harness-everything 0.44.0 → 0.45.0

package/harness-everything/scripts/doc-check.js

@@ -6,14 +6,16 @@
 // Prints one JSON result. Exit 0 = both pass, 1 = defect, 2 = usage/config error.
 const fs = require('fs');
 const path = require('path');
+const crypto = require('crypto');
 const { execFileSync, spawnSync } = require('child_process');
 const { collectDocs } = require('./doc-lifecycle');
 
 // Logical command IDs (A3 section 3): stdout that repeats an ID is not trusted as credit by itself.
 const CHECK_ID = 'harness.doc-check.check.v1';
 const COMPARE_ID = 'harness.doc-check.compare-derived.v1';
-const USAGE = 'usage: doc-check.js check --workspace <dir> --config <json-file, relative to --workspace> --changed-path <path> [--changed-path <path> ...] [--base <git-rev>]';
+const USAGE = 'usage: doc-check.js check --workspace <dir> --config <json-file, relative to --workspace> --changed-path <path> [--changed-path <path> ...] [--base <git-rev>] [--conflict-assessment]';
 const VALUE_FLAGS = ['--workspace', '--config', '--changed-path', '--base'];
+const CONFLICT_SCHEMA = 'harness.doc-check.conflict-assessment.v1';
 const EXTERNAL = /^(?:https?:|mailto:)/i;
 const SCHEME = /^[a-z][a-z0-9+.-]*:/i;
 
@@ -79,10 +81,15 @@ function parseArgs(argv) {
   const [command, ...rest] = argv;
   if (command !== 'check') throw new Error(USAGE);
   const options = { changedPaths: [] };
-  for (let index = 0; index < rest.length; index += 2) {
+  for (let index = 0; index < rest.length; index++) {
     const flag = rest[index];
-    const value = rest[index + 1];
-    if (!VALUE_FLAGS.includes(flag) || value === undefined) throw new Error(`${USAGE}\nunknown or incomplete argument: ${flag}`);
+    if (flag === '--conflict-assessment') {
+      if (options.conflictAssessment) throw new Error(`${USAGE}\nrepeated argument: ${flag}`);
+      options.conflictAssessment = true;
+      continue;
+    }
+    if (!VALUE_FLAGS.includes(flag) || rest[index + 1] === undefined) throw new Error(`${USAGE}\nunknown or incomplete argument: ${flag}`);
+    const value = rest[++index];
     if (value.startsWith('--')) throw new Error(`${USAGE}\n${flag} requires a value, not a flag: ${value}`);
     if (flag === '--changed-path') options.changedPaths.push(value);
     else {
@@ -92,16 +99,47 @@ function parseArgs(argv) {
   }
   if (!options.workspace || !options.config) throw new Error(`${USAGE}\n--workspace and --config are required`);
   if (!options.changedPaths.length) throw new Error(`${USAGE}\n--changed-path is required`);
+  if (options.conflictAssessment && options.base === undefined) throw new Error(`${USAGE}\n--conflict-assessment requires --base`);
   return options;
 }
 
 function runLint(workspace, options) {
   const args = [path.join(__dirname, 'doc-lifecycle.js'), 'lint', '--workspace', workspace, '--config', options.config];
-  for (const changed of options.changedPaths) args.push('--changed-path', changed);
+  if (options.conflictAssessment) args.push('--all');
+  else for (const changed of options.changedPaths) args.push('--changed-path', changed);
   if (options.base !== undefined) args.push('--base', options.base);
   return spawnSync(process.execPath, args, { encoding: 'utf8' });
 }
 
