])[conflictCorpus.config.path] || null : null;
+      }
     }
   } else if (event === 'PostToolUseFailure') {
     record.is_interrupt = Boolean(payload.is_interrupt);

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.43.1",
+  "version": "0.45.0",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/skills/harness-everything/SKILL.md

@@ -4,7 +4,7 @@ description: "Route software/project work through Harness: classify tier/topolog
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.43.0
+  version: 0.45.0
 ---
 
 # Harness Everything

package/plugins/harness-everything/skills/harness-everything/scripts/doc-check.js

@@ -6,14 +6,16 @@
 // Prints one JSON result. Exit 0 = both pass, 1 = defect, 2 = usage/config error.
 const fs = require('fs');
 const path = require('path');
+const crypto = require('crypto');
 const { execFileSync, spawnSync } = require('child_process');
 const { collectDocs } = require('./doc-lifecycle');
 
 // Logical command IDs (A3 section 3): stdout that repeats an ID is not trusted as credit by itself.
 const CHECK_ID = 'harness.doc-check.check.v1';
 const COMPARE_ID = 'harness.doc-check.compare-derived.v1';
-const USAGE = 'usage: doc-check.js check --workspace <dir> --config <json-file, relative to --workspace> --changed-path <path> [--changed-path <path> ...] [--base <git-rev>]';
+const USAGE = 'usage: doc-check.js check --workspace <dir> --config <json-file, relative to --workspace> --changed-path <path> [--changed-path <path> ...] [--base <git-rev>] [--conflict-assessment]';
 const VALUE_FLAGS = ['--workspace', '--config', '--changed-path', '--base'];
+const CONFLICT_SCHEMA = 'harness.doc-check.conflict-assessment.v1';
 const EXTERNAL = /^(?:https?:|mailto:)/i;
 const SCHEME = /^[a-z][a-z0-9+.-]*:/i;
 
@@ -79,10 +81,15 @@ function parseArgs(argv) {
   const [command, ...rest] = argv;
   if (command !== 'check') throw new Error(USAGE);
   const options = { changedPaths: [] };
-  for (let index = 0; index < rest.length; index += 2) {
+  for (let index = 0; index < rest.length; index++) {
     const flag = rest[index];
-    const value = rest[index + 1];
-    if (!VALUE_FLAGS.includes(flag) || value === undefined) throw new Error(`${USAGE}\nunknown or incomplete argument: ${flag}`);
+    if (flag === '--conflict-assessment') {
+      if (options.conflictAssessment) throw new Error(`${USAGE}\nrepeated argument: ${flag}`);
+      options.conflictAssessment = true;
+      continue;
+    }
+    if (!VALUE_FLAGS.includes(flag) || rest[index + 1] === undefined) throw new Error(`${USAGE}\nunknown or incomplete argument: ${flag}`);
+    const value = rest[++index];
     if (value.startsWith('--')) throw new Error(`${USAGE}\n${flag} requires a value, not a flag: ${value}`);
     if (flag === '--changed-path') options.changedPaths.push(value);
     else {
@@ -92,16 +99,47 @@ function parseArgs(argv) {
   }
   if (!options.workspace || !options.config) throw new Error(`${USAGE}\n--workspace and --config are required`);
   if (!options.changedPaths.length) throw new Error(`${USAGE}\n--changed-path is required`);
+  if (options.conflictAssessment && options.base === undefined) throw new Error(`${USAGE}\n--conflict-assessment requires --base`);
   return options;
 }
 
 function runLint(workspace, options) {
   const args = [path.join(__dirname, 'doc-lifecycle.js'), 'lint', '--workspace', workspace, '--config', options.config];
-  for (const changed of options.changedPaths) args.push('--changed-path', changed);
+  if (options.conflictAssessment) args.push('--all');
+  else for (const changed of options.changedPaths) args.push('--changed-path', changed);
   if (options.base !== undefined) args.push('--base', options.base);
   return spawnSync(process.execPath, args, { encoding: 'utf8' });
 }
 
