harness-everything 0.45.0 → 0.46.0

package/plugins/harness-everything/hooks/scripts/state-persist.js

@@ -148,6 +148,16 @@ function persistPilotCapture(payload, eventName, sessionId, root) {
     // Observation-time identity: the workflow and pin in force when the host event was captured.
     const observed = provider.observedIdentityFor(sessionDir);
     if (observed) entry.observedIdentity = observed;
+    if (eventName === 'PreToolUse' && (entry.tool_name === 'Agent' || entry.tool_name === 'Task')) {
+      try {
+        const existing = provider.readCaptureView(sessionDir);
+        entry.outlineDispatch = existing.tampered
+          ? { schema: 'harness.outline-dispatch.v1', state: 'unresolved', reasons: ['capture-view-tampered'] }
+          : provider.captureOutlineDispatch({ payload, capture: entry, sessionDir, workspaceRoot: root, captures: existing.records });
+      } catch {
+        entry.outlineDispatch = { schema: 'harness.outline-dispatch.v1', state: 'unresolved', reasons: ['dispatch-capture-failed'] };
+      }
+    }
     // Each capture is one exclusively created event file; the compatibility journal is rebuilt from them (not tamper-proof).
     provider.writeImmutableEvent(sessionDir, entry);
     provider.rebuildJournalView(sessionDir);

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.45.0",
+  "version": "0.46.0",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/skills/harness-everything/SKILL.md

@@ -4,7 +4,7 @@ description: "Route software/project work through Harness: classify tier/topolog
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.45.0
+  version: 0.46.0
 ---
 
 # Harness Everything

package/plugins/harness-everything/skills/harness-everything/scripts/doc-evidence.js

@@ -433,6 +433,61 @@ function evaluateObligation(obligation, context) {
     return entry ? baselineBound(item, entry) : candidateBound(item, path);
   };
 
+  if (capability === 'outline-confirmation') {
+    const candidates = matching.filter(item => reviewList.includes(item) && item.kind === 'outline-confirmation');
+    if (candidates.length !== 1) {
+      return result('unresolved', 'none',
+        'outline-confirmation requires one validated pre-draft O/review/handoff/dispatch record and a final D; generic execution and waivers do not qualify',
+        candidates.map(item => item.id));
+    }
+    const item = candidates[0];
+    const evidence = isPlainObject(item.outlineEvidence) ? item.outlineEvidence : null;
+    const sha = value => isSha256(value);
+    const digestsMatch = map => isPlainObject(map)
+      && Object.keys(map).sort(compareText).join('\0') === scopePaths.slice().sort(compareText).join('\0')
+      && scopePaths.every(path => sha(map[path]));
+    const identityValid = Boolean(evidence)
+      && evidence.schema === 'harness.outline-confirmation.v1' && evidence.state === 'validated'
+      && nonEmptyString(evidence.taskId) && nonEmptyString(evidence.attemptId)
+      && /^\d{1,2}$/.test(String(evidence.inventoryRowId || ''))
+      && /^[A-Z][A-Z0-9]{1,9}$/.test(String(evidence.domain || ''))
+      && sha(evidence.inventoryPinDigest) && sha(evidence.inventoryArtifactDigest)
+      && /^[0-9a-f]{40,64}$/.test(String(evidence.baselineCommit || ''))
+      && /^[0-9a-f]{40,64}$/.test(String(evidence.outlineCommit || ''))
+      && /^[0-9a-f]{40,64}$/.test(String(evidence.draftCommit || ''))
+      && /^[0-9a-f]{40,64}$/.test(String(evidence.mergedCommit || ''))
+      && evidence.outlineCommit !== evidence.draftCommit
+      && evidence.ancestry === 'strict-descendant'
+      && sha(evidence.handoffDigest) && sha(evidence.reviewCaptureDigest) && sha(evidence.reviewDigest)
+      && sha(evidence.seamDigest) && sha(evidence.dispatchInputDigest) && sha(evidence.writerLeaseDigest)
+      && nonEmptyString(evidence.dispatchToolUseId) && nonEmptyString(evidence.coordinatorPrincipal)
+      && nonEmptyString(evidence.reviewerPrincipal) && nonEmptyString(evidence.workerPrincipal)
+      && evidence.reviewerPrincipal !== evidence.coordinatorPrincipal
+      && evidence.reviewerPrincipal !== evidence.workerPrincipal
+      && Array.isArray(evidence.targetPaths)
+      && evidence.targetPaths.slice().sort(compareText).join('\0') === scopePaths.slice().sort(compareText).join('\0')
+      && digestsMatch(evidence.outlineArtifactDigests) && digestsMatch(evidence.draftArtifactDigests)
+      && digestsMatch(item.artifactDigests)
+      && scopePaths.every(path => evidence.draftArtifactDigests[path] === item.artifactDigests[path]
+        && candidateBound(item, path));
+    const mergeValid = evidence && (evidence.mergeCorrespondence === null
+      || (isPlainObject(evidence.mergeCorrespondence)
+        && ['accepted', 'changed'].includes(evidence.mergeCorrespondence.state)
+        && Array.isArray(evidence.mergeCorrespondence.targetPaths)
+        && evidence.mergeCorrespondence.targetPaths.slice().sort(compareText).join('\0')
+          === scopePaths.slice().sort(compareText).join('\0')));
+    const outlineProblems = [];
+    if (!identityValid) outlineProblems.push('envelope-or-current-D-binding');
+    if (!mergeValid) outlineProblems.push('merge-correspondence');
+    if (item.baseDigest !== baselineDigest) outlineProblems.push('original-B-digest');
+    if (outlineProblems.length) {
+      diagnostics.push({ code: 'outline-evidence-unresolved', obligationId,
+        message: `the outline evidence is incomplete or inconsistent: ${outlineProblems.join(', ')}` });
+      return result('unresolved', 'none', 'outline evidence is incomplete or unbound to the original B and final D', [item.id]);
+    }
+    return result('observed', 'pass', 'validated independent review of exact O, coordinator handoff, clean one-use dispatch, pinned inventory, and strict O-to-D evidence', [item.id]);
+  }
+
   for (const item of matching) {
     if (executionList.includes(item) && !completeExecution(item)) {
       diagnostics.push({

package/sbom.cdx.json

@@ -2,23 +2,23 @@
   "$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.7",
-  "serialNumber": "urn:uuid:16eef945-b68a-5405-9f2c-9d18949bad33",
+  "serialNumber": "urn:uuid:4e82c3bc-ded1-5f78-8aa6-6dd26488f41f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-27T11:52:14.799Z",
+    "timestamp": "2026-10-28T00:05:02.172Z",
     "tools": [
       {
         "vendor": "Harness Everything",
         "name": "generate-sbom.js",
-        "version": "0.45.0"
+        "version": "0.46.0"
       }
     ],
     "component": {
       "type": "application",
-      "bom-ref": "pkg:npm/harness-everything@0.45.0",
+      "bom-ref": "pkg:npm/harness-everything@0.46.0",
       "name": "harness-everything",
-      "version": "0.45.0",
-      "purl": "pkg:npm/harness-everything@0.45.0"
+      "version": "0.46.0",
+      "purl": "pkg:npm/harness-everything@0.46.0"
     }
   },
   "components": [
@@ -2033,7 +2033,7 @@
       ]
     },
     {
-      "ref": "pkg:npm/harness-everything@0.45.0",
+      "ref": "pkg:npm/harness-everything@0.46.0",
       "dependsOn": [
         "pkg:npm/%40commitlint/cli@19.8.1",
         "pkg:npm/%40commitlint/config-conventional@19.8.1",