harness-everything 0.5.0 → 0.5.2

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.5.0",
+      "version": "0.5.2",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "author": {
     "name": "Miya Daniel"
   },

package/.github/workflows/ci.yml

@@ -45,6 +45,25 @@ jobs:
       - name: Verify installer contract on Node 22
         run: node ci/installer-roundtrip.test.js
 
+  release-semantics:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+      - name: Install project dependencies
+        run: npm ci
+      - name: Install pinned semantic-release analyzer tooling
+        run: >-
+          npm install --no-save --package-lock=false --ignore-scripts
+          @semantic-release/commit-analyzer@13.0.1
+          conventional-changelog-conventionalcommits@10.4.0
+      - name: Verify semantic-release against real Git histories
+        run: npm run test:release:semantics
+
   skill-quality:
     runs-on: ubuntu-latest
     steps:

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.5.2](https://github.com/dyphn1/Harness-everything/compare/v0.5.1...v0.5.2) (2026-09-16)
+
+### Bug Fixes
+
+* **release:** close semantic-release contract gaps ([79d2a76](https://github.com/dyphn1/Harness-everything/commit/79d2a76c931eaaa8928334877ca2b1195e06cce4))
+
+## [0.5.1](https://github.com/dyphn1/Harness-everything/compare/v0.5.0...v0.5.1) (2026-09-16)
+
+### Bug Fixes
+
+* **rule-of-3:** parse Claude failure hook payload ([83d3106](https://github.com/dyphn1/Harness-everything/commit/83d310653d19fd72f597d119eface1c3baf5a7bd))
+* **rule-of-3:** wire Claude failure hook to tracker ([11b3e9e](https://github.com/dyphn1/Harness-everything/commit/11b3e9e7a08b0394d2dd3dac78bd1464ae5881df))
+
 ## [0.5.0](https://github.com/dyphn1/Harness-everything/compare/v0.4.4...v0.5.0) (2026-09-16)
 
 ### Features

package/ci/mechanism-2a-rule-of-3.test.js

@@ -4,6 +4,70 @@ const helper = require('./test-helper');
 
 console.log('\n[2a] Rule of 3 circuit breaker...');
 
+const hooksConfig = JSON.parse(
+  fs.readFileSync(path.join(helper.root, 'hooks', 'hooks.json'), 'utf8')
+);
+const failureTrackerHook = (hooksConfig.hooks.PostToolUseFailure || [])
+  .find(entry => entry.id === 'harness:post-failure:rule-of-3-tracker');
+helper.check(
+  '2a-claude-wiring. PostToolUseFailure invokes the Rule-of-3 tracker',
+  failureTrackerHook &&
+    failureTrackerHook.matcher === 'Bash|PowerShell' &&
+    failureTrackerHook.hooks?.some(hook => hook.command.includes('rule-of-3-tracker.js')),
+  `Hook=${JSON.stringify(failureTrackerHook)}`
+);
+
+const claudeFailurePayload = {
+  hook_event_name: 'PostToolUseFailure',
+  tool_name: 'Bash',
+  tool_input: { command: 'node -e "process.exit(1)"' },
+  error: 'Exit code 1\ncommand failed',
+  session_id: helper.SESSION_ID,
+};
+const failureRuns = [1, 2, 3].map(() =>
+  helper.runHook('rule-of-3-tracker.js', claudeFailurePayload)
+);
+const trackedFailureState = helper.readState('rule-of-3-state.json');
+helper.check(
+  '2a-claude-failure. PostToolUseFailure error payload increments the same signature to threshold',
+  failureRuns.every(result => result.code === 0) &&
+    trackedFailureState.count === 3 &&
+    trackedFailureState.threshold === 3 &&
+    trackedFailureState.lastHash &&
+    trackedFailureState.zoomOutResolved === false,
+  `Runs=${JSON.stringify(failureRuns)}, state=${JSON.stringify(trackedFailureState)}`
+);
+
+const claudeTripResult = helper.runHook('rule-of-3.js', {
+  hook_event_name: 'PreToolUse',
+  tool_name: 'Bash',
+  tool_input: { command: 'echo retry' },
+  session_id: helper.SESSION_ID,
+});
+helper.check(
+  '2a-claude-trip. Tracked Claude failures block the next mutation',
+  claudeTripResult.code === 2 &&
+    claudeTripResult.stderr.includes('RULE OF 3 CIRCUIT BREAKER TRIGGERED'),
+  `Got exit=${claudeTripResult.code}, stderr="${claudeTripResult.stderr.slice(0, 200)}"`
+);
+
+const successResult = helper.runHook('rule-of-3-tracker.js', {
+  hook_event_name: 'PostToolUse',
+  tool_name: 'Bash',
+  tool_input: { command: 'echo success' },
+  tool_response: { stdout: 'success', stderr: '', exitCode: 0 },
+  session_id: helper.SESSION_ID,
+});
+const resetState = helper.readState('rule-of-3-state.json');
+helper.check(
+  '2a-claude-success. Confirmed PostToolUse success keeps the existing reset behavior',
+  successResult.code === 0 &&
+    resetState.count === 0 &&
+    resetState.zoomOutResolved === true &&
+    resetState.zoomOutCycles === 0,
+  `Got exit=${successResult.code}, state=${JSON.stringify(resetState)}`
+);
+
 helper.writeState('rule-of-3-state.json', { count: 3, lastHash: 'mech-test', zoomOutResolved: false });
 const tripResult = helper.runHook('rule-of-3.js', { session_id: helper.SESSION_ID });
 helper.check(

