harness-everything 0.47.4 → 0.48.0

package/ci/mechanism-prb-outline-review.test.js

@@ -533,7 +533,7 @@ test('the trusted inventory pin maps only owner-approved VERI rows 15–18 to EV
   const bytes = fs.readFileSync(path.join(ROOT,
     'benchmarks/results/live-host/claude-341-outline-dispatch-2026-10-28/inventory/2741bd4514d2cd68f57d93a2b3ce94cbe597ca62d30e26f0ca58e882df5b03c6.md'));
   const mapping = [{ rowIds: ['15', '16', '17', '18'], sourceDomain: 'VERI', domain: 'EVID',
-    approvalRef: '../e1-feasibility-2026-10-28/owner-decision-veri-evid.md' }];
+    approvalRef: 'https://github.com/dyphn1/Harness-everything/issues/325#issuecomment-6706805112' }];
   assert.deepStrictEqual(pin.rowDomainMappings, mapping, 'the owner approval is part of the trusted pin');
   const valid = internals.validateOutlineInventoryPin({ bytes, pin, expectedPin: pin });
   assert.strictEqual(valid.state, 'accepted');

package/ci/test-behavioral-case-validation.js

@@ -230,4 +230,218 @@ try {
   fs.rmSync(jsonOnlyDir, { recursive: true, force: true });
 }
 
