harness-everything 0.46.1 → 0.46.3

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.46.1",
+      "version": "0.46.3",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.46.1",
+  "version": "0.46.3",
   "author": {
     "name": "Miya Daniel"
   },

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.46.3](https://github.com/dyphn1/Harness-everything/compare/v0.46.2...v0.46.3) (2026-10-28)
+
+### Bug Fixes
+
+* **doc-reconciliation:** clear outline reviewers that stopped before dispatch ([d62bdb8](https://github.com/dyphn1/Harness-everything/commit/d62bdb870523e39a19f63a117557794c21387e3c))
+* **doc-reconciliation:** require a unique reviewer start before clearing it ([99527f6](https://github.com/dyphn1/Harness-everything/commit/99527f6df6729ae8a5db331fc39bed5359797f17))
+
+## [0.46.2](https://github.com/dyphn1/Harness-everything/compare/v0.46.1...v0.46.2) (2026-10-28)
+
+### Bug Fixes
+
+* **doc-reconciliation:** pin the outline task binding at plan/start ([5823c48](https://github.com/dyphn1/Harness-everything/commit/5823c4881ccd6647c1af58e8d295f878e4f1020e))
+
 ## [0.46.1](https://github.com/dyphn1/Harness-everything/compare/v0.46.0...v0.46.1) (2026-10-28)
 
 ### Bug Fixes

package/ci/mechanism-prb-outline-review.test.js

@@ -770,6 +770,46 @@ test('pilot exposes a real-capture-only outline reference resolver', () => {
   assert.deepStrictEqual(resolve([], 'task-prb'), [], 'hand-authored JSON with no host capture creates no event ref');
 });
 
+test('shipped route + plan/start CLI pins the outline task binding in canonical and packaged layouts', () => {
+  // Live run 2026-10-28: the pilot's module lookup missed workflow-obligations, so no task pin was ever written.
+  for (const [layout, base] of [['canonical', ROOT], ['packaged', path.join(ROOT, 'plugins/harness-everything')]]) {
+    const root = canonical(fs.mkdtempSync(path.join(os.tmpdir(), 'prb-task-pin-')));
+    const stateHome = fs.mkdtempSync(path.join(os.tmpdir(), 'prb-task-pin-state-'));
+    try {
+      fixtureGit(root, ['init', '-q']);
+      fs.writeFileSync(path.join(root, 'README.md'), 'B\n');
+      fixtureGit(root, ['add', '-A']);
+      fixtureGit(root, ['commit', '-q', '-m', 'B baseline']);
+      const sessionId = `task-pin-${layout}`;
+      const env = { ...process.env, HARNESS_STATE_HOME: stateHome, HARNESS_WORKSPACE_ROOT: root, HARNESS_DOC_RECONCILIATION_PILOT: '1' };
+      const kernel = layout === 'canonical' ? path.join(base, 'harness-everything/scripts/kernel-router.js')
+        : path.join(base, 'skills/harness-everything/scripts/kernel-router.js');
+      const run = (script, args, input) => {
+        const child = spawnSync(process.execPath, [script, ...args], { cwd: root, env, encoding: 'utf8', input });
+        assert.strictEqual(child.status, 0, `${layout} ${path.basename(script)} ${args[0] || ''}: ${child.stderr || child.stdout}`);
+      };
+      run(kernel, [], JSON.stringify({ session_id: sessionId, cwd: root, prompt: 'Draft an ADR from the reviewed outline and verify it' }));
+      const controller = path.join(base, 'hooks/scripts/workflow-disposition.js');
+      run(controller, ['plan', '--session-id', sessionId, '--strategy', 'iterative-single', '--evidence', 'task pin fixture',
+        '--requirements-json', JSON.stringify([
+          { id: 'adr', stepType: 'doc-change', summary: 'draft ADR', acceptance: 'outline review precedes drafting' },
+          { id: 'verify', stepType: 'verification', summary: 'verify', acceptance: 'checker runs' }])]);
+      run(controller, ['start', '--session-id', sessionId]);
+      const prior = process.env.HARNESS_STATE_HOME;
+      process.env.HARNESS_STATE_HOME = stateHome;
+      let sessionDir;
+      try { sessionDir = require(path.join(ROOT, 'hooks/scripts/lib/harness-state.js')).getSessionDir(root, sessionId); }
+      finally { if (prior === undefined) delete process.env.HARNESS_STATE_HOME; else process.env.HARNESS_STATE_HOME = prior; }
+      const workflow = JSON.parse(fs.readFileSync(path.join(sessionDir, 'workflow-run.json'), 'utf8'));
+      assert.ok(workflow.docReconciliationBaseline, `${layout}: baseline pin is captured`);
+      assert.strictEqual(workflow.docReconciliationTask?.taskId, 'task-adr+verify', `${layout}: task pin is captured at plan/start`);
+    } finally {
+      fs.rmSync(root, { recursive: true, force: true });
+      fs.rmSync(stateHome, { recursive: true, force: true });
+    }
+  }
+});
+
 test('pre-dispatch seam requires review, exact worker root, clean O tree, lease, pin, and immutable handoff', () => {
   assert.strictEqual(typeof internals.captureOutlineDispatch, 'function', 'missing synchronous pre-dispatch seam');
   const differentWorkerRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'prb-outline-different-worker-'));
@@ -871,6 +911,46 @@ test('outline evidence binds exact task, B, O blobs, independent review, worker
       'a delayed write/edit callback from the coordinator remains visible and blocks ambiguous writer history');
   } finally { delayedWriter.cleanup(); }
 
