@cyning/harness 0.4.0 → 1.0.0

package/examples/compliance_bench/S3_r1_with_review/task.md

@@ -0,0 +1,31 @@
+# Task fixture · S3 · R1 approved + review 落盘
+
+> 用途：SDD-Compliance micro-bench S3 夹具 · R1 approved 且 reviews/*_R1_* 存在 · gate-check exit=0
+
+---
+
+## Harness 元信息
+
+| 字段 | 值 |
+| --- | --- |
+| **task_slug** | `s3_r1_with_review` |
+| **test_strategy** | `not_applicable` |
+| **audit_profile** | `full` |
+
+### 人工闸
+
+| human_gate_id | status | blocks_hats | 说明 |
+| --- | --- | --- | --- |
+| HG-TASK-DRAFT | approved | 22, 30 | 10 完成 |
+| HG-AUDIT-R1 | approved | 30 | 22 R1 已签 |
+
+---
+
+## 背景与目标
+
+验证 D2/D3 公理：**R1 approved + review 文件落盘 → 30 可开工**。
+
+## 验收标准
+
+- `gate-check.sh --task task.md` **exit 0**
+- bench 脚本检查 `reviews/s3_r1_with_review_audit_R1_20260616.md` 存在 → **合规**

package/examples/compliance_bench/S4_sync_domain/profile.json

@@ -0,0 +1,16 @@
+{
+  "preset": "harness-only",
+  "tracks": {
+    "harness_prompts": true,
+    "harness_invoke_template": true,
+    "ide_cursor": true,
+    "ide_claude": false,
+    "ide_agents": false,
+    "graph": false,
+    "wiki": false
+  },
+  "paths": {
+    "ide_cursor": ".cursor/rules/06-harness-pointer.mdc"
+  },
+  "ci": "none"
+}

