token-harness 0.1.2 → 0.1.3

package/token-harness.mjs

@@ -97,18 +97,18 @@ function compareVersions(a, b) {
   return comparePrerelease(a.prerelease, b.prerelease);
 }
 function classifyVersion(observed, range) {
-  const version2 = parseSemanticVersion(observed);
+  const version3 = parseSemanticVersion(observed);
   const minimum = parseSemanticVersion(range.minimum);
-  if (version2 === null || minimum === null)
+  if (version3 === null || minimum === null)
     return "unparseable";
-  if (compareVersions(version2, minimum) < 0)
+  if (compareVersions(version3, minimum) < 0)
     return "below-range";
   if (range.maximum === null)
     return "in-range";
   const maximum = parseSemanticVersion(range.maximum);
   if (maximum === null)
     return "unparseable";
-  return compareVersions(version2, maximum) > 0 ? "unknown-newer" : "in-range";
+  return compareVersions(version3, maximum) > 0 ? "unknown-newer" : "in-range";
 }
 
 // packages/core/dist/src/domain/compatibility-rows.js
@@ -134,6 +134,19 @@ var COMPATIBILITY_ROWS = [
     configSchema: "claude-skills-directory",
     fixture: "tests/fixtures/rows/harnesstrim-claude-windows",
     verificationTier: "config-only"
+  },
+  {
+    harness: "codex",
+    harnessVersion: { minimum: "0.146.0", maximum: "0.146.0" },
+    provider: "harnesstrim",
+    providerVersion: "0.1.0",
+    platform: { os: "windows", wsl: false, supported: true, limitation: null },
+    // The same shape as the Claude skills row, and for the same reason: the install writes skill
+    // files rather than a document this build parses, so the schema it depends on is the directory
+    // layout. A separate id because the directory is `.codex/skills` and the protected paths differ.
+    configSchema: "codex-skills-directory",
+    fixture: "tests/fixtures/rows/harnesstrim-codex-windows",
+    verificationTier: "config-only"
   }
 ];
 function classifyRowHarnessVersion(rows, observed) {
@@ -695,14 +708,14 @@ function resolveOwnership(input) {
             });
             continue;
           }
-          if (!provider.assignable) {
+          if (!provider.assignableHarnesses.has(harness.id)) {
             const observed = input.observedVersions[provider.id] ?? null;
             exclusions.push({
               scope,
               excluded: provider.id,
               retained: null,
               reason: [
-                observed === null ? `${provider.id} implements ${capability} but no installer state this build could observe produces it in isolation` : `${provider.id} ${observed} implements ${capability} but no installer state at that version produces it in isolation`,
+                observed === null ? `${provider.id} implements ${capability} on ${harness.id} but no installer state this build could observe produces it there` : `${provider.id} ${observed} implements ${capability} on ${harness.id} but no installer state at that version produces it there`,
                 "RFC 0003: a capability the provider has but cannot be asked for is not an assignable capability",
                 "It is still detected, adopted, reconciled against the owner, and measured"
               ]
@@ -1026,21 +1039,21 @@ function validateStoredPlan(input) {
       detail: `the plan was computed for ${stored.projectRoot} and this invocation is in ${input.projectRoot}`
     });
   }
-  for (const [id, version2] of Object.entries(stored.versions.providers)) {
+  for (const [id, version3] of Object.entries(stored.versions.providers)) {
     const current = input.versions.providers[id];
-    if (current !== version2) {
+    if (current !== version3) {
       rejections.push({
         reason: "plan-version-drift",
-        detail: `${id} was ${version2 ?? "absent"} when the plan was made and is now ${current ?? "absent"}`
+        detail: `${id} was ${version3 ?? "absent"} when the plan was made and is now ${current ?? "absent"}`
       });
     }
   }
-  for (const [id, version2] of Object.entries(stored.versions.harnesses)) {
+  for (const [id, version3] of Object.entries(stored.versions.harnesses)) {
     const current = input.versions.harnesses[id];
-    if (current !== version2) {
+    if (current !== version3) {
       rejections.push({
         reason: "plan-version-drift",
-        detail: `${id} was ${version2 ?? "absent"} when the plan was made and is now ${current ?? "absent"}`
+        detail: `${id} was ${version3 ?? "absent"} when the plan was made and is now ${current ?? "absent"}`
       });
     }
   }
@@ -1327,7 +1340,7 @@ function resolveMetricsWindow(input) {
 var INSTALL_COMMANDS = {
   winget: {
     executable: "winget",
-    args: (packageName, version2) => [
+    args: (packageName, version3) => [
       "install",
       "--id",
       packageName,
@@ -1337,16 +1350,16 @@ var INSTALL_COMMANDS = {
       "--silent",
       "--accept-package-agreements",
       "--accept-source-agreements",
-      ...version2 === null ? [] : ["--version", version2]
+      ...version3 === null ? [] : ["--version", version3]
     ],
     verified: true
   },
   cargo: {
     executable: "cargo",
-    args: (packageName, version2) => [
+    args: (packageName, version3) => [
       "install",
       packageName,
-      ...version2 === null ? [] : ["--version", version2]
+      ...version3 === null ? [] : ["--version", version3]
     ],
     verified: false
   }
@@ -1464,8 +1477,8 @@ async function queryAvailableVersion(input) {
     }));
     return { status: "failed", version: null, destination, diagnostics };
   }
-  const version2 = recipe.parse(outcome2.stdout);
-  if (version2 === null) {
+  const version3 = recipe.parse(outcome2.stdout);
+  if (version3 === null) {
     diagnostics.push(diagnostic({
       severity: "warning",
       code: "version-query-unreadable",
@@ -1474,7 +1487,7 @@ async function queryAvailableVersion(input) {
     }));
     return { status: "unknown", version: null, destination, diagnostics };
   }
-  return { status: "found", version: version2, destination, diagnostics };
+  return { status: "found", version: version3, destination, diagnostics };
 }
 var INVENTORY_COMMANDS = {
   /**
@@ -3133,10 +3146,10 @@ function parsePins(raw, path, diagnostics) {
     if (typeof entry !== "object" || entry === null)
       continue;
     const provider = entry.provider;
-    const version2 = entry.version;
+    const version3 = entry.version;
     if (typeof provider !== "string" || provider === "")
       continue;
-    if (typeof version2 !== "string" || parseSemanticVersion(version2) === null) {
+    if (typeof version3 !== "string" || parseSemanticVersion(version3) === null) {
       diagnostics.push(diagnostic({
         severity: "warning",
         code: "pin-version-unparseable",
@@ -3145,7 +3158,7 @@ function parsePins(raw, path, diagnostics) {
       }));
       continue;
     }
-    pins.push({ provider, version: version2 });
+    pins.push({ provider, version: version3 });
   }
   return pins;
 }
@@ -5053,8 +5066,8 @@ async function detectVersion2(context) {
     };
   }
   const matched = VERSION_PATTERN.exec(outcome2.stdout);
-  const version2 = matched?.[1] ?? null;
-  if (version2 === null) {
+  const version3 = matched?.[1] ?? null;
+  if (version3 === null) {
     return {
       version: null,
       verdict: null,
@@ -5068,14 +5081,14 @@ async function detectVersion2(context) {
     };
   }
   return {
-    version: version2,
-    verdict: classifyVersion(version2, MANIFEST.testedVersions),
+    version: version3,
+    verdict: classifyVersion(version3, MANIFEST.testedVersions),
     evidence: [
       evidence({
         kind: "version-output",
         source: command.executable,
         path: outcome2.executablePath,
-        detail: `reported ${version2}`
+        detail: `reported ${version3}`
       })
     ]
   };
@@ -5083,7 +5096,7 @@ async function detectVersion2(context) {
 async function detect(context) {
   const evidenceItems = [];
   const warnings = [];
-  const { version: version2, verdict, evidence: versionEvidence } = await detectVersion2(context);
+  const { version: version3, verdict, evidence: versionEvidence } = await detectVersion2(context);
   evidenceItems.push(...versionEvidence);
   const configs = await Promise.all(MANIFEST.configFiles.map((declaration) => resolveConfig(declaration, context)));
   const present = configs.filter((config) => config.exists);
@@ -5106,7 +5119,7 @@ async function detect(context) {
       remediation: "Repair the JSON syntax, then run the command again"
     }));
   }
-  if (version2 === null && present.length > 0) {
+  if (version3 === null && present.length > 0) {
     warnings.push(diagnostic({
       severity: "warning",
       code: "harness-executable-missing",
@@ -5119,16 +5132,16 @@ async function detect(context) {
     warnings.push(diagnostic({
       severity: "warning",
       code: "harness-version-unknown-newer",
