harness-everything 0.8.0 → 0.9.0

package/ci/invariant-routing.test.js

@@ -7,19 +7,15 @@ const ROOT = path.resolve(__dirname, '..');
 let failed = 0;
 
 function check(condition, message) {
-  if (condition) {
-    console.log(`  PASS ${message}`);
-  } else {
-    console.error(`  FAIL ${message}`);
-    failed++;
-  }
+  if (condition) console.log(`  PASS ${message}`);
+  else { console.error(`  FAIL ${message}`); failed++; }
 }
 
 function read(rel) {
   return fs.readFileSync(path.join(ROOT, rel), 'utf8');
 }
 
-console.log('=== Invariant-First Routing Contract ===');
+console.log('=== Mandatory Workflow Routing Contract ===');
 
 const kernel = path.join(ROOT, 'harness-everything', 'scripts', 'kernel-router.js');
 const tier2 = spawnSync(process.execPath, [kernel, 'add a login endpoint with tests and update the implementation'], {
@@ -36,25 +32,30 @@ check(tier2.stdout.includes('Verify before claim'), 'verify-before-claim invaria
 check(tier2.stdout.includes('after 3 same-signature failures'), 'failure escalation invariant is present');
 check(tier2.stdout.includes('loop-budget:'), 'iterative-single loop budget invariant is present');
 check(tier2.stdout.includes('evaluate-suggestions-before-skip'), 'non-empty suggestions inject evaluate-before-skip invariant');
-check(tier2.stdout.includes('SUGGESTED SKILLS (MANDATORY EVALUATION'), 'domain suggestions are mandatory to evaluate');
-check(tier2.stdout.includes('ADVISORY EXECUTION'), 'domain suggestion execution remains advisory');
+check(tier2.stdout.includes('WORKFLOW SKILLS (EVALUATE APPLICABILITY'), 'domain suggestions remain applicability inputs');
+check(tier2.stdout.includes('SELECTED WORKFLOW IS MANDATORY'), 'selected workflow execution is mandatory');
 check(tier2.stdout.includes('tdd:'), 'Tier 2 can still recommend TDD');
 check(!tier2.stdout.includes('BASE EXECUTION LOOP'), 'legacy fixed base-execution-loop output is suppressed');
-check(tier2.stdout.includes('Do not enforce workflow order'), 'self-orchestration policy is explicit');
+check(tier2.stdout.includes('Mandatory applicable workflow'), 'orchestration policy requires selected applicable workflow');
+check(tier2.stdout.includes('model controls HOW to satisfy it'), 'reasoning/implementation freedom remains inside workflow');
+check(tier2.stdout.includes('WORKFLOW EXECUTION CONTRACT (MANDATORY WHEN SELECTED)'), 'kernel emits workflow execution contract');
+check(tier2.stdout.includes('- State: unpersisted'), 'manual route without host session does not claim persisted lifecycle');
+check(tier2.stdout.includes('Generic simple/routine/already-clear reasons cannot waive'), 'model confidence cannot bypass workflow');
+check(tier2.stdout.includes('Escape is limited to workflow-uncovered-scope or host-capability-unavailable'), 'workflow escape is exception-only');
+check(!tier2.stdout.includes('execution remains advisory after evaluation'), 'old advisory execution wording is absent');
+check(!tier2.stdout.includes('isolated-worktree-before-mutation'), 'Tier 2 does not inherit the major-workflow worktree invariant');
 
 const tier2Checkpoints = tier2.stdout.match(/HARNESS ROUTING CHECKPOINT \(REQUIRED VISIBLE STATE\)/g) || [];
-check(tier2Checkpoints.length === 1, 'Tier 2 emits exactly one required routing checkpoint');
-check(tier2.stdout.includes('- Tier: Tier 2'), 'checkpoint exposes the human-readable Tier 2');
-check(tier2.stdout.includes('- Strategy: iterative-single'), 'checkpoint exposes the selected strategy');
+check(tier2Checkpoints.length === 1, 'Tier 2 emits exactly one routing checkpoint');
+check(tier2.stdout.includes('- Tier: Tier 2'), 'checkpoint exposes Tier 2');
+check(tier2.stdout.includes('- Strategy: iterative-single'), 'checkpoint exposes selected strategy');
 check(/- Required invariants: .*verify-before-claim/.test(tier2.stdout), 'checkpoint exposes required invariants');
-check(/- Suggested skills: .*tdd/.test(tier2.stdout), 'checkpoint exposes deduplicated suggestions');
-check(tier2.stdout.includes('Suggestion evaluation: MANDATORY'), 'checkpoint makes suggestion evaluation mandatory');
-check(tier2.stdout.includes('read its complete SKILL.md entry'), 'checkpoint requires reading the suggested skill entry before skip');
-check(tier2.stdout.includes('name, description, router summary'), 'checkpoint rejects metadata-only skip decisions');
-check(tier2.stdout.includes('routine/common task'), 'checkpoint rejects generic routine-task skip decisions');
-check(tier2.stdout.includes('Using one suggestion does not waive read-before-skip'), 'checkpoint applies read-before-skip per omitted suggestion');
-check(tier2.stdout.includes('unresolved/unavailable rather than skipped'), 'checkpoint preserves unresolved suggestions instead of silent skip');
-check(tier2.stdout.includes('If all are skipped after evaluation'), 'all-skipped rationale is grounded after evaluation');
+check(/- Suggested skills: .*tdd/.test(tier2.stdout), 'checkpoint exposes suggestions');
+check(tier2.stdout.includes('Suggestion evaluation: MANDATORY'), 'checkpoint requires suggestion evaluation');
+check(tier2.stdout.includes('read its complete SKILL.md entry'), 'checkpoint requires reading skill entry');
+check(tier2.stdout.includes('name, description, router summary'), 'checkpoint rejects metadata-only omission');
+check(tier2.stdout.includes('routine/common task'), 'checkpoint rejects routine-task omission shortcut');
+check(tier2.stdout.includes('selected workflow is mandatory'), 'checkpoint distinguishes skill applicability from topology obligation');
 
