harness-everything 0.6.0 → 0.7.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.6.0",
+      "version": "0.7.0",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "author": {
     "name": "Miya Daniel"
   },

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.7.0](https://github.com/dyphn1/Harness-everything/compare/v0.6.1...v0.7.0) (2026-09-17)
+
+### Features
+
+* **router:** make routing checkpoint observable ([#139](https://github.com/dyphn1/Harness-everything/issues/139)) ([97dc06d](https://github.com/dyphn1/Harness-everything/commit/97dc06d6b07747ba5e9c328838b8d535c9585b00)), closes [#282](https://github.com/dyphn1/Harness-everything/issues/282)
+
+## [0.6.1](https://github.com/dyphn1/Harness-everything/compare/v0.6.0...v0.6.1) (2026-09-17)
+
+### Bug Fixes
+
+* **hooks:** harden atomic commit and destructive action gates ([#132](https://github.com/dyphn1/Harness-everything/issues/132)) ([e7dee3a](https://github.com/dyphn1/Harness-everything/commit/e7dee3aed9bc2c2922151743e573f62ecdd60039)), closes [#90](https://github.com/dyphn1/Harness-everything/issues/90) [#100](https://github.com/dyphn1/Harness-everything/issues/100)
+
 ## [0.6.0](https://github.com/dyphn1/Harness-everything/compare/v0.5.3...v0.6.0) (2026-09-17)
 
 ### Features

package/ci/invariant-routing.test.js

@@ -40,6 +40,14 @@ check(tier2.stdout.includes('tdd:'), 'Tier 2 can still recommend TDD');
 check(!tier2.stdout.includes('BASE EXECUTION LOOP'), 'legacy fixed base-execution-loop output is suppressed');
 check(tier2.stdout.includes('Do not enforce workflow order'), 'self-orchestration policy is explicit');
 
+const tier2Checkpoints = tier2.stdout.match(/HARNESS ROUTING CHECKPOINT \(REQUIRED VISIBLE STATE\)/g) || [];
+check(tier2Checkpoints.length === 1, 'Tier 2 emits exactly one required routing checkpoint');
+check(tier2.stdout.includes('- Tier: Tier 2'), 'checkpoint exposes the human-readable Tier 2');
+check(tier2.stdout.includes('- Strategy: iterative-single'), 'checkpoint exposes the selected strategy');
+check(/- Required invariants: .*verify-before-claim/.test(tier2.stdout), 'checkpoint exposes required invariants');
+check(/- Suggested skills: .*tdd/.test(tier2.stdout), 'checkpoint exposes deduplicated suggestions');
+check(tier2.stdout.includes('If all are skipped, state one brief reason'), 'non-empty suggestions carry an all-skipped rationale contract');
+
 const tier3 = spawnSync(process.execPath, [kernel, 'audit the entire repository architecture and coordinate multiple modules'], {
   cwd: ROOT,
   encoding: 'utf8',
@@ -49,11 +57,14 @@ check(/RECOMMENDED TIER:\s*Tier 3/i.test(tier3.stdout), 'macro task remains Tier
 check(tier3.stdout.includes('"strategy":"fable-staged"'), 'Tier 3 dependent/unproven work selects fable-staged');
 check(tier3.stdout.includes('fable-mode / fable-discipline'), 'Tier 3 selected plan suggests Fable capabilities');
 check(tier3.stdout.includes('suggested skills remain advisory'), 'Tier 3 suggestions remain non-mandatory');
+check(tier3.stdout.includes('HARNESS ROUTING CHECKPOINT (REQUIRED VISIBLE STATE)'), 'Tier 3 also emits the required routing checkpoint');
 
 const harnessSkill = read('harness-everything/SKILL.md');
 check(!/Requests that already name a skill/i.test(harnessSkill), 'harness entrypoint no longer opts out when another skill is named');
 check(/including work that already names or strongly matches another skill/i.test(harnessSkill), 'named domain skills still pass through Harness routing');
 check(/not a fixed pipeline/i.test(harnessSkill), 'skill contract rejects fixed pipeline semantics');
+check(/Ensure the emitted \*\*Harness Routing Checkpoint\*\* is user-visible/.test(harnessSkill), 'skill contract requires checkpoint visibility');
+check(/If suggestions are non-empty and you use none, state one brief skip reason/.test(harnessSkill), 'skill contract requires rationale only when all suggestions are skipped');
 
 const cognitiveSkill = read('install-cognitive-os/SKILL.md');
 check(/policy, not a required peer-skill selection/i.test(cognitiveSkill), 'Cognitive OS is defined as policy rather than peer-skill dependency');
@@ -69,6 +80,10 @@ check(triageDoc.includes('Do not enforce workflow order. Enforce workflow invari
 check(triageDoc.includes('A tier is **not** a fixed pipeline'), 'tier documentation rejects rigid orchestration');
 check(!triageDoc.includes('MUST load `todo-driven-workflow`'), 'documentation no longer mandates TODO as universal Tier 2/3 first step');
 check(triageDoc.includes('```mermaid'), 'updated architecture retains executable flowchart documentation');
+check(triageDoc.includes('the kernel always emits a compact checkpoint'), 'reference makes checkpoint emission mandatory');
+check(!triageDoc.includes('When a visible checkpoint is useful'), 'reference no longer makes checkpoint visibility optional');
+check(triageDoc.includes('if every suggestion is skipped, state one brief reason'), 'reference records the all-skipped rationale rule');
+check(triageDoc.includes('Kernel emission alone is not proof that a host UI displayed the checkpoint'), 'reference preserves the #82 host-evidence boundary');
 
 console.log(`\n${failed === 0 ? 'PASS' : 'FAIL'}: invariant routing contract (${failed} failure${failed === 1 ? '' : 's'})`);
 process.exit(failed === 0 ? 0 : 1);

package/ci/mechanism-2ac-atomic-commit-check.test.js

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+'use strict';
+
+const assert = require('assert');
+const { execFileSync, spawnSync } = require('child_process');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '..');
+const canonical = path.join(ROOT, 'hooks', 'scripts', 'atomic-commit-check.js');
+const plugin = path.join(ROOT, 'plugins', 'harness-everything', 'hooks', 'scripts', 'atomic-commit-check.js');
+const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-atomic-commit-'));
+const repo = path.join(temp, 'repo');
+const outside = path.join(temp, 'outside');
+const stateHome = path.join(temp, 'state');
+
+function git(args) {
+  return execFileSync('git', args, { cwd: repo, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+}
+
+function invoke({ session, tool = 'Edit', target, patch }) {
+  const toolInput = tool === 'apply_patch'
+    ? { patch }
+    : { file_path: target };
+  const payload = {
+    session_id: session,
+    hook_event_name: 'PostToolUse',
+    tool_name: tool,
+    tool_input: toolInput,
+    cwd: repo,
+  };
+  return spawnSync(process.execPath, [canonical], {
+    cwd: repo,
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    env: { ...process.env, HARNESS_STATE_HOME: stateHome },
+  });
+}
+
+function sixInvocations(args) {
+  const results = [];
+  for (let i = 0; i < 6; i++) results.push(invoke(args));
+  return results;
+}
+
+try {
+  fs.mkdirSync(repo, { recursive: true });
+  fs.mkdirSync(outside, { recursive: true });
+  git(['init']);
+  git(['config', 'user.email', 'harness@example.invalid']);
+  git(['config', 'user.name', 'Harness Test']);
+  fs.writeFileSync(path.join(repo, 'tracked.txt'), 'base\n', 'utf8');
+  git(['add', 'tracked.txt']);
+  git(['commit', '-m', 'initial']);
+
+  assert.strictEqual(
+    fs.readFileSync(canonical, 'utf8'),
+    fs.readFileSync(plugin, 'utf8'),
+    'canonical and packaged atomic-commit hooks must remain byte-identical',
+  );
+
+  // Negative control for #90: keep the repository dirty with a pre-existing,
+  // unrelated file. Six host edits outside the workspace must still never
+  // increment the repository edit counter or emit a commit nudge.
+  fs.writeFileSync(path.join(repo, 'pre-existing-unrelated.txt'), 'unrelated\n', 'utf8');
+  const outsideTarget = path.join(outside, 'scratch.txt');
+  const outsideResults = sixInvocations({ session: 'outside-edit', target: outsideTarget });
+  assert.ok(outsideResults.every(result => result.status === 0), 'outside-workspace Edit calls must never nudge even when the repo is already dirty');
+  assert.ok(outsideResults.every(result => !String(result.stderr || '').includes('Atomic Commit Check')), 'outside-workspace Edit calls must stay silent');
+
+  const outsidePatchResults = sixInvocations({
+    session: 'outside-patch',
+    tool: 'apply_patch',
+    patch: `*** Begin Patch\n*** Update File: ${outsideTarget}\n@@\n-old\n+new\n*** End Patch`,
+  });
+  assert.ok(outsidePatchResults.every(result => result.status === 0), 'outside-workspace apply_patch headers must not increment the count');
+  fs.rmSync(path.join(repo, 'pre-existing-unrelated.txt'));
+
+  // A clean worktree is never a valid reason to request a commit. The sixth
+  // in-workspace event therefore stays non-blocking and resets the stale count.
+  const cleanResults = sixInvocations({ session: 'clean-tree', target: path.join(repo, 'tracked.txt') });
+  assert.ok(cleanResults.every(result => result.status === 0), 'clean worktree must not nudge at the threshold');
+  assert.ok(cleanResults.every(result => !String(result.stderr || '').includes('Atomic Commit Check')), 'clean worktree must not print a commit reminder');
+
+  // Real in-workspace edits with Git-visible changes still preserve the nudge.
+  fs.writeFileSync(path.join(repo, 'tracked.txt'), 'changed\n', 'utf8');
+  const dirtyResults = sixInvocations({ session: 'dirty-tree', target: path.join(repo, 'tracked.txt') });
+  assert.ok(dirtyResults.slice(0, 5).every(result => result.status === 0), 'first five in-workspace edits remain non-blocking');
+  assert.strictEqual(dirtyResults[5].status, 2, 'sixth in-workspace edit with uncommitted changes nudges');
+  assert.match(String(dirtyResults[5].stderr || ''), /6 edits since the last commit/, 'nudge wording is tool-neutral');
+  assert.doesNotMatch(String(dirtyResults[5].stderr || ''), /apply_patch calls/, 'nudge no longer claims all edits are apply_patch calls');
+
+  // apply_patch paths inside the repository count too.
+  const patchResults = sixInvocations({
+    session: 'inside-patch',
+    tool: 'apply_patch',
+    patch: '*** Begin Patch\n*** Update File: tracked.txt\n@@\n-old\n+new\n*** End Patch',
+  });
+  assert.strictEqual(patchResults[5].status, 2, 'in-workspace apply_patch header participates in the threshold');
+
+  // Moving HEAD resets the counter for the same session.
+  git(['add', 'tracked.txt']);
+  git(['commit', '-m', 'save change']);
+  const afterCommit = invoke({ session: 'dirty-tree', target: path.join(repo, 'tracked.txt') });
+  assert.strictEqual(afterCommit.status, 0, 'counter resets after a commit moves HEAD');
+
+  console.log('PASS: atomic commit check scopes edits to the workspace and suppresses clean-tree false nudges');
+} finally {
+  fs.rmSync(temp, { recursive: true, force: true });
+}

