token-harness 0.1.22 → 0.1.23

package/token-harness.mjs

@@ -4130,6 +4130,7 @@ function coversProviders(rule, providers) {
   return rule.providers.length === providers.length && providers.every((provider) => rule.providers.includes(provider));
 }
 function findCompatibilityRule(rules, query) {
+  const candidates = [];
   for (const rule of rules) {
     if (!rule.capabilities.includes(query.capability))
       continue;
@@ -4137,9 +4138,20 @@ function findCompatibilityRule(rules, query) {
       continue;
     if (!coversProviders(rule, query.providers))
       continue;
-    return rule;
+    if (rule.platforms !== void 0 && (query.platform === void 0 || !rule.platforms.some((platform) => platform.os === query.platform?.os && platform.wsl === query.platform?.wsl))) {
+      continue;
+    }
+    candidates.push(rule);
   }
-  return null;
+  if (query.observedVersions !== void 0) {
+    const matchesObservedTuple = (rule) => Object.entries(rule.testedVersions).every(([provider, version3]) => query.observedVersions?.[provider] === version3) && Object.entries(rule.testedHarnessVersions ?? {}).every(([harness, version3]) => query.observedHarnessVersions?.[harness] === version3);
+    const exact = candidates.find(matchesObservedTuple);
+    if (exact !== void 0)
+      return exact;
+    const matchingDimensions = (rule) => Object.entries(rule.testedVersions).filter(([provider, version3]) => query.observedVersions?.[provider] === version3).length + Object.entries(rule.testedHarnessVersions ?? {}).filter(([harness, version3]) => query.observedHarnessVersions?.[harness] === version3).length;
+    candidates.sort((left, right) => matchingDimensions(right) - matchingDimensions(left));
+  }
+  return candidates[0] ?? null;
 }
 function coversVersion(recorded, observed) {
   if (recorded.major === 0 || observed.major === 0)
@@ -4159,6 +4171,16 @@ function staleRecordedVersions(rule, observed) {
   }
   return stale2;
 }
+function staleRecordedHarnessVersions(rule, observed) {
+  const stale2 = [];
+  for (const [harness, recorded] of Object.entries(rule.testedHarnessVersions ?? {})) {
+    const seen = observed[harness] ?? null;
+    if (seen === recorded)
+      continue;
+    stale2.push({ harness, recorded, observed: seen });
+  }
+  return stale2;
+}
 var init_compatibility = __esm({
   "packages/core/dist/src/domain/compatibility.js"() {
     "use strict";
@@ -4777,7 +4799,77 @@ function narrowChannelOverlaps(context) {
     if (first === void 0)
       continue;
     const { harness, toolFamily, capability } = first.scope;
-    const rule = findCompatibilityRule(input.rules, { providers: owners, harness, capability });
+    const found = findCompatibilityRule(input.rules, {
+      providers: owners,
+      harness,
+      capability,
+      ...input.platform === void 0 ? {} : { platform: input.platform },
+      observedVersions: input.observedVersions,
+      ...input.observedHarnessVersions === void 0 ? {} : { observedHarnessVersions: input.observedHarnessVersions }
+    });
+    const staleProviders = found === null ? [] : staleRecordedVersions(found, input.observedVersions);
+    const staleHarnesses = found === null ? [] : staleRecordedHarnessVersions(found, input.observedHarnessVersions ?? {});
+    const stale2 = [...staleProviders, ...staleHarnesses];
+    const rule = stale2.length > 0 ? null : found;
+    if (found !== null && stale2.length > 0) {
+      conflicts.push({
+        code: "compatibility-rule-stale",
+        scope: `${harness}/${toolFamily}/${capability}`,
+        claimants: [...owners].sort(),
+        detail: [
+          `${owners.join(" and ")} both use ${capability} on ${harness}/${toolFamily} at different interception points`,
+          `Rule ${found.id} was tested at ${[
+            ...staleProviders.map((entry) => `${entry.provider} ${entry.recorded}`),
+            ...staleHarnesses.map((entry) => `${entry.harness} ${entry.recorded}`)
+          ].join(", ")}`,
+          `Installed now: ${[
+            ...staleProviders.map((entry) => `${entry.provider} ${entry.observed ?? "unknown"}`),
+            ...staleHarnesses.map((entry) => `${entry.harness} ${entry.observed ?? "unknown"}`)
+          ].join(", ")}`,
+          "The compatibility rule does not authorize this provider tuple"
+        ],
+        remediation: `Re-test ${found.id} against the installed versions and platform, or assign one owner to ${harness}/${toolFamily}/${capability}`
+      });
+      for (const entry of group)
+        dropped.add(entry);
+      continue;
+    }
+    if (rule?.outcome === "ordered") {
+      const conflictsBeforeOrdering = conflicts.length;
+      const order = rule.order;
+      if (order === void 0 || order.length !== owners.length) {
+        conflicts.push({
+          code: "compatibility-rule-malformed",
+          scope: `${harness}/${toolFamily}/${capability}`,
+          claimants: [...owners].sort(),
+          detail: [`Rule ${rule.id} does not order every owner in this channel`],
+          remediation: `Fix rule ${rule.id} so its order lists every provider on the channel`
+        });
+        for (const entry of group)
+          dropped.add(entry);
+        continue;
+      }
+      for (const entry of group) {
+        const index = order.indexOf(entry.owner);
+        if (index < 0) {
+          conflicts.push({
+            code: "compatibility-rule-malformed",
+            scope: `${harness}/${toolFamily}/${capability}`,
+            claimants: [...owners].sort(),
+            detail: [`Rule ${rule.id} does not include ${entry.owner}`],
+            remediation: `Fix rule ${rule.id} so its order lists every provider on the channel`
+          });
+          break;
+        }
+        entry.mode = "chainable";
+        entry.order = index;
+      }
+      if (conflicts.length > conflictsBeforeOrdering) {
+        for (const entry of group)
+          dropped.add(entry);
+      }
+      continue;
+    }
     if (rule === null || rule.outcome !== "narrowed" || rule.retains === void 0) {
       conflicts.push({
         code: "exclusive-scope-contested",
@@ -4823,7 +4915,10 @@ function resolveContested(context) {
   const found = findCompatibilityRule(input.rules, {
     providers: claimants,
     harness: scope.harness,
-    capability
+    capability,
+    ...input.platform === void 0 ? {} : { platform: input.platform },
+    observedVersions: input.observedVersions,
+    ...input.observedHarnessVersions === void 0 ? {} : { observedHarnessVersions: input.observedHarnessVersions }
   });
   const stale2 = found === null ? [] : staleRecordedVersions(found, input.observedVersions);
   const rule = stale2.length > 0 ? null : found;
@@ -5059,18 +5154,33 @@ var init_removal_order = __esm({
 });
 
 // packages/core/dist/src/planner/rules.js
-var RTK, HARNESSTRIM, RTK_HARNESSTRIM_SHELL_OVERLAP, COMPATIBILITY_RULES;
+var RTK, HARNESSTRIM, CLAUDE, CODEX, RTK_HARNESSTRIM_ORDERED_LINUX, RTK_HARNESSTRIM_SHELL_OVERLAP, COMPATIBILITY_RULES;
 var init_rules = __esm({
   "packages/core/dist/src/planner/rules.js"() {
     "use strict";
     init_ids();
     RTK = providerId("rtk");
     HARNESSTRIM = providerId("harnesstrim");
+    CLAUDE = harnessId("claude");
+    CODEX = harnessId("codex");
+    RTK_HARNESSTRIM_ORDERED_LINUX = {
+      id: "rtk-harnesstrim-post-tool-chain-linux",
+      providers: [RTK, HARNESSTRIM],
+      harnesses: [CLAUDE, CODEX],
+      capabilities: ["shell.output.reduce"],
+      outcome: "ordered",
+      order: [RTK, HARNESSTRIM],
+      platforms: [{ os: "linux", wsl: false }],
+      testedVersions: { rtk: "0.50.0", harnesstrim: "0.3.1" },
+      testedHarnessVersions: { claude: "2.1.274", codex: "0.159.0" },
+      rationale: "RTK rewrites the Bash command at PreToolUse; HarnessTrim processes the completed Bash result at PostToolUse. The harness lifecycle establishes RTK-before-HarnessTrim. Their telemetry remains separate because the providers do not expose comparable boundaries for one shared operation.",
+      fixtures: ["tests/fixtures/rows/rtk-harnesstrim-chain-linux"]
+    };
     RTK_HARNESSTRIM_SHELL_OVERLAP = {
       id: "rtk-harnesstrim-shell-output-overlap",
       providers: [RTK, HARNESSTRIM],
-      // Every harness: the RFC checked all three MVP adapters and found the same overlap on each,
-      // for different reasons. Listing them individually would imply a fourth harness is exempt.
+      // Legacy providers retain the reviewed RTK-only narrowing. The resolver selects the exact
+      // provider tuple above for the current Linux runtime chain.
       harnesses: "*",
       capabilities: ["shell.output.reduce"],
       outcome: "narrowed",
@@ -5079,7 +5189,10 @@ var init_rules = __esm({
       rationale: "RTK keeps shell output reduction: it rewrites the command, so the output arriving at any later point is already reduced, and reducing it again loses signal and counts the saving twice. HarnessTrim 0.1.0 no longer has to be excluded whole for that \u2014 `--no-hook` and `--no-instructions` produce a Claude install that adds skills and reduces nothing, and `--tools` confines its OpenCode reduction to a chosen tool family. So it is narrowed to the form that leaves this channel alone, rather than refused. At 0.0.5 no flag produced any of those states, which is why this rule read `conflict` and said no configuration narrows it.",
       fixtures: ["docs/rfcs/0003-capabilities-and-conflicts.md#the-table-is-an-intent"]
     };
-    COMPATIBILITY_RULES = [RTK_HARNESSTRIM_SHELL_OVERLAP];
+    COMPATIBILITY_RULES = [
+      RTK_HARNESSTRIM_ORDERED_LINUX,
+      RTK_HARNESSTRIM_SHELL_OVERLAP
+    ];
   }
 });
 
@@ -7160,6 +7273,14 @@ function ensureParent(document2, segments) {
   let current = document2;
   for (let index = 0; index < segments.length - 1; index += 1) {
     const segment = segments[index];
+    if (Array.isArray(current)) {
+      const itemIndex = arrayIndex(segment);
+      if (itemIndex === null || itemIndex >= current.length) {
+        return { ok: false, reason: "path crosses a missing or invalid array entry" };
+      }
+      current = current[itemIndex];
+      continue;
+    }
     if (!isJsonObject(current)) {
       return { ok: false, reason: `\`${segments.slice(0, index).join(".")}\` is not an object` };
     }
@@ -9663,7 +9784,7 @@ var TOOL_VERSION;
 var init_version2 = __esm({
   "apps/cli/dist/src/version.js"() {
     "use strict";
-    TOOL_VERSION = "0.1.22";
+    TOOL_VERSION = "0.1.23";
   }
 });
 