+function workspaceRelative(workspace, value) {
+  const absolute = path.resolve(workspace, value);
+  const relative = path.relative(workspace, absolute);
+  if (!relative || relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) return null;
+  return relative.split(path.sep).join('/');
+}
+
+function resolvedBaseCommit(workspace, base) {
+  if (typeof base !== 'string' || !base || base.startsWith('-')) return null;
+  try {
+    const value = execFileSync('git', ['-C', workspace, 'rev-parse', '--verify', `${base}^{commit}`], {
+      encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore']
+    }).trim();
+    return /^[0-9a-f]{40,64}$/.test(value) ? value : null;
+  } catch { return null; }
+}
+
+function baselineArtifacts(workspace, base, paths) {
+  const artifacts = {};
+  for (const relative of paths) {
+    if (fs.existsSync(path.join(workspace, relative))) continue;
+    try {
+      const bytes = execFileSync('git', ['-C', workspace, 'show', `${base}:${relative}`], { encoding: 'buffer', stdio: ['ignore', 'pipe', 'ignore'] });
+      artifacts[relative] = crypto.createHash('sha256').update(bytes).digest('hex');
+    } catch { /* Paths absent from both snapshots need no baseline artifact. */ }
+  }
+  return artifacts;
+}
+
 // Scan nested label spans depth-first, then resume after each destination. Matching brackets are precomputed per line,
 // and an explicit stack keeps nesting from consuming the JS call stack. A nested link inside a label remains an
 // intentional over-check: CommonMark keeps only the inner link, so both targets are checked and neither is silent.
@@ -340,7 +378,8 @@ function check(options) {
   try { analysis = JSON.parse(lint.stdout); } catch {
     return emit({ schema: CHECK_ID, command: CHECK_ID, lint: { exit: 2, error: 'lint output was not JSON', diagnostics: [] }, links: { checked: 0, broken: [], skipped: 'lint-usage-error' }, coverage: { unsupported: [] } }, 2);
   }
-  const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+  const configBytes = fs.readFileSync(configPath);
+  const config = JSON.parse(configBytes.toString('utf8'));
   const docs = collectDocs(workspace, config);
   const governed = new Set(docs.filter(doc => doc.role).map(doc => doc.path));
 
@@ -408,6 +447,7 @@ function check(options) {
   const result = {
     schema: CHECK_ID,
     command: CHECK_ID,
+    ...(options.conflictAssessment ? { mode: 'conflict-assessment' } : {}),
     lint: { exit: lintExit, evidence: analysis.evidence, diagnostics: analysis.diagnostics },
     links: { checked, broken },
     coverage: { unsupported },
@@ -425,6 +465,44 @@ function check(options) {
       },
     }
   };
+  if (options.conflictAssessment) {
+    const scopePaths = [...new Set(options.changedPaths.map(value => workspaceRelative(workspace, value)).filter(Boolean))].sort();
+    const corpus = analysis.corpus;
+    const baseCommit = resolvedBaseCommit(workspace, options.base);
+    const configRelative = workspaceRelative(workspace, options.config);
+    let reason = null;
+    if (!scopePaths.length || scopePaths.length !== new Set(options.changedPaths.map(value => workspaceRelative(workspace, value))).size) reason = 'scope-unavailable';
+    else if (!Array.isArray(config.domains) || config.domains.length === 0) reason = 'domains-unknown';
+    else if (!corpus || corpus.complete !== true || !Array.isArray(corpus.paths) || !corpus.paths.length) reason = 'corpus-incomplete';
+    else if (!corpus.digests || Object.keys(corpus.digests).length !== corpus.paths.length
+      || corpus.paths.some(relative => !/^[0-9a-f]{64}$/.test(corpus.digests[relative] || ''))) reason = 'corpus-digests-incomplete';
+    else if (!baseCommit) reason = 'base-unavailable';
+    else if (options.base !== baseCommit) reason = 'base-not-pinned';
+    else if (!configRelative) reason = 'config-outside-workspace';
+    else if (!corpus.config || corpus.config.path !== configRelative) reason = 'config-unavailable';
+    else if (corpus.config.digest !== crypto.createHash('sha256').update(configBytes).digest('hex')) reason = 'config-changed-during-check';
+    const hasErrors = lintExit !== 0 || !Array.isArray(analysis.diagnostics)
+      || analysis.diagnostics.some(item => item && item.severity === 'error');
+    const corpusIdentity = corpus && {
+      complete: corpus.complete === true,
+      paths: corpus.paths,
+      digests: corpus.digests,
+      config: corpus.config,
+      baseCommit,
+    };
+    const state = reason ? 'unavailable' : hasErrors ? 'fail' : 'pass';
+    result.conflictAssessment = {
+      schema: CONFLICT_SCHEMA,
+      state,
+      ...(reason ? { reason } : {}),
+      ...(corpusIdentity ? { corpus: corpusIdentity } : {}),
+      ...(state === 'pass' ? { baselineArtifacts: baselineArtifacts(workspace, baseCommit, scopePaths) } : {}),
+    };
+    if (state === 'pass') result.capabilities['conflict-check'] = {
+      state: 'pass', checkedPaths: scopePaths, corpus: corpusIdentity,
+    };
+    return emit(result, state === 'unavailable' ? 2 : lintExit === 1 || broken.length ? 1 : 0);
+  }
   return emit(result, lintExit === 1 || broken.length ? 1 : 0);
 }
 