package/ci/mechanism-2x-release-automation.test.js

@@ -52,12 +52,12 @@ for (const invalid of ['1.2.3-beta', '1.2.3+build', '01.2.3', '1.2', 'v1.2.3', '
   assert.ok(!isStableSemVer(invalid), invalid);
 }
 
-// Normal CI gates every checked-in runtime/plugin manifest against package.json.
-// package-lock is intentionally release-owned: the synchronizer fixes its root
-// version when semantic-release prepares the actual release transaction.
+// Once semantic-release has established the stable release line, every
+// release-owned checked-in version target must remain in lockstep. This is a
+// normal CI invariant, not something deferred until the next release run.
 const packageVersion = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8')).version;
 assert.ok(isStableSemVer(packageVersion), `package.json must use stable SemVer, got ${packageVersion}`);
-for (const target of VERSION_TARGETS.filter(target => target.file !== 'package-lock.json')) {
+for (const target of VERSION_TARGETS) {
   const data = JSON.parse(fs.readFileSync(path.join(ROOT, target.file), 'utf8'));
   const current = target.get(data);
   const values = Array.isArray(current) ? current : [current];
@@ -120,6 +120,17 @@ json(portable, tampered);
 assert.throws(() => syncReleaseVersion(root, '1.2.3', { checkOnly: true }), /Release version drift/);
 assert.throws(() => syncReleaseVersion(root, '1.2.3-beta'), /stable SemVer/);
 
+const lockDrift = fixture();
+syncReleaseVersion(lockDrift, '1.2.3');
+const driftedLock = JSON.parse(fs.readFileSync(path.join(lockDrift, 'package-lock.json'), 'utf8'));
+driftedLock.packages[''].version = '1.2.2';
+json(path.join(lockDrift, 'package-lock.json'), driftedLock);
+assert.throws(
+  () => syncReleaseVersion(lockDrift, '1.2.3', { checkOnly: true }),
+  /package-lock\.json/,
+  'release verification must reject package-lock drift'
+);
+
 const missing = fixture();
 const packageBefore = fs.readFileSync(path.join(missing, 'package.json'), 'utf8');
 fs.rmSync(path.join(missing, 'opencode-plugin/plugin.json'));
@@ -154,4 +165,4 @@ assert.strictEqual(versionOfSkill(path.join(changed, 'alpha/nested/SKILL.md')),
 assert.strictEqual(versionOfSkill(path.join(changed, 'beta/SKILL.md')), '0.1.0');
 syncReleaseVersion(changed, '0.2.0', { base: 'v0.1.0', checkOnly: true });
 
-console.log('Release automation contract verified: stable SemVer rules, changed-skill versioning, manifest sync, drift detection, idempotency, and fail-before-write behavior.');
+console.log('Release automation contract verified: stable SemVer rules, full manifest lockstep, changed-skill versioning, drift detection, idempotency, and fail-before-write behavior.');

