repo-harness 0.19.1 → 0.19.4

package/README.es.md

@@ -702,8 +702,8 @@ repositorio adopte la misma política.
 
 ## Versión actual
 
-- Paquete npm: `repo-harness@0.19.1`
-- Sello de workflow generado: `repo-harness@0.19.1+template@0.19.1`
+- Paquete npm: `repo-harness@0.19.4`
+- Sello de workflow generado: `repo-harness@0.19.4+template@0.19.4`
 - Repositorio de GitHub: `Ancienttwo/repo-harness`
 - Notas de versión e historial: [`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/README.fr.md

@@ -697,8 +697,8 @@ adopte la même policy.
 
 ## Release actuelle
 
-- Package npm : `repo-harness@0.19.1`
-- Generated workflow stamp : `repo-harness@0.19.1+template@0.19.1`
+- Package npm : `repo-harness@0.19.4`
+- Generated workflow stamp : `repo-harness@0.19.4+template@0.19.4`
 - Dépôt GitHub : `Ancienttwo/repo-harness`
 - Notes et historique de release : [`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/README.ja.md

@@ -694,8 +694,8 @@ commit script や hooks に組み込まないでください。
 
 ## 現在の Release
 
-- npm package：`repo-harness@0.19.1`
-- Generated workflow stamp：`repo-harness@0.19.1+template@0.19.1`
+- npm package：`repo-harness@0.19.4`
+- Generated workflow stamp：`repo-harness@0.19.4+template@0.19.4`
 - GitHub repository：`Ancienttwo/repo-harness`
 - Release notes and history：[`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/README.md

@@ -665,8 +665,8 @@ repo-harness commit scripts or hooks unless that repo adopts the same policy.
 
 ## Current Release
 
-- npm package: `repo-harness@0.19.1`
-- Generated workflow stamp: `repo-harness@0.19.1+template@0.19.1`
+- npm package: `repo-harness@0.19.4`
+- Generated workflow stamp: `repo-harness@0.19.4+template@0.19.4`
 - GitHub repository: `Ancienttwo/repo-harness`
 - Release notes and history: [`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/README.zh-CN.md

@@ -630,8 +630,8 @@ commit script 或 hook，除非目标仓库采用同样的 policy。
 
 ## 当前 Release
 
-- npm package：`repo-harness@0.19.1`
-- Generated workflow stamp：`repo-harness@0.19.1+template@0.19.1`
+- npm package：`repo-harness@0.19.4`
+- Generated workflow stamp：`repo-harness@0.19.4+template@0.19.4`
 - GitHub repository：`Ancienttwo/repo-harness`
 - Release notes 和 history：[`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/assets/reference-configs/external-tooling.md

@@ -637,16 +637,18 @@ mapping.
 
 | Source `model` | Codex `model` | Source `effort` | Codex `model_reasoning_effort` |
 |---|---|---|---|
-| `opus` | `gpt-5.6-terra` | `low`, `medium`, `high`, `xhigh`, `max` | same string, unchanged |
-| `sonnet`, `haiku` | `gpt-5.6-luna` | `low`, `medium`, `high`, `xhigh`, `max` | same string, unchanged |
-| `fable` | `gpt-5.6-sol` | `low`, `medium`, `high`, `xhigh`, `max` | same string, unchanged |
+| `opus` | `gpt-6-astra` | `low`, `medium`, `high`, `xhigh`, `max` | same string, unchanged |
+| `sonnet`, `haiku` | `gpt-6-luna` | `low`, `medium`, `high`, `xhigh`, `max` | same string, unchanged |
+| `fable` | `gpt-6-sol` | `low`, `medium`, `high`, `xhigh`, `max` | same string, unchanged |
 
-Three per-agent target overrides are applied after tuple validation, on top of
+Five per-agent target overrides are applied after tuple validation, on top of
 the family row above, and are the only model/effort remaps in the generator:
-`fast-worker` (`opus`/`medium`) targets `gpt-6-astra` at `low` (light) reasoning;
-`deep-worker` (`opus`/`high`) and `gatekeeper` (`opus`/`high`) both target
-`gpt-6-astra` at `medium` reasoning. Every other agent's Codex model and effort follow the family row
-unchanged.
+`fast-worker` (`opus`/`medium`) targets `gpt-6-sol` at `medium` reasoning;
+`deep-worker` (`opus`/`high`) targets `gpt-6-sol` at `xhigh` reasoning;
+`gatekeeper` (`opus`/`high`) targets `gpt-6-astra` at `medium` reasoning;
+`root-cause-prover` and `harness-evaluator` (`opus`/`high`) target `gpt-6-sol`
+at `high` reasoning.
+Every other agent's Codex model and effort follow the family row unchanged.
 
