chore(deps): bump vendored audit-harness to 1.4.0

.audit-harness/CHANGELOG.md

@@ -6,6 +6,45 @@ project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [1.4.0] - 2026-09-01
+
+### Added
+
+- `worktree-run` — pre-push gate runner that checks the exact ref being pushed
+  in a disposable `git worktree`: `verify` + `escape-scan --range` on the push
+  range fail-closed, `conform` + `audit --fast` advisory, gate-result/v1 rows
+  written outside the repo. No push authority, no LLM stage, no repo writes.
+  Wired as a lefthook `pre-push` job in this repo (reference recipe for
+  consumers). Extracted from the no-mistakes discovery (2026-08-30): the
+  isolated-worktree pre-push loop was the one idea worth keeping; the LLM
+  review stage, auto-fix authority, and proxy-push were deliberately not
+  adopted. Honors `AUDIT_HARNESS_DISABLE=1`.
+- `bias-count` now counts source-introspection tests — a test whose only
+  evidence is reading the implementation source (`inspect.getsource`, reading
+  files under `src/`) instead of asserting observable behaviour of a public
+  interface. Deterministic counterpart of the prose rule in the
+  implement-tests auto-remediation reference; advisory like every bias
+  pattern (promotion to blocking goes through `fp-rate`).
+
+### Fixed
+
+- `bias-count` no longer dies mid-report on a clean directory: under
+  `pipefail`, a zero-match grep exited 1 and aborted the scan (truncated
+  output, exit 1) before the summary — the "gate that looks like it ran"
+  failure class from 1.3.1. Zero-match patterns now count as 0.
+- Expanded the default `harness-hash` denominator to include package test
+  scripts, `tests/TESTING.md`, common JavaScript and Python coverage/mutation
+  configs, and primary CI workflow files. Previously an edit could weaken the
+  command or workflow that enforced a pinned threshold without changing one of
+  the few files protected by the manifest.
+- Added an offline contract suite proving those files are pinned, their edits
+  or removal produce `HARNESS_TAMPERED` (exit 2), and ordinary source changes do
+  not require a policy re-pin.
+- Accessibility detection now recognises dedicated a11y/accessibility test
+  files and directories for native, QML, CLI/TUI, and other non-web stacks.
+  Previously it recognised only four web dependencies and falsely advised
+  projects to add irrelevant tooling despite executable accessibility tests.
+
 > **Riding a future v2.1 routine release (descoped from 1.2.0):** OTel event-name
 > polish (iah-E07b/c). The `agent.rollout.gate.evaluated` and `gate.decision.emitted`
 > event names are already locked + tested on main (PRs #78, #81 per NORMATIVE
@@ -21,6 +60,10 @@ now detects escapes it previously let through. Adopters on 1.3.0 should upgrade:
 two of the five were **fail-open**, meaning a real threshold-lowering escape merged
 clean.
 
+**First required dogfood (2026-07-23):** CCPI (`claude-code-plugins-plus-skills`)
+made `audit-harness conform --strict` a **required** branch-protection context
+(`skill-conform`, own workflow — never inside `ci-required`). See CCPI#1118.
+
 ### Fixed
 
 - **`set -e` killed the script mid-load, producing a silent total bypass
@@ -414,7 +457,8 @@ Initial release. Extracted from the `audit-tests` Claude Code skill v7.0.0 to en
 - **`audit-harness gherkin-lint`** — advisory Gherkin quality check.
 - **`audit-harness crap`** — CRAP (Complexity × Coverage) scorer for Python, JS/TS, Go, Rust.
 
-[Unreleased]: https://github.com/jeremylongshore/intent-audit-harness/compare/v1.2.2...HEAD
+[Unreleased]: https://github.com/jeremylongshore/intent-audit-harness/compare/v1.4.0...HEAD
+[1.4.0]: https://github.com/jeremylongshore/intent-audit-harness/compare/v1.3.1...v1.4.0
 [1.2.2]: https://github.com/jeremylongshore/intent-audit-harness/compare/v1.2.1...v1.2.2
 [1.2.1]: https://github.com/jeremylongshore/intent-audit-harness/compare/v1.2.0...v1.2.1
 [1.2.0]: https://github.com/jeremylongshore/intent-audit-harness/compare/v1.1.8...v1.2.0

.audit-harness/PROVENANCE

@@ -1,4 +1,4 @@
 source-repo:   jeremylongshore/intent-audit-harness
-source-version: v1.3.1
-source-tarball: https://github.com/jeremylongshore/intent-audit-harness/archive/refs/tags/v1.3.1.tar.gz
-installed-at:  2026-07-29T06:10:55Z
+source-version: v1.4.0
+source-tarball: https://github.com/jeremylongshore/intent-audit-harness/archive/refs/tags/v1.4.0.tar.gz
+installed-at:  2026-09-05T02:13:18Z

.audit-harness/README.md

@@ -4,6 +4,8 @@
 [![License](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
 [![Provenance](https://img.shields.io/badge/sigstore-provenance-066da5)](https://www.npmjs.com/package/@intentsolutions/audit-harness)
 
+[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/U5S225PTME)
+
 Part of the **[Intent Eval Platform](https://github.com/intent-solutions-io/intent-eval-platform)** — the umbrella grouping the platform's six repos: five converge via a shared Evidence Bundle schema (`intent-eval-core`, `intent-eval-lab`, `audit-harness`, `j-rig-skill-binary-eval`, `intent-rollout-gate`), plus `intent-eval-dashboard` as a satellite consumer (not part of the convergence taxonomy).
 