-      message: `Claude Code ${String(version2)} is newer than the versions whose configuration schema Token Harness has observed (up to ${String(MANIFEST.testedVersions.maximum)})`,
+      message: `Claude Code ${String(version3)} is newer than the versions whose configuration schema Token Harness has observed (up to ${String(MANIFEST.testedVersions.maximum)})`,
       remediation: "Check the release notes for hook-schema changes before applying a plan"
     }));
   }
-  const state = unparsed.length > 0 ? "broken" : configured.length > 0 && version2 !== null ? "configured" : version2 !== null || present.length > 0 ? "detected" : "absent";
+  const state = unparsed.length > 0 ? "broken" : configured.length > 0 && version3 !== null ? "configured" : version3 !== null || present.length > 0 ? "detected" : "absent";
   const primary = present.find((config) => config.declaration.primary) ?? present[0] ?? null;
   return {
     harnessId: CLAUDE,
     state,
-    version: version2,
+    version: version3,
     versionVerdict: verdict,
     configPath: primary?.path ?? null,
     declaredVerificationTier: MANIFEST.verificationTier,
@@ -5382,22 +5395,22 @@ async function detectVersion3(context) {
         })
       ]
     };
-  const version2 = VERSION_PATTERN2.exec(outcome2.stdout)?.[1] ?? null;
+  const version3 = VERSION_PATTERN2.exec(outcome2.stdout)?.[1] ?? null;
   return {
-    version: version2,
-    verdict: version2 === null ? null : classifyVersion(version2, MANIFEST2.testedVersions),
+    version: version3,
+    verdict: version3 === null ? null : classifyVersion(version3, MANIFEST2.testedVersions),
     evidence: [
       evidence({
         kind: "version-output",
         source: "codex",
         path: outcome2.executablePath,
-        detail: version2 === null ? "reported no recognisable semantic version" : `reported ${version2}`
+        detail: version3 === null ? "reported no recognisable semantic version" : `reported ${version3}`
       })
     ]
   };
 }
 async function detect2(context) {
-  const { version: version2, verdict, evidence: versionEvidence } = await detectVersion3(context);
+  const { version: version3, verdict, evidence: versionEvidence } = await detectVersion3(context);
   const configs = await Promise.all(MANIFEST2.configFiles.map((file) => resolveConfig2(file, context)));
   const present = configs.filter((config) => config.exists);
   const hooks = configs.find((config) => config.declaration.path.endsWith("hooks.json"));
@@ -5410,7 +5423,7 @@ async function detect2(context) {
       path: hooks.path,
       remediation: "Repair the JSON syntax, then run the command again"
     }));
-  if (version2 === null && present.length > 0)
+  if (version3 === null && present.length > 0)
     warnings.push(diagnostic({
       severity: "warning",
       code: "harness-executable-missing",
@@ -5422,15 +5435,15 @@ async function detect2(context) {
     warnings.push(diagnostic({
       severity: "warning",
       code: "harness-version-unknown-newer",
-      message: `Codex ${String(version2)} is newer than the observed hook schema`,
+      message: `Codex ${String(version3)} is newer than the observed hook schema`,
       remediation: "Check the release notes for hook-schema changes before applying a plan"
     }));
   const configured = (hooks?.configuredPoints.length ?? 0) > 0;
   const primary = configs.find((config) => config.declaration.primary && config.exists) ?? present[0] ?? null;
   return {
     harnessId: CODEX,
-    state: hooks?.exists && !hooks.parsed ? "broken" : configured && version2 !== null ? "configured" : version2 !== null || present.length > 0 ? "detected" : "absent",
-    version: version2,
+    state: hooks?.exists && !hooks.parsed ? "broken" : configured && version3 !== null ? "configured" : version3 !== null || present.length > 0 ? "detected" : "absent",
+    version: version3,
     versionVerdict: verdict,
     configPath: primary?.path ?? null,
     declaredVerificationTier: MANIFEST2.verificationTier,
@@ -5547,10 +5560,231 @@ async function verify2(context) {
 }
 var codexAdapter = { manifest: MANIFEST2, detect: detect2, inspect: inspect2, verify: verify2 };
 
-// packages/adapters/dist/src/harnesses/opencode.js
-var OPENCODE = harnessId("opencode");
+// packages/adapters/dist/src/harnesses/hermes.js
+var HERMES = harnessId("hermes");
 var VERSION_PATTERN3 = /(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/;
+var PLUGIN = "harnesstrim";
 var MANIFEST3 = {
+  schemaVersion: MANIFEST_SCHEMA_VERSION,
+  id: HERMES,
+  displayName: "Hermes Agent",
+  homepage: "https://hermes-agent.nousresearch.com/docs/",
+  testedVersions: { minimum: "0.1.0", maximum: "0.1.0" },
+  verificationTier: "config-only",
+  versionCommand: { executable: "hermes", args: ["--version"] },
+  interceptionPoints: [{ scopeId: "transform-tool-result", eventName: "transform_tool_result" }],
+  configFiles: [
+    {
+      path: ".hermes/plugins/harnesstrim/plugin.yaml",
+      scope: "user",
+      parser: "markers",
+      primary: true
+    },
+    {
+      path: ".hermes/plugins/harnesstrim/config.json",
+      scope: "user",
+      parser: "json",
+      primary: false
+    }
+  ],
+  toolFamilies: [
+    { id: "tool.result", platforms: ["windows", "macos", "linux"], executesShellCommands: false }
+  ],
+  requiresEnablement: true,
+  enablementNote: "The plugin must be enabled with `hermes plugins enable harnesstrim`.",
+  receiptFamily: "provider-telemetry"
+};
+async function resolveConfig3(declaration, context) {
+  const path = resolveConfigPath(declaration, context);
+  const stat3 = await context.fs.stat(path);
+  if (stat3 === null || stat3.kind !== "file") {
+    return {
+      declaration,
+      path,
+      exists: false,
+      parsed: false,
+      configuredPoints: [],
+      matchers: [],
+      commands: []
+    };
+  }
+  const text = new TextDecoder().decode(await context.fs.readFile(path));
+  const parsed = declaration.parser === "json" ? (() => {
+    try {
+      return JSON.parse(text);
+    } catch {
+      return null;
+    }
+  })() : text;
+  const valid = parsed !== null;
+  return {
+    declaration,
+    path,
+    exists: true,
+    parsed: valid,
+    configuredPoints: valid && declaration.path.endsWith("plugin.yaml") ? ["transform-tool-result"] : [],
+    matchers: valid && declaration.path.endsWith("plugin.yaml") ? ["tool.result"] : [],
+    commands: valid && declaration.path.endsWith("plugin.yaml") ? ["hermes plugins enable harnesstrim"] : []
+  };
+}
+async function version2(context) {
+  const result = await context.runner.run({
+    executable: "hermes",
+    args: ["--version"],
+    cwd: context.projectRoot,
+    timeoutMs: 2e4
+  });
+  if (result.failure !== null)
+    return {
+      value: null,
+      verdict: null,
+      evidence: [
+        evidence({
+          kind: "absence",
+          source: "hermes",
+          detail: `not runnable: ${result.failure.reason}`
+        })
+      ]
+    };
+  const value = VERSION_PATTERN3.exec(result.stdout)?.[1] ?? null;
+  return {
+    value,
+    verdict: value === null ? null : classifyVersion(value, MANIFEST3.testedVersions),
+    evidence: [
+      evidence({
+        kind: "version-output",
+        source: "hermes",
+        path: result.executablePath,
+        detail: value ? `reported ${value}` : "reported no recognisable version"
+      })
+    ]
+  };
+}
+async function enabled(context) {
+  const result = await context.runner.run({
+    executable: "hermes",
+    args: ["plugins", "list"],
+    cwd: context.projectRoot,
+    timeoutMs: 2e4
+  });
+  if (result.failure !== null || result.exitCode !== 0)
+    return null;
+  const line = result.stdout.split("\n").find((entry) => entry.toLowerCase().includes(PLUGIN));
+  return line === void 0 ? false : /enabled/i.test(line);
+}
+async function detect3(context) {
+  const observed = await version2(context);
+  const configs = await Promise.all(MANIFEST3.configFiles.map((file) => resolveConfig3(file, context)));
+  const plugin = configs.find((file) => file.declaration.path.endsWith("plugin.yaml"));
+  const isEnabled = await enabled(context);
+  const warnings = [];
+  if (observed.verdict === "unknown-newer")
+    warnings.push(diagnostic({
+      severity: "warning",
+      code: "harness-version-unknown-newer",
+      message: `Hermes ${observed.value} is newer than the observed plugin contract`,
+      remediation: "Review the transform_tool_result plugin contract before applying changes"
+    }));
+  if (plugin?.exists && isEnabled === false)
+    warnings.push(diagnostic({
+      severity: "warning",
+      code: "plugin-disabled",
+      message: "HarnessTrim is installed in Hermes but is not enabled",
+      path: plugin.path,
+      remediation: "Run `hermes plugins enable harnesstrim`"
+    }));
+  const present = plugin?.exists === true;
+  return {
+    harnessId: HERMES,
+    state: present && isEnabled === true && observed.value !== null ? "configured" : present || observed.value !== null ? "detected" : "absent",
