repo-harness 0.12.1

See docs/CHANGELOG.md#0121---2026-08-01 for the full changelog. Threads one SessionStart-minted run identity through hook telemetry and evidence correlation, restructures the five-language README into a get-started-first layout, and refreshes the CodeGraph dev dependency line to 1.5.0.

repo-harness 0.12.0

See docs/CHANGELOG.md#0120---2026-07-31 for the full changelog. Breaking: repo-harness adopt is removed; repo-local adoption is now repo-harness init, global bootstrap is repo-harness install only.

repo-harness 0.11.3

repo-harness 0.11.3 ships the ChatGPT delegate mode: a repo-owned dual-agent GPT Pro collaboration protocol with explicit per-host transports (Claude via the Oracle consult/continue chain, Codex via the built-in browser), a mandatory fail-closed Gitleaks egress scan over the exact rendered PromptBundle before any session or provider side effect, and explicit host skill projection commands (install-skill/uninstall-skill) with realpath ownership validation.

Verification: exact-main npm release gate passed with 2,094 tests, 1 platform skip, and 0 failures; Linux/macOS/Windows GitHub CI passed; npm registry, dist-tag latest, tarball install smoke, and annotated tag readbacks passed.

repo-harness 0.11.2

repo-harness 0.11.2 removes per-command [ChecksFile] context noise, keeps out-of-repo paths outside capability/TDD jurisdiction without weakening path validation, and resolves SessionStart Effective State in process with bounded retries and redaction-safe unavailable diagnostics.

Verification: exact-main npm release gate passed with 2,089 tests, 1 platform skip, and 0 failures; Linux/macOS/Windows GitHub CI passed; npm registry, tarball integrity, annotated tag, and clean-room install readbacks passed.

repo-harness 0.11.1

repo-harness 0.11.1 ships the minimal/full host profile model (full by default), explicit protocol-1 migration, profile-aware 7/11 Codex hook projections, and user-managed agent-fleet preservation. It also fixes macOS Bash 3.2 primary-worktree shipping, evidence-ledger review-subject self-reference, immutable evidence genesis, typed status/archive acceptance authority, QA score normalization, state-concurrency readiness ordering, and Claude provider-setting isolation.

Verification: 2,067 tests passed, 1 platform-specific skip, 0 failures; tarball install smoke and the exact-main npm release gate passed on 998cb51.

repo-harness 0.11.0

Changed

• checks/latest.json is now materialized exclusively from the
  EvidenceEvent ledger (D7 selection predicate: exact worktree + subject +
  admitted trust class, last accepted event wins). Every prior direct
  authoring path is deleted in the same package that replaced it:
  verify-sprint.sh's cp onto checks/latest.json, the
  workflow_ensure_harness_surface {} bootstrap, and
  mutation-observed.ts's continuous contract-verification cascade (now
  redirected to a dedicated .ai/harness/checks/contract-verify.latest.json,
  never the acceptance-evidence path).
• Recovery views (handoff/current.md, handoff/resume.md) render from one
  standalone materializer, single-hop from the EPC-06 checkpoint plus
  minimal live workflow context. The independent bash workflow_write_handoff
  content assembly, codex-handoff-resume.sh's elaborate-resume assembly,
  prepare-codex-handoff.sh's Node/Python global-packet splice, and
  workflow_ensure_harness_surface's handoff/resume placeholder bootstrap
  are all retired same-package; the three bash entrypoints are now thin
  invokers of one standalone CLI (scripts/recovery-view-cli.ts).
• The SessionStart Context Packet's resume-availability check
  (resumeAvailable()) now resolves from the canonical checkpoint-backed
  evidence reader (resolveRecoveryEvidence) instead of re-deriving
  availability by string-scanning resume.md for a legacy marker/header.
• Evidence-ledger redaction gained a typed-field exemption: a whole-value
  declared hash (sha256:-prefixed or bare 40/64-hex) or a declared/inferred
  safe repo-relative path is exempt from high-entropy redaction, so a
  realistic long contract slug or a sha256:-prefixed field now survives
  materialization byte-identical instead of being partially hash-mangled.
  The secret-value denylist still runs unconditionally over every field,
  exempted or not.
• PostBash-observed command results and manual/external attested acceptance
  receipts now import into the same EvidenceEvent ledger (observed and
  external_attested/human_acceptance trust classes respectively),
  feeding the materializers above under the frozen D4 trust matrix.