package/plugins/harness-everything/skills/harness-everything/scripts/doc-lifecycle.js

@@ -265,7 +265,16 @@ function directoryCanContainMatch(relativeDirectory, globs, exactPaths = []) {
     || exactPathCanMatchDescendant(relativeDirectory, exactPaths);
 }
 
-function collectDocs(root, config) {
+function documentCorpusPaths(records, config) {
+  const selectors = [
+    ...(Array.isArray(config && config.governed) ? config.governed.map(entry => entry && entry.path) : []),
+    ...(Array.isArray(config && config.legacy) ? config.legacy : [])
+  ].filter(value => typeof value === 'string');
+  return [...new Set((records || []).filter(item => item && item.presence === 'present' && item.type === 'file'
+    && typeof item.path === 'string' && matchesAny(item.path, selectors)).map(item => item.path))].sort(compareText);
+}
+
+function collectDocs(root, config, coverage = null) {
   const workspace = path.resolve(root);
   const governed = Array.isArray(config && config.governed) ? config.governed : [];
   const legacyGlobs = Array.isArray(config && config.legacy) ? config.legacy : [];
@@ -274,9 +283,14 @@ function collectDocs(root, config) {
     ...legacyGlobs
   ].filter(value => typeof value === 'string');
   const files = [];
+  const skipped = [];
+  const skip = (relative, reason) => skipped.push({ path: relative || '.', reason });
   function walk(directory, relativeDirectory) {
     let entries;
-    try { entries = fs.readdirSync(directory, { withFileTypes: true }); } catch { return; }
+    try { entries = fs.readdirSync(directory, { withFileTypes: true }); } catch {
+      skip(relativeDirectory, 'unreadable-directory');
+      return;
+    }
     entries.sort((a, b) => compareText(a.name, b.name));
     for (const entry of entries) {
       if (entry.name === '.git' || entry.name === 'node_modules') continue;
@@ -285,6 +299,11 @@ function collectDocs(root, config) {
       if (entry.isDirectory()) {
         if (directoryCanContainMatch(relativePath, globs)) walk(absolute, relativePath);
       } else if (entry.isFile() && matchesAny(relativePath, globs)) files.push(absolute);
+      else if (entry.isSymbolicLink() && (matchesAny(relativePath, globs) || directoryCanContainMatch(relativePath, globs))) {
+        skip(relativePath, 'unsupported-symlink');
+      } else if (!entry.isDirectory() && !entry.isFile() && matchesAny(relativePath, globs)) {
+        skip(relativePath, 'unsupported-entry');
+      }
     }
   }
   walk(workspace, '');
@@ -296,9 +315,23 @@ function collectDocs(root, config) {
     const legacy = matchesAny(relativePath, legacyGlobs);
     if (!roleEntry && !legacy) continue;
     let bytes;
-    try { bytes = fs.readFileSync(absolute); } catch { continue; }
+    try { bytes = fs.readFileSync(absolute); } catch {
+      skip(relativePath, 'unreadable-file');
+      continue;
+    }
     selected.push({ relativePath, role: roleEntry ? roleEntry.role : null, legacy, bytes });
   }