@@ -14190,7 +14311,7 @@ async function detect(context) {
   const state = unparsed.length > 0 ? "broken" : configured.length > 0 && version3 !== null ? "configured" : version3 !== null || present.length > 0 ? "detected" : "absent";
   const primary = present.find((config) => config.declaration.primary) ?? present[0] ?? null;
   return {
-    harnessId: CLAUDE,
+    harnessId: CLAUDE2,
     state,
     version: version3,
     versionVerdict: verdict,
@@ -14211,7 +14332,7 @@ async function inspect(context) {
     diagnostics.push(diagnostic({
       severity: "warning",
       code: "tool-family-not-covered",
-      subject: CLAUDE,
+      subject: CLAUDE2,
       /**
        * Says whose gap it is, and that the tool is working.
        *
@@ -14228,7 +14349,7 @@ async function inspect(context) {
     }));
   }
   return {
-    harnessId: CLAUDE,
+    harnessId: CLAUDE2,
     configs,
     activeToolFamilies,
     uncoveredToolFamilies,
@@ -14236,7 +14357,7 @@ async function inspect(context) {
     // settings.json runs. Codex is the one that needs the other answer.
     enabled: MANIFEST.requiresEnablement ? null : null,
     summaries: configs.filter((config) => config.configuredPoints.length > 0).map((config) => ({
-      harnessId: CLAUDE,
+      harnessId: CLAUDE2,
       configPath: config.path,
       scope: config.declaration.scope,
       interceptionPoints: config.configuredPoints,
@@ -14300,7 +14421,7 @@ async function verify(context) {
     remediation: null
   });
   const achievedTier = checks.some((check) => check.achievedTier === "config-only") ? "config-only" : checks.some((check) => check.achievedTier === "presence") ? "presence" : null;
-  return { harnessId: CLAUDE, declaredTier: MANIFEST.verificationTier, achievedTier, checks };
+  return { harnessId: CLAUDE2, declaredTier: MANIFEST.verificationTier, achievedTier, checks };
 }
 function cclimitsPercent(value3) {
   if (typeof value3 !== "string")
@@ -14326,7 +14447,7 @@ function cclimitsUsageWindow(value3, input) {
     return null;
   }
   return {
-    harnessId: CLAUDE,
+    harnessId: CLAUDE2,
     bucketId: "claude-subscription",
     bucketName: "Claude subscription",
     window: input.window,
@@ -14350,7 +14471,7 @@ async function observeUsage(context, observedAt) {
     maxOutputBytes: 512 * 1024
   });
   const unavailable3 = (code, message, severity = "warning", remediation = null) => ({
-    harnessId: CLAUDE,
+    harnessId: CLAUDE2,
     state: "unavailable",
     windows: [],
     planType: null,
@@ -14360,7 +14481,7 @@ async function observeUsage(context, observedAt) {
       diagnostic({
         severity,
         code,
-        subject: CLAUDE,
+        subject: CLAUDE2,
         message,
         remediation: remediation ?? (severity === "info" ? "Install a cclimits build with cacheless Claude JSON support if you want this optional fallback" : "Run cclimits --claude --json --no-cache-write --no-stale-fallback directly and inspect its output")
       })
@@ -14426,13 +14547,13 @@ async function observeUsage(context, observedAt) {
     diagnostics.push(diagnostic({
       severity: "warning",
       code: "cclimits-claude-window-unrecognized",
-      subject: CLAUDE,
+      subject: CLAUDE2,
       message: "One cclimits Claude quota window failed strict percentage validation",
       remediation: "Treat the omitted window as unknown and update the cclimits compatibility fixture"
     }));
   }
   return {
-    harnessId: CLAUDE,
+    harnessId: CLAUDE2,
     state: "observed",
     windows,
     planType: typeof claude["plan"] === "string" ? claude["plan"] : null,
@@ -14465,7 +14586,7 @@ async function observeContext(context, _observedAt) {
   const nativeEffort = await readClaudeNativeEffort(context);
   const benchmarkPolicy = await readClaudeBenchmarkPolicy(context, nativeEffort);
   const empty2 = (state, diagnostics) => ({
-    harnessId: CLAUDE,
+    harnessId: CLAUDE2,
     state,
     nativeEffort,
     benchmarkPolicy,
@@ -14492,7 +14613,7 @@ async function observeContext(context, _observedAt) {
       diagnostic({
         severity: "warning",
         code: "claude-mcp-inventory-unavailable",
-        subject: CLAUDE,
+        subject: CLAUDE2,
         message: "Claude MCP inventory could not be read: " + outcome2.failure.message,
         remediation: "Run claude mcp list directly and verify the CLI installation"
       })
@@ -14503,7 +14624,7 @@ async function observeContext(context, _observedAt) {
       diagnostic({
         severity: "warning",
         code: "claude-mcp-inventory-unavailable",
-        subject: CLAUDE,
+        subject: CLAUDE2,
         message: "claude mcp list exited " + String(outcome2.exitCode),
         remediation: "Run claude mcp list directly and fix the reported MCP configuration"
       })
@@ -14521,7 +14642,7 @@ async function observeContext(context, _observedAt) {
     if (name2 === void 0 || name2 === "")
       continue;
     servers.push({
-      harnessId: CLAUDE,
+      harnessId: CLAUDE2,
       name: name2,
       toolCount: null,
       runtimeStatus: claudeMcpStatus(match[2] ?? ""),
@@ -14535,7 +14656,7 @@ async function observeContext(context, _observedAt) {
     mcpServers: servers
   };
 }
-var CLAUDE, MANIFEST, VERSION_PATTERN, claudeAdapter;
+var CLAUDE2, MANIFEST, VERSION_PATTERN, claudeAdapter;
 var init_claude = __esm({
   "packages/adapters/dist/src/harnesses/claude.js"() {
     "use strict";
@@ -14543,13 +14664,13 @@ var init_claude = __esm({
     init_contract();
     init_claude_policy();
     init_claude_benchmark_policy();
-    CLAUDE = harnessId("claude");
+    CLAUDE2 = harnessId("claude");
     MANIFEST = {
       schemaVersion: MANIFEST_SCHEMA_VERSION,
-      id: CLAUDE,
+      id: CLAUDE2,
       displayName: "Claude Code",
       homepage: "https://claude.com/claude-code",
-      testedVersions: { minimum: "2.0.0", maximum: "2.1.212" },
+      testedVersions: { minimum: "2.1.274", maximum: "2.1.274" },
       // RFC 0007 §Per-harness findings: tier 3 was reached on this harness, passively,
       // through the provider's receipt. The adapter alone reaches `config-only`.
       verificationTier: "canary",
@@ -14573,6 +14694,7 @@ var init_claude = __esm({
       toolFamilies: [
         {
           id: "Bash",
+          matcher: "Bash",
           platforms: ["windows", "macos", "linux"],
           executesShellCommands: true
         },
@@ -14580,6 +14702,7 @@ var init_claude = __esm({
           // Observed in a Windows session: the harness offers a separate PowerShell tool,
           // and a hook matching `Bash` did not see commands routed through it.
           id: "PowerShell",
+          matcher: "PowerShell",
           platforms: ["windows"],
           executesShellCommands: true
         }
@@ -14913,7 +15036,7 @@ async function detect2(context) {
   const configured = (hooks?.configuredPoints.length ?? 0) > 0;
   const primary = configs.find((config) => config.declaration.primary && config.exists) ?? present[0] ?? null;
   return {
-    harnessId: CODEX,
+    harnessId: CODEX2,
     state: hooks?.exists && !hooks.parsed ? "broken" : configured && version3 !== null ? "configured" : version3 !== null || present.length > 0 ? "detected" : "absent",
     version: version3,
     versionVerdict: verdict,
@@ -14939,14 +15062,14 @@ async function inspect2(context) {
     diagnostic({
       severity: "info",
       code: "hook-enablement-unobservable",
-      subject: CODEX,
+      subject: CODEX2,
       message: "This file declares hooks; run verify to query native enablement/trust where hooks/list is available",
       path: hook.path,
       remediation: "Open Codex and confirm the hook is enabled and trusted after any hook edit"
     })
   ] : [];
   return {
-    harnessId: CODEX,
+    harnessId: CODEX2,
     configs,
     activeToolFamilies: familiesOnThisPlatform(MANIFEST2, context.facts),
     /**
@@ -14963,7 +15086,7 @@ async function inspect2(context) {
     uncoveredToolFamilies: familiesOnThisPlatform(MANIFEST2, context.facts).filter((family) => family.executesShellCommands).filter((family) => matchers.length > 0 && !matchers.some((matcher) => matcherCoversFamily(matcher, family.id))).map((family) => family.id),
     enabled: null,
     summaries: configs.filter((config) => config.configuredPoints.length > 0).map((config) => ({
-      harnessId: CODEX,
+      harnessId: CODEX2,
       configPath: config.path,
       scope: config.declaration.scope,
       interceptionPoints: config.configuredPoints,
@@ -14983,11 +15106,15 @@ async function verify2(context) {
   const checks = [
     {
       id: "executable-resolves",
-      status: detection.version === null ? "fail" : "pass",
-      summary: detection.version === null ? "codex could not be run" : `Codex ${detection.version} resolves`,
+      // Codex Desktop can run hooks from its own app process without exposing the optional
+      // `codex` CLI to the shell that runs Token Harness. Missing CLI access therefore means
+      // that CLI-based checks cannot be exercised; the provider rows remain responsible for
+      // proving actual hook execution from RTK/HarnessTrim telemetry.
+      status: detection.version === null ? "not-exercised" : "pass",
+      summary: detection.version === null ? "Codex CLI is unavailable to this process; native CLI checks cannot run" : `Codex ${detection.version} resolves`,
       achievedTier: detection.version === null ? null : "presence",
       evidence: detection.evidence.filter((item) => item.kind === "version-output"),
-      remediation: detection.version === null ? "Install Codex CLI or add it to PATH" : null
+      remediation: null
     },
     {
       id: "hooks-readable",
@@ -15010,15 +15137,15 @@ async function verify2(context) {
     {
       id: "hook-enablement",
       status: configured ? "info" : "not-exercised",
-      summary: configured ? "Native enablement/trust metadata was unavailable; the declared file alone does not prove activation" : "No declared hook has enablement to inspect",
+      summary: configured ? "Native enablement/trust metadata is unavailable; configuration alone does not prove activation" : "No declared hook has enablement to inspect",
       achievedTier: null,
       evidence: [],
-      remediation: configured ? "Open Codex and manually enable and trust the hook; Token Harness cannot grant trust. Then run verify again." : null
+      remediation: configured ? "Use Codex hook controls to enable and trust the declared hook, then run a provider canary; Token Harness cannot grant trust." : null
     },
     {
       id: "canary-intercepted",
       status: "not-exercised",
-      summary: "No positive event-stream receipt has been observed for this integration",
+      summary: "No Codex CLI event-stream receipt is available from passive verification; provider-specific runtime receipts are checked separately",
       achievedTier: null,
       evidence: [],
       remediation: null
@@ -15033,7 +15160,7 @@ async function verify2(context) {
     }
   }
   return {
-    harnessId: CODEX,
+    harnessId: CODEX2,
     declaredTier: MANIFEST2.verificationTier,
     achievedTier: detection.version !== null && readable && configured ? "config-only" : detection.version !== null ? "presence" : null,
     checks
@@ -15069,7 +15196,7 @@ function rateWindow(value3, input) {
   const duration2 = readNumber(value3, "windowDurationMins");
   const resetsAt = readNumber(value3, "resetsAt");
   return {
-    harnessId: CODEX,
+    harnessId: CODEX2,
     bucketId: input.bucketId,
     bucketName: input.bucketName,
     window: input.window,
@@ -15171,7 +15298,7 @@ function cclimitsWindow(value3, input) {
     return null;
   }
   return {
-    harnessId: CODEX,
+    harnessId: CODEX2,
     bucketId: "codex-subscription",
     bucketName: "Codex subscription",
     window: input.window,
@@ -15231,7 +15358,7 @@ async function observeUsageViaCclimits(context, observedAt, nativeDiagnostic) {
   if (outcome2.failure !== null || outcome2.exitCode !== 0 || outcome2.stdoutTruncated) {
     const reason3 = outcome2.failure !== null ? outcome2.failure.message : outcome2.stdoutTruncated ? "output exceeded the bounded capture" : `exited ${String(outcome2.exitCode)}`;
     return {
-      harnessId: CODEX,
+      harnessId: CODEX2,
       state: "unavailable",
       windows: [],
       planType: null,
@@ -15242,7 +15369,7 @@ async function observeUsageViaCclimits(context, observedAt, nativeDiagnostic) {
         diagnostic({
           severity: outcome2.failure?.reason === "executable-not-found" ? "info" : "warning",
           code: "cclimits-codex-usage-unavailable",
-          subject: CODEX,
+          subject: CODEX2,
           message: "Optional cclimits Codex quota fallback was unavailable: " + reason3,
           remediation: "Install a cclimits build with cacheless Codex JSON support, or treat Codex quota as unknown"
         })
@@ -15252,7 +15379,7 @@ async function observeUsageViaCclimits(context, observedAt, nativeDiagnostic) {
   const parsed = parseCclimitsCodexResponse(outcome2.stdout, observedAt);
   if (parsed === null) {
     return {
-      harnessId: CODEX,
+      harnessId: CODEX2,
       state: "unavailable",
       windows: [],
       planType: null,
@@ -15263,7 +15390,7 @@ async function observeUsageViaCclimits(context, observedAt, nativeDiagnostic) {
         diagnostic({
           severity: "warning",
           code: "cclimits-codex-schema-unrecognized",
-          subject: CODEX,
+          subject: CODEX2,
           message: "cclimits returned no strictly validated Codex quota window with an absolute reset time",
           remediation: "Update the cclimits Codex compatibility fixture before using it for benchmark quota"
         })
@@ -15271,14 +15398,14 @@ async function observeUsageViaCclimits(context, observedAt, nativeDiagnostic) {
     };
   }
   return {
-    harnessId: CODEX,
+    harnessId: CODEX2,
     state: "observed",
     ...parsed,
     diagnostics: [
       diagnostic({
         severity: "info",
         code: "codex-rate-limits-companion-fallback",
-        subject: CODEX,
+        subject: CODEX2,
         message: "Native Codex quota was unavailable, so cclimits supplied a read-only reported snapshot",
         remediation: null
       })
@@ -15315,7 +15442,7 @@ async function observeUsage2(context, observedAt) {
     return observeUsageViaCclimits(context, observedAt, diagnostic({
       severity: "warning",
       code: "codex-rate-limits-unavailable",
-      subject: CODEX,
+      subject: CODEX2,
       message: "Codex rate limits could not be read natively: " + outcome2.failure.message,
       remediation: "Run Codex once, confirm ChatGPT authentication, then retry token-harness budget"
     }));
@@ -15324,7 +15451,7 @@ async function observeUsage2(context, observedAt) {
     return observeUsageViaCclimits(context, observedAt, diagnostic({
       severity: "warning",
       code: "codex-rate-limits-unavailable",
-      subject: CODEX,
+      subject: CODEX2,
       message: "Codex app-server exited " + String(outcome2.exitCode) + " without a usable rate-limit snapshot",
       remediation: "Check codex app-server --help and the installed Codex authentication state"
     }));
@@ -15334,7 +15461,7 @@ async function observeUsage2(context, observedAt) {
     return observeUsageViaCclimits(context, observedAt, diagnostic({
       severity: "warning",
       code: "codex-rate-limits-schema-unrecognized",
-      subject: CODEX,
+      subject: CODEX2,
       message: "Codex app-server returned no recognizable account/rateLimits/read response",
       remediation: "Refresh the Codex compatibility fixture before relying on this version"
     }));
@@ -15343,13 +15470,13 @@ async function observeUsage2(context, observedAt) {
     return observeUsageViaCclimits(context, observedAt, diagnostic({
       severity: "warning",
       code: "codex-rate-limits-empty",
-      subject: CODEX,
+      subject: CODEX2,
       message: "Codex returned a rate-limit response without any readable usage windows",
       remediation: "Treat current Codex quota as unknown unless a strict companion snapshot succeeds"
     }));
   }
   return {
-    harnessId: CODEX,
+    harnessId: CODEX2,
     state: "observed",
     ...parsed,
     diagnostics: []
@@ -15429,7 +15556,7 @@ async function observeContext2(context, _observedAt) {
     maxOutputBytes: 4 * 1024 * 1024
   });
   const unavailable3 = (state, code, message) => ({
-    harnessId: CODEX,
+    harnessId: CODEX2,
     state,
     model: null,
     reasoningEffort: null,
@@ -15451,7 +15578,7 @@ async function observeContext2(context, _observedAt) {
       diagnostic({
         severity: "warning",
         code,
-        subject: CODEX,
+        subject: CODEX2,
         message,
         remediation: "Update Codex and retry token-harness context"
       })
@@ -15518,7 +15645,7 @@ async function observeContext2(context, _observedAt) {
       if (path === null || version3 === null)
         continue;
       return {
-        harnessId: CODEX,
+        harnessId: CODEX2,
         scope: "user",
         path,
         version: version3,
@@ -15542,7 +15669,7 @@ async function observeContext2(context, _observedAt) {
     const path = readString(source, "file");
     const profile = readString(source, "profile");
     managedConfigFieldOrigins.push({
-      harnessId: CODEX,
+      harnessId: CODEX2,
       keyPath,
       sourceType,
       path,
@@ -15578,7 +15705,7 @@ async function observeContext2(context, _observedAt) {
         }
       }
       availableModels.push({
-        harnessId: CODEX,
+        harnessId: CODEX2,
         id,
         model,
         displayName,
@@ -15602,7 +15729,7 @@ async function observeContext2(context, _observedAt) {
         continue;
       const tools = isRecord3(item["tools"]) ? item["tools"] : null;
       mcpServers.push({
-        harnessId: CODEX,
+        harnessId: CODEX2,
         name: name2,
         toolCount: tools === null ? null : Object.keys(tools).length,
         runtimeStatus: readString(item, "runtimeStatus"),
@@ -15618,7 +15745,7 @@ async function observeContext2(context, _observedAt) {
     diagnostics.push(diagnostic({
       severity: "warning",
       code: "codex-config-read-unavailable",
-      subject: CODEX,
+      subject: CODEX2,
       message: "Codex returned no recognizable config/read result",
       remediation: "Treat effective Codex configuration as unknown"
     }));
@@ -15627,7 +15754,7 @@ async function observeContext2(context, _observedAt) {
     diagnostics.push(diagnostic({
       severity: "warning",
       code: "codex-managed-config-target-unavailable",
-      subject: CODEX,
+      subject: CODEX2,
       message: "Codex effective config was readable, but no versioned base user config layer was returned",
       remediation: "Keep native policy advisory; do not guess a config.toml path or expectedVersion"
     }));
@@ -15636,7 +15763,7 @@ async function observeContext2(context, _observedAt) {
     diagnostics.push(diagnostic({
       severity: "warning",
       code: "codex-model-catalog-unavailable",
-      subject: CODEX,
+      subject: CODEX2,
       message: "Codex returned no recognizable model/list result",
       remediation: "Keep the current model; do not infer alternative model ids"
     }));
@@ -15645,7 +15772,7 @@ async function observeContext2(context, _observedAt) {
     diagnostics.push(diagnostic({
       severity: "warning",
       code: "codex-model-catalog-truncated",
-      subject: CODEX,
+      subject: CODEX2,
       message: "Codex model catalog exceeded the one-shot page size",
       remediation: "Do not recommend a model absent from the returned catalog page"
     }));
@@ -15654,7 +15781,7 @@ async function observeContext2(context, _observedAt) {
     diagnostics.push(diagnostic({
       severity: "warning",
       code: "codex-mcp-inventory-unavailable",
-      subject: CODEX,
+      subject: CODEX2,
       message: "Codex returned no recognizable mcpServerStatus/list result",
       remediation: "Treat Codex MCP overhead as unknown; config/model optimization remains available"
     }));
@@ -15663,14 +15790,14 @@ async function observeContext2(context, _observedAt) {
     diagnostics.push(diagnostic({
       severity: "warning",
       code: "codex-mcp-inventory-truncated",
-      subject: CODEX,
+      subject: CODEX2,
       message: "Codex MCP inventory exceeded the one-shot page size",
       remediation: "Treat the reported MCP/tool counts as lower bounds"
     }));
   }
   const projectRootMarkers = config === null ? null : Array.isArray(config["project_root_markers"]) ? readStringArray(config, "project_root_markers") : null;
   return {
-    harnessId: CODEX,
+    harnessId: CODEX2,
     state: config !== null && mcpResponse !== null && modelResponse !== null ? mcpInventoryTruncated || modelCatalogTruncated ? "partial" : "observed" : config !== null || mcpResponse !== null || modelResponse !== null ? "partial" : "unavailable",
     model: config === null ? null : readString(config, "model"),
     reasoningEffort: config === null ? null : readString(config, "model_reasoning_effort"),
@@ -15691,7 +15818,7 @@ async function observeContext2(context, _observedAt) {
     diagnostics
   };
 }
-var CODEX, RATE_LIMIT_REQUEST_ID, CONTEXT_CONFIG_REQUEST_ID, CONTEXT_MCP_REQUEST_ID, CONTEXT_MODEL_REQUEST_ID, VERSION_PATTERN2, MANIFEST2, codexAdapter;
+var CODEX2, RATE_LIMIT_REQUEST_ID, CONTEXT_CONFIG_REQUEST_ID, CONTEXT_MCP_REQUEST_ID, CONTEXT_MODEL_REQUEST_ID, VERSION_PATTERN2, MANIFEST2, codexAdapter;
 var init_codex = __esm({
   "packages/adapters/dist/src/harnesses/codex.js"() {
     "use strict";
@@ -15699,7 +15826,7 @@ var init_codex = __esm({
     init_claude();
     init_codex_hooks();
     init_contract();
-    CODEX = harnessId("codex");
+    CODEX2 = harnessId("codex");
     RATE_LIMIT_REQUEST_ID = "token-harness-rate-limits";
     CONTEXT_CONFIG_REQUEST_ID = "token-harness-context-config";
     CONTEXT_MCP_REQUEST_ID = "token-harness-context-mcp";
@@ -15707,10 +15834,10 @@ var init_codex = __esm({
     VERSION_PATTERN2 = /(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/;
     MANIFEST2 = {
       schemaVersion: MANIFEST_SCHEMA_VERSION,
-      id: CODEX,
+      id: CODEX2,
       displayName: "Codex CLI",
       homepage: "https://developers.openai.com/codex",
-      testedVersions: { minimum: "0.146.0", maximum: "0.146.0" },
+      testedVersions: { minimum: "0.159.0", maximum: "0.159.0" },
       verificationTier: "config-only",
       versionCommand: { executable: "codex", args: ["--version"] },
       /**
@@ -15741,7 +15868,12 @@ var init_codex = __esm({
         }
       ],
       toolFamilies: [
-        { id: "Bash", platforms: ["windows", "macos", "linux"], executesShellCommands: true }
+        {
+          id: "Bash",
+          matcher: "^Bash$",
+          platforms: ["windows", "macos", "linux"],
+          executesShellCommands: true
+        }
       ],
       requiresEnablement: true,
       enablementNote: "Codex persists hook enablement and trust separately from hooks.json; verify reads hooks/list where available and otherwise keeps enablement unknown",
@@ -16531,6 +16663,105 @@ var init_harnesses = __esm({
   }
 });
 