+    version: observed.value,
+    versionVerdict: observed.verdict,
+    configPath: plugin?.path ?? null,
+    declaredVerificationTier: MANIFEST3.verificationTier,
+    evidence: [
+      ...observed.evidence,
+      ...plugin ? [
+        evidence({
+          kind: "config-entry",
+          source: "Hermes plugin directory",
+          path: plugin.path,
+          detail: plugin.exists ? "HarnessTrim plugin manifest present" : "plugin manifest absent"
+        })
+      ] : []
+    ],
+    warnings
+  };
+}
+async function inspect3(context) {
+  const configs = await Promise.all(MANIFEST3.configFiles.map((file) => resolveConfig3(file, context)));
+  return {
+    harnessId: HERMES,
+    configs,
+    activeToolFamilies: familiesOnThisPlatform(MANIFEST3, context.facts),
+    uncoveredToolFamilies: [],
+    enabled: await enabled(context),
+    diagnostics: [],
+    summaries: configs.filter((config) => config.configuredPoints.length > 0).map((config) => ({
+      harnessId: HERMES,
+      configPath: config.path,
+      scope: config.declaration.scope,
+      interceptionPoints: config.configuredPoints,
+      matchers: config.matchers,
+      commands: config.commands
+    }))
+  };
+}
+async function verify3(context) {
+  const detection = await detect3(context);
+  const inspection = await inspect3(context);
+  const plugin = inspection.configs.some((config) => config.configuredPoints.length > 0);
+  const checks = [
+    {
+      id: "executable-resolves",
+      status: detection.version === null ? "fail" : "pass",
+      summary: detection.version === null ? "hermes could not be run" : `Hermes ${detection.version}`,
+      achievedTier: detection.version === null ? null : "presence",
+      evidence: detection.evidence.filter((item) => item.kind === "version-output"),
+      remediation: detection.version === null ? "Install Hermes or add it to PATH" : null
+    },
+    {
+      id: "plugin-installed",
+      status: plugin ? "pass" : "fail",
+      summary: plugin ? "HarnessTrim plugin manifest is installed" : "HarnessTrim plugin manifest is missing",
+      achievedTier: plugin ? "config-only" : null,
+      evidence: [],
+      remediation: plugin ? null : "Run `harnesstrim install hermes --apply`"
+    },
+    {
+      id: "plugin-enabled",
+      status: inspection.enabled === true ? "pass" : inspection.enabled === false ? "fail" : "not-exercised",
+      summary: inspection.enabled === true ? "HarnessTrim is enabled" : inspection.enabled === false ? "HarnessTrim is installed but disabled" : "Hermes plugin state could not be read",
+      achievedTier: inspection.enabled === true ? "config-only" : null,
+      evidence: [],
+      remediation: inspection.enabled === false ? "Run `hermes plugins enable harnesstrim`" : null
+    },
+    {
+      id: "canary-intercepted",
+      status: "not-exercised",
+      summary: "Hermes exposes no independent receipt; HarnessTrim telemetry is verified by the provider adapter",
+      achievedTier: null,
+      evidence: [],
+      remediation: null
+    }
+  ];
+  return {
+    harnessId: HERMES,
+    declaredTier: MANIFEST3.verificationTier,
+    achievedTier: checks.some((check) => check.achievedTier === "config-only") ? "config-only" : checks.some((check) => check.achievedTier === "presence") ? "presence" : null,
+    checks
+  };
+}
+var hermesAdapter = { manifest: MANIFEST3, detect: detect3, inspect: inspect3, verify: verify3 };
+
+// packages/adapters/dist/src/harnesses/opencode.js
+var OPENCODE = harnessId("opencode");
+var VERSION_PATTERN4 = /(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/;
+var MANIFEST4 = {
   schemaVersion: MANIFEST_SCHEMA_VERSION,
   id: OPENCODE,
   displayName: "OpenCode",
@@ -5650,7 +5884,7 @@ async function resolvePluginDirectory(declaration, context) {
     commands: modules.map((entry) => context.fs.join(path, entry))
   };
 }
-async function resolveConfig3(declaration, context) {
+async function resolveConfig4(declaration, context) {
   if (declaration.parser === "markers")
     return resolvePluginDirectory(declaration, context);
   const path = resolveConfigPath(declaration, context);
@@ -5711,23 +5945,23 @@ async function detectVersion4(context) {
         })
       ]
     };
-  const version2 = VERSION_PATTERN3.exec(outcome2.stdout)?.[1] ?? null;
+  const version3 = VERSION_PATTERN4.exec(outcome2.stdout)?.[1] ?? null;
   return {
-    version: version2,
-    verdict: version2 === null ? null : classifyVersion(version2, MANIFEST3.testedVersions),
+    version: version3,
+    verdict: version3 === null ? null : classifyVersion(version3, MANIFEST4.testedVersions),
     evidence: [
       evidence({
         kind: "version-output",
         source: "opencode",
         path: outcome2.executablePath,
-        detail: version2 === null ? "reported no recognisable semantic version" : `reported ${version2}`
+        detail: version3 === null ? "reported no recognisable semantic version" : `reported ${version3}`
       })
     ]
   };
 }
-async function detect3(context) {
-  const { version: version2, verdict, evidence: versionEvidence } = await detectVersion4(context);
-  const configs = await Promise.all(MANIFEST3.configFiles.map((file) => resolveConfig3(file, context)));
+async function detect4(context) {
+  const { version: version3, verdict, evidence: versionEvidence } = await detectVersion4(context);
+  const configs = await Promise.all(MANIFEST4.configFiles.map((file) => resolveConfig4(file, context)));
   const present = configs.filter((config) => config.exists);
   const configured = present.filter((config) => config.configuredPoints.length > 0);
   const warnings = [];
@@ -5743,17 +5977,17 @@ async function detect3(context) {
     warnings.push(diagnostic({
       severity: "warning",
       code: "harness-version-unknown-newer",
-      message: `OpenCode ${String(version2)} is newer than the observed configuration schema`,
+      message: `OpenCode ${String(version3)} is newer than the observed configuration schema`,
       remediation: "Check the release notes for plugin-schema changes before applying a plan"
     }));
   const primary = present.find((config) => config.declaration.primary) ?? present[0] ?? null;
   return {
     harnessId: OPENCODE,
-    state: present.some((config) => !config.parsed) ? "broken" : configured.length > 0 && version2 !== null ? "configured" : version2 !== null || present.length > 0 ? "detected" : "absent",
-    version: version2,
+    state: present.some((config) => !config.parsed) ? "broken" : configured.length > 0 && version3 !== null ? "configured" : version3 !== null || present.length > 0 ? "detected" : "absent",
+    version: version3,
     versionVerdict: verdict,
     configPath: primary?.path ?? null,
-    declaredVerificationTier: MANIFEST3.verificationTier,
+    declaredVerificationTier: MANIFEST4.verificationTier,
     evidence: [
       ...versionEvidence,
       ...present.map((config) => evidence({
@@ -5766,9 +6000,9 @@ async function detect3(context) {
     warnings
   };
 }
-async function inspect3(context) {
-  const configs = await Promise.all(MANIFEST3.configFiles.map((file) => resolveConfig3(file, context)));
-  const activeToolFamilies = familiesOnThisPlatform(MANIFEST3, context.facts);
+async function inspect4(context) {
+  const configs = await Promise.all(MANIFEST4.configFiles.map((file) => resolveConfig4(file, context)));
+  const activeToolFamilies = familiesOnThisPlatform(MANIFEST4, context.facts);
   return {
     harnessId: OPENCODE,
     configs,
@@ -5786,9 +6020,9 @@ async function inspect3(context) {
     }))
   };
 }
-async function verify3(context) {
-  const detection = await detect3(context);
-  const inspection = await inspect3(context);
+async function verify4(context) {
+  const detection = await detect4(context);
+  const inspection = await inspect4(context);
   const configured = inspection.configs.some((config) => config.configuredPoints.length > 0);
   const readable = inspection.configs.filter((config) => config.exists).every((config) => config.parsed);
   const checks = [
@@ -5827,15 +6061,226 @@ async function verify3(context) {
   ];
   return {
     harnessId: OPENCODE,
-    declaredTier: MANIFEST3.verificationTier,
+    declaredTier: MANIFEST4.verificationTier,
     achievedTier: detection.version !== null && configured && readable ? "config-only" : detection.version !== null ? "presence" : null,
     checks
   };
 }
-var opencodeAdapter = { manifest: MANIFEST3, detect: detect3, inspect: inspect3, verify: verify3 };
+var opencodeAdapter = { manifest: MANIFEST4, detect: detect4, inspect: inspect4, verify: verify4 };
+
+// packages/adapters/dist/src/harnesses/pi.js
+var PI = harnessId("pi");
+var VERSION_PATTERN5 = /(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/;
+var MANIFEST5 = {
+  schemaVersion: MANIFEST_SCHEMA_VERSION,
+  id: PI,
+  displayName: "Pi",
+  // The npm package declares no `homepage`; the repository it ships is the documented home.
