repo-harness 0.16.0 → 0.16.2

package/AGENTS.md

@@ -36,7 +36,7 @@ This repository self-hosts the `repo-harness` contract; the former `repo-harness
 - Treat `deploy/` as the trackable deployment and operations surface for runbooks, submission materials, release checklists, helper scripts, ordered SQL files, and env examples; follow `.ai/harness/policy.json#operations.deploy_sql` for configured SQL roots and naming modes, otherwise keep SQL directly under `deploy/sql/` with 4-digit ascending prefixes.
 - Treat `_ops/` as ignored local operations state for secrets, real env files, provider state, artifacts, logs, and scratch files; do not commit or agent-edit `_ops/*`.
 - Treat contract-level task execution as worktree-first: `repo-harness run plan-to-todo --plan <approved-plan>` starts `repo-harness run contract-worktree start --plan <approved-plan>` when policy enables it, and completed blocks finish through Waza `/check` plus `repo-harness run contract-worktree finish`.
-- Treat the EXECUTION_BOUNDARY anti-extras clause as mandatory on every delegated runner surface (contract worker prompts, the Codex delegation advisor hook, subagent start context, and MCP `codex-goal` documents): absent requirements are forbidden design space, not permission to improve, and unrequested extras fail closed.
+- Treat the EXECUTION_BOUNDARY anti-extras clause as mandatory exactly once in each delegated runner's final rendered task packet: absent requirements are forbidden design space, not permission to improve, and unrequested extras fail closed. Each runner path names one injection owner and no other surface on that path may carry the clause — the Codex native-child path is owned by `SubagentStart.context` (contract- and writability-aware; generated personas and the delegation advisor carry none), the standalone contract worker path by its worker prompt, and the MCP path by the `codex-goal` document. Composed-path tests verify the count.
 - After Codex Plan mode, Waza `/think`, or `repo-harness-plan` produces a decision-complete work-package plan, capture it with `repo-harness run capture-plan --artifact-level work-package --slug <slug> --title <title>` so `plans/` becomes the file-backed source of truth; if the user has already approved implementation, capture with `--status Approved --execute --promotion-reason <merge_boundary|rollback_boundary|verification_boundary|risk_boundary|human_decision_boundary|worktree_boundary>` or run `repo-harness run plan-to-todo --plan <active-plan>`.
 - Promote work into a top-level `plans/plan-*.md` only when `Artifact Level: work-package` is justified by a merge/PR unit, rollback surface, independent verification boundary, review/acceptance boundary, high-risk surface, or otherwise cannot remain a checklist item in the current active plan or sprint backlog. Inline sprint rows and checklist rows stay in the sprint backlog or active plan `## Task Breakdown`; contract rows may expand into plan -> contract -> review -> notes only through the work-package gate.
 - If current repo state conflicts with the task, open an isolated `codex/<task-slug>` worktree, finish there, run Waza `/check`-style validation, then merge back to `main` without absorbing unrelated dirty changes.
@@ -59,7 +59,7 @@ This repository self-hosts the `repo-harness` contract; the former `repo-harness
 ## Required Checks
 
 ```bash
-bun test
+bun test --timeout 60000
 bash scripts/check-deploy-sql-order.sh
 bash scripts/check-architecture-sync.sh
 bash scripts/check-task-sync.sh

package/CLAUDE.md

@@ -36,7 +36,7 @@ This repository self-hosts the `repo-harness` contract; the former `repo-harness
 - Treat `deploy/` as the trackable deployment and operations surface for runbooks, submission materials, release checklists, helper scripts, ordered SQL files, and env examples; follow `.ai/harness/policy.json#operations.deploy_sql` for configured SQL roots and naming modes, otherwise keep SQL directly under `deploy/sql/` with 4-digit ascending prefixes.
 - Treat `_ops/` as ignored local operations state for secrets, real env files, provider state, artifacts, logs, and scratch files; do not commit or agent-edit `_ops/*`.
 - Treat contract-level task execution as worktree-first: `repo-harness run plan-to-todo --plan <approved-plan>` starts `repo-harness run contract-worktree start --plan <approved-plan>` when policy enables it, and completed blocks finish through Waza `/check` plus `repo-harness run contract-worktree finish`.
-- Treat the EXECUTION_BOUNDARY anti-extras clause as mandatory on every delegated runner surface (contract worker prompts, the Codex delegation advisor hook, subagent start context, and MCP `codex-goal` documents): absent requirements are forbidden design space, not permission to improve, and unrequested extras fail closed.
+- Treat the EXECUTION_BOUNDARY anti-extras clause as mandatory exactly once in each delegated runner's final rendered task packet: absent requirements are forbidden design space, not permission to improve, and unrequested extras fail closed. Each runner path names one injection owner and no other surface on that path may carry the clause — the Codex native-child path is owned by `SubagentStart.context` (contract- and writability-aware; generated personas and the delegation advisor carry none), the standalone contract worker path by its worker prompt, and the MCP path by the `codex-goal` document. Composed-path tests verify the count.
 - After Codex Plan mode, Waza `/think`, or `repo-harness-plan` produces a decision-complete work-package plan, capture it with `repo-harness run capture-plan --artifact-level work-package --slug <slug> --title <title>` so `plans/` becomes the file-backed source of truth; if the user has already approved implementation, capture with `--status Approved --execute --promotion-reason <merge_boundary|rollback_boundary|verification_boundary|risk_boundary|human_decision_boundary|worktree_boundary>` or run `repo-harness run plan-to-todo --plan <active-plan>`.
 - Promote work into a top-level `plans/plan-*.md` only when `Artifact Level: work-package` is justified by a merge/PR unit, rollback surface, independent verification boundary, review/acceptance boundary, high-risk surface, or otherwise cannot remain a checklist item in the current active plan or sprint backlog. Inline sprint rows and checklist rows stay in the sprint backlog or active plan `## Task Breakdown`; contract rows may expand into plan -> contract -> review -> notes only through the work-package gate.
 - If current repo state conflicts with the task, open an isolated `codex/<task-slug>` worktree, finish there, run Waza `/check`-style validation, then merge back to `main` without absorbing unrelated dirty changes.
@@ -59,7 +59,7 @@ This repository self-hosts the `repo-harness` contract; the former `repo-harness
 ## Required Checks
 
