harness-everything 0.8.0 → 0.9.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.8.0",
+      "version": "0.9.0",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "author": {
     "name": "Miya Daniel"
   },

package/.github/workflows/ci.yml

@@ -70,8 +70,18 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - name: Install waza CLI
-        run: curl -fsSL https://raw.githubusercontent.com/microsoft/waza/main/install.sh | bash
+      - name: Install pinned waza CLI
+        run: |
+          WAZA_VERSION=0.38.6
+          WAZA_SHA256=a799587795fd462411ca7c7af5faccee7e24f08e41d152c10738d31334d1c063
+          mkdir -p "$HOME/bin"
+          curl -fL --retry 3 --retry-all-errors \
+            -o "$HOME/bin/waza" \
+            "https://github.com/microsoft/waza/releases/download/v${WAZA_VERSION}/waza-linux-amd64"
+          echo "${WAZA_SHA256}  $HOME/bin/waza" | sha256sum -c -
+          chmod +x "$HOME/bin/waza"
+          echo "$HOME/bin" >> "$GITHUB_PATH"
+          "$HOME/bin/waza" --version
       - name: Check every canonical SKILL.md passes waza readiness gates
         run: |
           fail=0

package/AGENTS.md

@@ -4,20 +4,20 @@ description: Operating guide for AI agents working inside the Harness-everything
 
 # AGENTS.md — Working in This Repository
 
-You are modifying **Harness**: an orchestrated agent operating system (skills + hooks/plugins + routing) for AI coding agents. Changes here ship to real agent sessions; a vague `SKILL.md`, stale manifest, contradictory platform claim, or router suggestion that can be skipped without reading its flow can misroute other people's agents. Precision is the product.
+You are modifying **Harness**: an orchestrated agent operating system (skills + hooks/plugins + routing) for AI coding agents. Changes here ship to real agent sessions; a vague `SKILL.md`, stale manifest, contradictory platform claim, or selected workflow that remains bypassable can misroute other people's agents. Precision is the product.
 
 ## Repository Layout
 
 | Path | What it is |
 |---|---|
 | `<skill-name>/SKILL.md` | One canonical skill per top-level directory. Frontmatter: `name`, `description`, `metadata.author`, `metadata.version`. |
-| `hooks/` | Claude Code lifecycle hook scripts and shared mechanisms such as circuit breaker, scope guard, and stop gate. Do not infer that every host packages every hook. |
-| `harness-everything/scripts/` | Runtime: kernel/tier routing, verification, bootstrap, self-heal. |
+| `hooks/` | Claude Code lifecycle hook scripts and shared mechanisms such as circuit breaker, workflow/action/scope guards, and stop gates. Do not infer that every host packages every hook. |
+| `harness-everything/scripts/` | Runtime: kernel/tier routing, workflow contract, verification, bootstrap, self-heal. |
 | `opencode-plugin/` | OpenCode native plugin implementation. Mechanism-tested, with partial live-host evidence for project-scope `.js` loading and edit/verification state on OpenCode 1.18.31 (macOS); see the evidence boundary below. |
 | `.agents/plugins/` + `plugins/harness-everything/` | Local OpenAI/Codex marketplace + `.codex-plugin` package with canonical skill copies and packaged session/prompt hooks. |
 | `submission/openai/` | Public OpenAI Skills-only listing/test inputs. The public artifact does not include local `.codex-plugin` lifecycle hooks. |
 | `evals/<skill>/` | Trigger/routing eval per skill (waza format). Required for every canonical routed skill. |
-| `behavioral-evals/` | LLM-behavior cases run via headless CLI sessions. They can be run on demand and are also structurally validated by the weekly `behavioral-evals.yml` workflow; live cases run there only when the Claude CLI is available. |
+| `behavioral-evals/` | LLM-behavior cases run via headless CLI sessions and structurally validated by CI. |
 | `benchmarks/` | BENCHMARK_SOP fixtures and recorded results. Evidence lives here or nowhere. |
 | `.claude-plugin/` | Claude Code plugin distribution manifests. Must list exactly the on-disk canonical skills. |
 | `docs/platform-capabilities.md` | Canonical current platform/install/enforcement/evidence matrix. |
@@ -27,43 +27,44 @@ You are modifying **Harness**: an orchestrated agent operating system (skills +
 
