harness-everything 0.46.2 → 0.47.0

package/plugins/harness-everything/hooks/scripts/lib/doc-reconciliation-provider.js

@@ -47,7 +47,7 @@ const QUALIFICATION_EXPORT_SCHEMA = 'harness.doc-reconciliation.qualification.v1
 const HEX64 = /^[0-9a-f]{64}$/;
 const PRE_CAPTURE_TOOLS = ['Bash', 'PowerShell', 'Task', 'Agent', 'Write', 'Edit', 'apply_patch'];
 const STDOUT_CAP_BYTES = 1024 * 1024;
-const DOC_CHECK_FLAGS = new Set(['--workspace', '--config', '--changed-path', '--base']);
+const DOC_CHECK_FLAGS = new Set(['--workspace', '--config', '--changed-path', '--base', '--derived-view']);
 const DOC_CHECK_BOOLEAN_FLAGS = new Set(['--conflict-assessment']);
 const DOC_CHECK_SCHEMA = 'harness.doc-check.check.v1';
 const DOC_CHECK_CONFLICT_SCHEMA = 'harness.doc-check.conflict-assessment.v1';
@@ -76,6 +76,8 @@ const OUTLINE_INVENTORY_PIN = Object.freeze({
   runId: 'e1-inv-1',
   inputSha: '0ef0541c6cae550e8269ba712e03797e0e987dfb',
   approvalRef: { issue: 325, commentId: '6436207729', decision: 1 },
+  rowDomainMappings: Object.freeze([Object.freeze({ rowIds: Object.freeze(['15', '16', '17', '18']),
+    sourceDomain: 'VERI', domain: 'EVID', approvalRef: '../e1-feasibility-2026-10-28/owner-decision-veri-evid.md' })]),
   retainedArtifactPath: `inventory/${OUTLINE_INVENTORY_SHA256}.md`,
 });
 const OUTLINE_MARKER = 'HARNESS_OUTLINE_DISPATCH_V1';
@@ -99,7 +101,7 @@ function isUncPathPrefix(token, command, index) {
   return token === '' && command[index] === '\\' && command[index + 1] === '\\';
 }
 // Canonical SHA-256 of harness-everything/scripts/doc-check.js (CRLF normalised to LF). Re-pin deliberately when that script changes.
-const SHIPPED_DOC_CHECK_DIGEST = '1afd94d66b356c94206d2441529ec0b7fafa1bcb453b0f1e2cf6994b1e4858e5';
+const SHIPPED_DOC_CHECK_DIGEST = '804a093b31afde07ea6ec40e39fc758b501966bfa2a15c53a5275ad3171b0755';
 // This install's own doc-check runtime, relative to hooks/scripts/lib: the source checkout or the packaged plugin.
 const DOC_CHECK_INSTALL_LAYOUTS = [
   ['..', '..', '..', 'harness-everything', 'scripts', 'doc-check.js'],
@@ -405,6 +407,8 @@ function resolveDocCheckInvocation(command, cwd) {
     if (flag === '--changed-path') changedPaths.push(value);
     else {
       if (values.has(flag)) return rejected('duplicate-flag');
+      if (flag === '--derived-view' && (path.isAbsolute(value) || /^[A-Za-z]:[\\/]/.test(value)
+        || value.split(/[\\/]/).includes('..') || /[*?\[\]{}]/.test(value))) return rejected('derived-view-invalid');
       values.set(flag, value);
     }
   }
@@ -425,7 +429,8 @@ function resolveDocCheckInvocation(command, cwd) {
     }
   }
   return { kind: 'accepted', reason: null, installed: registered.installed, digest, argv,
-    conflictAssessment, base: values.get('--base') || null, changedPaths };
+    conflictAssessment, base: values.get('--base') || null, config: values.get('--config'),
+    derivedView: values.get('--derived-view') || null, changedPaths };
 }
 
 // Observation-time digests of the checked paths, read from the workspace when the check ran. Absent paths are omitted.
@@ -439,6 +444,29 @@ function observedDigestsFor(root, paths) {
   return digests;
 }
 
+function observedConfigSourcesFor(root, sources) {
+  if (!Array.isArray(sources)) return [];
+  return sources.map(source => {
+    const relative = source && source.path;
+    if (typeof relative !== 'string' || !relative || path.isAbsolute(relative) || relative.split(/[\\/]/).includes('..')) {
+      return { path: String(relative || ''), presence: 'unsupported' };
+    }
+    const file = path.resolve(root, relative);
+    const within = path.relative(path.resolve(root), file);
+    if (!within || within === '..' || within.startsWith(`..${path.sep}`) || path.isAbsolute(within)) {
+      return { path: relative, presence: 'unsupported' };
+    }
+    try {
+      if (!fs.lstatSync(file).isFile()) return { path: relative, presence: 'unsupported' };
+      return { path: relative, presence: 'present', digest: crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex') };
+    } catch (error) {
+      return error.code === 'ENOENT' || error.code === 'ENOTDIR'
+        ? { path: relative, presence: 'missing' }
+        : { path: relative, presence: 'unreadable' };
+    }
+  });
+}
+
 function textOf(value) { return typeof value === 'string' && value.trim().length > 0; }
 function recordOf(value) { return value !== null && typeof value === 'object' && !Array.isArray(value); }
 function compareKeys(a, b) { return a < b ? -1 : a > b ? 1 : 0; }
@@ -695,7 +723,7 @@ function parseInventoryPinRows(bytes) {
 
