harness-everything 0.47.4 → 0.48.0

package/plugins/harness-everything/hooks/scripts/lib/doc-reconciliation-producer.js

@@ -4,14 +4,17 @@ const fs = require('fs');
 const path = require('path');
 const { execFileSync } = require('child_process');
 const { _internals: U } = require('./doc-reconciliation-core');
-const { scanWorkspaceFiles } = U.runtimeModule('doc-lifecycle.js');
-const { resolveDocsConfigCaptured } = U.runtimeModule('project-docs-resolver.js');
+const { convertWorkspaceFiles } = U.runtimeModule('doc-lifecycle.js');
+const { resolveDocsConfigCaptured, validateDocsConfig } = U.runtimeModule('project-docs-resolver.js');
 const { deriveDocFacts, deriveDocObligations } = U.runtimeModule('doc-obligations.js');
 
 const MAX_FILES = 10000;
 const MAX_BYTES = 64 * 1024 * 1024;
 const POSIX_MODES = process.platform !== 'win32';
-function fail(code) { throw new Error(code); }
+const PROJECT_CONFIG_PATH = '.agents/harness-everything/project-docs.json';
+const SUPPORTED_ARTIFACT_ROOTS = new Set(['node_modules', '.husky/_']);
+const POLICY_VERSION = 'dependency-artifact-scope/1';
+function fail(code, reasonCode) { throw Object.assign(new Error(code), reasonCode ? { reasonCode } : {}); }
 // The JS realpath keeps Windows 8.3 spellings (RUNNER~1) while Git reports the long name, so
 // directory identity uses native resolution and is case-insensitive on Windows (as workflow-isolation).
 function canonicalPath(value) { return fs.realpathSync.native(path.resolve(value)); }
@@ -64,7 +67,249 @@ function captureBaseline(root, pin) {
   validatePaths(records);
   return { commit, treeRef, records };
 }
-function captureCandidate(root, baseline) {
+
+function pathUnderRoot(relative, root) {
+  const candidate = String(relative).replace(/\\/g, '/').normalize('NFC').toLowerCase();
+  const expected = root.normalize('NFC').toLowerCase();
+  return candidate === expected || candidate.startsWith(`${expected}/`);
+}
+function rootMention(value, root) {
+  const normalized = String(value).replace(/\\/g, '/').normalize('NFC').toLowerCase();
+  const needle = root.normalize('NFC').toLowerCase();
+  let offset = 0;
+  while ((offset = normalized.indexOf(needle, offset)) >= 0) {
+    const before = offset === 0 || !/[a-z0-9_.-]/.test(normalized[offset - 1]);
+    const after = offset + needle.length;
+    const boundary = after === normalized.length || /[/*?\s"'`:#),;\]]/.test(normalized[after]);
+    if (before && boundary) return true;
+    offset++;
+  }
+  return false;
+}
+function globSegmentMatches(rawPattern, rawSegment) {
+  // Same NFC + lowercase folding as rootMention()/pathUnderRoot(), so a wildcard spelling cannot dodge it.
+  const pattern = rawPattern.normalize('NFC').toLowerCase();
+  const segment = rawSegment.normalize('NFC').toLowerCase();
+  if (/[\[\]{}]/.test(pattern)) return true;
+  const escaped = pattern.split(/([*?])/).map(part => part === '*' ? '[\\s\\S]*' : part === '?' ? '[\\s\\S]'
+    : part.replace(/[|\\{}()[\]^$+?.]/g, '\\$&')).join('');
+  return new RegExp(`^${escaped}$`).test(segment);
+}
+function relativeSelectorMayIntersectRoot(selector, root) {
+  const normalized = selector.replace(/\\/g, '/');
+  if (/[\[\]{}]/.test(normalized) || normalized.split('/').includes('..')) return true;
+  // `.` and empty segments are redundant anywhere in a workspace-relative selector.
+  const pattern = normalized.split('/').filter(segment => segment !== '' && segment !== '.');
+  const target = root.split('/');
+  let states = new Set([0]);
+  const closure = values => {
+    const expanded = new Set(values);
+    let changed = true;
+    while (changed) {
+      changed = false;
+      for (const index of expanded) {
+        if (pattern[index] === '**' && !expanded.has(index + 1)) {
+          expanded.add(index + 1);
+          changed = true;
+        }
+      }
+    }
+    return expanded;
+  };
+  states = closure(states);
+  for (const segment of target) {
+    const next = new Set();
+    for (const index of states) {
+      if (index >= pattern.length) continue;
+      if (pattern[index] === '**') next.add(index);
+      else if (globSegmentMatches(pattern[index], segment)) next.add(index + 1);
+    }
+    states = closure(next);
+    if (!states.size) return false;
+  }
+  return states.size > 0;
+}
+function relativePathWithin(workspace, candidate, pathApi) {
+  const relative = pathApi.relative(workspace, candidate);
+  if (!relative) return '';
+  const normalized = relative.replace(/\\/g, '/');
+  // Case and filesystem aliases that cannot be resolved exactly must fail closed.
+  const workspaceParts = workspace.replace(/\\/g, '/').split('/').filter(Boolean);
+  const candidateParts = candidate.replace(/\\/g, '/').split('/').filter(Boolean);
+  const samePrefix = workspaceParts.length <= candidateParts.length
+    && workspaceParts.every((part, index) => part.normalize('NFC').toLowerCase()
+      === candidateParts[index].normalize('NFC').toLowerCase());
+  if (samePrefix) return candidateParts.slice(workspaceParts.length).join('/');
+  if (pathApi.isAbsolute(relative) || normalized === '..' || normalized.startsWith('../')) return null;
