supercode_harness/

support.rs

//! Canonical implementation inventory for external coding harnesses.
//!
//! This registry describes wiring that exists in the compiled core. It does
//! not claim that a harness has passed a real executable smoke test; the
//! support audit joins this inventory with behavioral probe receipts and
//! tracker state before it calls anything verified.

use std::collections::BTreeMap;

use serde::{Deserialize, Serialize};

use crate::{
    AcpRuntimeBackend, ClaudeCodeRuntimeBackend, CodexRuntimeBackend, HarnessId,
    OpenCodeRuntimeBackend, PiRuntimeBackend, RuntimeBackend, RuntimeCapabilities,
    RuntimeConnectLaunch, RuntimeLaunch,
};

/// Schema emitted by [`harness_support_registry`].
pub const SUPPORT_REGISTRY_SCHEMA: &str = "supercode.support-registry.v1";

/// How a primitive is wired into the compiled core.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum ImplementationKind {
    /// A harness-specific implementation is registered.
    BuiltIn,
    /// A protocol-generic implementation is usable with a known launch.
    GenericProtocol,
    /// No implementation is present.
    Absent,
}

/// Persisted-session and translation implementation facts.
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct NativeSupport {
    /// Whether the catalog can discover this harness's sessions.
    pub discover: ImplementationKind,
    /// Whether the core can load this harness's native persisted format.
    pub load: ImplementationKind,
    /// Whether the generic follower can open this harness's native storage.
    pub follow: ImplementationKind,
    /// Whether the canonical session can import this native format.
    pub import: ImplementationKind,
    /// Whether the canonical session can export this native format.
    pub export: ImplementationKind,
}

/// Live runtime wiring known without launching the real executable.
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct RuntimeSupport {
    /// Harness-specific or protocol-generic adapter registration.
    pub implementation: ImplementationKind,
    /// Protocol spoken by the adapter.
    pub protocol: String,
    /// Command used when callers do not provide an override.
    pub default_launch: Option<RuntimeLaunch>,
    /// Connect-mode launch for gateway harnesses: where a running endpoint's
    /// address and credential live in the harness's own config file. `None`
    /// for spawn-only harnesses; declaring one is an explicit registry
    /// decision, never inferred.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub connect_launch: Option<RuntimeConnectLaunch>,
    /// Static adapter capabilities. Optional protocol features are only true
    /// for known agents that advertise them; the adapter validates them again
    /// during the live handshake.
    pub capabilities: RuntimeCapabilities,
}

/// One compiled harness implementation descriptor.

/// The twelve Domain 11 concepts, in plan order
/// (`docs/plans/orchestration-domain-11-2026-09-02.md`).
pub const ORCHESTRATION_CONCEPTS: &[&str] = &[
    "scheduled_job",
    "run",
    "conversation",
    "pending_request",
    "profile",
    "skills",
    "memory",
    "delivery_target",
    "channel",
    "routing",
    "inbound_trigger",
    "gateway_health",
];

/// One orchestration concept's tiers for one harness (ORCH-4).
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct ConceptSupport {
    /// One of [`ORCHESTRATION_CONCEPTS`].
    pub concept: String,
    /// Read tier: supercode lists/inspects the concept from the harness's own files or CLI.
    pub observed: ImplementationKind,
    /// Write tier: supercode mutates the concept through the harness's own verb.
    pub controlled: ImplementationKind,
    /// `harness.v1.<noun>.<verb>` methods backing the non-`Absent` tiers.
    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    pub methods: Vec<String>,
}

/// Per-concept observed / controlled tiers for one harness (additive to the
/// v1 registry schema, like `connect_launch`).
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Default)]
pub struct OrchestrationSupport {
    /// Exactly [`ORCHESTRATION_CONCEPTS`], in order.
    pub concepts: Vec<ConceptSupport>,
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct HarnessSupportDescriptor {
    /// Stable harness identifier.
    pub id: HarnessId,
    /// Human-readable name.
    pub display_name: String,
    /// Native persistence/translation implementation.
    pub native: NativeSupport,
    /// Live runtime implementation.
    pub runtime: RuntimeSupport,
    /// ORCH-4: orchestration concept tiers (defaults to all-`Absent`).
    #[serde(default)]
    pub orchestration: OrchestrationSupport,
}

/// Machine-readable compiled support inventory.
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct SupportRegistryReport {
    /// Report schema.
    pub schema: String,
    /// Harness descriptors, in stable product order.
    pub harnesses: Vec<HarnessSupportDescriptor>,
}

/// Whether a harness can enter its own sandbox by replacing its process image.
///
/// WebAssembly has no process replacement, so a harness asked to sandbox itself
/// there aborts before its handshake. Everything the loader starts on that
/// target is already confined to the browser it runs in.
pub(crate) fn self_sandbox_supported() -> bool {
    !cfg!(target_family = "wasm")
}

/// Grok refuses its `workspace` sandbox when its home is a symlink ("symlinked GROK_HOME is
/// not allowed under sandbox write-deny"), so a symlinked `~/.grok` is named by the path it
/// resolves to: the same directory, which the sandbox can then protect. An explicit
/// `GROK_HOME` is left to the caller.
pub(crate) fn grok_home_env() -> BTreeMap<String, String> {
    let mut env = BTreeMap::new();
    if std::env::var_os("GROK_HOME").is_none() {
        if let Some(home) = supercode_interchange::user_home()
            .map(std::path::PathBuf::into_os_string)
            .map(std::path::PathBuf::from)
        {
            let grok = home.join(".grok");
            let linked = std::fs::symlink_metadata(&grok)
                .map(|metadata| metadata.file_type().is_symlink())
                .unwrap_or(false);
            if let (true, Ok(resolved)) = (linked, grok.canonicalize()) {
                env.insert("GROK_HOME".into(), resolved.to_string_lossy().into_owned());
            }
        }
    }
    env
}

/// A headless Grok runtime's environment: no agent dashboard, and [`grok_home_env`].
pub(crate) fn grok_env() -> BTreeMap<String, String> {
    let mut env = grok_home_env();
    env.insert("GROK_AGENT_DASHBOARD".into(), "0".into());
    env
}

/// Builds Grok's stdio launch, asking it to sandbox itself where it can.
fn grok_arguments() -> Vec<String> {
    let mut arguments: Vec<String> = Vec::new();
    if self_sandbox_supported() {
        arguments.push("--sandbox".into());
        arguments.push("workspace".into());
    }
    arguments.push("agent".into());
    arguments.push("--no-leader".into());
    arguments.push("stdio".into());
    arguments
}

fn built_in_native() -> NativeSupport {
    NativeSupport {
        discover: ImplementationKind::BuiltIn,
        load: ImplementationKind::BuiltIn,
        follow: ImplementationKind::BuiltIn,
        import: ImplementationKind::BuiltIn,
        export: ImplementationKind::BuiltIn,
    }
}

fn built_in_runtime(
    backend: &dyn RuntimeBackend,
    protocol: &str,
    launch: RuntimeLaunch,
) -> RuntimeSupport {
    RuntimeSupport {
        implementation: ImplementationKind::BuiltIn,
        protocol: protocol.into(),
        default_launch: Some(launch),
        connect_launch: None,
        capabilities: backend.capabilities(),
    }
}

/// Return the single compiled inventory used by product surfaces and audits.