+// packages/adapters/dist/src/providers/hook-plan.js
+function hookListPointer(eventName) {
+  return `hooks.${eventName.replace(/\./g, "\\.")}`;
+}
+function hookMatcherForFamily(harness, toolFamily) {
+  const family = harness.toolFamilies.find((entry) => entry.id === toolFamily);
+  return family?.matcher ?? toolFamily;
+}
+function commandHookTarget(context, harness, scopeId, toolFamily) {
+  const point = harness.interceptionPoints.find((entry) => entry.scopeId === scopeId);
+  const family = harness.toolFamilies.find((entry) => entry.id === toolFamily);
+  const file = harness.configFiles.find((entry) => entry.interceptionFormat === "hooks-event-command-list" && entry.interceptionPoints?.includes(scopeId));
+  if (point === void 0 || family === void 0 || file === void 0)
+    return null;
+  const base = file.scope === "user" ? context.paths.home : context.projectRoot;
+  const configPath = context.fs.join(base, ...file.path.split("/"));
+  return {
+    harness,
+    harnessId: harness.id,
+    scopeId,
+    toolFamily,
+    eventName: point.eventName,
+    matcher: family.matcher ?? family.id,
+    configPath,
+    pointer: hookListPointer(point.eventName)
+  };
+}
+function commandHookEntry(matcher, command) {
+  return {
+    matcher,
+    hooks: [{ type: "command", command }]
+  };
+}
+function appendCommandHookAction(input) {
+  const { target } = input;
+  return {
+    kind: "merge-json",
+    id: input.actionId,
+    riskClass: "reversible",
+    requiresNetwork: false,
+    requiresElevation: false,
+    affectedPaths: [target.configPath],
+    affectedProcesses: [],
+    preconditions: [
+      `${target.configPath} is absent or parses as JSON`,
+      `no ${input.providerId} command hook already exists on ${target.eventName}/${target.toolFamily}`
+    ],
+    postconditions: [
+      `${target.eventName} carries one ${input.providerId} command hook for ${target.toolFamily}`,
+      "every other hook entry is unchanged"
+    ],
+    rollbackData: "file-snapshot",
+    explanation: input.explanation,
+    path: target.configPath,
+    ownedPointers: [target.pointer],
+    operations: [
+      {
+        kind: "append",
+        pointer: target.pointer,
+        value: commandHookEntry(target.matcher, input.command),
+        expectedValueDigest: null
+      }
+    ],
+    createIfMissing: true
+  };
+}
+function removeCommandHookAction(input) {
+  return {
+    kind: "remove-owned-change",
+    id: input.actionId,
+    riskClass: "reversible",
+    requiresNetwork: false,
+    requiresElevation: false,
+    affectedPaths: [input.target.configPath],
+    affectedProcesses: [],
+    preconditions: [`the ${input.providerId} hook still matches the entry Token Harness wrote`],
+    postconditions: [
+      `${input.target.eventName} no longer carries the Token Harness ${input.providerId} hook`
+    ],
+    rollbackData: "file-snapshot",
+    explanation: `Remove the ${input.providerId} hook from ${input.target.harness.displayName}`,
+    path: input.target.configPath,
+    reverses: input.installActionId,
+    target: {
+      kind: "owned-json-entry",
+      path: input.target.configPath,
+      pointer: input.target.pointer,
+      placement: "array-element",
+      valueDigest: jsonValueDigest(commandHookEntry(input.target.matcher, input.command))
+    }
+  };
+}
+var init_hook_plan = __esm({
+  "packages/adapters/dist/src/providers/hook-plan.js"() {
+    "use strict";
+    init_src();
+  }
+});
+
 // packages/adapters/dist/src/providers/harnesstrim.js
 function identifiesCommand(command) {
   return HOOK_COMMAND_PATTERN.test(command) || PLUGIN_MODULE_PATTERN2.test(command);
@@ -17037,22 +17268,27 @@ async function verify6(context) {
       continue;
     const text3 = new TextDecoder().decode(await context.fs.readFile(path));
     const lines = text3.split("\n").filter((line) => line.trim() !== "");
-    const last = lines.at(-1);
-    const parsed = last === void 0 ? null : parseTrimEvent(last);
-    if (parsed === null)
+    const parsed = lines.map(parseTrimEvent).filter((event) => event !== null).filter((event) => event.harness === "codex" || event.harness === "claude");
+    const latest = parsed.at(-1);
+    if (latest === void 0)
       continue;
-    receipt = { observedAt: parsed.ts, operations: lines.length, source: path };
+    const reductions = parsed.filter((event) => !event.reductionFailed && event.afterChars < event.beforeChars && event.changed !== false);
+    receipt = {
+      observedAt: latest.ts,
+      operations: reductions.length,
+      attempts: parsed.length,
+      source: path
+    };
     break;
   }
   checks.push({
     id: "canary-intercepted",
-    status: receipt === null ? "not-exercised" : "pass",
-    summary: receipt === null ? "no telemetry file yet, so nothing has been observed" : `${String(receipt.operations)} reductions recorded, most recently ${receipt.observedAt}`,
-    // A recorded reduction is the provider witnessing its own interception, which is what `canary`
-    // means in RFC 0007's tier table.
-    achievedTier: receipt === null ? null : "canary",
+    status: receipt === null ? "not-exercised" : receipt.operations === 0 ? "info" : "pass",
+    summary: receipt === null ? "no telemetry file yet, so nothing has been observed" : receipt.operations === 0 ? `HarnessTrim observed ${String(receipt.attempts ?? 0)} Claude/Codex outputs, but none was reduced; latest attempt ${receipt.observedAt}` : `${String(receipt.operations)} applied reductions recorded from ${String(receipt.attempts ?? receipt.operations)} Claude/Codex outputs, most recently ${receipt.observedAt}`,
+    // Configured hooks and pass-through receipts do not prove that HarnessTrim shortened output.
+    achievedTier: receipt === null || receipt.operations === 0 ? null : "canary",
     evidence: [],
-    remediation: receipt !== null ? null : runtimeConfigured.length > 0 ? "Enable telemetry on the runtime integration, then use it on an output it can reduce." : "A skills-only setup does not write reduction telemetry. Configure a compatible measurement path before expecting agent-attributed results."
+    remediation: receipt !== null && receipt.operations > 0 ? null : receipt !== null ? "Run a canary that produces output the installed HarnessTrim reducer can shorten, then verify again." : runtimeConfigured.length > 0 ? "Enable telemetry on the runtime integration, then use it on an output it can reduce." : "A skills-only setup does not write reduction telemetry. Configure a compatible measurement path before expecting agent-attributed results."
   });
   const agents = context.fs.join(context.projectRoot, "AGENTS.md");
   if (await context.fs.stat(agents) !== null) {
@@ -17294,7 +17530,7 @@ async function harnessTrimSkillsConfigured(context, harness, capabilities) {
 }
 async function configuredHarnessesForHarnessTrim(context, capabilities) {
   const configured = new Set(harnessesWiredToHarnessTrim(context.harnessConfigs));
-  for (const harness of [CLAUDE2, CODEX2]) {
+  for (const harness of [CLAUDE3, CODEX3]) {
     if (await harnessTrimSkillsConfigured(context, harness, capabilities))
       configured.add(harness);
   }
@@ -17338,6 +17574,28 @@ async function plan(context, request) {
         mode: null
       }
     })));
+    for (const owned of request.ownership) {
+      if (owned.owner !== HARNESSTRIM2 || owned.scope.capability !== "shell.output.reduce" || owned.scope.interceptionPoint !== "post-tool-use" || owned.scope.harness !== CLAUDE3 && owned.scope.harness !== CODEX3) {
+        continue;
+      }
+      const harness = request.harnesses.find((entry) => entry.id === owned.scope.harness);
+      if (harness === void 0)
+        continue;
+      const target = commandHookTarget(context, harness, owned.scope.interceptionPoint, owned.scope.toolFamily);
+      if (target === null)
+        continue;
+      const existing = context.harnessConfigs.filter((config) => config.harnessId === harness.id && config.configPath === target.configPath && config.interceptionPoints.includes(target.scopeId)).flatMap((config) => config.hookCommands ?? []).find((entry) => entry.eventName === target.eventName && entry.matcher === target.matcher && isHarnessTrimHookFor(entry.command, harness.id));
+      if (existing === void 0)
+        continue;
+      const actionKey = digestText(target.configPath).slice(7, 15);
+      actions2.push(removeCommandHookAction({
+        target,
+        providerId: HARNESSTRIM2,
+        actionId: `harnesstrim-${harness.id}-hook-remove-${actionKey}`,
+        installActionId: `harnesstrim-${harness.id}-hook-${actionKey}`,
+        command: existing.command
+      }));
+    }
     return {
       providerId: HARNESSTRIM2,
       desiredState: "absent",
@@ -17354,6 +17612,7 @@ async function plan(context, request) {
     };
   }
   const actions = [];
+  const diagnostics = [];
   const plannedHarnesses = [];
   for (const harness of targets) {
     const review = reviews[harness];
@@ -17401,24 +17660,132 @@ async function plan(context, request) {
     });
     plannedHarnesses.push(harnessId(harness));
   }
+  for (const owned of request.ownership) {
+    if (owned.owner !== HARNESSTRIM2 || owned.scope.capability !== "shell.output.reduce" || owned.scope.interceptionPoint !== "post-tool-use" || owned.scope.harness !== CLAUDE3 && owned.scope.harness !== CODEX3) {
+      continue;
+    }
+    const harness = request.harnesses.find((entry) => entry.id === owned.scope.harness);
+    if (harness === void 0)
+      continue;
+    const target = commandHookTarget(context, harness, owned.scope.interceptionPoint, owned.scope.toolFamily);
+    if (target === null)
+      continue;
+    const metricsPath = ".harnesstrim/metrics.jsonl";
+    const command = `harnesstrim hook ${harness.id} --metrics ${metricsPath}`;
+    const existing = context.harnessConfigs.filter((config) => config.harnessId === harness.id && config.configPath === target.configPath && config.interceptionPoints.includes(target.scopeId)).flatMap((config) => config.hookCommands ?? []).filter((entry) => entry.eventName === target.eventName && entry.matcher !== null && matcherCoversFamily2(entry.matcher, target.toolFamily) && isHarnessTrimHookFor(entry.command, harness.id));
+    const correctlyMonitored = existing.some((entry) => commandHasMetricsPath(entry.command, metricsPath));
+    if (correctlyMonitored) {
+      plannedHarnesses.push(harness.id);
+      continue;
+    }
+    const upgradable = existing.find((entry) => !hasMetricsArgument(entry.command));
+    if (upgradable !== void 0) {
+      const upgraded = `${upgradable.command.trim()} --metrics ${metricsPath}`;
+      actions.push(replaceHookCommandAction({
+        target,
+        commandPointer: upgradable.commandPointer,
+        currentCommand: upgradable.command,
+        nextCommand: upgraded,
+        actionId: `harnesstrim-${harness.id}-metrics-${digestText(target.configPath).slice(7, 15)}`
+      }));
+      plannedHarnesses.push(harness.id);
+      continue;
+    }
+    if (existing.length > 0) {
+      diagnostics.push(diagnostic({
+        severity: "warning",
+        code: "harnesstrim-metrics-path-needs-review",
+        subject: harness.id,
+        message: `An existing HarnessTrim hook on ${harness.displayName} uses a different telemetry path or custom command and was left unchanged`,
+        path: target.configPath,
+        remediation: `Set its --metrics path to ${metricsPath}, or review the command before changing it`
+      }));
+      continue;
+    }
+    const actionId = `harnesstrim-${harness.id}-hook-${digestText(target.configPath).slice(7, 15)}`;
+    actions.push(appendCommandHookAction({
+      target,
+      providerId: HARNESSTRIM2,
+      actionId,
+      command,
+      explanation: `Register HarnessTrim after ${harness.displayName} Bash commands and record reductions in ${metricsPath}${codexActivationNote(harness.id)}`
+    }));
+    plannedHarnesses.push(harness.id);
+  }
   return {
     providerId: HARNESSTRIM2,
     desiredState: "configured",
     actions,
-    targetHarnesses: plannedHarnesses
+    diagnostics,
+    targetHarnesses: [...new Set(plannedHarnesses)]
+  };
+}
+function isHarnessTrimHookFor(command, harness) {
+  const match = HARNESSTRIM_HOOK_COMMAND.exec(command.trim());
+  return match?.[1]?.toLowerCase() === harness;
+}
+function hasMetricsArgument(command) {
+  return /(?:^|\s)--metrics(?:\s|=)/i.test(command);
+}
+function commandHasMetricsPath(command, metricsPath) {
+  const match = /(?:^|\s)--metrics(?:=|\s+)(?:"([^"]+)"|'([^']+)'|([^\s]+))/i.exec(command);
+  const observed = match?.[1] ?? match?.[2] ?? match?.[3];
+  return observed?.replaceAll("\\", "/") === metricsPath;
+}
+function matcherCoversFamily2(matcher, family) {
+  if (matcher === family)
+    return true;
+  try {
+    return new RegExp(matcher).test(family);
+  } catch {
+    return false;
+  }
+}
+function replaceHookCommandAction(input) {
+  return {
+    kind: "merge-json",
+    id: input.actionId,
+    riskClass: "reversible",
+    requiresNetwork: false,
+    requiresElevation: false,
+    affectedPaths: [input.target.configPath],
+    affectedProcesses: [],
+    preconditions: [
+      `${input.commandPointer} still contains the HarnessTrim command Token Harness inspected`
+    ],
+    postconditions: [
+      `${input.commandPointer} records HarnessTrim reductions to .harnesstrim/metrics.jsonl`
+    ],
+    rollbackData: "file-snapshot",
+    explanation: `Enable per-harness HarnessTrim telemetry for ${input.target.harness.displayName}${codexActivationNote(input.target.harnessId)}`,
+    path: input.target.configPath,
+    ownedPointers: [input.commandPointer],
+    operations: [
+      {
+        kind: "set",
+        pointer: input.commandPointer,
+        value: input.nextCommand,
+        expectedValueDigest: jsonValueDigest(input.currentCommand)
+      }
+    ],
+    createIfMissing: false
   };
 }
-var HARNESSTRIM2, CLAUDE2, HERMES2, CODEX2, PI2, SKILLS_UPSTREAM, RUNTIME_SKILL_DIGESTS_MINIMUM, SKILL_ARTIFACT_DIGESTS, SKILL_ARTIFACTS, OPENCODE2, MODE_CARRYING_HARNESSES, HOOK_COMMAND_PATTERN, PLUGIN_MODULE_PATTERN2, PI_EXTENSION_PATTERN, MANIFEST6, SKILLS_INSTALL, TESTED_UPSTREAM, TESTED_VERSIONS, SURFACE_ANCHORS, VERSION_PATTERN6, harnesstrimAdapter;
+function codexActivationNote(harness) {
+  return harness === CODEX3 ? ". Codex must enable and trust this hook in its native UI; Token Harness can register it but cannot grant trust" : "";
+}
+var HARNESSTRIM2, CLAUDE3, HERMES2, CODEX3, PI2, SKILLS_UPSTREAM, RUNTIME_SKILL_DIGESTS_MINIMUM, SKILL_ARTIFACT_DIGESTS, SKILL_ARTIFACTS, OPENCODE2, MODE_CARRYING_HARNESSES, HOOK_COMMAND_PATTERN, PLUGIN_MODULE_PATTERN2, PI_EXTENSION_PATTERN, MANIFEST6, SKILLS_INSTALL, TESTED_UPSTREAM, TESTED_VERSIONS, SURFACE_ANCHORS, VERSION_PATTERN6, HARNESSTRIM_HOOK_COMMAND, harnesstrimAdapter;
 var init_harnesstrim = __esm({
   "packages/adapters/dist/src/providers/harnesstrim.js"() {
     "use strict";
     init_src();
+    init_hook_plan();
     HARNESSTRIM2 = providerId("harnesstrim");
-    CLAUDE2 = harnessId("claude");
+    CLAUDE3 = harnessId("claude");
     HERMES2 = harnessId("hermes");
-    CODEX2 = harnessId("codex");
+    CODEX3 = harnessId("codex");
     PI2 = harnessId("pi");
-    SKILLS_UPSTREAM = "0.0.7";
+    SKILLS_UPSTREAM = "0.3.1";
     RUNTIME_SKILL_DIGESTS_MINIMUM = "0.2.0";
     SKILL_ARTIFACT_DIGESTS = {
       "compact-handoff/SKILL.md": "sha256:0efbf35581c559359e755b204778b64a289dab4d20dadc1cba3d5b5c995b5f01",
@@ -17452,7 +17819,7 @@ var init_harnesstrim = __esm({
         {
           capability: "shell.output.reduce",
           mode: "exclusive",
-          harnesses: [CLAUDE2, CODEX2],
+          harnesses: [CLAUDE3, CODEX3],
           // `HOOK_MATCHER = "Bash"` and `CODEX_HOOK_MATCHER = "^Bash$"`, per RFC 0003 §The table is an
           // intent. One surface each, and no selector narrows it.
           surfaces: [{ toolFamily: "Bash", interceptionPoint: "post-tool-use" }],
@@ -17482,14 +17849,14 @@ var init_harnesstrim = __esm({
       ],
       harnesses: [
         {
-          harness: CLAUDE2,
-          testedVersions: { minimum: "2.0.0", maximum: "2.1.212" },
-          verificationTier: "config-only"
+          harness: CLAUDE3,
+          testedVersions: { minimum: "2.1.274", maximum: "2.1.274" },
+          verificationTier: "canary"
         },
         {
-          harness: CODEX2,
-          testedVersions: { minimum: "0.146.0", maximum: "0.146.0" },
-          verificationTier: "config-only"
+          harness: CODEX3,
+          testedVersions: { minimum: "0.159.0", maximum: "0.159.0" },
+          verificationTier: "canary"
         },
         {
           harness: OPENCODE2,
@@ -17531,11 +17898,9 @@ var init_harnesstrim = __esm({
       /**
        * One review per harness — PLAN §15 item 46b.
        *
-       * Codex was observed at `0.1.0`: `harnesstrim install codex <dir> --apply --no-instructions`
-       * writes the same seven skill artifacts as the Claude invocation, byte for byte — the digests
-       * below are shared because the files are the same files — under `.codex/skills/` instead, and
-       * skips `AGENTS.md` exactly as the Claude one skips `CLAUDE.md`. What differs is the boundary and
-       * the protected paths, which is precisely why one review could not describe both.
+       * HarnessTrim 0.3.1 declares the same seven skill artifacts on Claude and Codex, byte for byte.
+       * The delegated invocation omits runtime hooks and instructions; Token Harness adds the
+       * versioned PostToolUse hook through the harness adapter and owns that exact JSON entry.
        *
        * OpenCode is absent on purpose. Its installer writes `.opencode/plugin/harnesstrim.ts` and
        * `.opencode/package.json` *and runs an npm install*, so the containment boundary would hold a
@@ -17570,13 +17935,14 @@ var init_harnesstrim = __esm({
         args: ["--no-instructions"]
       }
     };
-    TESTED_UPSTREAM = "0.2.1";
+    TESTED_UPSTREAM = "0.3.1";
     TESTED_VERSIONS = { minimum: "0.0.5", maximum: TESTED_UPSTREAM };
     SURFACE_ANCHORS = {
       "post-tool-use": "PostToolUse",
       "tool-execute-after": "tool.execute.after"
     };
     VERSION_PATTERN6 = /(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/;
+    HARNESSTRIM_HOOK_COMMAND = /^(?:"?[^"\n]*[\\/]?harnesstrim(?:\.cmd|\.exe)?"?|harnesstrim(?:\.cmd|\.exe)?)\s+hook\s+(claude|codex)(?:\s+(.*))?$/i;
     harnesstrimAdapter = {
       manifest: MANIFEST6,
       detect: detect6,
@@ -17590,7 +17956,7 @@ var init_harnesstrim = __esm({
 });
 