+  return normalized;
+}
+function realpathWithMissingSuffix(candidate, pathApi) {
+  let current = candidate;
+  const suffix = [];
+  while (true) {
+    try { return pathApi.resolve(fs.realpathSync.native(current), ...suffix); }
+    catch (error) {
+      if (!['ENOENT', 'ENOTDIR'].includes(error.code)) return null;
+      const parent = pathApi.dirname(current);
+      if (parent === current) return null;
+      suffix.unshift(pathApi.basename(current));
+      current = parent;
+    }
+  }
+}
+function absoluteSelectorRelatives(selector, workspaceRoot) {
+  const windowsDrive = /^[A-Za-z]:/.test(selector);
+  if ((windowsDrive || selector.startsWith('\\') || selector.startsWith('//')) && process.platform !== 'win32') return true;
+  const pathApi = process.platform === 'win32' ? path.win32 : path;
+  if (windowsDrive && !pathApi.isAbsolute(selector)) return true;
+  if (!pathApi.isAbsolute(selector)) return null;
+
+  const workspace = canonicalPath(workspaceRoot);
+  const absolute = pathApi.resolve(selector);
+  const lexicalRelative = relativePathWithin(workspace, absolute, pathApi);
+  const resolved = realpathWithMissingSuffix(absolute, pathApi);
+  if (!resolved) return true;
+  const realRelative = relativePathWithin(workspace, resolved, pathApi);
+  if (lexicalRelative !== null && realRelative !== null) return [lexicalRelative, realRelative];
+  if (lexicalRelative !== null || realRelative !== null) return true;
+  // A glob outside the workspace can still expand into it (via a parent such as /tmp/*/node_modules/**
+  // or a symlinked entry under an unrelated directory); only literal outside paths are provably disjoint.
+  if (/[*?\[\]{}]/.test(selector)) return true;
+  return false;
+}
+function selectorMayIntersectRoot(selector, root, workspaceRoot) {
+  if (typeof selector !== 'string' || !selector.trim()) return true;
+  const absolute = absoluteSelectorRelatives(selector, workspaceRoot);
+  if (absolute === true) return true;
+  if (absolute === false) return false;
+  if (absolute !== null) return absolute.some(relative => relativeSelectorMayIntersectRoot(relative || '.', root));
+  return relativeSelectorMayIntersectRoot(selector, root);
+}
+function valueMayIntersectRoots(value, roots, workspaceRoot) {
+  if (typeof value === 'string') {
+    const absolute = absoluteSelectorRelatives(value, workspaceRoot);
+    if (absolute === true) return true;
+    if (absolute === false) return false;
+    if (absolute !== null) return roots.some(root => absolute.some(relative => {
+      const selector = relative || '.';
+      return rootMention(selector, root)
+        || ((selector.includes('/') || /[*?\[\]{}]/.test(selector)) && selectorMayIntersectRoot(selector, root, workspaceRoot));
+    }));
+    return roots.some(root => rootMention(value, root)
+      || ((!value.trim() || value.includes('/') || /[*?\[\]{}]/.test(value))
+        && selectorMayIntersectRoot(value, root, workspaceRoot)));
+  }
+  if (Array.isArray(value)) return value.some(item => valueMayIntersectRoots(item, roots, workspaceRoot));
+  if (U.record(value)) return Object.entries(value).some(([key, item]) => valueMayIntersectRoots(key, roots, workspaceRoot)
+    || valueMayIntersectRoots(item, roots, workspaceRoot));
+  return false;
+}
+function withoutTaskPinIdentity(value) {
+  if (Array.isArray(value)) return value.map(withoutTaskPinIdentity);
+  if (!U.record(value)) return value;
+  return Object.fromEntries(Object.entries(value)
+    .filter(([key]) => !/ids?$/i.test(key))
+    .map(([key, item]) => [key, withoutTaskPinIdentity(item)]));
+}
+function projectConfigFromBytes(bytes) {
+  try {
+    const config = JSON.parse(Buffer.from(bytes).toString('utf8'));
+    return { config, valid: validateDocsConfig(config).valid };
+  } catch { return { config: null, valid: false }; }
+}
+function baselineProjectConfig(baseline) {
+  const source = baseline.records.find(item => item.path === PROJECT_CONFIG_PATH && item.presence === 'present');
+  return source ? { source, ...projectConfigFromBytes(source.storedBytes) } : { source: null, config: null, valid: false };
+}
+function capturedProjectConfig(config) {
+  const source = config.capture.sources.find(item => item.path === PROJECT_CONFIG_PATH);
+  return source && source.presence === 'present'
+    ? { source, ...projectConfigFromBytes(source.bytes) }
+    : { source: source || null, config: null, valid: false };
+}
+function dependencyRoots(config) {
+  return U.record(config) && U.record(config.inventory)
+    && Object.prototype.hasOwnProperty.call(config.inventory, 'dependencyArtifactRoots')
+    ? config.inventory.dependencyArtifactRoots : undefined;
+}
+function sameRootField(left, right) {
+  if (left === undefined || right === undefined) return left === right;
+  return U.stable([...left].sort()) === U.stable([...right].sort());
+}
+function validateExcludedRoots(workspaceRoot, roots) {
+  const workspace = canonicalPath(workspaceRoot);
+  const states = [];
+  for (const root of roots) {
+    let parent = workspace;