 function validateOutlineInventoryPin({ bytes, pin, expectedPin = OUTLINE_INVENTORY_PIN } = {}) {
   if (!Buffer.isBuffer(bytes) || !recordOf(pin) || !recordOf(expectedPin)) return { state: 'unresolved', reason: 'inventory-unavailable' };
-  const fields = ['source', 'sha256', 'runId', 'inputSha', 'approvalRef', 'retainedArtifactPath'];
+  const fields = ['source', 'sha256', 'runId', 'inputSha', 'approvalRef', 'rowDomainMappings', 'retainedArtifactPath'];
   const actualPin = Object.fromEntries(fields.map(field => [field, pin[field]]));
   const trustedPin = Object.fromEntries(fields.map(field => [field, expectedPin[field]]));
   if (captureJson(actualPin) !== captureJson(trustedPin)) return { state: 'unresolved', reason: 'inventory-pin-mismatch' };
@@ -716,10 +744,18 @@ function resolveInventoryRow(inventory, rowId) {
   if (!parsed || parsed.state !== 'parsed' || !textOf(rowId)) return { state: 'unresolved', reason: 'inventory-row-missing' };
   const matches = [...parsed.rows.entries()].filter(([id]) => id === rowId);
   const domains = parsed.domains.get(rowId) || [];
-  if (matches.length !== 1 || matches[0][1] !== 1 || domains.length !== 1) {
+  if (matches.length !== 1 || matches[0][1] !== 1) {
     return { state: 'unresolved', reason: 'inventory-row-ambiguous' };
   }
-  return { state: 'accepted', row: { rowId, domain: domains[0] } };
+  const mappings = (Array.isArray(inventory.pin?.rowDomainMappings) ? inventory.pin.rowDomainMappings : [])
+    .filter(item => recordOf(item) && Array.isArray(item.rowIds) && item.rowIds.includes(rowId));
+  if (mappings.length > 1) return { state: 'unresolved', reason: 'inventory-row-ambiguous' };
+  const mapping = mappings[0];
+  if (mapping && (!domains.includes(mapping.sourceDomain) || !textOf(mapping.domain) || !textOf(mapping.approvalRef))) {
+    return { state: 'unresolved', reason: 'inventory-row-mapping-invalid' };
+  }
+  if (!mapping && domains.length !== 1) return { state: 'unresolved', reason: 'inventory-row-ambiguous' };
+  return { state: 'accepted', row: { rowId, domain: mapping ? mapping.domain : domains[0] } };
 }
 