 // packages/adapters/dist/src/providers/rtk-plan.js
-function hookListPointer(eventName) {
+function hookListPointer2(eventName) {
   return `hooks.${eventName.replace(/\./g, "\\.")}`;
 }
 function hookEntryFor(harnessId2, matcher, restoreNativeHookOnUninstall = false) {
@@ -17607,7 +17973,7 @@ function hookEntryFor(harnessId2, matcher, restoreNativeHookOnUninstall = false)
 function hookActivationNote(target) {
   return target.harness.id === "codex" ? ". After applying, manually enable and trust this hook in Codex; Token Harness writes hooks.json but cannot activate the hook or grant trust" : "";
 }
-function matcherCoversFamily2(matcher, family) {
+function matcherCoversFamily3(matcher, family) {
   if (matcher === family)
     return true;
   try {
@@ -17637,12 +18003,13 @@ function planTargets(context, request) {
       scope: owned.scope,
       harness,
       eventName: point.eventName,
+      matcher: hookMatcherForFamily(harness, owned.scope.toolFamily),
       configPath
     });
   }
   if (context.facts.os === "windows") {
     for (const target of [...targets.values()]) {
-      if (target.harness.id !== CLAUDE3 || target.scope.toolFamily !== BASH)
+      if (target.harness.id !== CLAUDE4 || target.scope.toolFamily !== BASH)
         continue;
       if (!target.harness.toolFamilies.some((family) => family.id === POWERSHELL))
         continue;
@@ -17651,14 +18018,15 @@ function planTargets(context, request) {
         continue;
       targets.set(key, {
         ...target,
-        scope: { ...target.scope, toolFamily: POWERSHELL }
+        scope: { ...target.scope, toolFamily: POWERSHELL },
+        matcher: hookMatcherForFamily(target.harness, POWERSHELL)
       });
     }
   }
   return [...targets.values()];
 }
 function alreadyRegistered(context, target, allowRegexCoverage) {
-  return context.harnessConfigs.some((config) => config.harnessId === target.harness.id && config.configPath === target.configPath && config.interceptionPoints.includes(target.scope.interceptionPoint) && config.matchers.some((matcher) => allowRegexCoverage ? matcherCoversFamily2(matcher, target.scope.toolFamily) : matcher === target.scope.toolFamily) && (config.hookCommands ?? []).some((entry) => entry.eventName === target.eventName && entry.matcher !== null && (allowRegexCoverage ? matcherCoversFamily2(entry.matcher, target.scope.toolFamily) : entry.matcher === target.scope.toolFamily) && isRtkAttributionCommand(entry.command, target.harness.id)));
+  return context.harnessConfigs.some((config) => config.harnessId === target.harness.id && config.configPath === target.configPath && config.interceptionPoints.includes(target.scope.interceptionPoint) && config.matchers.some((matcher) => allowRegexCoverage ? matcherCoversFamily3(matcher, target.scope.toolFamily) : matcher === target.scope.toolFamily) && (config.hookCommands ?? []).some((entry) => entry.eventName === target.eventName && entry.matcher !== null && (allowRegexCoverage ? matcherCoversFamily3(entry.matcher, target.scope.toolFamily) : entry.matcher === target.matcher) && isRtkAttributionCommand(entry.command, target.harness.id)));
 }
 function isRtkAttributionCommand(command, harness) {
   return new RegExp(`^token-harness __internal-rtk-hook ${harness}(?: --restore-rtk)?$`, "i").test(command.trim());
@@ -17671,7 +18039,7 @@ function deterministicId(parts) {
   return digest.slice(digest.indexOf(":") + 1, digest.indexOf(":") + 9);
 }
 function hookAction(target, entry) {
-  const pointer = hookListPointer(target.eventName);
+  const pointer = hookListPointer2(target.eventName);
   return {
     kind: "merge-json",
     id: deterministicId([
@@ -17773,7 +18141,7 @@ function restoreNativeHookAction(target, current) {
   };
 }
 function removalAction(target, entry) {
-  const pointer = hookListPointer(target.eventName);
+  const pointer = hookListPointer2(target.eventName);
   const reverses = deterministicId([
     "rtk",
     "hook",
@@ -17857,13 +18225,13 @@ function buildRtkPlan(input) {
   const targetHarnesses = [...new Set(targets.map((target) => target.harness.id))];
   if (request.desiredState === "absent") {
     for (const target of targets) {
-      const existing = context.harnessConfigs.flatMap((config) => config.hookCommands ?? []).find((entry) => entry.eventName === target.eventName && entry.matcher === target.scope.toolFamily && isRtkAttributionCommand(entry.command, target.harness.id));
+      const existing = context.harnessConfigs.flatMap((config) => config.hookCommands ?? []).find((entry) => entry.eventName === target.eventName && entry.matcher === target.matcher && isRtkAttributionCommand(entry.command, target.harness.id));
       if (existing === void 0)
         continue;
       if (existing.command.endsWith(" --restore-rtk")) {
         actions.push(restoreNativeHookAction(target, existing));
       } else {
-        actions.push(removalAction(target, hookEntryFor(target.harness.id, target.scope.toolFamily)));
+        actions.push(removalAction(target, hookEntryFor(target.harness.id, target.matcher)));
       }
     }
     return {
@@ -17899,7 +18267,7 @@ function buildRtkPlan(input) {
   for (const target of targets) {
     if (alreadyRegistered(context, target, true))
       continue;
-    const matchingEntries = context.harnessConfigs.filter((config) => config.harnessId === target.harness.id && config.configPath === target.configPath && config.interceptionPoints.includes(target.scope.interceptionPoint)).flatMap((config) => config.hookCommands ?? []).filter((entry) => entry.eventName === target.eventName && entry.matcher !== null && matcherCoversFamily2(entry.matcher, target.scope.toolFamily) && input.identifiesCommand(entry.command));
+    const matchingEntries = context.harnessConfigs.filter((config) => config.harnessId === target.harness.id && config.configPath === target.configPath && config.interceptionPoints.includes(target.scope.interceptionPoint)).flatMap((config) => config.hookCommands ?? []).filter((entry) => entry.eventName === target.eventName && entry.matcher !== null && matcherCoversFamily3(entry.matcher, target.scope.toolFamily) && input.identifiesCommand(entry.command));
     const native = matchingEntries.find((entry) => isCanonicalNativeHook(entry.command, target.harness.id));
     if (native !== void 0) {
       if (!migratedPointers.has(native.commandPointer)) {
@@ -17931,7 +18299,7 @@ function buildRtkPlan(input) {
       }));
       continue;
     }
-    actions.push(hookAction(target, hookEntryFor(target.harness.id, target.scope.toolFamily)));
+    actions.push(hookAction(target, hookEntryFor(target.harness.id, target.matcher)));
   }
   return {
     providerId: "rtk",
@@ -17941,14 +18309,15 @@ function buildRtkPlan(input) {
     targetHarnesses: actions.length === 0 ? [] : targetHarnesses
   };
 }
-var RTK_HOOK_PROXY_COMMAND, RTK_NATIVE_HOOK_PREFIX, CLAUDE3, BASH, POWERSHELL;
+var RTK_HOOK_PROXY_COMMAND, RTK_NATIVE_HOOK_PREFIX, CLAUDE4, BASH, POWERSHELL;
 var init_rtk_plan = __esm({
   "packages/adapters/dist/src/providers/rtk-plan.js"() {
     "use strict";
     init_src();
+    init_hook_plan();
     RTK_HOOK_PROXY_COMMAND = "token-harness __internal-rtk-hook";
     RTK_NATIVE_HOOK_PREFIX = "rtk hook";
-    CLAUDE3 = "claude";
+    CLAUDE4 = "claude";
     BASH = "Bash";
     POWERSHELL = "PowerShell";
   }
@@ -18051,12 +18420,12 @@ async function detect7(context) {
     }));
   }
   const codexHookSupported = version3.version === RTK_CODEX_HOOK_VERSION;
-  const codexConfiguredWithoutHookSupport = configured.includes(CODEX3) && !codexHookSupported;
+  const codexConfiguredWithoutHookSupport = configured.includes(CODEX4) && !codexHookSupported;
   if (codexConfiguredWithoutHookSupport) {
     warnings.push(diagnostic({
       severity: "error",
       code: "rtk-codex-hook-unsupported",
-      subject: CODEX3,
+      subject: CODEX4,
       message: `RTK ${String(version3.version)} does not provide the Codex hook; its configuration entry cannot capture commands`,
       remediation: `Upgrade RTK to ${RTK_CODEX_HOOK_VERSION}, then refresh and apply the attribution plan`
     }));
@@ -18106,7 +18475,7 @@ async function detect7(context) {
      * its integration is a plugin module installed by `rtk init -g --opencode`, which this build
      * deliberately does not delegate without a reviewed write set.
      */
-    assignableHarnesses: version3.version === null || codexHookSupported ? [CLAUDE4, CODEX3] : [CLAUDE4],
+    assignableHarnesses: version3.version === null || codexHookSupported ? [CLAUDE5, CODEX4] : [CLAUDE5],
     evidence: evidenceItems,
     warnings
   };
@@ -18124,7 +18493,7 @@ async function verify7(context) {
     remediation: version3.version === null ? "Install RTK, or add it to PATH" : null
   });
   const configured = harnessesWiredToRtk(context.harnessConfigs);
-  const configuredSupported = configured.filter((harness) => harness === CLAUDE4 || harness === CODEX3 && version3.version === RTK_CODEX_HOOK_VERSION);
+  const configuredSupported = configured.filter((harness) => harness === CLAUDE5 || harness === CODEX4 && version3.version === RTK_CODEX_HOOK_VERSION);
   checks.push({
     id: "hook-registered",
     status: configuredSupported.length > 0 ? "pass" : configured.length > 0 ? "fail" : "not-exercised",
@@ -18138,8 +18507,8 @@ async function verify7(context) {
   for (const harness of TRACKED_HARNESSES) {
     if (!configured.includes(harness))
       continue;
-    const label = harness === CLAUDE4 ? "Claude Code" : "Codex";
-    const supported = harness !== CODEX3 || version3.version === RTK_CODEX_HOOK_VERSION;
+    const label = harness === CLAUDE5 ? "Claude Code" : "Codex";
+    const supported = harness !== CODEX4 || version3.version === RTK_CODEX_HOOK_VERSION;
     if (!supported) {
       checks.push({
         id: `rtk-attribution-${harness}`,
@@ -18566,17 +18935,17 @@ async function plan2(context, request) {
     hookProxyAvailable
   });
 }
-var RTK2, CLAUDE4, CODEX3, OPENCODE3, TRACKED_HARNESSES, RTK_CODEX_HOOK_VERSION, MANIFEST7, TESTED_VERSIONS2, VERSION_PATTERN7, HOOK_COMMAND_PATTERN2, PLUGIN_MODULE_PATTERN3, HARNESS_ACTIVITY_QUERY, STALE_RECEIPT_DAYS, HISTORY_QUERY, GENERATION_QUERY, IMPORT_BATCH_SIZE, SOURCE_LABEL, rtkAdapter;
+var RTK2, CLAUDE5, CODEX4, OPENCODE3, TRACKED_HARNESSES, RTK_CODEX_HOOK_VERSION, MANIFEST7, TESTED_VERSIONS2, VERSION_PATTERN7, HOOK_COMMAND_PATTERN2, PLUGIN_MODULE_PATTERN3, HARNESS_ACTIVITY_QUERY, STALE_RECEIPT_DAYS, HISTORY_QUERY, GENERATION_QUERY, IMPORT_BATCH_SIZE, SOURCE_LABEL, rtkAdapter;
 var init_rtk = __esm({
   "packages/adapters/dist/src/providers/rtk.js"() {
     "use strict";
     init_src();
     init_rtk_plan();
     RTK2 = providerId("rtk");
-    CLAUDE4 = harnessId("claude");
-    CODEX3 = harnessId("codex");
+    CLAUDE5 = harnessId("claude");
+    CODEX4 = harnessId("codex");
     OPENCODE3 = harnessId("opencode");
-    TRACKED_HARNESSES = [CLAUDE4, CODEX3];
+    TRACKED_HARNESSES = [CLAUDE5, CODEX4];
     RTK_CODEX_HOOK_VERSION = "0.50.0";
     MANIFEST7 = {
       schemaVersion: MANIFEST_SCHEMA_VERSION,
@@ -18590,7 +18959,7 @@ var init_rtk = __esm({
         {
           capability: "shell.command.rewrite",
           mode: "exclusive",
-          harnesses: [CLAUDE4],
+          harnesses: [CLAUDE5],
           // The portable resolver surface remains Bash. Windows PowerShell coverage is added by
           // the planner only on Windows, because ProviderManifest capabilities are not platform-scoped.
           // The native processor and that Windows-only plan path are covered by the live fixture below.
@@ -18603,7 +18972,7 @@ var init_rtk = __esm({
         {
           capability: "shell.output.reduce",
           mode: "exclusive",
-          harnesses: [CLAUDE4],