 ```bash
-bun test
+bun test --timeout 60000
 bash scripts/check-deploy-sql-order.sh
 bash scripts/check-architecture-sync.sh
 bash scripts/check-task-sync.sh

package/README.es.md

@@ -467,8 +467,8 @@ repositorio adopte la misma política.
 
 ## Versión actual
 
-- Paquete npm: `repo-harness@0.16.0`
-- Sello de workflow generado: `repo-harness@0.16.0+template@0.16.0`
+- Paquete npm: `repo-harness@0.16.2`
+- Sello de workflow generado: `repo-harness@0.16.2+template@0.16.2`
 - Repositorio de GitHub: `Ancienttwo/repo-harness`
 - Notas de versión e historial: [`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/README.fr.md

@@ -462,8 +462,8 @@ adopte la même policy.
 
 ## Release actuelle
 
-- Package npm : `repo-harness@0.16.0`
-- Generated workflow stamp : `repo-harness@0.16.0+template@0.16.0`
+- Package npm : `repo-harness@0.16.2`
+- Generated workflow stamp : `repo-harness@0.16.2+template@0.16.2`
 - Dépôt GitHub : `Ancienttwo/repo-harness`
 - Notes et historique de release : [`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/README.ja.md

@@ -470,8 +470,8 @@ commit script や hooks に組み込まないでください。
 
 ## 現在の Release
 
-- npm package：`repo-harness@0.16.0`
-- Generated workflow stamp：`repo-harness@0.16.0+template@0.16.0`
+- npm package：`repo-harness@0.16.2`
+- Generated workflow stamp：`repo-harness@0.16.2+template@0.16.2`
 - GitHub repository：`Ancienttwo/repo-harness`
 - Release notes and history：[`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/README.md

@@ -41,9 +41,10 @@ with a tasks-first agent contract that keeps Claude and Codex aligned.
 
 ### 1. Install the CLI
 
-Prerequisites: a Git working tree, `bash`, and `bun`; `jq` is optional. No
-Node.js required — the installer uses Bun >= 1.1.35 as the runtime, installing or
-upgrading Bun first when needed.
+Prerequisites: a Git working tree and `bun`; macOS/Linux also require `bash`,
+while Windows requires Git for Windows (including its Bash and `usr/bin`
+tools). `jq` is optional. No Node.js required — the installer uses Bun >=
+1.1.35 as the runtime, installing or upgrading Bun first when needed.
 
 ```bash
 # macOS / Linux
@@ -70,6 +71,13 @@ npx -y repo-harness@latest install   # npx fallback; the CLI still runs on Bun
 repo-harness install
 ```
 
+On Windows, keep Git for Windows on the install/update `PATH`. That explicit
+ceremony validates and pins `git.exe`, its matching `bash.exe`/`usr/bin`, and
+the install account's absolute `TEMP` directory plus native `System32` tools in the OS account's
+`~/.repo-harness/config.json#protectedHelperRuntime`. Protected workflow
+helpers do not rediscover tools from a caller's `PATH`; rerun
+`repo-harness update` after relocating or replacing Git for Windows.
+
 The global bootstrap: installs the npm package as the global CLI, refreshes
 repo-harness skill aliases, installs user-level hook adapters, and records an
 explicit install profile. It is idempotent and does not apply repo-local workflow
@@ -442,8 +450,8 @@ repo-harness commit scripts or hooks unless that repo adopts the same policy.
 