 function hasSubstantiveDecision(text) {
@@ -1165,11 +1201,20 @@ function validateOutlineCaptureQualification(input, expectedHost = HOST_ID) {
     const qualificationError = validateQualificationExport(expectedHost);
     if (qualificationError) return { open: false, reason: qualificationError };
     const exported = JSON.parse(fs.readFileSync(path.join(__dirname, EXPORT_FILE), 'utf8'));
-    const mapping = exported.outlineDispatchCapture;
-    const source = exported.sanitizedCapture;
-    const records = fs.readFileSync(path.join(__dirname, source.file), 'utf8').split(/\r?\n/).filter(Boolean).map(line => JSON.parse(line));
-    if (!outlineCaptureMappingValid(mapping, records)) return { open: false, reason: 'outline-live-capture-unqualified' };
-    return { open: true, source: 'validated-export', captureFile: source.file };
+    const wrapper = exported.outlineDispatchCapture;
+    if (!recordOf(wrapper) || !textOf(wrapper.hostVersion) || !textOf(wrapper.run) || !textOf(wrapper.baseline)
+      || !textOf(wrapper.file) || /[\\/]/.test(wrapper.file) || wrapper.file.includes('..')) {
+      return { open: false, reason: 'outline-live-capture-unqualified' };
+    }
+    const bytes = fs.readFileSync(path.join(__dirname, wrapper.file));
+    if (crypto.createHash('sha256').update(bytes).digest('hex') !== wrapper.sha256) {
+      return { open: false, reason: 'outline-live-capture-unqualified' };
+    }
+    const records = bytes.toString('utf8').split(/\r?\n/).filter(line => line.trim()).map(line => JSON.parse(line));
+    if (!records.every(recordOf) || !outlineCaptureMappingValid(wrapper.mapping, records)) {
+      return { open: false, reason: 'outline-live-capture-unqualified' };
+    }
+    return { open: true, source: 'validated-export', captureFile: wrapper.file };
   } catch (error) {
     return { open: false, reason: `outline-live-capture-unqualified:${error.code || 'invalid'}` };
   }
@@ -1452,8 +1497,35 @@ function resolveOutlineEvidence({ safeInput, capture, captures, request, originR
     if (review.reviewerPrincipal === worker.agent_id) return fail('outline-reviewer-is-draft-worker');
     const principals = { author: safeInput.sessionId, executors: journalExecutors(captures, safeInput.sessionId) };
     if (!reviewRecordIndependent(review.review, captures, principals)) return fail('outline-review-not-independent');
-    const competingStarts = (Array.isArray(captures) ? captures : []).filter(item => recordOf(item)
-      && item.event === 'SubagentStart' && item.ref !== worker.ref && sameCanonicalPath(item.cwd, workerRoot));
+    // An agent whose start and unique stop both precede the dispatch cannot write after the seam; earlier writes
+    // are covered by the clean-O seam check and by unattributedWriters below.
+    const journal = Array.isArray(captures) ? captures : [];
+    const dispatchIndex = journal.indexOf(correlation.pre);
+    const uniqueLifecycle = start => {
+      if (!textOf(start.session_id) || !textOf(start.agent_id)) return null;
+      const lifecycle = event => journal.filter(item => recordOf(item) && item.event === event
+        && item.session_id === start.session_id && textOf(start.agent_id) && item.agent_id === start.agent_id);
+      // Exactly one Start and one Stop per (session_id, agent_id); a duplicate either way stays ambiguous.
+      const starts = lifecycle('SubagentStart');
+      const stops = lifecycle('SubagentStop');
+      if (starts.length !== 1 || starts[0] !== start || stops.length !== 1) return null;
+      const startIndex = journal.indexOf(start);
+      const stopIndex = journal.indexOf(stops[0]);
+      if (startIndex < 0 || stopIndex <= startIndex) return null;
+      return { startIndex, stopIndex };
+    };
+    const stoppedBeforeDispatch = start => {
+      const lifecycle = uniqueLifecycle(start);
+      return Boolean(lifecycle && dispatchIndex >= 0 && lifecycle.stopIndex < dispatchIndex);
+    };
+    const startedAfterWorkerStop = start => {
+      const lifecycle = uniqueLifecycle(start);
+      const workerStopIndex = journal.indexOf(correlation.stop);
+      return Boolean(lifecycle && workerStopIndex >= 0 && lifecycle.startIndex > workerStopIndex);
+    };
+    const competingStarts = journal.filter(item => recordOf(item)
+      && item.event === 'SubagentStart' && item.ref !== worker.ref && sameCanonicalPath(item.cwd, workerRoot)
+      && !stoppedBeforeDispatch(item) && !startedAfterWorkerStop(item));
     if (competingStarts.length) return fail('outline-competing-writer-start');
     const unattributedWriters = (Array.isArray(captures) ? captures : []).filter(item => possibleWriterCapture(item)
       && (item.agent_id !== worker.agent_id || !sameCanonicalPath(item.cwd, workerRoot)));
@@ -1709,6 +1781,92 @@ const createClaudeOriginProvider = input => {
       if (!paths.length) return rejected('scope-empty', `${capability} checked no governed paths`);
       let corpusBinding;
       let baselineArtifactDigests;
+      let derivedBinding;
+      if (capability === 'derived-regenerate') {
+        if (!registered.derivedView || paths.length !== 1 || paths[0] !== registered.derivedView) {
+          return rejected('capability-mismatch', 'derived-regenerate requires the exact registered --derived-view path');
+        }
+        const binding = projection.binding;
+        const corpus = binding && binding.sourceCorpus;
+        const config = binding && binding.config;
+        const generator = binding && binding.generator;
+        const generation = binding && binding.generation;
+        const comparison = binding && binding.comparison;
+        if (!recordOf(binding) || binding.view !== registered.derivedView || !recordOf(corpus) || corpus.complete !== true
+          || !Array.isArray(corpus.paths) || !corpus.paths.length || !recordOf(corpus.digests)
+          || JSON.stringify([...new Set(corpus.paths)].sort(compareKeys)) !== JSON.stringify(corpus.paths)
+          || JSON.stringify(Object.keys(corpus.digests).sort(compareKeys)) !== JSON.stringify(corpus.paths)
+          || corpus.paths.some(relative => !textOf(relative) || path.isAbsolute(relative) || relative.split(/[\\/]/).includes('..')
+            || !HEX64.test(String(corpus.digests[relative] || '')))
+          || !recordOf(config) || !textOf(config.path) || path.isAbsolute(config.path)
+          || config.path.split(/[\\/]/).includes('..') || !HEX64.test(String(config.digest || ''))
+          || !Array.isArray(config.sources) || !recordOf(generator) || !textOf(generator.path)
+          || !HEX64.test(String(generator.digest || '')) || !recordOf(generation) || generation.state !== 'pass'
+          || !HEX64.test(String(generation.outputDigest || '')) || !recordOf(comparison) || comparison.state !== 'equal'
+          || comparison.targetDigest !== generation.outputDigest) {
+          return rejected('derived-binding-invalid', 'derived-regenerate stdout lacks complete generation, comparison, and input binding');
+        }
+        const configPath = path.resolve(cap.cwd, registered.config);
+        const configRelative = path.relative(path.resolve(cap.cwd), configPath).split(path.sep).join('/');