Removed

• Skill surface discovery convergence (public cutover, next-minor breaking
  change). assets/skill-commands/manifest.json v2 is now the runtime
  discovery authority for Skill package classification and host/profile
  projection. Rule owners converge from 25 Skill-like sources to 10 canonical
  packages (repo-harness, repo-harness-setup, repo-harness-plan,
  repo-harness-product, repo-harness-check, repo-harness-ship,
  repo-harness-architecture, repo-harness-cross-review, merge-gate
  classification-only, repo-harness-chatgpt); the 19 retired names below are
  deleted (no directories, no generated aliases, no compatibility shims) and
  recorded only as migration metadata in the manifest's retiredPackages
  array:

  Retired name	Replacement
  repo-harness-init	repo-harness-setup (adopt-init mode)
  repo-harness-migrate	repo-harness-setup (migrate mode)
  repo-harness-upgrade	repo-harness-setup (upgrade mode)
  repo-harness-repair	repo-harness-setup (repair mode)
  repo-harness-scaffold	repo-harness-setup (scaffold mode)
  repo-harness-capability	repo-harness-setup (capability mode)
  repo-harness-review	repo-harness-plan (review mode)
  repo-harness-prd	repo-harness-product (PRD mode)
  repo-harness-sprint	repo-harness-product (Sprint mode)
  repo-harness-goal	repo-harness-product (Goal mode)
  repo-harness-handoff	root repo-harness (handoff action + references/handoff.md)
  repo-harness-deploy	repo-harness-check (deploy-readiness reference)
  repo-harness-autoplan	retired, no successor; root execute already follows Effective State through the existing plan -> contract -> worktree -> verify -> ship chain. Its Reusable Workflow Packaging Rubric survives alone as references/workflow-packaging-rubric.md
  repo-harness-gptpro	repo-harness-chatgpt (consult/continue modes)
  repo-harness-gptpro-setup	repo-harness-chatgpt (setup mode)
  codex-review	repo-harness-cross-review (Codex provider mode)
  claude-review	repo-harness-cross-review (Claude provider mode)
  repo-harness-chatgpt-bridge (static .agents/skills/ copy)	repo-harness-chatgpt (bridge reference); the generated runtime projection identity repo-harness-chatgpt-bridge is unchanged
  repo-harness-chatgpt-browser (static .agents/skills/ copy)	repo-harness-chatgpt (continue reference); the underlying src/cli/chatgpt-browser CLI engine is unaffected

  Target discovery matrix: minimal -> repo-harness only; standard ->
  adds repo-harness-plan and repo-harness-check; product-planning ->
  adds repo-harness-product; strict -> repo-harness-plan,
  repo-harness-check, repo-harness-ship, host-aware
  repo-harness-cross-review on both hosts, and merge-gate only on its
  gatekeeper host. repo-harness-chatgpt is explicit-setup only and never
  implied by product-planning or any other profile.

Notes (accepted intermediate states -- operator guidance)

• Downstream adopters that installed via the packaged CLI (not this source
  checkout) do not yet receive the ledger/materializer tooling
  (emit-verify-evidence.ts and friends are source-repo-only, never
  registered in the distributed helper manifest); checks/latest.json stays
  structurally absent in those repos until the next release ships this
  cutover. This is a pre-existing condition, not a regression introduced
  here.
• A globally installed repo-harness CLI published before this cutover is a
  live legacy writer until refreshed. Operator guidance: refresh with the
  standard install profile (repo-harness update --profile standard, or
  install --profile standard for a fresh install) to pick up the
  materializer-only behavior; until then, invoke bash scripts/verify-sprint.sh
  directly in a self-hosted worktree rather than repo-harness run verify-sprint, so the stale global binary's own retired cp path cannot
  silently re-clobber checks/latest.json with old-schema content.
• The guarded, only-if-absent {} seeds in scripts/plan-to-todo.sh and
  scripts/ensure-task-workflow.sh (project-genesis scaffolding for a
  brand-new adopted repo, gated if [[ ! -f ... ]]) remain non-ledger
  first-writers by design -- fail-closed, never overwriting real
  materialized content, and out of scope for this cutover.