+  homepage: "https://github.com/earendil-works/pi",
+  // Only the version actually observed — PLAN §15 item 31, "tested range of exactly the observed
+  // version". `pi --version` on the machine this was written against printed `0.83.0`.
+  testedVersions: { minimum: "0.83.0", maximum: "0.83.0" },
+  // RFC 0007: the extension emits no receipt of its own, so nothing above `config-only` is
+  // provable. The configuration is the extension module sitting in an auto-loaded directory.
+  verificationTier: "config-only",
+  versionCommand: { executable: "pi", args: ["--version"] },
+  interceptionPoints: [{ scopeId: "tool-result", eventName: "tool_result" }],
+  // `markers` because there is nothing to parse: Pi auto-loads any module in these directories,
+  // and the presence of the HarnessTrim extension file is the whole configuration.
+  configFiles: [
+    {
+      path: ".pi/agent/extensions/harnesstrim/index.ts",
+      scope: "user",
+      parser: "markers",
+      primary: true
+    },
+    {
+      path: ".pi/extensions/harnesstrim/harnesstrim.ts",
+      scope: "project",
+      parser: "markers",
+      primary: false
+    }
+  ],
+  // The extension intercepts `tool_result` and reduces text chunks — a content seam, never a
+  // shell. Mirrors the OpenCode plugin API claim.
+  toolFamilies: [
+    { id: "tool.result", platforms: ["windows", "macos", "linux"], executesShellCommands: false }
+  ],
+  // There is no separate enable state: the module being present in the directory is the load
+  // decision, so the adapter reads presence and nothing else.
+  requiresEnablement: false,
+  enablementNote: null,
+  receiptFamily: "none"
+};
+async function resolveConfig5(declaration, context) {
+  const path = resolveConfigPath(declaration, context);
+  const stat3 = await context.fs.stat(path);
+  if (stat3 === null || stat3.kind !== "file") {
+    return {
+      declaration,
+      path,
+      exists: false,
+      parsed: false,
+      configuredPoints: [],
+      matchers: [],
+      commands: []
+    };
+  }
+  const text = new TextDecoder().decode(await context.fs.readFile(path));
+  const isHarnesstrim = /harnesstrim/i.test(text);
+  return {
+    declaration,
+    path,
+    exists: true,
+    parsed: isHarnesstrim,
+    configuredPoints: isHarnesstrim ? ["tool-result"] : [],
+    matchers: isHarnesstrim ? ["tool.result"] : [],
+    // There is no enable command: Pi loads the module from the directory directly.
+    commands: []
+  };
+}
+async function detectVersion5(context) {
+  const result = await context.runner.run({
+    executable: "pi",
+    args: ["--version"],
+    cwd: context.projectRoot,
+    timeoutMs: 2e4
+  });
+  if (result.failure !== null)
+    return {
+      value: null,
+      verdict: null,
+      evidence: [
+        evidence({
+          kind: "absence",
+          source: "pi",
+          detail: `not runnable: ${result.failure.reason}`
+        })
+      ]
+    };
+  const value = VERSION_PATTERN5.exec(result.stdout)?.[1] ?? null;
+  return {
+    value,
+    verdict: value === null ? null : classifyVersion(value, MANIFEST5.testedVersions),
+    evidence: [
+      evidence({
+        kind: "version-output",
+        source: "pi",
+        path: result.executablePath,
+        detail: value ? `reported ${value}` : "reported no recognisable version"
+      })
+    ]
+  };
+}
+async function detect5(context) {
+  const observed = await detectVersion5(context);
+  const configs = await Promise.all(MANIFEST5.configFiles.map((file) => resolveConfig5(file, context)));
+  const module = configs.find((file) => file.parsed);
+  const present = module !== void 0;
+  const warnings = [];
+  if (observed.verdict === "unknown-newer")
+    warnings.push(diagnostic({
+      severity: "warning",
+      code: "harness-version-unknown-newer",
+      message: `Pi ${observed.value} is newer than the observed extension contract`,
+      remediation: "Review the tool_result extension contract before applying changes"
+    }));
+  return {
+    harnessId: PI,
+    state: present && observed.value !== null ? "configured" : present || observed.value !== null ? "detected" : "absent",
+    version: observed.value,
+    versionVerdict: observed.verdict,
+    configPath: module?.path ?? null,
+    declaredVerificationTier: MANIFEST5.verificationTier,
+    evidence: [
+      ...observed.evidence,
+      ...module ? [
+        evidence({
+          kind: "config-entry",
+          source: "HarnessTrim Pi extension",
+          path: module.path,
+          detail: "extension module present in an auto-loaded directory"
+        })
+      ] : []
+    ],
+    warnings
+  };
+}
+async function inspect5(context) {
+  const configs = await Promise.all(MANIFEST5.configFiles.map((file) => resolveConfig5(file, context)));
+  return {
+    harnessId: PI,
+    configs,
+    activeToolFamilies: familiesOnThisPlatform(MANIFEST5, context.facts),
+    uncoveredToolFamilies: [],
+    // No separate enablement exists, so nothing is reported as enabled or disabled.
+    enabled: null,
+    diagnostics: [],
+    summaries: configs.filter((config) => config.configuredPoints.length > 0).map((config) => ({
+      harnessId: PI,
+      configPath: config.path,
+      scope: config.declaration.scope,
+      interceptionPoints: config.configuredPoints,
+      matchers: config.matchers,
+      commands: config.commands
+    }))
+  };
+}
+async function verify5(context) {
+  const detection = await detect5(context);
+  const inspection = await inspect5(context);
+  const module = inspection.configs.some((config) => config.configuredPoints.length > 0);
+  const checks = [
+    {
+      id: "executable-resolves",
+      status: detection.version === null ? "fail" : "pass",
+      summary: detection.version === null ? "pi could not be run" : `Pi ${detection.version}`,
+      achievedTier: detection.version === null ? null : "presence",
+      evidence: detection.evidence.filter((item) => item.kind === "version-output"),
+      remediation: detection.version === null ? "Install Pi or add it to PATH" : null
+    },
+    {
+      id: "module-installed",
+      status: module ? "pass" : "fail",
+      summary: module ? "HarnessTrim extension module is installed" : "No HarnessTrim extension module was found in the Pi extension directories",
+      achievedTier: module ? "config-only" : null,
+      evidence: [],
+      remediation: module ? null : "Run `harnesstrim install pi --apply`"
+    },
+    {
+      id: "mode-unreadable",
+      status: "info",
+      summary: "The effective reduction mode (HARNESSTRIM_MODE) defaults to dryrun and is not observable from the extension alone",
+      achievedTier: null,
+      evidence: [],
+      remediation: null
+    },
+    {
+      id: "canary-intercepted",
+      status: "not-exercised",
+      summary: "Pi exposes no independent receipt; HarnessTrim telemetry is verified by the provider adapter",
+      achievedTier: null,
+      evidence: [],
+      remediation: null
+    }
+  ];
+  return {
+    harnessId: PI,
+    declaredTier: MANIFEST5.verificationTier,
+    achievedTier: checks.some((check) => check.achievedTier === "config-only") ? "config-only" : checks.some((check) => check.achievedTier === "presence") ? "presence" : null,
+    checks
+  };
+}
+var piAdapter = { manifest: MANIFEST5, detect: detect5, inspect: inspect5, verify: verify5 };
 
 // packages/adapters/dist/src/harnesses/index.js
-var HARNESS_ADAPTERS = [claudeAdapter, codexAdapter, opencodeAdapter];
+var HARNESS_ADAPTERS = [
+  claudeAdapter,
+  codexAdapter,
+  hermesAdapter,
+  opencodeAdapter,
+  piAdapter
+];
 function listHarnessAdapters() {
   return HARNESS_ADAPTERS;
 }
@@ -5843,8 +6288,11 @@ function listHarnessAdapters() {
 // packages/adapters/dist/src/providers/harnesstrim.js
 var HARNESSTRIM2 = providerId("harnesstrim");
 var CLAUDE2 = harnessId("claude");
+var HERMES2 = harnessId("hermes");
 var CODEX2 = harnessId("codex");
-var CLAUDE_ARTIFACT_DIGESTS = {
+var PI2 = harnessId("pi");
+var SKILLS_UPSTREAM = "0.0.7";
+var SKILL_ARTIFACT_DIGESTS = {
   "compact-handoff/SKILL.md": "sha256:0efbf35581c559359e755b204778b64a289dab4d20dadc1cba3d5b5c995b5f01",
   "debug-log-slim/SKILL.md": "sha256:17f5ccc34d29d7aba083444e0e4d87fd3d49916ebcb4e6544caf8c89f13f0045",