+        const observedDerived = recordOf(cap.observedDerivedDigests) ? cap.observedDerivedDigests : {};
+        if (configRelative !== config.path || observedDerived[config.path] !== config.digest
+          || observedDerived[registered.derivedView] !== comparison.targetDigest) {
+          return rejected('derived-input-changed-after-check', 'the selected config or derived target changed before host capture');
+        }
+        const expectedObservedPaths = [...new Set([...corpus.paths, config.path, registered.derivedView])].sort(compareKeys);
+        if (JSON.stringify(Object.keys(observedDerived).sort(compareKeys)) !== JSON.stringify(expectedObservedPaths)
+          || corpus.paths.some(relative => observedDerived[relative] !== corpus.digests[relative])) {
+          return rejected('derived-input-changed-after-check', 'a source path is missing or changed before host capture');
+        }
+        const configSources = config.sources;
+        if (JSON.stringify(configSources.map(item => item && item.path)) !== JSON.stringify([...new Set(configSources.map(item => item && item.path))].sort(compareKeys))
+          || configSources.some(item => !recordOf(item) || !textOf(item.path) || path.isAbsolute(item.path)
+            || item.path.split(/[\\/]/).includes('..') || !['present', 'missing'].includes(item.presence)
+            || (item.presence === 'present' ? !HEX64.test(String(item.digest || '')) : item.digest !== undefined))) {
+          return rejected('derived-config-binding-invalid', 'derived-regenerate config source inventory is malformed');
+        }
+        const observedConfigSources = cap.observedDerivedConfigSources;
+        if (!Array.isArray(observedConfigSources) || JSON.stringify(observedConfigSources) !== JSON.stringify(configSources)) {
+          return rejected('config-changed-after-check', 'a config source changed between check and host capture');
+        }
+        const configSource = configSources.find(item => item.path === config.path);
+        if (!configSource || configSource.presence !== 'present' || configSource.digest !== config.digest) {
+          return rejected('derived-config-binding-invalid', 'the selected config is absent from the observed config inventory');
+        }
+        let configData;
+        try { configData = JSON.parse(fs.readFileSync(configPath, 'utf8')); }
+        catch { return rejected('derived-config-binding-invalid', 'the selected config cannot be read during assessment'); }
+        const selectedViews = Array.isArray(configData.derived) ? configData.derived.filter(item => item && item.path === registered.derivedView) : [];
+        const expectedGenerator = `node harness-everything/scripts/doc-lifecycle.js index --workspace . --config ${registered.config} --all`;
+        if (selectedViews.length !== 1 || selectedViews[0].generator !== expectedGenerator) {
+          return rejected('derived-generator-unsupported', 'the selected config does not declare the supported lifecycle index operation');
+        }
+        let generatorPath;
+        try { generatorPath = fs.realpathSync(path.join(path.dirname(registered.installed), 'doc-lifecycle.js')); }
+        catch { return rejected('derived-generator-unavailable', 'the installed lifecycle index generator is missing'); }
+        if (generator.path !== generatorPath || fileDigest(generatorPath) !== generator.digest) {
+          return rejected('derived-generator-mismatch', 'the lifecycle generator differs from the implementation observed in stdout');
+        }
+        let currentConfigSources;
+        try {
+          const lifecycle = require(generatorPath);
+          currentConfigSources = lifecycle.configSourceInventory(cap.cwd, configPath);
+        } catch { return rejected('derived-config-binding-invalid', 'the lifecycle config inventory is unavailable'); }
+        if (!currentConfigSources || currentConfigSources.complete !== true
+          || JSON.stringify(currentConfigSources.sources) !== JSON.stringify(configSources)) {
+          return rejected('config-changed-after-check', 'the lifecycle config source inventory changed after the check');
+        }
+        if (!recordOf(request.identity) || !HEX64.test(String(request.identity.baselineDigest || ''))
+          || !HEX64.test(String(request.identity.candidateDigest || '')) || !HEX64.test(String(request.identity.configDigest || ''))) {
+          return rejected('identity-missing', 'derived-regenerate needs the complete snapshot identity');
+        }
+        derivedBinding = {
+          ...binding,
+          baselineDigest: request.identity.baselineDigest,
+          candidateDigest: request.identity.candidateDigest,
+          configIdentityDigest: request.identity.configDigest,
+        };
+      }
       if (capability === 'conflict-check') {
         const assessment = report.conflictAssessment;
         const corpus = assessment && assessment.corpus;
@@ -1781,6 +1939,7 @@ const createClaudeOriginProvider = input => {
         artifactDigests,
         ...(Object.keys(baselineArtifacts).length ? { baselineArtifacts } : {}),
         ...(corpusBinding ? { corpusBinding } : {}),
+        ...(derivedBinding ? { derivedBinding } : {}),
         captured: { responseRef: cap.responseRef, responseDigest: cap.responseDigest },
       };
       return { status: 'accepted', originRef, event, correlation: { toolCorrelationId: cap.tool_use_id, resultRef: cap.responseRef } };
@@ -2115,6 +2274,16 @@ function buildCaptureRecord(payload, eventName, workspaceRoot) {
         const report = JSON.parse(stdout);
         checkedPaths = ['doc-lint', 'link-check'].flatMap(capability => (recordOf(report.capabilities) && recordOf(report.capabilities[capability])
           && Array.isArray(report.capabilities[capability].checkedPaths) ? report.capabilities[capability].checkedPaths : []));
+        const derived = recordOf(report.capabilities) && report.capabilities['derived-regenerate'];
+        const derivedBinding = recordOf(derived) && recordOf(derived.binding) ? derived.binding : null;
+        if (installedCheck.derivedView && typeof workspaceRoot === 'string' && workspaceRoot && derivedBinding && derivedBinding.view === installedCheck.derivedView
+          && recordOf(derivedBinding.sourceCorpus) && Array.isArray(derivedBinding.sourceCorpus.paths)
+          && recordOf(derivedBinding.config) && Array.isArray(derivedBinding.config.sources)) {
+          checkedPaths.push(derivedBinding.view);
+          record.observedDerivedDigests = observedDigestsFor(workspaceRoot,
+            [...derivedBinding.sourceCorpus.paths, derivedBinding.config.path, derivedBinding.view]);
+          record.observedDerivedConfigSources = observedConfigSourcesFor(workspaceRoot, derivedBinding.config.sources);
+        }
         const conflict = recordOf(report.capabilities) && report.capabilities['conflict-check'];
         if (installedCheck.conflictAssessment === true && report.mode === 'conflict-assessment'
           && recordOf(conflict) && conflict.state === 'pass' && recordOf(conflict.corpus)) {