package/ci/semantic-release-analyzer.test.mjs

@@ -0,0 +1,79 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { analyzeCommits } from '@semantic-release/commit-analyzer';
+
+const ROOT = path.resolve(import.meta.dirname, '..');
+const config = JSON.parse(fs.readFileSync(path.join(ROOT, '.releaserc.json'), 'utf8'));
+const analyzer = config.plugins.find(plugin => Array.isArray(plugin) && plugin[0] === '@semantic-release/commit-analyzer');
+assert.ok(analyzer, 'commit analyzer configuration missing');
+
+function git(root, args) {
+  return execFileSync('git', args, { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+}
+
+function history(messages) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-semantic-history-'));
+  try {
+    git(root, ['init']);
+    git(root, ['config', 'user.email', 'release-test@example.com']);
+    git(root, ['config', 'user.name', 'Release Test']);
+    git(root, ['commit', '--allow-empty', '-m', 'chore: baseline']);
+    git(root, ['tag', 'v1.0.0']);
+
+    for (const message of messages) {
+      git(root, ['commit', '--allow-empty', '-m', message]);
+    }
+
+    const log = execFileSync(
+      'git',
+      ['log', '--reverse', '--format=%B%x00', 'v1.0.0..HEAD'],
+      { cwd: root, encoding: 'utf8' }
+    );
+    return log.split('\0').map(message => message.trim()).filter(Boolean);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
+async function releaseType(messages) {
+  const commits = history(messages).map((message, index) => ({
+    hash: `fixture-${index}`,
+    message
+  }));
+  return analyzeCommits(analyzer[1], {
+    commits,
+    logger: { log() {} }
+  });
+}
+
+assert.equal(await releaseType(['fix(cache): repair invalidation']), 'patch', 'fix-only history must release patch');
+assert.equal(
+  await releaseType(['fix(cache): repair invalidation', 'feat(router): add route']),
+  'minor',
+  'feat must dominate patch commits'
+);
+assert.equal(
+  await releaseType(['fix(cache): repair invalidation', 'feat(api)!: replace runtime contract']),
+  'major',
+  'breaking ! must dominate lower release types'
+);
+assert.equal(
+  await releaseType(['feat(api): replace shape\n\nBREAKING CHANGE: remove legacy shape']),
+  'major',
+  'BREAKING CHANGE footer must produce major'
+);
+assert.equal(
+  (await releaseType(['docs: update guide', 'test: cover retry', 'ci: tune matrix'])) ?? null,
+  null,
+  'docs/test/ci-only history must not release'
+);
+assert.equal(
+  (await releaseType(['chore(release): 1.0.1 [skip ci]'])) ?? null,
+  null,
+  'generated release commit must not recurse into another release'
+);
+
+console.log('Semantic-release analyzer verified against real temporary Git histories: patch, minor, major, no-release, and recursion guard.');

package/docs/repository-contract.md

@@ -19,7 +19,7 @@ This page is generated from checked-in runtime and workflow sources. Do not edit
 | Workflow | Node.js versions | Explicit triggers | npm quality gates |
 | --- | --- | --- | --- |
 | `behavioral-evals.yml` | 24 | schedule, workflow_dispatch | n/a |
-| `ci.yml` | 22, 24 | workflow_call | `test`, `test:mutations`, `test:consistency`, `test:references`, `test:release`, `test:collision`, `test:plugin:openai`, `test:plugin:submission`, `test:platform:compatibility` |
+| `ci.yml` | 22, 24 | workflow_call | `test`, `test:mutations`, `test:release:semantics`, `test:consistency`, `test:references`, `test:release`, `test:collision`, `test:plugin:openai`, `test:plugin:submission`, `test:platform:compatibility` |
 | `release.yml` | 24 | workflow_dispatch | n/a |
 
 ## Drift prevention

package/hooks/hooks.json

@@ -194,6 +194,17 @@
         ],
         "description": "Record that an approved action-gate payload executed but failed",
         "id": "harness:post-failure:action-gate-audit"
+      },
+      {
+        "matcher": "Bash|PowerShell",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/rule-of-3-tracker.js\""
+          }
+        ],
+        "description": "Track failed tool error signatures for Rule of 3",
+        "id": "harness:post-failure:rule-of-3-tracker"
       }
     ]
   }

package/hooks/scripts/rule-of-3-tracker.js

@@ -4,7 +4,7 @@ const path = require('path');
 const crypto = require('crypto');
 const { getWorkspaceRoot, getSessionDir } = require('./lib/harness-state');
 
-// PostToolUse hooks in Claude Code typically receive the tool output via stdin
+// PostToolUse/PostToolUseFailure hooks in Claude Code receive their payload via stdin
 let inputData = '';
 
 process.stdin.on('data', chunk => {
@@ -14,18 +14,23 @@ process.stdin.on('data', chunk => {
 process.stdin.on('end', () => {
   try {
     const payload = JSON.parse(inputData);
+    const hookEventName = payload.hook_event_name || payload.hookEventName || '';
+    const isFailureEvent = hookEventName === 'PostToolUseFailure';
     const toolResponse = payload.tool_response || {};
     const stdout = toolResponse.stdout ?? payload.stdout ?? '';
     const stderr = toolResponse.stderr ?? payload.stderr ?? '';
-    const rawExitCode = toolResponse.exitCode ?? toolResponse.exit_code ?? payload.exitCode;
+    const failureText = typeof payload.error === 'string' ? payload.error : '';
+    const rawExitCode = toolResponse.exitCode ?? toolResponse.exit_code ?? payload.exitCode ?? payload.exit_code;
     const exitCode = typeof rawExitCode === 'number' ? rawExitCode : undefined;
 
