harness-everything 0.44.0 → 0.46.0

package/plugins/harness-everything/hooks/scripts/state-persist.js

@@ -148,6 +148,16 @@ function persistPilotCapture(payload, eventName, sessionId, root) {
     // Observation-time identity: the workflow and pin in force when the host event was captured.
     const observed = provider.observedIdentityFor(sessionDir);
     if (observed) entry.observedIdentity = observed;
+    if (eventName === 'PreToolUse' && (entry.tool_name === 'Agent' || entry.tool_name === 'Task')) {
+      try {
+        const existing = provider.readCaptureView(sessionDir);
+        entry.outlineDispatch = existing.tampered
+          ? { schema: 'harness.outline-dispatch.v1', state: 'unresolved', reasons: ['capture-view-tampered'] }
+          : provider.captureOutlineDispatch({ payload, capture: entry, sessionDir, workspaceRoot: root, captures: existing.records });
+      } catch {
+        entry.outlineDispatch = { schema: 'harness.outline-dispatch.v1', state: 'unresolved', reasons: ['dispatch-capture-failed'] };
+      }
+    }
     // Each capture is one exclusively created event file; the compatibility journal is rebuilt from them (not tamper-proof).
     provider.writeImmutableEvent(sessionDir, entry);
     provider.rebuildJournalView(sessionDir);

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.44.0",
+  "version": "0.46.0",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/skills/harness-everything/SKILL.md

@@ -4,7 +4,7 @@ description: "Route software/project work through Harness: classify tier/topolog
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.43.0
+  version: 0.46.0
 ---
 
 # Harness Everything

package/plugins/harness-everything/skills/harness-everything/scripts/doc-check.js

@@ -6,14 +6,16 @@
 // Prints one JSON result. Exit 0 = both pass, 1 = defect, 2 = usage/config error.
 const fs = require('fs');
 const path = require('path');
+const crypto = require('crypto');
 const { execFileSync, spawnSync } = require('child_process');
 const { collectDocs } = require('./doc-lifecycle');
 
 // Logical command IDs (A3 section 3): stdout that repeats an ID is not trusted as credit by itself.
 const CHECK_ID = 'harness.doc-check.check.v1';
 const COMPARE_ID = 'harness.doc-check.compare-derived.v1';
-const USAGE = 'usage: doc-check.js check --workspace <dir> --config <json-file, relative to --workspace> --changed-path <path> [--changed-path <path> ...] [--base <git-rev>]';
+const USAGE = 'usage: doc-check.js check --workspace <dir> --config <json-file, relative to --workspace> --changed-path <path> [--changed-path <path> ...] [--base <git-rev>] [--conflict-assessment]';
 const VALUE_FLAGS = ['--workspace', '--config', '--changed-path', '--base'];
+const CONFLICT_SCHEMA = 'harness.doc-check.conflict-assessment.v1';
 const EXTERNAL = /^(?:https?:|mailto:)/i;
 const SCHEME = /^[a-z][a-z0-9+.-]*:/i;
 
@@ -79,10 +81,15 @@ function parseArgs(argv) {
   const [command, ...rest] = argv;
   if (command !== 'check') throw new Error(USAGE);
   const options = { changedPaths: [] };
-  for (let index = 0; index < rest.length; index += 2) {
+  for (let index = 0; index < rest.length; index++) {
     const flag = rest[index];
-    const value = rest[index + 1];
-    if (!VALUE_FLAGS.includes(flag) || value === undefined) throw new Error(`${USAGE}\nunknown or incomplete argument: ${flag}`);
+    if (flag === '--conflict-assessment') {
+      if (options.conflictAssessment) throw new Error(`${USAGE}\nrepeated argument: ${flag}`);
+      options.conflictAssessment = true;
+      continue;
+    }
+    if (!VALUE_FLAGS.includes(flag) || rest[index + 1] === undefined) throw new Error(`${USAGE}\nunknown or incomplete argument: ${flag}`);
+    const value = rest[++index];
     if (value.startsWith('--')) throw new Error(`${USAGE}\n${flag} requires a value, not a flag: ${value}`);
     if (flag === '--changed-path') options.changedPaths.push(value);
     else {
@@ -92,16 +99,47 @@ function parseArgs(argv) {
   }
   if (!options.workspace || !options.config) throw new Error(`${USAGE}\n--workspace and --config are required`);
   if (!options.changedPaths.length) throw new Error(`${USAGE}\n--changed-path is required`);
+  if (options.conflictAssessment && options.base === undefined) throw new Error(`${USAGE}\n--conflict-assessment requires --base`);
   return options;
 }
 
 function runLint(workspace, options) {
   const args = [path.join(__dirname, 'doc-lifecycle.js'), 'lint', '--workspace', workspace, '--config', options.config];
-  for (const changed of options.changedPaths) args.push('--changed-path', changed);
+  if (options.conflictAssessment) args.push('--all');
+  else for (const changed of options.changedPaths) args.push('--changed-path', changed);
   if (options.base !== undefined) args.push('--base', options.base);
   return spawnSync(process.execPath, args, { encoding: 'utf8' });
 }
 