 ## OpenCode evidence boundary
 
-The retained [OpenCode evidence](benchmarks/results/live-host/opencode-2026-09-16/README.md) supports only the scoped loading and state effects above. The final snapshot is post-reset (`hardLock: false`, `count: 1`). Hard lock is only an interactive observation with no retained blocked-tool trace; reflection was operator-seeded, then agent-rewritten. Agent-controlled state deletion resets the breaker, so do not claim durable hard enforcement or behavioral effectiveness. `.mjs` auto-discovery is broken on this host version. Global scope, npm-package installation, and other host versions remain unverified.
+The retained [OpenCode evidence](benchmarks/results/live-host/opencode-2026-09-16/README.md) supports project-scope `.js` loading and edit/verification state on OpenCode 1.18.31 (macOS). The final snapshot is post-reset (`hardLock: false`, `count: 1`). Hard lock is only an interactive observation with no retained blocked-tool trace; reflection was operator-seeded, then agent-rewritten. Agent-controlled state deletion resets the breaker. Global scope, npm-package installation, and other OpenCode versions remain unverified.
 
 ## Non-Negotiable Change Rules
 
-1. **Every canonical SKILL.md keeps ≤ 500 tokens** (hard CI gate) and must contain `## USE FOR:` and `## DO NOT USE FOR:` sections. Deep detail goes in the skill's `references/` or `guides/`.
-2. **Descriptions are routing surfaces.** Two skills whose descriptions overlap enough that a router cannot distinguish them will fail `test:collision`. When adding a skill, differentiate its description from near neighbors deliberately.
-3. **A new canonical skill ships with a routing eval** (`evals/<skill>/eval.yaml` + positive/negative tasks). The positive task's `description:` field must carry the skill's exact frontmatter description — waza's deterministic matcher requires it verbatim.
-4. **Release version policy:** normal PRs do not manually bump package/plugin versions. `semantic-release` determines the next stable SemVer from Conventional Commits on `main`, and `scripts/sync-release-version.js` owns distribution-version synchronization. Skill frontmatter versions remain release metadata and must never exceed the package version's numeric base. Nested sub-skills (`<skill>/<sub>/SKILL.md`) inherit the parent skill's version and must always match it.
-5. **Distribution manifests are generated facts, not opinions:** if you add/remove/rename a canonical skill, update/sync every distribution that copies or lists it. Run `npm run plugin:sync`, `npm run test:consistency`, and `npm run test:plugin:openai` rather than updating only `.claude-plugin/plugin.json`.
-6. **Platform capability claims are tested contracts.** If host integration behavior changes, update `docs/platform-capabilities.md` and every affected current-state surface in the same change. Never turn package/mechanism evidence into a live-host claim, and never describe public Skills-only behavior as if it includes local lifecycle hooks.
-7. **Runtime/workflow claims are generated facts.** `package.json`, `.nvmrc`, `Dockerfile`, and active `.github/workflows/*.yml` are parsed by `scripts/repository-contract.js`. After changing them, run `npm run docs:sync`; `test:repo-contract` rejects stale generated docs, unsupported action majors, Node runtimes below the support floor, or loss of the Node 22 compatibility lane.
-8. **CHANGELOG.md keeps pending human-authored notes under `[Unreleased]`.** Do not create new alpha/beta/rc release headings; semantic-release owns stable release headings, tags, and release notes.
-9. **Conventional Commit type is release input.** The final commit/squash title that lands on `main` must follow the convention. Breaking changes release major; `feat` releases minor; `fix`, `perf`, `refactor`, `build`, and `revert` release patch; `docs`, `test`, `ci`, `style`, and `chore` do not release by themselves.
-10. **Router suggestions are mandatory to evaluate, advisory to execute.** Before skipping any suggested skill, read its complete `SKILL.md` entry and evaluate `USE FOR`, `DO NOT USE FOR`, workflow/basic flow, and hard rules. A name/description/router summary or “routine task” judgement is not enough. Using one suggestion does not waive read-before-skip for other omissions; unreadable suggestions are `unresolved/unavailable`, not silent skips. Do not turn this into a fixed TODO/TDD/Fable execution pipeline.
+1. **Every canonical SKILL.md keeps ≤ 500 tokens** (hard CI gate) and must contain `## USE FOR:` and `## DO NOT USE FOR:`. Deep detail goes in references/guides.
+2. **Descriptions are routing surfaces.** Differentiate neighboring skills deliberately; `test:collision` guards overlap.
+3. **A new canonical skill ships with a routing eval.** Positive task `description:` must exactly match the skill frontmatter description.
+4. **Release version policy:** normal PRs do not manually bump package/plugin versions. `semantic-release` owns stable SemVer and `scripts/sync-release-version.js` owns distribution synchronization. Nested sub-skills inherit their parent skill version.
+5. **Distribution manifests are generated facts:** add/remove/rename changes must sync every copied/listed distribution. Run `npm run plugin:sync`, `npm run test:consistency`, and `npm run test:plugin:openai`.
+6. **Platform capability claims are tested contracts.** Update `docs/platform-capabilities.md` with integration behavior changes. Package/mechanism evidence is not live-host evidence, and public Skills-only behavior does not include local lifecycle hooks.
+7. **Runtime/workflow claims are generated facts.** `package.json`, `.nvmrc`, Dockerfile, and active workflows feed `scripts/repository-contract.js`; run `npm run docs:sync` after relevant changes.
+8. **CHANGELOG.md keeps pending human-authored notes under `[Unreleased]`.** Semantic-release owns stable headings/tags/release notes.
+9. **Conventional Commit type is release input.** Breaking→major; `feat`→minor; `fix`/`perf`/`refactor`/`build`/`revert`→patch; docs/test/ci/style/chore do not release by themselves.
+10. **Selected workflow is mandatory; reasoning inside it stays flexible.** Before omitting a suggested skill, read/evaluate its complete `SKILL.md` flow. Suggested skills may be `not-applicable` with a flow-grounded reason, but a selected topology must be executed to resolution. Do not bypass it because the task feels simple/routine/already clear. Escape is limited to genuinely uncovered workflow scope or host-capability loss and requires explicit scope + evidence. Do not turn this into one universal TODO/TDD/Fable sequence.
+11. **Major mutation requires Git worktree isolation.** Read-only discovery may stay in the bound repository. Tier 3 / Fable source and artifact changes must target a verified linked worktree belonging to that repository; creation failure means `blocked`. Worktree isolation is separate from durable multi-agent workspace state. Scoped escape never waives it. See [workflow-runtime.md](docs/workflow-runtime.md) for the tested boundary and limitations.
 