/// Derive a harness's orchestration tiers from what the registry already
/// proves: a harness whose sessions load natively is `observed` for the
/// conversation concept (`sessions.discover`/`load`), and a runtime door that
/// answers protocol requests is `controlled` for pending requests
/// (`runtimes.respond`). Every other cell is `Absent` until its ORCH item
/// lands and adds its method here.
pub fn orchestration_support(descriptor: &HarnessSupportDescriptor) -> OrchestrationSupport {
    let concepts = ORCHESTRATION_CONCEPTS
        .iter()
        .map(|concept| {
            let (observed, controlled, methods): (
                ImplementationKind,
                ImplementationKind,
                Vec<&str>,
            ) = match *concept {
                // ORCH-18: the two harnesses that publish a client-callable
                // cron verb are also CONTROLLED — supercode runs `hermes cron
                // …` / `openclaw cron …` on the caller's behalf and re-reads
                // the row (`crate::jobs_control`). supercode still schedules
                // nothing itself; the tier means "the harness's own verb is
                // reachable through one uniform door".
                "scheduled_job"
                    if crate::jobs_control::supports_job_control(descriptor.id.as_str()) =>
                {
                    (
                        ImplementationKind::BuiltIn,
                        ImplementationKind::BuiltIn,
                        vec![
                            "harness.v1.jobs.list",
                            "harness.v1.jobs.get",
                            "harness.v1.jobs.create",
                            "harness.v1.jobs.update",
                            "harness.v1.jobs.pause",
                            "harness.v1.jobs.resume",
                            "harness.v1.jobs.run",
                            "harness.v1.jobs.delete",
                        ],
                    )
                }
                // ORCH-7: the three harnesses that HAVE scheduled jobs are read
                // uniformly from their own stores. Claude Code stays read-only
                // on purpose: its jobs are session-scoped runtime state created
                // by the model inside a session (`CronCreate`), so there is no
                // harness verb for a client to call.
                "scheduled_job" if crate::jobs::supports_jobs(descriptor.id.as_str()) => (
                    ImplementationKind::BuiltIn,
                    ImplementationKind::Absent,
                    vec!["harness.v1.jobs.list", "harness.v1.jobs.get"],
                ),
                // ORCH-8: a harness is `observed` for runs when it KEEPS a
                // fire store the loader in `crate::runs` opens. Claude Code
                // has scheduled jobs but no run store — its fires are turns —
                // so it is deliberately absent here while `scheduled_job`
                // above is built-in for it.
                "run" if crate::runs::supports_runs(descriptor.id.as_str()) => (
                    ImplementationKind::BuiltIn,
                    ImplementationKind::Absent,
                    vec!["harness.v1.runs.list", "harness.v1.runs.get"],
                ),
                // ORCH-19: a harness is CONTROLLED for conversations when it
                // publishes at least one lifecycle DOOR supercode can drive —
                // Codex's `archive`/`delete` CLI verbs, OpenCode's HTTP session
                // API, Hermes's and OpenClaw's `/new`/`/reset` slash commands
                // typed into a live driven session, Hermes's `sessions delete`,
                // and supercode's own store. The advertised methods come from
                // `sessions_control`'s own door table, so a method can never be
                // listed here without a door behind it. Claude Code stays
                // read-only on purpose: it publishes no lifecycle verb at all
                // (its sessions expire on a retention window it owns).
                "conversation"
                    if descriptor.native.load == ImplementationKind::BuiltIn
                        && !crate::sessions_control::controlled_methods(descriptor.id.as_str())
                            .is_empty() =>
                {
                    let mut methods =
                        vec!["harness.v1.sessions.discover", "harness.v1.sessions.load"];
                    methods.extend(crate::sessions_control::controlled_methods(
                        descriptor.id.as_str(),
                    ));
                    (
                        ImplementationKind::BuiltIn,
                        ImplementationKind::BuiltIn,
                        methods,
                    )
                }
                // ORC-7: the orchestrator's conversations are its BINDINGS,
                // discovered from every profile folder's `bindings` table
                // (`supercode_interchange::catalog::discover_orchestrator`). They are
                // observed, not loadable: the transcript belongs to the
                // worker harness the binding addresses and is read through
                // that harness's own `sessions.load`.
                // ORC-13 makes them CONTROLLED: `/new` and `/reset` are the
                // two chat commands the daemon's reducer applies to a binding
                // (`docs/ORCHESTRATOR-IR.md` §4.5), and the operator door now
                // reaches that reducer from outside a chat — the daemon's own
                // socket, or its package's CLI when the daemon is down. The
                // methods come from `sessions_control`'s door table, so a
                // method can never be advertised without a door behind it.
                "conversation" if descriptor.id.as_str() == HarnessId::ORCHESTRATOR => {
                    let mut methods = vec!["harness.v1.sessions.discover"];
                    methods.extend(crate::sessions_control::controlled_methods(
                        descriptor.id.as_str(),
                    ));
                    (
                        ImplementationKind::BuiltIn,
                        ImplementationKind::BuiltIn,
                        methods,
                    )
                }
                "conversation" if descriptor.native.load == ImplementationKind::BuiltIn => (
                    ImplementationKind::BuiltIn,
                    ImplementationKind::Absent,
                    vec!["harness.v1.sessions.discover", "harness.v1.sessions.load"],
                ),
                // ORCH-9: a harness is `observed` for pending requests when
                // its runtime door can carry one — the same flag that makes
                // it `controlled`, because at the pinned versions the LIVE
                // request IS the only uniform source (no harness stores
                // approvals; see `crate::approvals`).
                // ORCH-20 adds `harness.v1.approvals.resolve` to the
                // controlled tier: one uniform decision, translated onto the
                // request's own options and sent through `runtimes.respond`.
                "pending_request" if descriptor.runtime.capabilities.respond_to_requests => (
                    ImplementationKind::BuiltIn,
                    ImplementationKind::BuiltIn,
                    vec![
                        "harness.v1.approvals.list",
                        "harness.v1.approvals.resolve",
                        "harness.v1.runtimes.respond",
                    ],
                ),
                // ORCH-21: the two harnesses that publish a client-callable
                // profile lifecycle verb are also CONTROLLED — supercode runs
                // `hermes profile create|delete` / `openclaw agents
                // add|delete` on the caller's behalf and re-reads the row
                // (`crate::profiles_control`). supercode still owns no config
                // plane; the tier means "the harness's own verb is reachable
                // through one uniform door".
                "profile"
                    if crate::profiles_control::supports_profile_control(
                        descriptor.id.as_str(),
                    ) =>
                {
                    (
                        ImplementationKind::BuiltIn,
                        ImplementationKind::BuiltIn,
                        vec![
                            "harness.v1.profiles.list",
                            "harness.v1.profiles.get",
                            "harness.v1.profiles.create",
                            "harness.v1.profiles.delete",
                        ],
                    )
                }
                // ORCH-10: the profile noun is read for the four harnesses
                // that have one — supercode's presets, Codex's
                // `[profiles.<name>]` tables, Hermes's profile homes, and
                // OpenClaw's agent homes. Every other harness refuses. Codex
                // and supercode stay read-only on purpose: a Codex profile is
                // a table a human authors in `config.toml` and a supercode
                // preset is compiled-in code, so neither publishes a verb a
                // client could call.
                "profile"
                    if crate::profiles::PROFILE_HARNESSES.contains(&descriptor.id.as_str()) =>
                {
                    (
                        ImplementationKind::BuiltIn,
                        ImplementationKind::Absent,
                        vec!["harness.v1.profiles.list", "harness.v1.profiles.get"],
                    )
                }
                // ORCH-11: a harness is `observed` for skills when the loader
                // in `crate::skills` opens its documented skill roots.
                // ORCH-22 makes those same harnesses `controlled`: each one
                // publishes a skills door supercode drives — `hermes skills
                // install|uninstall`, `openclaw skills install`, and for the
                // core four the loader's own directory, which IS their only
                // skills door. supercode resolves no registry and unpacks no
                // archive; a verb a harness lacks (OpenClaw has no `skills
                // remove` at the pin) refuses with UnsupportedAction.
                "skills"
                    if crate::skills_control::supports_skill_control(descriptor.id.as_str()) =>
                {
                    (
                        ImplementationKind::BuiltIn,
                        ImplementationKind::BuiltIn,
                        vec![
                            "harness.v1.skills.list",
                            "harness.v1.skills.install",
                            "harness.v1.skills.remove",
                        ],
                    )
                }
                // ORCH-13: a delivery target is a FIELD on a job or a run,
                // not a noun with verbs of its own, so it is observed exactly
                // where those rows are — `deliver` on every job harness, and
                // the delivery record on the two that keep a fire store.
                // Nothing is controlled: supercode never sends.
                "delivery_target" if crate::jobs::supports_jobs(descriptor.id.as_str()) => {
                    let mut methods = vec!["harness.v1.jobs.list", "harness.v1.jobs.get"];
                    if crate::runs::supports_runs(descriptor.id.as_str()) {
                        methods.push("harness.v1.runs.list");
                        methods.push("harness.v1.runs.get");
                    }
                    (
                        ImplementationKind::BuiltIn,
                        ImplementationKind::Absent,
                        methods,
                    )
                }
                // ORCH-14: the channel noun is read for the two gateway
                // harnesses that HAVE install-scoped channels — Hermes's
                // `platforms:` blocks and OpenClaw's `channels.<name>`
                // entries. Claude Code's channels are MCP servers that
                // declare the capability over the protocol, not in a config
                // file, so it is refused rather than guessed at.
                // ORCH-17: gateway state/endpoint on the inventory row, derived from the
                // UNI-7 running-instance probe and the harness's own config.
                "gateway_health"
                    if matches!(
                        descriptor.id.as_str(),
                        // ORC-7: the orchestrator's gateway state is its
                        // daemon lease (`<home>/orchestrator.lock` plus a
                        // liveness check on the pid it names), reported on
                        // the same `harnesses.list` row as the other two.
                        HarnessId::HERMES | HarnessId::OPENCLAW | HarnessId::ORCHESTRATOR
                    ) =>
                {
                    (
                        ImplementationKind::BuiltIn,
                        ImplementationKind::Absent,
                        vec!["harness.v1.harnesses.list"],
                    )
                }
                // ORCH-16: inbound webhook routes / hook mappings from the same configs.
                "inbound_trigger"
                    if crate::triggers::TRIGGER_HARNESSES.contains(&descriptor.id.as_str()) =>
                {
                    (
                        ImplementationKind::BuiltIn,
                        ImplementationKind::Absent,
                        vec!["harness.v1.triggers.list"],
                    )
                }
                // ORCH-15: routing entries read from the same gateway configs.
                "routing" if crate::routes::ROUTE_HARNESSES.contains(&descriptor.id.as_str()) => (
                    ImplementationKind::BuiltIn,
                    ImplementationKind::Absent,
                    vec!["harness.v1.routes.list"],
                ),
                "channel"
                    if crate::channels::CHANNEL_HARNESSES.contains(&descriptor.id.as_str()) =>
                {
                    (
                        ImplementationKind::BuiltIn,
                        ImplementationKind::Absent,
                        vec!["harness.v1.channels.list", "harness.v1.channels.status"],
                    )
                }
                // ORCH-12: a harness is `observed` for memory when
                // `crate::memory` opens its own persistent memory documents —
                // Claude Code's per-project auto-memory directory, Hermes's
                // `memories/MEMORY.md`/`USER.md` per profile home, and
                // OpenClaw memory-core's workspace files. Nothing is
                // controlled: forget/reset stay the harness's own verb.
                "memory" if crate::memory::supports_memory(descriptor.id.as_str()) => (
                    ImplementationKind::BuiltIn,
                    ImplementationKind::Absent,
                    vec!["harness.v1.memory.show", "harness.v1.memory.search"],
                ),
                _ => (
                    ImplementationKind::Absent,
                    ImplementationKind::Absent,
                    vec![],
                ),
            };
            ConceptSupport {
                concept: (*concept).to_string(),
                observed,
                controlled,
                methods: methods.into_iter().map(str::to_string).collect(),
            }
        })
        .collect();
    OrchestrationSupport { concepts }
}