+    let presence = 'present-directory';
+    for (const component of root.split('/')) {
+      let entries;
+      try { entries = fs.readdirSync(parent, { withFileTypes: true }); }
+      catch { fail('inventory-incomplete', 'dependency-root-parent-unreadable'); }
+      const aliases = entries.filter(entry => entry.name.normalize('NFC').toLowerCase() === component.normalize('NFC').toLowerCase());
+      if (aliases.length > 1 || aliases.some(entry => entry.name !== component)) fail('inventory-unsupported', 'dependency-root-alias');
+      const current = path.join(parent, component);
+      let stat;
+      try { stat = fs.lstatSync(current); }
+      catch (error) {
+        if (error.code === 'ENOENT') { presence = 'absent'; break; }
+        fail('inventory-incomplete', 'dependency-root-unreadable');
+      }
+      if (stat.isSymbolicLink() || !stat.isDirectory()) fail('inventory-unsupported', 'dependency-root-not-plain-directory');
+      let real;
+      try { real = fs.realpathSync.native(current); }
+      catch { fail('inventory-incomplete', 'dependency-root-unreadable'); }
+      const within = process.platform === 'win32'
+        ? real.toLowerCase().startsWith(`${workspace.toLowerCase()}${path.sep}`)
+        : real.startsWith(`${workspace}${path.sep}`);
+      if (!within) fail('inventory-unsupported', 'dependency-root-outside-workspace');
+      parent = current;
+    }
+    states.push({ path: root, presence });
+  }
+  return states;
+}
+function guardedPolicy(root, baseline, capturedConfig, input) {
+  const base = baselineProjectConfig(baseline);
+  const current = capturedProjectConfig(capturedConfig);
+  const baselineRoots = base.valid ? dependencyRoots(base.config) : undefined;
+  const candidateRoots = current.valid ? dependencyRoots(current.config) : undefined;
+  if (current.valid && candidateRoots !== undefined && (!base.valid || !sameRootField(baselineRoots, candidateRoots))) {
+    fail('inventory-unsupported', 'dependency-artifact-policy-changed-or-unpinned');
+  }
+  if (!base.valid || baselineRoots === undefined || baselineRoots.length === 0) return null;
+  if (!current.valid || !sameRootField(baselineRoots, candidateRoots)) fail('inventory-unsupported', 'dependency-artifact-policy-changed-or-unpinned');
+  const roots = [...baselineRoots].sort();
+  const indexed = git(root, ['ls-files', '-z']).toString('utf8').split('\0').filter(Boolean);
+  if (baseline.records.some(item => roots.some(value => pathUnderRoot(item.path, value)))) fail('inventory-unsupported', 'baseline-path-overlap');
+  if (indexed.some(item => roots.some(value => pathUnderRoot(item, value)))) fail('inventory-unsupported', 'index-path-overlap');
+  if (capturedConfig.capture.sources.some(item => roots.some(value => pathUnderRoot(item.path, value)))) {
+    fail('inventory-unsupported', 'config-source-overlap');
+  }
+  const configs = [base.config, capturedConfig.resolution.config];
+  if (configs.some(config => {
+    if (!U.record(config)) return false;
+    const selectors = Object.fromEntries(Object.entries(config).filter(([key]) => key !== 'inventory'));
+    return valueMayIntersectRoots(selectors, roots, root);
+  })) fail('inventory-unsupported', 'config-selector-overlap');
+  if (valueMayIntersectRoots(withoutTaskPinIdentity(input.task), roots, root) || valueMayIntersectRoots(input.scope, roots, root)) {
+    fail('inventory-unsupported', 'task-input-overlap');
+  }
+  return {
+    roots,
+    baselineCommit: baseline.commit,
+    storedBytesDigest: U.sha(base.source.storedBytes),
+    guardOutcomes: [
+      { guard: 'baseline-paths', state: 'clear', reason: 'No baseline path intersects an approved root.' },
+      { guard: 'index-paths', state: 'clear', reason: 'No current index path intersects an approved root.' },
+      { guard: 'config-sources', state: 'clear', reason: 'No baseline or current config source intersects an approved root.' },
+      { guard: 'config-selectors', state: 'clear', reason: 'Baseline and current config declarations are disjoint from approved roots.' },
+      { guard: 'task-inputs', state: 'clear', reason: 'No explicit task or requirement input intersects an approved root.' }
+    ]
+  };
+}
+function captureCandidate(root, baseline, excludedRoots = []) {
+  const excludedRootStates = excludedRoots.length ? validateExcludedRoots(root, excludedRoots) : [];
   const raw = [];
   let total = 0;
   let visited = 0;
@@ -72,8 +317,9 @@ function captureCandidate(root, baseline) {
     const entries = fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => U.compare(a.name, b.name));
     for (const entry of entries) {
       if (!prefix && entry.name === '.git') continue;
-      if (++visited > MAX_FILES) fail('inventory-unsupported');
       const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
+      if (excludedRoots.includes(relative)) continue;
+      if (++visited > MAX_FILES) fail('inventory-unsupported');
       const absolute = path.join(dir, entry.name);
       const stat = fs.lstatSync(absolute);
       if (stat.isDirectory()) {