 const tier3 = spawnSync(process.execPath, [kernel, 'audit the entire repository architecture and coordinate multiple modules'], {
   cwd: ROOT,
@@ -62,86 +63,98 @@ const tier3 = spawnSync(process.execPath, [kernel, 'audit the entire repository
 });
 check(tier3.status === 0, 'Tier 3 kernel routing exits successfully');
 check(/RECOMMENDED TIER:\s*Tier 3/i.test(tier3.stdout), 'macro task remains Tier 3');
-check(tier3.stdout.includes('"strategy":"fable-staged"'), 'Tier 3 dependent/unproven work selects fable-staged');
-check(tier3.stdout.includes('fable-mode / fable-discipline'), 'Tier 3 selected plan suggests Fable capabilities');
-check(tier3.stdout.includes('execution remains advisory after evaluation'), 'Tier 3 execution remains non-mandatory after evaluation');
-check(tier3.stdout.includes('evaluate-suggestions-before-skip'), 'Tier 3 suggestions also carry read-before-skip invariant');
-check(tier3.stdout.includes('HARNESS ROUTING CHECKPOINT (REQUIRED VISIBLE STATE)'), 'Tier 3 also emits the required routing checkpoint');
+check(tier3.stdout.includes('"strategy":"fable-staged"'), 'Tier 3 task selects fable-staged');
+check(tier3.stdout.includes('fable-mode / fable-discipline'), 'Tier 3 plan exposes Fable capabilities');
+check(tier3.stdout.includes('selected Fable topology must be entered and resolved before completion'), 'selected Fable topology is mandatory');
+check(tier3.stdout.includes('WORKFLOW EXECUTION CONTRACT (MANDATORY WHEN SELECTED)'), 'Tier 3 emits execution contract');
+check(tier3.stdout.includes('isolated-worktree-before-mutation'), 'Tier 3 structured plan carries the worktree isolation invariant');
+check(tier3.stdout.includes('using-git-worktrees'), 'Tier 3 structured plan surfaces the worktree workflow skill');
+check(tier3.stdout.includes('mutations require Git worktree isolation'), 'Tier 3 execution contract requires worktree isolation before mutation');
+check(tier3.stdout.includes('unavailable isolation means BLOCKED'), 'Tier 3 worktree failure blocks instead of falling back in place');
 
 const harnessSkill = read('harness-everything/SKILL.md');
-check(!/Requests that already name a skill/i.test(harnessSkill), 'harness entrypoint no longer opts out when another skill is named');
 check(/Work that names or matches another skill/i.test(harnessSkill), 'named domain skills still pass through Harness routing');
-check(/not a fixed pipeline/i.test(harnessSkill), 'skill contract rejects fixed pipeline semantics');
-check(/Harness Routing Checkpoint\*\*.*user-visible/i.test(harnessSkill), 'skill contract requires checkpoint visibility');
-check(/For every suggestion, read its `SKILL\.md`/i.test(harnessSkill), 'skill contract requires reading each suggested skill before skip');
-check(/`USE FOR`, `DO NOT USE FOR`, workflow\/basic flow, and hard rules/i.test(harnessSkill), 'skill contract defines the required evaluation scope');
-check(/Name, description, router summary, or "routine\/common task" alone cannot justify skip/i.test(harnessSkill), 'skill contract rejects metadata-only omission');
-check(/Using one suggestion does not waive evaluation of others/i.test(harnessSkill), 'skill contract applies evaluation per omitted suggestion');
-check(/Unreadable suggestions are `unresolved\/unavailable`/i.test(harnessSkill), 'skill contract defines unreadable suggestion disposition');
-check(/If all are skipped, give one brief flow-grounded reason/i.test(harnessSkill), 'skill contract preserves evaluated all-skipped rationale');
-check(/mandatory evaluation, advisory execution/i.test(harnessSkill), 'skill entry states the core disposition succinctly');
+check(/selected topology is not advisory/i.test(harnessSkill), 'skill contract makes selected topology mandatory');
+check(/"Simple", "routine".*cannot justify omission/i.test(harnessSkill), 'skill contract rejects confidence/routine omission shortcuts');
+check(/explicit escape with uncovered scope \+ evidence/i.test(harnessSkill), 'skill contract defines evidence-backed escape');
+check(/Complete only after applicable workflow obligations and objective verification resolve/i.test(harnessSkill), 'skill contract gates completion on workflow resolution');
+check(/mandatory applicable workflow; flexible reasoning\/implementation/i.test(harnessSkill), 'skill entry states core policy');
 
