harness-everything 0.7.0 → 0.8.1

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.7.0",
+      "version": "0.8.1",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.7.0",
+  "version": "0.8.1",
   "author": {
     "name": "Miya Daniel"
   },

package/.github/workflows/ci.yml

@@ -70,8 +70,18 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - name: Install waza CLI
-        run: curl -fsSL https://raw.githubusercontent.com/microsoft/waza/main/install.sh | bash
+      - name: Install pinned waza CLI
+        run: |
+          WAZA_VERSION=0.38.6
+          WAZA_SHA256=a799587795fd462411ca7c7af5faccee7e24f08e41d152c10738d31334d1c063
+          mkdir -p "$HOME/bin"
+          curl -fL --retry 3 --retry-all-errors \
+            -o "$HOME/bin/waza" \
+            "https://github.com/microsoft/waza/releases/download/v${WAZA_VERSION}/waza-linux-amd64"
+          echo "${WAZA_SHA256}  $HOME/bin/waza" | sha256sum -c -
+          chmod +x "$HOME/bin/waza"
+          echo "$HOME/bin" >> "$GITHUB_PATH"
+          "$HOME/bin/waza" --version
       - name: Check every canonical SKILL.md passes waza readiness gates
         run: |
           fail=0

package/AGENTS.md

@@ -4,20 +4,20 @@ description: Operating guide for AI agents working inside the Harness-everything
 
 # AGENTS.md — Working in This Repository
 
-You are modifying **Harness**: an orchestrated agent operating system (skills + hooks/plugins + routing) for AI coding agents. Changes here ship to real agent sessions; a vague `SKILL.md`, stale manifest, or contradictory platform claim can misroute other people's agents. Precision is the product.
+You are modifying **Harness**: an orchestrated agent operating system (skills + hooks/plugins + routing) for AI coding agents. Changes here ship to real agent sessions; a vague `SKILL.md`, stale manifest, contradictory platform claim, or selected workflow that remains bypassable can misroute other people's agents. Precision is the product.
 
 ## Repository Layout
 
 | Path | What it is |
 |---|---|
 | `<skill-name>/SKILL.md` | One canonical skill per top-level directory. Frontmatter: `name`, `description`, `metadata.author`, `metadata.version`. |
-| `hooks/` | Claude Code lifecycle hook scripts and shared mechanisms such as circuit breaker, scope guard, and stop gate. Do not infer that every host packages every hook. |
-| `harness-everything/scripts/` | Runtime: kernel/tier routing, verification, bootstrap, self-heal. |
+| `hooks/` | Claude Code lifecycle hook scripts and shared mechanisms such as circuit breaker, workflow/action/scope guards, and stop gates. Do not infer that every host packages every hook. |
+| `harness-everything/scripts/` | Runtime: kernel/tier routing, workflow contract, verification, bootstrap, self-heal. |
 | `opencode-plugin/` | OpenCode native plugin implementation. Mechanism-tested, with partial live-host evidence for project-scope `.js` loading and edit/verification state on OpenCode 1.18.31 (macOS); see the evidence boundary below. |
 | `.agents/plugins/` + `plugins/harness-everything/` | Local OpenAI/Codex marketplace + `.codex-plugin` package with canonical skill copies and packaged session/prompt hooks. |
 | `submission/openai/` | Public OpenAI Skills-only listing/test inputs. The public artifact does not include local `.codex-plugin` lifecycle hooks. |
 | `evals/<skill>/` | Trigger/routing eval per skill (waza format). Required for every canonical routed skill. |
-| `behavioral-evals/` | LLM-behavior cases run via headless CLI sessions. They can be run on demand and are also structurally validated by the weekly `behavioral-evals.yml` workflow; live cases run there only when the Claude CLI is available. |
+| `behavioral-evals/` | LLM-behavior cases run via headless CLI sessions and structurally validated by CI. |
 | `benchmarks/` | BENCHMARK_SOP fixtures and recorded results. Evidence lives here or nowhere. |
 | `.claude-plugin/` | Claude Code plugin distribution manifests. Must list exactly the on-disk canonical skills. |
 | `docs/platform-capabilities.md` | Canonical current platform/install/enforcement/evidence matrix. |
@@ -27,41 +27,44 @@ You are modifying **Harness**: an orchestrated agent operating system (skills +
 
 ## OpenCode evidence boundary
 
-The retained [OpenCode evidence](benchmarks/results/live-host/opencode-2026-09-16/README.md) supports only the scoped loading and state effects above. The final snapshot is post-reset (`hardLock: false`, `count: 1`). Hard lock is only an interactive observation with no retained blocked-tool trace; reflection was operator-seeded, then agent-rewritten. Agent-controlled state deletion resets the breaker, so do not claim durable hard enforcement or behavioral effectiveness. `.mjs` auto-discovery is broken on this host version. Global scope, npm-package installation, and other host versions remain unverified.
+The retained [OpenCode evidence](benchmarks/results/live-host/opencode-2026-09-16/README.md) supports project-scope `.js` loading and edit/verification state on OpenCode 1.18.31 (macOS). The final snapshot is post-reset (`hardLock: false`, `count: 1`). Hard lock is only an interactive observation with no retained blocked-tool trace; reflection was operator-seeded, then agent-rewritten. Agent-controlled state deletion resets the breaker. Global scope, npm-package installation, and other OpenCode versions remain unverified.
 