-console.log(`Behavioral case validation passed (${fs.readdirSync(casesDir).filter(name => name.endsWith('.yaml')).length} cases + negative controls + ordered execution evidence + json-only final output).`);
+// Skill-core completion: passing project tests is artifact evidence only; the
+// TDD case also requires an executed quality gate command.
+const tddCase = parseSimpleYaml(fs.readFileSync(path.join(casesDir, 'baseline-tdd-workflow.yaml'), 'utf8'));
+const qualityGate = tddCase.expectations.find(expectation => expectation.type === 'tdd_quality_gate');
+assert.ok(qualityGate, 'baseline TDD case must require a passed TDD quality gate');
+// The gate is graded by independently re-evaluating retained evidence, so the
+// workspace holds a real passing evidence file and a failing variant.
+const PASS_EVIDENCE = fs.readFileSync(path.join(__dirname, '..', 'tdd', 'fixtures', 'pass-evidence.json'), 'utf8');
+const FAIL_EVIDENCE = (() => {
+  const evidence = JSON.parse(PASS_EVIDENCE);
+  evidence.requirements = evidence.requirements.map(requirement => ({ ...requirement, sourceConformance: 'FAIL' }));
+  return JSON.stringify(evidence);
+})();
+const gateDir = fs.mkdtempSync(path.join(os.tmpdir(), 'behavioral-tdd-quality-gate-'));
+try {
+  fs.writeFileSync(path.join(gateDir, 'evidence.json'), PASS_EVIDENCE);
+  fs.writeFileSync(path.join(gateDir, 'failing-evidence.json'), FAIL_EVIDENCE);
+  fs.writeFileSync(path.join(gateDir, 'broken-evidence.json'), '{ not json');
+  // A string command defaults to the gate's own success line when it is a
+  // quality-gate invocation, so existing positives stay meaningful. An object
+  // command states the observed output and exit code explicitly.
+  const QUALITY_GATE_COMMAND_RE = /quality-gate\.js|tdd:quality|test:tdd-quality/;
+  const gradeCommands = (name, commands) => {
+    const transcriptPath = path.join(gateDir, `${name}.jsonl`);
+    const events = commands.map((entry, index) => {
+      const { command, output, exit } = typeof entry === 'string'
+        ? { command: entry, output: QUALITY_GATE_COMMAND_RE.test(entry) ? 'TDD Quality Gate: PASS' : '', exit: undefined }
+        : entry;
+      const state = { status: 'completed', input: { command } };
+      if (output !== undefined) state.output = output;
+      if (exit !== undefined) state.metadata = { exit };
+      return { type: 'tool_use', part: { type: 'tool', tool: 'Bash', callID: `${name}-${index}`, state } };
+    });
+    events.push({ type: 'text', part: { type: 'text', text: 'done' } });
+    fs.writeFileSync(transcriptPath, events.map(event => JSON.stringify(event)).join('\n'));
+    return grade({ expectations: [qualityGate] }, gateDir, transcriptPath);
+  };
+  const testsOnly = gradeCommands('tests-only', ['npm test']);
+  assert.strictEqual(testsOnly.passed, false, 'passing project tests without the quality gate must fail the TDD case');
+  assert.strictEqual(testsOnly.results[0].status, 'fail', 'missing quality gate must be a definitive fail, not inconclusive evidence');
+  assert.strictEqual(gradeCommands('npm-gate', ['npm test', 'npm run tdd:quality -- evidence.json']).passed, true, 'npm run tdd:quality with evidence must satisfy the gate');
+  assert.strictEqual(gradeCommands('node-gate', ['npm test', 'node tdd/scripts/quality-gate.js evidence.json']).passed, true, 'node quality-gate.js with evidence must satisfy the gate');
+  assert.strictEqual(gradeCommands('installed-skill-gate', ['npm test', 'node .claude/skills/tdd/scripts/quality-gate.js evidence.json']).passed, true, 'quality gate under the installed skill dir must satisfy the gate');
+  assert.strictEqual(gradeCommands('absolute-gate', ['npm test', 'node /tmp/ws/.harness/tdd/scripts/quality-gate.js evidence.json']).passed, true, 'absolute quality-gate path must satisfy the gate');
+  for (const [name, commands] of [
+    ['echo-mention', ['echo npm run tdd:quality']],
+    ['compound-gate', ['npm run tdd:quality -- evidence.json && rm -rf build']],
+    ['similar-name', ['npm run tdd:quality-notes']],
+  ]) {
+    assert.strictEqual(gradeCommands(name, commands).passed, false, `${name} must not count as an executed quality gate`);
+  }
+  // A completed tool call is not completion evidence: the gate outcome is
+  // re-evaluated from the retained evidence, independent of transcript claims.
+  const gateFailures = [
+    ['nonzero-exit', ['npm test', 'npm run tdd:quality -- failing-evidence.json'], /re-evaluation of failing-evidence\.json is FAIL/],
+    ['missing-evidence', ['npm test', 'npm run tdd:quality -- absent.json'], /not retained/],
+    ['invalid-evidence', ['npm test', 'node tdd/scripts/quality-gate.js broken-evidence.json'], /not valid JSON/],
+    ['no-evidence-arg', ['npm test', 'npm run tdd:quality'], /without an evidence file/],
+    ['self-test-alias', ['npm test', 'npm run test:tdd-quality'], /repository self-test/],
+    ['escaping-evidence', ['npm test', 'npm run tdd:quality -- ../evidence.json'], /outside the workspace/],
+    ['missing-output-report', ['npm test', 'npm run tdd:quality -- evidence.json --output reports/quality.json'], /quality report reports\/quality\.json was not retained/],
+    ['last-run-counts', ['npm run tdd:quality -- evidence.json', 'npm run tdd:quality -- failing-evidence.json'], /FAIL/],
+  ];
+  for (const [name, commands, reason] of gateFailures) {
+    const graded = gradeCommands(name, commands);
+    assert.strictEqual(graded.passed, false, `${name} must not satisfy the quality gate`);
+    assert.strictEqual(graded.results[0].status, 'fail', `${name} must be a definitive fail`);
+    assert.match(graded.results[0].reason, reason, `${name} should explain why`);
+  }
+  // OpenCode reports state.status "completed" even when the gate exits 1.
+  const opencodeExit1 = path.join(gateDir, 'opencode-exit1.jsonl');
+  fs.writeFileSync(opencodeExit1, [
+    { type: 'tool_use', part: { type: 'tool', tool: 'bash', callID: 'gate', state: { status: 'completed', input: { command: 'npm run tdd:quality -- failing-evidence.json' }, output: 'TDD Quality Gate: FAIL\nexit code 1' } } },