Verification

• Added a cross-package projection-drift suite
  (tests/evidence-projection-drift.test.ts): the checkpoint machine/human
  views, the recovery views, materialized checks/latest, and tracked
  tasks/current.md all recompute byte/hash-identically from their declared
  sources, both on a fixture ledger and (where live state exists) against
  this worktree's own published evidence.
• Added a deprecation-residue scan (tests/evidence-residue-scan.test.ts)
  consuming a checked-in retired-surfaces list
  (evals/harness/epc-retired-surfaces.json, the union of every EPC-05/07/08
  deletion) -- zero unexcepted hits across src/, scripts/, .ai/hooks/,
  assets/.
• A matched post-EPC benchmark run was attempted at the post-EPC-08 subject
  under the frozen VGBR-R protocol (one authoritative invocation, no
  --profile/--scenario/--regrade-existing). The attempt
  (post-epc-196e787a-20260723-a01) self-classified failed_during_run:
  two adaptive-lite arms failed inside the runner's own isolated per-arm
  sandboxes (a provider tool-exec fault and a harness-guard-blocked agent
  turn -- see docs/researches/20260723-epc-program-closeout.research.md
  for the full evidence). No report was produced and none was promoted. Per
  the sprint's own frozen attempt discipline, one protocol-clean failed
  attempt is sufficient to trigger row 13's cannot-execute fallback -- no
  second attempt was made, and no automatic rerun or --regrade-existing
  backfill occurred. Fallback applied: the pre-EPC baseline triplet
  (27/27 arms, evals/harness/reports/profile-comparison.*, bytes
  untouched) is now designated "descriptive pre-EPC baseline only".
  This release closeout claims no benchmark improvement over the pre-EPC
  baseline.

repo-harness 0.10.0

What's Changed

• refactor(mcp): retire rollout controls by @Ancienttwo in #52
• refactor(adopt): cut over to transactional TypeScript planner by @Ancienttwo in #54
• feat(evals): add BDD² Phase E evaluation foundation by @Ancienttwo in #53
• chore(agents): move fast-worker to Luna xhigh by @Ancienttwo in #57
• docs(prd): archive retained BDD2 V0 by @Ancienttwo in #58
• ci: upgrade Bun baseline to 1.3.14 by @Ancienttwo in #56
• feat: add ChatGPT coding MCP profile by @Ancienttwo in #55
• test(evals): record BDD2 Shape reshape result by @Ancienttwo in #59
• eval: run BDD2 Audit hypothesis by @Ancienttwo in #60
• docs: record BDD2 Phase E gate by @Ancienttwo in #61
• docs: close BDD2 Phase E workflow by @Ancienttwo in #63
• feat(contract-run): resolve worker role to fleet profile with Sol-High fallback by @Ancienttwo in #62
• fix(mcp): close post-merge security gates by @Ancienttwo in #64
• feat(agents): add fleet specialist roles by @Ancienttwo in #65
• eval: close BDD2 Phase E with terminal E3 authority by @Ancienttwo in #66
• feat(hooks): verify native custom-agent role routing with SubagentStart evidence by @Ancienttwo in #68
• Configurable per-repo deploy-sql roots and naming policy by @Ancienttwo in #67
• chore: archive PR 67 workflow by @Ancienttwo in #69
• fix(release): drop retired provider literal from 0.10.0 skill-version description by @Ancienttwo in #71
• fix(harness): verify manual evidence from task baseline by @Ancienttwo in #70
• feat: add UX feature guardrail by @Ancienttwo in #72
• feat: cut verifier over to bounded evidence lifecycle by @Ancienttwo in #73
• fix: bound Codex auto delegation context by @Ancienttwo in #74
• feat(workflow): enforce local merge gate by @Ancienttwo in #75
• fix: scope auto delegation authorization to sessions by @Ancienttwo in #76
• fix: close 0.10.0 release blockers by @Ancienttwo in #77