 ## Non-Negotiable Change Rules
 
-1. **Every canonical SKILL.md keeps ≤ 500 tokens** (hard CI gate) and must contain `## USE FOR:` and `## DO NOT USE FOR:` sections. Deep detail goes in the skill's `references/` or `guides/`.
-2. **Descriptions are routing surfaces.** Two skills whose descriptions overlap enough that a router cannot distinguish them will fail `test:collision`. When adding a skill, differentiate its description from near neighbors deliberately.
-3. **A new canonical skill ships with a routing eval** (`evals/<skill>/eval.yaml` + positive/negative tasks). The positive task's `description:` field must carry the skill's exact frontmatter description — waza's deterministic matcher requires it verbatim.
-4. **Release version policy:** normal PRs do not manually bump package/plugin versions. `semantic-release` determines the next stable SemVer from Conventional Commits on `main`, and `scripts/sync-release-version.js` owns distribution-version synchronization. Skill frontmatter versions remain release metadata and must never exceed the package version's numeric base. Nested sub-skills (`<skill>/<sub>/SKILL.md`) inherit the parent skill's version and must always match it.
-5. **Distribution manifests are generated facts, not opinions:** if you add/remove/rename a canonical skill, update/sync every distribution that copies or lists it. Run `npm run plugin:sync`, `npm run test:consistency`, and `npm run test:plugin:openai` rather than updating only `.claude-plugin/plugin.json`.
-6. **Platform capability claims are tested contracts.** If host integration behavior changes, update `docs/platform-capabilities.md` and every affected current-state surface in the same change. Never turn package/mechanism evidence into a live-host claim, and never describe public Skills-only behavior as if it includes local lifecycle hooks.
-7. **Runtime/workflow claims are generated facts.** `package.json`, `.nvmrc`, `Dockerfile`, and active `.github/workflows/*.yml` are parsed by `scripts/repository-contract.js`. After changing them, run `npm run docs:sync`; `test:repo-contract` rejects stale generated docs, unsupported action majors, Node runtimes below the support floor, or loss of the Node 22 compatibility lane.
-8. **CHANGELOG.md keeps pending human-authored notes under `[Unreleased]`.** Do not create new alpha/beta/rc release headings; semantic-release owns stable release headings, tags, and release notes.
-9. **Conventional Commit type is release input.** The final commit/squash title that lands on `main` must follow the convention. Breaking changes release major; `feat` releases minor; `fix`, `perf`, `refactor`, `build`, and `revert` release patch; `docs`, `test`, `ci`, `style`, and `chore` do not release by themselves.
+1. **Every canonical SKILL.md keeps ≤ 500 tokens** (hard CI gate) and must contain `## USE FOR:` and `## DO NOT USE FOR:`. Deep detail goes in references/guides.
+2. **Descriptions are routing surfaces.** Differentiate neighboring skills deliberately; `test:collision` guards overlap.
+3. **A new canonical skill ships with a routing eval.** Positive task `description:` must exactly match the skill frontmatter description.
+4. **Release version policy:** normal PRs do not manually bump package/plugin versions. `semantic-release` owns stable SemVer and `scripts/sync-release-version.js` owns distribution synchronization. Nested sub-skills inherit their parent skill version.
+5. **Distribution manifests are generated facts:** add/remove/rename changes must sync every copied/listed distribution. Run `npm run plugin:sync`, `npm run test:consistency`, and `npm run test:plugin:openai`.
+6. **Platform capability claims are tested contracts.** Update `docs/platform-capabilities.md` with integration behavior changes. Package/mechanism evidence is not live-host evidence, and public Skills-only behavior does not include local lifecycle hooks.
+7. **Runtime/workflow claims are generated facts.** `package.json`, `.nvmrc`, Dockerfile, and active workflows feed `scripts/repository-contract.js`; run `npm run docs:sync` after relevant changes.
+8. **CHANGELOG.md keeps pending human-authored notes under `[Unreleased]`.** Semantic-release owns stable headings/tags/release notes.
+9. **Conventional Commit type is release input.** Breaking→major; `feat`→minor; `fix`/`perf`/`refactor`/`build`/`revert`→patch; docs/test/ci/style/chore do not release by themselves.
+10. **Selected workflow is mandatory; reasoning inside it stays flexible.** Before omitting a suggested skill, read/evaluate its complete `SKILL.md` flow. Suggested skills may be `not-applicable` with a flow-grounded reason, but a selected topology must be executed to resolution. Do not bypass it because the task feels simple/routine/already clear. Escape is limited to genuinely uncovered workflow scope or host-capability loss and requires explicit scope + evidence. Do not turn this into one universal TODO/TDD/Fable sequence.
+11. **Major mutation requires Git worktree isolation.** Read-only discovery may stay in the bound repository. Tier 3 / Fable source and artifact changes must target a verified linked worktree belonging to that repository; creation failure means `blocked`. Worktree isolation is separate from durable multi-agent workspace state. Scoped escape never waives it. See [workflow-runtime.md](docs/workflow-runtime.md) for the tested boundary and limitations.
 
 ## Verification Before You Claim Done
 
-Run the local gates that cover the same contract categories as CI:
+Run the gates that cover the same contract categories as CI:
 
 ```bash
-npm test                         # self-regression: syntax, routing, mechanisms
-npm run test:mutations           # focused mutation checks
-npm run test:mechanism           # mechanism suites alone
-npm run test:consistency         # manifests, versions, docs links, eval coverage + repository contract
-npm run test:repo-contract       # runtime/workflow/action/schedule drift gate
-npm run test:docs:capabilities   # platform documentation drift gate
-npm run test:references          # executable/deep-dive references
-npm run test:release             # release catalog + semantic-release/version-sync contract
-npm run test:collision           # description collision detection
-npm run test:routing:skills      # every positive skill route reaches its target
-npm run test:plugin:openai       # local OpenAI/Codex plugin package
-npm run test:plugin:submission   # public Skills-only submission inputs/bundle parity
+npm test
+npm run test:mutations
+npm run test:mechanism
+npm run test:consistency
+npm run test:repo-contract
+npm run test:docs:capabilities
+npm run test:references
+npm run test:release
+npm run test:collision
+npm run test:routing:skills
+npm run test:routing:invariants
+npm run test:plugin:openai
+npm run test:plugin:submission
 npm run test:platform:compatibility
 ```
 
-If waza is installed (`~/bin/waza`), also run what CI runs:
+If waza is installed (`~/bin/waza`), also run:
 
 ```bash
 waza check <skill-dir>
@@ -69,16 +72,16 @@ waza spec verify <skill> evals/<skill>/eval.yaml --fail --threshold 1
 waza tokens check
 ```
 
-Node.js 24 is the primary CI runtime across Ubuntu, Windows, and macOS. A separate Ubuntu Node.js 22 lane protects the advertised minimum runtime. See [docs/repository-contract.md](docs/repository-contract.md) for the generated current state.
+Node.js 24 is primary CI across Ubuntu/Windows/macOS; a Node.js 22 lane protects the supported minimum. See [docs/repository-contract.md](docs/repository-contract.md).
 