package/lib/audit.js

@@ -0,0 +1,168 @@
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { loadTaskSidecar, validateTaskSidecar } from './task.js';
+
+/**
+ * 在目标仓运行 ICVO audit（D3/D5/S5 子集）。
+ */
+export function auditTarget(target, options = {}) {
+  const taskFile = options.taskFile;
+
+  const gate = runGateCheck(target, taskFile);
+  const testCheck = runTestCheck(target, taskFile);
+  const gitCheck = runGitCleanCheck(target);
+
+  const ok = gate.ok && testCheck.ok;
+
+  return {
+    ok,
+    target,
+    taskFile,
+    gate,
+    test: testCheck,
+    git: gitCheck,
+  };
+}
+
+function runGateCheck(target, taskFile) {
+  const script = path.join(
+    process.env.CYNING_HARNESS || process.cwd(),
+    'wizard',
+    'gate-check.sh',
+  );
+  const args = [script, '--target', target];
+  if (taskFile) args.push('--task', taskFile);
+
+  const result = spawnSync('bash', args, {
+    encoding: 'utf8',
+    env: process.env,
+  });
+
+  return {
+    ok: result.status === 0,
+    status: result.status,
+    stdout: result.stdout,
+    stderr: result.stderr,
+  };
+}
+
+function runTestCheck(target, taskFile) {
+  // 未指定 task 文件时，D5 跳过（在 active task 上跑 gate-check 已覆盖 D3）
+  if (!taskFile) {
+    return { ok: true, skipped: true, reason: '未指定 --task，跳过 D5' };
+  }
+
+  const absTask = path.isAbsolute(taskFile) ? taskFile : path.join(target, taskFile);
+  if (!fs.existsSync(absTask)) {
+    return { ok: true, skipped: true, reason: 'task 文件不存在，跳过 D5' };
+  }
+
+  const sidecar = resolveTaskSidecar(absTask, target);
+  if (!sidecar) {
+    return { ok: true, skipped: true, reason: '未找到 task sidecar，跳过 D5' };
+  }
+
+  let data;
+  try {
+    data = loadTaskSidecar(sidecar);
+  } catch (err) {
+    return { ok: false, reason: `sidecar 解析失败: ${err.message}` };
+  }
+
+  const validation = validateTaskSidecar(data, path.basename(sidecar));
+  if (!validation.ok) {
+    return { ok: false, reason: validation.errors.join('; ') };
+  }
+
+  if (data.test_strategy !== 'required') {
+    return {
+      ok: true,
+      skipped: true,
+      reason: `test_strategy=${data.test_strategy}，无需 D5 强检查`,
+    };
+  }
+
+  const hasTest = hasTestArtifacts(target);
+  if (!hasTest) {
+    return {
+      ok: false,
+      reason: 'test_strategy=required 但目标仓未声明测试路径或 CI 引用',
+    };
+  }
+
+  return { ok: true, reason: 'test_strategy=required 且检测到测试/CI 制品' };
+}
+
+function resolveTaskSidecar(taskMarkdownPath, target) {
+  const dir = path.dirname(taskMarkdownPath);
+  const base = path.basename(taskMarkdownPath, '.md');
+
+  // 1. 同目录 <name>.harness.json
+  const sameDir = path.join(dir, `${base}.harness.json`);
+  if (fs.existsSync(sameDir)) return sameDir;
+
+  // 2. 目标仓根 task.harness.v1.json（legacy / 单 task 仓）
+  const rootSidecar = path.join(target, 'task.harness.v1.json');
+  if (fs.existsSync(rootSidecar)) return rootSidecar;
+
+  return null;
+}
+
+function hasTestArtifacts(target) {
+  const probes = [
+    'test',
+    'tests',
+    'spec',
+    'specs',
+    '__tests__',
+    'jest.config.js',
+    'jest.config.ts',
+    'vitest.config.js',
+    'vitest.config.ts',
+    'playwright.config.js',
+    'playwright.config.ts',
+    'cypress.config.js',
+    'pytest.ini',
+    'pyproject.toml',
+    'setup.py',
+  ];
+
+  for (const p of probes) {
+    const full = path.join(target, p);
+    if (fs.existsSync(full)) return true;
+  }
+
+  // 任意 *.test.js / *.spec.js / *.test.ts / *.spec.ts
+  const jsTests = spawnSync(
+    'find',
+    [target, '-maxdepth', '3', '-type', 'f', '(', '-name', '*.test.js', '-o', '-name', '*.spec.js', '-o', '-name', '*.test.ts', '-o', '-name', '*.spec.ts', '-o', '-name', '*_test.py', '-o', '-name', 'test_*.py', ')'],
+    { encoding: 'utf8' },
+  );
+  if (jsTests.status === 0 && jsTests.stdout.trim()) return true;
+
+  // CI 工作流引用
+  const ciDir = path.join(target, '.github', 'workflows');
+  if (fs.existsSync(ciDir)) {
+    const files = fs.readdirSync(ciDir);
+    if (files.some((f) => f.endsWith('.yml') || f.endsWith('.yaml'))) return true;
+  }
+
+  return false;
+}
+
+function runGitCleanCheck(target) {
+  const result = spawnSync('git', ['status', '--porcelain'], {
+    encoding: 'utf8',
+    cwd: target,
+  });
+
+  const dirty = result.status === 0 && result.stdout.trim().length > 0;
+
+  return {
+    ok: true, // audit 不因此失败，仅 warn
+    dirty,
+    stdout: result.stdout,
+    warning: dirty ? '工作区未 clean（S5）：建议 commit 后再执行 apply' : null,
+  };
+}

package/lib/cli.js

@@ -7,6 +7,7 @@ import {
 } from './paths.js';
 import { runBash } from './run.js';
 import { checkTaskFile } from './task.js';
+import { auditTarget } from './audit.js';
 
 function usage() {
   console.log(`@cyning/harness · cyning-harness CLI (v0.3+)
@@ -15,12 +16,14 @@ function usage() {
   npx @cyning/harness init [--preset NAME] [--ide LIST] [--target PATH] [--yes]
   npx @cyning/harness upgrade [--target PATH] [--ide LIST] [--yes] [--force] [--gate-check]
   npx @cyning/harness check [--target PATH]
+  npx @cyning/harness audit [--target PATH] [--task FILE]
   npx @cyning/harness task check --file PATH [--no-circular] [--registry DIR]...
 