 const pluginHarnessSkill = read('plugins/harness-everything/skills/harness-everything/SKILL.md');
 check(pluginHarnessSkill === harnessSkill, 'canonical/plugin Harness SKILL.md copies remain identical');
-const pluginKernel = read('plugins/harness-everything/skills/harness-everything/scripts/kernel-router.js');
-check(pluginKernel === read('harness-everything/scripts/kernel-router.js'), 'canonical/plugin kernel-router copies remain identical');
-const pluginTriage = read('plugins/harness-everything/skills/harness-everything/references/triage-and-tiers.md');
-check(pluginTriage === read('harness-everything/references/triage-and-tiers.md'), 'canonical/plugin triage references remain identical');
+check(read('plugins/harness-everything/skills/harness-everything/scripts/kernel-router.js') === read('harness-everything/scripts/kernel-router.js'), 'canonical/plugin kernel-router copies remain identical');
+check(read('plugins/harness-everything/skills/harness-everything/scripts/kernel-router-core.js') === read('harness-everything/scripts/kernel-router-core.js'), 'canonical/plugin kernel-router core copies remain identical');
+check(read('plugins/harness-everything/skills/harness-everything/references/triage-and-tiers.md') === read('harness-everything/references/triage-and-tiers.md'), 'canonical/plugin triage references remain identical');
+
+const worktreeSkill = read('using-git-worktrees/SKILL.md');
+check(/Major workflow mode/i.test(worktreeSkill), 'worktree skill defines mandatory major-workflow mode');
+check(/never fall back to the primary working tree/i.test(worktreeSkill), 'worktree skill blocks unsafe in-place fallback for major work');
+check(/Creation\/entry failure => `BLOCKED`/i.test(worktreeSkill), 'worktree skill makes isolation failure a blocked state');
+check(read('plugins/harness-everything/skills/using-git-worktrees/SKILL.md') === worktreeSkill, 'canonical/plugin worktree skill copies remain identical');
 
 const cognitiveSkill = read('install-cognitive-os/SKILL.md');
-check(/policy, not a required peer-skill selection/i.test(cognitiveSkill), 'Cognitive OS is defined as policy rather than peer-skill dependency');
-check(!/Tasks already governed by a more specific domain skill/i.test(cognitiveSkill), 'domain skill selection no longer disables Cognitive OS policy');
+check(/policy, not a required peer-skill selection/i.test(cognitiveSkill), 'Cognitive OS remains reasoning policy rather than peer dependency');
 
 const hooks = JSON.parse(read('hooks/hooks.json'));
 const promptHooks = hooks.hooks && hooks.hooks.UserPromptSubmit;
 const command = promptHooks && promptHooks[0] && promptHooks[0].hooks && promptHooks[0].hooks[0] && promptHooks[0].hooks[0].command;
-check(command === 'node "${CLAUDE_PLUGIN_ROOT}/harness-everything/scripts/kernel-router.js"', 'UserPromptSubmit anchors the Harness kernel to the Claude plugin root');
+check(command === 'node "${CLAUDE_PLUGIN_ROOT}/harness-everything/scripts/kernel-router.js"', 'UserPromptSubmit anchors kernel to Claude plugin root');
+const preHooks = hooks.hooks && hooks.hooks.PreToolUse || [];
+const workflowHook = preHooks.find(entry => entry.id === 'harness:pre:workflow-gate');
+check(Boolean(workflowHook), 'Claude PreToolUse includes workflow gate');
+check(workflowHook && /Bash/.test(workflowHook.matcher) && /PowerShell/.test(workflowHook.matcher) && /Edit/.test(workflowHook.matcher) && /Write/.test(workflowHook.matcher), 'Claude workflow gate covers shell and artifact mutation');
+const stopHooks = hooks.hooks && hooks.hooks.Stop || [];
+check(stopHooks.some(entry => entry.id === 'harness:stop:workflow-completion-gate'), 'Claude Stop includes Fable workflow completion gate');
+
+const openaiHooks = JSON.parse(read('plugins/harness-everything/hooks/hooks.json'));
+const openaiWorkflowHook = (openaiHooks.hooks && openaiHooks.hooks.PreToolUse || []).find(entry =>
+  (entry.hooks || []).some(hook => String(hook.command || '').includes('workflow-gate.js'))
+);
+check(openaiWorkflowHook && /Bash/.test(openaiWorkflowHook.matcher) && /apply_patch/.test(openaiWorkflowHook.matcher), 'Codex/OpenAI packaged workflow gate covers Bash and apply_patch');
 
 const triageDoc = read('harness-everything/references/triage-and-tiers.md');
-check(triageDoc.includes('Do not enforce workflow order. Enforce workflow invariants and evaluate suggestions before skipping them.'), 'architecture reference records invariant-first plus read-before-skip decision');
-check(triageDoc.includes('A tier is **not** a fixed pipeline'), 'tier documentation rejects rigid orchestration');
-check(!triageDoc.includes('MUST load `todo-driven-workflow`'), 'documentation no longer mandates TODO as universal Tier 2/3 first step');
-check(triageDoc.includes('```mermaid'), 'updated architecture retains executable flowchart documentation');
-check(triageDoc.includes('the kernel always emits a compact checkpoint'), 'reference makes checkpoint emission mandatory');
-check(triageDoc.includes('mandatory to **evaluate**'), 'reference requires evaluation of every emitted suggestion');
-check(triageDoc.includes('Using one suggested skill does not waive evaluation'), 'reference preserves per-suggestion evaluation');
-check(triageDoc.includes('cannot be resolved/read is not a valid skip'), 'reference preserves unresolved/unavailable state');
-check(triageDoc.includes('Kernel emission alone is not proof'), 'reference preserves the #82 host-evidence boundary');
+check(/Mandatory applicable workflow/i.test(triageDoc), 'triage reference documents mandatory applicable workflow');
+check(/topology becomes the run's execution contract/i.test(triageDoc), 'triage reference makes topology a contract');
+check(/workflow-uncovered-scope/i.test(triageDoc), 'triage reference documents narrow escape policy');
+check(/A tier is \*\*not\*\* a fixed TODO\/TDD\/Fable pipeline/i.test(triageDoc), 'triage reference rejects universal tier pipeline');
+check(/```mermaid/.test(triageDoc), 'triage reference retains executable flowchart documentation');
+check(/cross-host live-enforcement claim/i.test(triageDoc), 'triage reference preserves host evidence boundary');
 