@@ -102,7 +348,8 @@ function captureCandidate(root, baseline) {
     }
   }
   // Lifecycle owns text/eol/autocrlf conversion. A completeness walk above detects its skipped paths.
-  const stored = new Map(scanWorkspaceFiles(root).map(item => [item.path, item.bytes]));
+  const stored = new Map(convertWorkspaceFiles(root, raw.map(item => ({ path: item.path, bytes: item.raw })))
+    .map(item => [item.path, item.bytes]));
   const records = raw.map(item => {
     const converted = stored.get(item.path);
     if (!converted) fail('inventory-unsupported');
@@ -111,7 +358,7 @@ function captureCandidate(root, baseline) {
     return fileRecord(item.path, item.mode, converted);
   });
   for (const item of baseline.records) if (!stored.has(item.path)) records.push(fileRecord(item.path, '', Buffer.alloc(0), 'deleted'));
-  return records;
+  return { records, excludedRootStates };
 }
 const progressKeys = new Set(['status', 'state', 'evidence', 'loaded', 'loadedAt', 'updatedAt', 'createdAt', 'completedAt', 'timestamp', 'report', 'reports']);
 // Progress fields are excluded only at their defined record locations (top-level task/workflow, each
@@ -169,8 +416,20 @@ function produceDocSnapshot(input, dependencies = {}) {
     const baseline = captureBaseline(root, detached.baseline);
     const config = resolveDocsConfigCaptured(root, { activeHost: detached.activeHost });
     if (!['project', 'host'].includes(config.resolution.status) || config.capture.sources.some(s => s.presence === 'unreadable')) fail('config-unavailable');
-    const coverage = { kind: 'whole-project', excluded: ['.git'], scope: U.clone(detached.scope) };
-    const candidate = { records: captureCandidate(root, baseline), coverage };
+    const policy = guardedPolicy(root, baseline, config, detached);
+    const firstCapture = captureCandidate(root, baseline, policy?.roots || []);
+    const coverage = policy ? {
+      kind: 'project-with-dependency-artifact-exclusions',
+      policyVersion: POLICY_VERSION,
+      policySource: { path: PROJECT_CONFIG_PATH, baselineCommit: policy.baselineCommit, storedBytesDigest: policy.storedBytesDigest },
+      dependencyArtifactRoots: policy.roots,
+      excluded: ['.git', ...policy.roots],
+      excludedRootStates: firstCapture.excludedRootStates,
+      guardOutcomes: [...policy.guardOutcomes,
+        { guard: 'excluded-root-types', state: 'clear', reason: 'Each approved root is an in-workspace directory or absent.', roots: firstCapture.excludedRootStates }],
+      scope: U.clone(detached.scope)
+    } : { kind: 'whole-project', excluded: ['.git'], scope: U.clone(detached.scope) };
+    const candidate = { records: firstCapture.records, coverage };
     // Same owned config bytes must be the bytes covered by the working-tree capture.
     for (const source of config.capture.sources) {
       const file = candidate.records.find(r => r.path === source.path && r.presence === 'present');
@@ -189,18 +448,21 @@ function produceDocSnapshot(input, dependencies = {}) {
     const facts = derived.facts;
     const obligations = deriveDocObligations(facts);
     const derivationReasons = Object.fromEntries(obligations.map(o => [o.id, { applicability: o.applicability, reason: `captured facts derive ${o.capability}: ${o.applicability}`, factRefs: ['facts', ...(o.scope?.paths || []).map(p => `inventory:${p}`)] }]));
-    const again = captureCandidate(root, baseline);
+    const again = captureCandidate(root, baseline, policy?.roots || []);
     const configAgain = resolveDocsConfigCaptured(root, { activeHost: detached.activeHost });
+    const policyAgain = guardedPolicy(root, baseline, configAgain, detached);
     let finalContext;
     try { finalContext = contextFor(detached, originProvider); }
     catch { fail('snapshot-changed'); }
-    if (U.snapshotDigest('candidate', baseline, coverage, again) !== candidate.digest || U.configDigest(configAgain) !== config.digest
+    if (U.snapshotDigest('candidate', baseline, coverage, again.records) !== candidate.digest
+      || U.stable(again.excludedRootStates) !== U.stable(firstCapture.excludedRootStates)
+      || U.stable(policyAgain) !== U.stable(policy) || U.configDigest(configAgain) !== config.digest
       || U.stable(originContext) !== U.stable(finalContext)) fail('snapshot-changed');
     return { state: 'ready', snapshot: { identity, baseline, candidate, config, originContext, taskSemantics: planIdentity, facts, obligations, derivationReasons }, diagnostics: [] };
   } catch (error) {
     const codes = ['invalid-input', 'baseline-unavailable', 'inventory-incomplete', 'inventory-unsupported', 'snapshot-changed', 'config-unavailable', 'unsupported-prd-root', 'identity-mismatch', 'origin-unavailable', 'origin-untrusted'];
     const code = codes.includes(error.message) ? error.message : 'inventory-unsupported';
-    return { state: 'unavailable', snapshot: null, diagnostics: [U.diagnostic(code)] };
+    return { state: 'unavailable', snapshot: null, diagnostics: [U.diagnostic(code, error.reasonCode ? { reasonCode: error.reasonCode } : {})] };
   }
 }
 module.exports = { produceDocSnapshot };

