harness-everything 0.47.0 → 0.47.2

package/ci/mechanism-379-self-evolve-workspace.test.js

@@ -0,0 +1,151 @@
+#!/usr/bin/env node
+'use strict';
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const ROOT = path.resolve(__dirname, '..');
+const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-workspace-379-'));
+const workspace = path.join(temp, 'workspace');
+const stateHome = path.join(temp, 'state');
+fs.mkdirSync(path.join(workspace, '.git'), { recursive: true });
+const env = { ...process.env, HARNESS_STATE_HOME: stateHome };
+for (const key of ['HARNESS_WORKSPACE_ROOT', 'CLAUDE_PROJECT_DIR', 'CODEX_PROJECT_DIR']) delete env[key];
+const canonical = require('../scripts/lib/workspace');
+const oldState = process.env.HARNESS_STATE_HOME;
+process.env.HARNESS_STATE_HOME = stateHome;
+const state = canonical.getWorkspaceStateDir(workspace);
+if (oldState === undefined) delete process.env.HARNESS_STATE_HOME; else process.env.HARNESS_STATE_HOME = oldState;
+const candidateId = 'lesson-0123456789abcdef01234567';
+const candidate = { schemaVersion: 1, candidateId, state: 'proposed' };
+const candidateDir = path.join(state, 'state', 'sessions', 'test', 'learning-candidates');
+fs.mkdirSync(candidateDir, { recursive: true });
+fs.writeFileSync(path.join(candidateDir, `${candidateId}.json`), JSON.stringify(candidate));
+function layout(name, packaged = false, helper = true) {
+  const root = path.join(temp, name);
+  const scripts = path.join(root, packaged ? 'skills/self-evolve/scripts' : 'self-evolve/scripts');
+  fs.mkdirSync(path.dirname(scripts), { recursive: true });
+  fs.cpSync(path.join(ROOT, 'self-evolve/scripts'), scripts, { recursive: true });
+  if (packaged) {
+    fs.mkdirSync(path.join(root, '.codex-plugin'), { recursive: true });
+    fs.writeFileSync(path.join(root, '.codex-plugin/plugin.json'), JSON.stringify({ name: 'harness-everything', skills: './skills/' }));
+  } else {
+    fs.writeFileSync(path.join(root, 'package.json'), JSON.stringify({ name: 'harness-everything' }));
+  }
+  if (helper) {
+    fs.mkdirSync(path.join(root, 'scripts'), { recursive: true });
+    fs.cpSync(path.join(ROOT, 'scripts/lib'), path.join(root, 'scripts/lib'), { recursive: true });
+  }
+  return { root, scripts };
+}
+function run(l, file, args = [], extra = {}) {
+  return spawnSync(process.execPath, [path.join(l.scripts, file), ...args], { cwd: workspace, env, encoding: 'utf8', ...extra });
+}
+function error(result, code) {
+  assert.notStrictEqual(result.status, 0, result.stdout);
+  assert.match(result.stderr, new RegExp(code));
+  assert.doesNotMatch(result.stderr, /TypeError|path.join/);
+}
+let count = 0;
+function test(name, fn) { fn(); console.log(`PASS ${name}`); count++; }
+try {
+  for (const packaged of [false, true]) {
+    const l = layout(packaged ? 'plugin' : 'source', packaged);
+    test(`${packaged ? 'plugin' : 'source'} reads canonical candidates twice deterministically`, () => {
+      for (let i = 0; i < 2; i++) {
+        const result = run(l, 'lesson-candidate.js', ['list', '--workspace', workspace, '--session-id', 'test']);
+        assert.strictEqual(result.status, 0, result.stderr);
+        assert.deepStrictEqual(JSON.parse(result.stdout), [candidate]);
+      }
+    });
+    test(`${packaged ? 'plugin' : 'source'} empty session is []`, () => {
+      const result = run(l, 'lesson-candidate.js', ['list', '--workspace', workspace, '--session-id', 'empty']);
+      assert.strictEqual(result.status, 0, result.stderr);
+      assert.deepStrictEqual(JSON.parse(result.stdout), []);
+    });
+    test(`${packaged ? 'plugin' : 'source'} writers retain authorization boundary`, () => {
+      const result = run(l, 'persist-memory.js', ['Always verify Error.js before test changes.']);
+      assert.strictEqual(result.status, 3, result.stderr);
+      assert.match(result.stderr, /authorization/);
+      assert.strictEqual(fs.existsSync(path.join(workspace, 'memories')), false);
+    });
+    test(`${packaged ? 'plugin' : 'source'} register resolves helper before usage`, () => {
+      const result = run(l, 'register-dynamic-skill.js');
+      assert.doesNotMatch(result.stderr, /WORKSPACE_HELPER_UNAVAILABLE|Cannot register.*resolved git/);
+      assert.strictEqual(result.status, 0, result.stderr);
+      assert.match(result.stdout, /No self-evolved dynamic skills/);
+    });
+  }
+  const missing = layout('missing', true, false);
+  for (const command of ['list', 'show', 'evaluate', 'promote']) test(`missing helper ${command}`, () => {
+    const result = run(missing, 'lesson-candidate.js', [command, '--workspace', workspace, '--candidate-id', candidateId]);
+    error(result, 'WORKSPACE_HELPER_UNAVAILABLE');
+    assert.match(result.stderr, /workspace\.js/);
+  });
+  for (const file of ['persist-memory.js', 'register-dynamic-skill.js']) test(`missing helper ${file}`, () => {
+    error(run(missing, file, file === 'persist-memory.js' ? ['Always verify Error.js before test changes.'] : []), 'WORKSPACE_HELPER_UNAVAILABLE');
+  });
+  test('adversarial cwd helper is never imported', () => {
+    const hostile = path.join(temp, 'hostile-workspace');
