feat(f257): rebuild develop_base with Harness-only substrate

[mindfn]

What

Rebuild develop_base from origin/main at 06263d999 with the complete reusable Harness/F257 substrate while excluding fork-instance branding, local governance/ports, TeamAct/review notes, and runtime verdict artifacts.

The reviewed branch is linear (3 commits) and changes 508 files (+53,293/-4,480). It restores the complete consumed Harness stack across tracing, routing/guard/ball-custody telemetry, persistent ledgers, Objective/Metric evaluation, segment lifeline/replay, Console, API/MCP wiring, tests, docs, and governance checks.

Why

PR #87 combined reusable Harness work with fork-instance-only content and was squash-merged, so commit boundaries could no longer mechanically separate the two. The old tree is preserved by annotated archive tags; develop_base has now been reset to the latest main, making this PR the clean Harness-only overlay.

Issue Closure

• F257 work item; no GitHub issue closure.

Original Requirements

• Discussion: thread thread_mrdip0u5aw4ysi97, message 0001786090184730-000368-682ecb7e
• Original excerpt:

  重放 F257 与必要底座。不应该是我们做的 harness 的完整底座么；
  去掉其中 fork 仓特有的那些内容；然后把 develop_base 重新 reset，再重新合入。

• Core pain: keep the complete Harness foundation mechanically separable from fork-instance-only configuration and assets.
• Please judge whether the delivery actually resolves that operator problem.

Plan / ADR

• Plan: feature-specs/2026-08-04-f257-objective-eval-redesign.md
• Feature: docs/features/F257-harness-ledger.md
• Architecture cell: docs/architecture/ownership/cells/harness-eval.md
• Map delta: updated as a strict union with current main; continuity guard prevents dropping existing F266/F267/F278 ownership.

Risk Routing

• Behavior: high — routing, trace closure, evaluation scheduling, Console read models, and startup wiring span multiple packages.
• Data: medium — new append-only/runtime persistence paths; no production-data migration, deletion, or TTL reduction.
• Security: medium — fail-closed registry/coordinate validation and path-traversal defense; no new credentials or auth boundary.
• Contract: high — shared schemas plus API/MCP/Web consumers.
• Irreversible: controlled branch-history reset already completed with exact lease; old tree remains recoverable through annotated archive tags.

Gate selection: full pnpm gate required because targeted tests cannot cover this cross-package contract surface.

Cloud review: not selected. Stateful cross-family reviewer Fable covered the exact full diff, while Opus supplied an independent fresh-context security/boundary scan; there is no production-data, authentication, secret, or new external-contract surface requiring a second context-blind gate.

Tips Contribution

• Updated packages/web/src/lib/capability-tips.seed.json for the user-visible Harness capability path.
• Source references remain traceable.

Tradeoff

Preserve the complete substrate instead of producing a smaller “F257-only” patch. This makes the PR large, but avoids removing dependencies actually consumed by Harness and keeps the final branch boundary truthful.

Test Evidence

• pnpm gate — PASS on exact SHA 197c6da867193651c6f0a0ccfd3b9f5ff0eb7896 in 976 seconds; latest origin/main rebase, build, TypeScript, public tests, lint, and repository checks all passed.
• Focused: API 342, Web 133, Shared 272, MCP 7 — all passed.
• Hook variable unit tests: 3/3 passed.
• Ownership continuity tests: reviewer sandbox 5/5 passed.
• F257 reviewer focused tests: 122/122 passed.
• Candidate worktree clean; root artifact guard empty.
• Isolated preview: both F257 showcase routes compiled and returned HTTP 200. Browser continuity proof: all 30 changed Web code/component/test blobs are byte-identical to the archived PR87 reviewed tree that operator exercised in Hub Preview; the only differing Web path is non-interactive capability-tip data. This session does not claim a new click transcript.

Fresh-Context and Review Provenance

• Opus fresh-context scan on 0bb1ced20: 0 P1, 0 P2, 1 P3. FC-1 (hook-variable utility test coverage) fixed in a0df429dc.
• Architecture prerequisite finding (stale ownership replacement) fixed in 197c6da86 with a permanent continuity guard.
• Fable formal exact-HEAD review: APPROVE on 197c6da867193651c6f0a0ccfd3b9f5ff0eb7896; 0 P1, 0 P2, 0 new findings.

Open Questions

• Acceptance-only: after live activation, exercise both showcase pages and check runtime console/network behavior in the newly started process.

---

Local Review: [x] Fable — exact-HEAD APPROVE
Cloud Review: [x] Not selected; risk rationale above

Author: Maine Coon / gpt-5.6-sol

[mindfn]

Local review provenance transfer

• Reviewer: Fable (cross-family, non-author)
• Verdict: APPROVE — 0 P1, 0 P2, 0 new findings
• Reviewed exact SHA: 197c6da
• Thread verdict anchor: thread_mrdip0u5aw4ysi97 / message 0001786107470160-000599-68efd2b5
• Mechanical identity proof: PR headRefOid equals the reviewed SHA; local worktree HEAD equals the same SHA; no post-review content delta.
• Fresh-context delta: FC-1 covered and fixed in a0df429; ownership continuity issue fixed in 197c6da; no additional findings.
• Validation residue: browser click/runtime console/network acceptance remains explicitly unchecked because both review sessions lacked the supported browser control surface. HTTP/SSR and focused Web tests passed.

[mindfn]

Merge-gate evidence manifest

• head: 197c6da
• localPeerReviewSha: 197c6da
• cloudReviewSha: none (not selected; risk rationale in PR body)
• headChangeCause: pr-meta (PR body/comment only; no post-review content delta)
• nextGateOwner: author / merge owner
• gate_passed: true
• gate_commands: pnpm gate (976s), node scripts/check-feature-truth.mjs, git diff --check origin/main...HEAD, focused API/Web/Shared/MCP suites
• trigger_reason: high behavior and contract span; medium append-only data and validation security; no production migration, credentials, auth boundary, or external contract; full local gate plus stateful cross-family review selected
• stale: false — local reviewer APPROVE covers exact PR HEAD
• verdict: passed
• hotfix: false

Evidence Validation Checker:

• E1 PASS: local HEAD equals PR headRefOid
• E2 PASS: exact-HEAD local review is not stale
• E3 PASS: non-author reviewer provenance transferred from thread message 0001786107470160-000599-68efd2b5; PR HEAD identity is exact
• E4 PASS: APPROVE, 0 P1 / 0 P2 / 0 new findings
• E5 PASS: full risk-matched gate passed

Browser continuity:

• 30/30 changed Web code/component/test blobs are identical to archived reviewed head 8526f8b, whose UI was exercised in Hub Preview during prior operator feedback loops.
• The sole changed Web blob relative to that tree is packages/web/src/lib/capability-tips.seed.json, which is non-interactive content.
• Current isolated sandbox compiled both showcase routes and returned HTTP 200; no new click transcript is claimed.

GitHub executable checks: none configured/reported for this PR HEAD; REST check-runs total_count=0. Local full gate is the executable quality gate.