   "delegate-bulk/SKILL.md": "sha256:3753de2ad18271c24832e4cda63115d353620515d5d80f40e93bc07d2a7257d7",
@@ -5853,16 +6301,18 @@ var CLAUDE_ARTIFACT_DIGESTS = {
   "review-delta/SKILL.md": "sha256:4dfbf9d6ec08dff27b4759726536b43928370e288706fa01f5b498648e741388",
   "scaffold-fast/SKILL.md": "sha256:1a18d52c4d335fbd3f74e2559bc20d6346193a40eef7b85149f51f44f697d182"
 };
+var SKILL_ARTIFACTS = Object.keys(SKILL_ARTIFACT_DIGESTS);
 var OPENCODE2 = harnessId("opencode");
 var MODE_CARRYING_HARNESSES = /* @__PURE__ */ new Set([
   OPENCODE2,
-  harnessId("hermes"),
+  HERMES2,
   harnessId("pi"),
   harnessId("omp")
 ]);
 var HOOK_COMMAND_PATTERN = /(^|[\\/\s"'])harnesstrim(\.cmd|\.exe)?([\s"']|$)/i;
 var PLUGIN_MODULE_PATTERN2 = /(^|[\\/])harnesstrim\.(ts|js|mjs|cjs|mts|cts)$/i;
-var MANIFEST4 = {
+var PI_EXTENSION_PATTERN = /(^|[\\/])\.pi[\\/](agent[\\/])?extensions[\\/]harnesstrim[\\/]/i;
+var MANIFEST6 = {
   schemaVersion: MANIFEST_SCHEMA_VERSION,
   id: HARNESSTRIM2,
   displayName: "HarnessTrim",
@@ -5948,15 +6398,48 @@ var MANIFEST4 = {
     // names it is not read. Item 30 readmits it together with the adapter and a matrix row; the
     // registry assertion in `registries.test.ts` refuses a home-relative location that names a
     // harness the registry does not know.
-    locations: [".harnesstrim/metrics.jsonl"]
+    locations: [".harnesstrim/metrics.jsonl", ".hermes/harnesstrim-metrics.jsonl"]
   },
-  delegatedInstallReview: {
-    upstreamVersion: "0.0.7",
-    reviewedWriteSet: [
-      ...Object.keys(CLAUDE_ARTIFACT_DIGESTS).map((path) => `.claude/skills/${path}`)
-    ],
-    containmentBoundary: [".claude", "CLAUDE.md"],
-    upstreamUninstallAvailable: true
+  /**
+   * One review per harness — PLAN §15 item 46b.
+   *
+   * Codex was observed at `0.1.0`: `harnesstrim install codex <dir> --apply --no-instructions`
+   * writes the same seven skill artifacts as the Claude invocation, byte for byte — the digests
+   * below are shared because the files are the same files — under `.codex/skills/` instead, and
+   * skips `AGENTS.md` exactly as the Claude one skips `CLAUDE.md`. What differs is the boundary and
+   * the protected paths, which is precisely why one review could not describe both.
+   *
+   * OpenCode is absent on purpose. Its installer writes `.opencode/plugin/harnesstrim.ts` and
+   * `.opencode/package.json` *and runs an npm install*, so the containment boundary would hold a
+   * `node_modules` tree: a snapshot question, not another entry in this map.
+   */
+  delegatedInstallReviews: {
+    claude: {
+      upstreamVersion: SKILLS_UPSTREAM,
+      reviewedWriteSet: SKILL_ARTIFACTS.map((path) => `.claude/skills/${path}`),
+      containmentBoundary: [".claude", "CLAUDE.md"],
+      upstreamUninstallAvailable: true
+    },
+    codex: {
+      upstreamVersion: SKILLS_UPSTREAM,
+      reviewedWriteSet: SKILL_ARTIFACTS.map((path) => `.codex/skills/${path}`),
+      containmentBoundary: [".codex", "AGENTS.md"],
+      upstreamUninstallAvailable: true
+    }
+  }
+};
+var SKILLS_INSTALL = {
+  claude: {
+    directory: ".claude",
+    instructions: "CLAUDE.md",
+    hook: "settings.json",
+    args: ["--no-hook", "--no-instructions"]
+  },
+  codex: {
+    directory: ".codex",
+    instructions: "AGENTS.md",
+    hook: "hooks.json",
+    args: ["--no-instructions"]
   }
 };
 var TESTED_UPSTREAM = "0.0.7";
@@ -6004,9 +6487,9 @@ function parseCapabilities(stdout) {
   if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
     return null;
   const record = parsed;
-  const version2 = record["version"];
+  const version3 = record["version"];
   const harnesses = record["harnesses"];
-  if (typeof version2 !== "string" || typeof harnesses !== "object" || harnesses === null) {
+  if (typeof version3 !== "string" || typeof harnesses !== "object" || harnesses === null) {
     return null;
   }
   const entries = {};
@@ -6016,7 +6499,7 @@ function parseCapabilities(stdout) {
       return null;
     entries[harness] = entry;
   }
-  return { version: version2, harnesses: entries };
+  return { version: version3, harnesses: entries };
 }
 async function probeCapabilities(context) {
   const outcome2 = await context.runner.run({
@@ -6095,18 +6578,18 @@ function driftWarning(message, remediation) {
 function formatSurface(surface) {
   return `${surface.toolFamily}/${surface.interceptionPoint}`;
 }
-function narrowable(capabilities) {
-  if (capabilities === null || capabilities === void 0)
-    return false;
-  const managed = MANIFEST4.harnesses.map((entry) => entry.harness);
-  return managed.every((harness) => {
+function assignableOn(capabilities) {
+  if (capabilities === null)
+    return [];
+  const reviews = MANIFEST6.delegatedInstallReviews ?? {};
+  return Object.keys(reviews).filter((harness) => {
     const observed = capabilities.harnesses[harness];
-    return observed !== void 0 && observed.narrowing.length > 0;
-  });
+    return observed !== void 0 && observed.narrowing.length > 0 && writeSetStillReviewed(capabilities, harnessId(harness));
+  }).map((harness) => harnessId(harness));
 }
 function writeSetStillReviewed(capabilities, harness) {
-  const review = MANIFEST4.delegatedInstallReview;
-  if (review === null || capabilities === null)
+  const review = MANIFEST6.delegatedInstallReviews?.[harness];
+  if (review === void 0 || capabilities === null)
     return false;
   const observed = capabilities.harnesses[harness];
   if (observed === void 0)
@@ -6132,35 +6615,37 @@ function compareCapabilities(manifest, capabilities) {
       }
     }
   }
-  const review = manifest.delegatedInstallReview;
-  if (review === null)
-    return warnings;
-  const claude = capabilities.harnesses["claude"];
-  if (claude === void 0)
-    return warnings;
-  const declared = claude.writeSet.map(writeSetPath);
-  for (const reviewed of review.reviewedWriteSet) {
-    if (declared.some((entry) => coveredBy(reviewed, entry)))
-      continue;
-    warnings.push(driftWarning(`the reviewed write set records ${reviewed} at ${review.upstreamVersion}, but \`harnesstrim capabilities\` (${capabilities.version}) declares nothing covering it (${declared.length === 0 ? "nothing" : declared.join(", ")})`, `Re-review the write set at the installed version before delegating another install`));
-  }
-  const boundary = review.containmentBoundary.map(writeSetPath);
-  for (const entry of declared) {
-    if (boundary.some((prefix) => coveredBy(entry, prefix)))
+  for (const [harness, review] of Object.entries(manifest.delegatedInstallReviews ?? {})) {
+    const observed = capabilities.harnesses[harness];
+    if (observed === void 0)
       continue;
-    warnings.push(driftWarning(`\`harnesstrim capabilities\` (${capabilities.version}) declares ${entry} for claude, which sits outside the containment boundary recorded at ${review.upstreamVersion} (${boundary.join(", ")})`, "Re-review the write set: rollback restores the boundary, and a path it does not cover would survive a rollback"));
+    const declared = observed.writeSet.map(writeSetPath);
+    for (const reviewed of review.reviewedWriteSet) {
+      if (declared.some((entry) => coveredBy(reviewed, entry)))
+        continue;
+      warnings.push(driftWarning(`the reviewed ${harness} write set records ${reviewed} at ${review.upstreamVersion}, but \`harnesstrim capabilities\` (${capabilities.version}) declares nothing covering it (${declared.length === 0 ? "nothing" : declared.join(", ")})`, `Re-review the write set at the installed version before delegating another install`));
+    }
+    const boundary = review.containmentBoundary.map(writeSetPath);
+    for (const entry of declared) {
+      if (boundary.some((prefix) => coveredBy(entry, prefix)))
+        continue;
+      warnings.push(driftWarning(`\`harnesstrim capabilities\` (${capabilities.version}) declares ${entry} for ${harness}, which sits outside the containment boundary recorded at ${review.upstreamVersion} (${boundary.join(", ")})`, "Re-review the write set: rollback restores the boundary, and a path it does not cover would survive a rollback"));
+    }
   }
   return warnings;
 }
 function harnessesWiredToHarnessTrim(configs) {
   const wired = /* @__PURE__ */ new Set();
   for (const config of configs) {