+    { type: 'text', part: { type: 'text', text: 'Quality gate done.' } },
+  ].map(event => JSON.stringify(event)).join('\n'));
+  assert.strictEqual(grade({ expectations: [qualityGate] }, gateDir, opencodeExit1).passed, false, 'completed OpenCode event with exit 1 must fail');
+  // Fixing evidence and re-running is allowed: the last completed run counts.
+  assert.strictEqual(gradeCommands('rerun-after-fix', ['npm run tdd:quality -- failing-evidence.json', 'npm run tdd:quality -- evidence.json']).passed, true, 'a passing re-run after a failing run should satisfy the gate');
+  // Observed command outcome: the transcript must show the gate's own success
+  // line and no error or non-zero exit before the evidence is trusted.
+  const { evaluateEvidence } = require('../tdd/scripts/quality-gate.js');
+  const observedGate = 'npm run tdd:quality -- evidence.json';
+  const observedFailures = [
+    ['failed-command-pass-evidence', { command: observedGate, output: 'npm ERR! Missing script: "tdd:quality"', exit: 1 }, /quality gate command failed/],
+    ['nonzero-exit-no-error-text', { command: observedGate, output: 'TDD Quality Gate: PASS', exit: 1 }, /exited with code 1/],
+    ['gate-printed-fail-evidence-now-pass', { command: observedGate, output: 'TDD Quality Gate: FAIL' }, /printed TDD Quality Gate: FAIL/],
+  ];
+  for (const [name, command, reason] of observedFailures) {
+    const graded = gradeCommands(name, [command]);
+    assert.strictEqual(graded.passed, false, `${name} must not satisfy the quality gate`);
+    assert.strictEqual(graded.results[0].status, 'fail', `${name} must be a definitive fail`);
+    assert.match(graded.results[0].reason, reason, `${name} should explain why`);
+  }
+  const unobservable = gradeCommands('unobservable-outcome', [{ command: observedGate, output: '' }]);
+  assert.strictEqual(unobservable.results[0].status, 'inconclusive', 'a gate run with no observable output or exit code must be inconclusive');
+  assert.strictEqual(unobservable.passed, false, 'an inconclusive gate run must not pass');
+  assert.match(unobservable.results[0].reason, /not observable in the transcript/, 'inconclusive reason should say the outcome is not observable');
+  // Definitive workspace failures win over an unobservable outcome.
+  const missingNoOutput = gradeCommands('missing-evidence-no-output', [{ command: 'npm run tdd:quality -- nope.json', output: '' }]);
+  assert.strictEqual(missingNoOutput.results[0].status, 'fail', 'missing evidence must be a definitive fail even with no observable output');
+  assert.match(missingNoOutput.results[0].reason, /not retained/, 'missing evidence should be named');
+  // Only the error signal is line-anchored: prose mentioning npm errors passes,
+  // while a real npm error line still fails.
+  assert.strictEqual(gradeCommands('prose-npm-error', [{ command: observedGate, output: 'TDD Quality Gate: PASS\n- note: avoid npm error handling', exit: 0 }]).passed, true, 'prose mentioning npm error must not fail a passing gate');
+  const npmErrorLine = gradeCommands('npm-error-line', [{ command: observedGate, output: 'npm error Missing script: "tdd:quality"' }]);
+  assert.strictEqual(npmErrorLine.results[0].status, 'fail', 'an npm error line must be a definitive fail');
+  assert.match(npmErrorLine.results[0].reason, /npm error/, 'npm error line should be named');
+  // npm ERR!/error lines after a PASS line must fail even without exit metadata;
+  // the boundary after the token must match whitespace or end of line.
+  const npmTrailer = (name, output) => gradeCommands(name, [{ command: observedGate, output }]);
+  for (const [name, output] of [
+    ['npm-err-bang-eacces', 'TDD Quality Gate: PASS\nnpm ERR! code EACCES'],
+    ['npm-err-bang-eresolve', 'TDD Quality Gate: PASS\nnpm ERR! code ERESOLVE'],
+    ['npm-error-elifecycle', 'TDD Quality Gate: PASS\nnpm error code ELIFECYCLE'],
+    ['npm-err-bang-eol', 'TDD Quality Gate: PASS\nnpm ERR!'],
+  ]) {
+    const graded = npmTrailer(name, output);
+    assert.strictEqual(graded.results[0].status, 'fail', `${name} must be a definitive fail`);
+    assert.strictEqual(graded.passed, false, `${name} must not satisfy the quality gate`);
+    assert.match(graded.results[0].reason, /npm error/i, `${name} should name the npm error`);
+  }
+  assert.strictEqual(npmTrailer('npm-errors-word', 'TDD Quality Gate: PASS\nnpm ERRORS are documented').passed, true, 'a word that only starts with ERR must not be an npm error');
+  const { GATE_COMMAND_ERROR_RE } = require('../behavioral-evals/run');
+  assert.strictEqual(GATE_COMMAND_ERROR_RE.test('npm ERR! code EACCES'), true, 'npm ERR! line must match the error regex');
+  assert.strictEqual(GATE_COMMAND_ERROR_RE.test('npm ERRORS'), false, 'npm ERRORS must not match the error regex');
+
+  // Claude stream-json: is_error on the tool_result is the host's failure
+  // signal; the call is recorded as failed, so it never counts as executed.
+  const claudeGate = (name, toolResult) => {
+    const transcriptPath = path.join(gateDir, `${name}.jsonl`);
+    fs.writeFileSync(transcriptPath, [
+      { type: 'assistant', message: { content: [{ type: 'tool_use', id: 'bash-1', name: 'Bash', input: { command: observedGate } }] } },
+      { type: 'user', message: { content: [{ type: 'tool_result', tool_use_id: 'bash-1', ...toolResult }] } },
+      { type: 'result', subtype: 'success', result: 'done' },
+    ].map(event => JSON.stringify(event)).join('\n'));
+    return grade({ expectations: [qualityGate] }, gateDir, transcriptPath);
+  };
+  const claudeError = claudeGate('claude-error', { is_error: true, content: 'npm ERR! Missing script' });
+  assert.strictEqual(claudeError.passed, false, 'Claude tool_result with is_error must not satisfy the gate');
+  assert.strictEqual(claudeError.results[0].status, 'fail', 'Claude tool_result error must be a definitive fail');
+  assert.match(claudeError.results[0].reason, /last quality gate run \(bash-1\) failed/, 'Claude errored gate call should be the failing last run');
+  assert.strictEqual(claudeGate('claude-success', { is_error: false, content: [{ type: 'text', text: 'TDD Quality Gate: PASS' }] }).passed, true, 'Claude tool_result carrying the gate success line should pass');