 const routingDoc = read('docs/routing.md');
-check(routingDoc.includes('Suggested skills are mandatory to evaluate and advisory to execute.'), 'routing docs state mandatory-evaluation/advisory-execution contract');
-check(routingDoc.includes('complete `SKILL.md` entry'), 'routing docs require complete skill entry reads before omission');
-check(routingDoc.includes('“routine/common task.”'), 'routing docs reject routine-task skip shortcut');
+check(/Mandatory applicable workflow/i.test(routingDoc), 'routing docs use mandatory workflow policy');
+check(/workflow-gate\.js/.test(routingDoc), 'routing docs describe PreToolUse workflow gate');
+check(/workflow-stop-gate\.js/.test(routingDoc), 'routing docs describe completion gate');
+check(/workflow-disposition\.js/.test(routingDoc), 'routing docs describe explicit escape mechanism');
+check(!/mandatory to evaluate and advisory to execute/i.test(routingDoc), 'routing docs remove old advisory execution contract');
 
 const architectureDoc = read('docs/architecture.md');
-check(architectureDoc.includes('Mandatory evaluation, advisory execution'), 'architecture docs expose the new routing contract');
-check(architectureDoc.includes('evaluate-suggestions-before-skip'), 'architecture docs name the conditional invariant');
+check(/topology becomes a lifecycle contract/i.test(architectureDoc), 'architecture makes selected topology lifecycle contract');
+check(/workflow-gate\.js/.test(architectureDoc), 'architecture includes workflow bypass gate');
+check(!/Mandatory evaluation, advisory execution/i.test(architectureDoc), 'architecture removes old advisory execution policy');
 
 const philosophyDoc = read('docs/philosophy.md');
-check(philosophyDoc.includes('Mandatory Evaluation, Advisory Execution'), 'philosophy docs preserve autonomy after informed evaluation');
+check(/Constrain Lifecycle, Not Reasoning/i.test(philosophyDoc), 'philosophy separates lifecycle constraint from reasoning freedom');
+check(/Applicable workflow is mandatory/i.test(philosophyDoc), 'philosophy states applicable workflow requirement');
+check(!/Mandatory Evaluation, Advisory Execution/i.test(philosophyDoc), 'philosophy removes old advisory execution policy');
 
 const meshDoc = read('docs/mechanism-first-skill-mesh.md');
-check(meshDoc.includes('mandatory to evaluate before omission, but advisory to execute after evaluation'), 'skill-mesh docs prevent advisory suggestions from becoming dead code');
+check(/mandatory applicable workflow \+ local skill autonomy/i.test(meshDoc), 'skill mesh documents mandatory outer workflow and local skill autonomy');
+check(/selected topology is mandatory for the run/i.test(meshDoc), 'skill mesh distinguishes selected topology from skill suggestions');
 
 const capabilitiesDoc = read('docs/platform-capabilities.md');
-check(capabilitiesDoc.includes('repository/agent contract'), 'platform docs distinguish routing contract from host enforcement evidence');
-check(capabilitiesDoc.includes('does not change `platform-compatibility.json` status values'), 'routing change does not inflate compatibility status');
+check(capabilitiesDoc.includes('repository/agent contract'), 'platform docs distinguish contract from host enforcement evidence');
+check(capabilitiesDoc.includes('does not upgrade `platform-compatibility.json` live-host status values'), 'routing change does not inflate compatibility status');
 
-const readme = read('README.md');
-check(readme.includes('**evaluate before skip**'), 'README describes the conditional evaluation rail');
-check(readme.includes('mandatory to evaluate and advisory to execute'), 'README explains suggestion evaluation semantics');
+const advisory = read('scripts/lib/advisory-text.js');
+check(/For EVERY suggested skill/i.test(advisory), 'generated advisory instructions require per-suggestion applicability evaluation');
+check(/selected workflow topology is mandatory once applicable/i.test(advisory), 'advisory surfaces carry mandatory workflow semantics');
+check(/No universal skill pipeline/i.test(advisory), 'advisory surfaces reject universal skill pipeline');
+check(/workflow genuinely cannot cover part of the task/i.test(advisory), 'advisory surfaces constrain workflow escape');
+check(read('plugins/harness-everything/scripts/lib/advisory-text.js') === advisory, 'OpenAI plugin advisory mirror matches canonical source');
 
 const agents = read('AGENTS.md');
-check(agents.includes('Router suggestions are mandatory to evaluate, advisory to execute.'), 'AGENTS.md requires read-before-skip for repository agents');
-
-const advisory = read('scripts/lib/advisory-text.js');
-check(advisory.includes('For EVERY suggested skill'), 'generated advisory instructions require per-suggestion evaluation');
-check(advisory.includes('entry/basic flow before skipping it'), 'Codex AGENTS generator includes read-before-skip');
-check(advisory.includes('There is NO universal TODO/TDD/Fable sequence'), 'advisory surfaces reject the old fixed execution pipeline');
-check(!advisory.includes('Initialize the `todo-driven-workflow` checklist first'), 'old forced Tier 2/3 checklist pipeline is removed');
-check(!advisory.includes('load `fable-mode` and `fable-discipline`, run sub-agents'), 'old forced Tier 3 Fable pipeline is removed');
-const pluginAdvisory = read('plugins/harness-everything/scripts/lib/advisory-text.js');
-check(pluginAdvisory === advisory, 'OpenAI plugin advisory mirror matches canonical source');
+check(/Selected workflow is mandatory; reasoning inside it stays flexible/i.test(agents), 'repository agent contract matches mandatory workflow policy');
+check(!/Router suggestions are mandatory to evaluate, advisory to execute/i.test(agents), 'repository agent contract removes old advisory execution rule');
 
 console.log(`\n${failed === 0 ? 'PASS' : 'FAIL'}: invariant routing contract (${failed} failure${failed === 1 ? '' : 's'})`);
 process.exit(failed === 0 ? 0 : 1);

