repo-harness 0.11.0

Changed

• checks/latest.json is now materialized exclusively from the
  EvidenceEvent ledger (D7 selection predicate: exact worktree + subject +
  admitted trust class, last accepted event wins). Every prior direct
  authoring path is deleted in the same package that replaced it:
  verify-sprint.sh's cp onto checks/latest.json, the
  workflow_ensure_harness_surface {} bootstrap, and
  mutation-observed.ts's continuous contract-verification cascade (now
  redirected to a dedicated .ai/harness/checks/contract-verify.latest.json,
  never the acceptance-evidence path).
• Recovery views (handoff/current.md, handoff/resume.md) render from one
  standalone materializer, single-hop from the EPC-06 checkpoint plus
  minimal live workflow context. The independent bash workflow_write_handoff
  content assembly, codex-handoff-resume.sh's elaborate-resume assembly,
  prepare-codex-handoff.sh's Node/Python global-packet splice, and
  workflow_ensure_harness_surface's handoff/resume placeholder bootstrap
  are all retired same-package; the three bash entrypoints are now thin
  invokers of one standalone CLI (scripts/recovery-view-cli.ts).
• The SessionStart Context Packet's resume-availability check
  (resumeAvailable()) now resolves from the canonical checkpoint-backed
  evidence reader (resolveRecoveryEvidence) instead of re-deriving
  availability by string-scanning resume.md for a legacy marker/header.
• Evidence-ledger redaction gained a typed-field exemption: a whole-value
  declared hash (sha256:-prefixed or bare 40/64-hex) or a declared/inferred
  safe repo-relative path is exempt from high-entropy redaction, so a
  realistic long contract slug or a sha256:-prefixed field now survives
  materialization byte-identical instead of being partially hash-mangled.
  The secret-value denylist still runs unconditionally over every field,
  exempted or not.
• PostBash-observed command results and manual/external attested acceptance
  receipts now import into the same EvidenceEvent ledger (observed and
  external_attested/human_acceptance trust classes respectively),
  feeding the materializers above under the frozen D4 trust matrix.

Removed

• Skill surface discovery convergence (public cutover, next-minor breaking
  change). assets/skill-commands/manifest.json v2 is now the runtime
  discovery authority for Skill package classification and host/profile
  projection. Rule owners converge from 25 Skill-like sources to 10 canonical
  packages (repo-harness, repo-harness-setup, repo-harness-plan,
  repo-harness-product, repo-harness-check, repo-harness-ship,
  repo-harness-architecture, repo-harness-cross-review, merge-gate
  classification-only, repo-harness-chatgpt); the 19 retired names below are
  deleted (no directories, no generated aliases, no compatibility shims) and
  recorded only as migration metadata in the manifest's retiredPackages
  array:

  Retired name	Replacement
  repo-harness-init	repo-harness-setup (adopt-init mode)
  repo-harness-migrate	repo-harness-setup (migrate mode)
  repo-harness-upgrade	repo-harness-setup (upgrade mode)
  repo-harness-repair	repo-harness-setup (repair mode)
  repo-harness-scaffold	repo-harness-setup (scaffold mode)
  repo-harness-capability	repo-harness-setup (capability mode)
  repo-harness-review	repo-harness-plan (review mode)
  repo-harness-prd	repo-harness-product (PRD mode)
  repo-harness-sprint	repo-harness-product (Sprint mode)
  repo-harness-goal	repo-harness-product (Goal mode)
  repo-harness-handoff	root repo-harness (handoff action + references/handoff.md)
  repo-harness-deploy	repo-harness-check (deploy-readiness reference)
  repo-harness-autoplan	retired, no successor; root execute already follows Effective State through the existing plan -> contract -> worktree -> verify -> ship chain. Its Reusable Workflow Packaging Rubric survives alone as references/workflow-packaging-rubric.md
  repo-harness-gptpro	repo-harness-chatgpt (consult/continue modes)
  repo-harness-gptpro-setup	repo-harness-chatgpt (setup mode)
  codex-review	repo-harness-cross-review (Codex provider mode)
  claude-review	repo-harness-cross-review (Claude provider mode)
  repo-harness-chatgpt-bridge (static .agents/skills/ copy)	repo-harness-chatgpt (bridge reference); the generated runtime projection identity repo-harness-chatgpt-bridge is unchanged
  repo-harness-chatgpt-browser (static .agents/skills/ copy)	repo-harness-chatgpt (continue reference); the underlying src/cli/chatgpt-browser CLI engine is unaffected