+          harnesses: [CLAUDE5],
           // Same portable Bash surface. On Windows the planner adds PowerShell as a platform-only
           // companion matcher; the live fixture below proves the same native processor handles both.
           surfaces: [{ toolFamily: "Bash", interceptionPoint: "pre-tool-use" }],
@@ -18622,7 +18991,7 @@ var init_rtk = __esm({
         {
           capability: "shell.command.rewrite",
           mode: "exclusive",
-          harnesses: [CODEX3],
+          harnesses: [CODEX4],
           surfaces: [{ toolFamily: "Bash", interceptionPoint: "pre-tool-use" }],
           evidence: {
             sourceReference: "docs/spikes/rtk-codex-upstream-contract.md",
@@ -18632,7 +19001,7 @@ var init_rtk = __esm({
         {
           capability: "shell.output.reduce",
           mode: "exclusive",
-          harnesses: [CODEX3],
+          harnesses: [CODEX4],
           surfaces: [{ toolFamily: "Bash", interceptionPoint: "pre-tool-use" }],
           evidence: {
             sourceReference: "docs/spikes/rtk-codex-upstream-contract.md",
@@ -18691,15 +19060,14 @@ var init_rtk = __esm({
       ],
       harnesses: [
         {
-          harness: CLAUDE4,
-          testedVersions: { minimum: "2.0.0", maximum: "2.1.251" },
+          harness: CLAUDE5,
+          testedVersions: { minimum: "2.1.274", maximum: "2.1.274" },
           verificationTier: "canary"
         },
         {
-          harness: CODEX3,
-          // RTK added its native Codex PreToolUse rewriter in 0.50.0. Earlier releases only wrote
-          // prompt instructions; a hooks.json entry alone did not activate it.
-          testedVersions: { minimum: "0.146.0", maximum: "0.146.0" },
+          harness: CODEX4,
+          // RTK 0.50.0's native hook was exercised against the installed Codex 0.159.0 schema.
+          testedVersions: { minimum: "0.159.0", maximum: "0.159.0" },
           verificationTier: "canary"
         },
         {
@@ -20206,7 +20574,7 @@ async function mcptoonDetection(context) {
   const observation = await observeMcptoonManagedRuntime(context);
   const configuredHarnesses = [];
   if (observation.ready) {
-    for (const harness of [CLAUDE5, CODEX4]) {
+    for (const harness of [CLAUDE6, CODEX5]) {
       const verification = await verifyMcptoonManagedActivation(context, harness);
       if (verification.state === "verified")
         configuredHarnesses.push(harness);
@@ -20239,7 +20607,7 @@ async function mcptoonDetection(context) {
     unmanagedHarnessesConfigured: [],
     supportsUnmanagedHarnesses: false,
     managedByTokenHarness: false,
-    assignableHarnesses: observation.ready || canInstall ? [CLAUDE5, CODEX4] : [],
+    assignableHarnesses: observation.ready || canInstall ? [CLAUDE6, CODEX5] : [],
     evidence: [],
     warnings
   };
@@ -20248,7 +20616,7 @@ async function gitnexusDetection(context) {
   const observation = await observeGitNexusManagedRuntime(context);
   const configuredHarnesses = [];
   if (observation.ready) {
-    for (const harness of [CLAUDE5, CODEX4]) {
+    for (const harness of [CLAUDE6, CODEX5]) {
       const verification = await verifyGitNexusManagedMcpActivation(context, harness);
       if (verification.state === "verified")
         configuredHarnesses.push(harness);
@@ -20281,7 +20649,7 @@ async function gitnexusDetection(context) {
     unmanagedHarnessesConfigured: [],
     supportsUnmanagedHarnesses: false,
     managedByTokenHarness: false,
-    assignableHarnesses: observation.ready || canInstall ? [CLAUDE5, CODEX4] : [],
+    assignableHarnesses: observation.ready || canInstall ? [CLAUDE6, CODEX5] : [],
     evidence: [],
     warnings
   };
@@ -20289,7 +20657,7 @@ async function gitnexusDetection(context) {
 async function mcptoonVerify(context) {
   const checks = [];
   let achieved = null;
-  for (const harness of [CLAUDE5, CODEX4]) {
+  for (const harness of [CLAUDE6, CODEX5]) {
     const result6 = await verifyMcptoonManagedActivation(context, harness);
     if (result6.state === "verified")
       achieved = "config-only";
@@ -20316,7 +20684,7 @@ async function mcptoonVerify(context) {
 async function gitnexusVerify(context) {
   const checks = [];
   let achieved = null;
-  for (const harness of [CLAUDE5, CODEX4]) {
+  for (const harness of [CLAUDE6, CODEX5]) {
     const result6 = await verifyGitNexusManagedMcpActivation(context, harness);
     if (result6.state === "verified")
       achieved = "config-only";
@@ -20355,7 +20723,7 @@ async function mcptoonPlan(context, request) {
   const actions = [];
   const targets = [];
   for (const harness of request.harnesses.map((item) => item.id)) {
-    if (harness !== CLAUDE5 && harness !== CODEX4)
+    if (harness !== CLAUDE6 && harness !== CODEX5)
       continue;
     const plan6 = await planMcptoonManagedActivation(context, harness);
     if (plan6.actions.length === 0)
@@ -20382,7 +20750,7 @@ async function gitnexusPlan(context, request) {
   const actions = [];
   const targets = [];
   for (const harness of request.harnesses.map((item) => item.id)) {
-    if (harness !== CLAUDE5 && harness !== CODEX4)
+    if (harness !== CLAUDE6 && harness !== CODEX5)
       continue;
     const plan6 = await planGitNexusManagedMcpActivation(context, harness);
     if (plan6.actions.length === 0)
@@ -20397,7 +20765,7 @@ async function gitnexusPlan(context, request) {
     targetHarnesses: [...new Set(targets)]
   };
 }
-var MCPTOON, GITNEXUS, HEADROOM, CLAUDE5, CODEX4, MCPTOON_MANIFEST, GITNEXUS_MANIFEST, HEADROOM_MANIFEST, mcptoonAdapter, gitnexusAdapter;
+var MCPTOON, GITNEXUS, HEADROOM, CLAUDE6, CODEX5, MCPTOON_MANIFEST, GITNEXUS_MANIFEST, HEADROOM_MANIFEST, mcptoonAdapter, gitnexusAdapter;
 var init_managed_optimization_tools = __esm({
   "packages/adapters/dist/src/providers/managed-optimization-tools.js"() {
     "use strict";
@@ -20410,8 +20778,8 @@ var init_managed_optimization_tools = __esm({
     MCPTOON = providerId("mcptoon");
     GITNEXUS = providerId("gitnexus");
     HEADROOM = providerId("headroom");
-    CLAUDE5 = harnessId("claude");
-    CODEX4 = harnessId("codex");
+    CLAUDE6 = harnessId("claude");
+    CODEX5 = harnessId("codex");
     MCPTOON_MANIFEST = {
       schemaVersion: MANIFEST_SCHEMA_VERSION,
       id: MCPTOON,
@@ -20424,12 +20792,12 @@ var init_managed_optimization_tools = __esm({
       platforms: platforms(),
       harnesses: [
         {
-          harness: CLAUDE5,
+          harness: CLAUDE6,
           testedVersions: { minimum: "2.1.269", maximum: "2.1.269" },
           verificationTier: "config-only"
         },
         {
-          harness: CODEX4,
+          harness: CODEX5,
           testedVersions: { minimum: "0.152.1", maximum: "0.153.0" },
           verificationTier: "config-only"
         }
@@ -20463,12 +20831,12 @@ var init_managed_optimization_tools = __esm({
       platforms: platforms(),
       harnesses: [
         {
-          harness: CLAUDE5,
+          harness: CLAUDE6,
           testedVersions: { minimum: "2.1.269", maximum: "2.1.269" },
           verificationTier: "config-only"
         },
         {
-          harness: CODEX4,
+          harness: CODEX5,
           testedVersions: { minimum: "0.153.0", maximum: "0.153.0" },
           verificationTier: "config-only"
         }
@@ -20542,7 +20910,7 @@ async function plan3(context, request) {
   const actions = [];
   const targets = [];
   for (const harness of request.harnesses.map((item) => item.id)) {
-    if (harness !== CLAUDE6 && harness !== CODEX5)
+    if (harness !== CLAUDE7 && harness !== CODEX6)
       continue;
     const target = gitnexusOwnedArtifact(context, harness);
     if (target === null)
@@ -20559,15 +20927,15 @@ async function plan3(context, request) {
     targetHarnesses: [...new Set(targets)]
   };
 }
-var CLAUDE6, CODEX5, gitnexusManagedProviderAdapter;
+var CLAUDE7, CODEX6, gitnexusManagedProviderAdapter;
 var init_gitnexus_provider = __esm({
   "packages/adapters/dist/src/providers/gitnexus-provider.js"() {
     "use strict";
     init_src();
     init_managed_optimization_tools();
     init_gitnexus_managed();
-    CLAUDE6 = harnessId("claude");
-    CODEX5 = harnessId("codex");
+    CLAUDE7 = harnessId("claude");
+    CODEX6 = harnessId("codex");
     gitnexusManagedProviderAdapter = {
       ...gitnexusAdapter,
       plan: plan3
@@ -21085,7 +21453,7 @@ async function detect8(context) {
   const runtime = await headroomManagedMcpRuntime(context);
   const configuredHarnesses = [];
   if (runtime.ok) {
-    for (const harness of [CLAUDE7, CODEX6]) {
+    for (const harness of [CLAUDE8, CODEX7]) {
       const verification = await verifyHeadroomManagedMcpActivation(context, harness);
       if (verification.state === "verified")
         configuredHarnesses.push(harness);
@@ -21124,7 +21492,7 @@ async function detect8(context) {
     unmanagedHarnessesConfigured: [],
     supportsUnmanagedHarnesses: false,
     managedByTokenHarness: false,
-    assignableHarnesses: runtime.ok || canInstall ? [CLAUDE7, CODEX6] : [],
+    assignableHarnesses: runtime.ok || canInstall ? [CLAUDE8, CODEX7] : [],
     evidence: [],
     warnings
   };
@@ -21156,7 +21524,7 @@ function dedupe(actions) {
 }
 async function plan4(context, request) {
   if (request.desiredState === "absent") {
-    const targets = request.harnesses.map((item) => item.id).filter((id) => id === CLAUDE7 || id === CODEX6);
+    const targets = request.harnesses.map((item) => item.id).filter((id) => id === CLAUDE8 || id === CODEX7);
     return {
       providerId: HEADROOM2,
       desiredState: "absent",
@@ -21167,7 +21535,7 @@ async function plan4(context, request) {
   const actions = [];
   const targetHarnesses = [];
   for (const harness of request.harnesses.map((item) => item.id)) {
-    if (harness !== CLAUDE7 && harness !== CODEX6)
+    if (harness !== CLAUDE8 && harness !== CODEX7)
       continue;
     const activation = await planHeadroomManagedMcpActivation(context, harness);
     if (activation.actions.length === 0)
@@ -21185,7 +21553,7 @@ async function plan4(context, request) {
 async function verify8(context) {
   const checks = [];
   let achieved = null;
-  for (const harness of [CLAUDE7, CODEX6]) {
+  for (const harness of [CLAUDE8, CODEX7]) {
     const result6 = await verifyHeadroomManagedMcpActivation(context, harness);
     if (result6.state === "verified")
       achieved = "config-only";
@@ -21220,7 +21588,7 @@ function unavailableMetrics2() {
     diagnostics: []
   };
 }
-var HEADROOM2, CLAUDE7, CODEX6, HEADROOM_MANIFEST2, headroomManagedProviderAdapter;
+var HEADROOM2, CLAUDE8, CODEX7, HEADROOM_MANIFEST2, headroomManagedProviderAdapter;
 var init_headroom_provider = __esm({
   "packages/adapters/dist/src/providers/headroom-provider.js"() {
     "use strict";
@@ -21228,8 +21596,8 @@ var init_headroom_provider = __esm({
     init_headroom_candidate();
     init_headroom_managed();
     HEADROOM2 = providerId("headroom");
-    CLAUDE7 = harnessId("claude");
-    CODEX6 = harnessId("codex");
+    CLAUDE8 = harnessId("claude");
+    CODEX7 = harnessId("codex");
     HEADROOM_MANIFEST2 = {
       schemaVersion: MANIFEST_SCHEMA_VERSION,
       id: HEADROOM2,
@@ -21246,12 +21614,12 @@ var init_headroom_provider = __esm({
       ],
       harnesses: [
         {
-          harness: CLAUDE7,
+          harness: CLAUDE8,
           testedVersions: { minimum: "2.1.269", maximum: "2.1.269" },
           verificationTier: "config-only"
         },
         {
-          harness: CODEX6,
+          harness: CODEX7,
           testedVersions: { minimum: "0.153.0", maximum: "0.153.0" },
           verificationTier: "config-only"
         }
@@ -21285,7 +21653,7 @@ var init_headroom_provider = __esm({
 