+  for (const selector of globs.filter(value => !/[*?\[\]{}]/.test(value))) {
+    if (!files.includes(path.resolve(workspace, selector))) skip(selector, 'missing-configured-path');
+  }
+  if (coverage) {
+    coverage.complete = globs.length > 0 && skipped.length === 0;
+    coverage.skipped = skipped;
+    coverage.paths = selected.map(item => item.relativePath).sort(compareText);
+    coverage.digests = Object.fromEntries(selected
+      .sort((a, b) => compareText(a.relativePath, b.relativePath))
+      .map(item => [item.relativePath, crypto.createHash('sha256').update(item.bytes).digest('hex')]));
+  }
   const rules = readWorkingTreeRules(workspace, selected.filter(item => item.bytes.includes(0x0d)).map(item => item.relativePath));
   const docs = [];
   for (const item of selected) {
@@ -2664,7 +2697,11 @@ function main(argv = process.argv.slice(2)) {
     ? path.resolve(options.configFile)
     : path.resolve(workspacePath, options.configFile);
   let config;
-  try { config = JSON.parse(fs.readFileSync(configPath, 'utf8')); } catch (error) {
+  let configBytes;
+  try {
+    configBytes = fs.readFileSync(configPath);
+    config = JSON.parse(configBytes.toString('utf8'));
+  } catch (error) {
     process.stderr.write(`cannot read config: ${error.message}\n`);
     return 2;
   }
@@ -2672,7 +2709,14 @@ function main(argv = process.argv.slice(2)) {
     process.stderr.write(`${error.message}\n`);
     return 2;
   }
-  const docs = collectDocs(workspacePath, config);
+  const corpus = options.all ? { complete: false, skipped: [], paths: [], digests: {} } : null;
+  const docs = collectDocs(workspacePath, config, corpus);
+  if (corpus) {
+    const relativeConfig = path.relative(workspacePath, configPath);
+    corpus.config = relativeConfig && relativeConfig !== '..' && !relativeConfig.startsWith(`..${path.sep}`)
+      ? { path: relativeConfig.split(path.sep).join('/'), digest: crypto.createHash('sha256').update(configBytes).digest('hex') }
+      : null;
+  }
   const mode = {
     ...(options.all ? { all: true } : { changedPaths: options.changedPaths }),
     workspace: workspacePath, base: options.base, configPath,
@@ -2688,10 +2732,11 @@ function main(argv = process.argv.slice(2)) {
     }));
     return 0;
   }
+  if (corpus) analysis.corpus = corpus;
   process.stdout.write(`${JSON.stringify(analysis, null, 2)}\n`);
   return analysis.diagnostics.some(item => item.severity === 'error') ? 1 : 0;
 }
 
-module.exports = { readGitBaseInventory, scanWorkspaceFiles, parseFrontmatter, parseRequirementBlocks, collectDocs, analyzeDocs, resolveRef, lintDocs, buildIndex, diffRevisions, buildGitDocumentInventory };
+module.exports = { readGitBaseInventory, scanWorkspaceFiles, parseFrontmatter, parseRequirementBlocks, collectDocs, documentCorpusPaths, analyzeDocs, resolveRef, lintDocs, buildIndex, diffRevisions, buildGitDocumentInventory };
 
 if (require.main === module) process.exitCode = main();