-Do not report "it works" from reading code. Record which evidence layer you actually proved: package, deterministic mechanism, live host, or behavior.
+Do not report "it works" from code reading. State the evidence layer proved: package, deterministic mechanism, live host, or behavior.
 
 ## Behavioral & Benchmark Evidence
 
-Deterministic mechanism tests prove the tested hook/plugin contract; they do **not** prove a real host loaded it or that agents behave differently. For behavior:
+Deterministic mechanism tests prove the tested hook/plugin contract; they do **not** prove a real host loaded it or that behavior improved. For behavior:
 
 - `node behavioral-evals/run.js run --engine opencode` (or `--engine claude`) — on-demand, token-costing.
-- The weekly `behavioral-evals.yml` workflow always validates case structure and runs live cases only when its runner has the Claude CLI.
+- Weekly behavioral workflow validates case structure and runs live cases only when its runner has the required CLI.
 - `node benchmarks/run.js scaffold <scenario>` → run both variants → `record` with evidence logs.
 
-For a live-host enforcement claim, preserve a host/session artifact showing the mechanism was actually loaded and fired. Results are committed where the relevant evidence workflow requires it. A benchmark run without a recorded result is indistinguishable from one that never happened.
+For a live-host enforcement claim, preserve a host/session artifact showing the mechanism loaded and fired. For an effectiveness claim, use the paired evidence discipline in #71 rather than inferring improvement from mechanism presence.

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.8.1](https://github.com/dyphn1/Harness-everything/compare/v0.8.0...v0.8.1) (2026-09-17)
+
+### Bug Fixes
+
+* **router:** enforce selected workflow lifecycle ([9f3394a](https://github.com/dyphn1/Harness-everything/commit/9f3394a3ff59aaa08428e12a9a2784e7541368c4))
+* **workflow:** Close lifecycle isolation gaps ([96b58e7](https://github.com/dyphn1/Harness-everything/commit/96b58e7ce2e52312880663e59380038e4bf5f985)), closes [#131](https://github.com/dyphn1/Harness-everything/issues/131)
+* **workflow:** Normalize Windows worktree paths ([18ee645](https://github.com/dyphn1/Harness-everything/commit/18ee645a1a7165d01d60a964947082ad0108b93c)), closes [#131](https://github.com/dyphn1/Harness-everything/issues/131)
+* **workflow:** require worktree isolation for major mutations ([9ba0098](https://github.com/dyphn1/Harness-everything/commit/9ba0098adc94fe141fca2c03f07d0883d9a56b9b))
+
+## [Unreleased]
+
+### Fixed
+
+- Make selected workflows persist across follow-up prompts, bind Fable runs to workflow/session identities, and require correlated stage evidence before completion (#131, #142).
+- Enforce major-workflow Git worktree isolation at supported mutation hooks, check direct/patch targets and explicit shell paths, and retain isolation across scoped escape and blocked states.
+- Provide bounded run entry/replan and per-stage escape commands; expose unsupported hosts and shell-sandbox limits without upgrading live-host evidence.
+
+## [0.8.0](https://github.com/dyphn1/Harness-everything/compare/v0.7.0...v0.8.0) (2026-09-17)
+
+### Features
+
+* **router:** require evaluation before skipping suggested skills ([#140](https://github.com/dyphn1/Harness-everything/issues/140)) ([b959cb9](https://github.com/dyphn1/Harness-everything/commit/b959cb94afff984c4e4507f0be7f6c62dfa89961)), closes [#131](https://github.com/dyphn1/Harness-everything/issues/131)
+
 ## [0.7.0](https://github.com/dyphn1/Harness-everything/compare/v0.6.1...v0.7.0) (2026-09-17)
 
 ### Features

package/README.md

@@ -19,7 +19,7 @@ AI coding agents are highly capable, but they struggle with self-regulation, env
 
 Harness acts as an automated system supervisor. It remains completely silent and out of the way, intervening only when execution boundaries are violated or failures are detected.
 
-Harness deliberately follows a **minimal rails, maximum freedom** design: the runtime enforces only a few cross-cutting invariants — route before execution, verify before claim, and re-plan after repeated identical failure — while capable agents remain free to choose, combine, reorder, or skip domain skills according to the task.
+Harness deliberately follows a **minimal rails, maximum freedom** design: the runtime enforces route-before-execution, verify-before-claim, and re-plan-after repeated identical failure. When routing emits skill suggestions, it adds one conditional rail: **evaluate before skip**. The agent must read each suggested skill's `SKILL.md` entry/basic flow before omitting it, but remains free to choose, combine, reorder, or skip execution after that evaluation.
 
 ### Comparison: Prompt vs. Skill vs. Harness
 
@@ -68,7 +68,7 @@ npx github:dyphn1/Harness-everything install
 1. **Use the selected surface's real mechanism:** Claude Code hooks, the local OpenAI plugin lifecycle hooks, OpenCode's plugin API, or advisory instructions depending on what you installed.
 2. **Preflight / session context where packaged:** Hook-capable surfaces can inject environment/session context automatically; advisory-only surfaces must not be described as if they do.
 3. **Verification boundary:** Completion claims require objective evidence; whether that boundary is mechanically invoked or explicitly called depends on the host surface.
-4. **Agent Freedom Preserved:** Tier classification suggests useful skills, but does not impose a universal TODO/TDD/Fable sequence.
+4. **Mandatory applicable workflow:** Evaluate each suggested skill's complete `SKILL.md` before omission, then resolve the selected topology with objective evidence. Reasoning and implementation remain flexible; escape applies only to a declared uncovered stage with evidence. Tier 3 / Fable mutation requires a verified Git worktree. See the [workflow runtime contract](docs/workflow-runtime.md) for entry, completion, and host limits. Harness does not impose one universal TODO/TDD/Fable sequence.
 