package/ci/mechanism-2af-worktree-isolation.test.js

@@ -0,0 +1,152 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+const GATE = path.join(ROOT, 'hooks', 'scripts', 'workflow-gate.js');
+let failed = 0;
+
+function check(condition, message) {
+  if (condition) console.log(`✅ worktree-isolation: ${message}`);
+  else { console.error(`❌ worktree-isolation: ${message}`); failed++; }
+}
+
+function git(cwd, args) {
+  return spawnSync('git', args, { cwd, encoding: 'utf8', windowsHide: true });
+}
+
+const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-worktree-isolation-'));
+const home = path.join(temp, 'home');
+const repo = path.join(temp, 'repo');
+const linked = path.join(temp, 'repo-linked');
+fs.mkdirSync(home, { recursive: true });
+fs.mkdirSync(repo, { recursive: true });
+
+const env = {
+  ...process.env,
+  HOME: home,
+  USERPROFILE: home,
+  HARNESS_STATE_HOME: path.join(home, '.agents', 'harness-everything'),
+  CLAUDE: '1',
+};
+process.env.HARNESS_STATE_HOME = env.HARNESS_STATE_HOME;
+process.env.HOME = home;
+process.env.USERPROFILE = home;
+
+try {
+  if (process.platform === 'win32') {
+    const { key } = require('../hooks/scripts/lib/workflow-isolation');
+    const shortProgramFiles = path.join(process.env.SystemDrive || 'C:', 'PROGRA~1');
+    if (fs.existsSync(shortProgramFiles)) {
+      check(key(shortProgramFiles) === key(fs.realpathSync.native(shortProgramFiles)), 'Windows short and long path spellings identify the same physical directory');
+    }
+  }
+  check(git(repo, ['init']).status === 0, 'fixture git repository initializes');
+  fs.writeFileSync(path.join(repo, 'README.md'), 'fixture\n', 'utf8');
+  check(git(repo, ['add', 'README.md']).status === 0, 'fixture file stages');
+  check(git(repo, ['-c', 'user.name=Harness Test', '-c', 'user.email=harness@example.invalid', 'commit', '-m', 'fixture']).status === 0, 'fixture baseline commits');
+
+  const workspace = require(path.join(ROOT, 'scripts', 'lib', 'workspace'));
+  const state = require(path.join(ROOT, 'hooks', 'scripts', 'lib', 'harness-state'));
+  const sessionId = 'worktree-isolation-test';
+  const context = { session_id: sessionId, host_id: 'mechanism-test', cwd: repo };
+  workspace.bindWorkspaceSession(sessionId, repo, context, true);
+  const sessionDir = state.getSessionDir(repo, sessionId, context);
+  const workflowFile = path.join(sessionDir, 'workflow-run.json');
+
+  function writeWorkflow(tier, strategy) {
+    fs.writeFileSync(workflowFile, `${JSON.stringify({
+      schemaVersion: 1,
+      createdAt: new Date().toISOString(),
+      createdAtMs: Date.now(),
+      sessionId,
+      tier,
+      strategy,
+      state: 'active',
+    }, null, 2)}\n`, 'utf8');
+  }
+
+  function runGate(tool, cwd, input = {}) {
+    const payload = {
+      session_id: sessionId,
+      host_id: 'mechanism-test',
+      cwd,
+      tool_name: tool,
+      tool_input: input,
+    };
+    return spawnSync(process.execPath, [GATE], {
+      cwd: ROOT,
+      env,
+      input: JSON.stringify(payload),
+      encoding: 'utf8',
+    });
+  }
+
+  // Tier 3 isolation is independent of the selected execution topology.
+  writeWorkflow('tier3', 'iterative-single');
+
+  const primaryWrite = runGate('Write', repo, { file_path: path.join(repo, 'src.js'), content: 'x' });
+  check(primaryWrite.status === 2, 'Tier 3 direct write is blocked in the primary working tree');
+  check(/worktree isolation/i.test(primaryWrite.stderr), 'blocked write explains the isolation requirement');
+
+  const primaryDelete = runGate('Bash', repo, { command: 'rm -rf src' });
+  check(primaryDelete.status === 2, 'Tier 3 destructive shell mutation is blocked in the primary working tree');
+
+  for (const command of ['git status > tracked.txt', 'git log --output=tracked.txt', 'find . -delete', 'fd -x rm', 'rg --pre touch x', 'git show $(touch tracked.txt)', 'Get-Content (Remove-Item src)']) {
+    check(runGate('Bash', repo, { command }).status === 2, `shell side effect is not read-only: ${command}`);
+  }
+
+  const chainedBypass = runGate('Bash', repo, { command: 'git status --short && rm -rf src' });
+  check(chainedBypass.status === 2, 'read-only prefix cannot hide a chained mutation');
+
+  const readOnly = runGate('Bash', repo, { command: 'git status --short' });
+  check(readOnly.status === 0, 'read-only discovery remains allowed before isolation');
+
+  const setup = runGate('Bash', repo, { command: `git worktree add "${linked}" -b harness-isolation-test` });
+  check(setup.status === 0, 'git worktree creation is allowed as the isolation transition');
+
+  const createLinked = git(repo, ['worktree', 'add', linked, '-b', 'harness-isolation-test']);
+  check(createLinked.status === 0, 'fixture linked worktree is created');
+
+  const isolatedWrite = runGate('Write', linked, { file_path: path.join(linked, 'src.js'), content: 'x' });
+  check(isolatedWrite.status === 0, `Tier 3 mutation is allowed after entering a linked worktree (${isolatedWrite.stderr.trim() || 'allowed'})`);
+
+  check(runGate('Write', linked, { file_path: path.join(repo, 'src.js') }).status === 2, 'linked cwd cannot authorize a primary-tree target');
+  check(runGate('Write', linked, { file_path: '../repo/src.js' }).status === 2, 'relative traversal cannot escape the worktree');
+  check(runGate('apply_patch', linked, `*** Begin Patch\n*** Add File: ${path.join(repo, 'src.js')}\n+x\n*** End Patch`).status === 2, 'raw patch targets are checked');
+  check(runGate('apply_patch', linked, { patch: `*** Begin Patch\n*** Update File: README.md\n*** Move to: ${path.join(repo, 'moved.md')}\n@@\n-fixture\n+x\n*** End Patch` }).status === 2, 'patch move destination cannot escape isolation');
+  check(runGate('exec_command', repo, { cmd: 'rm -rf src', workdir: repo }).status === 2, 'native shell alias cannot skip mutation gating');
+  check(runGate('Bash', linked, { command: `rm "${path.join(repo, 'README.md')}"` }).status === 2, 'explicit primary-tree shell target is blocked');
+  check(runGate('Bash', linked, { command: 'cd ../repo && node build.js' }).status === 2, 'shell directory change cannot hide the effective working directory');
+  check(runGate('Write', linked, {}).status === 2, 'unknown direct target is blocked');
+  const junction = path.join(linked, 'outside');
+  fs.symlinkSync(repo, junction, process.platform === 'win32' ? 'junction' : 'dir');
+  check(runGate('Write', linked, { file_path: path.join(junction, 'src.js') }).status === 2, 'symlink or junction escape is blocked');
+  fs.unlinkSync(junction);
+
+  const escaped = JSON.parse(fs.readFileSync(workflowFile, 'utf8'));
+  escaped.state = 'escaped';
+  fs.writeFileSync(workflowFile, JSON.stringify(escaped));
+  check(runGate('Write', repo, { file_path: path.join(repo, 'src.js') }).status === 2, 'legacy escaped state never waives isolation');
+  escaped.state = 'blocked';
+  fs.writeFileSync(workflowFile, JSON.stringify(escaped));
+  check(runGate('Write', linked, { file_path: path.join(linked, 'src.js') }).status === 2, 'blocked workflow cannot mutate even inside isolation');
+  fs.writeFileSync(workflowFile, '{broken');
+  check(runGate('Write', linked, { file_path: path.join(linked, 'src.js') }).status === 2, 'corrupt recorded workflow cannot silently authorize mutation');
+
+  writeWorkflow('tier2', 'iterative-single');
+  const tier2Write = runGate('Write', repo, { file_path: path.join(repo, 'small.js'), content: 'x' });
+  check(tier2Write.status === 0, 'Tier 2 is not globally forced into worktree isolation');
+} finally {
+  try { fs.rmSync(temp, { recursive: true, force: true }); } catch (_) { /* best effort */ }
+}
+
+if (failed > 0) {
+  console.error(`FAIL: worktree isolation gate (${failed} failure${failed === 1 ? '' : 's'})`);
+  process.exit(1);
+}
+console.log('PASS: major-workflow worktree isolation gate');

