feat!: harden the coding agent harness

[hannsxpeter]

Summary

• add compact complete verification evidence, bounded specialist context, approved program design, durable slice handoffs, maintainability trajectories, and a six-checkpoint evolution benchmark
• migrate the MCP companion to MCP v2 with configured-root containment and Node.js 20 as its minimum
• add the opt-in authorized provenance extension and exact-origin consent controls
• harden paired npm publication, extension publication identity, traversal bounds, Git isolation, and event evidence
• synchronize architecture, requirements, roadmap, public documentation, release notes, and Godpowers state for 6.0.0

Breaking change

The root CLI keeps Node.js 18 support. The @godpowers/mcp companion now requires Node.js 20 or newer.

Validation

• npm run release:check
• 114 test commands and 3,113 checks
• 94.64 percent line coverage and 79.8 percent branch coverage
• 70 percent per-file line floor across 110 included runtime modules
• zero dependency vulnerabilities
• 140 self-project truth checks
• independent hardening: 2 Critical, 3 High, and 4 Medium findings resolved, zero unresolved
• pre-publication gate passes against the final hardening revision

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9cf6c532a6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Fail when Build omits program-design declarations

When an upgraded or malformed Build state omits both scale and a plan path, shouldValidate is false and the new program-design gate silently returns without adding any check. The committed .godpowers/state.json has exactly that shape, and gate.check({ tier: 'build' }) consequently passes with no program-design checks, allowing medium or large work to bypass the required plan sections and approval. Treat absent declarations as a failure or validate the canonical Build plan unconditionally. agents/quality.mdL32-L32

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Keep the Node 18 CI path out of the MCP workspace

After this engine bump, the Node 18 job in .github/workflows/ci.yml still runs npm test, while scripts/run-tests.js unconditionally executes npm --workspace @godpowers/mcp test. The MCP workspace and its v2 server dependency now require Node 20 or newer, so the advertised Node 18 matrix attempts to load an unsupported package and can fail before completing root-package verification. Gate the MCP protocol test to Node 20 or newer, or separate the root and MCP test jobs. agents/quality.mdL43-L43

Useful? React with 👍 / 👎.