 ### What Gets Installed (and How to Remove It)
 
@@ -119,9 +119,10 @@ flowchart TD
 flowchart TD
     U([User Request]) --> K[Harness Kernel<br/>classify scope + establish invariants]
     K --> T{Tier recommendation}
-    T -->|Tier 1| A[Agent chooses smallest useful tactic / skill set]
-    T -->|Tier 2| A
-    T -->|Tier 3| A
+    T --> S{Suggested skills?}
+    S -->|Yes| R[Read each suggested SKILL.md<br/>evaluate flow + applicability]
+    S -->|No| A[Agent chooses smallest useful tactic / skill set]
+    R --> A
     A --> Exec[Execute Code / Run Commands]
     Exec --> Gate{Objective evidence supports completion?}
     Gate -->|No| Retry[Diagnose / iterate]
@@ -137,7 +138,7 @@ flowchart TD
     style Gate fill:#ffcdd2,stroke:#c62828,stroke-width:1px,color:#000000
 ```
 
-The Tier changes the **recommendations**, not the required order. Tier 2 may suggest `tdd`, `todo-driven-workflow`, or `verification-loop`; Tier 3 may suggest Fable or multi-agent capabilities. The model decides what actually helps.
+The Tier changes the **recommendations**, not the required order. Tier 2 may suggest `tdd`, `todo-driven-workflow`, or `verification-loop`; Tier 3 may suggest Fable or multi-agent capabilities. Suggestions are **mandatory to evaluate and advisory to execute**: read each suggested skill's `SKILL.md` flow before omission, then let the model decide what actually helps.
 
 ---
 
@@ -145,7 +146,7 @@ The Tier changes the **recommendations**, not the required order. Tier 2 may sug
 
 Harness operates through six core cognitive concepts:
 
-1. **Kernel Router (`kernel-router.js` + `tier-router.js`):** `tier-router.js` remains the classifier, dynamic-skill detector, and knowledge-guide matcher. `kernel-router.js` is the public runtime boundary: it preserves the classifier result, removes legacy fixed-pipeline instructions, injects the three mandatory invariants, and presents domain skills as advisory suggestions. This prevents host peer-skill selection from bypassing Harness while preserving agent autonomy. If nothing matches at all — including nothing already kept from the open skills ecosystem — `find-skills` checks `npx skills list` live and, if still nothing, searches `skills.sh`/`npx skills` with explicit approval before installation.
+1. **Kernel Router (`kernel-router.js` + `tier-router.js`):** `tier-router.js` remains the classifier, dynamic-skill detector, and knowledge-guide matcher. `kernel-router.js` is the public runtime boundary: it preserves the classifier result, removes legacy fixed-pipeline instructions, injects the baseline invariants, and adds `evaluate-suggestions-before-skip` whenever domain skills are suggested. Suggestions are mandatory to evaluate by reading their `SKILL.md` entry/basic flow, but advisory to execute after evaluation. This prevents host peer-skill selection or superficial routing summaries from bypassing Harness while preserving agent autonomy. If nothing matches at all — including nothing already kept from the open skills ecosystem — `find-skills` checks `npx skills list` live and, if still nothing, searches `skills.sh`/`npx skills` with explicit approval before installation.
 2. **Guard (`rule-of-3.js`):** The fail-safe circuit breaker. Tracks failure signatures across terminal runs on integration surfaces that package the required lifecycle hooks. If a test or command fails 3 times with the same signature, it locks mutating tools and forces a `zoom-out` reflection: re-verify every assumption with read-only tools, write a fact-checked report, then resume on a fresh diagnosis. A companion `Stop` gate (`stop-gate.js`) can bounce the end of a turn once per edit batch when edits were never followed by successful verification on hosts where that hook is installed.
 3. **Memory (`state-persist.js`):** Session transaction logging for stateful hook/plugin integrations. Static skills/instructions alone do not create WAL state.
 4. **Reflection (`self-evolve`):** Long-term workspace immunization. Upon task completion, the agent reflects on the root cause of resolved issues, then judges whether the lesson is a simple rule or a reusable, complex pattern: simple rules are appended to local workspace rules (`RULES.md`); genuinely reusable patterns are instead packaged as a dynamic skill (via `skill-creator`'s Dynamic Skill Generation Contract) and registered in `manifest.json` so the Router picks it up in future sessions. Either path is validated by a hermetic self-regression suite before it's persisted.
@@ -285,7 +286,7 @@ Mechanism tests prove individual packaged mechanisms; only real host/session evi
 
 ### Catalog hygiene
 
-`npm run test:consistency` keeps distribution manifests, docs links, skill frontmatter, routing-eval coverage, platform capability claims, and the generated repository runtime/workflow contract in lockstep with what is actually on disk. `npm run test:repo-contract` runs the runtime/workflow drift gate directly, while `npm run docs:sync` regenerates [docs/repository-contract.md](docs/repository-contract.md) after an intentional change. `npm run test:docs:capabilities` runs the platform-doc drift check directly. `npm run test:references` checks every executable/deep-dive path named by `SKILL.md`; `npm run test:release` compares release/catalog evidence; `npm run test:routing:skills` recursively classifies nested skills and executes the real router for every directly-routable skill's positive cases; `npm run test:routing:invariants` guards the invariant-first architecture; and `harness verify-install` detects stale installed versions or file trees. The installer E2E gate performs install → verify-install → uninstall against seeded user-owned files on Ubuntu, Windows, and macOS so path and ownership symmetry regressions fail CI. `npm run test:collision` fails CI when two skills' descriptions overlap enough to confuse the router.