package/ci/mechanism-2ad-action-gate-classifier-hardening.test.js

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+'use strict';
+
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '..');
+const canonicalScript = path.join(ROOT, 'hooks', 'scripts', 'action-gate.js');
+const pluginScript = path.join(ROOT, 'plugins', 'harness-everything', 'hooks', 'scripts', 'action-gate.js');
+const canonicalRules = path.join(ROOT, 'hooks', 'scripts', 'action-gate-rules.json');
+const pluginRules = path.join(ROOT, 'plugins', 'harness-everything', 'hooks', 'scripts', 'action-gate-rules.json');
+const actionGate = require(canonicalScript);
+
+const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-action-gate-hardening-'));
+const sessionDir = path.join(temp, 'session');
+fs.mkdirSync(path.join(sessionDir, 'scratch'), { recursive: true });
+
+function payload(command, tool = 'Bash', cwd = ROOT) {
+  return {
+    session_id: 'classifier-hardening',
+    hook_event_name: 'PreToolUse',
+    tool_name: tool,
+    tool_input: { command },
+    cwd,
+  };
+}
+
+function matched(table, command, expected, tool = 'Bash', cwd = ROOT) {
+  const rule = actionGate.classify(payload(command, tool, cwd), table.rules, sessionDir);
+  assert.ok(rule, `${command} should match ${expected}`);
+  assert.strictEqual(rule.id, expected, `${command} should match ${expected}, got ${rule && rule.id}`);
+}
+
+function allowed(table, command, tool = 'Bash', cwd = ROOT) {
+  const rule = actionGate.classify(payload(command, tool, cwd), table.rules, sessionDir);
+  assert.strictEqual(rule, null, `${command} should not be classified as destructive`);
+}
+
+try {
+  assert.strictEqual(fs.readFileSync(canonicalScript, 'utf8'), fs.readFileSync(pluginScript, 'utf8'), 'canonical and packaged action-gate scripts must remain byte-identical');
+  assert.strictEqual(fs.readFileSync(canonicalRules, 'utf8'), fs.readFileSync(pluginRules, 'utf8'), 'canonical and packaged action-gate rule tables must remain byte-identical');
+
+  const table = actionGate.loadRuleTable(canonicalRules);
+  assert.strictEqual(table.degraded, false, 'production rule table must load normally');
+
+  const builtinById = new Map(actionGate.BUILTIN_RULES.map(rule => [rule.id, rule]));
+  for (const rule of table.rules) {
+    const fallback = builtinById.get(rule.id);
+    assert.ok(fallback, `built-in fallback must contain ${rule.id}`);
+    assert.deepStrictEqual(
+      { tools: fallback.tools, pattern: fallback.pattern, flags: fallback.flags, reason: fallback.reason, scope: fallback.scope },
+      { tools: rule.tools, pattern: rule.pattern, flags: rule.flags, reason: rule.reason, scope: rule.scope },
+      `built-in fallback must stay aligned with configured rule ${rule.id}`,
+    );
+  }
+
+  // Confirmed fail-open variants from #100.
+  matched(table, 'git -C . push --force origin main', 'git-force-push');
+  matched(table, 'git push origin +main', 'git-force-push');
+  matched(table, 'git push -uf origin main', 'git-force-push');
+  matched(table, 'git reset -q --hard HEAD~1', 'git-reset-hard');
+  matched(table, 'git -c key=value reset --hard', 'git-reset-hard');
+  matched(table, 'sudo rm -rf /opt/app', 'recursive-delete');
+  matched(table, 'bash -c "rm -rf C:/important"', 'recursive-delete');
+  matched(table, 'ri -Recurse -Force C:\\repo\\x', 'powershell-recursive-force-delete', 'PowerShell');
+  matched(table, 'rm -r -fo C:\\repo\\x', 'powershell-recursive-force-delete', 'PowerShell');
+
+  // Quoted/descriptive text is not an executable destructive command.
+  allowed(table, 'node -e "console.log(\'Remove-Item -Recurse -Force C:\\\\repo\\\\x\')"', 'Bash');
+  allowed(table, 'echo "never DROP TABLE users"');
+  allowed(table, 'grep -rn "npm publish" docs/');
+  allowed(table, 'git push origin main');
+
+  // Scratch cleanup keeps working for direct commands and PowerShell aliases.
+  const bashScratch = process.platform === 'win32' ? '/tmp/harness-action-gate-safe' : path.join(os.tmpdir(), 'harness-action-gate-safe');
+  allowed(table, `rm -rf "${bashScratch}"`, 'Bash');
+  const psScratch = path.join(sessionDir, 'scratch', 'build');
+  allowed(table, `rm -r -fo "${psScratch}"`, 'PowerShell');
+  allowed(table, `ri -Recurse -Force "${psScratch}"`, 'PowerShell');
+
+  // An unresolved variable remains conservative rather than creating a new
+  // fail-open path: the gate cannot prove that the target is scratch space.
+  matched(table, 'rm -rf "$S"', 'recursive-delete');
+
+  console.log('PASS: destructive-command classifier covers confirmed bypasses while suppressing quoted-text false positives');
+} finally {
+  fs.rmSync(temp, { recursive: true, force: true });
+}

package/harness-everything/SKILL.md

@@ -4,7 +4,7 @@ description: "Route software/project work through the Harness kernel: classify T
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.4.0
+  version: 0.7.0
 ---
 
 # Harness Everything
@@ -29,8 +29,9 @@ These rails are mandatory; Tier guidance is not a fixed pipeline.
 ## Workflow
 
 1. Reuse current-turn kernel output, or run `node "<this-skill-dir>/scripts/kernel-router.js" "<prompt summary>"`.
-2. Preserve the invariants.
-3. Treat suggested skills as advisory: choose, combine, reorder, or omit them as useful.
+2. Ensure the emitted **Harness Routing Checkpoint** is user-visible: reuse a host-visible rendering or include it in the first progress/update message.
+3. Preserve the invariants.
+4. Treat suggested skills as advisory: choose, combine, reorder, or omit them as useful. If suggestions are non-empty and you use none, state one brief skip reason with the visible checkpoint/progress update.
 
 ## Tier Guidance
 
@@ -38,6 +39,6 @@ These rails are mandatory; Tier guidance is not a fixed pipeline.
 - **Tier 2:** TODO tracking, TDD, and verification are common suggestions.
 - **Tier 3:** Fable/multi-agent skills are optional when macro planning or delegation helps.
 
-**Rule:** do not enforce workflow order; let the agent orchestrate itself inside the invariants.
+**Rule:** enforce checkpoint visibility and workflow invariants, not workflow order; let the agent orchestrate itself inside those rails.
 