+    const sentinel = path.join(temp, 'untrusted-helper-loaded');
+    fs.mkdirSync(path.join(hostile, '.git'), { recursive: true });
+    fs.mkdirSync(path.join(hostile, 'scripts/lib'), { recursive: true });
+    fs.writeFileSync(path.join(hostile, 'scripts/lib/workspace.js'), `require('fs').writeFileSync(${JSON.stringify(sentinel)}, 'loaded');`);
+    error(run(missing, 'lesson-candidate.js', ['list', '--workspace', hostile], { cwd: hostile }), 'WORKSPACE_HELPER_UNAVAILABLE');
+    assert.strictEqual(fs.existsSync(sentinel), false);
+  });
+  test('missing source helper never imports a hostile ancestor helper', () => {
+    const sourceMissing = layout('ancestor-attack/checkout', false, false);
+    const ancestorHelper = path.join(temp, 'ancestor-attack/scripts/lib/workspace.js');
+    const sentinel = path.join(temp, 'ancestor-helper-loaded');
+    fs.mkdirSync(path.dirname(ancestorHelper), { recursive: true });
+    fs.writeFileSync(ancestorHelper, `require('fs').writeFileSync(${JSON.stringify(sentinel)}, 'loaded'); module.exports = {getWorkspaceRoot: () => ${JSON.stringify(workspace)}, getWorkspaceStateDir: () => ${JSON.stringify(state)}, getWorkspaceKey: () => 'hostile'};`);
+    error(run(sourceMissing, 'lesson-candidate.js', ['list', '--workspace', workspace]), 'WORKSPACE_HELPER_UNAVAILABLE');
+    assert.strictEqual(fs.existsSync(sentinel), false);
+  });
+  test('source checkout named skills never falls through to a parent plugin marker', () => {
+    const namedSkills = layout('named-skills/skills', false, false);
+    const parent = path.dirname(namedSkills.root);
+    const sentinel = path.join(temp, 'false-plugin-helper-loaded');
+    fs.mkdirSync(path.join(parent, '.codex-plugin'), { recursive: true });
+    fs.mkdirSync(path.join(parent, 'scripts/lib'), { recursive: true });
+    fs.writeFileSync(path.join(parent, '.codex-plugin/plugin.json'), JSON.stringify({ name: 'harness-everything', skills: './skills/' }));
+    fs.writeFileSync(path.join(parent, 'scripts/lib/workspace.js'), `require('fs').writeFileSync(${JSON.stringify(sentinel)}, 'loaded'); module.exports = {getWorkspaceRoot: () => ${JSON.stringify(workspace)}, getWorkspaceStateDir: () => ${JSON.stringify(state)}, getWorkspaceKey: () => 'hostile'};`);
+    error(run(namedSkills, 'lesson-candidate.js', ['list', '--workspace', workspace]), 'WORKSPACE_HELPER_UNAVAILABLE');
+    assert.strictEqual(fs.existsSync(sentinel), false);
+  });
+  const broken = layout('broken');
+  fs.writeFileSync(path.join(broken.root, 'scripts/lib/workspace.js'), "throw new Error('resolver dependency failed');");
+  test('existing broken helper cause is visible', () => {
+    const result = run(broken, 'lesson-candidate.js', ['list', '--workspace', workspace]);
+    error(result, 'WORKSPACE_HELPER_UNAVAILABLE'); assert.match(result.stderr, /resolver dependency failed/);
+  });
+  const source = layout('unresolved');
+  for (const command of ['list', 'show', 'evaluate', 'promote']) test(`unresolved workspace ${command} cannot fall back to cwd`, () => {
+    error(run(source, 'lesson-candidate.js', [command, '--candidate-id', candidateId], { cwd: temp }), 'WORKSPACE_ROOT_UNRESOLVED');
+  });
+  for (const file of ['persist-memory.js', 'register-dynamic-skill.js']) test(`unresolved workspace ${file}`, () => {
+    error(run(source, file, file === 'persist-memory.js' ? ['Always verify Error.js before test changes.'] : [], { cwd: temp }), 'WORKSPACE_ROOT_UNRESOLVED');
+  });
+  const invalidState = layout('invalid-state');
+  fs.writeFileSync(path.join(invalidState.root, 'scripts/lib/workspace.js'), `module.exports = {getWorkspaceRoot: () => ${JSON.stringify(workspace)}, getWorkspaceStateDir: () => null, getWorkspaceKey: () => 'key'};`);
+  test('null canonical state is a state diagnostic', () => {
+    error(run(invalidState, 'lesson-candidate.js', ['list']), 'WORKSPACE_STATE_UNAVAILABLE');
+  });
+  test('candidate directory read errors are not an empty list', () => {
+    const session = path.join(state, 'state', 'sessions', 'blocked');
+    fs.mkdirSync(session, { recursive: true });
+    fs.writeFileSync(path.join(session, 'learning-candidates'), 'not a directory');
+    error(run(source, 'lesson-candidate.js', ['list', '--workspace', workspace, '--session-id', 'blocked']), 'WORKSPACE_STATE_UNAVAILABLE');
+  });
+  const blocked = path.join(temp, 'blocked-state'); fs.writeFileSync(blocked, 'not a directory');
+  for (const command of ['list', 'show', 'evaluate', 'promote']) test(`unusable state ${command}`, () => {
+    error(run(source, 'lesson-candidate.js', [command, '--workspace', workspace, '--candidate-id', candidateId], { env: { ...env, HARNESS_STATE_HOME: blocked } }), 'WORKSPACE_STATE_UNAVAILABLE');
+  });
+  test('no unintended workspace writes', () => {
+    assert.deepStrictEqual(fs.readdirSync(workspace), ['.git']);
+    assert.deepStrictEqual(JSON.parse(fs.readFileSync(path.join(candidateDir, `${candidateId}.json`))), candidate);
+  });
+  console.log(`${count} workspace resolver checks passed`);
+} finally { fs.rmSync(temp, { recursive: true, force: true }); }