+function workspaceRelative(workspace, value) {
+  const absolute = path.resolve(workspace, value);
+  const relative = path.relative(workspace, absolute);
+  if (!relative || relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) return null;
+  return relative.split(path.sep).join('/');
+}
+
+function resolvedBaseCommit(workspace, base) {
+  if (typeof base !== 'string' || !base || base.startsWith('-')) return null;
+  try {
+    const value = execFileSync('git', ['-C', workspace, 'rev-parse', '--verify', `${base}^{commit}`], {
+      encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore']
+    }).trim();
+    return /^[0-9a-f]{40,64}$/.test(value) ? value : null;
+  } catch { return null; }
+}
+
+function baselineArtifacts(workspace, base, paths) {
+  const artifacts = {};
+  for (const relative of paths) {
+    if (fs.existsSync(path.join(workspace, relative))) continue;
+    try {
+      const bytes = execFileSync('git', ['-C', workspace, 'show', `${base}:${relative}`], { encoding: 'buffer', stdio: ['ignore', 'pipe', 'ignore'] });
+      artifacts[relative] = crypto.createHash('sha256').update(bytes).digest('hex');
+    } catch { /* Paths absent from both snapshots need no baseline artifact. */ }
+  }
+  return artifacts;
+}
+
 // Scan nested label spans depth-first, then resume after each destination. Matching brackets are precomputed per line,
 // and an explicit stack keeps nesting from consuming the JS call stack. A nested link inside a label remains an
 // intentional over-check: CommonMark keeps only the inner link, so both targets are checked and neither is silent.
@@ -340,7 +378,8 @@ function check(options) {
   try { analysis = JSON.parse(lint.stdout); } catch {
     return emit({ schema: CHECK_ID, command: CHECK_ID, lint: { exit: 2, error: 'lint output was not JSON', diagnostics: [] }, links: { checked: 0, broken: [], skipped: 'lint-usage-error' }, coverage: { unsupported: [] } }, 2);
   }
-  const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+  const configBytes = fs.readFileSync(configPath);
+  const config = JSON.parse(configBytes.toString('utf8'));
   const docs = collectDocs(workspace, config);
   const governed = new Set(docs.filter(doc => doc.role).map(doc => doc.path));
 
@@ -408,6 +447,7 @@ function check(options) {
   const result = {
     schema: CHECK_ID,
     command: CHECK_ID,
+    ...(options.conflictAssessment ? { mode: 'conflict-assessment' } : {}),
     lint: { exit: lintExit, evidence: analysis.evidence, diagnostics: analysis.diagnostics },
     links: { checked, broken },
     coverage: { unsupported },
@@ -425,6 +465,44 @@ function check(options) {
       },
     }
   };
+  if (options.conflictAssessment) {
+    const scopePaths = [...new Set(options.changedPaths.map(value => workspaceRelative(workspace, value)).filter(Boolean))].sort();
+    const corpus = analysis.corpus;
+    const baseCommit = resolvedBaseCommit(workspace, options.base);
+    const configRelative = workspaceRelative(workspace, options.config);
+    let reason = null;
+    if (!scopePaths.length || scopePaths.length !== new Set(options.changedPaths.map(value => workspaceRelative(workspace, value))).size) reason = 'scope-unavailable';
+    else if (!Array.isArray(config.domains) || config.domains.length === 0) reason = 'domains-unknown';
+    else if (!corpus || corpus.complete !== true || !Array.isArray(corpus.paths) || !corpus.paths.length) reason = 'corpus-incomplete';
+    else if (!corpus.digests || Object.keys(corpus.digests).length !== corpus.paths.length
+      || corpus.paths.some(relative => !/^[0-9a-f]{64}$/.test(corpus.digests[relative] || ''))) reason = 'corpus-digests-incomplete';
+    else if (!baseCommit) reason = 'base-unavailable';
+    else if (options.base !== baseCommit) reason = 'base-not-pinned';
+    else if (!configRelative) reason = 'config-outside-workspace';
+    else if (!corpus.config || corpus.config.path !== configRelative) reason = 'config-unavailable';
+    else if (corpus.config.digest !== crypto.createHash('sha256').update(configBytes).digest('hex')) reason = 'config-changed-during-check';
+    const hasErrors = lintExit !== 0 || !Array.isArray(analysis.diagnostics)
+      || analysis.diagnostics.some(item => item && item.severity === 'error');
+    const corpusIdentity = corpus && {
+      complete: corpus.complete === true,
+      paths: corpus.paths,
+      digests: corpus.digests,
+      config: corpus.config,
+      baseCommit,
+    };
+    const state = reason ? 'unavailable' : hasErrors ? 'fail' : 'pass';
+    result.conflictAssessment = {
+      schema: CONFLICT_SCHEMA,
+      state,
+      ...(reason ? { reason } : {}),
+      ...(corpusIdentity ? { corpus: corpusIdentity } : {}),
+      ...(state === 'pass' ? { baselineArtifacts: baselineArtifacts(workspace, baseCommit, scopePaths) } : {}),
+    };
+    if (state === 'pass') result.capabilities['conflict-check'] = {
+      state: 'pass', checkedPaths: scopePaths, corpus: corpusIdentity,
+    };
+    return emit(result, state === 'unavailable' ? 2 : lintExit === 1 || broken.length ? 1 : 0);
+  }
   return emit(result, lintExit === 1 || broken.length ? 1 : 0);
 }
 