pub fn harness_support_registry() -> SupportRegistryReport {
    let claude = ClaudeCodeRuntimeBackend::new();
    let codex = CodexRuntimeBackend::new();
    let opencode = OpenCodeRuntimeBackend::new();
    let pi = PiRuntimeBackend::new();
    let grok_launch = RuntimeLaunch {
        program: "grok".into(),
        arguments: grok_arguments(),
        env: grok_env(),
    };
    let grok = AcpRuntimeBackend::new(HarnessId::from(HarnessId::GROK), grok_launch.clone())
        .with_resume_support(true);
    let gemini_launch = RuntimeLaunch {
        program: "gemini".into(),
        // PARITY-24 drift 2026-08-31: gemini-cli 0.29.x renamed the ACP
        // flag; `--acp` is rejected with "Unknown argument". Verified live:
        // `--experimental-acp` completes the v1 initialize handshake.
        arguments: vec!["--experimental-acp".into()],
        env: BTreeMap::new(),
    };
    let gemini = AcpRuntimeBackend::new(HarnessId::from(HarnessId::GEMINI), gemini_launch.clone())
        .with_resume_support(true);
    let goose_launch = RuntimeLaunch {
        program: "goose".into(),
        arguments: vec!["acp".into()],
        env: BTreeMap::new(),
    };
    let goose = AcpRuntimeBackend::new(HarnessId::from(HarnessId::GOOSE), goose_launch.clone())
        .with_resume_support(true);
    let hermes_launch = RuntimeLaunch {
        program: "hermes-acp".into(),
        arguments: Vec::new(),
        env: BTreeMap::new(),
    };
    let hermes = AcpRuntimeBackend::new(HarnessId::from(HarnessId::HERMES), hermes_launch.clone())
        .with_resume_support(true);
    let openclaw_launch = RuntimeLaunch {
        // `openclaw acp` is a stdio ACP bridge that CONNECTS to a running
        // Gateway (never spawns one); with no flags it resolves the gateway
        // target from OpenClaw's own config. The explicit-endpoint variant is
        // the connect_launch below.
        program: "openclaw".into(),
        arguments: vec!["acp".into()],
        env: BTreeMap::new(),
    };
    let openclaw = AcpRuntimeBackend::new(
        HarnessId::from(HarnessId::OPENCLAW),
        openclaw_launch.clone(),
    )
    .with_resume_support(true);
    let supercode_launch = RuntimeLaunch {
        program: "supercode".into(),
        arguments: vec!["acp".into()],
        env: BTreeMap::new(),
    };
    let supercode = AcpRuntimeBackend::new(
        HarnessId::from(HarnessId::SUPERCODE),
        supercode_launch.clone(),
    )
    .with_resume_support(true);