     const explicitFailure = exitCode !== undefined && exitCode !== 0;
     const explicitSuccess = exitCode === 0;
     const stderrSignal = typeof stderr === 'string' && stderr.trim().length > 0;
     const looksLikeError = /\b(error|fail|failed|failure|exception|fatal|panic|traceback|denied|refused|cannot|unable)\b/i.test(stderr);
-    const isFailure = explicitFailure || (exitCode === undefined && stderrSignal && looksLikeError);
-    const errorText = (stderrSignal ? stderr : stdout) || '';
+    const isFailure = isFailureEvent || explicitFailure || (exitCode === undefined && stderrSignal && looksLikeError);
+    const errorText = isFailureEvent
+      ? (failureText || (stderrSignal ? stderr : stdout) || '')
+      : ((stderrSignal ? stderr : stdout) || failureText || '');
 
     const root = getWorkspaceRoot(payload);
     const stateFile = path.join(getSessionDir(root, payload.session_id || payload.sessionId), 'rule-of-3-state.json');
@@ -108,7 +113,7 @@ process.stdin.on('end', () => {
       state.lastFailureAt = Date.now();
 
       fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), 'utf8');
-    } else if (explicitSuccess) {
+    } else if (!isFailureEvent && explicitSuccess) {
       // Only reset on a *confirmed* zero exit code, not merely "not a failure".
       if (state.count > 0 || state.zoomOutCycles > 0) {
         state.count = 0;

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {
@@ -20,6 +20,7 @@
     "test:docs:capabilities": "node ci/doc-capability-consistency.test.js",
     "test:references": "node ci/reference-check.js",
     "test:release": "node ci/release-consistency-check.js && node ci/mechanism-2x-release-automation.test.js && node ci/mechanism-2x-release-commit-message.test.js",
+    "test:release:semantics": "node ci/semantic-release-analyzer.test.mjs",
     "test:install": "node scripts/verify-install.js",
     "test:collision": "node ci/description-collision.js",
     "test:routing:skills": "node ci/skill-routing-check.js",

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/hooks/scripts/rule-of-3-tracker.js

@@ -4,7 +4,7 @@ const path = require('path');
 const crypto = require('crypto');
 const { getWorkspaceRoot, getSessionDir } = require('./lib/harness-state');
 
-// PostToolUse hooks in Claude Code typically receive the tool output via stdin
+// PostToolUse/PostToolUseFailure hooks in Claude Code receive their payload via stdin
 let inputData = '';
 
 process.stdin.on('data', chunk => {
@@ -14,18 +14,23 @@ process.stdin.on('data', chunk => {
 process.stdin.on('end', () => {
   try {
     const payload = JSON.parse(inputData);
+    const hookEventName = payload.hook_event_name || payload.hookEventName || '';
+    const isFailureEvent = hookEventName === 'PostToolUseFailure';
     const toolResponse = payload.tool_response || {};
     const stdout = toolResponse.stdout ?? payload.stdout ?? '';
     const stderr = toolResponse.stderr ?? payload.stderr ?? '';
-    const rawExitCode = toolResponse.exitCode ?? toolResponse.exit_code ?? payload.exitCode;
+    const failureText = typeof payload.error === 'string' ? payload.error : '';
+    const rawExitCode = toolResponse.exitCode ?? toolResponse.exit_code ?? payload.exitCode ?? payload.exit_code;
     const exitCode = typeof rawExitCode === 'number' ? rawExitCode : undefined;
 
     const explicitFailure = exitCode !== undefined && exitCode !== 0;
     const explicitSuccess = exitCode === 0;
     const stderrSignal = typeof stderr === 'string' && stderr.trim().length > 0;
     const looksLikeError = /\b(error|fail|failed|failure|exception|fatal|panic|traceback|denied|refused|cannot|unable)\b/i.test(stderr);
-    const isFailure = explicitFailure || (exitCode === undefined && stderrSignal && looksLikeError);
-    const errorText = (stderrSignal ? stderr : stdout) || '';
+    const isFailure = isFailureEvent || explicitFailure || (exitCode === undefined && stderrSignal && looksLikeError);
+    const errorText = isFailureEvent
+      ? (failureText || (stderrSignal ? stderr : stdout) || '')
+      : ((stderrSignal ? stderr : stdout) || failureText || '');
 
     const root = getWorkspaceRoot(payload);
     const stateFile = path.join(getSessionDir(root, payload.session_id || payload.sessionId), 'rule-of-3-state.json');
@@ -108,7 +113,7 @@ process.stdin.on('end', () => {
       state.lastFailureAt = Date.now();
 
       fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), 'utf8');
-    } else if (explicitSuccess) {
+    } else if (!isFailureEvent && explicitSuccess) {
       // Only reset on a *confirmed* zero exit code, not merely "not a failure".
       if (state.count > 0 || state.zoomOutCycles > 0) {
         state.count = 0;

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",