@hunter-harness/workflow-harness 0.2.12 → 0.2.14

package/harness/bundles/java/codex/scripts/harness_test_guard.py

@@ -448,9 +448,18 @@ def _validate_existing_manifest(
         tracked_now = _git(
             project, "ls-files", "--error-unmatch", "--", rel
         ).returncode == 0
-        if item["ignored"] != ignored_now or item["trackedBefore"] != tracked_now:
+        checkpointed = not item["trackedBefore"] and tracked_now
+        if (
+            item["trackedBefore"] != tracked_now and not checkpointed
+        ) or (
+            item["ignored"] != ignored_now and not checkpointed
+        ):
             return "MANIFEST_INVALID", {}
-        validated[rel] = dict(item)
+        normalized_item = dict(item)
+        if checkpointed:
+            normalized_item["trackedBefore"] = True
+            normalized_item["ignored"] = ignored_now
+        validated[rel] = normalized_item
     return None, validated
 
 
@@ -734,11 +743,26 @@ def _stage_locked(
     error, entries = validator(project_root, manifest, require_files=True)
     if error:
         return _result(False, action, error, [])
-    rels = [
-        rel
-        for rel, entry in entries.items()
-        if not is_v2 or entry.get("commitScope") == "current-change"
-    ]
+    rels: list[str] = []
+    for rel, entry in entries.items():
+        if is_v2:
+            if entry.get("commitScope") == "current-change":
+                rels.append(rel)
+            continue
+        if not entry["trackedBefore"]:
+            rels.append(rel)
+            continue
+        changed = _git(project_root, "diff", "--quiet", "HEAD", "--", rel)
+        if changed.returncode == 1:
+            rels.append(rel)
+        elif changed.returncode != 0:
+            return _result(
+                False,
+                action,
+                "GIT_DIFF_FAILED",
+                [rel],
+                error=changed.stderr.strip(),
+            )
     if not rels:
         return _result(True, action, "STAGED", [])
 
@@ -925,9 +949,22 @@ def close(project: Path | str, change_dir: Path | str) -> dict[str, Any]:
     if (
         not isinstance(snapshot, dict)
         or snapshot.get("schemaVersion") != SCHEMA_VERSION
-        or snapshot.get("projectRoot") != str(project_root)
     ):
         return _result(False, action, "SNAPSHOT_INVALID", [])
+    # Execution-root contract (retro §5.10): a snapshot captured against a
+    # different project root must fail with EXECUTION_ROOT_MISMATCH before
+    # the generic SNAPSHOT_INVALID, so callers can distinguish "wrong root"
+    # from "corrupt snapshot".
+    snapshot_root = snapshot.get("projectRoot")
+    if snapshot_root is not None and snapshot_root != str(project_root):
+        return _result(
+            False,
+            action,
+            "EXECUTION_ROOT_MISMATCH",
+            [],
+            expectedRoot=snapshot_root,
+            actualRoot=str(project_root),
+        )
 
     before_entries = snapshot.get("files")
     if not isinstance(before_entries, list):
@@ -963,15 +1000,51 @@ def close(project: Path | str, change_dir: Path | str) -> dict[str, Any]:
         if before[rel]["sha256"] != digest:
             touched.append((rel, "test-updated"))
 
-    recorded: list[str] = []
-    for rel, reason in touched:
-        result = record(project_root, change_root, [str(project_root / rel)], reason)
+    for reason in ("tdd-created", "test-updated"):
+        rels = [rel for rel, item_reason in touched if item_reason == reason]
+        if not rels:
+            continue
+        result = record(
+            project_root,
+            change_root,
+            [str(project_root / rel) for rel in rels],
+            reason,
+        )
         if not result.get("ok"):
             code = result.get("code", "RECORD_FAILED")
             if code == "TEST_PATH_NOT_ALLOWED":
-                return _result(False, action, "UNCLASSIFIABLE_TEST", [rel])
+                return _result(False, action, "UNCLASSIFIABLE_TEST", rels)
             return result
-        recorded.append(rel)
+
+    recorded = [rel for rel, _ in touched]
+
+    # Cross-check (retro §5.10): if the manifest has active entries for this
+    # change but close computed recordedCount=0, the snapshot/manifest/diff
+    # are inconsistent. Fail closed instead of silently returning success.
+    manifest_path = _manifest_path(change_root)
+    if manifest_path is not None and manifest_path.is_file():
+        try:
+            manifest = _read_json(manifest_path)
+        except (OSError, json.JSONDecodeError):
+            manifest = None
+        if isinstance(manifest, dict):
+            manifest_files = manifest.get("files")
+            if isinstance(manifest_files, list):
+                active_entries = [
+                    f for f in manifest_files
+                    if isinstance(f, dict)
+                    and f.get("reason") in ("tdd-created", "test-updated", "stale-test-repair")
+                ]
+                if active_entries and not recorded:
+                    return _result(
+                        False,
+                        action,
+                        "MANIFEST_DIFF_HASH_MISMATCH",
+                        [],
+                        manifestEntries=len(active_entries),
+                        recordedCount=0,
+                        detail="manifest has active entries but close computed 0 recorded tests",
+                    )
 
     return _result(
         True,

package/harness/bundles/java/cursor/.harness-build.json

@@ -2,5 +2,5 @@
   "schemaVersion": 1,
   "overlay": "java",
   "agent": "cursor",
-  "coreHash": "2adf80c5975eb711"
+  "coreHash": "5b442d7ce7db2ecd"
 }

package/harness/bundles/java/cursor/harness-apidoc/SKILL.md

@@ -2,7 +2,7 @@
 name: harness-apidoc
 description: 从 Java 后端代码生成结构化前端 API 文档（Controller/VO/ErrorCode）。使用场景：接口文档、前端接口文档、API 文档生成
 ---
-<!-- generated by harness_deploy.py; core=2adf80c5975eb711; overlay=java; agent=cursor; do not edit -->
+<!-- generated by harness_deploy.py; core=5b442d7ce7db2ecd; overlay=java; agent=cursor; do not edit -->
 # harness-apidoc — 前端接口文档（Java overlay）
 