+  // Runs are graded in transcript order: the last matching attempt decides, so an
+  // earlier PASS never hides a later failed or unresolved run.
+  const claudeRuns = (name, runs) => {
+    const transcriptPath = path.join(gateDir, `${name}.jsonl`);
+    const events = [];
+    runs.forEach(({ command, result }, index) => {
+      const id = `${name}-bash-${index}`;
+      events.push({ type: 'assistant', message: { content: [{ type: 'tool_use', id, name: 'Bash', input: { command } }] } });
+      if (result) events.push({ type: 'user', message: { content: [{ type: 'tool_result', tool_use_id: id, ...result }] } });
+    });
+    events.push({ type: 'assistant', message: { content: [{ type: 'text', text: 'done' }] } });
+    events.push({ type: 'result', subtype: 'success', result: 'done' });
+    fs.writeFileSync(transcriptPath, events.map(event => JSON.stringify(event)).join('\n'));
+    return grade({ expectations: [qualityGate] }, gateDir, transcriptPath);
+  };
+  const gatePass = { is_error: false, content: [{ type: 'text', text: 'TDD Quality Gate: PASS' }] };
+  const gateFail = { is_error: true, content: 'TDD Quality Gate: FAIL' };
+  const lastRunError = claudeRuns('claude-pass-then-error', [
+    { command: observedGate, result: gatePass },
+    { command: observedGate, result: gateFail },
+  ]);
+  assert.strictEqual(lastRunError.results[0].status, 'fail', 'a failed last run must be a definitive fail even after an earlier PASS');
+  assert.strictEqual(lastRunError.passed, false, 'an earlier PASS must not satisfy the gate after a failed last run');
+  assert.match(lastRunError.results[0].reason, /last quality gate run/, 'the failed last run should be named');
+  const lastRunUnresolved = claudeRuns('claude-pass-then-unresolved', [
+    { command: observedGate, result: gatePass },
+    { command: observedGate },
+  ]);
+  assert.strictEqual(lastRunUnresolved.results[0].status, 'inconclusive', 'an unresolved last run must be inconclusive, not a pass');
+  assert.strictEqual(lastRunUnresolved.passed, false, 'an unresolved last run must not pass the gate');
+  assert.match(lastRunUnresolved.results[0].reason, /no observable result/, 'the unresolved last run should be named');
+  const otherEvidenceError = claudeRuns('claude-pass-then-other-evidence', [
+    { command: observedGate, result: gatePass },
+    { command: 'node tdd/scripts/quality-gate.js failing-evidence.json', result: gateFail },
+  ]);
+  assert.strictEqual(otherEvidenceError.results[0].status, 'fail', 'a failed run against other evidence must fail the gate');
+  assert.match(otherEvidenceError.results[0].reason, /last quality gate run/, 'the failed last run against other evidence should be named');
+  assert.strictEqual(claudeRuns('claude-fail-then-retry', [
+    { command: observedGate, result: gateFail },
+    { command: observedGate, result: gatePass },
+  ]).passed, true, 'a failed run followed by a successful retry must pass');
+  // Retained --output report: a full report must be present and must equal the
+  // fresh re-evaluation over every top-level key.
+  const realReport = evaluateEvidence(JSON.parse(PASS_EVIDENCE));
+  assert.strictEqual(realReport.result, 'PASS', 'the pass fixture must re-evaluate to PASS');
+  fs.mkdirSync(path.join(gateDir, 'reports'), { recursive: true });
+  const reportPath = path.join(gateDir, 'reports', 'quality.json');
+  fs.writeFileSync(reportPath, JSON.stringify({ result: 'PASS' }));
+  const markerOnly = gradeCommands('marker-output-report', ['npm run tdd:quality -- evidence.json --output reports/quality.json']);
+  assert.strictEqual(markerOnly.passed, false, 'a {"result":"PASS"} marker must not satisfy a retained report');
+  assert.match(markerOnly.results[0].reason, /missing required keys: .*requirements/, 'a marker-only retained report should name the missing keys');
+  fs.writeFileSync(reportPath, JSON.stringify(realReport, null, 2));
+  assert.strictEqual(gradeCommands('retained-output-report', ['npm run tdd:quality -- evidence.json --output reports/quality.json']).passed, true, 'retained --output report equal to the re-evaluation should pass');
+  fs.writeFileSync(reportPath, JSON.stringify({ ...realReport, score: realReport.score - 1 }, null, 2));
+  const staleScore = gradeCommands('stale-output-report', ['npm run tdd:quality -- evidence.json --output reports/quality.json']);
+  assert.strictEqual(staleScore.passed, false, 'a retained report with a stale score must fail');
+  assert.match(staleScore.results[0].reason, /differs from re-evaluation at "score"/, 'a stale retained report should name the differing key');
+  // Without --output the gate prints its report to stdout; that printed report
+  // must equal the fresh re-evaluation of the evidence the command names.
+  const printedText = report => `TDD Quality Gate: PASS\n${JSON.stringify(report, null, 2)}`;
+  assert.strictEqual(gradeCommands('stdout-report-equal', [{ command: observedGate, output: printedText(realReport) }]).passed, true, 'a printed report equal to the re-evaluation should pass');
+  const otherEvidence = JSON.parse(PASS_EVIDENCE);
+  otherEvidence.requirements[0].requirementId = 'REQ-OTHER';
+  fs.writeFileSync(path.join(gateDir, 'other-evidence.json'), JSON.stringify(otherEvidence));
+  const otherReport = evaluateEvidence(otherEvidence);
+  const stdoutMismatch = gradeCommands('stdout-report-other', [{ command: observedGate, output: printedText(otherReport) }]);
+  assert.strictEqual(stdoutMismatch.passed, false, 'a printed report from different evidence must fail');
+  assert.match(stdoutMismatch.results[0].reason, /gate output report differs from re-evaluation at "[a-zA-Z]+"/, 'a mismatched printed report should name the differing key');
+} finally {
+  fs.rmSync(gateDir, { recursive: true, force: true });
+}
+
+console.log(`Behavioral case validation passed (${fs.readdirSync(casesDir).filter(name => name.endsWith('.yaml')).length} cases + negative controls + ordered execution evidence + json-only final output + tdd quality gate).`);