package/ci/mechanism-383-doc-glob-line-terminators.test.js

@@ -0,0 +1,131 @@
+'use strict';
+
+// #383: preserve each consumer's existing glob dialect while fixing only **.
+// Source contract: docs/document-lifecycle.md, project-docs configuration;
+// harness-everything/references/doc-check.md, derived-view unsupported cases.
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const vm = require('vm');
+const { spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+const LEGS = [
+  path.join(ROOT, 'harness-everything', 'scripts'),
+  path.join(ROOT, 'plugins', 'harness-everything', 'skills', 'harness-everything', 'scripts')
+];
+let failures = 0;
+let checks = 0;
+function check(name, run) {
+  try { run(); checks++; console.log(`PASS ${name}`); }
+  catch (error) { failures++; console.error(`FAIL ${name}: ${error.stack}`); }
+}
+
+for (const [legIndex, dir] of LEGS.entries()) {
+  const leg = legIndex === 0 ? 'source' : 'packaged';
+  for (const name of ['doc-lifecycle', 'doc-obligations', 'doc-check']) {
+    const source = fs.readFileSync(path.join(dir, `${name}.js`), 'utf8');
+    const declaration = source.match(/function globToRegExp\([^)]*\) \{[\s\S]*?\n\}/);
+    assert.ok(declaration, `${name}: matcher declaration exists`);
+    const matcher = vm.runInNewContext(`${declaration[0]}; globToRegExp`, {
+      normalizePath: value => String(value).replace(/\\/g, '/').replace(/^\.\//, '')
+    });
+    check(`${leg}/${name}: recursive line terminators, depths and negative controls`, () => {
+      for (const terminator of ['\n', '\r', '\u2028', '\u2029']) {
+        for (const pattern of ['docs/**/*.md', 'docs/**']) {
+          assert.strictEqual(matcher(pattern).test(`docs/a${terminator}b/file.md`), true, JSON.stringify({ pattern, terminator }));
+        }
+      }
+      assert.strictEqual(matcher('docs/**/*.md').test('docs/a/b/file.md'), true);
+      // doc-check has historically required the explicit slash after **;
+      // lifecycle and obligations give **/ zero-depth matching. Keep both.
+      assert.strictEqual(matcher('docs/**/*.md').test('docs/file.md'), name !== 'doc-check');
+      assert.strictEqual(matcher('docs/**').test('docs/file.md'), true);
+      assert.strictEqual(matcher('docs/*.md').test('docs/a/b.md'), false);
+      assert.strictEqual(matcher('docs/*.md').test('docs/a\nb.md'), true);
+      assert.strictEqual(matcher('docs/**/*.md').test('other/a/file.md'), false);
+      assert.strictEqual(matcher('docs/**/*.md').test('docs/a/file.txt'), false);
+      assert.strictEqual(matcher('docs.v1/**').test('docsXv1/file.md'), false);
+      assert.strictEqual(matcher('docs/?.md').test('docs/a.md'), name === 'doc-check');
+      assert.strictEqual(matcher('docs/?.md').test('docs/ab.md'), false);
+      assert.strictEqual(matcher('docs/?.md').test('docs/?.md'), true);
+    });
+  }
+
+  // LF/CR cannot be filesystem names on Windows; the in-memory matrix above
+  // covers them there. LS and PS exercise real paths on every supported host.
+  const terminators = process.platform === 'win32' ? ['\u2028', '\u2029'] : ['\n', '\r', '\u2028', '\u2029'];
+  for (const terminator of terminators) {
+    check(`${leg}/consumers: ${JSON.stringify(terminator)} scope and diagnostics`, () => {
+      const workspace = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-383-'));
+      try {
+        const relative = `docs/a${terminator}b/file.md`;
+        const config = {
+          governed: [{ path: 'docs/**/*.md', role: 'reference' }, { path: 'docs/**', role: 'adr' }],
+          domains: [], legacy: []
+        };
+        const absolute = path.join(workspace, relative);
+        fs.mkdirSync(path.dirname(absolute), { recursive: true });
+        fs.writeFileSync(absolute, '# Missing status\n');
+        const lifecycle = require(path.join(dir, 'doc-lifecycle'));
+        const docs = lifecycle.collectDocs(workspace, config);
+        assert.deepStrictEqual(docs.map(doc => [doc.path, doc.role]), [[relative, 'reference']], 'first matching scope retains precedence');