 // packages/adapters/dist/src/providers/mcptoon-provider.js
 function removalAction3(context, harness) {
-  if (harness === CLAUDE8) {
+  if (harness === CLAUDE9) {
     const path = context.fs.join(context.paths.home, ".claude", "skills", "mcptoon", "SKILL.md");
     const target = {
       kind: "owned-file",
@@ -21310,7 +21678,7 @@ function removalAction3(context, harness) {
       target
     };
   }
-  if (harness === CODEX7) {
+  if (harness === CODEX8) {
     const path = context.fs.join(context.projectRoot, "AGENTS.md");
     const target = {
       kind: "owned-marker-block",
@@ -21349,18 +21717,18 @@ async function plan5(context, request) {
     providerId: mcptoonAdapter.manifest.id,
     desiredState: "absent",
     actions,
-    targetHarnesses: request.harnesses.map((item) => item.id).filter((id) => id === CLAUDE8 || id === CODEX7)
+    targetHarnesses: request.harnesses.map((item) => item.id).filter((id) => id === CLAUDE9 || id === CODEX8)
   };
 }
-var CLAUDE8, CODEX7, mcptoonManagedProviderAdapter;
+var CLAUDE9, CODEX8, mcptoonManagedProviderAdapter;
 var init_mcptoon_provider = __esm({
   "packages/adapters/dist/src/providers/mcptoon-provider.js"() {
     "use strict";
     init_src();
     init_managed_optimization_tools();
     init_mcptoon_managed();
-    CLAUDE8 = harnessId("claude");
-    CODEX7 = harnessId("codex");
+    CLAUDE9 = harnessId("claude");
+    CODEX8 = harnessId("codex");
     mcptoonManagedProviderAdapter = {
       ...mcptoonAdapter,
       plan: plan5
@@ -21489,7 +21857,19 @@ function parseHarnessTrimReceiptEnvelope(line) {
   if (schemaVersion === 1 && (typeof record6["eventId"] !== "string" || record6["eventId"].length === 0)) {
     return null;
   }
-  return { ts: record6["ts"], harness: record6["harness"] };
+  return {
+    ts: record6["ts"],
+    harness: record6["harness"],
+    beforeChars: record6["beforeChars"],
+    afterChars: record6["afterChars"],
+    changed: typeof record6["changed"] === "boolean" ? record6["changed"] : null,
+    reductionFailed: record6["reductionFailed"] === true
+  };
+}
+function provesHarnessTrimReduction(event) {
+  return !event.reductionFailed && event.afterChars < event.beforeChars && // Native receipts explicitly mark pass-throughs. Legacy receipts predate this bit, so a
+  // strictly smaller after-size remains the only available evidence that the hook reduced it.
+  event.changed !== false;
 }
 async function harnessTrimReceiptFor(context, harnessId2) {
   for (const path of metricsLocations(context)) {
@@ -21498,9 +21878,15 @@ async function harnessTrimReceiptFor(context, harnessId2) {
       continue;
     const text3 = new TextDecoder().decode(await context.fs.readFile(path));
     const matches = text3.split("\n").filter((line) => line.trim() !== "").map(parseHarnessTrimReceiptEnvelope).filter((event) => event !== null && event.harness === harnessId2);
-    const latest = matches.at(-1);
-    if (latest !== void 0) {
-      return { observedAt: latest.ts, operations: matches.length, source: path };
+    const latestAttempt = matches.at(-1);
+    if (latestAttempt !== void 0) {
+      const reductions = matches.filter(provesHarnessTrimReduction);
+      return {
+        observedAt: latestAttempt.ts,
+        operations: reductions.length,
+        attempts: matches.length,
+        source: path
+      };
     }
   }
   return null;
@@ -21545,10 +21931,19 @@ function scopeCanaryCheck(check, input) {
         remediation: input.runtimeConfigured ? "Enable telemetry on this runtime integration and use it on an output it can reduce." : "Skills or instructions alone do not write reduction telemetry; a compatible measurement path is required."
       };
     }
+    if (input.receipt.operations === 0) {
+      return {
+        ...check,
+        status: "info",
+        summary: `HarnessTrim observed ${String(input.receipt.attempts ?? 0)} ${input.harnessId} outputs, but none was reduced; latest attempt ${input.receipt.observedAt}`,
+        achievedTier: null,
+        remediation: "Run a canary that produces output the installed HarnessTrim reducer can shorten, then verify again."
+      };
+    }
     return {
       ...check,
       status: "pass",
-      summary: `${String(input.receipt.operations)} reductions recorded for ${input.harnessId}, most recently ${input.receipt.observedAt}`,
+      summary: `${String(input.receipt.operations)} reductions recorded for ${input.harnessId} from ${String(input.receipt.attempts ?? input.receipt.operations)} observed outputs, most recently ${input.receipt.observedAt}`,
       achievedTier: "canary"
     };
   }
@@ -21597,9 +21992,13 @@ async function scopeProviderVerificationToHarness(context, verification, harness
   const harnessTrim = verification.providerId === HARNESSTRIM4;
   const runtimeConfigured = harnessTrim ? harnessesWiredToHarnessTrim(context.harnessConfigs).includes(harnessId2) : configured;
   const attributableByExclusion = configured && configuredHarnesses.length === 1 && configuredHarnesses[0] === harnessId2;
-  const receipt = !configured ? null : harnessTrim ? await harnessTrimReceiptFor(context, harnessId2) : attributableByExclusion ? verification.receipt : null;
+  const receipt = !configured ? null : harnessTrim ? await harnessTrimReceiptFor(context, harnessId2) : verification.receipt?.harnessId !== void 0 ? verification.receipt.harnessId === harnessId2 ? verification.receipt : null : attributableByExclusion ? verification.receipt : null;
   const providerHasAttributableReceipt = harnessTrim || attributableByExclusion;
-  const checks = verification.checks.map((check) => scopeCanaryCheck(scopeIntegrationCheck(scopeHookCheck(check, harnessId2, harnessTrim ? runtimeConfigured : configured), { harnessId: harnessId2, configured, runtimeConfigured }), {
+  const scopedSourceChecks = verification.providerId === RTK4 ? verification.checks.filter((check) => {
+    const match = /^(?:rtk-attribution|receipt-freshness)-(claude|codex)$/.exec(check.id);
+    return match === null || match[1] === harnessId2;
+  }) : verification.checks;
+  const checks = scopedSourceChecks.map((check) => scopeCanaryCheck(scopeIntegrationCheck(scopeHookCheck(check, harnessId2, harnessTrim ? runtimeConfigured : configured), { harnessId: harnessId2, configured, runtimeConfigured }), {
     harnessId: harnessId2,
     configured,
     runtimeConfigured,
@@ -21614,13 +22013,14 @@ async function scopeProviderVerificationToHarness(context, verification, harness
     checks
   };
 }
-var HARNESSTRIM4;
+var HARNESSTRIM4, RTK4;
 var init_harness_verification = __esm({
   "packages/adapters/dist/src/providers/harness-verification.js"() {
     "use strict";
     init_src();
     init_harnesstrim();
     HARNESSTRIM4 = providerId("harnesstrim");
+    RTK4 = providerId("rtk");
   }
 });
 