package/plugins/harness-everything/hooks/scripts/lib/doc-reconciliation-provider.js

@@ -77,7 +77,7 @@ const OUTLINE_INVENTORY_PIN = Object.freeze({
   inputSha: '0ef0541c6cae550e8269ba712e03797e0e987dfb',
   approvalRef: { issue: 325, commentId: '6436207729', decision: 1 },
   rowDomainMappings: Object.freeze([Object.freeze({ rowIds: Object.freeze(['15', '16', '17', '18']),
-    sourceDomain: 'VERI', domain: 'EVID', approvalRef: '../e1-feasibility-2026-10-28/owner-decision-veri-evid.md' })]),
+    sourceDomain: 'VERI', domain: 'EVID', approvalRef: 'https://github.com/dyphn1/Harness-everything/issues/325#issuecomment-6706805112' })]),
   retainedArtifactPath: `inventory/${OUTLINE_INVENTORY_SHA256}.md`,
 });
 const OUTLINE_MARKER = 'HARNESS_OUTLINE_DISPATCH_V1';

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.47.4",
+  "version": "0.48.0",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/skills/code-review/SKILL.md

@@ -4,7 +4,7 @@ description: "Independently review a PR, diff or finished implementation for cor
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.40.0
+  version: 0.47.5
 ---
 
 # Code Review

package/plugins/harness-everything/skills/code-review/references/review-playbook.md

@@ -19,6 +19,15 @@ Use this checklist for the applicable risks; do not force irrelevant categories.
 - [ ] Follow each important diagnostic/fact through every consumer and ancestor. Check whether required facts are computed before derived authority, indexes, or output.
 - [ ] Compare new rules with previously accepted rules and controls. Separate display severity from safety prerequisites.
 
+## Check evidence a gate trusts
+
+Apply these when the change grades, gates or labels evidence. Authors SHOULD run them as a self-review before push.
+
+- [ ] **Claimed vs observed.** Separate what the subject reports about itself (a tool's `completed` status, a result marker, an agent-supplied expected value, a status label) from what the checker observes independently (exit code, output, a recomputed result, the quoted source). A self-report alone never passes; when nothing independent is observable, the result is inconclusive.
+- [ ] **Select, then judge.** When the last, first or any item of a sequence decides (last run, final message, latest attempt), select from every attempt in order before filtering by outcome. Test both orders: failure then success, and success then failure or no result.
+- [ ] **One witness per rule.** Give each detection rule a negative case that triggers only that rule; a case that also trips an exit code or another pattern cannot show the rule works. Probe positive cases at structural boundaries (inside a token, string or quote), not only at safe separators.
+- [ ] **Comparable subjects, honest labels.** A comparison or conflict needs both sides to describe the same target. A status name claims only what was checked: a consistent quote is not a validated diagnosis.
+
 ## Check tests and output
 
 - [ ] Ask whether each test still passes if the behavior is disabled, bypassed, or broken (mutation thought experiment). Confirm the test is included in CI.

package/plugins/harness-everything/skills/harness-everything/SKILL.md

@@ -4,7 +4,7 @@ description: "Route software/project work through Harness: classify tier/topolog
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.47.3
+  version: 0.48.0
 ---
 
 # Harness Everything

package/plugins/harness-everything/skills/harness-everything/scripts/doc-lifecycle.js

@@ -1701,6 +1701,15 @@ function parseInventoryDoc(relativePath, bytes) {
   };
 }
 