+        const lint = lifecycle.analyzeDocs(docs, config, { all: true });
+        assert.ok(lint.diagnostics.some(item => item.path === relative && item.code === 'missing-status'), 'scoped malformed document is diagnosed');
+
+        const { deriveDocFacts, deriveDocObligations } = require(path.join(dir, 'doc-obligations'));
+        const derived = deriveDocFacts({
+          base: { files: { [relative]: '---\nstatus: active\n---\nBefore\n' } },
+          candidate: { files: { [relative]: '---\nstatus: active\n---\nAfter\n' } }, config
+        });
+        assert.deepStrictEqual(derived.facts.governedPaths, [relative]);
+        const obligation = deriveDocObligations(derived.facts).find(item => item.capability === 'doc-lint');
+        assert.strictEqual(obligation.applicability, 'applicable');
+        assert.deepStrictEqual(obligation.scope.paths, [relative]);
+
+        fs.writeFileSync(path.join(workspace, 'config.json'), JSON.stringify({ derived: [{ path: 'docs/**/*.md', generator: 'never-run' }] }));
+        const result = spawnSync(process.execPath, [path.join(dir, 'doc-check.js'), 'compare-derived',
+          '--workspace', workspace, '--config', 'config.json', '--view', relative,
+          '--candidate', 'absent.md', '--generation-status', 'ok'], { encoding: 'utf8', cwd: os.tmpdir() });
+        assert.strictEqual(result.status, 2, result.stderr);
+        const output = JSON.parse(result.stdout);
+        assert.strictEqual(output.result, 'unsupported', 'declared recursive glob receives the correct diagnostic');
+        assert.strictEqual(output.reason, 'view matches a declared glob; only literal derived paths are supported');
+        assert.strictEqual(fs.existsSync(path.join(workspace, 'absent.md')), false, 'no generator or candidate is created');
+      } finally { fs.rmSync(workspace, { recursive: true, force: true }); }
+    });
+  }
+}
+
+// #383 F1: the doc-reconciliation core mirrors the ** branch; each copy must match line terminators too.
+const CORE_LEGS = [
+  path.join(ROOT, 'hooks', 'scripts', 'lib', 'doc-reconciliation-core.js'),
+  path.join(ROOT, 'plugins', 'harness-everything', 'hooks', 'scripts', 'lib', 'doc-reconciliation-core.js')
+];
+const binaryRecord = relative => ({ presence: 'present', path: relative, type: 'file', mode: '100644', storedBytes: Buffer.from([0xff, 0xfe, 0x41]) });
+for (const [legIndex, corePath] of CORE_LEGS.entries()) {
+  const leg = legIndex === 0 ? 'source' : 'packaged';
+  const { deriveFiles, semanticRelevance } = require(corePath)._internals;
+  const config = { governed: [{ path: 'docs/**/*.md', role: 'reference' }] };
+  for (const terminator of ['\n', '\r', '
', '
']) {
+    const relative = `docs/a${terminator}b/file.md`;
+    check(`${leg}/doc-reconciliation-core: ${JSON.stringify(terminator)} is governed by docs/**/*.md`, () => {
+      assert.strictEqual(semanticRelevance(relative, config), 'document', JSON.stringify(relative));
+    });
+    check(`${leg}/doc-reconciliation-core: ${JSON.stringify(terminator)} undecodable record fails closed`, () => {
+      assert.throws(() => deriveFiles([binaryRecord(relative)], config), error => error.code === 'inventory-unsupported');
+    });
+    check(`${leg}/doc-reconciliation-core: ${JSON.stringify(terminator)} negative control (ungoverned path) is not fail-closed`, () => {
+      const other = `other/a${terminator}b/file.md`;
+      assert.strictEqual(semanticRelevance(other, config), null, JSON.stringify(other));
+      assert.deepStrictEqual(deriveFiles([binaryRecord(other)], config), {});
+    });
+  }
+  check(`${leg}/doc-reconciliation-core: positive control docs/ab/file.md fails closed`, () => {
+    assert.strictEqual(semanticRelevance('docs/ab/file.md', config), 'document');
+    assert.throws(() => deriveFiles([binaryRecord('docs/ab/file.md')], config), error => error.code === 'inventory-unsupported');
+  });
+}
+console.log(`${checks} checks passed; ${failures} failed`);
+process.exitCode = failures ? 1 : 0;