 `fast-worker`, `deep-worker`, `root-cause-prover`, and `harness-evaluator`
 receive `sandbox_mode = "workspace-write"`; every other role receives
@@ -951,9 +953,27 @@ global automatic mode does not authorize ownership adoption or semantic acceptan
 Use `repo-harness architecture-projection policy --json` to inspect the global
 source path, initialization state and effective execution settings without a
 provider process. `repo-harness architecture-projection status --json` adds the
-exact package capability handshake and project apply readiness. A repo that
-vendors a mismatching provider still fails closed; the global setting does not
-relax version or executable identity checks.
+exact package capability handshake and project apply readiness. The running
+repo-harness package owns the `archctx` executable and exact dependency version;
+its dependency tree is refreshed by the global update transaction. A target
+repository's `node_modules/archctx` never overrides that runtime dependency.
+Source-checkout execution uses that checkout's repo-harness dependencies, and
+candidate verification may explicitly select the candidate package root.
+Missing or mismatching runtime dependencies still fail closed with no target-repo
+fallback. Project model, ownership and snapshot checks remain repository-local.
+
+SessionStart also gives the Agent read-only model coverage guidance under this
+global provider setting; no per-repo execution toggle is needed. It observes empty
+capability models, missing declared module documents, and tracked package roots
+with no capability match or a shared ancestor capability. These are bounded
+inspection prompts, not inferred semantic nodes. The Agent uses the
+`repo-harness-architecture` skill to inspect source evidence and decide boundaries
+within the authorized task, then creates nodes through archctx ChangeSets and
+runs the existing projection. An intentional umbrella is valid. Hooks do not
+write model YAML, and unrelated coverage findings remain advice. The manifest
+inventory is limited to Git-tracked `package.json` paths; this is not a complete
+semantic coverage audit for every language or untracked source tree. Inspection
+errors become SessionStart provider diagnostics instead of invented model facts.
 
 When enabled, Stop observes the Git changed set and coalesces eligible paths
 into one durable projection job, excludes
@@ -989,6 +1009,27 @@ letter into its terminal job receipt, and is byte-idempotent on the same signal
 and approval reference. `status --json` reports unresolved or invalid
 acceptance evidence, and the strict architecture gate fails closed on either;
 the command never chooses or infers an architecture decision.
+
+For accepted apply, acceptance records an exact request intent before invoking
+ArchContext and the original result before running refresh actions. A retry
+with this pending evidence uses the provider's `projection-apply-readback-v1`
+capability. Readback returns the immutable committed receipt, original refresh
+signals, and a freshly verified current fixed point without changing provider
+delivery state. The same candidate, approval reference, request, and snapshot
+must still match. If the provider proves the exact request has no committed
+receipt, only an intent without a recorded result may retry apply; the provider
+checks the receipt again within its writer lock before writing. Errors and
+missing capabilities never authorize another apply.
+
+To recover an older interrupted accept that has no local intent, run
+`repo-harness architecture-projection accept --recover --signal-id <sha256> --approval-reference <original-event-id> --json`.
+This explicit command only resumes a committed apply. It fails if the provider
+has no receipt, and never creates an apply or poisons a fresh candidate with an
+unrecoverable intent. Adoption recovery is unsupported and fails closed; it is
+not converted into apply. Pending evidence remains content-bound local runtime
+state after completion; the final acceptance receipt is the resolution authority.
+The readback capability must be present in both the packaged CLI and its daemon;
+installing a new CLI alone does not upgrade a running daemon.
 If a candidate's exact reason set is only `verified-flow-proof-changed`, use
 `repo-harness architecture-projection reconcile --signal-id <sha256> --json`
 after refreshing the configured CodeGraph index. Reconciliation runs the same

package/assets/skill-commands/repo-harness-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: repo-harness-architecture
-description: Resolves repo-harness architecture drift requests and updates architecture docs or diagrams without running full init, migrate, or upgrade.
-when_to_use: "repo-harness-architecture, architecture drift, architecture doc, architecture diagram, update architecture index, resolve architecture request"
+description: Handles architecture coverage guidance, capability registration and drift requests through the existing model and projection authorities.
+when_to_use: "repo-harness-architecture, architecture drift, architecture doc, architecture diagram, architecture model guidance, register capability, update architecture index, resolve architecture request"
 ---
 
