feat(harness): add GitHub remote workspace backend

docs/harness/README.md

@@ -14,7 +14,9 @@ The user-facing command surface is intentionally small:
 - `setup`: install Agent Integration shim assets.
 - `local`: run or inspect Local Mnemon.
 - `status`: show Agent Integration, Local Mnemon, and Remote Workspace state.
-- `sync`: connect Local Mnemon to a Remote Workspace.
+- `sync`: connect Local Mnemon to a Remote Workspace. `mnemon-hub` is the
+  first-party backend; GitHub publication branches are available as an
+  experimental repo-mediated backend.
 
 Other implementation commands are internal and are not part of the beta product
 contract.
@@ -29,6 +31,10 @@ The current beta does not promise production readiness, automatic apply,
 multi-agent governance, broad organization scope, or a general evaluation
 runtime.
 
+The GitHub Remote Workspace backend is experimental. It uses explicitly
+configured publication branches and does not implement P2P discovery, GitHub
+Issues, GitHub PRs, or GitHub Actions as teamwork semantics.
+
 ## 3. Separation From Stable Mnemon
 
 `mnemon-harness` is built from `./harness/cmd/mnemon-harness`.

docs/harness/USAGE.md

@@ -38,12 +38,33 @@ Inspect local state:
 
 ## 3. Remote Workspace Sync
 
-Connect a Remote Workspace:
+Connect an HTTP `mnemon-hub` Remote Workspace:
 
 ```sh
-./mnemon-harness sync connect my-workspace
+./mnemon-harness sync connect my-workspace --remote-url https://mnemon-hub.example/sync --token-file ./hub.token
 ```
 
+Experimental GitHub publication backend:
+
+```sh
+./mnemon-harness sync connect self \
+  --backend github \
+  --direction publish \
+  --github-repo mnemon-dev/mnemon-teamwork-example \
+  --github-branch mnemon/agent-a \
+  --token-file ~/.config/mnemon/github.token
+
+./mnemon-harness sync connect agent-b \
+  --backend github \
+  --direction subscribe \
+  --github-repo mnemon-dev/mnemon-teamwork-example \
+  --github-branch mnemon/agent-b \
+  --token-file ~/.config/mnemon/github.token
+```
+
+The GitHub backend is repo-mediated publication, not P2P discovery. Configure the
+branches you publish and subscribe to explicitly.
+
 Run one push or pull:
 
 ```sh

harness/README.md

@@ -8,8 +8,9 @@ The current product surface is intentionally small:
 - `setup` installs Agent Integration shim assets into Codex or Claude Code.
 - `local run` starts the project-local Mnemon service.
 - `status` reports Agent Integration, Local Mnemon, and sync status.
-- `sync` connects Local Mnemon to a Remote Workspace (`mnemon-hub`) and pushes/pulls
-  governed commits with attribution preserved.
+- `sync` connects Local Mnemon to a Remote Workspace and pushes/pulls governed
+  commits with attribution preserved. The first-party backend is `mnemon-hub`;
+  the experimental GitHub backend uses repo-mediated publication branches.
 - `loop validate` remains hidden and is used by `make harness-validate`.
 
 Host directories such as `.codex` and `.claude` are projection surfaces. Runtime
@@ -48,3 +49,40 @@ Remove projected assets for a principal:
 ```
 
 More command examples are in `docs/harness/USAGE.md`.
+
+## Experimental GitHub Remote Workspace
+
+GitHub can be used as a bootstrap Remote Workspace backend for a decentralized
+publication mesh. Each Local Mnemon publishes accepted synced events to its own
+configured branch and subscribes to explicitly configured peer branches.
+
+This is not P2P networking or GitHub Issues/PR-based teamwork. GitHub is only the
+publication substrate; every imported event still enters through the receiving
+Local Mnemon's Event Intake.
+
+Example shape:
+
+```sh
+./mnemon-harness sync connect self \
+  --backend github \
+  --direction publish \
+  --github-repo mnemon-dev/mnemon-teamwork-example \
+  --github-branch mnemon/agent-a \
+  --token-file ~/.config/mnemon/github.token
+
+./mnemon-harness sync connect agent-b \
+  --backend github \
+  --direction subscribe \
+  --github-repo mnemon-dev/mnemon-teamwork-example \
+  --github-branch mnemon/agent-b \
+  --token-file ~/.config/mnemon/github.token
+```
+
+Live validation is opt-in:
+
+```sh
+MNEMON_GITHUB_LIVE=1 \
+MNEMON_GITHUB_REPO=mnemon-dev/mnemon-teamwork-example \
+MNEMON_GITHUB_TOKEN_FILE=~/.config/mnemon/github.token \
+go test ./harness/internal/app -run TestGitHubLivePublishPullImport -count=1 -v
+```

harness/cmd/mnemon-harness/acceptance.go

@@ -23,6 +23,7 @@ import (
 	"github.com/mnemon-dev/mnemon/harness/internal/mnemond/presentation"
 	"github.com/mnemon-dev/mnemon/harness/internal/mnemond/state"
 	"github.com/mnemon-dev/mnemon/harness/internal/mnemonhub"
+	"github.com/mnemon-dev/mnemon/harness/internal/mnemonhub/exchange"
 	"github.com/mnemon-dev/mnemon/harness/internal/runtime"
 	"github.com/spf13/cobra"
 )
@@ -147,8 +148,23 @@ type r1CodexAgentReport struct {
 