package/sbom.cdx.json

@@ -2,23 +2,23 @@
   "$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.7",
-  "serialNumber": "urn:uuid:e4de25fd-21a9-593b-841e-c8e0c3a9d6ad",
+  "serialNumber": "urn:uuid:16eef945-b68a-5405-9f2c-9d18949bad33",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-27T09:10:22.642Z",
+    "timestamp": "2026-10-27T11:52:14.799Z",
     "tools": [
       {
         "vendor": "Harness Everything",
         "name": "generate-sbom.js",
-        "version": "0.43.1"
+        "version": "0.45.0"
       }
     ],
     "component": {
       "type": "application",
-      "bom-ref": "pkg:npm/harness-everything@0.43.1",
+      "bom-ref": "pkg:npm/harness-everything@0.45.0",
       "name": "harness-everything",
-      "version": "0.43.1",
-      "purl": "pkg:npm/harness-everything@0.43.1"
+      "version": "0.45.0",
+      "purl": "pkg:npm/harness-everything@0.45.0"
     }
   },
   "components": [
@@ -2033,7 +2033,7 @@
       ]
     },
     {
-      "ref": "pkg:npm/harness-everything@0.43.1",
+      "ref": "pkg:npm/harness-everything@0.45.0",
       "dependsOn": [
         "pkg:npm/%40commitlint/cli@19.8.1",
         "pkg:npm/%40commitlint/config-conventional@19.8.1",

package/scripts/doc-governance-guard.js

@@ -121,9 +121,8 @@ function validateProjectDocs(value, label) {
       if (!isRecord(record) || typeof record.path !== 'string' || !record.path || typeof record[field] !== 'string' || !record[field]) {
         throw new Error(`${label} has a malformed ${kind} record`);
       }
-      if (record.path.startsWith('/') || record.path.split('/').includes('..') || /[*?\[\]]/.test(record.path)) {
-        // shortcut: the baseline registry uses exact Git paths; glob support needs a Git-aware matcher before adoption.
-        throw new Error(`${label} has a non-exact governed or derived path: ${record.path}`);
+      if (record.path.startsWith('/') || record.path.split('/').includes('..') || ['?', '[', ']', '{', '}'].some(char => record.path.includes(char))) {
+        throw new Error(`${label} has an unsupported governed or derived path pattern: ${record.path}`);
       }
       const key = `${kind}:${record.path}`;
       if (seen.has(key)) throw new Error(`${label} has duplicate ${kind} path: ${record.path}`);
@@ -159,8 +158,9 @@ function policyChanges(base, candidate, kind) {
     path: record.path,
     base: record,
     candidate: byPath.get(record.path) || null
-  }));
-  const added = candidate[kind].filter(record => !basePaths.has(record.path));
+  })).sort((left, right) => Buffer.compare(Buffer.from(left.path), Buffer.from(right.path)));
+  const added = candidate[kind].filter(record => !basePaths.has(record.path))
+    .sort((left, right) => Buffer.compare(Buffer.from(left.path), Buffer.from(right.path)));
   return { state: missingOrChanged.length || added.length ? 'review_required' : 'pass', preserved: base[kind].length - missingOrChanged.length, missingOrChanged, added };
 }
 
@@ -173,6 +173,32 @@ function pathText(pathBytes) {
   return Buffer.from(value, 'utf8').equals(pathBytes) ? value : null;
 }
 
+function globToRegExp(glob) {
+  const source = Buffer.from(String(glob).replace(/\\/g, '/'), 'utf8').toString('latin1');
+  let pattern = '^';
+  for (let index = 0; index < source.length; index++) {
+    const char = source[index];
+    if (char === '*' && source[index + 1] === '*') {
+      if (source[index + 2] === '/') {
+        pattern += '(?:[\\s\\S]*/)?';
+        index += 2;
+      } else {
+        pattern += '[\\s\\S]*';
+        index++;
+      }
+    } else if (char === '*') {
+      pattern += '[^/]*';
+    } else {
+      pattern += char.replace(/[|\\{}()[\]^$+?.]/g, '\\$&');
+    }
+  }
+  return new RegExp(`${pattern}$`);
+}
+
+function matchesConfiguredPath(record, pathBytes, matcher) {
+  return matcher ? matcher.test(pathBytes.toString('latin1')) : Buffer.from(record.path, 'utf8').equals(pathBytes);
+}
+
 function identity(entry) {
   return entry ? { mode: entry.mode, type: entry.type, oid: entry.oid } : null;
 }
@@ -223,27 +249,57 @@ function unknownNewDocuments(baseTree, candidateTree) {
 