package/harness-everything/scripts/doc-lifecycle.js

@@ -265,7 +265,16 @@ function directoryCanContainMatch(relativeDirectory, globs, exactPaths = []) {
     || exactPathCanMatchDescendant(relativeDirectory, exactPaths);
 }
 
-function collectDocs(root, config) {
+function documentCorpusPaths(records, config) {
+  const selectors = [
+    ...(Array.isArray(config && config.governed) ? config.governed.map(entry => entry && entry.path) : []),
+    ...(Array.isArray(config && config.legacy) ? config.legacy : [])
+  ].filter(value => typeof value === 'string');
+  return [...new Set((records || []).filter(item => item && item.presence === 'present' && item.type === 'file'
+    && typeof item.path === 'string' && matchesAny(item.path, selectors)).map(item => item.path))].sort(compareText);
+}
+
+function collectDocs(root, config, coverage = null) {
   const workspace = path.resolve(root);
   const governed = Array.isArray(config && config.governed) ? config.governed : [];
   const legacyGlobs = Array.isArray(config && config.legacy) ? config.legacy : [];
@@ -274,9 +283,14 @@ function collectDocs(root, config) {
     ...legacyGlobs
   ].filter(value => typeof value === 'string');
   const files = [];
+  const skipped = [];
+  const skip = (relative, reason) => skipped.push({ path: relative || '.', reason });
   function walk(directory, relativeDirectory) {
     let entries;
-    try { entries = fs.readdirSync(directory, { withFileTypes: true }); } catch { return; }
+    try { entries = fs.readdirSync(directory, { withFileTypes: true }); } catch {
+      skip(relativeDirectory, 'unreadable-directory');
+      return;
+    }
     entries.sort((a, b) => compareText(a.name, b.name));
     for (const entry of entries) {
       if (entry.name === '.git' || entry.name === 'node_modules') continue;
@@ -285,6 +299,11 @@ function collectDocs(root, config) {
       if (entry.isDirectory()) {
         if (directoryCanContainMatch(relativePath, globs)) walk(absolute, relativePath);
       } else if (entry.isFile() && matchesAny(relativePath, globs)) files.push(absolute);
+      else if (entry.isSymbolicLink() && (matchesAny(relativePath, globs) || directoryCanContainMatch(relativePath, globs))) {
+        skip(relativePath, 'unsupported-symlink');
+      } else if (!entry.isDirectory() && !entry.isFile() && matchesAny(relativePath, globs)) {
+        skip(relativePath, 'unsupported-entry');
+      }
     }
   }
   walk(workspace, '');
@@ -296,9 +315,23 @@ function collectDocs(root, config) {
     const legacy = matchesAny(relativePath, legacyGlobs);
     if (!roleEntry && !legacy) continue;
     let bytes;
-    try { bytes = fs.readFileSync(absolute); } catch { continue; }
+    try { bytes = fs.readFileSync(absolute); } catch {
+      skip(relativePath, 'unreadable-file');
+      continue;
+    }
     selected.push({ relativePath, role: roleEntry ? roleEntry.role : null, legacy, bytes });
   }
+  for (const selector of globs.filter(value => !/[*?\[\]{}]/.test(value))) {
+    if (!files.includes(path.resolve(workspace, selector))) skip(selector, 'missing-configured-path');
+  }
+  if (coverage) {
+    coverage.complete = globs.length > 0 && skipped.length === 0;
+    coverage.skipped = skipped;
+    coverage.paths = selected.map(item => item.relativePath).sort(compareText);
+    coverage.digests = Object.fromEntries(selected
+      .sort((a, b) => compareText(a.relativePath, b.relativePath))
+      .map(item => [item.relativePath, crypto.createHash('sha256').update(item.bytes).digest('hex')]));
+  }
   const rules = readWorkingTreeRules(workspace, selected.filter(item => item.bytes.includes(0x0d)).map(item => item.relativePath));
   const docs = [];
   for (const item of selected) {
@@ -2664,7 +2697,11 @@ function main(argv = process.argv.slice(2)) {
     ? path.resolve(options.configFile)
     : path.resolve(workspacePath, options.configFile);
   let config;
-  try { config = JSON.parse(fs.readFileSync(configPath, 'utf8')); } catch (error) {
+  let configBytes;
+  try {
+    configBytes = fs.readFileSync(configPath);
+    config = JSON.parse(configBytes.toString('utf8'));
+  } catch (error) {
     process.stderr.write(`cannot read config: ${error.message}\n`);
     return 2;
   }
@@ -2672,7 +2709,14 @@ function main(argv = process.argv.slice(2)) {
     process.stderr.write(`${error.message}\n`);
     return 2;
   }
-  const docs = collectDocs(workspacePath, config);
+  const corpus = options.all ? { complete: false, skipped: [], paths: [], digests: {} } : null;
+  const docs = collectDocs(workspacePath, config, corpus);
+  if (corpus) {
+    const relativeConfig = path.relative(workspacePath, configPath);
+    corpus.config = relativeConfig && relativeConfig !== '..' && !relativeConfig.startsWith(`..${path.sep}`)
+      ? { path: relativeConfig.split(path.sep).join('/'), digest: crypto.createHash('sha256').update(configBytes).digest('hex') }
+      : null;
+  }
   const mode = {
     ...(options.all ? { all: true } : { changedPaths: options.changedPaths }),
     workspace: workspacePath, base: options.base, configPath,
@@ -2688,10 +2732,11 @@ function main(argv = process.argv.slice(2)) {
     }));
     return 0;
   }
+  if (corpus) analysis.corpus = corpus;
   process.stdout.write(`${JSON.stringify(analysis, null, 2)}\n`);
   return analysis.diagnostics.some(item => item.severity === 'error') ? 1 : 0;
 }
 