 Deterministic test-enforcement toolkit. Companion to the `audit-tests` and `implement-tests` Claude Code skills — but usable standalone in any repo that wants hash-pinned, escape-scanned, AI-resistant quality gates.
@@ -106,10 +108,22 @@ git commit -m "chore(test): lower coverage floor to 75"
 
 The harness enforces this rule: **policy changes must be conscious, not silent.**
 
-Engineer-owned files (`tests/TESTING.md`, `features/*.feature`, `.dependency-cruiser.cjs`, `stryker.conf.json`, etc.) are hashed into a manifest. Any diff that changes their content without a fresh `audit-harness init` is caught by pre-commit / CI and **REFUSED**.
+Engineer-owned files (`tests/TESTING.md`, package test scripts, CI workflows,
+coverage and mutation configs, acceptance features, and architecture rules) are
+hashed into a manifest. Any diff that changes their content without a fresh
+`audit-harness init` is caught by pre-commit / CI and **REFUSED**. Ordinary
+application source is deliberately outside this denominator.
 
 AI agents remain useful (they can read policy, they can implement within constraints). What they can't do is silently weaken the constraints. That's the entire design.
 
+The same walls can close the loop **before a push leaves the machine**:
+`audit-harness worktree-run --pre-push` checks the exact ref being pushed in a
+disposable `git worktree` — `verify` + `escape-scan` on the push range stay
+fail-closed, `conform` + `audit` contribute advisory gate-result/v1 rows — then
+removes the worktree. It has no push authority, no LLM stage, and never writes
+to the repo. Wire it as a lefthook `pre-push` job (this repo's `lefthook.yml`
+is the reference) so CI becomes confirmation instead of discovery.
+
 See `audit-tests/references/philosophy.md` in the companion skill for the full rationale.
 
 ## The 7-layer testing taxonomy

.audit-harness/VERSION

@@ -1 +1 @@
-v1.3.1
+v1.4.0

.audit-harness/bin/audit-harness.js

@@ -31,13 +31,15 @@ const COMMANDS = {
   'currency':      { script: 'currency.py',      args: [] },
   'migration-notes': { script: 'migration-notes.py', args: [] },
   'gen-layer-applicability': { script: 'gen-layer-applicability.py', args: [] },
+  'worktree-run':  { script: 'worktree-run.sh',  args: [] },
 };
 
 // Gate commands that may be no-op'd by the AUDIT_HARNESS_DISABLE kill-switch.
 // classify is intentionally NOT here: it emits a meaningful kill-switched profile
 // itself (every gate enforcement=disabled). verify/init/list always run.
 const KILLABLE_GATES = new Set([
   'escape-scan', 'cred-gate', 'arch', 'bias', 'gherkin-lint', 'crap', 'emit-evidence',
+  'worktree-run',
 ]);
 
 function usage() {
@@ -118,6 +120,12 @@ Commands:
   emit-evidence            Wrap a gate-result JSON envelope in an in-toto
                            Statement v1 (predicate https://evals.intentsolutions.io/gate-result/v1)
                            Read JSON on stdin: <gate> --json | audit-harness emit-evidence
+  worktree-run             Pre-push gate runner: checks the ref being pushed in
+                           a disposable git worktree (verify + escape-scan on
+                           the push range fail-closed; conform + audit advisory)
+                           and emits gate-result/v1 rows. No push authority, no
+                           repo writes. --pre-push | --ref REF | --range A..B |
+                           --out FILE. Wire via lefthook pre-push (see README).
 
 Evidence Bundle (v0.3.0+):
   All gates support --json to emit machine-readable gate-result envelopes

.audit-harness/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentsolutions/audit-harness",
-  "version": "1.3.1",
+  "version": "1.4.0",
   "description": "Deterministic test-enforcement harness — escape-scan, hash-pinning, CRAP, architecture checks, bias detection, Gherkin lint. Companion to the audit-tests and implement-tests Claude Code skills.",
   "license": "Apache-2.0",
   "author": "Jeremy Longshore <jeremy@intentsolutions.io>",

.audit-harness/scripts/audit.py

@@ -183,6 +183,21 @@ def d_perf(repo, deps):
 def d_a11y(repo, deps):
     if any(x in deps for x in ("axe-core", "@axe-core/playwright", "jest-axe", "pa11y")):
         return True, "a11y tooling dep"
+    # Accessibility is not a web-only layer. QML, native, CLI/TUI, mobile, and
+    # desktop projects commonly assert roles, names, focus, keyboard routing,
+    # contrast, or screen-reader contracts in ordinary language-native tests.
+    # Keep the filename signal test-specific so an accessibility.md design
+    # document alone does not masquerade as executable evidence.
+    if has_dir(repo, "a11y", "accessibility"):
+        return True, "a11y/accessibility test dir"
+    test_exts = (".js", ".ts", ".py", ".go", ".rs", ".java", ".kt", ".cs", ".rb")
+    if has_file_matching(
+        repo,
+        lambda f: ("a11y" in f.lower() or "accessibility" in f.lower())
+        and ("test" in f.lower() or "spec" in f.lower())
+        and f.lower().endswith(test_exts),
+    ):
+        return True, "a11y/accessibility test file"
     return False, "no accessibility test infrastructure detected"
 