    let mut report = SupportRegistryReport {
        schema: SUPPORT_REGISTRY_SCHEMA.into(),
        harnesses: vec![
            HarnessSupportDescriptor {
                id: HarnessId::from(HarnessId::CLAUDE_CODE),
                display_name: "Claude Code".into(),
                orchestration: OrchestrationSupport::default(),
                native: built_in_native(),
                // the backend's own prefix: a published launch that omitted the
                // stream-json flags started the interactive TUI on a pipe when
                // handed back through `RuntimeStart.launch`
                runtime: built_in_runtime(&claude, "claude-stream-json", claude.launch().clone()),
            },
            HarnessSupportDescriptor {
                id: HarnessId::from(HarnessId::CODEX),
                display_name: "Codex".into(),
                orchestration: OrchestrationSupport::default(),
                native: built_in_native(),
                runtime: built_in_runtime(
                    &codex,
                    "codex-app-server-jsonl",
                    RuntimeLaunch {
                        program: "codex".into(),
                        arguments: vec!["app-server".into()],
                        env: BTreeMap::new(),
                    },
                ),
            },
            HarnessSupportDescriptor {
                id: HarnessId::from(HarnessId::OPENCODE),
                display_name: "OpenCode".into(),
                orchestration: OrchestrationSupport::default(),
                native: built_in_native(),
                runtime: built_in_runtime(
                    &opencode,
                    "opencode-http-sse",
                    RuntimeLaunch {
                        program: "opencode".into(),
                        arguments: vec!["serve".into()],
                        env: BTreeMap::new(),
                    },
                ),
            },
            HarnessSupportDescriptor {
                id: HarnessId::from(HarnessId::PI),
                display_name: "Pi".into(),
                orchestration: OrchestrationSupport::default(),
                native: built_in_native(),
                runtime: built_in_runtime(
                    &pi,
                    "pi-rpc-jsonl",
                    RuntimeLaunch {
                        program: "pi".into(),
                        arguments: vec!["--mode".into(), "rpc".into()],
                        env: BTreeMap::new(),
                    },
                ),
            },
            HarnessSupportDescriptor {
                id: HarnessId::from(HarnessId::GROK),
                display_name: "Grok".into(),
                orchestration: OrchestrationSupport::default(),
                native: built_in_native(),
                runtime: RuntimeSupport {
                    implementation: ImplementationKind::GenericProtocol,
                    protocol: "acp-v1-jsonrpc".into(),
                    default_launch: Some(grok_launch),
                    connect_launch: None,
                    capabilities: grok.capabilities(),
                },
            },
            HarnessSupportDescriptor {
                id: HarnessId::from(HarnessId::GEMINI),
                display_name: "Gemini CLI".into(),
                orchestration: OrchestrationSupport::default(),
                native: built_in_native(),
                runtime: RuntimeSupport {
                    implementation: ImplementationKind::GenericProtocol,
                    protocol: "acp-v1-jsonrpc".into(),
                    default_launch: Some(gemini_launch),
                    connect_launch: None,
                    capabilities: gemini.capabilities(),
                },
            },
            HarnessSupportDescriptor {
                id: HarnessId::from(HarnessId::GOOSE),
                display_name: "Goose".into(),
                orchestration: OrchestrationSupport::default(),
                native: built_in_native(),
                runtime: RuntimeSupport {
                    implementation: ImplementationKind::GenericProtocol,
                    protocol: "acp-v1-jsonrpc".into(),
                    default_launch: Some(goose_launch),
                    connect_launch: None,
                    capabilities: goose.capabilities(),
                },
            },
            HarnessSupportDescriptor {
                id: HarnessId::from(HarnessId::HERMES),
                display_name: "Hermes Agent".into(),
                orchestration: OrchestrationSupport::default(),
                native: NativeSupport {
                    // UNI-15 read-only tier: discovery + load over the
                    // state.db SQLite store. Follow/import stay Absent.
                    // EXPORT (UNI-18) goes through Hermes's own door:
                    // `hermes sessions import --from codex` (0.21.0), which
                    // writes the store with Hermes's own writer — supercode
                    // never writes a live Hermes store itself. The tier
                    // stays driven (matrix membership is UNI-17's flip).
                    discover: ImplementationKind::BuiltIn,
                    load: ImplementationKind::BuiltIn,
                    follow: ImplementationKind::Absent,
                    import: ImplementationKind::Absent,
                    export: ImplementationKind::GenericProtocol,
                },
                runtime: RuntimeSupport {
                    implementation: ImplementationKind::GenericProtocol,
                    protocol: "acp-v1-jsonrpc".into(),
                    default_launch: Some(hermes_launch),
                    connect_launch: None,
                    capabilities: hermes.capabilities(),
                },
            },
            HarnessSupportDescriptor {
                id: HarnessId::from(HarnessId::OPENCLAW),
                display_name: "OpenClaw".into(),
                orchestration: OrchestrationSupport::default(),
                native: NativeSupport {
                    // UNI-16 read-only tier: discovery over
                    // `agents/<id>/sessions/*.jsonl` and the pi-v3-dialect
                    // loader (`from_openclaw_str`). Import (translate IN),
                    // export (write OUT), and follow stay Absent — the write
                    // path is a permanent skip, and the TIER stays `driven`:
                    // matrix membership remains UNI-17's priced flip.
                    discover: ImplementationKind::BuiltIn,
                    load: ImplementationKind::BuiltIn,
                    follow: ImplementationKind::Absent,
                    import: ImplementationKind::Absent,
                    export: ImplementationKind::Absent,
                },
                runtime: RuntimeSupport {
                    implementation: ImplementationKind::GenericProtocol,
                    protocol: "acp-v1-jsonrpc".into(),
                    default_launch: Some(openclaw_launch),
                    // Blind-walk finding 2026-08-31: `gateway.url` is NOT a
                    // key openclaw's config schema accepts (the gateway
                    // rejects the whole file as invalid config). The real
                    // shape: an optional full URL at `gateway.remote.url`, a
                    // bare `gateway.port` number, or nothing at all — the
                    // documented out-of-the-box endpoint is ws://127.0.0.1:18789.
                    connect_launch: Some(RuntimeConnectLaunch {
                        config_path: "~/.openclaw/openclaw.json".into(),
                        address_pointer: "/gateway/remote/url".into(),
                        port_pointer: Some("/gateway/port".into()),
                        default_address: Some("ws://127.0.0.1:18789".into()),
                        auth_pointer: Some("/gateway/auth/token".into()),
                        protocol: "acp-v1-jsonrpc".into(),
                    }),
                    capabilities: openclaw.capabilities(),
                },
            },
            // ORC-7: the orchestrator is a harness id so the EXISTING
            // orchestration readers list its state — its folder is a
            // Hermes-shaped home (`docs/ORCHESTRATOR-IR.md` §6) and each
            // reader is pointed at it with no new reader code. It has no
            // native session tier of its own: it keeps no transcripts, only
            // BINDINGS that address a WORKER harness's session, which is read
            // through that harness's own door. It has no runtime either — the
            // daemon is a Node process the operator verbs start and stop, not
            // an adapter supercode connects a turn to.
            HarnessSupportDescriptor {
                id: HarnessId::from(HarnessId::ORCHESTRATOR),
                display_name: "Orchestrator".into(),
                orchestration: OrchestrationSupport::default(),
                native: NativeSupport {
                    discover: ImplementationKind::Absent,
                    load: ImplementationKind::Absent,
                    follow: ImplementationKind::Absent,
                    import: ImplementationKind::Absent,
                    export: ImplementationKind::Absent,
                },
                runtime: RuntimeSupport {
                    implementation: ImplementationKind::Absent,
                    protocol: "none".into(),
                    default_launch: None,
                    connect_launch: None,
                    capabilities: RuntimeCapabilities {
                        start_session: false,
                        resume_session: false,
                        attach_existing_process: false,
                        send_input: false,
                        stream_events: false,
                        interrupt: false,
                        steer: false,
                        respond_to_requests: false,
                    },
                },
            },
            HarnessSupportDescriptor {
                id: HarnessId::from(HarnessId::SUPERCODE),
                display_name: "Volter Harness".into(),
                orchestration: OrchestrationSupport::default(),
                native: built_in_native(),
                runtime: RuntimeSupport {
                    implementation: ImplementationKind::GenericProtocol,
                    protocol: "acp-v1-jsonrpc".into(),
                    default_launch: Some(supercode_launch),
                    connect_launch: None,
                    capabilities: supercode.capabilities(),
                },
            },
        ],
    };
    for descriptor in &mut report.harnesses {
        descriptor.orchestration = orchestration_support(descriptor);
    }
    report
}