 Deep dive: <this-skill-dir>/references/triage-and-tiers.md

package/harness-everything/references/triage-and-tiers.md

@@ -73,11 +73,12 @@ npx github:dyphn1/Harness-everything next "<brief prompt summary>"
 `kernel-router.js` delegates classification and guide discovery to `tier-router.js`, removes legacy fixed-pipeline instructions, and emits:
 
 - the recommended tier and rationale,
+- a compact **Harness Routing Checkpoint**,
 - the **required Harness invariants**,
 - **suggested skills** marked advisory,
 - the policy that the agent may choose the smallest useful skill/tool set.
 
-If a host's `UserPromptSubmit` integration already ran the kernel this turn, reuse that output rather than running it twice.
+If a host's `UserPromptSubmit` integration already ran the kernel this turn, reuse that output rather than running it twice. The checkpoint must still become user-visible for software/project work: use the host's visible hook rendering when it has one, otherwise include the checkpoint in the first progress/update message.
 
 The tier classifier is heuristic. Treat its result as the default route, not an oracle. A clear task reading or explicit user instruction may override it; record the reason when doing so.
 
@@ -116,7 +117,7 @@ Common **suggestions**, not a pipeline:
 | Isolated workspace would reduce risk | `using-git-worktrees` |
 | Quantitative scoring/benchmarking is requested | `eval-harness` |
 
-The model decides which of these are useful and in what order. It may use none, one, or several while preserving the kernel invariants.
+The model decides which of these are useful and in what order. It may use none, one, or several while preserving the kernel invariants. If the router emitted one or more suggestions and the agent uses none of them, the visible checkpoint/progress update must include one brief skip reason; using at least one suggestion does not require explaining why the others were omitted.
 
 ### Tier 3 — Macro
 
@@ -137,7 +138,7 @@ Common **suggestions**, not a pipeline:
 | Settled intent needs a spec | `to-spec` |
 | Settled work needs tracer-bullet issues | `to-tickets` |
 
-Tier 3 does **not** automatically require multi-agent execution. A strong model may complete macro work directly when that is the safer/smaller choice.
+Tier 3 does **not** automatically require multi-agent execution. A strong model may complete macro work directly when that is the safer/smaller choice. The same all-skipped rationale rule applies when the router emitted suggestions.
 
 ## 4. Cognitive OS Relationship
 
@@ -160,24 +161,26 @@ But this diagram describes a reasoning policy, not a peer-skill dependency graph
 
 | Host mode | Expected behavior |
 |---|---|
-| Lifecycle hook available | Run the Harness Kernel on prompt submission so routing context exists before domain-skill execution. Hard gates may enforce supported invariants at tool/stop boundaries. |
-| Advisory instructions only | Tell the agent to run/reuse `harness next` before software mutation and `harness verify` before completion. The behavior is advisory, not a hard gate. |
-| Manual use | Invoke `harness-everything` or `install-cognitive-os` explicitly to inspect/re-establish the contract. |
+| Lifecycle hook available | Run the Harness Kernel on prompt submission so routing context exists before domain-skill execution. Surface the emitted checkpoint through a host-visible hook surface when supported; otherwise the agent carries it into the first visible progress/update. Hard gates may enforce supported invariants at tool/stop boundaries. |
+| Advisory instructions only | Tell the agent to run/reuse `harness next` before software mutation, surface the checkpoint, and run `harness verify` before completion. The behavior is advisory, not a hard host gate. |
+| Manual use | Invoke `harness-everything` or `install-cognitive-os` explicitly to inspect/re-establish and surface the contract. |
 
-Never describe an advisory integration as hard enforcement. Platform-specific adapters may differ while preserving functional intent.
+Never describe an advisory integration as hard enforcement. Platform-specific adapters may differ while preserving functional intent. Kernel emission alone is not proof that a host UI displayed the checkpoint; #82 live evidence owns that claim.
 
 ## 6. Routing Checkpoint
 
-When a visible checkpoint is useful, keep it small:
+For software/project work, the kernel always emits a compact checkpoint and the execution surface must make it user-visible before or with the first progress update:
 
 ```markdown
 ## 🚦 Harness Routing Checkpoint
 - Tier: Tier X — <reason>
+- Strategy: <selected/deferred strategy>
 - Required invariants: route-before-execution; verify-before-claim; re-plan-after-3-same-failures
-- Suggested skills: <only the skills that appear useful>
+- Suggested skills: <deduplicated suggestions, or none>
+- Suggestion disposition: <using one or more | skipped all — brief reason>
 ```
 
-The checkpoint reports state; it does not prescribe a universal workflow.
+The checkpoint reports state; it does not prescribe a universal workflow. Suggested skills remain advisory. The only extra accountability rule is that a non-empty suggestion set cannot disappear silently: if every suggestion is skipped, state one brief reason. Do not add a skip explanation when at least one suggestion is used.
 
 ## 7. Self-Healing and Dynamic Skills
 

package/harness-everything/scripts/kernel-router.js

@@ -117,6 +117,32 @@ function printWorkflowPlan(plan) {
   console.log(`\n=> ROUTER WORKFLOW PLAN (JSON): ${JSON.stringify(visible)}`);
 }
 
+function uniqueSuggestedSkills(plan) {
+  if (!Array.isArray(plan.suggestedSkills)) return [];
+  return [...new Set(plan.suggestedSkills.filter(skill => typeof skill === 'string' && skill.trim()))];
+}
+
+function displayTier(tier) {
+  if (tier === 'tier1') return 'Tier 1';
+  if (tier === 'tier2') return 'Tier 2';
+  if (tier === 'tier3') return 'Tier 3';
+  return tier || 'unclassified';
+}
+
+function printRoutingCheckpoint(plan) {
+  const invariants = Array.isArray(plan.requiredInvariants) ? plan.requiredInvariants : [];
+  const suggestions = uniqueSuggestedSkills(plan);
+
+  console.log('\n=> HARNESS ROUTING CHECKPOINT (REQUIRED VISIBLE STATE):');
+  console.log(`   - Tier: ${displayTier(plan.tier)}`);
+  console.log(`   - Strategy: ${plan.strategy || 'deferred'}`);
+  console.log(`   - Required invariants: ${invariants.length ? invariants.join(', ') : 'none'}`);
+  console.log(`   - Suggested skills: ${suggestions.length ? suggestions.join(', ') : 'none'}`);
+  if (suggestions.length > 0) {
+    console.log('   - Suggestion disposition: suggestions are advisory; use any that add value. If all are skipped, state one brief reason in the first visible progress/update message.');
+  }
+}
+
 function printKernelContract(plan) {
   console.log('\n=> REQUIRED HARNESS INVARIANTS:');
   for (const invariant of plan.requiredInvariants || []) {
@@ -194,6 +220,7 @@ function run(prompt, stdinPayload) {
   }
 
   printWorkflowPlan(contract.workflowPlan);
+  printRoutingCheckpoint(contract.workflowPlan);
   printKernelContract(contract.workflowPlan);
 
   if (result.status !== 0) process.exit(result.status === null ? 1 : result.status);