Full Changelog: v0.9.2...v0.10.0

repo-harness 0.9.2

[0.9.2] - 2026-07-10

Changed

• Updated the generated Codex agent fleet so deep-reasoner and gatekeeper
  use GPT-5.6 Sol with xhigh reasoning, while fast-worker uses GPT-5.6
  Terra with medium reasoning; generated descriptions now fail closed when the
  upstream provider label does not match the declared model mapping.
• Added the shared Rule 0, first-principles reasoning, and generality guidance
  to global working-rule distribution and newly scaffolded root agent context.

Fixed

• Pinned the documented bunx/npx bootstrap and prompt-guard recovery paths
  to repo-harness@latest, and made an already-installed Bun global runtime
  surface an opt-in, repository-isolated update hint instead of silently
  perpetuating a stale version.
• Made repo-harness doctor run Bun registry lookup from the package root,
  require the stable PATH-visible Codex CLI to be at least 0.144.0, and keep
  Claude-only setup free of irrelevant Codex warnings.
• Made explicit direct-change-and-commit requests enter hook execution while
  generic change language, questions, quoted text, negation, and contractions
  remain non-execution intent.

repo-harness 0.9.1

[0.9.1] - 2026-07-06

Added

• Added repo-harness install --target codex|both --location global --delegation-mode auto|explicit, plus the matching interactive TTY prompt,
  so users can persist the global Codex delegation mode in
  ~/.repo-harness/config.json without clobbering existing config keys.
• Added an exact archctx-contracts@0.2.1 devDependency and moved
  archcontext-boundaries-v1 export tests from a vendored schema fixture to
  the package's authoritative schema/validator surface.
• Added a read-only repo.adopt-refresh setup-check advisory: with
  --check-updates, adopted repos now surface an Agent action when the
  repo-harness adopt dry-run plan has pending operations.

Changed

• Updated the shell and PowerShell install scripts to point new users at
  repo-harness install instead of the compatibility init alias, and to
  print a PATH hint when Bun's bin directory was not already visible in the
  original shell.
• Moved Waza and Geju setup-check probes and docs from npx -y skills ... to
  bunx skills ..., keeping the release line Bun-first.
• Made the Codex delegation advisor honor delegation.mode=auto from either
  the global user config or repo policy, while keeping discussion prompts quiet
  and disabling stop-fallback for implicit auto-mode injections.
• Added .archcontext/ to the self-host and generated-repo ignore surfaces so
  local arch-context model scaffolds stay out of commits by default.
• Removed the local tests/fixtures/archcontext/architecture-node.subset.schema.json
  fixture now that archctx-contracts@0.2.1 publishes the required schemas.