package/plugins/harness-everything/hooks/scripts/lib/doc-reconciliation-qualification.json

@@ -30,5 +30,25 @@
   "sanitizedCapture": {
     "file": "doc-reconciliation-capture.sanitized.jsonl",
     "sha256": "db4d8c85d2ba0fd06f53f455f31b125dd194e9a22cb337687bc0e295a16f02e5"
+  },
+  "outlineDispatchCapture": {
+    "mapping": {
+      "version": "claude-outline-dispatch-mapping/2",
+      "promptField": "tool_input.prompt",
+      "dispatchKey": "session_id+tool_use_id",
+      "runInBackgroundField": "tool_input.run_in_background",
+      "isolationPresenceField": "tool_input.isolation",
+      "resultAgentIdField": "tool_response.agentId",
+      "resultStatusField": "tool_response.status",
+      "workerStartEvent": "SubagentStart",
+      "workerStopEvent": "SubagentStop",
+      "workerIdentity": "session_id+agent_id",
+      "workerRootField": "cwd"
+    },
+    "file": "doc-reconciliation-outline-capture.sanitized.jsonl",
+    "sha256": "6feb440af12aaf878a0bed5cb750f29e27d271a9add93001e151746980230b7f",
+    "hostVersion": "2.1.312",
+    "run": "run8",
+    "baseline": "1bd0f805031c5577a6e7f72a9bc5b41618b71fc1"
   }
 }

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.46.2",
+  "version": "0.47.0",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/skills/harness-everything/SKILL.md

@@ -4,7 +4,7 @@ description: "Route software/project work through Harness: classify tier/topolog
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.46.0
+  version: 0.47.0
 ---
 
 # Harness Everything

package/plugins/harness-everything/skills/harness-everything/scripts/doc-check.js

@@ -8,13 +8,14 @@ const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
 const { execFileSync, spawnSync } = require('child_process');
-const { collectDocs } = require('./doc-lifecycle');
+const { isDeepStrictEqual } = require('node:util');
+const { collectDocs, buildIndexSnapshot } = require('./doc-lifecycle');
 