 ## Current Release
 
-- npm package: `repo-harness@0.16.0`
-- Generated workflow stamp: `repo-harness@0.16.0+template@0.16.0`
+- npm package: `repo-harness@0.16.2`
+- Generated workflow stamp: `repo-harness@0.16.2+template@0.16.2`
 - GitHub repository: `Ancienttwo/repo-harness`
 - Release notes and history: [`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/README.zh-CN.md

@@ -41,9 +41,10 @@ checks 和 review evidence 写回项目文件，让下一个 agent 会话从文
 
 ### 1. 安装 CLI
 
-前置条件：一个 Git working tree、`bash` 和 `bun`；`jq` 可选。不需要
-Node.js——installer 使用 Bun >= 1.1.35 作为 runtime，需要时会先安装或升级
-Bun。
+前置条件：一个 Git working tree 和 `bun`；macOS/Linux 还需要 `bash`，
+Windows 则需要 Git for Windows（包括其 Bash 与 `usr/bin` 工具）。`jq`
+可选。不需要 Node.js——installer 使用 Bun >= 1.1.35 作为 runtime，需要时会
+先安装或升级 Bun。
 
 ```bash
 # macOS / Linux
@@ -70,6 +71,13 @@ npx -y repo-harness@latest install   # npx fallback; the CLI still runs on Bun
 repo-harness install
 ```
 
+Windows 上应在执行 install/update 时让 Git for Windows 位于 `PATH`。
+这次显式配置会验证 `git.exe`、同一安装根下的 `bash.exe`/`usr/bin` 以及原生
+`System32` 工具和安装账号的绝对 `TEMP` 目录，并将这些路径固定到 OS 账号的
+`~/.repo-harness/config.json#protectedHelperRuntime`。protected workflow
+helper 运行时不会再从调用者 `PATH` 搜索工具；Git for Windows 被移动或替换
+后，必须重新运行 `repo-harness update`。
+
 这个全局 bootstrap 会把 npm 包安装成全局 CLI，刷新 repo-harness 的 skill
 aliases，安装 user-level hook adapters，并记录一份明确的 install profile。
 它是幂等的，不会把 repo-local workflow 文件应用到当前目录。`--dry-run
@@ -449,8 +457,8 @@ policy。
 
 ## 当前 Release
 
-- npm package：`repo-harness@0.16.0`
-- Generated workflow stamp：`repo-harness@0.16.0+template@0.16.0`
+- npm package：`repo-harness@0.16.2`
+- Generated workflow stamp：`repo-harness@0.16.2+template@0.16.2`
 - GitHub repository：`Ancienttwo/repo-harness`
 - Release notes 和 history：[`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/assets/partials/03-philosophy.partial.md