+`npm run test:consistency` keeps distribution manifests, docs links, skill frontmatter, routing-eval coverage, platform capability claims, and the generated repository runtime/workflow contract in lockstep with what is actually on disk. `npm run test:repo-contract` runs the runtime/workflow drift gate directly, while `npm run docs:sync` regenerates [docs/repository-contract.md](docs/repository-contract.md) after an intentional change. `npm run test:docs:capabilities` runs the platform-doc drift check directly. `npm run test:references` checks every executable/deep-dive path named by `SKILL.md`; `npm run test:release` compares release/catalog evidence; `npm run test:routing:skills` recursively classifies nested skills and executes the real router for every directly-routable skill's positive cases; `npm run test:routing:invariants` guards the invariant-first architecture including read-before-skip; and `harness verify-install` detects stale installed versions or file trees. The installer E2E gate performs install → verify-install → uninstall against seeded user-owned files on Ubuntu, Windows, and macOS so path and ownership symmetry regressions fail CI. `npm run test:collision` fails CI when two skills' descriptions overlap enough to confuse the router.
 
 ---
 

package/benchmarks/results/reviews/pr142-verification.json

@@ -0,0 +1,95 @@
+{
+  "schemaVersion": 1,
+  "baselineCommit": "8b99baec44745e171f078fe9eb3dac6fd812b5c8",
+  "reviewedRevision": "commit containing this report",
+  "evidenceLayer": "local deterministic mechanisms and packages",
+  "environment": {
+    "os": "win32",
+    "node": "v24.15.0",
+    "npm": "11.12.1"
+  },
+  "gates": [
+    {
+      "gate": "test",
+      "exitCode": 0,
+      "seconds": 76.007
+    },
+    {
+      "gate": "test:mutations",
+      "exitCode": 0,
+      "seconds": 5.309
+    },
+    {
+      "gate": "test:mechanism",
+      "exitCode": 0,
+      "seconds": 54.904
+    },
+    {
+      "gate": "test:consistency",
+      "exitCode": 0,
+      "seconds": 0.782
+    },
+    {
+      "gate": "test:repo-contract",
+      "exitCode": 0,
+      "seconds": 0.522
+    },
+    {
+      "gate": "test:docs:capabilities",
+      "exitCode": 0,
+      "seconds": 0.639
+    },
+    {
+      "gate": "test:references",
+      "exitCode": 0,
+      "seconds": 0.597
+    },
+    {
+      "gate": "test:release",
+      "exitCode": 0,
+      "seconds": 5.161
+    },
+    {
+      "gate": "test:collision",
+      "exitCode": 0,
+      "seconds": 0.481
+    },
+    {
+      "gate": "test:routing:skills",
+      "exitCode": 0,
+      "seconds": 2.926
+    },
+    {
+      "gate": "test:routing:invariants",
+      "exitCode": 0,
+      "seconds": 3.521
+    },
+    {
+      "gate": "test:plugin:openai",
+      "exitCode": 0,
+      "seconds": 4.225
+    },
+    {
+      "gate": "test:plugin:submission",
+      "exitCode": 0,
+      "seconds": 0.963
+    },
+    {
+      "gate": "test:platform:compatibility",
+      "exitCode": 0,
+      "seconds": 0.612
+    }
+  ],
+  "mechanismSuites": 44,
+  "lifecycleAssertions": {
+    "source": 50,
+    "openaiPackage": 50
+  },
+  "waza": {
+    "checks": 57,
+    "passed": 57
+  },
+  "liveHost": "not run for this change",
+  "behavioralEffectiveness": "not measured for this change",
+  "windowsPathRegression": "Native resolution equates Windows 8.3 and long path spellings; regression and final local self-regression passed."
+}

package/ci/action-gate.test.js

@@ -237,7 +237,7 @@ try {
   check(canonicalHooks.hooks.Stop.some(group => group.id === 'harness:stop:action-gate-audit'), 'Claude hook manifest closes unresolved approvals on Stop');
 
   const pluginHooks = JSON.parse(fs.readFileSync(path.join(ROOT, 'plugins', 'harness-everything', 'hooks', 'hooks.json'), 'utf8'));
-  const pluginPre = pluginHooks.hooks.PreToolUse.find(group => group.matcher === 'Bash|apply_patch');
+  const pluginPre = pluginHooks.hooks.PreToolUse.find(group => group.matcher === 'Bash|apply_patch' && group.hooks.some(hook => /codex-action-gate-pre\.js/.test(hook.command)));
   check(pluginPre && pluginPre.hooks.some(hook => /codex-action-gate-pre\.js/.test(hook.command)), 'OpenAI plugin wires the attribution-aware Codex action-gate adapter to Bash|apply_patch');
   check(!Object.prototype.hasOwnProperty.call(pluginHooks.hooks, 'PostToolUseFailure'), 'Codex plugin does not declare unsupported PostToolUseFailure lifecycle event');
   const pluginPost = pluginHooks.hooks.PostToolUse.find(group => group.matcher === 'Bash|apply_patch');

package/ci/doc-capability-consistency.test.js

@@ -44,6 +44,7 @@ const CURRENT_SURFACES = [
   'docs/platform-capabilities.md',
   'docs/reflection.md',
   'docs/routing.md',
+  'docs/workflow-runtime.md',
   'docs/troubleshooting.md',
   'docs/openai-plugin.md',
   'submission/openai/README.md',
@@ -59,6 +60,8 @@ const STALE_PATTERNS = [
   /Only possible on Claude Code \(the only platform with a hook\/exit-code execution system\)/i,
   /On platforms with no hook system at all \(Cursor, Copilot, Codex/i,
   /hooks[^\n]{0,100}Hard enforcement, Claude Code only/i,
+  /mandatory evaluation\s*[,/]\s*advisory execution/i,
+  /Tier-specific skills remain advisory/i,
   /Codex[^\n]{0,180}\.codex\/skills\//i,
 ];
 

package/ci/invariant-routing.test.js

@@ -7,19 +7,15 @@ const ROOT = path.resolve(__dirname, '..');
 let failed = 0;
 
 function check(condition, message) {