package/ci/mechanism-2ag-router-worktree-contract.test.js

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+'use strict';
+
+const assert = require('assert');
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '..');
+const router = require(path.join(ROOT, 'harness-everything', 'scripts', 'router-contract.js'));
+
+const tier3 = router.buildRouterContract({
+  routingStatus: 'ok',
+  recommendedTier: 'Tier 3',
+  rationale: 'major architecture change',
+  signals: { macroScope: true, dependentStages: true },
+}).workflowPlan;
+
+assert.strictEqual(tier3.strategy, 'fable-staged');
+assert.ok(tier3.requiredInvariants.includes('isolated-worktree-before-mutation'), 'Tier 3 plan must carry mutation isolation invariant');
+assert.ok(tier3.suggestedSkills.includes('using-git-worktrees'), 'Tier 3 plan must surface the worktree workflow');
+assert.strictEqual(tier3.workspace.required, false, 'Git worktree isolation must remain distinct from durable multi-agent workspace state');
+
+const tier2 = router.buildRouterContract({
+  routingStatus: 'ok',
+  recommendedTier: 'Tier 2',
+  rationale: 'bounded bug fix',
+  signals: { tier2Keyword: true },
+}).workflowPlan;
+
+assert.strictEqual(tier2.strategy, 'iterative-single');
+assert.ok(!tier2.requiredInvariants.includes('isolated-worktree-before-mutation'), 'Tier 2 must not be globally forced into major-workflow isolation');
+assert.ok(!tier2.suggestedSkills.includes('using-git-worktrees'), 'Tier 2 keeps worktree use task-dependent');
+
+const explicitFable = router.buildWorkflowPlan({
+  routingStatus: 'ok',
+  tier: 'tier3',
+  taskShape: router.buildTaskShape({
+    tier: 'tier3',
+    signals: { macroScope: true, dependentStages: true },
+    explicitRequest: { strategy: 'fable-staged' },
+  }),
+});
+assert.ok(explicitFable.requiredInvariants.includes('isolated-worktree-before-mutation'), 'direct buildWorkflowPlan callers receive the same isolation contract');
+
+console.log('PASS: router major-workflow plan carries worktree isolation independently of multi-agent workspace state.');