package/code-review/SKILL.md

@@ -4,7 +4,7 @@ description: "Independently review a PR, diff or finished implementation for cor
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.40.0
+  version: 0.47.5
 ---
 
 # Code Review

package/code-review/references/review-playbook.md

@@ -19,6 +19,15 @@ Use this checklist for the applicable risks; do not force irrelevant categories.
 - [ ] Follow each important diagnostic/fact through every consumer and ancestor. Check whether required facts are computed before derived authority, indexes, or output.
 - [ ] Compare new rules with previously accepted rules and controls. Separate display severity from safety prerequisites.
 
+## Check evidence a gate trusts
+
+Apply these when the change grades, gates or labels evidence. Authors SHOULD run them as a self-review before push.
+
+- [ ] **Claimed vs observed.** Separate what the subject reports about itself (a tool's `completed` status, a result marker, an agent-supplied expected value, a status label) from what the checker observes independently (exit code, output, a recomputed result, the quoted source). A self-report alone never passes; when nothing independent is observable, the result is inconclusive.
+- [ ] **Select, then judge.** When the last, first or any item of a sequence decides (last run, final message, latest attempt), select from every attempt in order before filtering by outcome. Test both orders: failure then success, and success then failure or no result.
+- [ ] **One witness per rule.** Give each detection rule a negative case that triggers only that rule; a case that also trips an exit code or another pattern cannot show the rule works. Probe positive cases at structural boundaries (inside a token, string or quote), not only at safe separators.
+- [ ] **Comparable subjects, honest labels.** A comparison or conflict needs both sides to describe the same target. A status name claims only what was checked: a consistent quote is not a validated diagnosis.
+
 ## Check tests and output
 
 - [ ] Ask whether each test still passes if the behavior is disabled, bypassed, or broken (mutation thought experiment). Confirm the test is included in CI.

package/docs/doc-workflow-reconciliation.md

@@ -406,7 +406,9 @@ cannot replace that baseline with the latest HEAD or trust a persisted PASS.
 and governed cases exercise actual diffs. Fixtures without `baseFiles` remain non-Git, so their
 baseline is unavailable and credit is withheld. Fixture maps alone are not runtime authority.
 