 ## Verification Before You Claim Done
 
-Run the local gates that cover the same contract categories as CI:
+Run the gates that cover the same contract categories as CI:
 
 ```bash
-npm test                         # self-regression: syntax, routing, mechanisms
-npm run test:mutations           # focused mutation checks
-npm run test:mechanism           # mechanism suites alone
-npm run test:consistency         # manifests, versions, docs links, eval coverage + repository contract
-npm run test:repo-contract       # runtime/workflow/action/schedule drift gate
-npm run test:docs:capabilities   # platform documentation drift gate
-npm run test:references          # executable/deep-dive references
-npm run test:release             # release catalog + semantic-release/version-sync contract
-npm run test:collision           # description collision detection
-npm run test:routing:skills      # every positive skill route reaches its target
-npm run test:routing:invariants  # kernel/read-before-skip routing contract
-npm run test:plugin:openai       # local OpenAI/Codex plugin package
-npm run test:plugin:submission   # public Skills-only submission inputs/bundle parity
+npm test
+npm run test:mutations
+npm run test:mechanism
+npm run test:consistency
+npm run test:repo-contract
+npm run test:docs:capabilities
+npm run test:references
+npm run test:release
+npm run test:collision
+npm run test:routing:skills
+npm run test:routing:invariants
+npm run test:plugin:openai
+npm run test:plugin:submission
 npm run test:platform:compatibility
 ```
 
-If waza is installed (`~/bin/waza`), also run what CI runs:
+If waza is installed (`~/bin/waza`), also run:
 
 ```bash
 waza check <skill-dir>
@@ -71,16 +72,16 @@ waza spec verify <skill> evals/<skill>/eval.yaml --fail --threshold 1
 waza tokens check
 ```
 
-Node.js 24 is the primary CI runtime across Ubuntu, Windows, and macOS. A separate Ubuntu Node.js 22 lane protects the advertised minimum runtime. See [docs/repository-contract.md](docs/repository-contract.md) for the generated current state.
+Node.js 24 is primary CI across Ubuntu/Windows/macOS; a Node.js 22 lane protects the supported minimum. See [docs/repository-contract.md](docs/repository-contract.md).
 
-Do not report "it works" from reading code. Record which evidence layer you actually proved: package, deterministic mechanism, live host, or behavior.
+Do not report "it works" from code reading. State the evidence layer proved: package, deterministic mechanism, live host, or behavior.
 