package/hooks/scripts/action-gate-rules.json

@@ -4,7 +4,7 @@
     {
       "id": "git-force-push",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bgit\\s+push\\b[\\s\\S]*(?:--force(?:-with-lease)?|(?:^|\\s)-f(?:\\s|$))",
+      "pattern": "(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*push\\b(?=[^\\r\\n;&|]*(?:--force(?:-with-lease)?\\b|-[A-Za-z]*f[A-Za-z]*\\b|\\s\\+[^\\s;&|]+))",
       "flags": "i",
       "reason": "Force-pushing can rewrite remote history.",
       "scope": "always"
@@ -12,7 +12,7 @@
     {
       "id": "git-reset-hard",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bgit\\s+reset\\s+--hard\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*reset\\b[^\\r\\n;&|]*--hard\\b",
       "flags": "i",
       "reason": "git reset --hard can discard local work.",
       "scope": "always"
@@ -20,7 +20,7 @@
     {
       "id": "git-clean-force-delete",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bgit\\s+clean\\b(?=[^\\r\\n]*\\s-(?:[^\\s]*f|f\\b))(?=[^\\r\\n]*\\s-(?:[^\\s]*d|d\\b))",
+      "pattern": "(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*clean\\b(?=[^\\r\\n;&|]*\\s-(?:[^\\s]*f|f\\b))(?=[^\\r\\n;&|]*\\s-(?:[^\\s]*d|d\\b))",
       "flags": "i",
       "reason": "git clean with force and directory deletion can remove untracked work.",
       "scope": "always"
@@ -28,15 +28,15 @@
     {
       "id": "recursive-delete",
       "tools": ["Bash"],
-      "pattern": "(?:^|[;&|\\n]\\s*)rm\\s+(?=[^\\r\\n;&|]*-(?:[^\\s]*r|r\\b))(?=[^\\r\\n;&|]*-(?:[^\\s]*f|f\\b))",
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:(?:bash|sh)\\s+(?:-\\S+\\s+)*-c\\s+[\\\"']\\s*)?(?:sudo(?:\\s+-\\S+)*\\s+)?rm\\s+(?=[^\\r\\n;&|]*-(?:[^\\s]*r|r\\b))(?=[^\\r\\n;&|]*-(?:[^\\s]*f|f\\b))",
       "flags": "i",
       "reason": "Recursive forced deletion outside approved scratch space is destructive.",
       "scope": "outside-scratch"
     },
     {
       "id": "powershell-recursive-force-delete",
-      "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bRemove-Item\\b(?=[^\\r\\n;|]*-(?:Recurse|r)\\b)(?=[^\\r\\n;|]*-(?:Force|fo)\\b)",
+      "tools": ["PowerShell"],
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:Remove-Item|ri|rm)\\b(?=[^\\r\\n;|]*-(?:Recurse|r)\\b)(?=[^\\r\\n;|]*-(?:Force|fo)\\b)",
       "flags": "i",
       "reason": "PowerShell recursive forced deletion outside approved scratch space is destructive.",
       "scope": "outside-scratch"
@@ -44,7 +44,7 @@
     {
       "id": "sql-destructive-ddl",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\b(?:DROP\\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE(?:\\s+TABLE)?)\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:(?:psql|mysql|sqlcmd|sqlite3)\\b[^\\r\\n;&|]*)?\\b(?:DROP\\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE(?:\\s+TABLE)?)\\b",
       "flags": "i",
       "reason": "Destructive SQL DDL can irreversibly remove production data or schema state.",
       "scope": "always"
@@ -52,7 +52,7 @@
     {
       "id": "package-publish",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\b(?:npm|pnpm|yarn|cargo|twine)\\s+publish\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:sudo\\s+)?(?:npm|pnpm|yarn|cargo|twine)\\s+publish\\b",
       "flags": "i",
       "reason": "Publishing creates an external package/release side effect.",
       "scope": "always"
@@ -60,7 +60,7 @@
     {
       "id": "github-release-create",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bgh\\s+release\\s+create\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)gh\\s+release\\s+create\\b",
       "flags": "i",
       "reason": "Creating a GitHub release is an external irreversible publication action.",
       "scope": "always"
@@ -68,7 +68,7 @@
     {
       "id": "production-deploy",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\b(?:kubectl\\s+apply|helm\\s+(?:upgrade|install)|terraform\\s+apply|vercel\\s+deploy|fly\\s+deploy|gcloud\\s+run\\s+deploy|(?:npm|pnpm|yarn)\\s+(?:run\\s+)?deploy|deploy\\s+to\\s+(?:prod|production|live))\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:kubectl\\s+apply|helm\\s+(?:upgrade|install)|terraform\\s+apply|vercel\\s+deploy|fly\\s+deploy|gcloud\\s+run\\s+deploy|(?:npm|pnpm|yarn)\\s+(?:run\\s+)?deploy|deploy\\s+to\\s+(?:prod|production|live))\\b",
       "flags": "i",
       "reason": "Deployment changes an external environment and requires explicit approval.",
       "scope": "always"

package/hooks/scripts/action-gate.js

@@ -20,15 +20,15 @@ const ALWAYS_ASK_POLICY = 'always-ask';
 // Fail-safe defaults are used only when the configured table is missing or
 // invalid. A valid-but-empty table stays empty so CI can catch policy erasure.
 const BUILTIN_RULES = [
-  ['git-force-push', ['Bash', 'PowerShell'], '\\bgit\\s+push\\b[\\s\\S]*(?:--force(?:-with-lease)?|(?:^|\\s)-f(?:\\s|$))', 'i', 'Force-pushing can rewrite remote history.', 'always'],
-  ['git-reset-hard', ['Bash', 'PowerShell'], '\\bgit\\s+reset\\s+--hard\\b', 'i', 'git reset --hard can discard local work.', 'always'],
-  ['git-clean-force-delete', ['Bash', 'PowerShell'], '\\bgit\\s+clean\\b(?=[^\\r\\n]*\\s-(?:[^\\s]*f|f\\b))(?=[^\\r\\n]*\\s-(?:[^\\s]*d|d\\b))', 'i', 'git clean with force and directory deletion can remove untracked work.', 'always'],
-  ['recursive-delete', ['Bash'], '(?:^|[;&|\\n]\\s*)rm\\s+(?=[^\\r\\n;&|]*-(?:[^\\s]*r|r\\b))(?=[^\\r\\n;&|]*-(?:[^\\s]*f|f\\b))', 'i', 'Recursive forced deletion outside approved scratch space is destructive.', 'outside-scratch'],
-  ['powershell-recursive-force-delete', ['Bash', 'PowerShell'], '\\bRemove-Item\\b(?=[^\\r\\n;|]*-(?:Recurse|r)\\b)(?=[^\\r\\n;|]*-(?:Force|fo)\\b)', 'i', 'PowerShell recursive forced deletion outside approved scratch space is destructive.', 'outside-scratch'],
-  ['sql-destructive-ddl', ['Bash', 'PowerShell'], '\\b(?:DROP\\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE(?:\\s+TABLE)?)\\b', 'i', 'Destructive SQL DDL can irreversibly remove production data or schema state.', 'always'],
-  ['package-publish', ['Bash', 'PowerShell'], '\\b(?:npm|pnpm|yarn|cargo|twine)\\s+publish\\b', 'i', 'Publishing creates an external package/release side effect.', 'always'],
-  ['github-release-create', ['Bash', 'PowerShell'], '\\bgh\\s+release\\s+create\\b', 'i', 'Creating a GitHub release is an external irreversible publication action.', 'always'],
-  ['production-deploy', ['Bash', 'PowerShell'], '\\b(?:kubectl\\s+apply|helm\\s+(?:upgrade|install)|terraform\\s+apply|vercel\\s+deploy|fly\\s+deploy|gcloud\\s+run\\s+deploy|(?:npm|pnpm|yarn)\\s+(?:run\\s+)?deploy|deploy\\s+to\\s+(?:prod|production|live))\\b', 'i', 'Deployment changes an external environment and requires explicit approval.', 'always'],
+  ['git-force-push', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*push\\b(?=[^\\r\\n;&|]*(?:--force(?:-with-lease)?\\b|-[A-Za-z]*f[A-Za-z]*\\b|\\s\\+[^\\s;&|]+))', 'i', 'Force-pushing can rewrite remote history.', 'always'],
+  ['git-reset-hard', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*reset\\b[^\\r\\n;&|]*--hard\\b', 'i', 'git reset --hard can discard local work.', 'always'],
+  ['git-clean-force-delete', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*clean\\b(?=[^\\r\\n;&|]*\\s-(?:[^\\s]*f|f\\b))(?=[^\\r\\n;&|]*\\s-(?:[^\\s]*d|d\\b))', 'i', 'git clean with force and directory deletion can remove untracked work.', 'always'],
+  ['recursive-delete', ['Bash'], '(?:^|[;&|\\n]\\s*)(?:(?:bash|sh)\\s+(?:-\\S+\\s+)*-c\\s+[\\"\']\\s*)?(?:sudo(?:\\s+-\\S+)*\\s+)?rm\\s+(?=[^\\r\\n;&|]*-(?:[^\\s]*r|r\\b))(?=[^\\r\\n;&|]*-(?:[^\\s]*f|f\\b))', 'i', 'Recursive forced deletion outside approved scratch space is destructive.', 'outside-scratch'],
+  ['powershell-recursive-force-delete', ['PowerShell'], '(?:^|[;&|\\n]\\s*)(?:Remove-Item|ri|rm)\\b(?=[^\\r\\n;|]*-(?:Recurse|r)\\b)(?=[^\\r\\n;|]*-(?:Force|fo)\\b)', 'i', 'PowerShell recursive forced deletion outside approved scratch space is destructive.', 'outside-scratch'],
+  ['sql-destructive-ddl', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)(?:(?:psql|mysql|sqlcmd|sqlite3)\\b[^\\r\\n;&|]*)?\\b(?:DROP\\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE(?:\\s+TABLE)?)\\b', 'i', 'Destructive SQL DDL can irreversibly remove production data or schema state.', 'always'],
+  ['package-publish', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)(?:sudo\\s+)?(?:npm|pnpm|yarn|cargo|twine)\\s+publish\\b', 'i', 'Publishing creates an external package/release side effect.', 'always'],
+  ['github-release-create', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)gh\\s+release\\s+create\\b', 'i', 'Creating a GitHub release is an external irreversible publication action.', 'always'],
+  ['production-deploy', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)(?:kubectl\\s+apply|helm\\s+(?:upgrade|install)|terraform\\s+apply|vercel\\s+deploy|fly\\s+deploy|gcloud\\s+run\\s+deploy|(?:npm|pnpm|yarn)\\s+(?:run\\s+)?deploy|deploy\\s+to\\s+(?:prod|production|live))\\b', 'i', 'Deployment changes an external environment and requires explicit approval.', 'always'],
 ].map(([id, tools, pattern, flags, reason, scope]) => ({ id, tools, pattern, flags, reason, scope }));
 
 function hashExact(value) {
@@ -153,9 +153,15 @@ function deleteTargets(command, ruleId) {
   const tails = [];
   let regex = null;
   if (ruleId === 'recursive-delete') {
-    regex = /(?:^|[;&|\n]\s*)rm\s+([^;&|\n]+)/ig;
+    regex = /(?:^|[;&|\n]\s*)(?:sudo(?:\s+-\S+)*\s+)?rm\s+([^;&|\n]+)/ig;
+    const wrapper = /(?:^|[;&|\n]\s*)(?:bash|sh)\s+(?:-\S+\s+)*-c\s+(["'])([\s\S]*?)\1/ig;
+    let wrapped;
+    while ((wrapped = wrapper.exec(text)) !== null) {
+      tails.push(...deleteTargets(wrapped[2], ruleId));
+      if (wrapped[0].length === 0) wrapper.lastIndex++;
+    }
   } else if (ruleId === 'powershell-recursive-force-delete') {
-    regex = /\bRemove-Item\b([^;|\n]+)/ig;
+    regex = /(?:^|[;|\n]\s*)(?:Remove-Item|ri|rm)\b([^;|\n]+)/ig;
   }
   if (!regex) return [];
 
