Prepare harness-extractor for public release

[ArkashJ]

What changed

• converted the reducer into the stdlib-only harness_extractor 1.0.0 library and harness-extractor CLI while retaining ./harvest.py
• added valid multi-file JSON, configurable inventory paths, strict option validation, safe Markdown fences, fork dedupe, and repeat detection
• added setuptools metadata, wheel/sdist builds, MIT license, changelog, code of conduct, contributing/security policies, CLAUDE.md, AGENTS.md, and GitHub templates
• added Python 3.10–3.14 CI, clean wheel/sdist installs, extracted-sdist tests, release artifact/version smokes, and executable workflow-contract guards
• removed private findings, syntheses, provenance notes, and two retained confidential prompts from tracking while preserving their local copies
• added the reviewed sensitive-history, GitHub Support, release, and Homebrew tap plan with separate force-push and merge confirmation gates

Root causes fixed

• .gitignore cannot untrack files already committed, and repository instructions explicitly told agents to commit private findings
• fixed-path privacy checks missed confidential content in retained prompt files
• CLI/API and release workflow contracts were under-tested, allowing green checks on incomplete behavior and disconnected workflow wiring

Verification

• python3 -m unittest discover -s tests -v — 20 tests pass
• extracted sdist — 17 tests pass, 3 explicit repository-only skips
• python3 -m py_compile harness_extractor.py harvest.py — pass
• wheel and sdist build + Twine — pass
• clean wheel/sdist version, help, and synthetic fixture smokes — pass
• artifact private-path scan — zero matches
• workflow YAML and 34 release-plan shell blocks — parse successfully
• CI push run: https://github.com/ArkashJ/harness_extractor/actions/runs/32113998970
• CI pull-request run: https://github.com/ArkashJ/harness_extractor/actions/runs/32114003458
• GitGuardian Security Checks — pass

Privacy state

The repository is temporarily PRIVATE after final review found retained confidential prompt context. It must remain private until the reviewed history rewrite, GitHub Support cleanup/readback, and zero-forbidden-path checks pass. The plan then restores PUBLIC visibility and enables private vulnerability reporting before release.

Still deliberately unperformed

• force-push rewritten public refs
• GitHub Support cached-view/internal-ref cleanup and readback
• merge PR Prepare harness-extractor for public release #1
• tag and publish v1.0.0
• create ArkashJ/homebrew-tap, audit/test the formula, and verify the documented install command

Each destructive/external phase retains its exact confirmation and authoritative readback gate.

Not covered

• PyPI publishing is intentionally excluded; README uses immutable GitHub release asset URLs
• bottles and automated Homebrew release bots are intentionally excluded

[ArkashJ]

Checkpoint log

2026-08-18 00:08 CDT — private harvest boundary landed in 914594b: 87 findings/ entries untracked while 87 local files remain; repository ignores, docs, weekly prompt, and regression test updated — verify: python3 -m unittest discover -s tests -v (2 tests, OK) — next: package/library/CLI release unit

2026-08-18 00:12 CDT — expanded private boundary landed in ffd9250: seven synthesis files and one provenance note untracked and preserved locally; remaining public index scanned for known personal identifiers — verify: python3 -m unittest discover -s tests -v (2 tests, OK) and identifier scan returned no matches — next: approved release design and plan

2026-08-18 00:19 CDT — release design and six-task implementation plan landed in e219e00 and 21fe9b3; isolated implementation worktree created and Task 1 dispatched — verify: baseline python3 -m unittest discover -s tests -v (2 tests, OK) — in flight: /root/task1_library on child branch codex/library-cli-implementation

2026-08-18 00:44 CDT — Tasks 1–3 landed on pushed child branch through 57ff68e: importable module, hardened CLI, and harness-extractor 1.0.0 wheel/sdist; Task 2 review fixes included — verify: 10 tests OK, twine check passed, wheel and sdist clean installs both printed 1.0.0 — in flight: /root/task4_docs; next: docs/governance then CI

2026-08-18 02:45 CDT — branch-wide adversarial review and single fix wave landed through a69aeb4: confidential retained prompts removed, repository temporarily PRIVATE, API/CLI/test/docs/workflow/history-plan blockers fixed — verify: 18 tests OK, extracted sdist OK with 2 repo-only skips, CI 32112465636 success — next: harvest guards

2026-08-18 02:59 CDT — $harvest guard landed through 9798281: workflow authentication/repository/tag/artifact and extracted-sdist wiring now fail with actionable messages when disconnected; PR #1 fast-forwarded to exact head — verify: mutation failures observed, 20 tests OK, parent push and PR CI runs 32113998970/32114003458 plus GitGuardian all success — next: sensitive-history remediation confirmation gate

2026-08-18 03:21 CDT — release candidate frozen and marked ready; private 0600 bundle plus disposable sensitive-history rewrite verified locally; all 5 refs rewritten, 0 forbidden paths, 3/3 public trees equivalent, fsck clean, rewritten candidate 45fcfbb, 20 tests/build/Twine green — verify: Task 1 and Task 2 independent reviews approved — next: fresh atomic force-push confirmation

2026-08-18 03:25 CDT — disposable local Homebrew tap built the reviewed sdist from source, installed harness-extractor 1.0.0, and passed version + synthetic fixture formula tests; temporary keg/tap removed and developer mode restored — verify: brew test exit 0 and installed CLI readback 1.0.0 — next: fresh atomic force-push confirmation

2026-08-18 08:52 CDT — approved sensitive-history rewrite atomically force-pushed with three exact leases; fresh GitHub branch + PR refs contain 0 forbidden paths, regenerated merge parents match, fsck clean, rewritten CI 32144445908 success; 2 stale local clones quarantined from pushes — verify: fresh bare GitHub readback and exact-head checks — next: authenticated GitHub Support cached-view/internal-ref cleanup

SURPRISE: GitHub connected-app PR creation returned 403 Resource not accessible by integration; authenticated gh pr create succeeded.
SURPRISE: fixed-path privacy checks passed while retained prompt files still exposed confidential context; repository was made PRIVATE and the paths now enter ignore/tests/history remediation.
FALSIFIED: unscoped workflow marker checks passed while auth/release wiring could be disconnected; the harvested guard now scopes relationships to exact jobs and steps and has failing mutation proof.