 ## Behavioral & Benchmark Evidence
 
-Deterministic mechanism tests prove the tested hook/plugin contract; they do **not** prove a real host loaded it or that agents behave differently. For behavior:
+Deterministic mechanism tests prove the tested hook/plugin contract; they do **not** prove a real host loaded it or that behavior improved. For behavior:
 
 - `node behavioral-evals/run.js run --engine opencode` (or `--engine claude`) — on-demand, token-costing.
-- The weekly `behavioral-evals.yml` workflow always validates case structure and runs live cases only when its runner has the Claude CLI.
+- Weekly behavioral workflow validates case structure and runs live cases only when its runner has the required CLI.
 - `node benchmarks/run.js scaffold <scenario>` → run both variants → `record` with evidence logs.
 
-For a live-host enforcement claim, preserve a host/session artifact showing the mechanism was actually loaded and fired. Results are committed where the relevant evidence workflow requires it. A benchmark run without a recorded result is indistinguishable from one that never happened.
+For a live-host enforcement claim, preserve a host/session artifact showing the mechanism loaded and fired. For an effectiveness claim, use the paired evidence discipline in #71 rather than inferring improvement from mechanism presence.

package/CHANGELOG.md

@@ -2,6 +2,57 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.9.0](https://github.com/dyphn1/Harness-everything/compare/v0.8.1...v0.9.0) (2026-09-18)
+
+### Features
+
+* **action-gate:** classify structured tool actions ([3502f42](https://github.com/dyphn1/Harness-everything/commit/3502f4200401be029250ac503ea283f90fd5552d))
+* **action-gate:** package isolated MCP adapters ([81133db](https://github.com/dyphn1/Harness-everything/commit/81133db7fffc417fdc01530db01235dcfb32f3c7))
+* **action-gate:** wire Claude MCP lifecycle ([27c9e72](https://github.com/dyphn1/Harness-everything/commit/27c9e72171f7a69d1f0797356feae71d50fa02b9))
+* **memory:** add deterministic scoped retrieval ([2fb175c](https://github.com/dyphn1/Harness-everything/commit/2fb175c98274bf031fd54d6d3cace321a040d63e))
+* **memory:** add deterministic scoped retrieval ([bfa158b](https://github.com/dyphn1/Harness-everything/commit/bfa158b2e519460b45cbf85796549816a32c826f))
+* **memory:** detect explicit persistence intent ([f438543](https://github.com/dyphn1/Harness-everything/commit/f438543f2e27ef50f419fd52d51fc606e72bac61))
+* **memory:** detect explicit persistence intent ([7b37cee](https://github.com/dyphn1/Harness-everything/commit/7b37ceeab58c239ab81f6310fcc6543e64c6f194))
+* **memory:** enforce workflow-authorized persistence ([987ecd1](https://github.com/dyphn1/Harness-everything/commit/987ecd1c3e5bfc2564a2c8eb3280b717041c1cb9))
+* **memory:** issue workflow-bound write capability ([93c001f](https://github.com/dyphn1/Harness-everything/commit/93c001facc11c30a97d83bcc6d1debbdd5dba25d))
+* **memory:** issue workflow-bound write capability ([0034f1a](https://github.com/dyphn1/Harness-everything/commit/0034f1a58724f6cf76c3bbecc06dab7b43f6c464))
+* **memory:** route bounded persistence requests ([bfabb4a](https://github.com/dyphn1/Harness-everything/commit/bfabb4a27aa9db9545136a450b76037241b1becd))
+* **memory:** route bounded persistence requests ([1451b7a](https://github.com/dyphn1/Harness-everything/commit/1451b7a9f64cadb857223899dffa14ca427dfda4))
+* **memory:** route explicit persistence authorization ([ea275cc](https://github.com/dyphn1/Harness-everything/commit/ea275cc1b60b7211607095d21136f50f49f602d6))
+* **memory:** route explicit persistence authorization ([3fb9e23](https://github.com/dyphn1/Harness-everything/commit/3fb9e23e01361128f75df8d2aea9ef9e916e74d7))
+* **memory:** schema persistence intent signal ([50dfb83](https://github.com/dyphn1/Harness-everything/commit/50dfb830ff0bb4e548d36115a55fda16d7e77f8b))
+* **memory:** schema persistence intent signal ([4fdd410](https://github.com/dyphn1/Harness-everything/commit/4fdd410309974def42dbd13f9a46e94ca57673b3))
+* **memory:** surface authorization invariant ([88f87a2](https://github.com/dyphn1/Harness-everything/commit/88f87a2be9942a00fd85e0e383dcc015ef101313))
+* **memory:** surface authorization invariant ([00c7588](https://github.com/dyphn1/Harness-everything/commit/00c7588bbf5fbdefdc472e2a0e27a40b2c0ba91e))
+* **runtime:** account failed verification rounds ([4bb3ea1](https://github.com/dyphn1/Harness-everything/commit/4bb3ea1a45661672e932ae758d77482a453c46ad))