@@ -21787,15 +22187,15 @@ async function runBudget(context) {
     diagnostics: report.harnesses.flatMap((item) => item.diagnostics)
   });
 }
-var CLAUDE9, CODEX8, BUDGET_HARNESSES;
+var CLAUDE10, CODEX9, BUDGET_HARNESSES;
 var init_budget2 = __esm({
   "apps/cli/dist/src/commands/budget.js"() {
     "use strict";
     init_src3();
     init_src();
-    CLAUDE9 = harnessId("claude");
-    CODEX8 = harnessId("codex");
-    BUDGET_HARNESSES = /* @__PURE__ */ new Set([CLAUDE9, CODEX8]);
+    CLAUDE10 = harnessId("claude");
+    CODEX9 = harnessId("codex");
+    BUDGET_HARNESSES = /* @__PURE__ */ new Set([CLAUDE10, CODEX9]);
   }
 });
 
@@ -23883,12 +24283,12 @@ var init_context_owner_candidates = __esm({
 });
 
 // apps/cli/dist/src/commands/context-cost.js
-function nativeToolDeferral(harness, version3, verdict) {
-  if (harness !== CODEX9)
+function nativeToolDeferral(harness, version3) {
+  if (harness !== CODEX10)
     return null;
-  if (version3 === "0.146.0" && verdict === "in-range") {
+  if (version3 === "0.146.0") {
     return {
-      harnessId: CODEX9,
+      harnessId: CODEX10,
       mechanism: "native-tool-search",
       state: "available",
       scope: "mcp-tools",
@@ -23897,7 +24297,7 @@ function nativeToolDeferral(harness, version3, verdict) {
     };
   }
   return {
-    harnessId: CODEX9,
+    harnessId: CODEX10,
     mechanism: "native-tool-search",
     state: "unknown",
     scope: "mcp-tools",
@@ -24014,7 +24414,7 @@ async function codexInstructionFiles(context, observation) {
     if (selected === null)
       continue;
     const item = await fileObservation(context, {
-      harnessId: CODEX9,
+      harnessId: CODEX10,
       path: selected,
       scope: "project",
       loadedBytes: remaining2
@@ -24046,7 +24446,7 @@ async function claudeInstructionFiles(context) {
   const results = [];
   for (const candidate of candidates) {
     const item = await fileObservation(context, {
-      harnessId: CLAUDE10,
+      harnessId: CLAUDE11,
       path: candidate.path,
       scope: candidate.scope,
       loadedBytes: null
@@ -24113,16 +24513,16 @@ async function runContext(context) {
       continue;
     }
     const observation = await adapter.observeContext(harnessContext, report.observedAt);
-    const deferral = nativeToolDeferral(adapter.manifest.id, detection.version, detection.versionVerdict);
+    const deferral = nativeToolDeferral(adapter.manifest.id, detection.version);
     if (deferral !== null)
       observation.toolDeferral = deferral;
     report.harnesses.push(observation);
   }
-  const codex = report.harnesses.find((item) => item.harnessId === CODEX9);
+  const codex = report.harnesses.find((item) => item.harnessId === CODEX10);
   if (codex !== void 0 && codex.state !== "absent") {
     report.instructions.push(...await codexInstructionFiles(context, codex));
   }
-  const claude = report.harnesses.find((item) => item.harnessId === CLAUDE10);
+  const claude = report.harnesses.find((item) => item.harnessId === CLAUDE11);
   if (claude !== void 0 && claude.state !== "absent") {
     report.instructions.push(...await claudeInstructionFiles(context));
   }
@@ -24174,16 +24574,16 @@ async function runContext(context) {
     ]
   });
 }
-var CLAUDE10, CODEX9, CONTEXT_HARNESSES;
+var CLAUDE11, CODEX10, CONTEXT_HARNESSES;
 var init_context_cost2 = __esm({
   "apps/cli/dist/src/commands/context-cost.js"() {
     "use strict";
     init_src3();
     init_src();
     init_context_owner_candidates();
-    CLAUDE10 = harnessId("claude");
-    CODEX9 = harnessId("codex");
-    CONTEXT_HARNESSES = /* @__PURE__ */ new Set([CLAUDE10, CODEX9]);
+    CLAUDE11 = harnessId("claude");
+    CODEX10 = harnessId("codex");
+    CONTEXT_HARNESSES = /* @__PURE__ */ new Set([CLAUDE11, CODEX10]);
   }
 });
 
@@ -24204,7 +24604,7 @@ function stringArray(value3) {
   return array(value3).filter((item) => typeof item === "string");
 }
 function normalizedHarness(value3) {
-  return value3 === "claude" ? CLAUDE11 : value3 === "codex" ? CODEX10 : null;
+  return value3 === "claude" ? CLAUDE12 : value3 === "codex" ? CODEX11 : null;
 }
 function totals(row2) {
   const inputTokens = number(row2["inputTokens"]);
@@ -24512,7 +24912,7 @@ async function runHistory(context) {
   const filterHarness = context.harness;
   const daily = dailyRows(payload).filter((row2) => filterHarness === null || row2.harnessId === filterHarness).sort((left, right) => left.period.localeCompare(right.period));
   const sessions = sessionRows(payload).filter((row2) => filterHarness === null || row2.harnessId === filterHarness).sort((left, right) => (left.lastActivity ?? "").localeCompare(right.lastActivity ?? ""));
-  const harnesses = [CLAUDE11, CODEX10].filter((harness) => filterHarness === null || harness === filterHarness).map((harness) => summarize(harness, daily, sessions, context.now()));
+  const harnesses = [CLAUDE12, CODEX11].filter((harness) => filterHarness === null || harness === filterHarness).map((harness) => summarize(harness, daily, sessions, context.now()));
   const report = {
     ...blankReport(context, window.windowStart, window.windowEnd, "available", version3, []),
     daily,
@@ -24525,15 +24925,15 @@ async function runHistory(context) {
     data: report
   });
 }
-var SUPPORTED_CCUSAGE_MAJOR, CLAUDE11, CODEX10, HISTORY_HARNESSES;
+var SUPPORTED_CCUSAGE_MAJOR, CLAUDE12, CODEX11, HISTORY_HARNESSES;
 var init_history2 = __esm({
   "apps/cli/dist/src/commands/history.js"() {
     "use strict";
     init_src();
     SUPPORTED_CCUSAGE_MAJOR = 20;
-    CLAUDE11 = harnessId("claude");
-    CODEX10 = harnessId("codex");
-    HISTORY_HARNESSES = /* @__PURE__ */ new Set([CLAUDE11, CODEX10]);
+    CLAUDE12 = harnessId("claude");
+    CODEX11 = harnessId("codex");
+    HISTORY_HARNESSES = /* @__PURE__ */ new Set([CLAUDE12, CODEX11]);
   }
 });
 