+function convertWorkspaceFiles(root, inventory) {
+  const files = (Array.isArray(inventory) ? inventory : []).map(item => ({
+    relative: item.path,
+    bytes: Buffer.from(item.bytes)
+  }));
+  const rules = readWorkingTreeRules(root, files.filter(item => item.bytes.includes(0x0d)).map(item => item.relative));
+  return files.map(item => ({ path: item.relative, bytes: workingStoredBytes(root, item.relative, item.bytes, rules) }));
+}
+
 function scanWorkspaceFiles(root, scope = null) {
   if (!root) return [];
   const workspace = path.resolve(root);
@@ -1728,8 +1737,7 @@ function scanWorkspaceFiles(root, scope = null) {
     }
   }
   walk(workspace, '');
-  const rules = readWorkingTreeRules(workspace, files.filter(item => item.bytes.includes(0x0d)).map(item => item.relative));
-  return files.map(item => ({ path: item.relative, bytes: workingStoredBytes(workspace, item.relative, item.bytes, rules) }));
+  return convertWorkspaceFiles(workspace, files.map(item => ({ path: item.relative, bytes: item.bytes })));
 }
 
 function scanWorkspaceInventory(root) {
@@ -2785,6 +2793,6 @@ function main(argv = process.argv.slice(2)) {
   return analysis.diagnostics.some(item => item.severity === 'error') ? 1 : 0;
 }
 
-module.exports = { readGitBaseInventory, scanWorkspaceFiles, parseFrontmatter, parseRequirementBlocks, collectDocs, documentCorpusPaths, analyzeDocs, resolveRef, lintDocs, buildIndex, buildIndexSnapshot, configSourceInventory, diffRevisions, buildGitDocumentInventory };
+module.exports = { readGitBaseInventory, scanWorkspaceFiles, convertWorkspaceFiles, parseFrontmatter, parseRequirementBlocks, collectDocs, documentCorpusPaths, analyzeDocs, resolveRef, lintDocs, buildIndex, buildIndexSnapshot, configSourceInventory, diffRevisions, buildGitDocumentInventory };
 
 if (require.main === module) process.exitCode = main();

package/plugins/harness-everything/skills/harness-everything/scripts/project-docs-resolver.js

@@ -21,6 +21,7 @@ const PROJECT_DOCS_CONFIG = path.join('.agents', 'harness-everything', 'project-
 const PROJECT_DOC_ROLES = Object.freeze(['prd', 'adr', 'ticket', 'reference', 'log', 'report']);
 const PROJECT_DOC_CONFIG_KEYS = new Set([
   'governed', 'domains', 'legacy', 'derived', 'tickets',
+  'inventory',
   'docLocation', 'tracker', 'issueDefinition', 'contextMap', 'contextMapPath',
   'decisionLocation', 'decisions', 'adrLocation', 'adr',
   'domainLocation', 'contextLocation', 'contexts', 'domain',
@@ -327,6 +328,17 @@ function validateDocsConfig(config) {
     }
   }
 
+  if (Object.prototype.hasOwnProperty.call(config, 'inventory')) {
+    const inventory = config.inventory;
+    const roots = inventory && inventory.dependencyArtifactRoots;
+    const supportedRoots = new Set(['node_modules', '.husky/_']);
+    if (!isPlainObject(inventory) || Object.keys(inventory).some(key => key !== 'dependencyArtifactRoots')
+      || !Array.isArray(roots) || roots.some(root => typeof root !== 'string' || !supportedRoots.has(root))
+      || new Set(roots).size !== roots.length) {
+      invalid('invalid-dependency-artifact-roots', 'inventory.dependencyArtifactRoots must contain distinct exact roots from node_modules and .husky/_');
+    }
+  }
+
   if (Object.prototype.hasOwnProperty.call(config, 'tickets') &&
       config.tickets !== 'tracker' && !isRepoRelativePath(config.tickets)) {
     invalid('invalid-tickets', 'tickets must be "tracker" or a repo-relative path');

package/plugins/harness-everything/skills/multi-agent-workspace/SKILL.md

@@ -4,7 +4,7 @@ description: "Scaffold a verified multi-agent workspace and select bounded speci
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.39.0
+  version: 0.48.0
 ---
 
 # Multi-Agent Workspace

package/plugins/harness-everything/skills/multi-agent-workspace/scripts/project-docs-resolver.js

@@ -21,6 +21,7 @@ const PROJECT_DOCS_CONFIG = path.join('.agents', 'harness-everything', 'project-
 const PROJECT_DOC_ROLES = Object.freeze(['prd', 'adr', 'ticket', 'reference', 'log', 'report']);
 const PROJECT_DOC_CONFIG_KEYS = new Set([
   'governed', 'domains', 'legacy', 'derived', 'tickets',
+  'inventory',
   'docLocation', 'tracker', 'issueDefinition', 'contextMap', 'contextMapPath',
   'decisionLocation', 'decisions', 'adrLocation', 'adr',
   'domainLocation', 'contextLocation', 'contexts', 'domain',
@@ -327,6 +328,17 @@ function validateDocsConfig(config) {
     }
   }
 