@@ -24,6 +24,12 @@ BUG_FIX_FLOW:
   3. Re-run full verification
 ```
 
+#### Artifact Hygiene
+
+- Write comments, commit messages, and PR text from the final diff only, as if discarded intermediate attempts never existed.
+- Comments state only the non-obvious reason at the owning boundary; never restate the operation, preserve intermediate attempts, or list speculative future work.
+- PR text states final behavior plus only the material rationale or trade-off a reviewer cannot recover from the diff; never mention never-merged states or reverted work.
+
 Detailed playbooks:
 - `docs/reference-configs/harness-overview.md`
 - `docs/reference-configs/agentic-development-flow.md`

package/assets/partials-agents/04-task-protocol.partial.md

@@ -53,7 +53,6 @@ RULES:
   - Promote factors only after hypothesis and backtest summary artifacts exist
   - Run the configured factor-lab check before claiming factor-lab work is complete
 {{/IF}}
-
 ACTIVE_PLAN:
   - .ai/harness/active-plan selects the current active plan only for its owning worktree; .ai/harness/active-worktree records that owner
 

package/assets/partials-agents/06-quality-safety.partial.md

@@ -12,6 +12,7 @@
 - Do not silently expand scope beyond approved plan.
 - If unexpected repo changes appear, stop and ask.
 - Prefer modifying existing files over unnecessary file creation.
+- Write comments, commit messages, and PR text from the final diff only: comments state only the non-obvious reason at the owning boundary; PR text states final behavior plus only rationale a reviewer cannot recover from the diff; never mention discarded attempts, reverted work, or never-merged states.
 
 ### Final Response Contract
 1. What changed — list modified files with one-line summary each

package/assets/reference-configs/external-tooling.md

@@ -224,7 +224,7 @@ boundary explicit:
 | Capability | Owner | Required for |
 |---|---|---|
 | `bun` | repo-harness | repo-harness-owned global installs, local dependency install, tests, and runtime execution |
-| `bash` | repo-harness | helper scripts, migration, setup checks, and contract verification wrappers |
+| `bash` | repo-harness | helper scripts, migration, setup checks, and contract verification wrappers; Git-for-Windows Bash is the Windows platform contract |
 | `npm` | npm registry | registry readbacks, publish gates, and opt-in update checks; not repo-harness-owned global install repair |
 | `npx` / `skills_cli` | external Skills CLI | Waza and Mermaid skill bootstrap/update commands |
 | `rsync` | platform filesystem | Waza staging-to-Codex sync and installed-copy runtime mirroring |
@@ -236,6 +236,31 @@ CLI dependencies until a separate plan replaces that integration. Missing
 optional capabilities should degrade the named feature, not blur command
 ownership.
 
+On Windows, `repo-harness install` and `repo-harness update` are the only
+protected-helper tool discovery ceremonies. They resolve `git.exe` and
+`taskkill.exe` from that invocation's `PATH`, require the latter to match
+`SystemRoot\\System32\\taskkill.exe`, require Git, Bash, and `usr/bin` to
+resolve under one non-symlink Git-for-Windows root, require the ceremony's
+`TEMP` to be an absolute non-symlink directory, probe the executables, and
+atomically persist protocol 1 under the OS account's
+`~/.repo-harness/config.json#protectedHelperRuntime`. Existing sibling config
+fields are preserved.
+
+Normal `acceptance-receipt`, `merge-gate`, `contract-worktree`, and
+`ship-worktrees` dispatch reads that exact contract. The protected child gets
+the platform `PATH` delimiter, account home, pinned temp/SystemRoot values,
+pinned Bun/Git/Bash, the Git-for-Windows POSIX directories, and the exact
+`taskkill.exe` passed to both supervisor termination paths; caller binary overrides, `HOME`, shell
+startup hooks, and general `PATH` entries are discarded. A missing, malformed,
+relocated, symlinked, cross-root, or incomplete contract fails before helper
+execution and instructs the operator to rerun install/update. There is no
+runtime discovery fallback. The protected TypeScript entrypoints re-resolve the
+same host contract themselves when invoked directly, so their Git and temp
+authority does not depend on dispatcher-only environment variables. Optional
+feature dependencies such as `jq` and `gh` remain separately operator-owned
+and are not installed by this contract; the required merge-gate path does not
+depend on `jq`.
+
 Installed-copy sync has two explicit modes. `AGENTIC_DEV_LINK_INSTALLED_COPIES=1`
 uses symlinks and does not require `rsync`; if symlink creation fails, the
 script reports unsupported link-mode and tells the caller to use copy-mode.
@@ -584,9 +609,9 @@ The exact target base commit enables the local gate in
 `.ai/harness/policy.json#merge_gate`; the candidate cannot disable that base