+* **runtime:** add run-scoped budget accounting ([b1dc987](https://github.com/dyphn1/Harness-everything/commit/b1dc9875701c81dcd4d92ac8a882a6e16fadb909))
+* **runtime:** cap parallel dispatch batches ([0c587bc](https://github.com/dyphn1/Harness-everything/commit/0c587bc963370e50698626b647a0a69c96e63aec))
+* **runtime:** cap parallel dispatch batches ([42f396f](https://github.com/dyphn1/Harness-everything/commit/42f396fb6f4e3d8f91d3b7b1027cdd3c3543a65e))
+* **runtime:** enforce iterative mutation budget ([8b54044](https://github.com/dyphn1/Harness-everything/commit/8b54044f27cf05608a8e192857e0362e3ff5a207))
+* **runtime:** enforce replan and revision budgets ([3fae99b](https://github.com/dyphn1/Harness-everything/commit/3fae99bb28e5f2354465936fba11e8f7406be4fd))
+* **runtime:** enforce worker concurrency budget ([5a7de6d](https://github.com/dyphn1/Harness-everything/commit/5a7de6daa4292047c5a623b338551324689e84bd))
+* **runtime:** make workflow limits numeric ([9295ee2](https://github.com/dyphn1/Harness-everything/commit/9295ee2f9ad043abce8dc07e9b88a1210f152286))
+* **runtime:** make workflow limits numeric ([2409f5b](https://github.com/dyphn1/Harness-everything/commit/2409f5bce4dd338bf9f7496d0a4a00498a9ca1e4))
+* **runtime:** schema numeric workflow budgets ([7fa7a55](https://github.com/dyphn1/Harness-everything/commit/7fa7a556bebf38257c4fdf8d0837acba5ae630ce))
+* **runtime:** schema numeric workflow budgets ([9cc26a1](https://github.com/dyphn1/Harness-everything/commit/9cc26a1d352eeab03dc8dc973850476f7d60b080))
+
+## [0.8.1](https://github.com/dyphn1/Harness-everything/compare/v0.8.0...v0.8.1) (2026-09-17)
+
+### Bug Fixes
+
+* **router:** enforce selected workflow lifecycle ([9f3394a](https://github.com/dyphn1/Harness-everything/commit/9f3394a3ff59aaa08428e12a9a2784e7541368c4))
+* **workflow:** Close lifecycle isolation gaps ([96b58e7](https://github.com/dyphn1/Harness-everything/commit/96b58e7ce2e52312880663e59380038e4bf5f985)), closes [#131](https://github.com/dyphn1/Harness-everything/issues/131)
+* **workflow:** Normalize Windows worktree paths ([18ee645](https://github.com/dyphn1/Harness-everything/commit/18ee645a1a7165d01d60a964947082ad0108b93c)), closes [#131](https://github.com/dyphn1/Harness-everything/issues/131)
+* **workflow:** require worktree isolation for major mutations ([9ba0098](https://github.com/dyphn1/Harness-everything/commit/9ba0098adc94fe141fca2c03f07d0883d9a56b9b))
+
+## [Unreleased]
+
+### Fixed
+
+- Make selected workflows persist across follow-up prompts, bind Fable runs to workflow/session identities, and require correlated stage evidence before completion (#131, #142).
+- Enforce major-workflow Git worktree isolation at supported mutation hooks, check direct/patch targets and explicit shell paths, and retain isolation across scoped escape and blocked states.
+- Provide bounded run entry/replan and per-stage escape commands; expose unsupported hosts and shell-sandbox limits without upgrading live-host evidence.
+
 ## [0.8.0](https://github.com/dyphn1/Harness-everything/compare/v0.7.0...v0.8.0) (2026-09-17)
 
 ### Features

package/README.md

@@ -68,7 +68,7 @@ npx github:dyphn1/Harness-everything install
 1. **Use the selected surface's real mechanism:** Claude Code hooks, the local OpenAI plugin lifecycle hooks, OpenCode's plugin API, or advisory instructions depending on what you installed.
 2. **Preflight / session context where packaged:** Hook-capable surfaces can inject environment/session context automatically; advisory-only surfaces must not be described as if they do.
 3. **Verification boundary:** Completion claims require objective evidence; whether that boundary is mechanically invoked or explicitly called depends on the host surface.
-4. **Mandatory evaluation, advisory execution:** Tier classification may suggest useful skills. Before skipping any suggested skill, the agent reads its complete `SKILL.md` entry/basic flow and evaluates applicability; execution remains agent-controlled afterward, so Harness still does not impose a universal TODO/TDD/Fable sequence.
+4. **Mandatory applicable workflow:** Evaluate each suggested skill's complete `SKILL.md` before omission, then resolve the selected topology with objective evidence. Reasoning and implementation remain flexible; escape applies only to a declared uncovered stage with evidence. Tier 3 / Fable mutation requires a verified Git worktree. See the [workflow runtime contract](docs/workflow-runtime.md) for entry, completion, and host limits. Harness does not impose one universal TODO/TDD/Fable sequence.
 