-  if (condition) {
-    console.log(`  PASS ${message}`);
-  } else {
-    console.error(`  FAIL ${message}`);
-    failed++;
-  }
+  if (condition) console.log(`  PASS ${message}`);
+  else { console.error(`  FAIL ${message}`); failed++; }
 }
 
 function read(rel) {
   return fs.readFileSync(path.join(ROOT, rel), 'utf8');
 }
 
-console.log('=== Invariant-First Routing Contract ===');
+console.log('=== Mandatory Workflow Routing Contract ===');
 
 const kernel = path.join(ROOT, 'harness-everything', 'scripts', 'kernel-router.js');
 const tier2 = spawnSync(process.execPath, [kernel, 'add a login endpoint with tests and update the implementation'], {
@@ -35,18 +31,31 @@ check(tier2.stdout.includes('Route before execution'), 'route-before-execution i
 check(tier2.stdout.includes('Verify before claim'), 'verify-before-claim invariant is present');
 check(tier2.stdout.includes('after 3 same-signature failures'), 'failure escalation invariant is present');
 check(tier2.stdout.includes('loop-budget:'), 'iterative-single loop budget invariant is present');
-check(tier2.stdout.includes('SUGGESTED SKILLS (ADVISORY'), 'domain skills are explicitly advisory');
+check(tier2.stdout.includes('evaluate-suggestions-before-skip'), 'non-empty suggestions inject evaluate-before-skip invariant');
+check(tier2.stdout.includes('WORKFLOW SKILLS (EVALUATE APPLICABILITY'), 'domain suggestions remain applicability inputs');
+check(tier2.stdout.includes('SELECTED WORKFLOW IS MANDATORY'), 'selected workflow execution is mandatory');
 check(tier2.stdout.includes('tdd:'), 'Tier 2 can still recommend TDD');
 check(!tier2.stdout.includes('BASE EXECUTION LOOP'), 'legacy fixed base-execution-loop output is suppressed');
-check(tier2.stdout.includes('Do not enforce workflow order'), 'self-orchestration policy is explicit');
+check(tier2.stdout.includes('Mandatory applicable workflow'), 'orchestration policy requires selected applicable workflow');
+check(tier2.stdout.includes('model controls HOW to satisfy it'), 'reasoning/implementation freedom remains inside workflow');
+check(tier2.stdout.includes('WORKFLOW EXECUTION CONTRACT (MANDATORY WHEN SELECTED)'), 'kernel emits workflow execution contract');
+check(tier2.stdout.includes('- State: unpersisted'), 'manual route without host session does not claim persisted lifecycle');
+check(tier2.stdout.includes('Generic simple/routine/already-clear reasons cannot waive'), 'model confidence cannot bypass workflow');
+check(tier2.stdout.includes('Escape is limited to workflow-uncovered-scope or host-capability-unavailable'), 'workflow escape is exception-only');
+check(!tier2.stdout.includes('execution remains advisory after evaluation'), 'old advisory execution wording is absent');
+check(!tier2.stdout.includes('isolated-worktree-before-mutation'), 'Tier 2 does not inherit the major-workflow worktree invariant');
 
 const tier2Checkpoints = tier2.stdout.match(/HARNESS ROUTING CHECKPOINT \(REQUIRED VISIBLE STATE\)/g) || [];
-check(tier2Checkpoints.length === 1, 'Tier 2 emits exactly one required routing checkpoint');
-check(tier2.stdout.includes('- Tier: Tier 2'), 'checkpoint exposes the human-readable Tier 2');
-check(tier2.stdout.includes('- Strategy: iterative-single'), 'checkpoint exposes the selected strategy');
+check(tier2Checkpoints.length === 1, 'Tier 2 emits exactly one routing checkpoint');
+check(tier2.stdout.includes('- Tier: Tier 2'), 'checkpoint exposes Tier 2');
+check(tier2.stdout.includes('- Strategy: iterative-single'), 'checkpoint exposes selected strategy');
 check(/- Required invariants: .*verify-before-claim/.test(tier2.stdout), 'checkpoint exposes required invariants');
-check(/- Suggested skills: .*tdd/.test(tier2.stdout), 'checkpoint exposes deduplicated suggestions');
-check(tier2.stdout.includes('If all are skipped, state one brief reason'), 'non-empty suggestions carry an all-skipped rationale contract');
+check(/- Suggested skills: .*tdd/.test(tier2.stdout), 'checkpoint exposes suggestions');
+check(tier2.stdout.includes('Suggestion evaluation: MANDATORY'), 'checkpoint requires suggestion evaluation');
+check(tier2.stdout.includes('read its complete SKILL.md entry'), 'checkpoint requires reading skill entry');
+check(tier2.stdout.includes('name, description, router summary'), 'checkpoint rejects metadata-only omission');
+check(tier2.stdout.includes('routine/common task'), 'checkpoint rejects routine-task omission shortcut');
+check(tier2.stdout.includes('selected workflow is mandatory'), 'checkpoint distinguishes skill applicability from topology obligation');
 
 const tier3 = spawnSync(process.execPath, [kernel, 'audit the entire repository architecture and coordinate multiple modules'], {
   cwd: ROOT,
@@ -54,36 +63,98 @@ const tier3 = spawnSync(process.execPath, [kernel, 'audit the entire repository
 });
 check(tier3.status === 0, 'Tier 3 kernel routing exits successfully');
 check(/RECOMMENDED TIER:\s*Tier 3/i.test(tier3.stdout), 'macro task remains Tier 3');
-check(tier3.stdout.includes('"strategy":"fable-staged"'), 'Tier 3 dependent/unproven work selects fable-staged');
-check(tier3.stdout.includes('fable-mode / fable-discipline'), 'Tier 3 selected plan suggests Fable capabilities');
-check(tier3.stdout.includes('suggested skills remain advisory'), 'Tier 3 suggestions remain non-mandatory');
-check(tier3.stdout.includes('HARNESS ROUTING CHECKPOINT (REQUIRED VISIBLE STATE)'), 'Tier 3 also emits the required routing checkpoint');
+check(tier3.stdout.includes('"strategy":"fable-staged"'), 'Tier 3 task selects fable-staged');
+check(tier3.stdout.includes('fable-mode / fable-discipline'), 'Tier 3 plan exposes Fable capabilities');