+  // Live run 2026-10-28: a non-isolated reviewer starts in O; only a stop journaled before the dispatch clears it.
+  const reviewerStart = fixture => provider.buildCaptureRecord({ session_id: fixture.sessionId, cwd: fixture.root,
+    hook_event_name: 'SubagentStart', agent_id: 'outline-reviewer', agent_type: 'reviewer' }, 'SubagentStart', fixture.root);
+  const stoppedReviewer = createOutlineFixture();
+  try {
+    stoppedReviewer.reviewCaptures.unshift(reviewerStart(stoppedReviewer));
+    const completed = stoppedReviewer.finishDraft();
+    assert.strictEqual(completed.result.status, 'accepted',
+      `a reviewer that started and stopped in O before the dispatch is not a competing writer: ${JSON.stringify(completed.result)}`);
+  } finally { stoppedReviewer.cleanup(); }
+  for (const [name, arrange] of [
+    ['reviewer stop after the dispatch', fixture => {
+      const stop = fixture.reviewCaptures.findIndex(item => item.event === 'SubagentStop');
+      fixture.extraCaptures.push(...fixture.reviewCaptures.splice(stop, 1));
+      fixture.reviewCaptures.unshift(reviewerStart(fixture));
+    }],
+    ['reviewer start without a stop', fixture => {
+      fixture.reviewCaptures.unshift(provider.buildCaptureRecord({ session_id: fixture.sessionId, cwd: fixture.root,
+        hook_event_name: 'SubagentStart', agent_id: 'other-agent', agent_type: 'reviewer' }, 'SubagentStart', fixture.root));
+    }],
+    ['reviewer start after its stop', fixture => { fixture.reviewCaptures.push(reviewerStart(fixture)); }],
+    ['duplicate reviewer start with one stop before the dispatch', fixture => {
+      fixture.reviewCaptures.unshift(reviewerStart(fixture), reviewerStart(fixture));
+    }],
+    ['reviewer start with duplicate stops before the dispatch', fixture => {
+      const stop = fixture.reviewCaptures.find(item => item.event === 'SubagentStop');
+      fixture.reviewCaptures.unshift(reviewerStart(fixture));
+      fixture.reviewCaptures.push({ ...stop, ref: `${stop.ref}:dup`, captureId: `${stop.captureId}:dup` });
+    }],
+    ['reviewer start after the dispatch', fixture => { fixture.extraCaptures.push(reviewerStart(fixture)); }],
+  ]) {
+    const fixture = createOutlineFixture();
+    try {
+      arrange(fixture);
+      const completed = fixture.finishDraft();
+      assert.ok(completed.result.diagnostics?.some(item => item.code === 'outline-competing-writer-start'),
+        `${name} stays a competing writer start: ${JSON.stringify(completed.result)}`);
+    } finally { fixture.cleanup(); }
+  }
+
   const unqualified = createOutlineFixture();
   try {
     const completed = unqualified.finishDraft();