 ### What Gets Installed (and How to Remove It)
 
@@ -312,4 +312,4 @@ npm run test:plugin:openai
 npm run test:plugin:submission
 ```
 
-After intentional runtime/workflow changes, run `npm run docs:sync` and commit the regenerated repository contract. All script modifications must pass 100% cleanly before pushing to keep the runtime immunized against behavioral regression.
+After intentional runtime/workflow changes, run `npm run docs:sync` and commit the regenerated repository contract. All script modifications must pass 100% cleanly before pushing to keep the runtime immunized against behavioral regression.

package/benchmarks/results/reviews/pr142-verification.json

@@ -0,0 +1,95 @@
+{
+  "schemaVersion": 1,
+  "baselineCommit": "8b99baec44745e171f078fe9eb3dac6fd812b5c8",
+  "reviewedRevision": "commit containing this report",
+  "evidenceLayer": "local deterministic mechanisms and packages",
+  "environment": {
+    "os": "win32",
+    "node": "v24.15.0",
+    "npm": "11.12.1"
+  },
+  "gates": [
+    {
+      "gate": "test",
+      "exitCode": 0,
+      "seconds": 76.007
+    },
+    {
+      "gate": "test:mutations",
+      "exitCode": 0,
+      "seconds": 5.309
+    },
+    {
+      "gate": "test:mechanism",
+      "exitCode": 0,
+      "seconds": 54.904
+    },
+    {
+      "gate": "test:consistency",
+      "exitCode": 0,
+      "seconds": 0.782
+    },
+    {
+      "gate": "test:repo-contract",
+      "exitCode": 0,
+      "seconds": 0.522
+    },
+    {
+      "gate": "test:docs:capabilities",
+      "exitCode": 0,
+      "seconds": 0.639
+    },
+    {
+      "gate": "test:references",
+      "exitCode": 0,
+      "seconds": 0.597
+    },
+    {
+      "gate": "test:release",
+      "exitCode": 0,
+      "seconds": 5.161
+    },
+    {
+      "gate": "test:collision",
+      "exitCode": 0,
+      "seconds": 0.481
+    },
+    {
+      "gate": "test:routing:skills",
+      "exitCode": 0,
+      "seconds": 2.926
+    },
+    {
+      "gate": "test:routing:invariants",
+      "exitCode": 0,
+      "seconds": 3.521
+    },
+    {
+      "gate": "test:plugin:openai",
+      "exitCode": 0,
+      "seconds": 4.225
+    },
+    {
+      "gate": "test:plugin:submission",
+      "exitCode": 0,
+      "seconds": 0.963
+    },
+    {
+      "gate": "test:platform:compatibility",
+      "exitCode": 0,
+      "seconds": 0.612
+    }
+  ],
+  "mechanismSuites": 44,
+  "lifecycleAssertions": {
+    "source": 50,
+    "openaiPackage": 50
+  },
+  "waza": {
+    "checks": 57,
+    "passed": 57
+  },
+  "liveHost": "not run for this change",
+  "behavioralEffectiveness": "not measured for this change",
+  "windowsPathRegression": "Native resolution equates Windows 8.3 and long path spellings; regression and final local self-regression passed."
+}

package/ci/action-gate.test.js

@@ -139,6 +139,82 @@ try {
   });
   check(actionGate.evaluatePreToolUse(routerTrueSafe, { host: 'claude', sessionDir, ruleTable: table }).kind === 'allow', 'safe command is not gated solely because prompt router predicted risk');
 
+  const mcpDelete = {
+    session_id: 'phase5-test',
+    hook_event_name: 'PreToolUse',
+    tool_name: 'mcp__demo__delete_record',
+    tool_use_id: 'mcp-delete',
+    tool_input: {
+      record_id: 'record-123',
+      api_token: 'SHOULD_NOT_BE_PERSISTED',
+      actionDescriptor: { toolFamily: 'mcp', action: 'delete', resource: 'record:123' },
+    },
+    cwd: ROOT,
+  };
+  const mcpDeleteDecision = actionGate.evaluatePreToolUse(mcpDelete, { host: 'claude', sessionDir, ruleTable: table });
+  check(mcpDeleteDecision.kind === 'defer' && mcpDeleteDecision.rule.id === 'structured-delete', 'structured MCP delete is gated before execution');