repo-harness 0.9.0

Added

• Added a bugfix task profile with a first-class Root Cause Evidence gate: contract-run.ts and verify-contract.sh independently evaluate the same ## Root Cause Evidence section against shared fixtures, matching a pre-fix failure artifact by its captured PRE_FIX_EXIT recipe; added the bugfix golden example docs/reference-configs/contract-brief-example-bugfix.md.
• Declared file-coupled delegation policy (delegation.preferred_runners / fallback_runner / runner_rule) that makes the task contract the authoritative execution brief and the native subagent an optional accelerator; slimmed codex-delegation-advisor to point at the contract instead of commanding native spawn limits; plan-to-todo now prints a non-blocking [BriefPreflight] advisory right after contract projection, while contract-run.ts run keeps the fail-closed brief-completeness gate.
• Added an optional ## Falsifier section to the contract template and aligned all five template/helper-mirror copies, backfilling the Why/Stop-Conditions/Exemplar sections seeded for prompt distillation. Distilled the contract-run prompts on top of that: writePrompt() folds self-verify/notes/stop duties and Intent into the worker/verifier prompts, runBriefPreflight() requires a concrete ## Why, a golden contract-brief example ships with a preflight guard test, verify-sprint prints promotion/triage advisories at finish without changing its exit code, contract-run.ts gained a --runner option with manifest runner_usage recording, and the workflow is taught across the repo's SKILL.md docs.
• Added geju (hylarucoder/hai-stack) as an external_tooling dependency; plan-to-todo prints a [Geju] artifact-freeze advisory after rendering a contract.
• Made the agent fleet a first-class dependency: a fable_agents policy entry (self-host auto-install-on-init, downstream advisory), the install-agent-fleet helper (direct-installs upstream .md agent definitions and generates matching Codex .toml mappings, never-clobber by default with --force to override, REPO_HARNESS_FLEET_SOURCE_DIR override), check-agent-tooling's detectAgentFleet() with strict-readiness (missing/partial), and tiered init/migrate policy assembly where dry-run never writes to $HOME.
• Added the codex-subagent runner label and committed this repo's own fleet: three .claude/agents/ definitions (deep-reasoner, fast-worker, gatekeeper) with symmetric .codex/agents/*.toml mappings.
• Added a frontend task profile with a design-brief gate, intake prior-art/negative-scenario/canonical-term trigger rules with recorded acceptance evidence, and a capability/archcontext boundary bridge exposing a read-only archcontext-boundaries-v1 export with export tests.
• Mechanically landed the EXECUTION_BOUNDARY anti-extras clause on every delegated runner surface, with a canonical-sentence parity test; contracts now project the plan's Non-scope section, and In-scope/Out-of-scope get an independent preflight check.
• Made the install/init global bootstrap prompt Y/n in interactive terminals before installing the optional external-skills and CodeGraph pieces (Enter keeps default-on; non-TTY and --json stay unprompted; explicit --no-* flags are honored without prompting), moved the skills bootstrap from npx -y skills to bunx skills, and pinned the CodeGraph install to @colbymchenry/codegraph@latest.

Changed

• Renamed the dead bun run typecheck exit-criteria command to the real bun run check:type script across every contract template/helper-mirror surface; explicitly revised sprint-contracts.md's exit-criteria-only promise to scope the new Root Cause Evidence check to bugfix-profile contracts only. Bumped the review rubric from v1 to v2 so external acceptance must carry its own current Reviewed Diff Fingerprint and scope instead of a stale one, and added a bounded P1-escalation Scope Fidelity rubric dimension.

Fixed

• Worked around a bash 3.2 parser trap where a $(cat <<'EOF' ... EOF)-wrapped heredoc with a quoted delimiter is still scanned for quote parity: an odd apostrophe count inside embedded template prose broke scripts/lib/project-init-lib.sh under bash -n. Switched to mktemp file indirection.

Verification

• Release battery (bun run check:release) green at the tagged commit: full bun test 1075 pass / 1 skip / 0 fail, type check, workflow/deploy/architecture/task-sync gates, package dry-run, and tarball install smoke (repo-harness-0.9.0.tgz installs and packaged CLI bins start).
• Cross-vendor external acceptance: Codex (codex exec, Review Rubric v2) passed the full v0.8.5..c70fa29 release diff with zero P1/P2 findings, fingerprint-bound via git diff v0.8.5..HEAD | shasum -a 256 = fd27185b205a4ef8efb21b8d43fc0ede8f2b60144c3dba5a86b1a17c1bd60e12; this supersedes the two interim manual overrides recorded during the constituent work packages.
• npm publish completed with the latest dist-tag; registry read-back agrees on version, dist-tag, shasum 420e0c00e344a159ec4eb52b78ac13df87dae612, and gitHead = c70fa295... (the tagged commit). scripts/check-release-published.sh 0.9.0: registry, dist-tag, tarball, tag, and local version files all agree.
• Installed-runtime smoke: repo-harness --version reports 0.9.0 and the packaged helper runtime includes install-agent-fleet.sh; repo-harness run check-task-workflow --strict green via the installed CLI.