 type r1CodexSyncReport struct {
 	Status               string                      `json:"status"`
+	Backend              string                      `json:"backend,omitempty"`
+	Repo                 string                      `json:"repo,omitempty"`
+	TransportModel       string                      `json:"transport_model,omitempty"`
+	RosterSource         string                      `json:"roster_source,omitempty"`
+	NetworkDiscovery     string                      `json:"network_discovery,omitempty"`
 	HubURL               string                      `json:"hub_url"`
+	PublicationBranches  []string                    `json:"publication_branches,omitempty"`
+	BranchByAgent        map[string]string           `json:"branch_by_agent,omitempty"`
+	RemotePlanPaths      []string                    `json:"remote_plan_paths,omitempty"`
+	RuntimeWorkspaces    []string                    `json:"runtime_workspace_paths,omitempty"`
+	LocalStorePaths      []string                    `json:"local_mnemond_store_paths,omitempty"`
+	PublishedByBranch    map[string]int              `json:"published_events_by_branch,omitempty"`
+	ImportedByMnemond    map[string]int              `json:"imported_events_by_mnemond,omitempty"`
+	DiagnosticsByMnemond map[string]int              `json:"diagnostics_by_mnemond,omitempty"`
+	ProfileByMnemond     map[string]int              `json:"profile_events_by_mnemond,omitempty"`
 	AllowedEventSubjects []string                    `json:"allowed_event_subjects"`
+	Lifecycle            []r1SyncLifecycleReport     `json:"lifecycle,omitempty"`
 	Source               string                      `json:"source"`
 	Target               string                      `json:"target"`
 	Agents               []r1CodexAgentReport        `json:"agents"`
@@ -158,6 +174,16 @@ type r1CodexSyncReport struct {
 	Artifacts            map[string]string           `json:"artifacts,omitempty"`
 }
 
+type r1SyncLifecycleReport struct {
+	At        string         `json:"at"`
+	Principal string         `json:"principal"`
+	Action    string         `json:"action"`
+	Result    string         `json:"result"`
+	Branch    string         `json:"branch,omitempty"`
+	Detail    string         `json:"detail,omitempty"`
+	Ledger    map[string]int `json:"ledger,omitempty"`
+}
+
 type r1AcceptanceAssertion struct {
 	Name   string `json:"name"`
 	Passed bool   `json:"passed"`
@@ -376,7 +402,11 @@ func installAcceptanceHarnessBinary(runRoot string) (string, error) {
 }
 
 func prepareR1AcceptanceRunRoot(runRoot string) error {
-	testdataRoot, err := filepath.Abs(".testdata")
+	testdataRoot, err := physicalAcceptancePath(".testdata")
+	if err != nil {
+		return err
+	}
+	runRoot, err = physicalAcceptancePath(runRoot)
 	if err != nil {
 		return err
 	}
@@ -401,6 +431,30 @@ func prepareR1AcceptanceRunRoot(runRoot string) error {
 	return nil
 }
 
+func physicalAcceptancePath(path string) (string, error) {
+	abs, err := filepath.Abs(path)
+	if err != nil {
+		return "", err
+	}
+	if resolved, err := filepath.EvalSymlinks(abs); err == nil {
+		return resolved, nil
+	}
+	var missing []string
+	for current := abs; ; current = filepath.Dir(current) {
+		if resolved, err := filepath.EvalSymlinks(current); err == nil {
+			for i := len(missing) - 1; i >= 0; i-- {
+				resolved = filepath.Join(resolved, missing[i])
+			}
+			return resolved, nil
+		}
+		parent := filepath.Dir(current)
+		if parent == current {
+			return abs, nil
+		}
+		missing = append(missing, filepath.Base(current))
+	}
+}
+
 func setupR1CodexAgents(runRoot, binDir, controlURL string, count int, sourceCodexHome string) ([]r1CodexAgent, access.LoadedBindings, error) {
 	var agents []r1CodexAgent
 	var loaded access.LoadedBindings
@@ -1081,7 +1135,7 @@ func setupR1CodexSyncAgents(ctx context.Context, runRoot, binDir string, hub r1S
 		if i-1 >= len(hub.Tokens) {
 			return nil, fmt.Errorf("hub token missing for agent %d", i)
 		}
-		if err := upsertSyncRemote(filepath.Join(workspace, ".mnemon", "harness", "sync", "remotes.json"), workspace, "hub", hub.URL, hub.Tokens[i-1], "", ""); err != nil {
+		if err := upsertSyncRemote(filepath.Join(workspace, ".mnemon", "harness", "sync", "remotes.json"), workspace, "hub", exchange.RemoteBackendHTTP, "", hub.URL, "", "", hub.Tokens[i-1], "", ""); err != nil {
 			return nil, err
 		}
 		loaded, err := access.LoadBindingFile(workspace, filepath.Join(workspace, access.DefaultBindingFile))