 // Logical command IDs (A3 section 3): stdout that repeats an ID is not trusted as credit by itself.
 const CHECK_ID = 'harness.doc-check.check.v1';
 const COMPARE_ID = 'harness.doc-check.compare-derived.v1';
-const USAGE = 'usage: doc-check.js check --workspace <dir> --config <json-file, relative to --workspace> --changed-path <path> [--changed-path <path> ...] [--base <git-rev>] [--conflict-assessment]';
-const VALUE_FLAGS = ['--workspace', '--config', '--changed-path', '--base'];
+const USAGE = 'usage: doc-check.js check --workspace <dir> --config <json-file, relative to --workspace> --changed-path <path> [--changed-path <path> ...] [--base <git-rev>] [--derived-view <path>] [--conflict-assessment]';
+const VALUE_FLAGS = ['--workspace', '--config', '--changed-path', '--base', '--derived-view'];
 const CONFLICT_SCHEMA = 'harness.doc-check.conflict-assessment.v1';
 const EXTERNAL = /^(?:https?:|mailto:)/i;
 const SCHEME = /^[a-z][a-z0-9+.-]*:/i;
@@ -91,10 +92,11 @@ function parseArgs(argv) {
     if (!VALUE_FLAGS.includes(flag) || rest[index + 1] === undefined) throw new Error(`${USAGE}\nunknown or incomplete argument: ${flag}`);
     const value = rest[++index];
     if (value.startsWith('--')) throw new Error(`${USAGE}\n${flag} requires a value, not a flag: ${value}`);
-    if (flag === '--changed-path') options.changedPaths.push(value);
+      if (flag === '--changed-path') options.changedPaths.push(value);
     else {
-      if (options[flag.slice(2)] !== undefined) throw new Error(`${USAGE}\nrepeated argument: ${flag}`);
-      options[flag.slice(2)] = value;
+        const key = flag === '--derived-view' ? 'derivedView' : flag.slice(2);
+        if (options[key] !== undefined) throw new Error(`${USAGE}\nrepeated argument: ${flag}`);
+        options[key] = value;
     }
   }
   if (!options.workspace || !options.config) throw new Error(`${USAGE}\n--workspace and --config are required`);
@@ -310,7 +312,7 @@ function compareDerived(argv) {
 }
 
 const GLOB_CHARS = /[*?[\]{}]/;
-const VIEW_REASON = 'derived view not verified: run its authorized generator, then compare-derived';
+const VIEW_REASON = 'derived view not verified: request check --derived-view to regenerate and compare it';
 
 // Near-miss comparison only (separators, leading ./, trailing /, case); never used to accept a view.
 function normalizeView(value) {
@@ -366,6 +368,97 @@ function derivedCoverage(config, { workspace, configRelative, configChanged, aff
   return entries;
 }
 