@@ -190,6 +196,10 @@ function isWithin(target, root) {
 
 function scratchRoots(payload, sessionDir) {
   const roots = [os.tmpdir(), path.join(sessionDir, 'scratch')];
+  // Git Bash/MSYS exposes the Windows temp area as /tmp (and sometimes
+  // /var/tmp). Treat those aliases as scratch on Windows instead of gating a
+  // harmless temp cleanup merely because the host path syntax differs.
+  if (process.platform === 'win32') roots.push('/tmp', '/var/tmp');
   const declared = payload && (payload.scratchpad_path || payload.scratchpadPath || (payload.harness && payload.harness.scratchpadPath));
   if (declared) roots.push(declared);
   if (process.env.HARNESS_SCRATCH_DIR) roots.push(process.env.HARNESS_SCRATCH_DIR);

package/hooks/scripts/atomic-commit-check.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 /**
- * Atomic Commit Check (PostToolUse: apply_patch)
- * PostToolUse can't block - the edit/write already happened. So this counts
- * apply_patch calls since the last commit and, once the count crosses a
- * threshold, feeds a strong reminder back to Claude (exit 2) to commit the
- * completed chunk before piling on more changes. Resets whenever HEAD moves.
+ * Atomic Commit Check (PostToolUse: Edit/Write/apply_patch)
+ * PostToolUse can't block - the edit/write already happened. Count only edits
+ * whose targets resolve inside the current workspace. Once the count crosses
+ * the threshold, emit a strong reminder only when the Git worktree actually
+ * has uncommitted changes. Resets whenever HEAD moves.
  * Fails open on any error - this is a nudge, never a hard stop.
  */
 const { execSync } = require('child_process');
@@ -15,6 +15,90 @@ const { getWorkspaceRoot, getSessionDir } = require('./lib/harness-state');
 const THRESHOLD = 6;
 const RENUDGE_EVERY = 3;
 
+function toolNameOf(payload) {
+  return String((payload && (payload.tool_name || payload.toolName)) || '');
+}
+
+function toolInputOf(payload) {
+  return (payload && (payload.tool_input || payload.toolInput || payload.input)) || {};
+}
+
+function pathApiFor(value) {
+  return /^[A-Za-z]:[\\/]/.test(String(value || '')) ? path.win32 : path;
+}
+
+function canonicalPath(value) {
+  const text = String(value || '');
+  if (!text) return null;
+  const api = pathApiFor(text);
+  const resolved = api.resolve(text);
+
+  // realpath() is necessary on macOS where /var is a symlink to /private/var.
+  // New Write targets may not exist yet, so canonicalize the nearest existing
+  // ancestor and append the missing path segments without requiring creation.
+  const missing = [];
+  let cursor = resolved;
+  while (cursor && !fs.existsSync(cursor)) {
+    const parent = api.dirname(cursor);
+    if (!parent || parent === cursor) break;
+    missing.unshift(api.basename(cursor));
+    cursor = parent;
+  }
+  if (!cursor || !fs.existsSync(cursor)) return resolved;
+
+  let real = fs.realpathSync.native ? fs.realpathSync.native(cursor) : fs.realpathSync(cursor);
+  for (const segment of missing) real = api.join(real, segment);
+  return api.normalize(real);
+}
+
+function isWithin(target, root) {
+  if (!target || !root) return false;
+  const api = pathApiFor(target) === path.win32 || pathApiFor(root) === path.win32 ? path.win32 : path;
+  const resolvedTarget = canonicalPath(target);
+  const resolvedRoot = canonicalPath(root);
+  const relative = api.relative(resolvedRoot, resolvedTarget);
+  if (!relative) return true;
+  return relative !== '..' && !relative.startsWith(`..${api.sep}`) && !api.isAbsolute(relative);
+}
+
+function absoluteTarget(target, root) {
+  const text = String(target || '').trim();
+  if (!text) return null;
+  const api = pathApiFor(text) === path.win32 || pathApiFor(root) === path.win32 ? path.win32 : path;
+  return api.isAbsolute(text) ? api.normalize(text) : api.resolve(root, text);
+}
+
+function patchTargets(patchText) {
+  const targets = [];
+  const regex = /^\*\*\* (?:Add|Update|Delete) File:\s*(.+?)\s*$/gm;
+  let match;
+  while ((match = regex.exec(String(patchText || ''))) !== null) targets.push(match[1]);
+  return targets;
+}
+
+function editTargets(payload) {
+  const tool = toolNameOf(payload);
+  const input = toolInputOf(payload);
+  if (tool === 'Edit' || tool === 'Write') {
+    const target = input.file_path || input.filePath || input.path;
+    return target ? [String(target)] : [];
+  }
+  if (tool === 'apply_patch') {
+    return patchTargets(input.patch || input.command || input.content || '');
+  }
+  return [];
+}
+
+function touchesWorkspace(payload, root) {
+  const targets = editTargets(payload);
+  if (targets.length === 0) return false;
+  return targets.some(target => isWithin(absoluteTarget(target, root), root));
+}
+
+function writeState(stateFile, state) {
+  fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), 'utf8');
+}
+
 function main(payload) {
   try {
     const root = getWorkspaceRoot(payload);
@@ -33,17 +117,32 @@ function main(payload) {
       state.editCount = 0;
     }
 
+    // Host scratchpads, memory stores, temp files, and any other target outside
+    // the repository must not contribute to a repository commit reminder.
+    if (!touchesWorkspace(payload, root)) {
+      writeState(stateFile, state);
+      process.exit(0);
+    }
+
     state.editCount += 1;
-    fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), 'utf8');
+    writeState(stateFile, state);
 
     const overThreshold = state.editCount >= THRESHOLD;
     const onNudgeBeat = overThreshold && (state.editCount - THRESHOLD) % RENUDGE_EVERY === 0;
 
     if (onNudgeBeat) {
       const statusRaw = execSync('git status --porcelain', { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
-      const changedFiles = statusRaw ? statusRaw.split('\n').length : 0;
-      console.error(`[Atomic Commit Check] ${state.editCount} apply_patch calls since the last commit (${changedFiles} files currently changed).`);
-      console.error(`If a logically complete chunk of work is done, commit it now before continuing - large uncommitted diffs are harder to review and harder to recover from.`);
+      if (!statusRaw) {
+        // Calls that produced no Git-visible change (or work already reverted)
+        // must not leave a stale counter that immediately re-nudges later.
+        state.editCount = 0;
+        writeState(stateFile, state);
+        process.exit(0);
+      }
+
+      const changedFiles = statusRaw.split('\n').length;
+      console.error(`[Atomic Commit Check] ${state.editCount} edits since the last commit (${changedFiles} files currently changed).`);
+      console.error('If a logically complete chunk of work is done, commit it now before continuing - large uncommitted diffs are harder to review and harder to recover from.');
       process.exit(2);
     }
 
@@ -66,3 +165,12 @@ process.stdin.on('error', () => {
   clearTimeout(timeout);
   main(null);
 });
+
+module.exports = {
+  absoluteTarget,
+  canonicalPath,
+  editTargets,
+  isWithin,
+  patchTargets,
+  touchesWorkspace,
+};

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/hooks/scripts/action-gate-rules.json