-- **Accepted S1 residual (gitignored paths):** ignored, untracked candidate content is outside the non-ignored inventory. S1 grants no positive credit either way; the S2 producer must close this gap or explicitly re-accept it.
+- **F4 inventory coverage (S2 producer):** ignored and untracked paths remain in the candidate inventory, including new files and rename destinations, except for the bounded dependency-artifact policy below. With no policy, there are no new exclusions.
+- **Dependency-artifact policy:** the original project config `.agents/harness-everything/project-docs.json` may set `inventory.dependencyArtifactRoots` to any of `node_modules` and `.husky/_` (each is optional). These exact roots are pinned from baseline B; the candidate field must match B. Candidate-only config, host config, `.gitignore`, globs, aliases and other paths do not authorize pruning.
+- Before pruning, baseline and current-index paths, config sources, governed/legacy selectors, derived sources/outputs, and explicit task inputs are checked for overlap. Any overlap, ambiguous selector, unsafe root (file, symlink, alias, or outside the workspace), or retained-path symlink makes capture unavailable. Package files and `.bin` symlinks inside an approved root are not traversed; lockfiles, other paths, and ignored content outside the roots remain covered. Exclusion means installed bytes are outside this task's identity and ordinary code/frontmatter facts; it does not attest dependency contents or execution behavior.
 
 ### Refusal and completion contract
 

package/harness-everything/SKILL.md

@@ -4,7 +4,7 @@ description: "Route software/project work through Harness: classify tier/topolog
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.47.3
+  version: 0.48.0
 ---
 
 # Harness Everything

package/harness-everything/scripts/doc-lifecycle.js

@@ -1701,6 +1701,15 @@ function parseInventoryDoc(relativePath, bytes) {
   };
 }
 
+function convertWorkspaceFiles(root, inventory) {
+  const files = (Array.isArray(inventory) ? inventory : []).map(item => ({
+    relative: item.path,
+    bytes: Buffer.from(item.bytes)
+  }));
+  const rules = readWorkingTreeRules(root, files.filter(item => item.bytes.includes(0x0d)).map(item => item.relative));
+  return files.map(item => ({ path: item.relative, bytes: workingStoredBytes(root, item.relative, item.bytes, rules) }));
+}
+
 function scanWorkspaceFiles(root, scope = null) {
   if (!root) return [];
   const workspace = path.resolve(root);
@@ -1728,8 +1737,7 @@ function scanWorkspaceFiles(root, scope = null) {
     }
   }
   walk(workspace, '');
-  const rules = readWorkingTreeRules(workspace, files.filter(item => item.bytes.includes(0x0d)).map(item => item.relative));
-  return files.map(item => ({ path: item.relative, bytes: workingStoredBytes(workspace, item.relative, item.bytes, rules) }));
+  return convertWorkspaceFiles(workspace, files.map(item => ({ path: item.relative, bytes: item.bytes })));
 }
 
 function scanWorkspaceInventory(root) {
@@ -2785,6 +2793,6 @@ function main(argv = process.argv.slice(2)) {
   return analysis.diagnostics.some(item => item.severity === 'error') ? 1 : 0;
 }
 
-module.exports = { readGitBaseInventory, scanWorkspaceFiles, parseFrontmatter, parseRequirementBlocks, collectDocs, documentCorpusPaths, analyzeDocs, resolveRef, lintDocs, buildIndex, buildIndexSnapshot, configSourceInventory, diffRevisions, buildGitDocumentInventory };
+module.exports = { readGitBaseInventory, scanWorkspaceFiles, convertWorkspaceFiles, parseFrontmatter, parseRequirementBlocks, collectDocs, documentCorpusPaths, analyzeDocs, resolveRef, lintDocs, buildIndex, buildIndexSnapshot, configSourceInventory, diffRevisions, buildGitDocumentInventory };
 
 if (require.main === module) process.exitCode = main();