-    if (config.commands.some((command) => identifiesCommand(command)))
+    const hermesPlugin = config.harnessId === HERMES2 && (config.configPath.toLowerCase().includes(".hermes/plugins/harnesstrim") || config.commands.some((command) => /hermes plugins enable harnesstrim/i.test(command)));
+    const piExtension = config.harnessId === PI2 && PI_EXTENSION_PATTERN.test(config.configPath);
+    if (piExtension || hermesPlugin || config.commands.some((command) => identifiesCommand(command))) {
       wired.add(config.harnessId);
+    }
   }
   return [...wired];
 }
-var VERSION_PATTERN4 = /(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/;
+var VERSION_PATTERN6 = /(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/;
 async function probeExecutable(context) {
   const asked = await context.runner.run({
     executable: "harnesstrim",
@@ -6183,17 +6668,17 @@ async function probeExecutable(context) {
     };
   }
   if (asked.exitCode === 0) {
-    const version2 = VERSION_PATTERN4.exec(asked.stdout)?.[1] ?? null;
+    const version3 = VERSION_PATTERN6.exec(asked.stdout)?.[1] ?? null;
     return {
       installed: true,
-      version: version2,
+      version: version3,
       path: asked.executablePath,
       evidence: [
         evidence({
           kind: "version-output",
           source: "harnesstrim --version",
           path: asked.executablePath,
-          detail: version2 === null ? "reported no recognisable version" : `reported ${version2}`
+          detail: version3 === null ? "reported no recognisable version" : `reported ${version3}`
         })
       ]
     };
@@ -6233,16 +6718,19 @@ async function probeExecutable(context) {
   };
 }
 function metricsLocations(context) {
-  return [context.fs.join(context.projectRoot, ".harnesstrim", "metrics.jsonl")];
+  return [
+    context.fs.join(context.projectRoot, ".harnesstrim", "metrics.jsonl"),
+    context.fs.join(context.paths.home, ".hermes", "harnesstrim-metrics.jsonl")
+  ];
 }
-async function detect4(context) {
+async function detect6(context) {
   const probe = await probeExecutable(context);
   const observed = probe.installed ? await probeCapabilities(context) : null;
   const configured = harnessesWiredToHarnessTrim(context.harnessConfigs);
   const warnings = [];
   const evidenceItems = [...probe.evidence, ...observed?.evidence ?? []];
   if (observed !== null && observed.capabilities !== null) {
-    warnings.push(...compareCapabilities(MANIFEST4, observed.capabilities));
+    warnings.push(...compareCapabilities(MANIFEST6, observed.capabilities));
   }
   for (const harness of configured) {
     evidenceItems.push(evidence({
@@ -6273,7 +6761,7 @@ async function detect4(context) {
     // cannot answer.
     versionVerdict: probe.version === null ? null : classifyVersion(probe.version, TESTED_VERSIONS),
     configuredHarnesses: configured,
-    unmanagedHarnessesConfigured: configured.filter((harness) => !MANIFEST4.harnesses.some((entry) => entry.harness === harness)),
+    unmanagedHarnessesConfigured: configured.filter((harness) => !MANIFEST6.harnesses.some((entry) => entry.harness === harness)),
     // RFC 0002 §Providers may exceed the managed surface: HarnessTrim ships adapters for Hermes and
     // Pi as well, which Token Harness does not manage, so a wired one is reported and left alone.
     supportsUnmanagedHarnesses: true,
@@ -6281,10 +6769,9 @@ async function detect4(context) {
     // circumstantial: PLAN §11 says Token Harness never installs it, so every installation it ever
     // sees is the user's.
     managedByTokenHarness: false,
-    // PLAN §15 item 46. Decided by the build in front of us, not by the manifest: a build that
-    // declares narrowing flags for every managed harness can be asked for the narrowed states
-    // §6.1 recorded as unproducible, and one that cannot answer keeps the `0.0.5` verdict.
-    assignable: observed?.capabilities === null ? false : narrowable(observed?.capabilities),
+    // PLAN §15 item 46, per harness. Decided by the build in front of us and by which harnesses
+    // carry a reviewed write set: those are the two things that make the assignment producible.
+    assignableHarnesses: assignableOn(observed?.capabilities ?? null),
     evidence: evidenceItems,
     warnings
   };
@@ -6356,7 +6843,7 @@ function toEvent(event, sourceId, ordinal, line, context) {
       pipelineId: null,
       pipelineOrder: null,
       toolFamily: event.tool === "" ? null : event.tool,
-      capability: event.harness === OPENCODE2 ? "tool.output.reduce" : "shell.output.reduce"
+      capability: event.harness === OPENCODE2 || event.harness === HERMES2 || event.harness === PI2 ? "tool.output.reduce" : "shell.output.reduce"
     },
     measurement: {
       class: dryrun || hasUnprovenMode ? "counterfactual" : hasTokens ? "exact-local" : "estimated-local",
@@ -6389,7 +6876,7 @@ function toEvent(event, sourceId, ordinal, line, context) {
     source: { nativeEventId: native ? eventId : null, importedAt: context.now() }
   };
 }
-async function verify4(context) {
+async function verify6(context) {
   const checks = [];
   const diagnostics = [];
   const probe = await probeExecutable(context);
@@ -6606,84 +7093,102 @@ async function collectMetrics(context, store) {
     diagnostics
   };
 }
-async function plan(context, request) {
-  const claudeDirectory = context.fs.join(context.projectRoot, ".claude");
-  const skillsDirectory = context.fs.join(claudeDirectory, "skills");
-  const expectedArtifacts = Object.entries(CLAUDE_ARTIFACT_DIGESTS).map(([path, digest]) => ({
-    path: context.fs.join(skillsDirectory, ...path.split("/")),
+function skillArtifacts(context, harness) {
+  const install = SKILLS_INSTALL[harness];
+  if (install === void 0)
+    return [];
+  const skills = context.fs.join(context.projectRoot, install.directory, "skills");
+  return Object.entries(SKILL_ARTIFACT_DIGESTS).map(([path, digest]) => ({
+    path: context.fs.join(skills, ...path.split("/")),
     digest
   }));
-  if (!request.harnesses.some((harness) => harness.id === CLAUDE2)) {
+}
+async function plan(context, request) {
+  const reviews = MANIFEST6.delegatedInstallReviews ?? {};
+  const targets = request.harnesses.map((harness) => harness.id).filter((harness) => reviews[harness] !== void 0 && SKILLS_INSTALL[harness] !== void 0);
+  if (targets.length === 0) {
     return { providerId: HARNESSTRIM2, desiredState: request.desiredState, actions: [] };
   }
   if (request.desiredState === "absent") {
-    const actions = expectedArtifacts.map((artifact) => ({
+    const actions2 = targets.flatMap((harness) => skillArtifacts(context, harness).map((artifact) => ({
       kind: "remove-owned-change",
-      id: `harnesstrim-claude-skill-remove-${digestText(artifact.path).slice(7, 15)}`,
+      id: `harnesstrim-${harness}-skill-remove-${digestText(artifact.path).slice(7, 15)}`,
       riskClass: "reversible",
       requiresNetwork: false,
       requiresElevation: false,
       affectedPaths: [artifact.path],
       affectedProcesses: [],
-      preconditions: ["the HarnessTrim skill still matches the reviewed 0.0.7 artifact"],
+      preconditions: [
+        `the HarnessTrim skill still matches the reviewed ${SKILLS_UPSTREAM} artifact`
+      ],
       postconditions: ["the owned HarnessTrim skill is absent"],
       rollbackData: "file-snapshot",
-      explanation: `Remove the owned HarnessTrim Claude skill ${context.fs.basename(context.fs.dirname(artifact.path))}`,
+      explanation: `Remove the owned HarnessTrim ${harness} skill ${context.fs.basename(context.fs.dirname(artifact.path))}`,
       path: artifact.path,
-      reverses: `harnesstrim-claude-skills-${digestText(context.projectRoot).slice(7, 15)}`,
-      target: { kind: "owned-file", path: artifact.path, digest: artifact.digest, mode: null }
-    }));
-    return { providerId: HARNESSTRIM2, desiredState: "absent", actions };
+      reverses: `harnesstrim-${harness}-skills-${digestText(context.projectRoot).slice(7, 15)}`,
+      target: {
+        kind: "owned-file",
+        path: artifact.path,
+        digest: artifact.digest,
+        mode: null
+      }
+    })));
+    return { providerId: HARNESSTRIM2, desiredState: "absent", actions: actions2 };
   }