+  const mcpDeleteAudit = readAudit(sessionDir, 'mcp-delete');
+  check(mcpDeleteAudit.actionDescriptor.toolFamily === 'mcp' && mcpDeleteAudit.actionDescriptor.action === 'delete', 'audit retains normalized structured action identity');
+  check(mcpDeleteAudit.actionDescriptor.payloadHash === actionGate.hashExact(actionGate.exactPayloadText(mcpDelete)), 'structured action audit binds to exact payload hash');
+  check(!JSON.stringify(mcpDeleteAudit).includes('SHOULD_NOT_BE_PERSISTED'), 'structured action audit does not persist raw secret arguments');
+
+  const mcpRead = {
+    ...mcpDelete,
+    tool_name: 'mcp__demo__get_record',
+    tool_use_id: 'mcp-read',
+    tool_input: { record_id: 'record-123' },
+  };
+  const mcpReadDecision = actionGate.evaluatePreToolUse(mcpRead, { host: 'claude', sessionDir, ruleTable: table });
+  check(mcpReadDecision.kind === 'allow' && mcpReadDecision.descriptor.classification === 'safe', 'read-only MCP fixture passes without a false gate');
+
+  const inferredMutation = {
+    ...mcpDelete,
+    tool_name: 'mcp__demo__update_issue',
+    tool_use_id: 'mcp-update',
+    tool_input: { issue_id: 135, title: 'changed' },
+  };
+  const inferredMutationDecision = actionGate.evaluatePreToolUse(inferredMutation, { host: 'claude', sessionDir, ruleTable: table });
+  check(inferredMutationDecision.kind === 'defer' && inferredMutationDecision.rule.id === 'structured-mutate', 'obvious structured mutation is classified from tool identity');
+
+  const localDelete = {
+    ...mcpDelete,
+    tool_name: 'local_delete_record',
+    tool_use_id: 'local-delete',
+    tool_input: {
+      record_id: 'record-456',
+      actionDescriptor: { toolFamily: 'local-function', action: 'delete', resource: 'record:456' },
+    },
+  };
+  const localDeleteDecision = actionGate.evaluatePreToolUse(localDelete, { host: 'claude', sessionDir, ruleTable: table });
+  check(localDeleteDecision.kind === 'defer' && localDeleteDecision.rule.id === 'structured-delete', 'non-shell local-function destructive fixture uses the same structured gate');
+
+  const opaqueRequired = {
+    ...mcpDelete,
+    tool_name: 'mcp__demo__opaque_action',
+    tool_use_id: 'mcp-opaque-required',
+    tool_input: { value: 1 },
+    workflowPlan: { actionGate: { required: true, reasonCodes: ['external-side-effect'], disposition: 'pending-approval' } },
+  };
+  const opaqueRequiredDecision = actionGate.evaluatePreToolUse(opaqueRequired, { host: 'claude', sessionDir, ruleTable: table });
+  check(opaqueRequiredDecision.kind === 'defer' && opaqueRequiredDecision.rule.id === 'structured-unknown-required', 'unknown structured action fails closed when workflow requires a gate');
+
+  const opaqueSafe = { ...opaqueRequired, tool_use_id: 'mcp-opaque-unrequired' };
+  delete opaqueSafe.workflowPlan;
+  check(actionGate.evaluatePreToolUse(opaqueSafe, { host: 'claude', sessionDir, ruleTable: table }).kind === 'allow', 'unknown structured action is not fabricated as destructive without a gate requirement');
+
+  const integrityPre = {
+    ...mcpDelete,
+    tool_use_id: 'mcp-integrity',
+    tool_input: { actionDescriptor: { toolFamily: 'mcp', action: 'delete', resource: 'record:A' }, record_id: 'A' },
+  };
+  actionGate.evaluatePreToolUse(integrityPre, { host: 'claude', sessionDir, ruleTable: table });
+  const integrityPost = actionGate.processEvent({
+    ...integrityPre,
+    hook_event_name: 'PostToolUse',
+    tool_input: { actionDescriptor: { toolFamily: 'mcp', action: 'delete', resource: 'record:B' }, record_id: 'B' },
+  }, { sessionDir });
+  check(integrityPost.record && integrityPost.record.disposition === 'integrity-violation', 'changed structured payload cannot reuse a prior approval/audit decision');