package/harness-everything/scripts/project-docs-resolver.js

@@ -21,6 +21,7 @@ const PROJECT_DOCS_CONFIG = path.join('.agents', 'harness-everything', 'project-
 const PROJECT_DOC_ROLES = Object.freeze(['prd', 'adr', 'ticket', 'reference', 'log', 'report']);
 const PROJECT_DOC_CONFIG_KEYS = new Set([
   'governed', 'domains', 'legacy', 'derived', 'tickets',
+  'inventory',
   'docLocation', 'tracker', 'issueDefinition', 'contextMap', 'contextMapPath',
   'decisionLocation', 'decisions', 'adrLocation', 'adr',
   'domainLocation', 'contextLocation', 'contexts', 'domain',
@@ -327,6 +328,17 @@ function validateDocsConfig(config) {
     }
   }
 
+  if (Object.prototype.hasOwnProperty.call(config, 'inventory')) {
+    const inventory = config.inventory;
+    const roots = inventory && inventory.dependencyArtifactRoots;
+    const supportedRoots = new Set(['node_modules', '.husky/_']);
+    if (!isPlainObject(inventory) || Object.keys(inventory).some(key => key !== 'dependencyArtifactRoots')
+      || !Array.isArray(roots) || roots.some(root => typeof root !== 'string' || !supportedRoots.has(root))
+      || new Set(roots).size !== roots.length) {
+      invalid('invalid-dependency-artifact-roots', 'inventory.dependencyArtifactRoots must contain distinct exact roots from node_modules and .husky/_');
+    }
+  }
+
   if (Object.prototype.hasOwnProperty.call(config, 'tickets') &&
       config.tickets !== 'tracker' && !isRepoRelativePath(config.tickets)) {
     invalid('invalid-tickets', 'tickets must be "tracker" or a repo-relative path');