package/docs/doc-workflow-reconciliation.md

@@ -1256,6 +1256,6 @@ flowchart LR
 | Worker and D | The dispatch key is `(session_id, tool_use_id)`. Exactly one matching Task/Agent result must carry `tool_response.status === 'completed'`; its observed `tool_response.agentId` must map to exactly one `SubagentStart` and one `SubagentStop` with the same `session_id` and `agent_id`. Require PreToolUse < SubagentStart < SubagentStop in journal order, but do not order the completed result against Stop. Both worker events need exact canonical `cwd === workerRoot`. `prompt_id` and `parent_tool_use_id` are not correlation keys; `interrupted` is not completion proof. Async launches, failures, cancellation, missing/duplicate events, replayed IDs, worktree isolation and root mismatch stay unresolved. D is checked against the current candidate separately from O. O must be a strict ancestor of D. A squash may retain the cycle only when a coordinator correspondence record proves identical target blobs between retained pre-merge D and the merged tree; changed bytes need fresh final quality review. |
 | Checker outcome | `outline-confirmation` has its own pass/unresolved lane. Generic command success and waivers never satisfy it. No D is incomplete/unresolved. Its result is separate from the aggregate result over every MUST derived from original B→D; an outline pass never waives lint, conflict, quality review, requirement-sync or other MUSTs. |
 
-Capture and validation failures stay fail-open to host tools and withhold evidence credit. Unclassified shell commands and writes outside the correlated worker/root remain unresolved. Retries use a fresh attempt, token, clean worktree and immutable handoff; only one non-superseded leaf is current. An identical same-tool-ID/input callback may reuse its stored seam, but repeated PreToolUse records remain ambiguous for evidence credit; changed input or token reuse is unresolved. OpenCode and Codex remain unsupported for positive outline credit.
+Capture and validation failures stay fail-open to host tools and withhold evidence credit. Unclassified shell commands and writes outside the correlated worker/root remain unresolved. Any other subagent start in the worker root rejects the outline as a competing writer, unless that start and its unique stop are both journaled before the dispatch PreToolUse (for example, a non-isolated outline reviewer). Retries use a fresh attempt, token, clean worktree and immutable handoff; only one non-superseded leaf is current. An identical same-tool-ID/input callback may reuse its stored seam, but repeated PreToolUse records remain ambiguous for evidence credit; changed input or token reuse is unresolved. OpenCode and Codex remain unsupported for positive outline credit.
 
 The current retained Claude qualification does not establish the versioned `claude-outline-dispatch-mapping/2` contract. The outline provider therefore grants no positive live-host credit until a retained Claude capture validates the prompt, coordinator, result status/agent ID, explicit non-background boundary, isolation absence and exact worker-root mapping. Deterministic fixtures exercise the real hook/provider/adapter/checker/pilot path with a synthetic inventory pin; they are mechanism evidence, not live-host behavior or E1 readiness.