+
   const nonScratchTarget = process.platform === 'win32'
     ? 'C:\\workspace\\harness-project\\build'
     : '/opt/harness-project/build';
@@ -231,14 +307,18 @@ try {
 
   const canonicalHooks = JSON.parse(fs.readFileSync(path.join(ROOT, 'hooks', 'hooks.json'), 'utf8'));
   const canonicalPre = canonicalHooks.hooks.PreToolUse.find(group => group.id === 'harness:pre:action-gate');
-  check(canonicalPre && canonicalPre.matcher === 'Bash|PowerShell', 'Claude hook manifest wires action-gate to Bash|PowerShell');
+  check(canonicalPre && canonicalPre.matcher === 'Bash|PowerShell|mcp__.*', 'Claude hook manifest wires action-gate to shell and MCP pre-action surfaces');
   check(canonicalHooks.hooks.PostToolUse.some(group => group.id === 'harness:post:action-gate-audit'), 'Claude hook manifest audits successful tool execution');
   check(canonicalHooks.hooks.PostToolUseFailure.some(group => group.id === 'harness:post-failure:action-gate-audit'), 'Claude hook manifest audits failed tool execution');
   check(canonicalHooks.hooks.Stop.some(group => group.id === 'harness:stop:action-gate-audit'), 'Claude hook manifest closes unresolved approvals on Stop');
 
   const pluginHooks = JSON.parse(fs.readFileSync(path.join(ROOT, 'plugins', 'harness-everything', 'hooks', 'hooks.json'), 'utf8'));
-  const pluginPre = pluginHooks.hooks.PreToolUse.find(group => group.matcher === 'Bash|apply_patch');
-  check(pluginPre && pluginPre.hooks.some(hook => /codex-action-gate-pre\.js/.test(hook.command)), 'OpenAI plugin wires the attribution-aware Codex action-gate adapter to Bash|apply_patch');
+  const pluginPre = pluginHooks.hooks.PreToolUse.find(group => group.matcher === 'Bash|apply_patch' && group.hooks.some(hook => /codex-action-gate-pre\.js/.test(hook.command)));
+  check(pluginPre && pluginPre.hooks.some(hook => /codex-action-gate-pre\.js/.test(hook.command)), 'OpenAI plugin preserves the attribution-aware Codex shell action-gate adapter');
+  const pluginMcpPre = pluginHooks.hooks.PreToolUse.find(group => group.matcher === 'mcp__.*' && group.hooks.some(hook => /codex-action-gate-pre\.js/.test(hook.command)));
+  const pluginMcpPost = pluginHooks.hooks.PostToolUse.find(group => group.matcher === 'mcp__.*' && group.hooks.some(hook => /codex-action-gate-post\.js/.test(hook.command)));
+  check(Boolean(pluginMcpPre), 'OpenAI plugin packages an isolated structured MCP pre-action adapter without widening unrelated hooks');
+  check(Boolean(pluginMcpPost), 'OpenAI plugin packages an isolated structured MCP post-action audit adapter');
   check(!Object.prototype.hasOwnProperty.call(pluginHooks.hooks, 'PostToolUseFailure'), 'Codex plugin does not declare unsupported PostToolUseFailure lifecycle event');
   const pluginPost = pluginHooks.hooks.PostToolUse.find(group => group.matcher === 'Bash|apply_patch');
   check(pluginPost && pluginPost.hooks.some(hook => /codex-action-gate-post\.js/.test(hook.command)), 'Codex plugin infers action-gate outcome from supported PostToolUse');

package/ci/doc-capability-consistency.test.js

@@ -44,6 +44,7 @@ const CURRENT_SURFACES = [
   'docs/platform-capabilities.md',
   'docs/reflection.md',
   'docs/routing.md',
+  'docs/workflow-runtime.md',
   'docs/troubleshooting.md',
   'docs/openai-plugin.md',
   'submission/openai/README.md',
@@ -59,6 +60,8 @@ const STALE_PATTERNS = [
   /Only possible on Claude Code \(the only platform with a hook\/exit-code execution system\)/i,
   /On platforms with no hook system at all \(Cursor, Copilot, Codex/i,
   /hooks[^\n]{0,100}Hard enforcement, Claude Code only/i,
+  /mandatory evaluation\s*[,/]\s*advisory execution/i,
+  /Tier-specific skills remain advisory/i,
   /Codex[^\n]{0,180}\.codex\/skills\//i,
 ];