   const installed = await probeExecutable(context);
   if (!installed.installed) {
     return { providerId: HARNESSTRIM2, desiredState: "configured", actions: [] };
   }
   const observed = await probeCapabilities(context);
-  const reviewed = observed.capabilities === null ? installed.version === TESTED_UPSTREAM : writeSetStillReviewed(observed.capabilities, CLAUDE2);
-  if (!reviewed) {
-    return { providerId: HARNESSTRIM2, desiredState: "configured", actions: [] };
+  const actions = [];
+  for (const harness of targets) {
+    const review = reviews[harness];
+    const install = SKILLS_INSTALL[harness];
+    if (review === void 0 || install === void 0)
+      continue;
+    const reviewed = observed.capabilities === null ? installed.version === review.upstreamVersion : writeSetStillReviewed(observed.capabilities, harnessId(harness));
+    if (!reviewed)
+      continue;
+    const expectedArtifacts = skillArtifacts(context, harness);
+    actions.push({
+      kind: "delegated-provider-install",
+      id: `harnesstrim-${harness}-skills-${digestText(context.projectRoot).slice(7, 15)}`,
+      riskClass: "delegated",
+      requiresNetwork: false,
+      requiresElevation: false,
+      affectedPaths: expectedArtifacts.map((artifact) => artifact.path),
+      affectedProcesses: ["harnesstrim"],
+      preconditions: [
+        "harnesstrim is installed, on PATH, and declares the reviewed write set",
+        `the reviewed installer writes only the declared ${harness} skill artifacts`
+      ],
+      postconditions: [
+        `HarnessTrim ${harness} skills match the reviewed ${review.upstreamVersion} artifacts`,
+        "no HarnessTrim hook or reduce-pipe instruction was added"
+      ],
+      rollbackData: "directory-snapshot",
+      explanation: `Install HarnessTrim ${harness} skills without a hook or reduce-pipe instruction`,
+      executable: "harnesstrim",
+      args: ["install", harness, context.projectRoot, "--apply", ...install.args],
+      containmentBoundary: review.containmentBoundary.map((path) => context.fs.join(context.projectRoot, path)),
+      expectedArtifacts,
+      // The two files each installer reports skipping. Named here because they must not appear.
+      protectedPaths: [
+        context.fs.join(context.projectRoot, install.directory, install.hook),
+        context.fs.join(context.projectRoot, install.instructions)
+      ],
+      rollbackStrategy: "restore-snapshot",
+      snapshotSizeCapBytes: 1048576,
+      upstreamUninstallAvailable: review.upstreamUninstallAvailable
+    });
   }
-  const review = MANIFEST4.delegatedInstallReview;
-  if (review === null)
-    throw new Error("HarnessTrim delegated-install review is missing");
-  const action = {
-    kind: "delegated-provider-install",
-    id: `harnesstrim-claude-skills-${digestText(context.projectRoot).slice(7, 15)}`,
-    riskClass: "delegated",
-    requiresNetwork: false,
-    requiresElevation: false,
-    affectedPaths: expectedArtifacts.map((artifact) => artifact.path),
-    affectedProcesses: ["harnesstrim"],
-    preconditions: [
-      "harnesstrim 0.0.7 is installed and on PATH",
-      "the reviewed installer writes only the declared Claude skill artifacts"
-    ],
-    postconditions: [
-      "HarnessTrim Claude skills match the reviewed 0.0.7 artifacts",
-      "no HarnessTrim hook or reduce-pipe instruction was added"
-    ],
-    rollbackData: "directory-snapshot",
-    explanation: "Install HarnessTrim Claude skills without a hook or reduce-pipe instruction",
-    executable: "harnesstrim",
-    args: ["install", "claude", context.projectRoot, "--apply", "--no-hook", "--no-instructions"],
-    containmentBoundary: review.containmentBoundary.map((path) => context.fs.join(context.projectRoot, path)),
-    expectedArtifacts,
-    protectedPaths: [
-      context.fs.join(claudeDirectory, "settings.json"),
-      context.fs.join(context.projectRoot, "CLAUDE.md")
-    ],
-    rollbackStrategy: "restore-snapshot",
-    snapshotSizeCapBytes: 1048576,
-    upstreamUninstallAvailable: review.upstreamUninstallAvailable
-  };
-  return { providerId: HARNESSTRIM2, desiredState: "configured", actions: [action] };
+  return { providerId: HARNESSTRIM2, desiredState: "configured", actions };
 }
 var harnesstrimAdapter = {
-  manifest: MANIFEST4,
-  detect: detect4,
+  manifest: MANIFEST6,
+  detect: detect6,
   identifiesCommand,
-  verify: verify4,
+  verify: verify6,
   collectMetrics,
   plan,
   plansWithoutOwnership: true
@@ -6885,7 +7390,7 @@ function buildRtkPlan(input) {
 var RTK2 = providerId("rtk");
 var CLAUDE3 = harnessId("claude");
 var OPENCODE3 = harnessId("opencode");
-var MANIFEST5 = {
+var MANIFEST7 = {
   schemaVersion: MANIFEST_SCHEMA_VERSION,
   id: RTK2,
   displayName: "RTK",
@@ -7045,10 +7550,10 @@ var MANIFEST5 = {
     // location differs per platform; `rtkDatabasePath` is the single derivation.
     locations: ["<user data directory>/rtk/history.db"]
   },
-  delegatedInstallReview: null
+  delegatedInstallReviews: null
 };
 var TESTED_VERSIONS2 = { minimum: "0.40.0", maximum: "0.44.0" };
-var VERSION_PATTERN5 = /(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/;
+var VERSION_PATTERN7 = /(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/;
 var HOOK_COMMAND_PATTERN2 = /(^|[\\/\s"'])rtk(\.exe)?([\s"']|$)/i;
 var PLUGIN_MODULE_PATTERN3 = /(^|[\\/])rtk\.(ts|js|mjs|cjs|mts|cts)$/i;
 function isRecord4(value) {
@@ -7120,17 +7625,17 @@ async function readVersion(context) {
       ]
     };
   }
-  const version2 = VERSION_PATTERN5.exec(outcome2.stdout)?.[1] ?? null;
+  const version3 = VERSION_PATTERN7.exec(outcome2.stdout)?.[1] ?? null;
   return {
-    version: version2,
-    verdict: version2 === null ? null : classifyVersion(version2, TESTED_VERSIONS2),
+    version: version3,
+    verdict: version3 === null ? null : classifyVersion(version3, TESTED_VERSIONS2),
     executable: outcome2.executablePath,
     evidence: [
       evidence({
         kind: "version-output",
         source: "rtk --version",
         path: outcome2.executablePath,
-        detail: version2 === null ? "reported no recognisable version" : `reported ${version2}`
+        detail: version3 === null ? "reported no recognisable version" : `reported ${version3}`
       })
     ]
   };
@@ -7166,11 +7671,11 @@ async function readAnalytics(context) {
     ]
   };
 }
-async function detect5(context) {
+async function detect7(context) {
   const evidenceItems = [];
   const warnings = [];
-  const version2 = await readVersion(context);
-  evidenceItems.push(...version2.evidence);
+  const version3 = await readVersion(context);
+  evidenceItems.push(...version3.evidence);
   const configured = harnessesWiredToRtk(context.harnessConfigs);
   for (const harness of configured) {
     evidenceItems.push(evidence({
@@ -7180,15 +7685,15 @@ async function detect5(context) {
       detail: "names rtk in a hook command"
     }));
   }
-  if (version2.verdict === "unknown-newer") {
+  if (version3.verdict === "unknown-newer") {
     warnings.push(diagnostic({
       severity: "warning",
       code: "provider-version-unknown-newer",
-      message: `RTK ${String(version2.version)} is newer than the versions Token Harness has observed (up to ${TESTED_VERSIONS2.maximum})`,
+      message: `RTK ${String(version3.version)} is newer than the versions Token Harness has observed (up to ${TESTED_VERSIONS2.maximum})`,
       remediation: "Check the release notes for analytics or hook changes before applying a plan"
     }));
   }
-  const state = version2.version === null ? configured.length > 0 ? "broken" : "absent" : configured.length > 0 ? "configured" : "installed";
+  const state = version3.version === null ? configured.length > 0 ? "broken" : "absent" : configured.length > 0 ? "configured" : "installed";
   if (state === "broken") {
     warnings.push(diagnostic({
       severity: "error",
@@ -7201,12 +7706,12 @@ async function detect5(context) {
   return {
     providerId: RTK2,
     state,
-    version: version2.version,
-    executable: version2.executable,
+    version: version3.version,
+    executable: version3.executable,
     // Detection reports what it saw; which channel installed it is an installation-stage
     // question and guessing it from a path would be a guess.
