[mlieberman85]

Summary

The harness-loop MCP tools (run_next_action, submit_action_result) took framework_name from client state, and resolve_framework_path treated any value containing / or ending in .toml as a path. A client could therefore point darnit at a framework file committed to the audited repository, and darnit would run that file's exec steps. Clients now select a framework by registered name only.

• HarnessState.framework_name, the harness-loop tools and run_sieve_audit refuse path-like values and unregistered names before anything is loaded or run. Path-like means containing / or \, ending in .toml, starting with . or ~, or absolute.
• darnit audit and darnit plan --framework PATH refuse a file whose real path is inside the audited repository, as operator configuration there already is.
• Paths the operator gives at launch still work: darnit serve PATH, darnit validate PATH, and --framework PATH outside the checkout.
• Behavior change: darnit run|harness|serve --framework take names only, as their help text already said.
• Spec: framework-design 14.5, with notes in 10.5 and 14.4 (1.0.0-alpha.17).

Testing

• tests/darnit/server/test_framework_selection.py (28 tests).
• Full suite: 5189 passed, 19 skipped. Ruff and validate_sync are clean.
• By hand: a repository commits .darnit/fw.toml with an exec step that writes a marker file, and harness state names that file. darnit refuses it and writes no marker.

Merge notes: this PR, #635 and #636 each set the spec version to 1.0.0-alpha.17 and add a changelog row; whichever lands later bumps the version. #637 adds framework-design 14.6 right after this PR's 14.5.

AI assistance

Claude Code (claude-opus-5-5) implemented and tested this and drafted this description. Commits carry Assisted-by: Claude:claude-opus-5-5.

[Marc-cn]

Clean security fix: names only from clients, paths refused before anything loads, operator paths still accepted from the CLI and refused inside the checkout (symlinks resolved), and the marker-file tests prove no step runs. On rebase the spec version needs a bump past what main has now (alpha.18+), and the changelog row will conflict like everyone else's. Good to merge after that.

[Marc-cn]

Re-approved on ccce2e4 (my earlier review's commit is gone, so I re-read it whole). Path-likeness is refused at every client-facing entry (harness state, agent state, tool argument, audit pipeline), registration is required in HarnessState, commonpath handles the repo/repo-x prefix case and there's a test for it, symlink-into-repo is covered, and the server still takes its framework name from the TOML's metadata.name so darnit serve custom.toml keeps working. test_framework_selection, server and harness suites pass locally.