-module.exports = { readGitBaseInventory, scanWorkspaceFiles, parseFrontmatter, parseRequirementBlocks, collectDocs, analyzeDocs, resolveRef, lintDocs, buildIndex, diffRevisions, buildGitDocumentInventory };
+module.exports = { readGitBaseInventory, scanWorkspaceFiles, parseFrontmatter, parseRequirementBlocks, collectDocs, documentCorpusPaths, analyzeDocs, resolveRef, lintDocs, buildIndex, diffRevisions, buildGitDocumentInventory };
 
 if (require.main === module) process.exitCode = main();

package/hooks/scripts/lib/doc-reconciliation-events.js

@@ -101,6 +101,23 @@ function acceptDocEvents(input = {}, dependencies = {}) {
         // Supplied extra digests must also describe this capture, never another tree.
         for (const p of Object.keys(digests)) if (!artifacts[p] || digests[p] !== artifacts[p].digest) reject('artifact-mismatch');
       }
+      if (event?.capability === 'conflict-check') {
+        const binding = event.corpusBinding;
+        const identity = snapshot.identity;
+        const expectedPaths = U.runtimeModule('doc-lifecycle.js').documentCorpusPaths(
+          snapshot.candidate.records, snapshot.config.resolution.config
+        );
+        if (!U.record(binding) || binding.complete !== true || !Array.isArray(binding.paths)
+          || U.stable(binding.paths) !== U.stable(expectedPaths) || !U.record(binding.digests)
+          || U.stable(Object.keys(binding.digests).sort()) !== U.stable(expectedPaths)
+          || !expectedPaths.every(p => artifacts[p] && binding.digests[p] === artifacts[p].digest)) reject('corpus-mismatch');
+        if (binding?.baselineDigest !== identity.baselineDigest || binding?.candidateDigest !== identity.candidateDigest
+          || binding?.configIdentityDigest !== identity.configDigest
+          || binding?.baseCommit !== snapshot.originContext.baseline.commit) reject('snapshot-changed');
+        const configSource = snapshot.config.capture.sources.find(source => source.path === binding?.config?.path);
+        if (!configSource || configSource.presence !== 'present'
+          || U.sha(U.bytes(configSource.bytes)) !== binding?.config?.digest) reject('config-capture-mismatch');
+      }
       if (event?.kind === 'review') {
         if (event.verdict !== 'approve' || !U.text(event.summary)) reject('event-invalid');
         const principals = context?.principals;