+function workspaceRelative(workspace, value) {
+  const absolute = path.resolve(workspace, value);
+  const relative = path.relative(workspace, absolute);
+  if (!relative || relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) return null;
+  return relative.split(path.sep).join('/');
+}
+
+function resolvedBaseCommit(workspace, base) {
+  if (typeof base !== 'string' || !base || base.startsWith('-')) return null;
+  try {
+    const value = execFileSync('git', ['-C', workspace, 'rev-parse', '--verify', `${base}^{commit}`], {
+      encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore']
+    }).trim();
+    return /^[0-9a-f]{40,64}$/.test(value) ? value : null;
+  } catch { return null; }
+}
+
+function baselineArtifacts(workspace, base, paths) {
+  const artifacts = {};
+  for (const relative of paths) {
+    if (fs.existsSync(path.join(workspace, relative))) continue;
+    try {
+      const bytes = execFileSync('git', ['-C', workspace, 'show', `${base}:${relative}`], { encoding: 'buffer', stdio: ['ignore', 'pipe', 'ignore'] });
+      artifacts[relative] = crypto.createHash('sha256').update(bytes).digest('hex');
+    } catch { /* Paths absent from both snapshots need no baseline artifact. */ }
+  }
+  return artifacts;
+}
+
 // Scan nested label spans depth-first, then resume after each destination. Matching brackets are precomputed per line,
 // and an explicit stack keeps nesting from consuming the JS call stack. A nested link inside a label remains an
 // intentional over-check: CommonMark keeps only the inner link, so both targets are checked and neither is silent.
@@ -340,7 +378,8 @@ function check(options) {
   try { analysis = JSON.parse(lint.stdout); } catch {
     return emit({ schema: CHECK_ID, command: CHECK_ID, lint: { exit: 2, error: 'lint output was not JSON', diagnostics: [] }, links: { checked: 0, broken: [], skipped: 'lint-usage-error' }, coverage: { unsupported: [] } }, 2);
   }
-  const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+  const configBytes = fs.readFileSync(configPath);
+  const config = JSON.parse(configBytes.toString('utf8'));
   const docs = collectDocs(workspace, config);
   const governed = new Set(docs.filter(doc => doc.role).map(doc => doc.path));
 
@@ -408,6 +447,7 @@ function check(options) {
   const result = {
     schema: CHECK_ID,
     command: CHECK_ID,
+    ...(options.conflictAssessment ? { mode: 'conflict-assessment' } : {}),
     lint: { exit: lintExit, evidence: analysis.evidence, diagnostics: analysis.diagnostics },
     links: { checked, broken },
     coverage: { unsupported },
@@ -425,6 +465,44 @@ function check(options) {
       },
     }
   };
+  if (options.conflictAssessment) {
+    const scopePaths = [...new Set(options.changedPaths.map(value => workspaceRelative(workspace, value)).filter(Boolean))].sort();
+    const corpus = analysis.corpus;
+    const baseCommit = resolvedBaseCommit(workspace, options.base);
+    const configRelative = workspaceRelative(workspace, options.config);
+    let reason = null;
+    if (!scopePaths.length || scopePaths.length !== new Set(options.changedPaths.map(value => workspaceRelative(workspace, value))).size) reason = 'scope-unavailable';
+    else if (!Array.isArray(config.domains) || config.domains.length === 0) reason = 'domains-unknown';
+    else if (!corpus || corpus.complete !== true || !Array.isArray(corpus.paths) || !corpus.paths.length) reason = 'corpus-incomplete';
+    else if (!corpus.digests || Object.keys(corpus.digests).length !== corpus.paths.length
+      || corpus.paths.some(relative => !/^[0-9a-f]{64}$/.test(corpus.digests[relative] || ''))) reason = 'corpus-digests-incomplete';
+    else if (!baseCommit) reason = 'base-unavailable';
+    else if (options.base !== baseCommit) reason = 'base-not-pinned';
+    else if (!configRelative) reason = 'config-outside-workspace';
+    else if (!corpus.config || corpus.config.path !== configRelative) reason = 'config-unavailable';
+    else if (corpus.config.digest !== crypto.createHash('sha256').update(configBytes).digest('hex')) reason = 'config-changed-during-check';
+    const hasErrors = lintExit !== 0 || !Array.isArray(analysis.diagnostics)
+      || analysis.diagnostics.some(item => item && item.severity === 'error');
+    const corpusIdentity = corpus && {
+      complete: corpus.complete === true,
+      paths: corpus.paths,
+      digests: corpus.digests,
+      config: corpus.config,
+      baseCommit,
+    };
+    const state = reason ? 'unavailable' : hasErrors ? 'fail' : 'pass';
+    result.conflictAssessment = {
+      schema: CONFLICT_SCHEMA,
+      state,
+      ...(reason ? { reason } : {}),
+      ...(corpusIdentity ? { corpus: corpusIdentity } : {}),
+      ...(state === 'pass' ? { baselineArtifacts: baselineArtifacts(workspace, baseCommit, scopePaths) } : {}),
+    };
+    if (state === 'pass') result.capabilities['conflict-check'] = {
+      state: 'pass', checkedPaths: scopePaths, corpus: corpusIdentity,
+    };
+    return emit(result, state === 'unavailable' ? 2 : lintExit === 1 || broken.length ? 1 : 0);
+  }
   return emit(result, lintExit === 1 || broken.length ? 1 : 0);
 }
 