+check(tier3.stdout.includes('selected Fable topology must be entered and resolved before completion'), 'selected Fable topology is mandatory');
+check(tier3.stdout.includes('WORKFLOW EXECUTION CONTRACT (MANDATORY WHEN SELECTED)'), 'Tier 3 emits execution contract');
+check(tier3.stdout.includes('isolated-worktree-before-mutation'), 'Tier 3 structured plan carries the worktree isolation invariant');
+check(tier3.stdout.includes('using-git-worktrees'), 'Tier 3 structured plan surfaces the worktree workflow skill');
+check(tier3.stdout.includes('mutations require Git worktree isolation'), 'Tier 3 execution contract requires worktree isolation before mutation');
+check(tier3.stdout.includes('unavailable isolation means BLOCKED'), 'Tier 3 worktree failure blocks instead of falling back in place');
 
 const harnessSkill = read('harness-everything/SKILL.md');
-check(!/Requests that already name a skill/i.test(harnessSkill), 'harness entrypoint no longer opts out when another skill is named');
-check(/including work that already names or strongly matches another skill/i.test(harnessSkill), 'named domain skills still pass through Harness routing');
-check(/not a fixed pipeline/i.test(harnessSkill), 'skill contract rejects fixed pipeline semantics');
-check(/Ensure the emitted \*\*Harness Routing Checkpoint\*\* is user-visible/.test(harnessSkill), 'skill contract requires checkpoint visibility');
-check(/If suggestions are non-empty and you use none, state one brief skip reason/.test(harnessSkill), 'skill contract requires rationale only when all suggestions are skipped');
+check(/Work that names or matches another skill/i.test(harnessSkill), 'named domain skills still pass through Harness routing');
+check(/selected topology is not advisory/i.test(harnessSkill), 'skill contract makes selected topology mandatory');
+check(/"Simple", "routine".*cannot justify omission/i.test(harnessSkill), 'skill contract rejects confidence/routine omission shortcuts');
+check(/explicit escape with uncovered scope \+ evidence/i.test(harnessSkill), 'skill contract defines evidence-backed escape');
+check(/Complete only after applicable workflow obligations and objective verification resolve/i.test(harnessSkill), 'skill contract gates completion on workflow resolution');
+check(/mandatory applicable workflow; flexible reasoning\/implementation/i.test(harnessSkill), 'skill entry states core policy');
+
+const pluginHarnessSkill = read('plugins/harness-everything/skills/harness-everything/SKILL.md');
+check(pluginHarnessSkill === harnessSkill, 'canonical/plugin Harness SKILL.md copies remain identical');
+check(read('plugins/harness-everything/skills/harness-everything/scripts/kernel-router.js') === read('harness-everything/scripts/kernel-router.js'), 'canonical/plugin kernel-router copies remain identical');
+check(read('plugins/harness-everything/skills/harness-everything/scripts/kernel-router-core.js') === read('harness-everything/scripts/kernel-router-core.js'), 'canonical/plugin kernel-router core copies remain identical');
+check(read('plugins/harness-everything/skills/harness-everything/references/triage-and-tiers.md') === read('harness-everything/references/triage-and-tiers.md'), 'canonical/plugin triage references remain identical');
+
+const worktreeSkill = read('using-git-worktrees/SKILL.md');
+check(/Major workflow mode/i.test(worktreeSkill), 'worktree skill defines mandatory major-workflow mode');
+check(/never fall back to the primary working tree/i.test(worktreeSkill), 'worktree skill blocks unsafe in-place fallback for major work');
+check(/Creation\/entry failure => `BLOCKED`/i.test(worktreeSkill), 'worktree skill makes isolation failure a blocked state');
+check(read('plugins/harness-everything/skills/using-git-worktrees/SKILL.md') === worktreeSkill, 'canonical/plugin worktree skill copies remain identical');
 
 const cognitiveSkill = read('install-cognitive-os/SKILL.md');
-check(/policy, not a required peer-skill selection/i.test(cognitiveSkill), 'Cognitive OS is defined as policy rather than peer-skill dependency');
-check(!/Tasks already governed by a more specific domain skill/i.test(cognitiveSkill), 'domain skill selection no longer disables Cognitive OS policy');
+check(/policy, not a required peer-skill selection/i.test(cognitiveSkill), 'Cognitive OS remains reasoning policy rather than peer dependency');
 
 const hooks = JSON.parse(read('hooks/hooks.json'));
 const promptHooks = hooks.hooks && hooks.hooks.UserPromptSubmit;
 const command = promptHooks && promptHooks[0] && promptHooks[0].hooks && promptHooks[0].hooks[0] && promptHooks[0].hooks[0].command;
-check(command === 'node "${CLAUDE_PLUGIN_ROOT}/harness-everything/scripts/kernel-router.js"', 'UserPromptSubmit anchors the Harness kernel to the Claude plugin root');
+check(command === 'node "${CLAUDE_PLUGIN_ROOT}/harness-everything/scripts/kernel-router.js"', 'UserPromptSubmit anchors kernel to Claude plugin root');
+const preHooks = hooks.hooks && hooks.hooks.PreToolUse || [];
+const workflowHook = preHooks.find(entry => entry.id === 'harness:pre:workflow-gate');
+check(Boolean(workflowHook), 'Claude PreToolUse includes workflow gate');
+check(workflowHook && /Bash/.test(workflowHook.matcher) && /PowerShell/.test(workflowHook.matcher) && /Edit/.test(workflowHook.matcher) && /Write/.test(workflowHook.matcher), 'Claude workflow gate covers shell and artifact mutation');
+const stopHooks = hooks.hooks && hooks.hooks.Stop || [];
+check(stopHooks.some(entry => entry.id === 'harness:stop:workflow-completion-gate'), 'Claude Stop includes Fable workflow completion gate');
+