/// Look up one harness in the compiled registry.
pub fn harness_support(id: &str) -> Option<HarnessSupportDescriptor> {
    harness_support_registry()
        .harnesses
        .into_iter()
        .find(|harness| harness.id.as_str() == id)
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn claude_code_default_launch_is_the_stream_json_prefix() {
        let claude = harness_support_registry()
            .harnesses
            .into_iter()
            .find(|h| h.id.as_str() == HarnessId::CLAUDE_CODE)
            .unwrap();
        let launch = claude.runtime.default_launch.unwrap();
        assert_eq!(launch.program, "claude");
        let joined = launch.arguments.join(" ");
        assert!(joined.contains("--input-format stream-json"), "{joined}");
        assert!(joined.contains("--output-format stream-json"), "{joined}");
        assert!(
            joined.contains("--permission-prompt-tool stdio"),
            "{joined}"
        );
    }

    #[test]
    fn grok_asks_for_a_self_sandbox_only_where_one_is_possible() {
        let arguments = grok_arguments();
        assert_eq!(
            arguments.iter().any(|argument| argument == "--sandbox"),
            self_sandbox_supported(),
        );
        assert!(
            arguments.ends_with(&["agent".into(), "--no-leader".into(), "stdio".into()]),
            "{arguments:?}",
        );
    }

    #[test]
    fn registry_is_unique_and_reports_all_native_support() {
        let report = harness_support_registry();
        assert_eq!(report.schema, SUPPORT_REGISTRY_SCHEMA);
        // Ten harnesses plus the orchestrator (ORC-7), which is a registry id
        // with orchestration tiers and no native or runtime tier of its own.
        assert_eq!(report.harnesses.len(), 11);
        let ids = report
            .harnesses
            .iter()
            .map(|harness| harness.id.as_str())
            .collect::<std::collections::BTreeSet<_>>();
        assert_eq!(ids.len(), report.harnesses.len());

        let grok = report
            .harnesses
            .iter()
            .find(|harness| harness.id.as_str() == HarnessId::GROK)
            .unwrap();
        assert_eq!(grok.native.discover, ImplementationKind::BuiltIn);
        assert_eq!(grok.native.load, ImplementationKind::BuiltIn);
        assert_eq!(grok.native.follow, ImplementationKind::BuiltIn);
        assert_eq!(grok.native.import, ImplementationKind::BuiltIn);
        for id in [HarnessId::GEMINI, HarnessId::SUPERCODE] {
            let harness = report
                .harnesses
                .iter()
                .find(|harness| harness.id.as_str() == id)
                .unwrap();
            assert_eq!(harness.native.discover, ImplementationKind::BuiltIn);
            assert_eq!(harness.native.load, ImplementationKind::BuiltIn);
            assert_eq!(harness.native.follow, ImplementationKind::BuiltIn);
        }
        assert_eq!(grok.native.export, ImplementationKind::BuiltIn);
        assert_eq!(
            grok.runtime.implementation,
            ImplementationKind::GenericProtocol
        );
        let expected: Vec<&str> = if self_sandbox_supported() {
            vec!["--sandbox", "workspace", "agent", "--no-leader", "stdio"]
        } else {
            vec!["agent", "--no-leader", "stdio"]
        };
        assert_eq!(
            grok.runtime.default_launch.as_ref().unwrap().arguments,
            expected
        );
        assert!(!grok
            .runtime
            .default_launch
            .as_ref()
            .unwrap()
            .arguments
            .iter()
            .any(|argument| argument == "--always-approve"));
        assert!(grok.runtime.capabilities.resume_session);
    }