package/plugins/harness-everything/skills/harness-everything/scripts/doc-evidence.js

@@ -433,6 +433,61 @@ function evaluateObligation(obligation, context) {
     return entry ? baselineBound(item, entry) : candidateBound(item, path);
   };
 
+  if (capability === 'outline-confirmation') {
+    const candidates = matching.filter(item => reviewList.includes(item) && item.kind === 'outline-confirmation');
+    if (candidates.length !== 1) {
+      return result('unresolved', 'none',
+        'outline-confirmation requires one validated pre-draft O/review/handoff/dispatch record and a final D; generic execution and waivers do not qualify',
+        candidates.map(item => item.id));
+    }
+    const item = candidates[0];
+    const evidence = isPlainObject(item.outlineEvidence) ? item.outlineEvidence : null;
+    const sha = value => isSha256(value);
+    const digestsMatch = map => isPlainObject(map)
+      && Object.keys(map).sort(compareText).join('\0') === scopePaths.slice().sort(compareText).join('\0')
+      && scopePaths.every(path => sha(map[path]));
+    const identityValid = Boolean(evidence)
+      && evidence.schema === 'harness.outline-confirmation.v1' && evidence.state === 'validated'
+      && nonEmptyString(evidence.taskId) && nonEmptyString(evidence.attemptId)
+      && /^\d{1,2}$/.test(String(evidence.inventoryRowId || ''))
+      && /^[A-Z][A-Z0-9]{1,9}$/.test(String(evidence.domain || ''))
+      && sha(evidence.inventoryPinDigest) && sha(evidence.inventoryArtifactDigest)
+      && /^[0-9a-f]{40,64}$/.test(String(evidence.baselineCommit || ''))
+      && /^[0-9a-f]{40,64}$/.test(String(evidence.outlineCommit || ''))
+      && /^[0-9a-f]{40,64}$/.test(String(evidence.draftCommit || ''))
+      && /^[0-9a-f]{40,64}$/.test(String(evidence.mergedCommit || ''))
+      && evidence.outlineCommit !== evidence.draftCommit
+      && evidence.ancestry === 'strict-descendant'
+      && sha(evidence.handoffDigest) && sha(evidence.reviewCaptureDigest) && sha(evidence.reviewDigest)
+      && sha(evidence.seamDigest) && sha(evidence.dispatchInputDigest) && sha(evidence.writerLeaseDigest)
+      && nonEmptyString(evidence.dispatchToolUseId) && nonEmptyString(evidence.coordinatorPrincipal)
+      && nonEmptyString(evidence.reviewerPrincipal) && nonEmptyString(evidence.workerPrincipal)
+      && evidence.reviewerPrincipal !== evidence.coordinatorPrincipal
+      && evidence.reviewerPrincipal !== evidence.workerPrincipal
+      && Array.isArray(evidence.targetPaths)
+      && evidence.targetPaths.slice().sort(compareText).join('\0') === scopePaths.slice().sort(compareText).join('\0')
+      && digestsMatch(evidence.outlineArtifactDigests) && digestsMatch(evidence.draftArtifactDigests)
+      && digestsMatch(item.artifactDigests)
+      && scopePaths.every(path => evidence.draftArtifactDigests[path] === item.artifactDigests[path]
+        && candidateBound(item, path));
+    const mergeValid = evidence && (evidence.mergeCorrespondence === null
+      || (isPlainObject(evidence.mergeCorrespondence)
+        && ['accepted', 'changed'].includes(evidence.mergeCorrespondence.state)
+        && Array.isArray(evidence.mergeCorrespondence.targetPaths)
+        && evidence.mergeCorrespondence.targetPaths.slice().sort(compareText).join('\0')
+          === scopePaths.slice().sort(compareText).join('\0')));
+    const outlineProblems = [];
+    if (!identityValid) outlineProblems.push('envelope-or-current-D-binding');
+    if (!mergeValid) outlineProblems.push('merge-correspondence');
+    if (item.baseDigest !== baselineDigest) outlineProblems.push('original-B-digest');
+    if (outlineProblems.length) {
+      diagnostics.push({ code: 'outline-evidence-unresolved', obligationId,
+        message: `the outline evidence is incomplete or inconsistent: ${outlineProblems.join(', ')}` });
+      return result('unresolved', 'none', 'outline evidence is incomplete or unbound to the original B and final D', [item.id]);
+    }
+    return result('observed', 'pass', 'validated independent review of exact O, coordinator handoff, clean one-use dispatch, pinned inventory, and strict O-to-D evidence', [item.id]);
+  }
+
   for (const item of matching) {
     if (executionList.includes(item) && !completeExecution(item)) {
       diagnostics.push({