 # repo-harness-architecture
@@ -12,7 +12,7 @@ architecture documentation, drift-request, or diagram pass.
 ## Protocol
 
 1. Confirm the target repo path and architecture scope.
-2. Inspect `docs/architecture/index.md` and pending files under `docs/architecture/requests/`.
+2. Inspect `docs/architecture/index.md`, `.archcontext/model/nodes/`, and pending files under `docs/architecture/requests/`. For architecture model guidance or a registration scope, follow the coverage procedure below even when no drift request exists.
 3. When the scope maps to repo code or config, resolve the capability with:
    - `repo-harness run capability-resolver match --repo <repo> --path <path> --format json`
 4. Update the smallest relevant architecture artifact:
@@ -28,9 +28,58 @@ architecture documentation, drift-request, or diagram pass.
    - `repo-harness run capability-resolver validate --repo <repo> --format text`
    - `repo-harness run check-task-workflow --strict` when repo workflow surfaces changed
 
+## Coverage and Agent-owned registration
+
+SessionStart automatically supplies read-only coverage observations when the global
+architecture provider is enabled and the repo selects `capability_source: archcontext`.
+An empty model, missing module docs, unmatched tracked package roots, or multiple
+packages sharing an ancestor capability are reasons to inspect, not proof that a new
+capability is required. Hooks do not decide responsibilities or write nodes.
+
+1. Read the existing semantic architecture docs and trace the relevant entrypoints,
+   dependencies, ownership and verification in source. Use CodeGraph when indexed.
+   Compare `repo-harness run capability-resolver list --format json` and
+   `repo-harness run capability-resolver match --path <source-path> --format json`.
+   Package layout is inventory evidence; it does not establish semantic boundaries.
+2. Give a concrete recommendation: retain an intentional umbrella, create a justified
+   capability, or restore a missing projection. Include source evidence, responsibility,
+   proposed prefixes, overlap with existing nodes, contract paths and verification.
+   Within already authorized architecture work, the Agent may decide and execute;
+   do not ask for the same approval again. During unrelated work, keep this as advice.
+3. For a new capability, author a complete `archcontext.node/v2` body with an
+   `id` of `capability.<domain>.<name>`, `kind: capability`, `status: active`, `name`,
+   `summary`, `responsibilities`, `source.include`, and `extensions` containing
+   `contractFiles.agents`, `contractFiles.claude`, `lspProfile`, and `verification`.
+   Use the current model schema and source evidence; do not copy an example's semantics.
+4. Resolve the owned archctx executable from
+   `repo-harness architecture-projection status --json` (`projectionProvider.binaryPath`).
+   Require ready status and use that binary with its supported Node runtime in the
+   target repo. Do not install a repo-local archctx or select an unrelated PATH copy.
+   The following `archctx` notation means that resolved executable:
+
+   ```text
+   archctx plan --id <unique-changeset-id> --path .archcontext/model/nodes/capability.<domain>.<name>.yaml --expected-hash missing --body <complete-YAML-as-one-argument> --format json
+   archctx apply --id <same-changeset-id> --approved --expected-worktree-digest <data.draft.base.worktreeDigest-from-plan> --format json
+   ```
+
+   Inspect the plan's full draft and preview before applying. Keep the same daemon
+   and ChangeSet ID; pass body via a structured process argument, not shell interpolation.
+   `--approved` records the authorized Agent decision; it does not grant extra scope.
+   If the worktree changed, re-plan and re-inspect. In archctx 0.5.10 this public `plan`
+   route creates one entity only. It is not an update route: when an existing node must
+   change, report the required update and use a supported typed ChangeSet authoring
+   surface if available; do not overwrite YAML or disguise an update as creation.
+5. Run `archctx validate --format json`, verify source matching with capability-resolver,
+   then `repo-harness architecture-projection plan --json --changed-path <node-path>`
+   and `repo-harness architecture-projection apply --json --changed-path <node-path>`.
+   Verify the expected module document exists and run the protocol's architecture checks.
+   Missing docs for an unchanged node need projection, not a duplicate node. Generated
+   module regions belong to archctx; preserve human-owned prose. Resolve any resulting
+   drift request through the normal request protocol.
+
 ## Failure Modes
 