 requirement. Runtime setup installs no merge-gate skill, agent, or provider
 runtime. Caller `HOME`, helper-source, and runner environment overrides are ignored for
-the protected ship/gate helpers. The official runner also pins Bash, Git, Bun,
-and `gh` to installed host executables and replaces caller `PATH` with the
-minimal host runtime path. The host state directories, AcceptanceReceipt, and
+the protected ship/gate helpers. The official runner pins Bash, Git, and Bun;
+where a fixed trusted host `gh` is present it pins that executable too, and it
+replaces caller `PATH` with the minimal host runtime path. The host state directories, AcceptanceReceipt, and
 seal must be owned by the OS account and not group/world writable. After
 `contract-worktree finish` creates the candidate commit, the installed helper
 binds the seal to repository root, target base ref/SHA, candidate head SHA,
@@ -642,11 +667,22 @@ mismatched, invalid, or unverified native observation blocks a role-routing
 claim and authorizes no alternate fleet runner. repo-harness must not scrape
 rollout JSONL or SQLite as a compatibility path.
 
-`developer_instructions` is the packaged `.md` body plus the canonical
-EXECUTION_BOUNDARY anti-extras clause, kept byte-identical to the
-`EXECUTION_BOUNDARY` constant in `scripts/contract-run.ts` so every generated
-Codex agent carries the same boundary as the Claude worker prompts, the MCP
-`codex-goal` path, and the Codex delegation advisor hook.
+`developer_instructions` is the packaged `.md` role body only. Generated
+personas carry no EXECUTION_BOUNDARY anti-extras clause, and neither does the
+Codex delegation advisor hook: on the native-child path `SubagentStart.context`
+is the single injection owner, so the clause appears exactly once in each
+rendered task packet under the marker
+`[repo-harness:execution-boundary/v1]`. The hook renders it only when both
+halves of the scope decision are known — a resolved active contract and a child
+whose selected profile declares `sandbox_mode = "workspace-write"`; a
+`read-only` child gets the inverse note, and an unresolved contract or
+unverified routing gets neither.
+
+`sandbox_mode` is therefore required in every custom-agent TOML and validated
+fail-closed. Writability is read from the selected profile, never inferred from
+the agent name and never defaulted: a profile missing `sandbox_mode`, or
+declaring anything other than `read-only` or `workspace-write`, routes the child
+to native-role-routing `invalid` and receives no implementation boundary.
 
 ### `install_mode`: self-host vs. downstream
 

package/assets/reference-configs/global-working-rules.md

@@ -75,6 +75,14 @@ For architecture reviews, bug hunts, risky refactors, deployment issues, auth/pa
 
 Reports must be concise and grounded in files, commands, runtime behavior, observed code, or verified system state.
 
+## Artifact Hygiene
+
+Write comments, commit messages, and PR text from the final diff only, as if discarded intermediate attempts never existed. Session history is not documentation material.
+
+- Comments state only the non-obvious reason at the owning boundary; never restate the operation, preserve intermediate attempts, or list speculative future work.
+- PR text states final behavior plus only the material rationale or trade-off a reviewer cannot recover from the diff; never mention never-merged states, reverted work, or why something is absent (no "(without X)" titles, no paragraphs justifying a removal the reviewer never saw).
+- When the user rejects an addition, the correct artifact output is the version where that addition never existed — not an annotated explanation of its removal.
+
 ## Completion Summary Rule
 
 For non-trivial completed tasks, include a short `下一刀` section only when verified state shows a concrete next bottleneck, unresolved risk, failing check, deployment gap, review gap, or active-plan item that materially affects the user's stated goal.

package/assets/reference-configs/sprint-contracts.md

@@ -231,6 +231,8 @@ evaluator never guesses semantic equivalence.
   worktree start records immutable provenance.
 - Execute the sprint in that linked worktree. The primary worktree remains a merge target and must stay clean before merge-back.
 - After implementation, run `repo-harness run verify-sprint --prepare-acceptance`, obtain exactly one semantic disposition from the contract-frozen reviewer (or an explicitly allowed typed user waiver), record the `AcceptanceReceipt`, then run `repo-harness run verify-sprint`. The final verification projects the receipt into the review file. The finish command consumes that same receipt, creates a provider-free exact local seal, applies the allowlisted lifecycle archive, and publishes one synthesized target commit whose tree is byte-identical to the verified lifecycle HEAD. The target base must remain frozen and its worktree must remain clean through publication.