package/plugins/harness-everything/skills/harness-everything/scripts/doc-lifecycle.js

@@ -265,7 +265,16 @@ function directoryCanContainMatch(relativeDirectory, globs, exactPaths = []) {
     || exactPathCanMatchDescendant(relativeDirectory, exactPaths);
 }
 
-function collectDocs(root, config) {
+function documentCorpusPaths(records, config) {
+  const selectors = [
+    ...(Array.isArray(config && config.governed) ? config.governed.map(entry => entry && entry.path) : []),
+    ...(Array.isArray(config && config.legacy) ? config.legacy : [])
+  ].filter(value => typeof value === 'string');
+  return [...new Set((records || []).filter(item => item && item.presence === 'present' && item.type === 'file'
+    && typeof item.path === 'string' && matchesAny(item.path, selectors)).map(item => item.path))].sort(compareText);
+}
+
+function collectDocs(root, config, coverage = null) {
   const workspace = path.resolve(root);
   const governed = Array.isArray(config && config.governed) ? config.governed : [];
   const legacyGlobs = Array.isArray(config && config.legacy) ? config.legacy : [];
@@ -274,9 +283,14 @@ function collectDocs(root, config) {
     ...legacyGlobs
   ].filter(value => typeof value === 'string');
   const files = [];
+  const skipped = [];
+  const skip = (relative, reason) => skipped.push({ path: relative || '.', reason });
   function walk(directory, relativeDirectory) {
     let entries;
-    try { entries = fs.readdirSync(directory, { withFileTypes: true }); } catch { return; }
+    try { entries = fs.readdirSync(directory, { withFileTypes: true }); } catch {
+      skip(relativeDirectory, 'unreadable-directory');
+      return;
+    }
     entries.sort((a, b) => compareText(a.name, b.name));
     for (const entry of entries) {
       if (entry.name === '.git' || entry.name === 'node_modules') continue;
@@ -285,6 +299,11 @@ function collectDocs(root, config) {
       if (entry.isDirectory()) {
         if (directoryCanContainMatch(relativePath, globs)) walk(absolute, relativePath);
       } else if (entry.isFile() && matchesAny(relativePath, globs)) files.push(absolute);
+      else if (entry.isSymbolicLink() && (matchesAny(relativePath, globs) || directoryCanContainMatch(relativePath, globs))) {
+        skip(relativePath, 'unsupported-symlink');
+      } else if (!entry.isDirectory() && !entry.isFile() && matchesAny(relativePath, globs)) {
+        skip(relativePath, 'unsupported-entry');
+      }
     }
   }
   walk(workspace, '');
@@ -296,9 +315,23 @@ function collectDocs(root, config) {
     const legacy = matchesAny(relativePath, legacyGlobs);
     if (!roleEntry && !legacy) continue;
     let bytes;
-    try { bytes = fs.readFileSync(absolute); } catch { continue; }
+    try { bytes = fs.readFileSync(absolute); } catch {
+      skip(relativePath, 'unreadable-file');
+      continue;
+    }
     selected.push({ relativePath, role: roleEntry ? roleEntry.role : null, legacy, bytes });
   }
+  for (const selector of globs.filter(value => !/[*?\[\]{}]/.test(value))) {
+    if (!files.includes(path.resolve(workspace, selector))) skip(selector, 'missing-configured-path');
+  }
+  if (coverage) {
+    coverage.complete = globs.length > 0 && skipped.length === 0;
+    coverage.skipped = skipped;
+    coverage.paths = selected.map(item => item.relativePath).sort(compareText);
+    coverage.digests = Object.fromEntries(selected
+      .sort((a, b) => compareText(a.relativePath, b.relativePath))
+      .map(item => [item.relativePath, crypto.createHash('sha256').update(item.bytes).digest('hex')]));
+  }
   const rules = readWorkingTreeRules(workspace, selected.filter(item => item.bytes.includes(0x0d)).map(item => item.relativePath));
   const docs = [];
   for (const item of selected) {
@@ -2664,7 +2697,11 @@ function main(argv = process.argv.slice(2)) {
     ? path.resolve(options.configFile)
     : path.resolve(workspacePath, options.configFile);
   let config;
-  try { config = JSON.parse(fs.readFileSync(configPath, 'utf8')); } catch (error) {
+  let configBytes;
+  try {
+    configBytes = fs.readFileSync(configPath);
+    config = JSON.parse(configBytes.toString('utf8'));
+  } catch (error) {
     process.stderr.write(`cannot read config: ${error.message}\n`);
     return 2;
   }
@@ -2672,7 +2709,14 @@ function main(argv = process.argv.slice(2)) {
     process.stderr.write(`${error.message}\n`);
     return 2;
   }
-  const docs = collectDocs(workspacePath, config);
+  const corpus = options.all ? { complete: false, skipped: [], paths: [], digests: {} } : null;
+  const docs = collectDocs(workspacePath, config, corpus);
+  if (corpus) {
+    const relativeConfig = path.relative(workspacePath, configPath);
+    corpus.config = relativeConfig && relativeConfig !== '..' && !relativeConfig.startsWith(`..${path.sep}`)
+      ? { path: relativeConfig.split(path.sep).join('/'), digest: crypto.createHash('sha256').update(configBytes).digest('hex') }
+      : null;
+  }
   const mode = {
     ...(options.all ? { all: true } : { changedPaths: options.changedPaths }),
     workspace: workspacePath, base: options.base, configPath,
@@ -2688,10 +2732,11 @@ function main(argv = process.argv.slice(2)) {
     }));
     return 0;
   }
+  if (corpus) analysis.corpus = corpus;
   process.stdout.write(`${JSON.stringify(analysis, null, 2)}\n`);
   return analysis.diagnostics.some(item => item.severity === 'error') ? 1 : 0;
 }
 