package/hooks/scripts/lib/doc-reconciliation-pilot.js

@@ -247,6 +247,9 @@ function captureReferences(context) {
     const ordered = index ? candidates.slice(1).concat(candidates.slice(0, 1)) : candidates;
     references.push(...ordered.map(item => `${item.ref}#${capability}`));
   }
+  const provider = require('./doc-reconciliation-provider');
+  references.push(...candidates.filter(item => provider.resolveDocCheckInvocation(item.command, item.cwd).conflictAssessment === true)
+    .map(item => `${item.ref}#conflict-check`));
   // The adapter accepts one event per capability; rotating candidate order lets separate valid runs fill each capability.
   return [...references, ...reviews.map(item => `${item.ref}#quality-review`)];
 }

package/hooks/scripts/lib/doc-reconciliation-provider.js

@@ -46,7 +46,9 @@ const HEX64 = /^[0-9a-f]{64}$/;
 const PRE_CAPTURE_TOOLS = ['Bash', 'PowerShell', 'Task', 'Agent'];
 const STDOUT_CAP_BYTES = 1024 * 1024;
 const DOC_CHECK_FLAGS = new Set(['--workspace', '--config', '--changed-path', '--base']);
+const DOC_CHECK_BOOLEAN_FLAGS = new Set(['--conflict-assessment']);
 const DOC_CHECK_SCHEMA = 'harness.doc-check.check.v1';
+const DOC_CHECK_CONFLICT_SCHEMA = 'harness.doc-check.conflict-assessment.v1';
 const DOC_CHECK_SHELLS = new Set(['sh', 'bash', 'dash', 'zsh', 'ksh', 'fish']);
 const DOC_CHECK_LAUNCHERS = new Set(['node', 'nodejs', 'bun', 'deno', 'tsx', 'ts-node']);
 const DOC_CHECK_LAUNCHER_VALUE_FLAGS = new Set(['-r', '--require', '--import', '--loader', '--experimental-loader', '--inspect-port', '--input-type', '--conditions', '--env-file']);
@@ -65,7 +67,7 @@ function isUncPathPrefix(token, command, index) {
   return token === '' && command[index] === '\\' && command[index + 1] === '\\';
 }
 // Canonical SHA-256 of harness-everything/scripts/doc-check.js (CRLF normalised to LF). Re-pin deliberately when that script changes.
-const SHIPPED_DOC_CHECK_DIGEST = 'da5e51a763eda6680afb63ee781b566253df9d358eec1e65436786c9ecebbbdb';
+const SHIPPED_DOC_CHECK_DIGEST = '1afd94d66b356c94206d2441529ec0b7fafa1bcb453b0f1e2cf6994b1e4858e5';
 // This install's own doc-check runtime, relative to hooks/scripts/lib: the source checkout or the packaged plugin.
 const DOC_CHECK_INSTALL_LAYOUTS = [
   ['..', '..', '..', 'harness-everything', 'scripts', 'doc-check.js'],
@@ -357,10 +359,16 @@ function resolveDocCheckInvocation(command, cwd) {
 