    /// UNI-5 dev/03: every OpenClaw path is gateway-mediated — the registry
    /// declares NO native primitive, so no supercode code path can open the
    /// openclaw-agent SQLite store (direct-DB-write-as-product is a permanent
    /// skip; the read tier is UNI-16's gated wave). The connect launch stores
    /// pointers into openclaw's config, never endpoint or credential values.
    #[test]
    fn openclaw_registers_gateway_mediated_with_no_store_access() {
        let report = harness_support_registry();
        let openclaw = report
            .harnesses
            .iter()
            .find(|harness| harness.id.as_str() == HarnessId::OPENCLAW)
            .expect("openclaw must be registered");
        assert_eq!(openclaw.display_name, "OpenClaw");
        // UNI-16 read tier: discover + load are BuiltIn (pi-v3-dialect
        // files); follow/import/EXPORT stay Absent — no code path can WRITE
        // the openclaw store, and the tier stays driven (matrix membership
        // remains UNI-17's priced flip).
        assert_eq!(openclaw.native.discover, ImplementationKind::BuiltIn);
        assert_eq!(openclaw.native.load, ImplementationKind::BuiltIn);
        for kind in [
            openclaw.native.follow,
            openclaw.native.import,
            openclaw.native.export,
        ] {
            assert_eq!(kind, ImplementationKind::Absent);
        }
        assert_eq!(
            openclaw.runtime.implementation,
            ImplementationKind::GenericProtocol
        );
        assert_eq!(openclaw.runtime.protocol, "acp-v1-jsonrpc");
        let launch = openclaw.runtime.default_launch.as_ref().unwrap();
        assert_eq!(launch.program, "openclaw");
        assert_eq!(launch.arguments, ["acp"]);
        let connect = openclaw.runtime.connect_launch.as_ref().unwrap();
        assert_eq!(connect.config_path, "~/.openclaw/openclaw.json");
        // Blind-walk correction 2026-08-31: openclaw's schema has no
        // `gateway.url`; the real chain is remote.url -> port -> the
        // documented default endpoint.
        assert_eq!(connect.address_pointer, "/gateway/remote/url");
        assert_eq!(connect.port_pointer.as_deref(), Some("/gateway/port"));
        assert_eq!(
            connect.default_address.as_deref(),
            Some("ws://127.0.0.1:18789")
        );
        assert_eq!(connect.auth_pointer.as_deref(), Some("/gateway/auth/token"));
        // Executed dialect probe
        // (docs/interop/research/openclaw-acp-dialect-2026-08-30.json):
        // resume + list advertised on >= 2026.7.
        assert!(openclaw.runtime.capabilities.resume_session);
    }

    #[test]
    fn hermes_registers_as_a_driven_tier_acp_entry_without_native_claims() {
        let report = harness_support_registry();
        let hermes = report
            .harnesses
            .iter()
            .find(|harness| harness.id.as_str() == HarnessId::HERMES)
            .expect("hermes must be registered");
        assert_eq!(hermes.display_name, "Hermes Agent");
        // UNI-15 read tier: discover + load BuiltIn over state.db;
        // follow/import stay Absent; export is Hermes's own door (UNI-18).
        assert_eq!(hermes.native.discover, ImplementationKind::BuiltIn);
        assert_eq!(hermes.native.load, ImplementationKind::BuiltIn);
        for kind in [hermes.native.follow, hermes.native.import] {
            assert_eq!(kind, ImplementationKind::Absent);
        }
        assert_eq!(hermes.native.export, ImplementationKind::GenericProtocol);
        assert_eq!(
            hermes.runtime.implementation,
            ImplementationKind::GenericProtocol
        );
        assert_eq!(hermes.runtime.protocol, "acp-v1-jsonrpc");
        let launch = hermes.runtime.default_launch.as_ref().unwrap();
        assert_eq!(launch.program, "hermes-acp");
        assert!(launch.arguments.is_empty());
        assert!(hermes.runtime.connect_launch.is_none());
        // Verified against the executed dialect probe
        // (docs/interop/research/hermes-acp-dialect-2026-08-30.json):
        // loadSession + sessionCapabilities.resume are advertised.
        assert!(hermes.runtime.capabilities.resume_session);
        assert!(!hermes.runtime.capabilities.attach_existing_process);
    }

    #[test]
    fn connect_mode_descriptor_round_trips_the_registry_schema() {
        let descriptor = HarnessSupportDescriptor {
            id: HarnessId::from("openclaw"),
            display_name: "OpenClaw".into(),
            orchestration: OrchestrationSupport::default(),
            native: NativeSupport {
                discover: ImplementationKind::Absent,
                load: ImplementationKind::Absent,
                follow: ImplementationKind::Absent,
                import: ImplementationKind::Absent,
                export: ImplementationKind::Absent,
            },
            runtime: RuntimeSupport {
                implementation: ImplementationKind::GenericProtocol,
                protocol: "acp-v1-jsonrpc".into(),
                default_launch: None,
                connect_launch: Some(RuntimeConnectLaunch {
                    config_path: "~/.openclaw/openclaw.json".into(),
                    address_pointer: "/gateway/url".into(),
                    port_pointer: None,
                    default_address: None,
                    auth_pointer: Some("/gateway/token".into()),
                    protocol: "acp-v1-jsonrpc".into(),
                }),
                capabilities: RuntimeCapabilities {
                    start_session: true,
                    resume_session: false,
                    attach_existing_process: true,
                    send_input: true,
                    stream_events: true,
                    interrupt: false,
                    steer: false,
                    respond_to_requests: false,
                },
            },
        };
        let encoded = serde_json::to_value(&descriptor).unwrap();
        assert_eq!(
            encoded["runtime"]["connect_launch"]["address_pointer"],
            "/gateway/url"
        );
        let decoded: HarnessSupportDescriptor = serde_json::from_value(encoded).unwrap();
        assert_eq!(decoded, descriptor);
    }

    #[test]
    fn spawn_only_registry_entries_do_not_serialize_a_connect_launch() {
        let report = harness_support_registry();
        for harness in &report.harnesses {
            let encoded = serde_json::to_string(harness).unwrap();
            if harness.id.as_str() == HarnessId::OPENCLAW {
                // The one declared connect-mode entry (UNI-5): endpoint and
                // credential POINTERS plus the harness's DOCUMENTED default
                // endpoint — never resolved values or credentials.
                assert!(encoded.contains("connect_launch"));
                assert!(encoded.contains("/gateway/auth/token"));
                assert!(encoded.contains("ws://127.0.0.1:18789"));
                assert!(!encoded.contains("token\":\"ws"));
            } else {
                assert!(
                    !encoded.contains("connect_launch"),
                    "{} must stay spawn-only",
                    harness.id.as_str()
                );
            }
        }
        let encoded = serde_json::to_string(&report).unwrap();
        let decoded: SupportRegistryReport = serde_json::from_str(&encoded).unwrap();
        assert_eq!(decoded, report);
    }