+  if (Object.prototype.hasOwnProperty.call(config, 'inventory')) {
+    const inventory = config.inventory;
+    const roots = inventory && inventory.dependencyArtifactRoots;
+    const supportedRoots = new Set(['node_modules', '.husky/_']);
+    if (!isPlainObject(inventory) || Object.keys(inventory).some(key => key !== 'dependencyArtifactRoots')
+      || !Array.isArray(roots) || roots.some(root => typeof root !== 'string' || !supportedRoots.has(root))
+      || new Set(roots).size !== roots.length) {
+      invalid('invalid-dependency-artifact-roots', 'inventory.dependencyArtifactRoots must contain distinct exact roots from node_modules and .husky/_');
+    }
+  }
+
   if (Object.prototype.hasOwnProperty.call(config, 'tickets') &&
       config.tickets !== 'tracker' && !isRepoRelativePath(config.tickets)) {
     invalid('invalid-tickets', 'tickets must be "tracker" or a repo-relative path');

package/plugins/harness-everything/skills/tdd/SKILL.md

@@ -4,7 +4,7 @@ description: "Drive Standard Tasks (Tier 2) with Test-Driven Development (RED/GR
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.13.0
+  version: 0.47.5
 ---
 
 # Test-Driven Development

package/plugins/harness-everything/skills/tdd/fixtures/quality-scenarios.json

@@ -8,8 +8,16 @@
     { "name": "weighted integration failure", "mutation": "the 0.15 positive dimension scores zero", "expectedScore": 85, "expectedResult": "FAIL" },
     { "name": "weighted unit failure", "mutation": "unit determinism is N/A and the 0.15 positive dimension scores zero", "expectedScore": 83.33, "expectedResult": "FAIL" },
     { "name": "NON_CONFORMANT", "mutation": "sourceConformance = NON_CONFORMANT", "expectedResult": "FAIL" },
-    { "name": "SOURCE_DEFECT", "mutation": "sourceValidity = SOURCE_DEFECT and sourceNotes is present", "expectedResult": "PASS" },
-    { "name": "SOURCE_CONFLICT", "mutation": "sourceValidity = SOURCE_CONFLICT with a traced additional source", "expectedResult": "FAIL" },
+    { "name": "SOURCE_DEFECT", "mutation": "sourceValidity = SOURCE_DEFECT, sourceNotes is present, and sourceEvidence quotes the defective assertion against the observed value; sourceEvidenceStatus is REVIEWER_REQUIRED, never VERIFIED, because a single-source mismatch does not prove the source is wrong", "expectedResult": "PASS" },
+    { "name": "SOURCE_DEFECT without sourceEvidence", "mutation": "sourceValidity = SOURCE_DEFECT with sourceNotes but no sourceEvidence", "expectedResult": "FAIL" },
+    { "name": "SOURCE_CONFLICT", "mutation": "sourceValidity = SOURCE_CONFLICT with a traced additional source and sourceEvidence quoting both sources", "expectedResult": "FAIL" },
+    { "name": "SOURCE_CONFLICT without sourceEvidence", "mutation": "sourceValidity = SOURCE_CONFLICT with two authoritative sources but no sourceEvidence", "expectedResult": "FAIL" },
+    { "name": "SOURCE_CONFLICT node-versus-value", "mutation": "sourceValidity = SOURCE_CONFLICT citing only expect(list.head.value).toEqual(1) from one spec, observed value is an Element object", "expectedEvidence": "REJECTED", "expectedResult": "FAIL" },
+    { "name": "SOURCE_CONFLICT agreeing expectations", "mutation": "sourceValidity = SOURCE_CONFLICT with two sources expecting the same value and a failing observed value; the mismatch is implementation behaviour", "expectedEvidence": "REJECTED", "expectedResult": "FAIL" },
+    { "name": "SOURCE_CONFLICT two-source evidence", "mutation": "sourceValidity = SOURCE_CONFLICT with two authoritative sources quoting disagreeing expectations for the same subject list.head and a failing observed value; one quote (toBeInstanceOf) is not mechanically checkable, so sourceEvidenceStatus is REVIEWER_REQUIRED and the unresolved conflict gate stays closed", "expectedEvidence": "ACCEPTED", "expectedResult": "FAIL" },
+    { "name": "SOURCE_CONFLICT relabelled expected", "mutation": "sourceValidity = SOURCE_CONFLICT with two authoritative sources quoting the identical assertion expect(list.head).toEqual(1) but expected values 1 and 3; each expected must match its quoted literal, so the second entry is rejected", "expectedEvidence": "REJECTED", "expectedResult": "FAIL" },
+    { "name": "SOURCE_CONFLICT verified literal disagreement", "mutation": "sourceValidity = SOURCE_CONFLICT with two authoritative sources quoting expect(list.head.value).toBe(1) and expect(list.head.value).toBe('1') with matching expected values 1 and '1' and a failing observed value; sourceEvidenceStatus is VERIFIED and the unresolved conflict gate stays closed", "expectedEvidence": "ACCEPTED", "expectedResult": "FAIL" },
+    { "name": "SOURCE_CONFLICT unrelated assertions", "mutation": "sourceValidity = SOURCE_CONFLICT quoting expect(foo).toEqual(1) from one source and expect(bar).toEqual(3) from another; unequal expectations about different subjects", "expectedEvidence": "REJECTED", "expectedResult": "FAIL" },
     { "name": "malformed input", "mutation": "requirements is not an array", "expectedResult": "FAIL" },
     { "name": "unexpected input", "mutation": "one unexpectedInput check is FAIL", "expectedResult": "FAIL" },
     { "name": "error handling", "mutation": "one errorHandling check is SKIPPED", "expectedResult": "FAIL" },