   const values = new Map();
   const changedPaths = [];
-  for (let index = 3; index < tokens.length; index += 2) {
-    const flag = tokens[index];
-    const value = tokens[index + 1];
+  let conflictAssessment = false;
+  for (let index = 3; index < tokens.length;) {
+    const flag = tokens[index++];
+    if (DOC_CHECK_BOOLEAN_FLAGS.has(flag)) {
+      if (conflictAssessment) return rejected('duplicate-flag');
+      conflictAssessment = true;
+      continue;
+    }
     if (!DOC_CHECK_FLAGS.has(flag)) return rejected('unknown-flag');
+    const value = tokens[index++];
     if (value === undefined || !value || value.startsWith('--')) return rejected('flag-value-missing');
     if (flag === '--changed-path') changedPaths.push(value);
     else {
@@ -371,6 +379,8 @@ function resolveDocCheckInvocation(command, cwd) {
   if (!values.has('--workspace') || !values.has('--config') || !changedPaths.length) {
     return rejected('required-flag-missing');
   }
+  if (conflictAssessment && !values.has('--base')) return rejected('conflict-assessment-base-required');
+  if (conflictAssessment && !/^[0-9a-f]{40,64}$/.test(values.get('--base'))) return rejected('conflict-assessment-base-unpinned');
 
   installed = installedDocCheck();
   if (!installed) return rejected('implementation-not-installed');
@@ -382,7 +392,8 @@ function resolveDocCheckInvocation(command, cwd) {
       if (fileDigest(registered.installed) !== SHIPPED_DOC_CHECK_DIGEST) return rejected('implementation-pin-mismatch', 'the installed doc-check is not the shipped script (canonical digest differs from SHIPPED_DOC_CHECK_DIGEST); no credit');
     }
   }
-  return { kind: 'accepted', reason: null, installed: registered.installed, digest, argv };
+  return { kind: 'accepted', reason: null, installed: registered.installed, digest, argv,
+    conflictAssessment, base: values.get('--base') || null, changedPaths };
 }
 