    /// ORCH-4: every harness carries all twelve concepts; every method a
    /// non-Absent tier cites is a real service method.
    #[test]
    fn orchestration_block_is_complete_and_its_methods_exist() {
        let report = harness_support_registry();
        for harness in &report.harnesses {
            let names: Vec<&str> = harness
                .orchestration
                .concepts
                .iter()
                .map(|c| c.concept.as_str())
                .collect();
            assert_eq!(names, ORCHESTRATION_CONCEPTS, "{}", harness.id.as_str());
            for concept in &harness.orchestration.concepts {
                let any_built_in = concept.observed == ImplementationKind::BuiltIn
                    || concept.controlled == ImplementationKind::BuiltIn;
                assert_eq!(
                    any_built_in,
                    !concept.methods.is_empty(),
                    "{}/{}: a BuiltIn tier must cite methods and an Absent one must not",
                    harness.id.as_str(),
                    concept.concept
                );
                for method in &concept.methods {
                    assert!(
                        crate::harness_service::HARNESS_SERVICE_METHODS.contains(&method.as_str()),
                        "{}/{}: `{method}` is not a harness service method",
                        harness.id.as_str(),
                        concept.concept
                    );
                }
            }
        }
        // Today's honest floor: conversation is observed wherever sessions load
        // natively; pending requests are controlled wherever the door responds.
        let hermes = report
            .harnesses
            .iter()
            .find(|h| h.id.as_str() == HarnessId::HERMES)
            .unwrap();
        let conv = &hermes.orchestration.concepts[2];
        assert_eq!(conv.concept, "conversation");
        assert_eq!(conv.observed, ImplementationKind::BuiltIn);
        // ORCH-19: Hermes is controlled through the doors it actually has —
        // `/reset` inside a live session, plus `hermes sessions delete`. It
        // has no per-session archive verb, and its ACP door does not carry
        // `/new` (a gateway-only command), so neither is advertised.
        assert_eq!(conv.controlled, ImplementationKind::BuiltIn);
        assert_eq!(
            conv.methods,
            vec![
                "harness.v1.sessions.discover",
                "harness.v1.sessions.load",
                "harness.v1.sessions.reset",
                "harness.v1.sessions.delete",
            ]
        );
        // OpenClaw's ACP door advertises both `/new` and `/reset` at the pin,
        // and it has neither archive nor delete.
        let openclaw_conv = &report
            .harnesses
            .iter()
            .find(|h| h.id.as_str() == HarnessId::OPENCLAW)
            .unwrap()
            .orchestration
            .concepts[2];
        assert_eq!(
            openclaw_conv.methods,
            vec![
                "harness.v1.sessions.discover",
                "harness.v1.sessions.load",
                "harness.v1.sessions.new",
                "harness.v1.sessions.reset",
            ]
        );
        // Claude Code loads natively but publishes no lifecycle verb: observed
        // only, and the two read methods only.
        let claude_conv = &report
            .harnesses
            .iter()
            .find(|h| h.id.as_str() == HarnessId::CLAUDE_CODE)
            .unwrap()
            .orchestration
            .concepts[2];
        assert_eq!(claude_conv.observed, ImplementationKind::BuiltIn);
        assert_eq!(claude_conv.controlled, ImplementationKind::Absent);
        assert_eq!(
            claude_conv.methods,
            vec!["harness.v1.sessions.discover", "harness.v1.sessions.load"]
        );
        for harness in &report.harnesses {
            let conversation = &harness.orchestration.concepts[2];
            let doors = crate::sessions_control::controlled_methods(harness.id.as_str());
            assert_eq!(
                conversation.controlled == ImplementationKind::BuiltIn,
                !doors.is_empty(),
                "{}: conversation controlled must track the sessions_control door table",
                harness.id.as_str()
            );
            for method in &doors {
                assert!(
                    conversation.methods.iter().any(|listed| listed == method),
                    "{}: `{method}` has a door but is not advertised",
                    harness.id.as_str()
                );
            }
            for listed in &conversation.methods {
                assert!(
                    listed.ends_with(".discover")
                        || listed.ends_with(".load")
                        || doors.contains(&listed.as_str()),
                    "{}: `{listed}` is advertised with no door behind it",
                    harness.id.as_str()
                );
            }
        }
        let pending = &hermes.orchestration.concepts[3];
        assert_eq!(pending.concept, "pending_request");
        assert_eq!(pending.controlled, ImplementationKind::BuiltIn);
        // ORCH-7/ORCH-18: scheduled jobs are observed for the three harnesses
        // that have them and controlled for the two that publish a
        // client-callable cron verb.
        let job = &hermes.orchestration.concepts[0];
        assert_eq!(job.concept, "scheduled_job");
        assert_eq!(job.observed, ImplementationKind::BuiltIn);
        assert_eq!(job.controlled, ImplementationKind::BuiltIn);
        assert_eq!(
            job.methods,
            vec![
                "harness.v1.jobs.list",
                "harness.v1.jobs.get",
                "harness.v1.jobs.create",
                "harness.v1.jobs.update",
                "harness.v1.jobs.pause",
                "harness.v1.jobs.resume",
                "harness.v1.jobs.run",
                "harness.v1.jobs.delete",
            ]
        );
        // Claude Code has jobs but no verb a client can call: observed only.
        let claude_job = &report
            .harnesses
            .iter()
            .find(|h| h.id.as_str() == HarnessId::CLAUDE_CODE)
            .unwrap()
            .orchestration
            .concepts[0];
        assert_eq!(claude_job.observed, ImplementationKind::BuiltIn);
        assert_eq!(claude_job.controlled, ImplementationKind::Absent);
        assert_eq!(
            claude_job.methods,
            vec!["harness.v1.jobs.list", "harness.v1.jobs.get"]
        );
        for harness in &report.harnesses {
            let job = &harness.orchestration.concepts[0];
            assert_eq!(
                job.observed == ImplementationKind::BuiltIn,
                crate::jobs::supports_jobs(harness.id.as_str()),
                "{}: scheduled_job observed must track JOB_HARNESSES",
                harness.id.as_str()
            );
            assert_eq!(
                job.controlled == ImplementationKind::BuiltIn,
                crate::jobs_control::supports_job_control(harness.id.as_str()),
                "{}: scheduled_job controlled must track CONTROLLED_JOB_HARNESSES",
                harness.id.as_str()
            );
        }
        // ORCH-10/ORCH-21: profiles are observed for the four harnesses with
        // the concept, controlled for the two that publish a lifecycle verb,
        // and Absent (with no methods) everywhere else.
        let profile = &hermes.orchestration.concepts[4];
        assert_eq!(profile.concept, "profile");
        assert_eq!(profile.observed, ImplementationKind::BuiltIn);
        assert_eq!(profile.controlled, ImplementationKind::BuiltIn);
        assert_eq!(
            profile.methods,
            [
                "harness.v1.profiles.list",
                "harness.v1.profiles.get",
                "harness.v1.profiles.create",
                "harness.v1.profiles.delete",
            ]
        );
        // Codex HAS profiles but publishes no verb for them — they are tables
        // a human authors in `config.toml` — so it is observed only.
        let codex_profile = &report
            .harnesses
            .iter()
            .find(|h| h.id.as_str() == HarnessId::CODEX)
            .unwrap()
            .orchestration
            .concepts[4];
        assert_eq!(codex_profile.observed, ImplementationKind::BuiltIn);
        assert_eq!(codex_profile.controlled, ImplementationKind::Absent);
        assert_eq!(
            codex_profile.methods,
            ["harness.v1.profiles.list", "harness.v1.profiles.get"]
        );
        for harness in &report.harnesses {
            let profile = &harness.orchestration.concepts[4];
            assert_eq!(
                profile.observed == ImplementationKind::BuiltIn,
                crate::profiles::PROFILE_HARNESSES.contains(&harness.id.as_str()),
                "{}: profile observed tier disagrees with PROFILE_HARNESSES",
                harness.id.as_str()
            );
            assert_eq!(
                profile.controlled == ImplementationKind::BuiltIn,
                crate::profiles_control::supports_profile_control(harness.id.as_str()),
                "{}: profile controlled tier disagrees with CONTROLLED_PROFILE_HARNESSES",
                harness.id.as_str()
            );
        }
    }