package/hooks/scripts/lib/doc-reconciliation-pilot.js

@@ -45,7 +45,8 @@ function captureBaseline(context) {
     }
     if (!context.workflow.docReconciliationTask) {
       const plan = context.workflow.pendingPlan || context.workflow.workflowPlan;
-      const loaded = plan && runtimeModule('workflow-obligations').loadObligationSet(context, plan);
+      // workflow-obligations is a hook-lib sibling in every layout, not a skill runtime script.
+      const loaded = plan && require('./workflow-obligations').loadObligationSet(context, plan);
       const requirementIds = loaded?.set?.requirements?.map(item => item.id);
       if (Array.isArray(requirementIds) && requirementIds.length && requirementIds.every(id => typeof id === 'string' && id)) {
         const baseline = context.workflow.docReconciliationBaseline;

package/hooks/scripts/lib/doc-reconciliation-provider.js

@@ -1452,8 +1452,24 @@ function resolveOutlineEvidence({ safeInput, capture, captures, request, originR
     if (review.reviewerPrincipal === worker.agent_id) return fail('outline-reviewer-is-draft-worker');
     const principals = { author: safeInput.sessionId, executors: journalExecutors(captures, safeInput.sessionId) };
     if (!reviewRecordIndependent(review.review, captures, principals)) return fail('outline-review-not-independent');
-    const competingStarts = (Array.isArray(captures) ? captures : []).filter(item => recordOf(item)
-      && item.event === 'SubagentStart' && item.ref !== worker.ref && sameCanonicalPath(item.cwd, workerRoot));
+    // An agent whose start and unique stop both precede the dispatch cannot write after the seam; earlier writes
+    // are covered by the clean-O seam check and by unattributedWriters below.
+    const journal = Array.isArray(captures) ? captures : [];
+    const dispatchIndex = journal.indexOf(correlation.pre);
+    const stoppedBeforeDispatch = start => {
+      const lifecycle = event => journal.filter(item => recordOf(item) && item.event === event
+        && item.session_id === start.session_id && textOf(start.agent_id) && item.agent_id === start.agent_id);
+      // Exactly one Start and one Stop per (session_id, agent_id); a duplicate either way stays ambiguous.
+      const starts = lifecycle('SubagentStart');
+      const stops = lifecycle('SubagentStop');
+      if (starts.length !== 1 || starts[0] !== start || stops.length !== 1) return false;
+      const startIndex = journal.indexOf(start);
+      const stopIndex = journal.indexOf(stops[0]);
+      return dispatchIndex >= 0 && startIndex >= 0 && startIndex < stopIndex && stopIndex < dispatchIndex;
+    };
+    const competingStarts = journal.filter(item => recordOf(item)
+      && item.event === 'SubagentStart' && item.ref !== worker.ref && sameCanonicalPath(item.cwd, workerRoot)
+      && !stoppedBeforeDispatch(item));
     if (competingStarts.length) return fail('outline-competing-writer-start');
     const unattributedWriters = (Array.isArray(captures) ? captures : []).filter(item => possibleWriterCapture(item)
       && (item.agent_id !== worker.agent_id || !sameCanonicalPath(item.cwd, workerRoot)));

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.46.1",
+  "version": "0.46.3",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.46.1",
+  "version": "0.46.3",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.46.1",
+  "version": "0.46.3",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/hooks/scripts/lib/doc-reconciliation-pilot.js

@@ -45,7 +45,8 @@ function captureBaseline(context) {
     }
     if (!context.workflow.docReconciliationTask) {
       const plan = context.workflow.pendingPlan || context.workflow.workflowPlan;
-      const loaded = plan && runtimeModule('workflow-obligations').loadObligationSet(context, plan);
+      // workflow-obligations is a hook-lib sibling in every layout, not a skill runtime script.
+      const loaded = plan && require('./workflow-obligations').loadObligationSet(context, plan);
       const requirementIds = loaded?.set?.requirements?.map(item => item.id);
       if (Array.isArray(requirementIds) && requirementIds.length && requirementIds.every(id => typeof id === 'string' && id)) {
         const baseline = context.workflow.docReconciliationBaseline;

package/plugins/harness-everything/hooks/scripts/lib/doc-reconciliation-provider.js