+- When architecture projection policy is `automatic`, `--prepare-acceptance` materializes it before computing the review subject. The generated `docs/architecture/.projection-manifest.json` is an exact workflow-owned publication output and does not need to be repeated in every contract `allowed_paths`; every other generated architecture/context path still needs explicit contract scope and otherwise fails closed. Provider unavailability or a non-publishable projection status aborts preparation. After a synthesized commit containing a manifest delta lands, closeout verifies the exact clean published tree and advances the architecture drift cursor to that publication SHA; recovery retries this acknowledgement before committing its journal. Post-publication Stop projection is recovery only, and closeout never restores or discards a dirty target manifest.
+- On the primary checkout, a Stop drain whose only effect is a digest-only manifest restamp publishes itself as one single-path commit, so the steady state stays clean for those dirty gates instead of needing a manual batching commit. The classifier is the provider's own result — exactly one `update` entry for `docs/architecture/.projection-manifest.json` and no pending human action — so a semantic projection delta is never auto-committed. The git gate is fail-closed on top of that: primary worktree, attached local branch, clean index, the manifest as the only dirty tracked path, and no `commit.gpgsign`. The commit is synthesized with `commit-tree` plus an `update-ref` compare-and-swap, which runs no user hooks and reads no untracked or unstaged state, so staged content and working files are never swept in. Nothing is pushed and the architecture drift cursor is not touched; a publication that leaves the branch ahead of its remote prints one push advisory, and every skip or fault prints one advisory and still exits 0. `repo-harness architecture-projection publish-restamp --json` runs the same classifier, gate, and synthesis for manual recovery and exits non-zero unless it published.
 
 ## Publication Granularity
 

package/assets/skill-commands/manifest.json

@@ -151,7 +151,10 @@
       ],
       "discoverability": "profile-facade",
       "component": "adaptive-workflow",
-      "requires": [],
+      "requires": [
+        "obsidian-markdown",
+        "obsidian-cli"
+      ],
       "mutatesRepoByDefault": false,
       "summary": "Cross-project long-term memory over the user's Obsidian brain vault: recall relevant notes before a task and persist distilled conclusions after it. Repo artifacts stay the source of truth; sync direction is repo -> brain. Explicitly invoked by the model or operator, never from hooks. Requires the runtime-referenced official obsidian-markdown and obsidian-cli skills.",
       "retirementCandidate": null
@@ -336,6 +339,42 @@
       "mutatesRepoByDefault": false,
       "summary": "Explicit-opt-in reverse-engineering and security-task router pack. Fetched from zhaoxuya520/reverse-skill via bunx skills add after independent authorization review.",
       "retirementCandidate": null
+    },
+    {
+      "name": "obsidian-markdown",
+      "kind": "external",
+      "source": null,
+      "provider": "kepano/obsidian-skills@a1dc48e68138490d522c04cbf5822214c6eb1202",
+      "integrity": "sha256:ac9b702f9697f0bbf5f0fdc0c6896d94efef01438a59a4b508e5d7346da050e6",
+      "hosts": [
+        "claude",
+        "codex"
+      ],
+      "profiles": [],
+      "discoverability": "external-marketplace",
+      "component": "adaptive-workflow",
+      "requires": [],
+      "mutatesRepoByDefault": false,
+      "summary": "Explicit-opt-in official Obsidian Markdown authoring companion Skill. Pinned to kepano/obsidian-skills and verified before projection.",
+      "retirementCandidate": null
+    },
+    {
+      "name": "obsidian-cli",
+      "kind": "external",
+      "source": null,
+      "provider": "kepano/obsidian-skills@a1dc48e68138490d522c04cbf5822214c6eb1202",
+      "integrity": "sha256:58b3eaf9ccaadfcbe3b8d0eddb0d1fe872ef42c4cf289393a72d4e9a6d896f6f",
+      "hosts": [
+        "claude",
+        "codex"
+      ],
+      "profiles": [],
+      "discoverability": "external-marketplace",
+      "component": "adaptive-workflow",
+      "requires": [],
+      "mutatesRepoByDefault": false,
+      "summary": "Explicit-opt-in official Obsidian CLI companion Skill. Does not install or require the Obsidian executable or desktop App.",
+      "retirementCandidate": null
     }
   ],
   "expectedProjections": {

package/assets/skill-version.json

@@ -1,6 +1,6 @@
 {
-  "version": "0.16.0",
-  "templateVersion": "0.16.0",
+  "version": "0.16.2",
+  "templateVersion": "0.16.2",
