[P1][testing] End-to-end live-test matrix per harness (only Pi is exercised today)

[richard-devbot]

The problem

RStack has strong component tests (1364/0), but only Pi is exercised end-to-end as a real governed run. Tau/Operator were verified once via doctor self-test; Hermes has never run against its real host. "Works on every harness" is currently a claim backed by conformance (tool-surface) + unit tests, not by a governed run actually completing on each host. For a governance product about to be relied on, that gap is the difference between "should work" and "does work."

What to build

A per-harness end-to-end smoke matrix — the minimum real run that proves the loop + enforcement on each host:

1. init --framework <h> in a scratch dir → doctor --framework <h> = all PASS.
2. Start a tiny governed run (sdlc_start a trivial goal) → sdlc_plan → sdlc_build_next → sdlc_validate → sdlc_approve → run reaches a gate/DONE.
3. Enforcement proof: a destructive action blocks (exit 2) and a safe one passes; on Claude Code/Tau/Hermes via the real hook, on Operator via the manual guard.
4. Capture the transcript/evidence per harness.

Where a host can't run in CI (needs its own runtime), ship a documented runbook (docs/integrations/testing-matrix.md already exists — extend it to a full governed run, not just install/doctor) and record the last-verified date + version per harness in the docs, so "production-ready" is dated and honest.

Acceptance criteria

• A governed run completes end-to-end on Pi, Claude Code, Tau, Hermes (Operator: bridge-tool run + manual-guard proof).
• Enforcement (block/allow) demonstrated live per harness.
• docs/SETUP.md / testing-matrix records last-verified version + date per harness.
• Any harness that hasn't had a live run is labelled "code-complete, not yet live-verified" until it does — no silent "production-ready."

Part of the end-to-end onboarding epic — this is what turns the epic's other children from "written" into "proven."

[richard-devbot]

Part of the end-to-end onboarding epic #393.

[richard-devbot]

Where to get each harness (for the live matrix)

Harness	Repo / install
Pi	https://github.com/earendil-works/pi.git
Claude Code	https://code.claude.com/docs (CLI) + plugin from this repo once #388 lands
Tau	https://github.com/Jeomon/Tau.git (pip install tau-coding-agent)
Operator	operator_use — repo TBD (see #391)
Hermes	https://github.com/NousResearch/hermes-agent.git
RStack	https://github.com/richard-devbot/SDLC-rstack.git

Missing gaps (clear)

• Only Pi has a real end-to-end governed run. Tau/Operator = doctor self-test once. Hermes = never live. "Works on every harness" is currently backed by conformance + unit tests, not a completed run per host.

Research prompt (run BEFORE building the matrix)

You are designing the minimum honest end-to-end proof per harness.
1. For each harness, find how to run it headless in a scratch dir (CI-able?) or document the manual runbook if it needs its own runtime.
2. Define the smallest governed run that exercises: sdlc_start → plan → build_next → validate → approve reaching a gate/DONE, PLUS an enforcement proof (one destructive blocked, one safe allowed) on that host's real hook (or manual guard for Operator).
3. Decide CI vs. runbook per harness; record last-verified {version, date} in docs/integrations/testing-matrix.md.
OUTPUT: the per-harness smoke spec + which are CI-able vs runbook-only, BEFORE writing tests. Never label a harness "production-ready" without a captured live run.