package/docs/document-lifecycle.md

@@ -114,7 +114,7 @@ Two *separate* gates apply. The **functional gate** requires contract tests, neg
 | `tickets` | `"tracker"` or a repo-relative path |
 | Unknown keys | Warning, not error |
 
-Globs are repo-relative POSIX paths supporting `*` (one segment) and `**` (any depth).
+Globs are repo-relative POSIX paths supporting `*` (one segment) and `**` (any depth). Recursive `**` branches include line terminators in path components; `*` still cannot cross `/`.
 
 ## Roles and status (D6.1, D6.3)
 

package/docs/platform-capabilities.md

@@ -43,6 +43,10 @@ upgrade any platform row's live-host status.
 
 The registered `doc-check check --conflict-assessment` mode runs document lifecycle lint across the full governed and legacy corpus and requires `--base` as an exact commit SHA. It emits `conflict-check` only when collection is complete and there are no lifecycle errors. Its event preserves the exact obligation scope separately from full-corpus paths and digests, config bytes and base commit, then checks those bindings against the workflow snapshot. The acceptance is limited to recorded and structural conflicts; prose contradictions remain with independent `quality-review`. Plain `check` never earns this credit, and OpenCode still refuses the capability. Deterministic mechanism coverage does not establish live-host behavior or change the platform matrix's live-verification status.
 
+### Self-evolve workspace resolution (mechanism only)
+
+Source and packaged plugin self-evolve entrypoints use installation-relative canonical workspace helpers and the same workspace/session state path. Missing helpers, unresolved identities, and unusable state paths fail explicitly; only absent candidate directories yield an empty list. The [resolver contract](../self-evolve/references/memory-resolution.md#workspace-helper-and-diagnostics) and source/package subprocess regressions establish deterministic mechanism coverage, not a live-host upgrade. Existing memory authorization remains required.
+
 ## Current capability summary
 
 | Platform surface | Standalone skills | Plugin support | Hooks/lifecycle | Project scope | Global scope | Current evidence boundary |

package/harness-everything/SKILL.md

@@ -4,7 +4,7 @@ description: "Route software/project work through Harness: classify tier/topolog
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.47.0
+  version: 0.47.1
 ---
 