+function digest(bytes) { return crypto.createHash('sha256').update(bytes).digest('hex'); }
+
+function derivedRegenerate(workspace, options, config, configBytes) {
+  const view = options.derivedView;
+  const unavailable = reason => ({ state: 'unavailable', checkedPaths: [view], reason });
+  if (typeof view !== 'string' || !view || path.isAbsolute(view) || view.includes('\\')
+    || view.split('/').some(part => !part || part === '.' || part === '..') || GLOB_CHARS.test(view)) {
+    return { state: 'unsupported', checkedPaths: [], reason: 'view must be a literal workspace-relative path' };
+  }
+  const configRelative = workspaceRelative(workspace, options.config);
+  if (!configRelative || path.isAbsolute(options.config) || options.config.includes('\\')
+    || !/^[A-Za-z0-9._/-]+$/.test(options.config)
+    || options.config.split('/').some(part => !part || part === '.' || part === '..')) {
+    return { state: 'unsupported', checkedPaths: [view], reason: 'config must be a canonical workspace-relative path' };
+  }
+  const selected = (Array.isArray(config.derived) ? config.derived : []).filter(item => item && item.path === view);
+  if (selected.length !== 1) return { state: 'unsupported', checkedPaths: [view], reason: 'view must name exactly one declared derived path' };
+  const governedPatterns = [
+    ...(Array.isArray(config.governed) ? config.governed.map(item => item && item.path) : []),
+    ...(Array.isArray(config.legacy) ? config.legacy : [])
+  ].filter(item => typeof item === 'string');
+  if (governedPatterns.some(pattern => globToRegExp(pattern).test(view))) {
+    return { state: 'unsupported', checkedPaths: [view], reason: 'a derived view cannot be governed by its own index' };
+  }
+  const expectedGenerator = `node harness-everything/scripts/doc-lifecycle.js index --workspace . --config ${options.config} --all`;
+  if (selected[0].generator !== expectedGenerator) {
+    return { state: 'unsupported', checkedPaths: [view], reason: 'configured generator is not the supported lifecycle index operation' };
+  }
+
+  const target = path.resolve(workspace, view);
+  const generatorPath = path.resolve(__dirname, 'doc-lifecycle.js');
+  const rootReal = fs.realpathSync(workspace);
+  const targetBytes = () => {
+    const stat = fs.lstatSync(target);
+    if (!stat.isFile()) throw new Error('view is not a regular file');
+    const real = fs.realpathSync(target);
+    const relative = path.relative(rootReal, real);
+    if (!relative || relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+      throw new Error('view resolves outside the workspace');
+    }
+    return readRegularFile(target);
+  };
+
+  try {
+    const configPath = path.resolve(workspace, options.config);
+    const configReal = fs.realpathSync(configPath);
+    const configPathRelative = path.relative(rootReal, configReal);
+    if (!configPathRelative || configPathRelative === '..' || configPathRelative.startsWith(`..${path.sep}`)
+      || !fs.lstatSync(configPath).isFile()) return { state: 'unsupported', checkedPaths: [view], reason: 'config is not a workspace-contained regular file' };
+    const beforeTarget = targetBytes();
+    const generatorDigest = digest(fs.readFileSync(generatorPath, 'utf8').replace(/\r\n/g, '\n'));
+    const first = buildIndexSnapshot(workspace, configPath, config, configBytes);
+    const currentConfigBytes = fs.readFileSync(configPath);
+    const currentConfig = JSON.parse(currentConfigBytes.toString('utf8'));
+    const second = buildIndexSnapshot(workspace, configPath, currentConfig, currentConfigBytes);
+    const afterTarget = targetBytes();
+    const currentGeneratorDigest = digest(fs.readFileSync(generatorPath, 'utf8').replace(/\r\n/g, '\n'));
+    const outputDigest = digest(first.bytes);
+    const targetDigest = digest(beforeTarget);
+    const stable = digest(configBytes) === digest(currentConfigBytes)
+      && first.corpus.complete === true && second.corpus.complete === true
+      && first.configInventory.complete === true && second.configInventory.complete === true
+      && isDeepStrictEqual(first.corpus.paths, second.corpus.paths)
+      && isDeepStrictEqual(first.corpus.digests, second.corpus.digests)
+      && isDeepStrictEqual(first.configInventory.sources, second.configInventory.sources)
+      && isDeepStrictEqual(first.configSources, second.configSources)
+      && Buffer.compare(first.bytes, second.bytes) === 0
+      && generatorDigest === currentGeneratorDigest
+      && digest(afterTarget) === targetDigest;
+    const equal = Buffer.compare(first.bytes, beforeTarget) === 0;
+    const comparisonState = stable ? (equal ? 'equal' : 'stale') : 'unavailable';
+    const binding = {
+      view,
+      sourceCorpus: { complete: first.corpus.complete === true, paths: first.corpus.paths, digests: first.corpus.digests },
+      config: { path: configRelative, digest: digest(configBytes), sources: first.configInventory.sources },
+      generator: { path: fs.realpathSync(generatorPath), digest: generatorDigest },
+      generation: { state: 'pass', outputDigest },
+      comparison: { state: comparisonState, targetDigest },
+    };
+    return {
+      state: stable && equal ? 'pass' : stable ? 'stale' : 'unavailable',
+      checkedPaths: [view],
+      ...(stable ? {} : { reason: 'source, config, generator, or target changed during the check' }),
+      ...(!stable && !first.corpus.complete ? { reason: 'source corpus is incomplete' } : {}),
+      binding,
+    };
+  } catch (error) {
+    return unavailable(error.message || 'generation or comparison unavailable');
+  }
+}
+
 function check(options) {
   const workspace = path.resolve(options.workspace);
   const configPath = path.resolve(workspace, options.config);
@@ -422,7 +515,7 @@ function check(options) {
   // SHOULD reminders only: they never change the exit code and are never diagnostics.
   const changed = new Set(options.changedPaths.map(value => path.relative(workspace, path.resolve(workspace, value)).split(path.sep).join('/')));
   // F3 applicability (conservative): a governed or legacy source, an unknown or deleted path, a derived output or the config
-  // itself marks every declared view unverified. check still never runs a generator.
+  // itself marks every declared view unverified until the explicit derived-view mode is selected.
   const configRelative = path.relative(workspace, configPath).split(path.sep).join('/');
   const declaredViews = [...new Set((Array.isArray(config.derived) ? config.derived : []).map(entry => entry.path))];
   const affectsViews = [...changed].some(item => {
@@ -465,6 +558,11 @@ function check(options) {
       },
     }
   };
+  if (options.derivedView) {
+    const derived = derivedRegenerate(workspace, options, config, configBytes);
+    result.capabilities['derived-regenerate'] = derived;
+    if (derived.state === 'pass') result.coverage.unsupported = result.coverage.unsupported.filter(item => item.path !== options.derivedView || item.state !== 'unverified');
+  }
   if (options.conflictAssessment) {
     const scopePaths = [...new Set(options.changedPaths.map(value => workspaceRelative(workspace, value)).filter(Boolean))].sort();
     const corpus = analysis.corpus;

package/plugins/harness-everything/skills/harness-everything/scripts/doc-lifecycle.js

@@ -1839,6 +1839,24 @@ function readWorkspaceConfigSources(root, explicitConfigPath, fallbackConfig) {
   return sources.length ? sources : [fallbackConfig];
 }
 