-- If no pending architecture request exists, report `no-change` and do not invent one.
+- If no pending architecture request exists, do not invent one. Coverage and registration work can proceed independently; report `no-change` only after inspecting the requested coverage scope.
 - If capability resolution is ambiguous, stop at the matching paths and ask for a narrower scope.
 - If `check-architecture-sync.sh` blocks in strict mode, resolve or archive the pending request card for the touched capability before finishing the worktree.
 - If diagram validation fails, fix the Mermaid Markdown source or report the validation failure; do not substitute HTML.

package/assets/skill-version.json

@@ -1,6 +1,6 @@
 {
-  "version": "0.19.1",
-  "templateVersion": "0.19.1",
+  "version": "0.19.4",
+  "templateVersion": "0.19.4",
   "skillName": "repo-harness",
   "contractId": "tasks-first-harness-v1",
   "compatibility": {

package/assets/templates/helpers/architecture-event.ts

@@ -713,9 +713,7 @@ function renderRequiredFollowUp(event: ArchitectureEvent): string {
 
 function renderRequestCard(event: ArchitectureEvent, events: ArchitectureEvent[], existingMetadata: Record<string, string>): string {
   const firstDetected =
-    existingMetadata.Detected ||
-    events
-      .map((entry) => entry.ts || "")
+    [existingMetadata.Detected, ...events.map((entry) => entry.ts || "")]
       .filter(Boolean)
       .sort()[0] ||
     event.ts ||

package/assets/templates/helpers/archive-workflow.sh

@@ -491,6 +491,9 @@ rewrite_archive_projection_file() {
     awk \
       -v source_path="${archive_projection_sources[$index]}" \
       -v destination_path="${archive_projection_destinations[$index]}" '
+      # Executable acceptance criteria are frozen authority, not navigation.
+      /^## / { verification_plan = ($0 ~ /^## Verification Plan[[:space:]]*$/) }
+      verification_plan { print; next }
       {
         remaining = $0
         rendered = ""

package/assets/templates/helpers/check-task-sync.sh

@@ -356,6 +356,11 @@ for file in "${changed_files[@]}"; do
 done
 if ! workflow_profile="$("${repo_harness_cli[@]}" state resolve --json --field workflow_profile --target-path "${profile_paths[@]}")"; then
   echo "[task-sync] Workflow profile resolution failed; no lite exemption admitted." >&2
+  # Failed verification can itself block state resolution. Keep the failure,
+  # but expose the exact binding consumed above so recovery needs no cache reset
+  # or trust in a blocked resolver's profile field.
+  echo "[task-sync] To satisfy task-sync, record the current diff in a changed canonical workflow artifact with this exact line:" >&2
+  printf '> **Substantive Change SHA256**: `%s`\n' "$substantive_digest" >&2
   exit 1
 fi
 case "$workflow_profile" in

package/assets/templates/helpers/ensure-task-workflow.sh

@@ -1016,8 +1016,8 @@ ARCHITECTURE_INDEX_EOF
     "provider": "archctx",
     "proposal_author": "local",
     "stages": {
-      "scan": { "provider_version": "0.5.10", "required_features": ["module-statistics-v1", "refactor-assessment-v1", "recommendation-v3"] },
-      "verify": { "provider_version": "0.5.10", "required_features": ["refactor-resolution-v1"] }
+      "scan": { "provider_version": "0.5.13", "required_features": ["module-statistics-v1", "refactor-assessment-v1", "recommendation-v3"] },
+      "verify": { "provider_version": "0.5.13", "required_features": ["refactor-resolution-v1"] }
     },
     "workflow_routing": {
       "module_refactor": "work_package",

package/assets/templates/helpers/heartbeat-triage.sh

@@ -179,7 +179,7 @@ run_workflow_check() {
   if [[ "$status" -eq 0 ]]; then
     add_entry "workflow-check" "pass" "check-task-workflow.sh --strict passed" "$output"
   else
-    summary="$(printf '%s\n' "$output" | first_line)"
+    summary="$(first_line <<<"$output")"
     add_entry "workflow-check" "fail" "${summary:-check-task-workflow.sh --strict failed}" "$output"
   fi
 }