   "skillName": "repo-harness",
   "contractId": "tasks-first-harness-v1",
   "compatibility": {
@@ -255,6 +255,14 @@
     {
       "version": "0.16.0",
       "description": "Completes the kanban coordination program on top of the 0.15.3 lease plane: adds the deterministic board projection `state board --json` emitting the frozen BoardDocumentV1 with four precedence-ordered columns, three separated dimensions, per-dimension and composite input revisions, and a stable | changed_during_read snapshot-consistency verdict from a single-retry collector; adds a bind-time resumed receipt so a steal-then-rebind no longer inherits the previous claim's no-progress receipts; injects a byte-identical read-only BoardSliceV1 at Codex SubagentStart context and the Claude PreToolUse.subagent Task|Agent branch through one pure projector and one shared renderer; arms a PreToolUse.edit lease gate only behind the double predicate of a unique claim token matching the active-plan marker and a linked worktree, failing closed with an explicit reason token per step while leaving non-sprint execution untouched; and retires the merged worktree at the tail of contract-worktree finish --merge"
+    },
+    {
+      "version": "0.16.1",
+      "description": "Replaces the boolean `overwrite` flag on the seven MCP workflow-artifact write tools with an optional `expected_sha256` revision precondition (absent = create-only with WOULD_OVERWRITE, supplied = guarded overwrite with REVISION_CONFLICT and no current-hash echo), routes those writes through a guarded synchronous writer with lstat symlink and regular-file guards plus temp+fsync+rename+parent-fsync, returns sha256/previousSha256 on success, and rejects undeclared parameters server-side with UNKNOWN_PARAMETER while `overwrite` specifically returns RETIRED_PARAMETER naming `expected_sha256`"
+    },
+    {
+      "version": "0.16.2",
+      "description": "Fixes MCP runtime issues from #204, binds MCP HTTP sessions to the startup profile with fail-closed config-flip handling, publishes the architecture queue lock owner record atomically via staged hard-link creation, requires and fail-closed-validates sandbox_mode in Codex custom-agent TOMLs with EXECUTION_BOUNDARY persona de-duplication, and adds artifact-hygiene rules (final-diff-only comments and PR text) to the global working rules and generated agent contracts"
     }
   ],
   "generatedProjectStamp": {

package/assets/templates/helpers/acceptance-receipt.ts

@@ -13,6 +13,7 @@ import {
   writeFileSync,
 } from 'fs';
 import { userInfo } from 'os';
+import { createRequire } from 'module';
 import { basename, dirname, isAbsolute, join, relative, resolve } from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
 import { spawnSync } from 'child_process';
@@ -87,10 +88,81 @@ type Options = {
 };
 
 const SCRIPT_DIR = dirname(fileURLToPath(import.meta.url));
-const PACKAGE_ROOT = SCRIPT_DIR.endsWith('/assets/templates/helpers')
+const PACKAGE_ROOT = basename(SCRIPT_DIR) === 'helpers'
+  && basename(dirname(SCRIPT_DIR)) === 'templates'
+  && basename(dirname(dirname(SCRIPT_DIR))) === 'assets'
   ? resolve(SCRIPT_DIR, '../../..')
   : resolve(SCRIPT_DIR, '..');
-const GIT_BIN = ['/usr/bin/git', '/bin/git'].find((path) => existsSync(path)) ?? 'git';
+type ProtectedRuntime = {
+  platform: NodeJS.Platform;
+  accountHome: string;
+  accountUsername: string;
+  gitBin: string;
+  bashBin: string;
+  bunExecutable: string;
+  pathEntries: readonly string[];
+  pathDelimiter: ':' | ';';
+  tempDir: string;
+  systemRoot?: string;
+};
+type ProtectedPlatformModule = {
+  resolveProtectedHelperPlatform: () => ProtectedRuntime;
+  protectedHelperRuntimeEnv: (runtime: ProtectedRuntime) => NodeJS.ProcessEnv;
+};
+type ProtectedGitRuntime = {
+  readonly gitBin: string;
+  readonly env: NodeJS.ProcessEnv;
+};
+const requireFromHelper = createRequire(import.meta.url);
+let protectedGitRuntimeCache: ProtectedGitRuntime | null = null;
+
+function fixedPosixExecutable(label: string, candidates: readonly string[]): string {
+  for (const candidate of candidates) {
+    if (!isAbsolute(candidate) || !existsSync(candidate)) continue;
+    const source = lstatSync(candidate);
+    if (source.isSymbolicLink() || !source.isFile()) continue;
+    const actual = realpathSync(candidate);
+    const target = lstatSync(actual);
+    if (target.isSymbolicLink() || !target.isFile() || (target.mode & 0o111) === 0) continue;
+    return actual;
+  }
+  throw new Error(`required system executable is unavailable: ${label}`);
+}
+
+export function resolveProtectedGitRuntime(): ProtectedGitRuntime {
+  if (protectedGitRuntimeCache) return protectedGitRuntimeCache;
+  if (process.platform !== 'win32') {
+    const account = userInfo();
+    const gitBin = fixedPosixExecutable('git', ['/usr/bin/git', '/bin/git']);