@@ -4,7 +4,7 @@
     {
       "id": "git-force-push",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bgit\\s+push\\b[\\s\\S]*(?:--force(?:-with-lease)?|(?:^|\\s)-f(?:\\s|$))",
+      "pattern": "(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*push\\b(?=[^\\r\\n;&|]*(?:--force(?:-with-lease)?\\b|-[A-Za-z]*f[A-Za-z]*\\b|\\s\\+[^\\s;&|]+))",
       "flags": "i",
       "reason": "Force-pushing can rewrite remote history.",
       "scope": "always"
@@ -12,7 +12,7 @@
     {
       "id": "git-reset-hard",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bgit\\s+reset\\s+--hard\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*reset\\b[^\\r\\n;&|]*--hard\\b",
       "flags": "i",
       "reason": "git reset --hard can discard local work.",
       "scope": "always"
@@ -20,7 +20,7 @@
     {
       "id": "git-clean-force-delete",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bgit\\s+clean\\b(?=[^\\r\\n]*\\s-(?:[^\\s]*f|f\\b))(?=[^\\r\\n]*\\s-(?:[^\\s]*d|d\\b))",
+      "pattern": "(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*clean\\b(?=[^\\r\\n;&|]*\\s-(?:[^\\s]*f|f\\b))(?=[^\\r\\n;&|]*\\s-(?:[^\\s]*d|d\\b))",
       "flags": "i",
       "reason": "git clean with force and directory deletion can remove untracked work.",
       "scope": "always"
@@ -28,15 +28,15 @@
     {
       "id": "recursive-delete",
       "tools": ["Bash"],
-      "pattern": "(?:^|[;&|\\n]\\s*)rm\\s+(?=[^\\r\\n;&|]*-(?:[^\\s]*r|r\\b))(?=[^\\r\\n;&|]*-(?:[^\\s]*f|f\\b))",
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:(?:bash|sh)\\s+(?:-\\S+\\s+)*-c\\s+[\\\"']\\s*)?(?:sudo(?:\\s+-\\S+)*\\s+)?rm\\s+(?=[^\\r\\n;&|]*-(?:[^\\s]*r|r\\b))(?=[^\\r\\n;&|]*-(?:[^\\s]*f|f\\b))",
       "flags": "i",
       "reason": "Recursive forced deletion outside approved scratch space is destructive.",
       "scope": "outside-scratch"
     },
     {
       "id": "powershell-recursive-force-delete",
-      "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bRemove-Item\\b(?=[^\\r\\n;|]*-(?:Recurse|r)\\b)(?=[^\\r\\n;|]*-(?:Force|fo)\\b)",
+      "tools": ["PowerShell"],
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:Remove-Item|ri|rm)\\b(?=[^\\r\\n;|]*-(?:Recurse|r)\\b)(?=[^\\r\\n;|]*-(?:Force|fo)\\b)",
       "flags": "i",
       "reason": "PowerShell recursive forced deletion outside approved scratch space is destructive.",
       "scope": "outside-scratch"
@@ -44,7 +44,7 @@
     {
       "id": "sql-destructive-ddl",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\b(?:DROP\\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE(?:\\s+TABLE)?)\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:(?:psql|mysql|sqlcmd|sqlite3)\\b[^\\r\\n;&|]*)?\\b(?:DROP\\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE(?:\\s+TABLE)?)\\b",
       "flags": "i",
       "reason": "Destructive SQL DDL can irreversibly remove production data or schema state.",
       "scope": "always"
@@ -52,7 +52,7 @@
     {
       "id": "package-publish",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\b(?:npm|pnpm|yarn|cargo|twine)\\s+publish\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:sudo\\s+)?(?:npm|pnpm|yarn|cargo|twine)\\s+publish\\b",
       "flags": "i",
       "reason": "Publishing creates an external package/release side effect.",
       "scope": "always"
@@ -60,7 +60,7 @@
     {
       "id": "github-release-create",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\bgh\\s+release\\s+create\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)gh\\s+release\\s+create\\b",
       "flags": "i",
       "reason": "Creating a GitHub release is an external irreversible publication action.",
       "scope": "always"
@@ -68,7 +68,7 @@
     {
       "id": "production-deploy",
       "tools": ["Bash", "PowerShell"],
-      "pattern": "\\b(?:kubectl\\s+apply|helm\\s+(?:upgrade|install)|terraform\\s+apply|vercel\\s+deploy|fly\\s+deploy|gcloud\\s+run\\s+deploy|(?:npm|pnpm|yarn)\\s+(?:run\\s+)?deploy|deploy\\s+to\\s+(?:prod|production|live))\\b",
+      "pattern": "(?:^|[;&|\\n]\\s*)(?:kubectl\\s+apply|helm\\s+(?:upgrade|install)|terraform\\s+apply|vercel\\s+deploy|fly\\s+deploy|gcloud\\s+run\\s+deploy|(?:npm|pnpm|yarn)\\s+(?:run\\s+)?deploy|deploy\\s+to\\s+(?:prod|production|live))\\b",
       "flags": "i",
       "reason": "Deployment changes an external environment and requires explicit approval.",
       "scope": "always"

package/plugins/harness-everything/hooks/scripts/action-gate.js

@@ -20,15 +20,15 @@ const ALWAYS_ASK_POLICY = 'always-ask';
 // Fail-safe defaults are used only when the configured table is missing or
 // invalid. A valid-but-empty table stays empty so CI can catch policy erasure.
 const BUILTIN_RULES = [
-  ['git-force-push', ['Bash', 'PowerShell'], '\\bgit\\s+push\\b[\\s\\S]*(?:--force(?:-with-lease)?|(?:^|\\s)-f(?:\\s|$))', 'i', 'Force-pushing can rewrite remote history.', 'always'],
-  ['git-reset-hard', ['Bash', 'PowerShell'], '\\bgit\\s+reset\\s+--hard\\b', 'i', 'git reset --hard can discard local work.', 'always'],
-  ['git-clean-force-delete', ['Bash', 'PowerShell'], '\\bgit\\s+clean\\b(?=[^\\r\\n]*\\s-(?:[^\\s]*f|f\\b))(?=[^\\r\\n]*\\s-(?:[^\\s]*d|d\\b))', 'i', 'git clean with force and directory deletion can remove untracked work.', 'always'],
-  ['recursive-delete', ['Bash'], '(?:^|[;&|\\n]\\s*)rm\\s+(?=[^\\r\\n;&|]*-(?:[^\\s]*r|r\\b))(?=[^\\r\\n;&|]*-(?:[^\\s]*f|f\\b))', 'i', 'Recursive forced deletion outside approved scratch space is destructive.', 'outside-scratch'],
-  ['powershell-recursive-force-delete', ['Bash', 'PowerShell'], '\\bRemove-Item\\b(?=[^\\r\\n;|]*-(?:Recurse|r)\\b)(?=[^\\r\\n;|]*-(?:Force|fo)\\b)', 'i', 'PowerShell recursive forced deletion outside approved scratch space is destructive.', 'outside-scratch'],
-  ['sql-destructive-ddl', ['Bash', 'PowerShell'], '\\b(?:DROP\\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE(?:\\s+TABLE)?)\\b', 'i', 'Destructive SQL DDL can irreversibly remove production data or schema state.', 'always'],
-  ['package-publish', ['Bash', 'PowerShell'], '\\b(?:npm|pnpm|yarn|cargo|twine)\\s+publish\\b', 'i', 'Publishing creates an external package/release side effect.', 'always'],
-  ['github-release-create', ['Bash', 'PowerShell'], '\\bgh\\s+release\\s+create\\b', 'i', 'Creating a GitHub release is an external irreversible publication action.', 'always'],
-  ['production-deploy', ['Bash', 'PowerShell'], '\\b(?:kubectl\\s+apply|helm\\s+(?:upgrade|install)|terraform\\s+apply|vercel\\s+deploy|fly\\s+deploy|gcloud\\s+run\\s+deploy|(?:npm|pnpm|yarn)\\s+(?:run\\s+)?deploy|deploy\\s+to\\s+(?:prod|production|live))\\b', 'i', 'Deployment changes an external environment and requires explicit approval.', 'always'],
+  ['git-force-push', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*push\\b(?=[^\\r\\n;&|]*(?:--force(?:-with-lease)?\\b|-[A-Za-z]*f[A-Za-z]*\\b|\\s\\+[^\\s;&|]+))', 'i', 'Force-pushing can rewrite remote history.', 'always'],
+  ['git-reset-hard', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*reset\\b[^\\r\\n;&|]*--hard\\b', 'i', 'git reset --hard can discard local work.', 'always'],
+  ['git-clean-force-delete', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)git\\s+(?:(?:-C|-c)\\s+\\S+\\s+|-\\S+\\s+)*clean\\b(?=[^\\r\\n;&|]*\\s-(?:[^\\s]*f|f\\b))(?=[^\\r\\n;&|]*\\s-(?:[^\\s]*d|d\\b))', 'i', 'git clean with force and directory deletion can remove untracked work.', 'always'],
+  ['recursive-delete', ['Bash'], '(?:^|[;&|\\n]\\s*)(?:(?:bash|sh)\\s+(?:-\\S+\\s+)*-c\\s+[\\"\']\\s*)?(?:sudo(?:\\s+-\\S+)*\\s+)?rm\\s+(?=[^\\r\\n;&|]*-(?:[^\\s]*r|r\\b))(?=[^\\r\\n;&|]*-(?:[^\\s]*f|f\\b))', 'i', 'Recursive forced deletion outside approved scratch space is destructive.', 'outside-scratch'],
+  ['powershell-recursive-force-delete', ['PowerShell'], '(?:^|[;&|\\n]\\s*)(?:Remove-Item|ri|rm)\\b(?=[^\\r\\n;|]*-(?:Recurse|r)\\b)(?=[^\\r\\n;|]*-(?:Force|fo)\\b)', 'i', 'PowerShell recursive forced deletion outside approved scratch space is destructive.', 'outside-scratch'],
+  ['sql-destructive-ddl', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)(?:(?:psql|mysql|sqlcmd|sqlite3)\\b[^\\r\\n;&|]*)?\\b(?:DROP\\s+(?:TABLE|DATABASE|SCHEMA)|TRUNCATE(?:\\s+TABLE)?)\\b', 'i', 'Destructive SQL DDL can irreversibly remove production data or schema state.', 'always'],
+  ['package-publish', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)(?:sudo\\s+)?(?:npm|pnpm|yarn|cargo|twine)\\s+publish\\b', 'i', 'Publishing creates an external package/release side effect.', 'always'],
+  ['github-release-create', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)gh\\s+release\\s+create\\b', 'i', 'Creating a GitHub release is an external irreversible publication action.', 'always'],
+  ['production-deploy', ['Bash', 'PowerShell'], '(?:^|[;&|\\n]\\s*)(?:kubectl\\s+apply|helm\\s+(?:upgrade|install)|terraform\\s+apply|vercel\\s+deploy|fly\\s+deploy|gcloud\\s+run\\s+deploy|(?:npm|pnpm|yarn)\\s+(?:run\\s+)?deploy|deploy\\s+to\\s+(?:prod|production|live))\\b', 'i', 'Deployment changes an external environment and requires explicit approval.', 'always'],
 ].map(([id, tools, pattern, flags, reason, scope]) => ({ id, tools, pattern, flags, reason, scope }));
 