@@ -25336,7 +25736,7 @@ function admitOutcomePolicy(advice, observation, diagnostics) {
 async function appendCodexNativePolicy(context, actions, diagnostics) {
   if (context.nativePolicy !== true)
     return;
-  if (context.harness !== null && context.harness !== CODEX11) {
+  if (context.harness !== null && context.harness !== CODEX12) {
     diagnostics.push(diagnostic({
       severity: "warning",
       code: "native-policy-harness-unsupported",
@@ -25346,16 +25746,16 @@ async function appendCodexNativePolicy(context, actions, diagnostics) {
     }));
     return;
   }
-  const nativeContext = { ...context, harness: CODEX11 };
+  const nativeContext = { ...context, harness: CODEX12 };
   const optimization = await runOptimize(nativeContext);
   const contextResult = await runContext(nativeContext);
-  const advice = optimization.data?.harnesses.find((item) => item.harnessId === CODEX11) ?? null;
-  const observation = contextResult.data?.harnesses.find((item) => item.harnessId === CODEX11) ?? null;
+  const advice = optimization.data?.harnesses.find((item) => item.harnessId === CODEX12) ?? null;
+  const observation = contextResult.data?.harnesses.find((item) => item.harnessId === CODEX12) ?? null;
   if (advice === null || observation === null || observation.managedConfigTarget === null) {
     diagnostics.push(diagnostic({
       severity: "warning",
       code: "codex-native-policy-unavailable",
-      subject: CODEX11,
+      subject: CODEX12,
       message: "Codex optimizer advice could not be paired with a versioned native user-config target",
       remediation: "Run token-harness context --harness codex and keep native policy advisory until the target is observable"
     }));
@@ -25375,7 +25775,7 @@ async function appendCodexNativePolicy(context, actions, diagnostics) {
       diagnostics.push(diagnostic({
         severity: "warning",
         code: "codex-native-policy-observation-drift",
-        subject: CODEX11,
+        subject: CODEX12,
         message: `${input.keyPath} changed between optimizer observation (${String(input.adviceCurrent)}) and native-plan observation (${String(input.observedCurrent)})`,
         remediation: "Re-run token-harness plan --native-policy so recommendation and config precondition come from a stable state"
       }));
@@ -25385,7 +25785,7 @@ async function appendCodexNativePolicy(context, actions, diagnostics) {
       diagnostics.push(diagnostic({
         severity: "warning",
         code: "codex-native-policy-origin-unavailable",
-        subject: CODEX11,
+        subject: CODEX12,
         message: `Codex did not expose origin metadata for ${input.keyPath}, so it will not be managed`,
         remediation: "Keep this recommendation advisory rather than guessing config precedence"
       }));
@@ -25396,7 +25796,7 @@ async function appendCodexNativePolicy(context, actions, diagnostics) {
       diagnostics.push(diagnostic({
         severity: "warning",
         code: "codex-native-policy-shadowed",
-        subject: CODEX11,
+        subject: CODEX12,
         message: `${input.keyPath} currently comes from Codex layer ${origin.sourceType}` + (origin.profile === null ? "" : ` profile ${origin.profile}`) + ", not from the writable base user layer",
         path: origin.path,
         remediation: "Leave the project/profile-owned value untouched; change that scope explicitly if desired"
@@ -25408,7 +25808,7 @@ async function appendCodexNativePolicy(context, actions, diagnostics) {
         diagnostics.push(diagnostic({
           severity: "warning",
           code: "codex-native-model-unproven",
-          subject: CODEX11,
+          subject: CODEX12,
           message: "A managed Codex model change requires the learned model candidate and a complete native catalog",
           remediation: "Keep the model recommendation advisory until RFC 0018 evidence and the complete catalog agree"
         }));
@@ -25419,7 +25819,7 @@ async function appendCodexNativePolicy(context, actions, diagnostics) {
         diagnostics.push(diagnostic({
           severity: "warning",
           code: "codex-native-model-reference-ambiguous",
-          subject: CODEX11,
+          subject: CODEX12,
           message: "The learned Codex model recommendation does not resolve uniquely in the current native catalog",
           remediation: "Re-run the plan after the Codex model catalog is stable"
         }));
@@ -25539,6 +25939,8 @@ async function computePlan(context) {
     providers,
     rules: [...COMPATIBILITY_RULES],
     observedVersions: versions.providers,
+    observedHarnessVersions: versions.harnesses,
+    platform: { os: context.platform.os, wsl: context.platform.isWsl },
     harness: context.harness
   });
   const actions = [];
@@ -25818,7 +26220,7 @@ function planExitCode(counts) {
     return EXIT_CODES["blocked-by-conflict"];
   return EXIT_CODES.ok;
 }
-var DEFAULT_PROFILE, CODEX11;
+var DEFAULT_PROFILE, CODEX12;
 var init_plan2 = __esm({
   "apps/cli/dist/src/commands/plan.js"() {
     "use strict";
@@ -25829,7 +26231,7 @@ var init_plan2 = __esm({
     init_context_cost2();
     init_optimize();
     DEFAULT_PROFILE = "safe";
-    CODEX11 = harnessId("codex");
+    CODEX12 = harnessId("codex");
   }
 });
 
@@ -26749,7 +27151,7 @@ async function runBenchmarkFinish(context) {
     ]
   });
 }
-var CLAUDE12, CODEX12, CAPTURE_HARNESSES;
+var CLAUDE13, CODEX13, CAPTURE_HARNESSES;
 var init_benchmark_capture = __esm({
   "apps/cli/dist/src/commands/benchmark-capture.js"() {
     "use strict";
@@ -26757,9 +27159,9 @@ var init_benchmark_capture = __esm({
     init_budget2();
     init_context_cost2();
     init_history2();
-    CLAUDE12 = harnessId("claude");
-    CODEX12 = harnessId("codex");
-    CAPTURE_HARNESSES = /* @__PURE__ */ new Set([CLAUDE12, CODEX12]);
+    CLAUDE13 = harnessId("claude");
+    CODEX13 = harnessId("codex");
+    CAPTURE_HARNESSES = /* @__PURE__ */ new Set([CLAUDE13, CODEX13]);
   }
 });
 
@@ -28546,10 +28948,12 @@ async function runStatus(context) {
   const harnessAdapters = listHarnessAdapters().filter((adapter) => context.harness === null || adapter.manifest.id === context.harness);
   const present = [];
   const configs = [];
+  const observedHarnessVersions = {};
   for (const adapter of harnessAdapters) {
     const detection = await adapter.detect(detectionContext);
     if (detection.state === "absent")
       continue;
+    observedHarnessVersions[adapter.manifest.id] = detection.version;
     present.push(adapter.manifest);
     const inspection = await adapter.inspect(detectionContext);
     configs.push(...inspection.summaries);
@@ -28580,6 +28984,8 @@ async function runStatus(context) {
     providers,
     rules: [...COMPATIBILITY_RULES],
     observedVersions,
+    observedHarnessVersions,
+    platform: { os: context.platform.os, wsl: context.platform.isWsl },
     harness: context.harness
   });
   if (context.stateRoot !== null) {
@@ -29189,6 +29595,38 @@ var init_rollback = __esm({
   }
 });
 
+// apps/cli/dist/src/commands/verify-status.js
+function harnessesForVerification(selected, configured, present) {
+  if (selected !== null)
+    return present.includes(selected) ? [selected] : [];
+  return configured.length > 0 ? [...configured] : [...present];
+}
+function statusFor(achieved, declared, checks = []) {
+  const canaryNotExercised = checks.some((check) => (check.id === "canary-intercepted" || check.id.startsWith("rtk-attribution-")) && (check.status === "not-exercised" || check.status === "info" && check.achievedTier === null));
+  const noObservedOutcome = checks.length > 0 && checks.some((check) => check.status === "not-exercised") && checks.every((check) => check.status === "not-exercised" || check.status === "info");
+  if (canaryNotExercised || noObservedOutcome)
+    return "not-applicable";
+  const order = ["presence", "config-only", "canary", "live-receipt"];
+  if (achieved === null)
+    return "not-applicable";
+  const reached = order.indexOf(achieved);
+  const promised = order.indexOf(declared);
+  if (reached < 0 || promised < 0)
+    return "not-applicable";
+  return reached >= promised ? "healthy" : "degraded";
+}
+function allResultsAtDeclaredTier(results) {
+  return results.every((result6) => result6.status === "healthy");
+}
+function verificationHasProblems(results, failedCheckCount) {
+  return failedCheckCount > 0 || results.some((result6) => result6.status === "degraded" || result6.status === "failed");
+}
+var init_verify_status = __esm({
+  "apps/cli/dist/src/commands/verify-status.js"() {
+    "use strict";
+  }
+});
+
 // apps/cli/dist/src/commands/verify.js
 async function runVerify(context) {
   const diagnostics = [];
@@ -29256,18 +29694,14 @@ async function runVerify(context) {
       continue;
     const verification = await adapter.verify(providerContext4);
     diagnostics.push(...verification.diagnostics);
-    const harnesses = detection.configuredHarnesses.length > 0 ? detection.configuredHarnesses : (
-      // Installed but wired to nothing: still worth a row, on every present harness, because
-      // "installed and not connected here" is the finding.
-      presentHarnesses
-    );
+    const harnesses = harnessesForVerification(context.harness, detection.configuredHarnesses, presentHarnesses);
     for (const harnessId2 of harnesses) {
       const declaredTier = adapter.manifest.harnesses.find((entry) => entry.harness === harnessId2)?.verificationTier ?? verification.declaredTier;
       const scopedVerification = await scopeProviderVerificationToHarness(providerContext4, verification, harnessId2, detection.configuredHarnesses);
       results.push({
         providerId: adapter.manifest.id,
         harnessId: harnessId2,
-        status: statusFor(scopedVerification.achievedTier, declaredTier),
+        status: statusFor(scopedVerification.achievedTier, declaredTier, scopedVerification.checks),
         declaredTier,
         managedByTokenHarness: managedIntegrations.has(`${adapter.manifest.id}\0${harnessId2}`),
         providerManagedByTokenHarness: detection.managedByTokenHarness,
@@ -29278,15 +29712,16 @@ async function runVerify(context) {
   const receipts = context.metrics === null ? [] : await readReceipts(context);
   const latest = receipts[0] ?? null;
   const failures = results.flatMap((result6) => result6.checks.filter(contributesToProblems));
+  const hasProblems = verificationHasProblems(results, failures.length);
   const report = {
     receiptId: latest?.receiptId ?? null,
     appliedAt: latest?.appliedAt ?? null,
     results,
-    healthyAtDeclaredTier: failures.length === 0
+    healthyAtDeclaredTier: allResultsAtDeclaredTier(results)
   };
   return commandResult({
     command: "verify",
-    exitCode: failures.length === 0 ? EXIT_CODES.ok : EXIT_CODES["problems-found"],
+    exitCode: hasProblems ? EXIT_CODES["problems-found"] : EXIT_CODES.ok,
     data: report,
     diagnostics
   });
@@ -29323,21 +29758,12 @@ async function readReceipts(context) {
     return [];
   }
 }
-function statusFor(achieved, declared) {
-  const order = ["presence", "config-only", "canary", "live-receipt"];
-  if (achieved === null)
-    return "not-applicable";
-  const reached = order.indexOf(achieved);
-  const promised = order.indexOf(declared);
-  if (reached < 0 || promised < 0)
-    return "not-applicable";
-  return reached >= promised ? "healthy" : "degraded";
-}
 var init_verify = __esm({
   "apps/cli/dist/src/commands/verify.js"() {
     "use strict";
     init_src3();
     init_src();
+    init_verify_status();
   }
 });
 
@@ -32473,8 +32899,18 @@ function renderVerifyReport(report, _context) {
   if (report.healthyAtDeclaredTier) {
     lines.push("Healthy at the declared tier for every provider.");
   } else {
-    const failures = report.results.flatMap((result6) => result6.checks).filter((check) => check.status === "fail").length;
-    lines.push(`${String(failures)} ${pluralize(failures, "check")} below tier. Not proven.`);
+    const belowTier = report.results.filter((result6) => result6.status === "degraded" || result6.status === "failed").length;
+    const notProven = report.results.filter((result6) => result6.status === "not-applicable").length;
+    const failedChecks = report.results.flatMap((result6) => result6.checks).filter((check) => check.status === "fail").length;
+    if (belowTier > 0) {
+      lines.push(`${String(belowTier)} ${pluralize(belowTier, "provider\u2013harness integration")} below declared tier.`);
+    }
+    if (failedChecks > 0) {
+      lines.push(`${String(failedChecks)} ${pluralize(failedChecks, "check")} failed.`);
+    }
+    if (notProven > 0) {
+      lines.push(`${String(notProven)} ${pluralize(notProven, "provider\u2013harness integration")} not proven yet.`);
+    }
   }
   return document(lines);
 }