v0.6.0

Two org-policy rules for agent pull requests, and a .pharn/ci.yml that may only tighten. P13, agent
self-modification (POLICY_P13), blocks an agent pull request that widens its own or another agent's powers in an
agent settings file, an MCP config, a workflow or CODEOWNERS. P14, the agent PR size cap (POLICY_P14), fails an agent
pull request that changes more files or lines than the org policy's agents.max_files / agents.max_changed_lines;
it is opt-in, so a policy that sets neither sees no change. A behaviour change: a stricter coverage.threshold or
setup.require: true in .pharn/ci.yml now applies over a looser threshold input (or --threshold) or
require-agent-setup: false; to get the looser value back, lower it in .pharn/ci.yml itself. An added test file
pharn-ci cannot read is now named in the TEST_INTEGRITY_INDEX_UNAVAILABLE warning instead of dropped. Report v2 gains
the two message codes; no field, input or code was removed or renamed.

Added

• Org-policy rule P13, agent self-modification (POLICY_P13, default block): under an app or file: policy, an
  agent pull request that widens its own or another agent's powers is blocked. The Action compares each agent settings
  file, MCP config, workflow and CODEOWNERS file the diff touches between the merge base and HEAD (read from committed
  objects with the caps of the test sources): an allow rule added, a deny rule removed, defaultMode changed, a hook
  removed or rewritten, disableAllHooks or enableAllProjectMcpServers turned on, an MCP server added or changed, a
  secret newly referenced, a workflow permission widened or its block removed, pull_request_target added, or a
  CODEOWNERS change other than owners added. One violation per file names the widening in fixed words, never file
  text. A missing diff, or a file that cannot be read or parsed, fails closed. A person's pull request is never
  subject to it, a file: policy cannot lower it, and the CLI never runs it. New message code in schema v2, no new
  input, no new dependency, no network call.
• Org-policy rule P14, agent PR size cap, with the new message code POLICY_P14: an agent pull request that changes
  more files than agents.max_files or more lines (added plus removed) than agents.max_changed_lines fails, with one
  path-less violation per exceeded cap that names the count, the cap and the top-level directories touched ("split it
  by area: …"). It is opt-in: set agents.max_files / agents.max_changed_lines to turn it on. There is no default
  cap, so a policy that sets neither sees no change. Lockfiles, snapshots, *.generated.* files and coverage.exclude
  paths do not count (coverage.exclude is not used when the pull request edits the config in use or a workflow,
  unless the app policy sets the exclusions). A person's pull request is never subject to it, a missing diff fails
  closed, the severity is block and a file: policy can lower a cap but never raise or remove one. Report v2 gains
  the code only; no field changes.

Changed

• .pharn/ci.yml may now only tighten the coverage threshold and the agent setup requirement, as it already did the
  test-integrity mode. A stricter coverage.threshold now applies over a looser threshold input or --threshold
  flag (with both set, the larger applies; it was the input's), and setup.require: true now stays on when the
  require-agent-setup input is false (it was turned off). This is a behaviour change: a workflow that set a lower
  threshold or require-agent-setup: false to relax a stricter config now gets the config's value. An org policy that
  raises the threshold over a config value that was in force names config in POLICY_OVERRIDE_IGNORED. The file,
  root and format inputs still replace the config's, and exclusions are still the config's plus the input's. No new
  message code and no schema change.
• An added test file pharn-ci cannot read (the test index refuses it as syntax-error-heavy, too-deep or
  parser-threw, its text was dropped or missing at HEAD, or there is no Python index for a .py file) is now named in
  TEST_INTEGRITY_INDEX_UNAVAILABLE with its reason code, in a sentence of its own after the TI02 and TI05 one: "The
  tests in these added test files could not be read, so they are not checked: …". It was dropped with no trace, so
  its tests were checked by nothing and the report did not say so. The message stays a warning in every mode, is not
  given in mode off, and is unchanged when no added file is unread. No new message code and no schema change.
• TI01's detail for a deleted test file with a same-stem test file added now says the base text "could not be parsed"
  when it was read but the test index refused it, instead of saying it was not available. The severity is unchanged.