@@ -1452,8 +1452,24 @@ function resolveOutlineEvidence({ safeInput, capture, captures, request, originR
     if (review.reviewerPrincipal === worker.agent_id) return fail('outline-reviewer-is-draft-worker');
     const principals = { author: safeInput.sessionId, executors: journalExecutors(captures, safeInput.sessionId) };
     if (!reviewRecordIndependent(review.review, captures, principals)) return fail('outline-review-not-independent');
-    const competingStarts = (Array.isArray(captures) ? captures : []).filter(item => recordOf(item)
-      && item.event === 'SubagentStart' && item.ref !== worker.ref && sameCanonicalPath(item.cwd, workerRoot));
+    // An agent whose start and unique stop both precede the dispatch cannot write after the seam; earlier writes
+    // are covered by the clean-O seam check and by unattributedWriters below.
+    const journal = Array.isArray(captures) ? captures : [];
+    const dispatchIndex = journal.indexOf(correlation.pre);
+    const stoppedBeforeDispatch = start => {
+      const lifecycle = event => journal.filter(item => recordOf(item) && item.event === event
+        && item.session_id === start.session_id && textOf(start.agent_id) && item.agent_id === start.agent_id);
+      // Exactly one Start and one Stop per (session_id, agent_id); a duplicate either way stays ambiguous.
+      const starts = lifecycle('SubagentStart');
+      const stops = lifecycle('SubagentStop');
+      if (starts.length !== 1 || starts[0] !== start || stops.length !== 1) return false;
+      const startIndex = journal.indexOf(start);
+      const stopIndex = journal.indexOf(stops[0]);
+      return dispatchIndex >= 0 && startIndex >= 0 && startIndex < stopIndex && stopIndex < dispatchIndex;
+    };
+    const competingStarts = journal.filter(item => recordOf(item)
+      && item.event === 'SubagentStart' && item.ref !== worker.ref && sameCanonicalPath(item.cwd, workerRoot)
+      && !stoppedBeforeDispatch(item));
     if (competingStarts.length) return fail('outline-competing-writer-start');
     const unattributedWriters = (Array.isArray(captures) ? captures : []).filter(item => possibleWriterCapture(item)
       && (item.agent_id !== worker.agent_id || !sameCanonicalPath(item.cwd, workerRoot)));

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.46.1",
+  "version": "0.46.3",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/sbom.cdx.json

@@ -2,23 +2,23 @@
   "$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.7",
-  "serialNumber": "urn:uuid:e14b39ac-6cf4-5711-b0c8-03de1649a568",
+  "serialNumber": "urn:uuid:194f592d-6226-519c-a5b8-9f6750fb3c19",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-28T02:23:43.789Z",
+    "timestamp": "2026-10-28T05:22:07.321Z",
     "tools": [
       {
         "vendor": "Harness Everything",
         "name": "generate-sbom.js",
-        "version": "0.46.1"
+        "version": "0.46.3"
       }
     ],
     "component": {
       "type": "application",
-      "bom-ref": "pkg:npm/harness-everything@0.46.1",
+      "bom-ref": "pkg:npm/harness-everything@0.46.3",
       "name": "harness-everything",
-      "version": "0.46.1",
-      "purl": "pkg:npm/harness-everything@0.46.1"
+      "version": "0.46.3",
+      "purl": "pkg:npm/harness-everything@0.46.3"
     }
   },
   "components": [
@@ -2033,7 +2033,7 @@
       ]
     },
     {
-      "ref": "pkg:npm/harness-everything@0.46.1",
+      "ref": "pkg:npm/harness-everything@0.46.3",
       "dependsOn": [
         "pkg:npm/%40commitlint/cli@19.8.1",
         "pkg:npm/%40commitlint/config-conventional@19.8.1",