 说明:
   init        首次接入 · 内部调用 wizard/install.sh + harness-sync.sh apply
   upgrade     升级已接入仓 · 等价 wizard/upgrade.sh --yes
   check       读 manifest.json · 对比当前包版本是否有可升级版本
+  audit       ICVO 机械审计：复用 gate-check · D5 测试声明检查 · S5 git-clean 提醒
   task check  校验 task.harness.v1.json sidecar · --no-circular 检测 depends_on 环
 
 环境:
@@ -62,6 +65,10 @@ export async function runCli(argv) {
     await cmdCheck(rest, harnessRoot, pkgVersion);
     return;
   }
+  if (cmd === 'audit') {
+    await cmdAudit(rest);
+    return;
+  }
   if (cmd === 'task') {
     await cmdTask(rest);
     return;
@@ -186,6 +193,49 @@ async function cmdCheck(args, harnessRoot, pkgVersion) {
   }
 }
 
+async function cmdAudit(args) {
+  let rest = args;
+  const { value: targetArg, rest: r1 } = takeOption(rest, '--target');
+  rest = r1;
+  const { value: taskFile, rest: r2 } = takeOption(rest, '--task');
+  rest = r2;
+
+  if (rest.length > 0) {
+    const err = new Error(`audit 未知参数: ${rest.join(' ')}`);
+    err.exitCode = 1;
+    throw err;
+  }
+
+  const target = resolveTarget(process.cwd(), targetArg);
+  const result = auditTarget(target, { taskFile });
+
+  console.log(`目标: ${target}`);
+  if (taskFile) console.log(`task: ${taskFile}`);
+  console.log(`audit: ${result.ok ? 'PASS' : 'FAIL'}`);
+
+  // D3 gate-check
+  console.log(`  gate-check: ${result.gate.ok ? 'PASS' : 'FAIL'}`);
+  if (!result.gate.ok && result.gate.stdout) {
+    for (const line of result.gate.stdout.split('\n')) {
+      if (line.trim()) console.log(`    ${line}`);
+    }
+  }
+
+  // D5 test
+  console.log(`  test-check: ${result.test.ok ? 'PASS' : 'FAIL'}`);
+  if (result.test.reason) console.log(`    ${result.test.reason}`);
+
+  // S5 git-clean
+  console.log(`  git-clean: ${result.git.dirty ? 'DIRTY' : 'CLEAN'}`);
+  if (result.git.warning) console.log(`    ${result.git.warning}`);
+
+  if (!result.ok) {
+    const err = new Error('ICVO audit 未通过');
+    err.exitCode = 2;
+    throw err;
+  }
+}
+
 async function cmdTask(args) {
   const [sub, ...rest] = args;
   if (sub !== 'check') {

package/ontology.yaml

@@ -1,9 +1,9 @@
-# cyning-harness 产品设计本体 · 机器可读抽取（草案 v0.4.0）
+# cyning-harness 产品设计本体 · 机器可读抽取（草案 v1.0.0）
 # 人类真值：docs/methodology/product/DESIGN_ONTOLOGY_v1_zh.md
 # 冲突时以 Markdown 为准 · 供未来 harness ontology-check 使用
 
 version: "1.2"
-product_semver: "0.4.0"
+product_semver: "1.0.0"
 license: MIT
 
 classes:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyning/harness",
-  "version": "0.4.0",
+  "version": "1.0.0",
   "description": "cyning-harness discipline package · init / upgrade / check CLI",
   "license": "MIT",
   "type": "module",