package/ci/mechanism-2ah-workflow-lifecycle.test.js

@@ -0,0 +1,140 @@
+#!/usr/bin/env node
+'use strict';
+
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const ROOT = path.resolve(__dirname, '..');
+const plugin = process.argv.includes('--plugin');
+const runtimeRoot = plugin ? path.join(ROOT, 'plugins/harness-everything') : ROOT;
+const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-workflow-lifecycle-'));
+const repo = path.join(temp, 'repo');
+const linked = path.join(temp, 'linked');
+fs.mkdirSync(repo);
+const env = { ...process.env, HARNESS_STATE_HOME: path.join(temp, 'state'), HARNESS_WORKSPACE_ROOT: repo };
+process.env.HARNESS_STATE_HOME = env.HARNESS_STATE_HOME;
+const state = require(path.join(runtimeRoot, 'hooks/scripts/lib/harness-state'));
+const sessionId = 'workflow-lifecycle';
+const payload = { session_id: sessionId, cwd: repo };
+const sessionDir = state.getSessionDir(repo, sessionId);
+const file = path.join(sessionDir, 'workflow-run.json');
+const read = target => JSON.parse(fs.readFileSync(target, 'utf8'));
+const write = (target, value) => fs.writeFileSync(target, JSON.stringify(value));
+let passed = 0;
+function check(value, message) { assert.ok(value, message); passed++; console.log('PASS ' + message); }
+function node(script, input, args = []) {
+  const relative = plugin && script.startsWith('harness-everything/') ? 'skills/' + script : script;
+  return spawnSync(process.execPath, [path.join(runtimeRoot, relative), ...args], { cwd: repo, env, input: input && JSON.stringify(input), encoding: 'utf8' });
+}
+function git(args) {
+  const result = spawnSync('git', args, { cwd: repo, encoding: 'utf8' });
+  assert.strictEqual(result.status, 0, result.stderr);
+}
+const route = prompt => node('harness-everything/scripts/kernel-router.js', { ...payload, prompt });
+const gate = (tool, input, cwd = linked) => node('hooks/scripts/workflow-gate.js', { ...payload, cwd, tool_name: tool, tool_input: input });
+const stop = extra => node('hooks/scripts/workflow-stop-gate.js', { ...payload, ...extra });
+const control = (...args) => node('hooks/scripts/workflow-disposition.js', null, [args[0], '--session-id', sessionId, ...args.slice(1)]);
+const stages = [
+  { stageId: 'build', goal: 'fix', agent: 'fable-worker', task: 'fix bounded module', dependsOn: [], writeSet: ['src'], checkCommand: 'node test-build.js', passCondition: 'exit 0' },
+  { stageId: 'optional', goal: 'external scope', agent: 'fable-worker', task: 'external task', dependsOn: [], writeSet: [], checkCommand: 'node external.js', passCondition: 'exit 0' },
+  { stageId: 'verify', goal: 'verify', agent: 'fable-verifier', task: 'independent review', dependsOn: ['build', 'optional'], writeSet: [], checkCommand: 'node verify.js', passCondition: 'exit 0' },
+];
+
+try {
+  git(['init']); fs.writeFileSync(path.join(repo, 'README.md'), 'fixture\n'); git(['add', '.']);
+  git(['-c', 'user.name=Harness Test', '-c', 'user.email=harness@example.invalid', 'commit', '-m', 'fixture']);
+  git(['worktree', 'add', linked, '-b', 'isolated']);
+  const routed = route('Refactor the entire repository architecture in dependent stages.');
+  check(routed.status === 0, 'prompt hook creates workflow');
+  const initial = read(file);
+  check(initial.state === 'pending' && initial.workflowId && initial.strategy === 'fable-staged', 'selected route is pending with identity');
+  check(initial.requiredInvariants.includes('stage-contracts') && initial.requiredInvariants.includes('isolated-worktree-before-mutation'), 'persisted contract retains full invariant set');
+  check(!fs.readFileSync(file, 'utf8').includes('Refactor the entire'), 'state stores prompt hash without prompt text');
+  check(gate('Write', { file_path: path.join(linked, 'src.js') }).status === 2, 'Fable entry is required even inside worktree');
+  check(stop().status === 2, 'cannot stop before entry');
+  check(route('continue').status === 0 && read(file).workflowId === initial.workflowId, 'continuation does not erase active obligation');
+  check(route('Update one README typo').status === 0 && read(file).strategy === 'fable-staged', 'simple prompt cannot downgrade unresolved workflow');
+  const spec = path.join(sessionDir, 'workflow-stages.json');
+  check(gate('Write', { file_path: spec }, repo).status === 0, 'bounded stage specification can be bootstrapped without source mutation');
+  fs.linkSync(path.join(repo, 'README.md'), spec);
+  check(gate('Write', { file_path: spec }, repo).status === 2, 'bootstrap file cannot alias a primary-tree artifact');
+  fs.unlinkSync(spec);
+  check(gate('Write', { file_path: file }, repo).status === 2, 'bootstrap exception excludes active workflow state');
+  write(spec, stages);
+  const command = `node "${path.join(runtimeRoot, 'hooks/scripts/workflow-disposition.js')}" start --session-id ${sessionId}`;
+  check(gate('Bash', { command }, repo).status === 0, 'trusted controller can start from bound primary root');
+  check(gate('Bash', { command: command + ' && rm src.js' }, repo).status === 2, 'controller prefix cannot hide shell execution');
+  const started = control('start');
+  check(started.status === 0, 'controller starts a real Fable run: ' + started.stderr);
+  const active = read(file);
+  const runRoot = path.join(state.getStateRoot(repo), 'fable-runs', active.runId);
+  const runFile = path.join(runRoot, 'run.json');
+  const manifest = read(runFile);
+  check(manifest.workflowId === active.workflowId && manifest.sessionId === sessionId, 'run is explicitly bound to workflow and session');
+  const allowedMutation = gate('Write', { file_path: path.join(linked, 'src.js') });
+  check(allowedMutation.status === 0, 'entered workflow allows isolated artifact mutation: ' + allowedMutation.stderr);
+  for (const invalid of [{ sessionId: null }, { workflowId: 'unrelated' }, { createdAt: 'invalid' }]) {