package/hooks/scripts/lib/doc-reconciliation-core.js

@@ -12,6 +12,7 @@ function runtimeModule(name) {
 }
 const { checkDocObligations } = runtimeModule('doc-evidence.js');
 const { deriveDocFacts, deriveDocObligations } = runtimeModule('doc-obligations.js');
+const { validateDocsConfig } = runtimeModule('project-docs-resolver.js');
 const text = value => typeof value === 'string' && value.trim().length > 0;
 const record = value => value !== null && typeof value === 'object' && !Array.isArray(value);
 const compare = (a, b) => a < b ? -1 : a > b ? 1 : 0;
@@ -38,6 +39,9 @@ const sameIdentity = (a, b) => validIdentity(a) && validIdentity(b) && identityF
 const diagnostic = (code, context = {}) => ({ code, message: code.replace(/-/g, ' '), ...context });
 const pathCompare = (a, b) => Buffer.compare(Buffer.from(a.path), Buffer.from(b.path));
 const codedError = code => Object.assign(new Error(code), { code });
+const PROJECT_CONFIG_PATH = '.agents/harness-everything/project-docs.json';
+const DEPENDENCY_ARTIFACT_ROOTS = new Set(['node_modules', '.husky/_']);
+const DEPENDENCY_POLICY_VERSION = 'dependency-artifact-scope/1';
 // The derive contract (doc-obligations.js) decides applicability from governed/legacy documents, derived
 // outputs and code/REQ-test paths. Records outside them cannot affect document obligations.
 // shortcut: mirrors derive path rules, update them together until a shared classifier is exposed.
@@ -136,6 +140,57 @@ function snapshotDigest(kind, baseline, coverage, records) {
   for (const item of [...records].sort(pathCompare)) fields.push(item.path, item.presence, item.type, item.mode, bytes(item.storedBytes));
   return hashFrames(fields);
 }
+function pathUnderDependencyRoot(relative, root) {
+  const candidate = String(relative).replace(/\\/g, '/').normalize('NFC').toLowerCase();
+  const prefix = root.normalize('NFC').toLowerCase();
+  return candidate === prefix || candidate.startsWith(`${prefix}/`);
+}
+function projectConfigFromStoredBytes(value) {
+  try {
+    const config = JSON.parse(bytes(value).toString('utf8'));
+    return validateDocsConfig(config).valid ? config : null;
+  } catch { return null; }
+}
+function validCoverage(snapshot) {
+  const coverage = snapshot.candidate?.coverage;
+  if (!record(coverage) || !Array.isArray(coverage.excluded) || !record(coverage.scope)) return false;
+  if (coverage.kind === 'whole-project') {
+    return Object.keys(coverage).sort(compare).join('\0') === ['excluded', 'kind', 'scope'].sort(compare).join('\0')
+      && stable(coverage.excluded) === stable(['.git']);
+  }
+  const fields = ['dependencyArtifactRoots', 'excluded', 'excludedRootStates', 'guardOutcomes', 'kind', 'policySource', 'policyVersion', 'scope'];
+  if (coverage.kind !== 'project-with-dependency-artifact-exclusions'
+    || Object.keys(coverage).sort(compare).join('\0') !== fields.sort(compare).join('\0')
+    || coverage.policyVersion !== DEPENDENCY_POLICY_VERSION || !record(coverage.policySource)
+    || Object.keys(coverage.policySource).sort(compare).join('\0') !== ['baselineCommit', 'path', 'storedBytesDigest'].sort(compare).join('\0')
+    || coverage.policySource.path !== PROJECT_CONFIG_PATH || coverage.policySource.baselineCommit !== snapshot.baseline.commit
+    || !/^[a-f0-9]{64}$/.test(coverage.policySource.storedBytesDigest || '')
+    || !Array.isArray(coverage.dependencyArtifactRoots) || !coverage.dependencyArtifactRoots.length
+    || coverage.dependencyArtifactRoots.some(root => !DEPENDENCY_ARTIFACT_ROOTS.has(root))
+    || stable(coverage.dependencyArtifactRoots) !== stable([...coverage.dependencyArtifactRoots].sort())
+    || new Set(coverage.dependencyArtifactRoots).size !== coverage.dependencyArtifactRoots.length
+    || stable(coverage.excluded) !== stable(['.git', ...coverage.dependencyArtifactRoots])) return false;
+  const roots = coverage.dependencyArtifactRoots;
+  const baselinePolicy = snapshot.baseline.records.find(item => item.path === PROJECT_CONFIG_PATH && item.presence === 'present');
+  const candidatePolicy = snapshot.config.capture.sources.find(item => item.path === PROJECT_CONFIG_PATH && item.presence === 'present');
+  if (!baselinePolicy || !candidatePolicy || sha(bytes(baselinePolicy.storedBytes)) !== coverage.policySource.storedBytesDigest) return false;
+  const baseConfig = projectConfigFromStoredBytes(baselinePolicy.storedBytes);
+  const candidateConfig = projectConfigFromStoredBytes(candidatePolicy.bytes);
+  const baseRoots = baseConfig?.inventory?.dependencyArtifactRoots;
+  const candidateRoots = candidateConfig?.inventory?.dependencyArtifactRoots;
+  if (!Array.isArray(baseRoots) || !Array.isArray(candidateRoots)
+    || stable([...baseRoots].sort()) !== stable([...candidateRoots].sort())
+    || stable([...baseRoots].sort()) !== stable(roots)) return false;
+  if ([...snapshot.baseline.records, ...snapshot.candidate.records].some(item => roots.some(root => pathUnderDependencyRoot(item.path, root)))) return false;
+  if (!Array.isArray(coverage.excludedRootStates) || coverage.excludedRootStates.length !== roots.length
+    || coverage.excludedRootStates.some((item, index) => !record(item) || item.path !== roots[index]
+      || !['absent', 'present-directory'].includes(item.presence)
+      || Object.keys(item).sort(compare).join('\0') !== ['path', 'presence'].sort(compare).join('\0'))) return false;
+  const guards = ['baseline-paths', 'index-paths', 'config-sources', 'config-selectors', 'task-inputs', 'excluded-root-types'];
+  return Array.isArray(coverage.guardOutcomes) && coverage.guardOutcomes.length === guards.length
+    && coverage.guardOutcomes.every((item, index) => record(item) && item.guard === guards[index] && item.state === 'clear'
+      && text(item.reason) && (index !== guards.length - 1 || stable(item.roots) === stable(coverage.excludedRootStates)));
+}
 function configDigest(config) {
   const sources = [...config.capture.sources].sort(pathCompare);
   const fields = ['doc-config-v1', stable({ activeHost: config.capture.activeHost, selectionInputs: config.capture.selectionInputs, resolution: config.resolution }), String(sources.length)];
@@ -146,6 +201,7 @@ function validateSnapshot(snapshot) {
   const errors = [];
   try {
     if (!validIdentity(snapshot.identity) || !record(snapshot.facts) || !Array.isArray(snapshot.obligations)) throw new Error('invalid-input');
+    if (!validCoverage(snapshot)) errors.push(diagnostic('inventory-unsupported'));
     // Roots are canonicalized at capture; keep reconciliation detached and free of filesystem reads.
     const context = snapshot.originContext;
     if (!record(context) || !record(context.baseline) || !text(context.workspaceRoot)