 

.audit-harness/scripts/bias-count.sh

@@ -71,7 +71,11 @@ count_pattern() {
   local label="$1"
   local pattern="$2"
   local count
-  count=$(grep -rn "$pattern" "$TEST_DIR" 2>/dev/null | wc -l)
+  # `|| true`: under pipefail a zero-match grep exits 1, which killed the whole
+  # scan mid-report (truncated output, exit 1) on any clean directory — the
+  # "gate that looks like it ran" failure class from 1.3.1. wc's count is
+  # captured either way.
+  count=$(grep -rn "$pattern" "$TEST_DIR" 2>/dev/null | wc -l) || true
   TOTAL_BIAS=$((TOTAL_BIAS + count))
   printf "  %-30s %d\n" "$label" "$count"
 }
@@ -88,13 +92,20 @@ count_pattern "Symmetric input (1,1)" "(1, 1)"
 count_pattern "Symmetric input (100,100)" "(100, 100)"
 count_pattern "Range-only assertion" "assert.*<=.*<="
 count_pattern 'Substring check (in str)' '" in '
+# Source-introspection tests: a test whose evidence is reading the
+# implementation source (inspect.getsource, reading files under src/) instead
+# of asserting observable behaviour of a public interface. Deterministic
+# counterpart of the prose rule in auto-remediation.md; advisory like every
+# other bias pattern here (promotion to blocking goes through fp-rate).
+count_pattern "Source-introspection (getsource)" "inspect\.getsource\|getsource("
+count_pattern "Source-read test (src/ file)" "readFileSync([^)]*src/\|open([^)]*['\"]src/"
 echo
 
-# Count test functions
-TEST_COUNT=$(grep -rn "def test_\|it('\|it(\"\\|test('\|test(\"" "$TEST_DIR" 2>/dev/null | wc -l)
+# Count test functions (`|| true` — see count_pattern)
+TEST_COUNT=$(grep -rn "def test_\|it('\|it(\"\\|test('\|test(\"" "$TEST_DIR" 2>/dev/null | wc -l) || true
 
-# Count total assertions
-ASSERT_COUNT=$(grep -rn "assert\b\|assertEqual\|expect(" "$TEST_DIR" 2>/dev/null | wc -l)
+# Count total assertions (`|| true` — see count_pattern)
+ASSERT_COUNT=$(grep -rn "assert\b\|assertEqual\|expect(" "$TEST_DIR" 2>/dev/null | wc -l) || true
 
 # Assertion density
 if [ "$TEST_COUNT" -gt 0 ]; then

.audit-harness/scripts/harness-hash.sh

@@ -55,6 +55,12 @@ done
 set -- "${_filtered_args[@]+"${_filtered_args[@]}"}"
 
 PATTERNS=(
+  # Wall 1: the declared test contract and package-level command surface. A
+  # coverage floor is not protected if an edit can simply replace `npm test`
+  # with a weaker command or remove the CI invocation that enforces it.
+  "TESTING.md"
+  "tests/TESTING.md"
+  "package.json"
   # Wall 1: acceptance
   "features/**/*.feature"
   "features/*.feature"
@@ -71,9 +77,39 @@ PATTERNS=(
   "test/**/*ArchTests.cs"
   "tests/**/*ArchTests.cs"
   # Coverage thresholds (edits to these are escape attempts — hash them)
+  ".c8rc"
   ".c8rc.json"
+  ".nycrc"
+  ".nycrc.json"
+  ".nycrc.yml"
+  ".nycrc.yaml"
+  ".coveragerc"
+  "coverage.toml"
+  "jest.config.js"
+  "jest.config.cjs"
+  "jest.config.mjs"
+  "jest.config.ts"
+  "vitest.config.js"
+  "vitest.config.cjs"
+  "vitest.config.mjs"
+  "vitest.config.ts"
+  "pytest.ini"
+  "pyproject.toml"
+  "setup.cfg"
+  "tox.ini"
   "stryker.conf.json"
   "stryker.config.js"
+  "stryker.config.cjs"
+  "stryker.config.mjs"
+  # Wall 1: primary CI enforcement. Workflow changes are legitimate, but they
+  # must be accompanied by an explicit re-pin so removing a test, race,
+  # mutation, or audit step cannot masquerade as an ordinary source edit.
+  ".github/workflows/*.yml"
+  ".github/workflows/*.yaml"
+  ".gitlab-ci.yml"
+  ".circleci/config.yml"
+  "azure-pipelines.yml"
+  "Jenkinsfile"
 )
 
 # Optional per-repo extra patterns appended from .harness-hash-extra-patterns