+const openaiHooks = JSON.parse(read('plugins/harness-everything/hooks/hooks.json'));
+const openaiWorkflowHook = (openaiHooks.hooks && openaiHooks.hooks.PreToolUse || []).find(entry =>
+  (entry.hooks || []).some(hook => String(hook.command || '').includes('workflow-gate.js'))
+);
+check(openaiWorkflowHook && /Bash/.test(openaiWorkflowHook.matcher) && /apply_patch/.test(openaiWorkflowHook.matcher), 'Codex/OpenAI packaged workflow gate covers Bash and apply_patch');
 
 const triageDoc = read('harness-everything/references/triage-and-tiers.md');
-check(triageDoc.includes('Do not enforce workflow order. Enforce workflow invariants.'), 'architecture reference records the invariant-first decision');
-check(triageDoc.includes('A tier is **not** a fixed pipeline'), 'tier documentation rejects rigid orchestration');
-check(!triageDoc.includes('MUST load `todo-driven-workflow`'), 'documentation no longer mandates TODO as universal Tier 2/3 first step');
-check(triageDoc.includes('```mermaid'), 'updated architecture retains executable flowchart documentation');
-check(triageDoc.includes('the kernel always emits a compact checkpoint'), 'reference makes checkpoint emission mandatory');
-check(!triageDoc.includes('When a visible checkpoint is useful'), 'reference no longer makes checkpoint visibility optional');
-check(triageDoc.includes('if every suggestion is skipped, state one brief reason'), 'reference records the all-skipped rationale rule');
-check(triageDoc.includes('Kernel emission alone is not proof that a host UI displayed the checkpoint'), 'reference preserves the #82 host-evidence boundary');
+check(/Mandatory applicable workflow/i.test(triageDoc), 'triage reference documents mandatory applicable workflow');
+check(/topology becomes the run's execution contract/i.test(triageDoc), 'triage reference makes topology a contract');
+check(/workflow-uncovered-scope/i.test(triageDoc), 'triage reference documents narrow escape policy');
+check(/A tier is \*\*not\*\* a fixed TODO\/TDD\/Fable pipeline/i.test(triageDoc), 'triage reference rejects universal tier pipeline');
+check(/```mermaid/.test(triageDoc), 'triage reference retains executable flowchart documentation');
+check(/cross-host live-enforcement claim/i.test(triageDoc), 'triage reference preserves host evidence boundary');
+
+const routingDoc = read('docs/routing.md');
+check(/Mandatory applicable workflow/i.test(routingDoc), 'routing docs use mandatory workflow policy');
+check(/workflow-gate\.js/.test(routingDoc), 'routing docs describe PreToolUse workflow gate');
+check(/workflow-stop-gate\.js/.test(routingDoc), 'routing docs describe completion gate');
+check(/workflow-disposition\.js/.test(routingDoc), 'routing docs describe explicit escape mechanism');
+check(!/mandatory to evaluate and advisory to execute/i.test(routingDoc), 'routing docs remove old advisory execution contract');
+
+const architectureDoc = read('docs/architecture.md');
+check(/topology becomes a lifecycle contract/i.test(architectureDoc), 'architecture makes selected topology lifecycle contract');
+check(/workflow-gate\.js/.test(architectureDoc), 'architecture includes workflow bypass gate');
+check(!/Mandatory evaluation, advisory execution/i.test(architectureDoc), 'architecture removes old advisory execution policy');
+
+const philosophyDoc = read('docs/philosophy.md');
+check(/Constrain Lifecycle, Not Reasoning/i.test(philosophyDoc), 'philosophy separates lifecycle constraint from reasoning freedom');
+check(/Applicable workflow is mandatory/i.test(philosophyDoc), 'philosophy states applicable workflow requirement');
+check(!/Mandatory Evaluation, Advisory Execution/i.test(philosophyDoc), 'philosophy removes old advisory execution policy');
+
+const meshDoc = read('docs/mechanism-first-skill-mesh.md');
+check(/mandatory applicable workflow \+ local skill autonomy/i.test(meshDoc), 'skill mesh documents mandatory outer workflow and local skill autonomy');
+check(/selected topology is mandatory for the run/i.test(meshDoc), 'skill mesh distinguishes selected topology from skill suggestions');
+
+const capabilitiesDoc = read('docs/platform-capabilities.md');
+check(capabilitiesDoc.includes('repository/agent contract'), 'platform docs distinguish contract from host enforcement evidence');
+check(capabilitiesDoc.includes('does not upgrade `platform-compatibility.json` live-host status values'), 'routing change does not inflate compatibility status');
+
+const advisory = read('scripts/lib/advisory-text.js');
+check(/For EVERY suggested skill/i.test(advisory), 'generated advisory instructions require per-suggestion applicability evaluation');
+check(/selected workflow topology is mandatory once applicable/i.test(advisory), 'advisory surfaces carry mandatory workflow semantics');
+check(/No universal skill pipeline/i.test(advisory), 'advisory surfaces reject universal skill pipeline');
+check(/workflow genuinely cannot cover part of the task/i.test(advisory), 'advisory surfaces constrain workflow escape');
+check(read('plugins/harness-everything/scripts/lib/advisory-text.js') === advisory, 'OpenAI plugin advisory mirror matches canonical source');
+
+const agents = read('AGENTS.md');
+check(/Selected workflow is mandatory; reasoning inside it stays flexible/i.test(agents), 'repository agent contract matches mandatory workflow policy');
+check(!/Router suggestions are mandatory to evaluate, advisory to execute/i.test(agents), 'repository agent contract removes old advisory execution rule');
 
 console.log(`\n${failed === 0 ? 'PASS' : 'FAIL'}: invariant routing contract (${failed} failure${failed === 1 ? '' : 's'})`);
 process.exit(failed === 0 ? 0 : 1);