 // Observation-time digests of the checked paths, read from the workspace when the check ran. Absent paths are omitted.
@@ -714,6 +725,9 @@ const createClaudeOriginProvider = input => {
       if (cap.event !== 'PostToolUse') return rejected('capability-mismatch', 'only a PostToolUse check invocation can cover a doc capability');
       const registered = resolveDocCheckInvocation(cap.command, cap.cwd);
       if (registered.kind === 'not-candidate') return rejected('unregistered-command', 'the command is not a registered doc-check invocation; an arbitrary successful shell command never covers a doc capability');
+      if (capability === 'conflict-check' && registered.conflictAssessment !== true) {
+        return rejected('capability-mismatch', 'conflict-check requires the structurally parsed --conflict-assessment mode');
+      }
       if (registered.kind === 'rejected' && registered.reason !== 'implementation-pin-mismatch') {
         if (registered.reason === 'implementation-not-installed') return rejected('implementation-not-installed', 'the registered check does not resolve to this install\'s own doc-check runtime; a different path earns no credit');
         return rejected('unregistered-command', `doc-check invocation rejected (${registered.reason}); no credit`);
@@ -744,11 +758,55 @@ const createClaudeOriginProvider = input => {
       }
       const paths = Array.isArray(projection.checkedPaths) ? projection.checkedPaths.slice() : [];
       if (!paths.length) return rejected('scope-empty', `${capability} checked no governed paths`);
+      let corpusBinding;
+      let baselineArtifactDigests;
+      if (capability === 'conflict-check') {
+        const assessment = report.conflictAssessment;
+        const corpus = assessment && assessment.corpus;
+        const config = corpus && corpus.config;
+        if (registered.conflictAssessment !== true || report.mode !== 'conflict-assessment'
+          || assessment?.schema !== DOC_CHECK_CONFLICT_SCHEMA || assessment.state !== 'pass'
+          || projection.corpus?.complete !== true || corpus?.complete !== true
+          || !Array.isArray(corpus.paths) || !corpus.paths.length || !recordOf(corpus.digests)
+          || !recordOf(config) || !textOf(config.path) || path.isAbsolute(config.path)
+          || config.path.split(/[\\/]/).includes('..') || !HEX64.test(String(config.digest || ''))
+          || !/^[0-9a-f]{40,64}$/.test(String(corpus.baseCommit || ''))
+          || JSON.stringify([...new Set(corpus.paths)].sort(compareKeys)) !== JSON.stringify(corpus.paths)
+          || JSON.stringify(Object.keys(corpus.digests).sort(compareKeys)) !== JSON.stringify(corpus.paths)
+          || corpus.paths.some(relative => !textOf(relative) || path.isAbsolute(relative)
+            || relative.split(/[\\/]/).includes('..') || !HEX64.test(String(corpus.digests[relative] || '')))) {
+          return rejected('corpus-binding-invalid', 'conflict-check stdout does not carry a complete, structured full-corpus assessment');
+        }
+        const observedCorpus = recordOf(cap.observedCorpusDigests) ? cap.observedCorpusDigests : {};
+        if (corpus.paths.some(relative => observedCorpus[relative] !== corpus.digests[relative])) {
+          return rejected('corpus-changed-after-check', 'a full-corpus path is missing or changed between assessment and capture');
+        }
+        if (cap.observedConfigDigest !== config.digest) {
+          return rejected('config-changed-after-check', 'the project-docs config changed between assessment and capture');
+        }
+        if (!recordOf(request.identity) || !HEX64.test(String(request.identity.baselineDigest || ''))
+          || !HEX64.test(String(request.identity.candidateDigest || '')) || !HEX64.test(String(request.identity.configDigest || ''))) {
+          return rejected('identity-missing', 'conflict-check needs the complete snapshot identity');
+        }
+        corpusBinding = {
+          complete: true,
+          paths: corpus.paths.slice(),
+          digests: { ...corpus.digests },
+          config: { ...config },
+          baseCommit: corpus.baseCommit,
+          baselineDigest: request.identity.baselineDigest,
+          candidateDigest: request.identity.candidateDigest,
+          configIdentityDigest: request.identity.configDigest,
+        };
+        baselineArtifactDigests = recordOf(assessment.baselineArtifacts) ? assessment.baselineArtifacts : {};
+      }
       const observed = recordOf(cap.observedDigests) ? cap.observedDigests : {};
       const artifactDigests = {};
+      const baselineArtifacts = {};
       for (const relative of paths) {
-        if (typeof observed[relative] !== 'string') return rejected('artifact-unobserved', `no observation-time digest for ${relative}`);
-        artifactDigests[relative] = observed[relative];
+        if (typeof observed[relative] === 'string') artifactDigests[relative] = observed[relative];
+        else if (capability === 'conflict-check' && HEX64.test(String(baselineArtifactDigests[relative] || ''))) baselineArtifacts[relative] = baselineArtifactDigests[relative];
+        else return rejected('artifact-unobserved', `no observation-time digest for ${relative}`);
       }
       const argv = ['node', ...registered.argv];
       const command = argv.join(' ');
@@ -772,6 +830,8 @@ const createClaudeOriginProvider = input => {
         endIdentity: recordOf(request.identity) ? JSON.parse(JSON.stringify(request.identity)) : null,
         paths,
         artifactDigests,
+        ...(Object.keys(baselineArtifacts).length ? { baselineArtifacts } : {}),
+        ...(corpusBinding ? { corpusBinding } : {}),
         captured: { responseRef: cap.responseRef, responseDigest: cap.responseDigest },
       };
       return { status: 'accepted', originRef, event, correlation: { toolCorrelationId: cap.tool_use_id, resultRef: cap.responseRef } };
@@ -1086,12 +1146,25 @@ function buildCaptureRecord(payload, eventName, workspaceRoot) {
         record.toolResponse = toolResponse;
       } else { record.stdout = null; record.stdoutTruncated = true; }
       let checkedPaths = [];
+      let conflictCorpus = null;
       try {
         const report = JSON.parse(stdout);
         checkedPaths = ['doc-lint', 'link-check'].flatMap(capability => (recordOf(report.capabilities) && recordOf(report.capabilities[capability])
           && Array.isArray(report.capabilities[capability].checkedPaths) ? report.capabilities[capability].checkedPaths : []));
+        const conflict = recordOf(report.capabilities) && report.capabilities['conflict-check'];
+        if (installedCheck.conflictAssessment === true && report.mode === 'conflict-assessment'
+          && recordOf(conflict) && conflict.state === 'pass' && recordOf(conflict.corpus)) {
+          checkedPaths.push(...(Array.isArray(conflict.checkedPaths) ? conflict.checkedPaths : []));
+          conflictCorpus = report.conflictAssessment && report.conflictAssessment.corpus;
+        }
       } catch { /* not JSON: no paths observed, the event will be withheld */ }
       record.observedDigests = typeof workspaceRoot === 'string' && workspaceRoot ? observedDigestsFor(workspaceRoot, [...new Set(checkedPaths)]) : {};
+      if (recordOf(conflictCorpus) && Array.isArray(conflictCorpus.paths) && recordOf(conflictCorpus.config)) {
+        record.observedCorpusDigests = typeof workspaceRoot === 'string' && workspaceRoot
+          ? observedDigestsFor(workspaceRoot, conflictCorpus.paths) : {};
+        record.observedConfigDigest = typeof workspaceRoot === 'string' && workspaceRoot
+          ? observedDigestsFor(workspaceRoot, [conflictCorpus.config.path])[conflictCorpus.config.path] || null : null;
+      }
     }
   } else if (event === 'PostToolUseFailure') {
     record.is_interrupt = Boolean(payload.is_interrupt);