+function configSourceInventory(root, explicitConfigPath) {
+  const sources = [];
+  let complete = true;
+  for (const relativePath of [...configPathsForWorkspace(root, explicitConfigPath)].sort(compareText)) {
+    const file = path.join(root, ...relativePath.split('/'));
+    try {
+      const stat = fs.lstatSync(file);
+      if (!stat.isFile()) { sources.push({ path: relativePath, presence: 'unsupported' }); complete = false; continue; }
+      const bytes = fs.readFileSync(file);
+      sources.push({ path: relativePath, presence: 'present', digest: crypto.createHash('sha256').update(bytes).digest('hex') });
+    } catch (error) {
+      if (error.code === 'ENOENT' || error.code === 'ENOTDIR') sources.push({ path: relativePath, presence: 'missing' });
+      else { sources.push({ path: relativePath, presence: 'unreadable' }); complete = false; }
+    }
+  }
+  return { complete, sources };
+}
+
 function readGitBaseInventory(root, baseRef, config, explicitConfigPath = null) {
   if (!root || typeof baseRef !== 'string' || !baseRef.trim()) return { available: false, inventory: [], files: [] };
   try {
@@ -2602,6 +2620,27 @@ function buildIndex(docs, config, options = {}) {
   return `${lines.join('\n').replace(/\n+$/, '')}\n`;
 }
 
+function buildIndexSnapshot(workspace, configPath, config, configBytes, options = {}) {
+  const root = path.resolve(workspace);
+  const corpus = { complete: false, skipped: [], paths: [], digests: {} };
+  const docs = collectDocs(root, config, corpus);
+  const relativeConfig = path.relative(root, configPath);
+  corpus.config = relativeConfig && relativeConfig !== '..' && !relativeConfig.startsWith(`..${path.sep}`)
+    ? { path: relativeConfig.split(path.sep).join('/'), digest: crypto.createHash('sha256').update(configBytes).digest('hex') }
+    : null;
+  const configSources = readWorkspaceConfigSources(root, configPath, config);
+  const configInventory = configSourceInventory(root, configPath);
+  const mode = { all: true, workspace: root, base: options.base, configPath, configSources };
+  const analysis = analyzeDocs(docs, config, mode);
+  const bytes = Buffer.from(buildIndex(docs, config, {
+    ...mode,
+    diagnostics: analysis.diagnostics,
+    _graph: analysis._graph,
+    _retirementEligibleSources: analysis._retirementEligibleSources
+  }), 'utf8');
+  return { bytes, corpus, configSources, configInventory };
+}
+
 function parseCli(argv) {
   const [command, ...rest] = argv;
   const options = { command, changedProvided: false, changedPaths: [], proposedUntracked: [], all: false };
@@ -2709,6 +2748,15 @@ function main(argv = process.argv.slice(2)) {
     process.stderr.write(`${error.message}\n`);
     return 2;
   }
+  if (options.command === 'index' && options.all) {
+    try {
+      process.stdout.write(buildIndexSnapshot(workspacePath, configPath, config, configBytes, options).bytes);
+      return 0;
+    } catch (error) {
+      process.stderr.write(`index generation failed: ${error.message}\n`);
+      return 2;
+    }
+  }
   const corpus = options.all ? { complete: false, skipped: [], paths: [], digests: {} } : null;
   const docs = collectDocs(workspacePath, config, corpus);
   if (corpus) {
@@ -2737,6 +2785,6 @@ function main(argv = process.argv.slice(2)) {
   return analysis.diagnostics.some(item => item.severity === 'error') ? 1 : 0;
 }
 
-module.exports = { readGitBaseInventory, scanWorkspaceFiles, parseFrontmatter, parseRequirementBlocks, collectDocs, documentCorpusPaths, analyzeDocs, resolveRef, lintDocs, buildIndex, diffRevisions, buildGitDocumentInventory };
+module.exports = { readGitBaseInventory, scanWorkspaceFiles, parseFrontmatter, parseRequirementBlocks, collectDocs, documentCorpusPaths, analyzeDocs, resolveRef, lintDocs, buildIndex, buildIndexSnapshot, configSourceInventory, diffRevisions, buildGitDocumentInventory };
 
 if (require.main === module) process.exitCode = main();

package/sbom.cdx.json

@@ -2,23 +2,23 @@
   "$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.7",
-  "serialNumber": "urn:uuid:8b8908cf-420b-56c4-87b3-31c2359222df",
+  "serialNumber": "urn:uuid:76fc9d39-b249-59ad-bcf8-de01347662b8",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-28T04:07:58.196Z",
+    "timestamp": "2026-10-29T00:00:39.955Z",
     "tools": [
       {
         "vendor": "Harness Everything",
         "name": "generate-sbom.js",
-        "version": "0.46.2"
+        "version": "0.47.0"
       }
     ],
     "component": {
       "type": "application",
-      "bom-ref": "pkg:npm/harness-everything@0.46.2",
+      "bom-ref": "pkg:npm/harness-everything@0.47.0",
       "name": "harness-everything",
-      "version": "0.46.2",
-      "purl": "pkg:npm/harness-everything@0.46.2"
+      "version": "0.47.0",
+      "purl": "pkg:npm/harness-everything@0.47.0"
     }
   },
   "components": [
@@ -2033,7 +2033,7 @@
       ]
     },
     {
-      "ref": "pkg:npm/harness-everything@0.46.2",
+      "ref": "pkg:npm/harness-everything@0.47.0",
       "dependsOn": [
         "pkg:npm/%40commitlint/cli@19.8.1",
         "pkg:npm/%40commitlint/config-conventional@19.8.1",