 function hashExact(value) {
@@ -153,9 +153,15 @@ function deleteTargets(command, ruleId) {
   const tails = [];
   let regex = null;
   if (ruleId === 'recursive-delete') {
-    regex = /(?:^|[;&|\n]\s*)rm\s+([^;&|\n]+)/ig;
+    regex = /(?:^|[;&|\n]\s*)(?:sudo(?:\s+-\S+)*\s+)?rm\s+([^;&|\n]+)/ig;
+    const wrapper = /(?:^|[;&|\n]\s*)(?:bash|sh)\s+(?:-\S+\s+)*-c\s+(["'])([\s\S]*?)\1/ig;
+    let wrapped;
+    while ((wrapped = wrapper.exec(text)) !== null) {
+      tails.push(...deleteTargets(wrapped[2], ruleId));
+      if (wrapped[0].length === 0) wrapper.lastIndex++;
+    }
   } else if (ruleId === 'powershell-recursive-force-delete') {
-    regex = /\bRemove-Item\b([^;|\n]+)/ig;
+    regex = /(?:^|[;|\n]\s*)(?:Remove-Item|ri|rm)\b([^;|\n]+)/ig;
   }
   if (!regex) return [];
 
@@ -190,6 +196,10 @@ function isWithin(target, root) {
 
 function scratchRoots(payload, sessionDir) {
   const roots = [os.tmpdir(), path.join(sessionDir, 'scratch')];
+  // Git Bash/MSYS exposes the Windows temp area as /tmp (and sometimes
+  // /var/tmp). Treat those aliases as scratch on Windows instead of gating a
+  // harmless temp cleanup merely because the host path syntax differs.
+  if (process.platform === 'win32') roots.push('/tmp', '/var/tmp');
   const declared = payload && (payload.scratchpad_path || payload.scratchpadPath || (payload.harness && payload.harness.scratchpadPath));
   if (declared) roots.push(declared);
   if (process.env.HARNESS_SCRATCH_DIR) roots.push(process.env.HARNESS_SCRATCH_DIR);

package/plugins/harness-everything/hooks/scripts/atomic-commit-check.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 /**
- * Atomic Commit Check (PostToolUse: apply_patch)
- * PostToolUse can't block - the edit/write already happened. So this counts
- * apply_patch calls since the last commit and, once the count crosses a
- * threshold, feeds a strong reminder back to Claude (exit 2) to commit the
- * completed chunk before piling on more changes. Resets whenever HEAD moves.
+ * Atomic Commit Check (PostToolUse: Edit/Write/apply_patch)
+ * PostToolUse can't block - the edit/write already happened. Count only edits
+ * whose targets resolve inside the current workspace. Once the count crosses
+ * the threshold, emit a strong reminder only when the Git worktree actually
+ * has uncommitted changes. Resets whenever HEAD moves.
  * Fails open on any error - this is a nudge, never a hard stop.
  */
 const { execSync } = require('child_process');
@@ -15,6 +15,90 @@ const { getWorkspaceRoot, getSessionDir } = require('./lib/harness-state');
 const THRESHOLD = 6;
 const RENUDGE_EVERY = 3;
 
+function toolNameOf(payload) {
+  return String((payload && (payload.tool_name || payload.toolName)) || '');
+}
+
+function toolInputOf(payload) {
+  return (payload && (payload.tool_input || payload.toolInput || payload.input)) || {};
+}
+
+function pathApiFor(value) {
+  return /^[A-Za-z]:[\\/]/.test(String(value || '')) ? path.win32 : path;
+}
+
+function canonicalPath(value) {
+  const text = String(value || '');
+  if (!text) return null;
+  const api = pathApiFor(text);
+  const resolved = api.resolve(text);
+
+  // realpath() is necessary on macOS where /var is a symlink to /private/var.
+  // New Write targets may not exist yet, so canonicalize the nearest existing
+  // ancestor and append the missing path segments without requiring creation.
+  const missing = [];
+  let cursor = resolved;
+  while (cursor && !fs.existsSync(cursor)) {
+    const parent = api.dirname(cursor);
+    if (!parent || parent === cursor) break;
+    missing.unshift(api.basename(cursor));
+    cursor = parent;
+  }
+  if (!cursor || !fs.existsSync(cursor)) return resolved;
+
+  let real = fs.realpathSync.native ? fs.realpathSync.native(cursor) : fs.realpathSync(cursor);
+  for (const segment of missing) real = api.join(real, segment);
+  return api.normalize(real);
+}
+
+function isWithin(target, root) {
+  if (!target || !root) return false;
+  const api = pathApiFor(target) === path.win32 || pathApiFor(root) === path.win32 ? path.win32 : path;
+  const resolvedTarget = canonicalPath(target);
+  const resolvedRoot = canonicalPath(root);
+  const relative = api.relative(resolvedRoot, resolvedTarget);
+  if (!relative) return true;
+  return relative !== '..' && !relative.startsWith(`..${api.sep}`) && !api.isAbsolute(relative);
+}
+
+function absoluteTarget(target, root) {
+  const text = String(target || '').trim();
+  if (!text) return null;
+  const api = pathApiFor(text) === path.win32 || pathApiFor(root) === path.win32 ? path.win32 : path;
+  return api.isAbsolute(text) ? api.normalize(text) : api.resolve(root, text);
+}
+
+function patchTargets(patchText) {
+  const targets = [];
+  const regex = /^\*\*\* (?:Add|Update|Delete) File:\s*(.+?)\s*$/gm;
+  let match;
+  while ((match = regex.exec(String(patchText || ''))) !== null) targets.push(match[1]);
+  return targets;
+}
+
+function editTargets(payload) {
+  const tool = toolNameOf(payload);
+  const input = toolInputOf(payload);
+  if (tool === 'Edit' || tool === 'Write') {
+    const target = input.file_path || input.filePath || input.path;
+    return target ? [String(target)] : [];
+  }
+  if (tool === 'apply_patch') {
+    return patchTargets(input.patch || input.command || input.content || '');
+  }
+  return [];
+}
+
+function touchesWorkspace(payload, root) {
+  const targets = editTargets(payload);
+  if (targets.length === 0) return false;
+  return targets.some(target => isWithin(absoluteTarget(target, root), root));
+}
+
+function writeState(stateFile, state) {
+  fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), 'utf8');
+}
+
 function main(payload) {
   try {
     const root = getWorkspaceRoot(payload);
@@ -33,17 +117,32 @@ function main(payload) {
       state.editCount = 0;
     }
 
+    // Host scratchpads, memory stores, temp files, and any other target outside
+    // the repository must not contribute to a repository commit reminder.
+    if (!touchesWorkspace(payload, root)) {
+      writeState(stateFile, state);
+      process.exit(0);
+    }
+
     state.editCount += 1;
-    fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), 'utf8');
+    writeState(stateFile, state);
 
     const overThreshold = state.editCount >= THRESHOLD;
     const onNudgeBeat = overThreshold && (state.editCount - THRESHOLD) % RENUDGE_EVERY === 0;
 
     if (onNudgeBeat) {
       const statusRaw = execSync('git status --porcelain', { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
-      const changedFiles = statusRaw ? statusRaw.split('\n').length : 0;
-      console.error(`[Atomic Commit Check] ${state.editCount} apply_patch calls since the last commit (${changedFiles} files currently changed).`);
-      console.error(`If a logically complete chunk of work is done, commit it now before continuing - large uncommitted diffs are harder to review and harder to recover from.`);
+      if (!statusRaw) {
+        // Calls that produced no Git-visible change (or work already reverted)
+        // must not leave a stale counter that immediately re-nudges later.
+        state.editCount = 0;
+        writeState(stateFile, state);
+        process.exit(0);
+      }
+
+      const changedFiles = statusRaw.split('\n').length;
+      console.error(`[Atomic Commit Check] ${state.editCount} edits since the last commit (${changedFiles} files currently changed).`);
+      console.error('If a logically complete chunk of work is done, commit it now before continuing - large uncommitted diffs are harder to review and harder to recover from.');
       process.exit(2);
     }
 