 # Harness Everything

package/harness-everything/scripts/doc-check.js

@@ -243,7 +243,7 @@ function parseCompareArgs(argv) {
 
 // Escape regex metacharacters, then translate `**`, `*` and `?`. Used only to detect a declared glob.
 function globToRegExp(pattern) {
-  const body = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*\*/g, '\u0000').replace(/\*/g, '[^/]*').replace(/\?/g, '[^/]').replace(/\u0000/g, '.*');
+  const body = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*\*/g, '\u0000').replace(/\*/g, '[^/]*').replace(/\?/g, '[^/]').replace(/\u0000/g, '[\\s\\S]*');
   return new RegExp(`^${body}$`);
 }
 

package/harness-everything/scripts/doc-lifecycle.js

@@ -202,10 +202,10 @@ function globToRegExp(glob) {
     const char = source[index];
     if (char === '*' && source[index + 1] === '*') {
       if (source[index + 2] === '/') {
-        pattern += '(?:.*/)?';
+        pattern += '(?:[\\s\\S]*/)?';
         index += 2;
       } else {
-        pattern += '.*';
+        pattern += '[\\s\\S]*';
         index++;
       }
     } else if (char === '*') {

package/harness-everything/scripts/doc-obligations.js

@@ -70,10 +70,10 @@ function globToRegExp(glob) {
     const char = source[index];
     if (char === '*' && source[index + 1] === '*') {
       if (source[index + 2] === '/') {
-        pattern += '(?:.*/)?';
+        pattern += '(?:[\\s\\S]*/)?';
         index += 2;
       } else {
-        pattern += '.*';
+        pattern += '[\\s\\S]*';
         index++;
       }
     } else if (char === '*') {

package/hooks/scripts/lib/doc-reconciliation-core.js

@@ -50,8 +50,8 @@ function globToRegExp(glob) {
   for (let index = 0; index < source.length; index++) {
     const char = source[index];
     if (char === '*' && source[index + 1] === '*') {
-      if (source[index + 2] === '/') { pattern += '(?:.*/)?'; index += 2; }
-      else { pattern += '.*'; index += 1; }
+      if (source[index + 2] === '/') { pattern += '(?:[\\s\\S]*/)?'; index += 2; }
+      else { pattern += '[\\s\\S]*'; index += 1; }
     } else if (char === '*') pattern += '[^/]*';
     else pattern += char.replace(/[|\\{}()[\]^$+?.]/g, '\\$&');
   }

package/hooks/scripts/lib/doc-reconciliation-provider.js

@@ -101,7 +101,7 @@ function isUncPathPrefix(token, command, index) {
   return token === '' && command[index] === '\\' && command[index + 1] === '\\';
 }
 // Canonical SHA-256 of harness-everything/scripts/doc-check.js (CRLF normalised to LF). Re-pin deliberately when that script changes.
-const SHIPPED_DOC_CHECK_DIGEST = '804a093b31afde07ea6ec40e39fc758b501966bfa2a15c53a5275ad3171b0755';
+const SHIPPED_DOC_CHECK_DIGEST = '3ca386666d4dae9a98ffa27adf2f326bf171a783af90515375f0b328ca35f194';
 // This install's own doc-check runtime, relative to hooks/scripts/lib: the source checkout or the packaged plugin.
 const DOC_CHECK_INSTALL_LAYOUTS = [
   ['..', '..', '..', 'harness-everything', 'scripts', 'doc-check.js'],

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.47.0",
+  "version": "0.47.2",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.47.0",
+  "version": "0.47.2",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.47.0",
+  "version": "0.47.2",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/hooks/scripts/lib/doc-reconciliation-core.js

@@ -50,8 +50,8 @@ function globToRegExp(glob) {
   for (let index = 0; index < source.length; index++) {
     const char = source[index];
     if (char === '*' && source[index + 1] === '*') {
-      if (source[index + 2] === '/') { pattern += '(?:.*/)?'; index += 2; }
-      else { pattern += '.*'; index += 1; }
+      if (source[index + 2] === '/') { pattern += '(?:[\\s\\S]*/)?'; index += 2; }
+      else { pattern += '[\\s\\S]*'; index += 1; }
     } else if (char === '*') pattern += '[^/]*';
     else pattern += char.replace(/[|\\{}()[\]^$+?.]/g, '\\$&');
   }

package/plugins/harness-everything/hooks/scripts/lib/doc-reconciliation-provider.js