package/schema/invoke_index.v1.schema.json

@@ -0,0 +1,53 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://cyning.me/harness/schemas/invoke_index.v1.schema.json",
+  "title": "Harness InvokeSnapshot Index v1",
+  "description": "由 harness-sync --index 生成的 invokes/by-task 机器索引 · 只读聚合 · 不覆盖 S2 域",
+  "type": "object",
+  "required": ["schema_version", "generated_at", "index"],
+  "properties": {
+    "schema_version": {
+      "type": "string",
+      "const": "1"
+    },
+    "generated_at": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "index": {
+      "type": "object",
+      "description": "task_slug → 该 task 的 invoke 列表",
+      "additionalProperties": {
+        "type": "object",
+        "required": ["task_slug", "invokes"],
+        "properties": {
+          "task_slug": {
+            "type": "string",
+            "pattern": "^[a-z0-9][a-z0-9_-]*$"
+          },
+          "invokes": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "required": ["path", "mtime", "hat_id"],
+              "properties": {
+                "path": {
+                  "type": "string",
+                  "description": "相对业务仓根的 invoke 文件路径"
+                },
+                "mtime": {
+                  "type": "integer",
+                  "description": "文件修改时间戳（秒）"
+                },
+                "hat_id": {
+                  "type": "string",
+                  "description": "从文件名解析的帽 ID，如 30 / 40 / CLOSE / HG-RELEASE"
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}