+    const bashBin = fixedPosixExecutable('bash', ['/bin/bash']);
+    const protectedPath = `${dirname(process.execPath)}:/usr/bin:/bin:/usr/sbin:/sbin`;
+    protectedGitRuntimeCache = {
+      gitBin,
+      env: {
+        HOME: account.homedir,
+        USER: account.username,
+        LOGNAME: account.username,
+        PATH: protectedPath,
+        TMPDIR: '/tmp',
+        REPO_HARNESS_BASH_BIN: bashBin,
+        REPO_HARNESS_GIT_BIN: gitBin,
+        REPO_HARNESS_BUN_BIN: process.execPath,
+        REPO_HARNESS_PROTECTED_PATH: protectedPath,
+        REPO_HARNESS_PROTECTED_TMPDIR: '/tmp',
+      },
+    };
+    return protectedGitRuntimeCache;
+  }
+  const protectedPlatform = requireFromHelper(
+    join(PACKAGE_ROOT, 'src', 'cli', 'runtime', 'protected-helper-platform.ts'),
+  ) as ProtectedPlatformModule;
+  const runtime = protectedPlatform.resolveProtectedHelperPlatform();
+  protectedGitRuntimeCache = {
+    gitBin: runtime.gitBin,
+    env: protectedPlatform.protectedHelperRuntimeEnv(runtime),
+  };
+  return protectedGitRuntimeCache;
+}
 
 function fail(message: string, code = 1): never {
   const error = new Error(message) as Error & { exitCode?: number };
@@ -123,7 +195,8 @@ function isRecord(value: unknown): value is Record<string, unknown> {
 }
 
 function gitText(root: string, args: string[]): string {
-  const result = spawnSync(GIT_BIN, ['-C', root, ...args], { encoding: 'utf-8' });
+  const runtime = resolveProtectedGitRuntime();
+  const result = spawnSync(runtime.gitBin, ['-C', root, ...args], { encoding: 'utf-8', env: runtime.env });
   if (result.status !== 0) fail(`git ${args.join(' ')} failed: ${result.stderr.trim() || 'unknown error'}`);
   return result.stdout.trim();
 }
@@ -478,7 +551,8 @@ function resolveArchived(root: string, path: string, family: 'plans' | 'tasks',
   if (existsSync(resolve(root, path))) return path;
   const archiveRoot = join(root, family, 'archive');
   if (!existsSync(archiveRoot)) fail(`receipt authority file is missing: ${path}`);
-  const tracked = spawnSync(GIT_BIN, ['-C', root, 'ls-files', `${family}/archive`], { encoding: 'utf-8' })
+  const runtime = resolveProtectedGitRuntime();
+  const tracked = spawnSync(runtime.gitBin, ['-C', root, 'ls-files', `${family}/archive`], { encoding: 'utf-8', env: runtime.env })
     .stdout.split(/\r?\n/).filter(Boolean);
   const matches = tracked.filter((candidate) => {
     const absolute = resolve(root, candidate);

package/assets/templates/helpers/architecture-event.ts

@@ -3,6 +3,7 @@ import { createHash, randomUUID } from "crypto";
 import {
   closeSync,
   existsSync,
+  linkSync,
   lstatSync,
   mkdirSync,
   openSync,
@@ -520,18 +521,34 @@ function acquireQueueLock(requestsDir: string, ownerPid: number, ownerToken: str
   assertSafeWriteTarget(`${requestsDir}/.write-probe`);
   const lockFile = ".ai/harness/architecture/.architecture-queue.lock";
   assertSafeWriteTarget(lockFile);
+  const candidateToken = createHash("sha256").update(ownerToken).digest("hex").slice(0, 16);
+  const candidateFile = `${lockFile}.${ownerPid}.${candidateToken}.tmp`;
+  assertSafeWriteTarget(candidateFile);
   const deadline = Date.now() + 10_000;
   while (true) {
     try {
-      const fd = openSync(lockFile, "wx", 0o600);
+      const fd = openSync(candidateFile, "wx", 0o600);
       try {
         writeAllSync(fd, JSON.stringify({ pid: ownerPid, token: ownerToken, created_at: new Date().toISOString() }));
       } finally {
         closeSync(fd);
       }
-      return lockFile;
+      const holdBeforePublishMs = Number(process.env.REPO_HARNESS_ARCHITECTURE_HOLD_BEFORE_LOCK_PUBLISH_MS || "0");
+      if (Number.isFinite(holdBeforePublishMs) && holdBeforePublishMs > 0) {
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, holdBeforePublishMs);
+      }
+      try {
+        linkSync(candidateFile, lockFile);
+        return lockFile;
+      } catch (error: any) {
+        if (error?.code !== "EEXIST") throw error;
+      }
     } catch (error: any) {
-      if (error?.code !== "EEXIST" || !existsSync(lockFile)) throw error;
+      if (error?.code !== "EEXIST") throw error;
+    } finally {
+      rmSync(candidateFile, { force: true });
+    }
+    if (existsSync(lockFile)) {
       try {
         const owner = JSON.parse(readFileSync(lockFile, "utf8"));
         if (!processIsAlive(Number(owner.pid))) {
@@ -545,9 +562,9 @@ function acquireQueueLock(requestsDir: string, ownerPid: number, ownerToken: str
           continue;
         }
       }
-      if (Date.now() >= deadline) throw new Error(`architecture queue lock unavailable: ${lockFile}`);
-      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
     }
+    if (Date.now() >= deadline) throw new Error(`architecture queue lock unavailable: ${lockFile}`);
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
   }
 }