@@ -101,7 +101,7 @@ function isUncPathPrefix(token, command, index) {
   return token === '' && command[index] === '\\' && command[index + 1] === '\\';
 }
 // Canonical SHA-256 of harness-everything/scripts/doc-check.js (CRLF normalised to LF). Re-pin deliberately when that script changes.
-const SHIPPED_DOC_CHECK_DIGEST = '804a093b31afde07ea6ec40e39fc758b501966bfa2a15c53a5275ad3171b0755';
+const SHIPPED_DOC_CHECK_DIGEST = '3ca386666d4dae9a98ffa27adf2f326bf171a783af90515375f0b328ca35f194';
 // This install's own doc-check runtime, relative to hooks/scripts/lib: the source checkout or the packaged plugin.
 const DOC_CHECK_INSTALL_LAYOUTS = [
   ['..', '..', '..', 'harness-everything', 'scripts', 'doc-check.js'],

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.47.0",
+  "version": "0.47.2",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/skills/harness-everything/SKILL.md

@@ -4,7 +4,7 @@ description: "Route software/project work through Harness: classify tier/topolog
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.47.0
+  version: 0.47.1
 ---
 
 # Harness Everything

package/plugins/harness-everything/skills/harness-everything/scripts/doc-check.js

@@ -243,7 +243,7 @@ function parseCompareArgs(argv) {
 
 // Escape regex metacharacters, then translate `**`, `*` and `?`. Used only to detect a declared glob.
 function globToRegExp(pattern) {
-  const body = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*\*/g, '\u0000').replace(/\*/g, '[^/]*').replace(/\?/g, '[^/]').replace(/\u0000/g, '.*');
+  const body = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*\*/g, '\u0000').replace(/\*/g, '[^/]*').replace(/\?/g, '[^/]').replace(/\u0000/g, '[\\s\\S]*');
   return new RegExp(`^${body}$`);
 }
 

package/plugins/harness-everything/skills/harness-everything/scripts/doc-lifecycle.js

@@ -202,10 +202,10 @@ function globToRegExp(glob) {
     const char = source[index];
     if (char === '*' && source[index + 1] === '*') {
       if (source[index + 2] === '/') {
-        pattern += '(?:.*/)?';
+        pattern += '(?:[\\s\\S]*/)?';
         index += 2;
       } else {
-        pattern += '.*';
+        pattern += '[\\s\\S]*';
         index++;
       }
     } else if (char === '*') {

package/plugins/harness-everything/skills/harness-everything/scripts/doc-obligations.js

@@ -70,10 +70,10 @@ function globToRegExp(glob) {
     const char = source[index];
     if (char === '*' && source[index + 1] === '*') {
       if (source[index + 2] === '/') {
-        pattern += '(?:.*/)?';
+        pattern += '(?:[\\s\\S]*/)?';
         index += 2;
       } else {
-        pattern += '.*';
+        pattern += '[\\s\\S]*';
         index++;
       }
     } else if (char === '*') {

package/plugins/harness-everything/skills/self-evolve/SKILL.md

@@ -4,7 +4,7 @@ description: "Extract root causes from resolved problems and persist them as def
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.31.3
+  version: 0.47.1
 ---
 
 # Self-evolve

package/plugins/harness-everything/skills/self-evolve/references/memory-resolution.md

@@ -35,6 +35,17 @@ For a simple rule, inspect/list the session candidate, evaluate it with a genera
 
 For a reusable multi-step procedure, load `skill-creator/SKILL.md`, create the draft skill, and use `register-dynamic-skill.js` to update each platform's `manifest.json` `generated[]` registry. The host agent remains responsible for deciding which evidence is relevant; these scripts do not discover session history.
 