    /// ORCH-12: memory is observed for the three harnesses that have a
    /// persistent memory store at the pinned versions, and stays Absent for
    /// the rest — Codex, opencode and pi have no memory store to read.
    #[test]
    fn memory_is_observed_only_for_the_harnesses_with_a_memory_store() {
        let report = harness_support_registry();
        for harness in &report.harnesses {
            let memory = harness
                .orchestration
                .concepts
                .iter()
                .find(|concept| concept.concept == "memory")
                .unwrap_or_else(|| panic!("{}: no memory concept row", harness.id.as_str()));
            if crate::memory::MEMORY_HARNESSES.contains(&harness.id.as_str()) {
                assert_eq!(
                    memory.observed,
                    ImplementationKind::BuiltIn,
                    "{}: memory must be observed",
                    harness.id.as_str()
                );
                assert_eq!(
                    memory.methods,
                    vec![
                        "harness.v1.memory.show".to_string(),
                        "harness.v1.memory.search".to_string()
                    ]
                );
            } else {
                assert_eq!(
                    memory.observed,
                    ImplementationKind::Absent,
                    "{}: memory must be absent",
                    harness.id.as_str()
                );
                assert!(memory.methods.is_empty(), "{}", harness.id.as_str());
            }
            // forget / reset stay the harness's own verb.
            assert_eq!(memory.controlled, ImplementationKind::Absent);
        }
    }

    /// ORCH-11 + ORCH-22: skills are observed AND controlled for the six
    /// harnesses whose skill roots `crate::skills` opens, and stay Absent for
    /// the rest — supercode itself included, since it has no root of its own.
    #[test]
    fn skills_are_observed_and_controlled_for_the_harnesses_with_a_skills_loader() {
        let report = harness_support_registry();
        for harness in &report.harnesses {
            let skills = harness
                .orchestration
                .concepts
                .iter()
                .find(|concept| concept.concept == "skills")
                .unwrap();
            if crate::skills::SKILL_HARNESSES.contains(&harness.id.as_str()) {
                assert_eq!(
                    skills.observed,
                    ImplementationKind::BuiltIn,
                    "{}",
                    harness.id.as_str()
                );
                // ORCH-22: the write tier is the harness's OWN door — a CLI
                // verb for the two gateway harnesses, the loader's directory
                // for the core four.
                assert_eq!(
                    skills.controlled,
                    ImplementationKind::BuiltIn,
                    "{}",
                    harness.id.as_str()
                );
                assert_eq!(
                    skills.methods,
                    vec![
                        "harness.v1.skills.list".to_string(),
                        "harness.v1.skills.install".to_string(),
                        "harness.v1.skills.remove".to_string(),
                    ]
                );
            } else {
                assert_eq!(
                    skills.observed,
                    ImplementationKind::Absent,
                    "{}",
                    harness.id.as_str()
                );
                assert_eq!(
                    skills.controlled,
                    ImplementationKind::Absent,
                    "{}",
                    harness.id.as_str()
                );
            }
        }
    }

    /// ORCH-14: channels are observed for the two gateway harnesses whose
    /// config files `crate::channels` opens, and stay Absent for the rest —
    /// Claude Code included, because its channels are declared over the MCP
    /// protocol and not in any file supercode can read.
    #[test]
    fn channels_are_observed_for_the_gateway_harnesses_only() {
        let report = harness_support_registry();
        for harness in &report.harnesses {
            let channel = harness
                .orchestration
                .concepts
                .iter()
                .find(|concept| concept.concept == "channel")
                .unwrap();
            if crate::channels::CHANNEL_HARNESSES.contains(&harness.id.as_str()) {
                assert_eq!(
                    channel.observed,
                    ImplementationKind::BuiltIn,
                    "{}",
                    harness.id.as_str()
                );
                assert_eq!(
                    channel.methods,
                    ["harness.v1.channels.list", "harness.v1.channels.status"]
                );
            } else {
                assert_eq!(
                    channel.observed,
                    ImplementationKind::Absent,
                    "{}",
                    harness.id.as_str()
                );
                assert!(channel.methods.is_empty(), "{}", harness.id.as_str());
            }
            // Every channel mutation stays the harness's own verb.
            assert_eq!(channel.controlled, ImplementationKind::Absent);
        }
    }

    /// ORCH-8: `run` is observed exactly where a fire STORE exists, which is a
    /// strictly smaller set than `scheduled_job`. Claude Code is the case that
    /// makes the distinction real: it has jobs but no run store, so it must be
    /// built-in for one concept and absent for the other in the same
    /// descriptor.
    #[test]
    fn runs_are_observed_only_where_the_harness_keeps_a_fire_store() {
        let report = harness_support_registry();
        let concept = |harness: &HarnessSupportDescriptor, name: &str| {
            harness
                .orchestration
                .concepts
                .iter()
                .find(|concept| concept.concept == name)
                .unwrap_or_else(|| panic!("no `{name}` concept for {}", harness.id.as_str()))
                .clone()
        };
        let mut observed = Vec::new();
        for harness in &report.harnesses {
            let run = concept(harness, "run");
            if crate::runs::RUN_HARNESSES.contains(&harness.id.as_str()) {
                assert_eq!(
                    run.observed,
                    ImplementationKind::BuiltIn,
                    "{}",
                    harness.id.as_str()
                );
                assert_eq!(
                    run.methods,
                    vec![
                        "harness.v1.runs.list".to_string(),
                        "harness.v1.runs.get".to_string()
                    ]
                );
                observed.push(harness.id.as_str().to_string());
            } else {
                assert_eq!(
                    run.observed,
                    ImplementationKind::Absent,
                    "{}",
                    harness.id.as_str()
                );
                assert!(run.methods.is_empty(), "{}", harness.id.as_str());
            }
            // Retention is the only write verb either harness has, and it is
            // not wired: nothing here claims the controlled tier.
            assert_eq!(run.controlled, ImplementationKind::Absent);
        }
        // ORC-7: the orchestrator keeps its fires in the same
        // `cron/executions.db`, one per profile folder, so the same reader
        // observes it.
        assert_eq!(observed, vec!["hermes", "openclaw", "orchestrator"]);

        let claude = report
            .harnesses
            .iter()
            .find(|harness| harness.id.as_str() == HarnessId::CLAUDE_CODE)
            .expect("claude-code is in the registry");
        assert_eq!(
            concept(claude, "scheduled_job").observed,
            ImplementationKind::BuiltIn,
        );
        assert_eq!(concept(claude, "run").observed, ImplementationKind::Absent);
    }

    /// The block is additive: a v1 descriptor without it still deserializes.
    #[test]
    fn orchestration_block_is_additive_on_the_wire() {
        let report = harness_support_registry();
        let mut value = serde_json::to_value(&report.harnesses[0]).unwrap();
        value.as_object_mut().unwrap().remove("orchestration");
        let back: HarnessSupportDescriptor = serde_json::from_value(value).unwrap();
        assert!(back.orchestration.concepts.is_empty());
    }
}