-module.exports = { readGitBaseInventory, scanWorkspaceFiles, parseFrontmatter, parseRequirementBlocks, collectDocs, analyzeDocs, resolveRef, lintDocs, buildIndex, diffRevisions, buildGitDocumentInventory };
+module.exports = { readGitBaseInventory, scanWorkspaceFiles, parseFrontmatter, parseRequirementBlocks, collectDocs, documentCorpusPaths, analyzeDocs, resolveRef, lintDocs, buildIndex, diffRevisions, buildGitDocumentInventory };
 
 if (require.main === module) process.exitCode = main();

package/sbom.cdx.json

@@ -2,23 +2,23 @@
   "$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.7",
-  "serialNumber": "urn:uuid:062d938e-8477-5564-9f89-fa21e9121182",
+  "serialNumber": "urn:uuid:4e82c3bc-ded1-5f78-8aa6-6dd26488f41f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-27T10:11:43.769Z",
+    "timestamp": "2026-10-28T00:05:02.172Z",
     "tools": [
       {
         "vendor": "Harness Everything",
         "name": "generate-sbom.js",
-        "version": "0.44.0"
+        "version": "0.46.0"
       }
     ],
     "component": {
       "type": "application",
-      "bom-ref": "pkg:npm/harness-everything@0.44.0",
+      "bom-ref": "pkg:npm/harness-everything@0.46.0",
       "name": "harness-everything",
-      "version": "0.44.0",
-      "purl": "pkg:npm/harness-everything@0.44.0"
+      "version": "0.46.0",
+      "purl": "pkg:npm/harness-everything@0.46.0"
     }
   },
   "components": [
@@ -2033,7 +2033,7 @@
       ]
     },
     {
-      "ref": "pkg:npm/harness-everything@0.44.0",
+      "ref": "pkg:npm/harness-everything@0.46.0",
       "dependsOn": [
         "pkg:npm/%40commitlint/cli@19.8.1",
         "pkg:npm/%40commitlint/config-conventional@19.8.1",