package/assets/templates/helpers/install-agent-fleet.sh

@@ -16,8 +16,14 @@ bun_version_is_supported() {
 
 RUNTIME_BIN=""
 BUN_VERSION=""
-PATH_BUN="$(command -v bun 2>/dev/null || true)"
-for candidate in "$PATH_BUN" "${HOME}/.bun/bin/bun"; do
+# A caller that already validated its Bun hands it over explicitly; only a
+# standalone invocation discovers Bun by name.
+if [[ -n "${REPO_HARNESS_BUN_BIN:-}" ]]; then
+  BUN_CANDIDATES=("$REPO_HARNESS_BUN_BIN")
+else
+  BUN_CANDIDATES=("$(command -v bun 2>/dev/null || true)" "${HOME}/.bun/bin/bun")
+fi
+for candidate in "${BUN_CANDIDATES[@]}"; do
   [[ -n "$candidate" && -x "$candidate" ]] || continue
   candidate_version="$("$candidate" --version 2>/dev/null || true)"
   [[ -n "$BUN_VERSION" ]] || BUN_VERSION="$candidate_version"
@@ -136,19 +142,21 @@ function buildFamilyEffortMap(sourceLabel, targetModel, targetLabel) {
 }
 
 const MODEL_EFFORT_MAP = {
-  opus: buildFamilyEffortMap("Opus", "gpt-5.6-terra", "GPT-5.6 Terra"),
-  sonnet: buildFamilyEffortMap("Sonnet", "gpt-5.6-luna", "GPT-5.6 Luna"),
-  haiku: buildFamilyEffortMap("Haiku", "gpt-5.6-luna", "GPT-5.6 Luna"),
-  fable: buildFamilyEffortMap("Fable", "gpt-5.6-sol", "GPT-5.6 Sol"),
+  opus: buildFamilyEffortMap("Opus", "gpt-6-astra", "GPT-6 Astra"),
+  sonnet: buildFamilyEffortMap("Sonnet", "gpt-6-luna", "GPT-6 Luna"),
+  haiku: buildFamilyEffortMap("Haiku", "gpt-6-luna", "GPT-6 Luna"),
+  fable: buildFamilyEffortMap("Fable", "gpt-6-sol", "GPT-6 Sol"),
 };
 
 // Per-agent Codex target overrides — the only model/effort remaps in the fleet.
-// fast-worker targets Astra at low reasoning; deep-worker and gatekeeper
-// target Astra at medium. Everything else follows the family default.
+// Execution and diagnostic roles use Sol or Luna; the gatekeeper uses Astra.
+// Explorer and deep-reasoner follow the family default.
 const AGENT_TARGET_OVERRIDES = {
-  "fast-worker": { model: "gpt-6-astra", effort: "low", targetDescription: "GPT-6 Astra at low reasoning" },
-  "deep-worker": { model: "gpt-6-astra", effort: "medium", targetDescription: "GPT-6 Astra at medium reasoning" },
+  "fast-worker": { model: "gpt-6-sol", effort: "medium", targetDescription: "GPT-6 Sol at medium reasoning" },
+  "deep-worker": { model: "gpt-6-sol", effort: "xhigh", targetDescription: "GPT-6 Sol at xhigh reasoning" },
   gatekeeper: { model: "gpt-6-astra", effort: "medium", targetDescription: "GPT-6 Astra at medium reasoning" },
+  "root-cause-prover": { model: "gpt-6-sol", effort: "high", targetDescription: "GPT-6 Sol at high reasoning" },
+  "harness-evaluator": { model: "gpt-6-sol", effort: "high", targetDescription: "GPT-6 Sol at high reasoning" },
 };
 
 function readSource(agent) {

package/assets/templates/helpers/sprint-backlog.sh

@@ -486,7 +486,7 @@ backlog_counts() {
 
 next_pending_row() {
   local file="$1"
-  backlog_rows "$file" | awk -F '\t' '$2 == "[ ]" { print; exit }'
+  backlog_rows "$file" | awk -F '\t' '!found && $2 == "[ ]" { print; found = 1 }'
 }
 
 # Mint one persisted task id: 32 random bytes rendered as lowercase hex. A task
@@ -1043,7 +1043,7 @@ cmd_start_task() {
     echo "sprint-backlog: task reference '$task_ref' is ambiguous (${match_count} backlog rows match); fix duplicate indices or task names first" >&2
     exit 1
   fi
-  target_row="$(backlog_rows "$sprint_file" | TASK_REF="$task_ref" awk -F '\t' '$1 == ENVIRON["TASK_REF"] || $3 == ENVIRON["TASK_REF"] { print; exit }')"
+  target_row="$(backlog_rows "$sprint_file" | TASK_REF="$task_ref" awk -F '\t' '!found && ($1 == ENVIRON["TASK_REF"] || $3 == ENVIRON["TASK_REF"]) { print; found = 1 }')"
 
   local target_index target_status target_task target_mode target_acceptance
   target_index="$(printf '%s' "$target_row" | cut -f1)"