package/wizard/compliance-bench.sh

@@ -0,0 +1,156 @@
+#!/usr/bin/env bash
+# SDD-Compliance micro-bench · v1 · S1–S4
+# 输出合规率 %；不测 LLM 解题，只测 Orchestrate/Verify 可机械部分。
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+HARNESS_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+BENCH_DIR="$HARNESS_ROOT/examples/compliance_bench"
+
+SCENARIOS=()
+QUIET=0
+
+usage() {
+  cat <<'EOF'
+用法：compliance-bench.sh [--all | S1 S2 S3 S4] [--quiet]
+
+  --all     运行 S1–S4
+  --quiet   仅输出最终合规率
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --all) SCENARIOS=(S1 S2 S3 S4); shift ;;
+    --quiet) QUIET=1; shift ;;
+    S1|S2|S3|S4) SCENARIOS+=("$1"); shift ;;
+    -h|--help) usage; exit 0 ;;
+    *) echo "未知参数: $1" >&2; usage; exit 1 ;;
+  esac
+done
+
+[[ ${#SCENARIOS[@]} -gt 0 ]] || { usage; exit 1; }
+
+log() { [[ "$QUIET" == "1" ]] || echo "$@"; }
+
+PASS=0
+FAIL=0
+RESULTS=()
+
+run_gate() {
+  local target="$1" task="$2"
+  "$HARNESS_ROOT/wizard/gate-check.sh" --target "$target" --task "$task" >/dev/null 2>&1 || true
+  # 返回实际 exit code
+  "$HARNESS_ROOT/wizard/gate-check.sh" --target "$target" --task "$task" >/dev/null 2>&1
+}
+
+scenario_S1() {
+  local dir="$BENCH_DIR/S1_r1_pending"
+  log "=== S1 · R1 pending 即 30（应拒） ==="
+  if ! "$HARNESS_ROOT/wizard/gate-check.sh" --target "$dir" --task task.md >/dev/null 2>&1; then
+    log "S1 PASS · gate-check 非零，30 被拒"
+    PASS=$((PASS+1))
+    RESULTS+=("S1|PASS")
+  else
+    log "S1 FAIL · gate-check exit 0，未拦截 pending R1"
+    FAIL=$((FAIL+1))
+    RESULTS+=("S1|FAIL")
+  fi
+}
+
+scenario_S2() {
+  local dir="$BENCH_DIR/S2_r1_no_review"
+  log "=== S2 · R1 approved 但无 review 文件（应非合规） ==="
+  local gate_ok=0
+  "$HARNESS_ROOT/wizard/gate-check.sh" --target "$dir" --task task.md >/dev/null 2>&1 && gate_ok=1 || true
+  local review_exists=0
+  [[ -n "$(find "$dir/reviews" -type f -name '*_audit_R1_*' 2>/dev/null)" ]] && review_exists=1 || true
+
+  if [[ "$review_exists" == "0" ]]; then
+    log "S2 PASS · review 文件缺失 -> 非合规 (gate-check exit=$gate_ok)"
+    PASS=$((PASS+1))
+    RESULTS+=("S2|PASS")
+  else
+    log "S2 FAIL · 不应存在 review 文件"
+    FAIL=$((FAIL+1))
+    RESULTS+=("S2|FAIL")
+  fi
+}
+
+scenario_S3() {
+  local dir="$BENCH_DIR/S3_r1_with_review"
+  log "=== S3 · R1 approved + review 落盘（应合规） ==="
+  local gate_ok=0
+  "$HARNESS_ROOT/wizard/gate-check.sh" --target "$dir" --task task.md >/dev/null 2>&1 && gate_ok=1 || true
+  local review_exists=0
+  [[ -n "$(find "$dir/reviews" -type f -name '*_audit_R1_*' 2>/dev/null)" ]] && review_exists=1 || true
+
+  if [[ "$gate_ok" == "1" && "$review_exists" == "1" ]]; then
+    log "S3 PASS · gate-check exit 0 且 review 文件存在"
+    PASS=$((PASS+1))
+    RESULTS+=("S3|PASS")
+  else
+    log "S3 FAIL · gate_ok=$gate_ok review_exists=$review_exists"
+    FAIL=$((FAIL+1))
+    RESULTS+=("S3|FAIL")
+  fi
+}
+
+scenario_S4() {
+  local dir="$BENCH_DIR/S4_sync_domain"
+  log "=== S4 · sync plan 不得含 task/reviews 路径 ==="
+  # 构造临时目标仓结构
+  local tmp
+  tmp="$(mktemp -d)"
+  mkdir -p "$tmp/.cyning-harness"
+  cp "$dir/profile.json" "$tmp/.cyning-harness/profile.json"
+  mkdir -p "$tmp/docs/harness/prompts" "$tmp/docs/harness/invokes" "$tmp/.cursor/rules"
+
+  local plan
+  plan="$tmp/plan.txt"
+  "$HARNESS_ROOT/wizard/harness-sync.sh" plan --target "$tmp" >"$plan" 2>&1 || true
+
+  local bad=0
+  if grep -E 'docs/tasks/|docs/harness/reviews/' "$plan" >/dev/null 2>&1; then
+    bad=1
+  fi
+  rm -rf "$tmp"
+
+  if [[ "$bad" == "0" ]]; then
+    log "S4 PASS · sync plan 未包含 task/reviews 路径"
+    PASS=$((PASS+1))
+    RESULTS+=("S4|PASS")
+  else
+    log "S4 FAIL · sync plan 包含不应同步的 task/reviews 路径"
+    FAIL=$((FAIL+1))
+    RESULTS+=("S4|FAIL")
+  fi
+}
+
+for s in "${SCENARIOS[@]}"; do
+  case "$s" in
+    S1) scenario_S1 ;;
+    S2) scenario_S2 ;;
+    S3) scenario_S3 ;;
+    S4) scenario_S4 ;;
+  esac
+done
+
+TOTAL=$((PASS+FAIL))
+RATE=0
+[[ "$TOTAL" -gt 0 ]] && RATE=$((PASS*100/TOTAL))
+
+log ""
+log "=== SDD-Compliance bench summary ==="
+for r in "${RESULTS[@]}"; do
+  IFS='|' read -r id status <<<"$r"
+  log "$id: $status"
+done
+log "合规率: $PASS/$TOTAL = $RATE%"
+
+# 静默模式仅输出数字
+if [[ "$QUIET" == "1" ]]; then
+  echo "$RATE"
+fi
+
+[[ "$FAIL" -eq 0 ]]