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.44.0",
+  "version": "0.45.0",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.44.0",
+  "version": "0.45.0",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.44.0",
+  "version": "0.45.0",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/hooks/scripts/lib/doc-reconciliation-events.js

@@ -101,6 +101,23 @@ function acceptDocEvents(input = {}, dependencies = {}) {
         // Supplied extra digests must also describe this capture, never another tree.
         for (const p of Object.keys(digests)) if (!artifacts[p] || digests[p] !== artifacts[p].digest) reject('artifact-mismatch');
       }
+      if (event?.capability === 'conflict-check') {
+        const binding = event.corpusBinding;
+        const identity = snapshot.identity;
+        const expectedPaths = U.runtimeModule('doc-lifecycle.js').documentCorpusPaths(
+          snapshot.candidate.records, snapshot.config.resolution.config
+        );
+        if (!U.record(binding) || binding.complete !== true || !Array.isArray(binding.paths)
+          || U.stable(binding.paths) !== U.stable(expectedPaths) || !U.record(binding.digests)
+          || U.stable(Object.keys(binding.digests).sort()) !== U.stable(expectedPaths)
+          || !expectedPaths.every(p => artifacts[p] && binding.digests[p] === artifacts[p].digest)) reject('corpus-mismatch');
+        if (binding?.baselineDigest !== identity.baselineDigest || binding?.candidateDigest !== identity.candidateDigest
+          || binding?.configIdentityDigest !== identity.configDigest
+          || binding?.baseCommit !== snapshot.originContext.baseline.commit) reject('snapshot-changed');
+        const configSource = snapshot.config.capture.sources.find(source => source.path === binding?.config?.path);
+        if (!configSource || configSource.presence !== 'present'
+          || U.sha(U.bytes(configSource.bytes)) !== binding?.config?.digest) reject('config-capture-mismatch');
+      }
       if (event?.kind === 'review') {
         if (event.verdict !== 'approve' || !U.text(event.summary)) reject('event-invalid');
         const principals = context?.principals;

package/plugins/harness-everything/hooks/scripts/lib/doc-reconciliation-pilot.js

@@ -247,6 +247,9 @@ function captureReferences(context) {
     const ordered = index ? candidates.slice(1).concat(candidates.slice(0, 1)) : candidates;
     references.push(...ordered.map(item => `${item.ref}#${capability}`));
   }
+  const provider = require('./doc-reconciliation-provider');
+  references.push(...candidates.filter(item => provider.resolveDocCheckInvocation(item.command, item.cwd).conflictAssessment === true)
+    .map(item => `${item.ref}#conflict-check`));
   // The adapter accepts one event per capability; rotating candidate order lets separate valid runs fill each capability.
   return [...references, ...reviews.map(item => `${item.ref}#quality-review`)];
 }