+## Workspace helper and diagnostics
+
+| Contract | Behavior |
+| --- | --- |
+| Trusted imports | Select one layout using its installation marker: source `package.json` takes precedence; packaged `skills/` requires `.codex-plugin/plugin.json`. Load only that root’s `scripts/lib/workspace.js`; never fall through to ancestor/project/cwd code. |
+| Identity and state | Use the canonical resolver and `HARNESS_STATE_HOME` precedence; source and plugin read the same workspace/session candidates. No alternate state root. |
+| Missing helper | `WORKSPACE_HELPER_UNAVAILABLE` identifies the selected helper path or invalid layout marker and cause; absent or broken helpers fail without trying another layout. |
+| Unresolved identity | `WORKSPACE_ROOT_UNRESOLVED` exits nonzero; do not substitute cwd when canonical resolution fails. |
+| Unusable state | `WORKSPACE_STATE_UNAVAILABLE` exits nonzero for invalid state paths or failed reads; only a genuinely absent candidate directory returns `[]`. |
+| Writes | Existing screening and workflow authorization still apply. Resolver failures never authorize persistence or state repair. |
+
 ## Candidate Lifecycle
 
 ```text

package/plugins/harness-everything/skills/self-evolve/scripts/lesson-candidate.js

@@ -18,14 +18,7 @@ for (const relative of [
   }
 }
 
-let getWorkspaceRoot;
-let getWorkspaceStateDir;
-try {
-  ({ getWorkspaceRoot, getWorkspaceStateDir } = require('../../scripts/lib/workspace'));
-} catch (_) {
-  getWorkspaceRoot = () => null;
-  getWorkspaceStateDir = () => null;
-}
+const { getWorkspaceRoot, getWorkspaceStateDir, workspaceError } = require('./workspace-helper');
 
 const SCHEMA_VERSION = 1;
 const TERMINAL = new Set(['rejected', 'validated', 'regressed', 'superseded']);
@@ -48,10 +41,10 @@ function readJson(filePath) {
 }
 
 function candidatePath(workspace, sessionId, candidateId) {
-  if (!workspace || !getWorkspaceStateDir(workspace)) throw new Error('workspace state root is unavailable');
+  const stateDir = getWorkspaceStateDir(workspace);
   if (!/^lesson-[a-f0-9]{24}$/.test(String(candidateId || ''))) throw new Error('invalid candidate id');
   return path.join(
-    getWorkspaceStateDir(workspace),
+    stateDir,
     'state',
     'sessions',
     safeSessionName(sessionId),
@@ -292,7 +285,10 @@ function observeCandidate(input) {
 function listCandidates({ workspace, sessionId }) {
   const base = path.join(getWorkspaceStateDir(workspace), 'state', 'sessions', safeSessionName(sessionId), 'learning-candidates');
   let files = [];
-  try { files = fs.readdirSync(base).filter(name => /^lesson-[a-f0-9]{24}\.json$/.test(name)); } catch (_) { return []; }
+  try { files = fs.readdirSync(base).filter(name => /^lesson-[a-f0-9]{24}\.json$/.test(name)); } catch (error) {
+    if (error.code === 'ENOENT') return [];
+    throw workspaceError('WORKSPACE_STATE_UNAVAILABLE', `cannot read candidate directory ${base}`, error);
+  }
   return files.map(name => readJson(path.join(base, name))).filter(Boolean);
 }
 
@@ -303,7 +299,8 @@ function option(args, name) {
 
 function parseCli(argv) {
   const command = argv[0];
-  const workspace = path.resolve(option(argv, '--workspace') || getWorkspaceRoot() || process.cwd());
+  const explicit = option(argv, '--workspace');
+  const workspace = getWorkspaceRoot(explicit ? { workspace_root: path.resolve(explicit) } : undefined);
   const base = {
     command,
     workspace,

package/plugins/harness-everything/skills/self-evolve/scripts/persist-memory.js

@@ -4,20 +4,7 @@
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
-let getWorkspaceRoot;
-let getWorkspaceStateDir;
-let getWorkspaceKey;
-try {
-  ({ getWorkspaceRoot, getWorkspaceStateDir, getWorkspaceKey } = require('../../scripts/lib/workspace'));
-} catch (err) {
-  getWorkspaceRoot = () => null;
-  getWorkspaceStateDir = () => null;
-  getWorkspaceKey = () => null;
-}
-
-// NOTE: this script ships standalone - it is copied whole into every install
-// target. When the canonical workspace resolver is not present, persistence
-// fails closed rather than guessing a project root (issue #42).
+const { getWorkspaceRoot, getWorkspaceStateDir, getWorkspaceKey } = require('./workspace-helper');
 
 const SECRET_PATTERNS = [
   ['github-token', /\bgh[pousr]_[A-Za-z0-9]{20,}\b/],

package/plugins/harness-everything/skills/self-evolve/scripts/register-dynamic-skill.js

@@ -1,16 +1,12 @@
 #!/usr/bin/env node
 const fs = require('fs');
 const path = require('path');
-let getWorkspaceRoot;
-try {
-  ({ getWorkspaceRoot } = require('../../scripts/lib/workspace'));
-} catch (err) {
-  getWorkspaceRoot = () => null;
-}
+const { getWorkspaceRoot } = require('./workspace-helper');
 
-const workspaceRoot = getWorkspaceRoot();
-if (!workspaceRoot) {
-  console.error('[self-evolve] Cannot register a dynamic skill without a resolved git workspace.');
+let workspaceRoot;
+try { workspaceRoot = getWorkspaceRoot(); }
+catch (error) {
+  console.error(`[self-evolve] ${error.message}`);
   process.exit(1);
 }