+    write(runFile, { ...manifest, ...invalid });
+    check(stop().status === 2, 'uncorrelated run cannot satisfy completion: ' + JSON.stringify(invalid));
+  }
+  write(runFile, manifest);
+  check(control('escape', '--reason-code', 'routine', '--scope', 'task', '--evidence', 'easy').status === 2, 'confidence escape rejected');
+  check(control('escape', '--reason-code', 'workflow-uncovered-scope', '--scope', 'task', '--evidence', 'uncovered').status === 2, 'unscoped whole-workflow escape rejected');
+  check(control('escape', '--stage-id', 'optional', '--reason-code', 'workflow-uncovered-scope', '--scope', 'external observation', '--evidence', 'fixture external host unavailable').status === 0, 'scoped evidence-backed exception is recorded');
+  check(read(file).state === 'running' && stop().status === 2, 'escape leaves covered obligations unresolved');
+  check(gate('Write', { file_path: path.join(repo, 'src.js') }, repo).status === 2, 'actual escape command cannot waive isolation');
+  check(control('escape', '--stage-id', 'verify', '--reason-code', 'host-capability-unavailable', '--scope', 'verifier', '--evidence', 'missing host').status === 2, 'required verifier cannot be escaped');
+  function observe(stage, worker, exitCode) {
+    return node('hooks/scripts/contract-test.js', { ...payload, worker_id: worker, tool_name: 'Bash', tool_input: { command: stages.find(item => item.stageId === stage).checkCommand }, tool_response: { exitCode, stdout: 'fixture evidence' } });
+  }
+  check(observe('verify', 'reviewer', 0).status === 2, 'verifier cannot pass ahead of its dependency');
+  check(observe('build', 'builder', 1).status === 2 && stop().status === 2, 'failed objective check prevents completion');
+  check(observe('build', 'builder', 0).status === 0, 'failed stage may recover with observed passing evidence');
+  check(observe('verify', 'reviewer', 0).status === 0, 'independent verifier evidence is observed');
+  const buildFile = path.join(runRoot, 'contracts/build.json');
+  const savedBuild = read(buildFile);
+  fs.unlinkSync(buildFile);
+  check(stop().status === 2, 'deleted contract cannot make remaining directory entries look complete');
+  write(buildFile, savedBuild);
+  const evidenceFile = path.join(runRoot, 'evidence/build.json');
+  const savedEvidence = read(evidenceFile);
+  write(evidenceFile, { ...savedEvidence, exitCode: null });
+  check(stop().status === 2, 'status pass without observed exit zero is insufficient');
+  write(evidenceFile, savedEvidence);
+  const mutationState = read(file);
+  write(file, { ...mutationState, lastMutationAt: Date.now() + 10000 });
+  check(stop().status === 2, 'verification predating a new mutation is stale');
+  write(file, mutationState);
+  check(stop().status === 0 && read(file).state === 'satisfied', 'all covered stages and verifier resolve workflow to satisfied');
+  check(route('Refactor the entire repository architecture in dependent stages.').status === 0 && read(file).workflowId !== initial.workflowId, 'next completed-task boundary creates a fresh workflow');
+  check(stop({ stop_hook_active: true }).status === 0 && read(file).state === 'blocked', 'Stop retry reports blocked instead of faking completion');
+  check(gate('Write', { file_path: path.join(linked, 'src.js') }).status === 2, 'blocked state still prohibits mutation');
+  for (let i = 0; i < 3; i++) { check(control('start').status === 0, 'bounded replan attempt ' + i); control('block', '--evidence', 'fixture blocker'); }
+  check(control('start').status === 2 && read(file).state === 'blocked', 'exhausted replan budget remains blocked');
+  fs.writeFileSync(file, '{broken');
+  check(route('continue').status === 2 && fs.readFileSync(file, 'utf8') === '{broken', 'router cannot overwrite unreadable unresolved state');
+  check(stop().status === 2, 'malformed state cannot silently pass completion');
+  write(file, { state: 'active' });
+  check(gate('Write', { file_path: path.join(linked, 'src.js') }).status === 2 && stop().status === 2, 'partial JSON state cannot bypass workflow gates');
+  fs.unlinkSync(file);
+  check(route('Fix this checkout bug with a regression test').status === 0 && read(file).strategy === 'iterative-single', 'bounded fix selects iterative lifecycle');
+  check(gate('Write', { file_path: path.join(repo, 'small.js') }, repo).status === 0, 'ordinary iterative mutation does not require isolation');
+  check(stop().status === 2, 'direct/iterative route cannot complete unverified mutation');
+  check(stop({ stop_hook_active: true }).status === 0 && read(file).state === 'blocked', 'iterative retry reports incomplete state');
+  check(control('start').status === 0, 'blocked iterative route can resume without a Fable stage map');
+  node('hooks/scripts/state-persist.js', { ...payload, tool_name: 'Bash', tool_input: { command: 'npm test' }, tool_response: { stdout: 'no code' } });
+  check(stop().status === 2, 'verification without numeric exit status is unknown');
+  node('hooks/scripts/state-persist.js', { ...payload, tool_name: 'Bash', tool_input: { command: 'npm test' }, tool_response: { exitCode: 0, stdout: 'passed' } });
+  check(stop().status === 0 && read(file).state === 'satisfied', 'observed iterative verification resolves completion');
+  console.log(`PASS: workflow lifecycle (${passed} assertions)`);
+} finally {
+  if (!temp.startsWith(path.join(os.tmpdir(), 'harness-workflow-lifecycle-'))) throw new Error('unsafe fixture cleanup');
+  fs.rmSync(temp, { recursive: true, force: true });
+}
+if (!plugin) {
+  const packaged = spawnSync(process.execPath, [__filename, '--plugin'], { cwd: ROOT, env: process.env, encoding: 'utf8' });
+  assert.strictEqual(packaged.status, 0, packaged.stdout + packaged.stderr);
+  console.log('PASS: packaged OpenAI workflow lifecycle mirrors source (' + passed + ' assertions)');
+}