 function checkConfiguredPaths(baseTree, candidateTree, config) {
   const details = [];
+  const patterns = [];
   for (const kind of ['governed', 'derived']) {
     for (const record of config[kind]) {
-      const key = pathKey(record.path);
-      const before = baseTree.get(key);
-      const after = candidateTree.get(key);
-      if (!regularBlob(before)) throw new Error(`baseline ${kind} path is missing or not a regular file: ${record.path}`);
-      const sameRegularMode = regularBlob(after) && before.mode === after.mode;
-      const revised = kind === 'governed' && sameRegularMode && before.oid !== after.oid;
-      const identityPreserved = sameRegularMode && before.oid === after.oid;
-      details.push({
-        kind,
-        path: record.path,
-        state: revised ? 'revised' : identityPreserved ? 'pass' : 'review_required',
-        base: identity(before),
-        candidate: identity(after),
-        ...(revised ? { reason: 'Content revisions are tracked by Git identity but are not semantically validated by the guard.' } : {})
-      });
+      const glob = record.path.includes('*');
+      const matcher = glob ? globToRegExp(record.path) : null;
+      const collect = sourceTree => {
+        if (!glob) {
+          const key = pathKey(record.path);
+          const entry = sourceTree.get(key);
+          return new Map(entry ? [[key, entry]] : []);
+        }
+        const matches = new Map();
+        for (const [key, entry] of sourceTree) {
+          if (matchesConfiguredPath(record, entry.pathBytes, matcher)) matches.set(key, entry);
+        }
+        return matches;
+      };
+      const baseMembers = collect(baseTree);
+      const candidateMembers = collect(candidateTree);
+      if (!glob && !regularBlob(baseMembers.values().next().value)) {
+        throw new Error(`baseline ${kind} path is missing or not a regular file: ${record.path}`);
+      }
+      if (glob) patterns.push({ kind, path: record.path, baseMembers: baseMembers.size, candidateMembers: candidateMembers.size });
+      const keys = new Set([...baseMembers.keys(), ...candidateMembers.keys()]);
+      for (const key of keys) {
+        const before = baseMembers.get(key) || null;
+        const after = candidateMembers.get(key) || null;
+        const entry = before || after;
+        const sameRegularMode = regularBlob(before) && regularBlob(after) && before.mode === after.mode;
+        const revised = kind === 'governed' && sameRegularMode && before.oid !== after.oid;
+        const identityPreserved = sameRegularMode && before.oid === after.oid;
+        const memberPath = pathText(entry.pathBytes);
+        details.push({
+          kind,
+          ...(glob ? { pattern: record.path } : {}),
+          path: memberPath,
+          ...(memberPath === null ? { pathBase64: key } : {}),
+          state: revised ? 'revised' : identityPreserved ? 'pass' : 'review_required',
+          base: identity(before),
+          candidate: identity(after),
+          ...(revised ? { reason: 'Content revisions are tracked by Git identity but are not semantically validated by the guard.' } : {})
+        });
+      }
     }
   }
+  patterns.sort((left, right) => Buffer.compare(Buffer.from(left.kind), Buffer.from(right.kind)) || Buffer.compare(Buffer.from(left.path), Buffer.from(right.path)));
+  details.sort((left, right) => Buffer.compare(Buffer.from(left.pathBase64 || Buffer.from(left.path, 'utf8').toString('base64'), 'base64'), Buffer.from(right.pathBase64 || Buffer.from(right.path, 'utf8').toString('base64'), 'base64'))
+    || Buffer.compare(Buffer.from(left.kind), Buffer.from(right.kind))
+    || Buffer.compare(Buffer.from(left.pattern || ''), Buffer.from(right.pattern || '')));
   const failures = details.filter(item => item.state === 'review_required');
-  return { state: failures.length ? 'review_required' : 'pass', paths: details, missingOrChanged: failures };
+  return { state: failures.length ? 'review_required' : 'pass', patterns, paths: details, missingOrChanged: failures };
 }
 
 function parseArgs(argv) {