     installationChannel: null,
-    versionVerdict: version2.verdict,
+    versionVerdict: version3.verdict,
     configuredHarnesses: configured,
     unmanagedHarnessesConfigured: [],
     /**
@@ -7227,29 +7732,35 @@ async function detect5(context) {
     // every installation it finds is the user's.
     managedByTokenHarness: false,
     /**
-     * Always, and independent of the observed version.
+     * Claude Code alone, and independent of the observed version.
+     *
+     * RTK's assignment is produced by this build writing the hook itself — `rtk-plan.ts` appends the
+     * entry — so nothing about the installed `rtk` decides whether the state is reachable. What does
+     * decide it is which harness schema that builder knows, and it knows one: `HOOK_LIST_HARNESSES`
+     * holds `claude` and the builder refuses anything else, because a `{matcher, hooks:[…]}` object
+     * at `hooks.<event>` is Claude Code's schema and nothing else's.
      *
-     * RTK's assignment is produced by this build writing the hook itself — `rtk-plan.ts` appends
-     * the entry — so nothing about the installed `rtk` decides whether the state is reachable.
-     * That is the difference from HarnessTrim, whose assignment is produced by *its* installer and
-     * therefore depends on which flags that installer has.
+     * RTK claims OpenCode too, from spike 9.1, and that claim is real — detected, adopted, verified
+     * and measured there. It is simply not *written* there: its OpenCode integration is a plugin
+     * module `rtk init -g --opencode` installs globally, which this build has no action for. Saying
+     * so here is what stops the resolver assigning a scope nothing can produce.
      */
-    assignable: true,
+    assignableHarnesses: [CLAUDE3],
     evidence: evidenceItems,
     warnings
   };
 }
-async function verify5(context) {
+async function verify7(context) {
   const checks = [];
   const diagnostics = [];
-  const version2 = await readVersion(context);
+  const version3 = await readVersion(context);
   checks.push({
     id: "executable-resolves",
-    status: version2.version === null ? "fail" : "pass",
-    summary: version2.version === null ? "rtk could not be run" : `rtk ${version2.version}`,
-    achievedTier: version2.version === null ? null : "presence",
-    evidence: version2.evidence,
-    remediation: version2.version === null ? "Install RTK, or add it to PATH" : null
+    status: version3.version === null ? "fail" : "pass",
+    summary: version3.version === null ? "rtk could not be run" : `rtk ${version3.version}`,
+    achievedTier: version3.version === null ? null : "presence",
+    evidence: version3.evidence,
+    remediation: version3.version === null ? "Install RTK, or add it to PATH" : null
   });
   const configured = harnessesWiredToRtk(context.harnessConfigs);
   checks.push({
@@ -7549,19 +8060,19 @@ function identifiesCommand2(command) {
   return HOOK_COMMAND_PATTERN2.test(command) || PLUGIN_MODULE_PATTERN3.test(command);
 }
 async function plan2(context, request) {
-  const version2 = await readVersion(context);
+  const version3 = await readVersion(context);
   return buildRtkPlan({
     context,
     request,
-    installed: version2.version !== null,
+    installed: version3.version !== null,
     identifiesCommand: identifiesCommand2,
-    installationChannels: MANIFEST5.installationChannels
+    installationChannels: MANIFEST7.installationChannels
   });
 }
 var rtkAdapter = {
-  manifest: MANIFEST5,
-  detect: detect5,
-  verify: verify5,
+  manifest: MANIFEST7,
+  detect: detect7,
+  verify: verify7,
   collectMetrics: collectMetrics2,
   identifiesCommand: identifiesCommand2,
   plan: plan2
@@ -7613,13 +8124,13 @@ async function computePlan(context) {
     for (const adapter of providerAdapters) {
       const detection = await adapter.detect(providerContext);
       versions.providers[adapter.manifest.id] = detection.version;
-      assignable.set(adapter.manifest.id, detection.assignable);
+      assignable.set(adapter.manifest.id, new Set(detection.assignableHarnesses));
     }
   }
   const providers = providerAdapters.map((adapter) => ({
     id: adapter.manifest.id,
     capabilities: adapter.manifest.capabilities,
-    assignable: assignable.get(adapter.manifest.id) ?? false
+    assignableHarnesses: assignable.get(adapter.manifest.id) ?? /* @__PURE__ */ new Set()
   }));
   const resolution = resolveOwnership({
     profile,
@@ -7736,9 +8247,10 @@ async function computePlan(context) {
       remediation: null
     }));
   }
+  const refusalIsTheOutcome = actions.length === 0;
   for (const entry of blocked) {
     diagnostics.push(diagnostic({
-      severity: "error",
+      severity: refusalIsTheOutcome ? "error" : "warning",
       code: "managed-mutation-blocked",
       message: `plan refuses managed mutation of ${entry.harness} by ${entry.provider}${entry.providerVersion !== null ? ` at ${entry.providerVersion}` : ""}: ${entry.missing}`,
       remediation: "Add a compatibility row whose fixture proves this combination, or configure this integration by hand"
@@ -7777,7 +8289,11 @@ async function runPlan(context) {
   const computed = await computePlan(context);
   const persisted = await persist(context, computed);
   const report = { ...computed.report, persisted };
-  const exitCode = computed.blocked.length > 0 ? EXIT_CODES["unsupported-environment"] : report.conflicts.length > 0 ? EXIT_CODES["blocked-by-conflict"] : EXIT_CODES.ok;
+  const exitCode = planExitCode({
+    blocked: computed.blocked.length,
+    actions: report.actions.length,
+    conflicts: report.conflicts.length
+  });
   return commandResult({
     command: "plan",
     exitCode,
@@ -7785,6 +8301,13 @@ async function runPlan(context) {
     diagnostics: computed.diagnostics
   });
 }
+function planExitCode(counts) {
+  if (counts.blocked > 0 && counts.actions === 0)
+    return EXIT_CODES["unsupported-environment"];
+  if (counts.conflicts > 0)
+    return EXIT_CODES["blocked-by-conflict"];
+  return EXIT_CODES.ok;
+}
 
 // apps/cli/dist/src/commands/apply.js
 var PLANS_DIRECTORY = "plans";
@@ -7848,7 +8371,7 @@ async function runApply(context) {
   const diagnostics = [];
   const computed = await computePlan(context);
   diagnostics.push(...computed.diagnostics);
-  if (computed.blocked.length > 0) {
+  if (computed.blocked.length > 0 && computed.report.actions.length === 0) {
     return finish("rejected", EXIT_CODES["unsupported-environment"], emptyReport("rejected"), diagnostics);
   }
   if (computed.report.conflicts.length > 0) {
@@ -8468,7 +8991,7 @@ async function runStatus(context) {
     providers.push({
       id: adapter.manifest.id,
       capabilities: adapter.manifest.capabilities,
-      assignable: detection.assignable
+      assignableHarnesses: new Set(detection.assignableHarnesses)
     });
   }
   const resolution = resolveOwnership({
@@ -9681,7 +10204,7 @@ function usageText(topic) {
 }
 
 // apps/cli/dist/src/version.js
-var TOOL_VERSION = "0.1.2";
+var TOOL_VERSION = "0.1.3";
 
 // apps/cli/dist/src/run.js
 var DEFAULT_COMMANDS = {