@@ -66,3 +165,12 @@ process.stdin.on('error', () => {
   clearTimeout(timeout);
   main(null);
 });
+
+module.exports = {
+  absoluteTarget,
+  canonicalPath,
+  editTargets,
+  isWithin,
+  patchTargets,
+  touchesWorkspace,
+};

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/skills/harness-everything/SKILL.md

@@ -4,7 +4,7 @@ description: "Route software/project work through the Harness kernel: classify T
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.4.0
+  version: 0.7.0
 ---
 
 # Harness Everything
@@ -29,8 +29,9 @@ These rails are mandatory; Tier guidance is not a fixed pipeline.
 ## Workflow
 
 1. Reuse current-turn kernel output, or run `node "<this-skill-dir>/scripts/kernel-router.js" "<prompt summary>"`.
-2. Preserve the invariants.
-3. Treat suggested skills as advisory: choose, combine, reorder, or omit them as useful.
+2. Ensure the emitted **Harness Routing Checkpoint** is user-visible: reuse a host-visible rendering or include it in the first progress/update message.
+3. Preserve the invariants.
+4. Treat suggested skills as advisory: choose, combine, reorder, or omit them as useful. If suggestions are non-empty and you use none, state one brief skip reason with the visible checkpoint/progress update.
 
 ## Tier Guidance
 
@@ -38,6 +39,6 @@ These rails are mandatory; Tier guidance is not a fixed pipeline.
 - **Tier 2:** TODO tracking, TDD, and verification are common suggestions.
 - **Tier 3:** Fable/multi-agent skills are optional when macro planning or delegation helps.
 
-**Rule:** do not enforce workflow order; let the agent orchestrate itself inside the invariants.
+**Rule:** enforce checkpoint visibility and workflow invariants, not workflow order; let the agent orchestrate itself inside those rails.
 
 Deep dive: <this-skill-dir>/references/triage-and-tiers.md

package/plugins/harness-everything/skills/harness-everything/references/triage-and-tiers.md

@@ -73,11 +73,12 @@ npx github:dyphn1/Harness-everything next "<brief prompt summary>"
 `kernel-router.js` delegates classification and guide discovery to `tier-router.js`, removes legacy fixed-pipeline instructions, and emits:
 
 - the recommended tier and rationale,
+- a compact **Harness Routing Checkpoint**,
 - the **required Harness invariants**,
 - **suggested skills** marked advisory,
 - the policy that the agent may choose the smallest useful skill/tool set.
 
-If a host's `UserPromptSubmit` integration already ran the kernel this turn, reuse that output rather than running it twice.
+If a host's `UserPromptSubmit` integration already ran the kernel this turn, reuse that output rather than running it twice. The checkpoint must still become user-visible for software/project work: use the host's visible hook rendering when it has one, otherwise include the checkpoint in the first progress/update message.
 
 The tier classifier is heuristic. Treat its result as the default route, not an oracle. A clear task reading or explicit user instruction may override it; record the reason when doing so.
 
@@ -116,7 +117,7 @@ Common **suggestions**, not a pipeline:
 | Isolated workspace would reduce risk | `using-git-worktrees` |
 | Quantitative scoring/benchmarking is requested | `eval-harness` |
 
-The model decides which of these are useful and in what order. It may use none, one, or several while preserving the kernel invariants.
+The model decides which of these are useful and in what order. It may use none, one, or several while preserving the kernel invariants. If the router emitted one or more suggestions and the agent uses none of them, the visible checkpoint/progress update must include one brief skip reason; using at least one suggestion does not require explaining why the others were omitted.
 
 ### Tier 3 — Macro
 
@@ -137,7 +138,7 @@ Common **suggestions**, not a pipeline:
 | Settled intent needs a spec | `to-spec` |
 | Settled work needs tracer-bullet issues | `to-tickets` |
 
-Tier 3 does **not** automatically require multi-agent execution. A strong model may complete macro work directly when that is the safer/smaller choice.
+Tier 3 does **not** automatically require multi-agent execution. A strong model may complete macro work directly when that is the safer/smaller choice. The same all-skipped rationale rule applies when the router emitted suggestions.
 
 ## 4. Cognitive OS Relationship
 
@@ -160,24 +161,26 @@ But this diagram describes a reasoning policy, not a peer-skill dependency graph
 
 | Host mode | Expected behavior |
 |---|---|
-| Lifecycle hook available | Run the Harness Kernel on prompt submission so routing context exists before domain-skill execution. Hard gates may enforce supported invariants at tool/stop boundaries. |
-| Advisory instructions only | Tell the agent to run/reuse `harness next` before software mutation and `harness verify` before completion. The behavior is advisory, not a hard gate. |
-| Manual use | Invoke `harness-everything` or `install-cognitive-os` explicitly to inspect/re-establish the contract. |
+| Lifecycle hook available | Run the Harness Kernel on prompt submission so routing context exists before domain-skill execution. Surface the emitted checkpoint through a host-visible hook surface when supported; otherwise the agent carries it into the first visible progress/update. Hard gates may enforce supported invariants at tool/stop boundaries. |
+| Advisory instructions only | Tell the agent to run/reuse `harness next` before software mutation, surface the checkpoint, and run `harness verify` before completion. The behavior is advisory, not a hard host gate. |
+| Manual use | Invoke `harness-everything` or `install-cognitive-os` explicitly to inspect/re-establish and surface the contract. |
 
-Never describe an advisory integration as hard enforcement. Platform-specific adapters may differ while preserving functional intent.
+Never describe an advisory integration as hard enforcement. Platform-specific adapters may differ while preserving functional intent. Kernel emission alone is not proof that a host UI displayed the checkpoint; #82 live evidence owns that claim.
 
 ## 6. Routing Checkpoint
 
-When a visible checkpoint is useful, keep it small:
+For software/project work, the kernel always emits a compact checkpoint and the execution surface must make it user-visible before or with the first progress update:
 
 ```markdown
 ## 🚦 Harness Routing Checkpoint
 - Tier: Tier X — <reason>
+- Strategy: <selected/deferred strategy>
 - Required invariants: route-before-execution; verify-before-claim; re-plan-after-3-same-failures
-- Suggested skills: <only the skills that appear useful>
+- Suggested skills: <deduplicated suggestions, or none>
+- Suggestion disposition: <using one or more | skipped all — brief reason>
 ```
 
-The checkpoint reports state; it does not prescribe a universal workflow.
+The checkpoint reports state; it does not prescribe a universal workflow. Suggested skills remain advisory. The only extra accountability rule is that a non-empty suggestion set cannot disappear silently: if every suggestion is skipped, state one brief reason. Do not add a skip explanation when at least one suggestion is used.
 
 ## 7. Self-Healing and Dynamic Skills
 

package/plugins/harness-everything/skills/harness-everything/scripts/kernel-router.js

@@ -117,6 +117,32 @@ function printWorkflowPlan(plan) {
   console.log(`\n=> ROUTER WORKFLOW PLAN (JSON): ${JSON.stringify(visible)}`);
 }
 
+function uniqueSuggestedSkills(plan) {
+  if (!Array.isArray(plan.suggestedSkills)) return [];
+  return [...new Set(plan.suggestedSkills.filter(skill => typeof skill === 'string' && skill.trim()))];
+}
+
+function displayTier(tier) {
+  if (tier === 'tier1') return 'Tier 1';
+  if (tier === 'tier2') return 'Tier 2';
+  if (tier === 'tier3') return 'Tier 3';
+  return tier || 'unclassified';
+}
+
+function printRoutingCheckpoint(plan) {
+  const invariants = Array.isArray(plan.requiredInvariants) ? plan.requiredInvariants : [];
+  const suggestions = uniqueSuggestedSkills(plan);
+
+  console.log('\n=> HARNESS ROUTING CHECKPOINT (REQUIRED VISIBLE STATE):');
+  console.log(`   - Tier: ${displayTier(plan.tier)}`);
+  console.log(`   - Strategy: ${plan.strategy || 'deferred'}`);
+  console.log(`   - Required invariants: ${invariants.length ? invariants.join(', ') : 'none'}`);
+  console.log(`   - Suggested skills: ${suggestions.length ? suggestions.join(', ') : 'none'}`);
+  if (suggestions.length > 0) {
+    console.log('   - Suggestion disposition: suggestions are advisory; use any that add value. If all are skipped, state one brief reason in the first visible progress/update message.');
+  }
+}
+
 function printKernelContract(plan) {
   console.log('\n=> REQUIRED HARNESS INVARIANTS:');
   for (const invariant of plan.requiredInvariants || []) {
@@ -194,6 +220,7 @@ function run(prompt, stdinPayload) {
   }
 
   printWorkflowPlan(contract.workflowPlan);
+  printRoutingCheckpoint(contract.workflowPlan);
   printKernelContract(contract.workflowPlan);
 
   if (result.status !== 0) process.exit(result.status === null ? 1 : result.status);