  Target discovery matrix: minimal -> repo-harness only; standard ->
  adds repo-harness-plan and repo-harness-check; product-planning ->
  adds repo-harness-product; strict -> repo-harness-plan,
  repo-harness-check, repo-harness-ship, host-aware
  repo-harness-cross-review on both hosts, and merge-gate only on its
  gatekeeper host. repo-harness-chatgpt is explicit-setup only and never
  implied by product-planning or any other profile.

Notes (accepted intermediate states -- operator guidance)

• Downstream adopters that installed via the packaged CLI (not this source
  checkout) do not yet receive the ledger/materializer tooling
  (emit-verify-evidence.ts and friends are source-repo-only, never
  registered in the distributed helper manifest); checks/latest.json stays
  structurally absent in those repos until the next release ships this
  cutover. This is a pre-existing condition, not a regression introduced
  here.
• A globally installed repo-harness CLI published before this cutover is a
  live legacy writer until refreshed. Operator guidance: refresh with the
  standard install profile (repo-harness update --profile standard, or
  install --profile standard for a fresh install) to pick up the
  materializer-only behavior; until then, invoke bash scripts/verify-sprint.sh
  directly in a self-hosted worktree rather than repo-harness run verify-sprint, so the stale global binary's own retired cp path cannot
  silently re-clobber checks/latest.json with old-schema content.
• The guarded, only-if-absent {} seeds in scripts/plan-to-todo.sh and
  scripts/ensure-task-workflow.sh (project-genesis scaffolding for a
  brand-new adopted repo, gated if [[ ! -f ... ]]) remain non-ledger
  first-writers by design -- fail-closed, never overwriting real
  materialized content, and out of scope for this cutover.

Verification

• Added a cross-package projection-drift suite
  (tests/evidence-projection-drift.test.ts): the checkpoint machine/human
  views, the recovery views, materialized checks/latest, and tracked
  tasks/current.md all recompute byte/hash-identically from their declared
  sources, both on a fixture ledger and (where live state exists) against
  this worktree's own published evidence.
• Added a deprecation-residue scan (tests/evidence-residue-scan.test.ts)
  consuming a checked-in retired-surfaces list
  (evals/harness/epc-retired-surfaces.json, the union of every EPC-05/07/08
  deletion) -- zero unexcepted hits across src/, scripts/, .ai/hooks/,
  assets/.
• A matched post-EPC benchmark run was attempted at the post-EPC-08 subject
  under the frozen VGBR-R protocol (one authoritative invocation, no
  --profile/--scenario/--regrade-existing). The attempt
  (post-epc-196e787a-20260723-a01) self-classified failed_during_run:
  two adaptive-lite arms failed inside the runner's own isolated per-arm
  sandboxes (a provider tool-exec fault and a harness-guard-blocked agent
  turn -- see docs/researches/20260723-epc-program-closeout.research.md
  for the full evidence). No report was produced and none was promoted. Per
  the sprint's own frozen attempt discipline, one protocol-clean failed
  attempt is sufficient to trigger row 13's cannot-execute fallback -- no
  second attempt was made, and no automatic rerun or --regrade-existing
  backfill occurred. Fallback applied: the pre-EPC baseline triplet
  (27/27 arms, evals/harness/reports/profile-comparison.*, bytes
  untouched) is now designated "descriptive pre-EPC baseline only".
  This release closeout claims no benchmark improvement over the pre-EPC
  baseline.