package/plugins/harness-everything/skills/tdd/references/quality-model.md

@@ -2,6 +2,8 @@
 
 This model turns each source requirement into auditable evidence. The authoritative source remains the contract even when it appears wrong. Record a suspected documentation problem as `SOURCE_DEFECT`; record disagreement between traced sources as `SOURCE_CONFLICT`. Never reinterpret either into a passing implementation. If no authoritative source exists, use `INFERRED` and state the inference basis.
 
+Before declaring either outcome, `sourceEvidence` quotes the exact conflicting assertions, names each declared source by path, and compares each `expected` value with the `observed` value from the run. A `SOURCE_CONFLICT` needs at least two distinct sources whose expected values disagree about the same `subject` — the contract target each quoted assertion constrains, written as it appears in the quote (`list.head` is not `list.head.value`). Unequal expectations about unrelated targets are not a conflict. If the quoted expectations agree and the run still fails, the mismatch is in the implementation: record `NON_CONFORMANT`, not `SOURCE_CONFLICT`. Each `expected` must match a mechanically readable literal in the quoted assertion (`toEqual`, `toStrictEqual`, `toBe`, or `assert.*` with a JSON or single-quoted literal); otherwise the claim is marked `REVIEWER_REQUIRED` and the gate does not treat it as an established disagreement. `VERIFIED` applies only to a `SOURCE_CONFLICT` whose two quoted literals disagree. A `SOURCE_DEFECT` is always `REVIEWER_REQUIRED`, because a mismatch with the observed value does not prove the source is wrong; the implementation may be the one at fault.
+
 ## Profile contract
 
 Every requirement declares exactly one `testProfile`: `unit` or `integration`. The selected profile defines which case classes are applicable; the common scoring and source rules do not make every test use identical evidence.

package/plugins/harness-everything/skills/tdd/schemas/quality-evidence.schema.json

@@ -149,6 +149,18 @@
         }
       ]
     },
+    "sourceEvidence": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["source", "assertion", "expected", "observed"],
+      "properties": {
+        "source": { "type": "string", "minLength": 1 },
+        "subject": { "type": "string", "minLength": 1 },
+        "assertion": { "type": "string", "minLength": 1 },
+        "expected": {},
+        "observed": {}
+      }
+    },
     "requirement": {
       "type": "object",
       "additionalProperties": false,
@@ -161,6 +173,7 @@
         "sourceConformance": { "enum": ["PASS", "NON_CONFORMANT"] },
         "sourceValidity": { "enum": ["VALID", "SOURCE_DEFECT", "SOURCE_CONFLICT"] },
         "sourceNotes": { "type": "string", "minLength": 1 },
+        "sourceEvidence": { "type": "array", "items": { "$ref": "#/$defs/sourceEvidence" } },
         "skippedTests": { "type": "array" },
         "flakyTests": { "type": "array" },
         "naDeclarations": { "type": "array" },
@@ -186,6 +199,14 @@
         }
       },
       "allOf": [
+        {
+          "if": { "required": ["sourceValidity"], "properties": { "sourceValidity": { "enum": ["SOURCE_DEFECT", "SOURCE_CONFLICT"] } } },
+          "then": { "required": ["sourceEvidence"], "properties": { "sourceEvidence": { "minItems": 1 } } }
+        },
+        {
+          "if": { "required": ["sourceValidity"], "properties": { "sourceValidity": { "const": "SOURCE_CONFLICT" } } },
+          "then": { "properties": { "sourceEvidence": { "items": { "required": ["subject"] } } } }
+        },
         {
           "if": {
             "required": ["testProfile"],

package/plugins/harness-everything/skills/tdd/schemas/quality-report.schema.json

@@ -96,6 +96,8 @@
         "sourceConformance": { "enum": ["PASS", "NON_CONFORMANT", null] },
         "sourceValidity": { "enum": ["VALID", "SOURCE_DEFECT", "SOURCE_CONFLICT", null] },
         "sourceNotes": { "type": "string" },
+        "sourceEvidence": { "type": "array" },
+        "sourceEvidenceStatus": { "enum": ["VERIFIED", "REVIEWER_REQUIRED"], "description": "VERIFIED only for a SOURCE_CONFLICT whose two quoted literals disagree; SOURCE_DEFECT is always REVIEWER_REQUIRED." },
         "dimensions": { "$ref": "#/$defs/dimensions" },
         "skippedTests": { "type": "array" },
         "flakyTests": { "type": "array" },