 ## Purpose

package/harness/bundles/java/cursor/harness-archive/SKILL.md

@@ -3,7 +3,7 @@ name: harness-archive
 description: 归档所有变更产出（计划/测试报告/审查/SQL/API文档）到
   .harness/archive/，含归档元数据和可视化最终总结。使用场景：归档、完成归档、收尾、打包产出物
 ---
-<!-- generated by harness_deploy.py; core=2adf80c5975eb711; overlay=java; agent=cursor; do not edit -->
+<!-- generated by harness_deploy.py; core=5b442d7ce7db2ecd; overlay=java; agent=cursor; do not edit -->
 # harness-archive — 变更归档
 
 ## Purpose

package/harness/bundles/java/cursor/harness-codebase-map/SKILL.md

@@ -3,7 +3,7 @@ name: harness-codebase-map
 description: 分析现有代码库并生成 .harness/codebase/map/
   下的结构化代码库地图。用于陌生项目理解、重大改造前梳理、harness-sync 提示 map 过期后的人工刷新。
 ---
-<!-- generated by harness_deploy.py; core=2adf80c5975eb711; overlay=java; agent=cursor; do not edit -->
+<!-- generated by harness_deploy.py; core=5b442d7ce7db2ecd; overlay=java; agent=cursor; do not edit -->
 # harness-codebase-map — 代码库地图
 
 ## Purpose

package/harness/bundles/java/cursor/harness-knowledge-ingest/SKILL.md

@@ -3,7 +3,7 @@ name: harness-knowledge-ingest
 description: 从 .harness/archive 归档整理、同步和维护项目知识索引。适用场景：ingest knowledge、sync
   knowledge、rebuild knowledge index、promote knowledge、确认知识条目、检查知识库是否过期。
 ---
-<!-- generated by harness_deploy.py; core=2adf80c5975eb711; overlay=java; agent=cursor; do not edit -->
+<!-- generated by harness_deploy.py; core=5b442d7ce7db2ecd; overlay=java; agent=cursor; do not edit -->
 # harness-knowledge-ingest
 
 从 `.harness/archive/**/reports/final/summary-data.json` 抽取项目知识，生成并维护本地 `.harness/knowledge/` 索引。

package/harness/bundles/java/cursor/harness-knowledge-query/SKILL.md

@@ -3,7 +3,7 @@ name: harness-knowledge-query
 description: 根据新需求、设计任务、代码修改请求或问题排查，在规划和编码前查询 .harness/knowledge
   历史上下文。适用场景：query knowledge、查找历史需求、根据归档理解需求、继续之前类似开发、生成需求上下文包。
 ---
-<!-- generated by harness_deploy.py; core=2adf80c5975eb711; overlay=java; agent=cursor; do not edit -->
+<!-- generated by harness_deploy.py; core=5b442d7ce7db2ecd; overlay=java; agent=cursor; do not edit -->
 # harness-knowledge-query
 
 并行 change 中查询必须传 `--change <change-id>`；成功后以该 change 的 `meta/knowledge-context.json` 为稳定指针。全局 `context-packs/latest.json` 仅向后兼容，不得用于判断多个 active change 的上下文归属。

package/harness/bundles/java/cursor/harness-package/SKILL.md

@@ -2,7 +2,7 @@
 name: harness-package
 description: 增量模块打包：拉取最新→编译验证→mvn package→汇总 jar/war。使用场景：打包、package、发版准备
 ---
-<!-- generated by harness_deploy.py; core=2adf80c5975eb711; overlay=java; agent=cursor; do not edit -->
+<!-- generated by harness_deploy.py; core=5b442d7ce7db2ecd; overlay=java; agent=cursor; do not edit -->
 # harness-package — 增量模块打包（Java overlay）
 
 ## Purpose

package/harness/bundles/java/cursor/harness-plan/SKILL.md

@@ -2,7 +2,7 @@
 name: harness-plan
 description: 将需求转化为设计文档+实施计划+完整测试场景表，必须在编码前完成。使用场景：需求分析、feature plan、技术方案设计、实现方案规划
 ---
-<!-- generated by harness_deploy.py; core=2adf80c5975eb711; overlay=java; agent=cursor; do not edit -->
+<!-- generated by harness_deploy.py; core=5b442d7ce7db2ecd; overlay=java; agent=cursor; do not edit -->
 # harness-plan — 需求规划
 
 ## Purpose

package/harness/bundles/java/cursor/harness-review/SKILL.md

@@ -3,7 +3,7 @@ name: harness-review
 description: 6维度代码审查（架构/安全/规范/兼容/测试/性能），对照项目规则（见
   .harness/context-index.json）和测试场景表，在隔离上下文运行。使用场景：代码审查、提交前检查、合并评审
 ---
-<!-- generated by harness_deploy.py; core=2adf80c5975eb711; overlay=java; agent=cursor; do not edit -->
+<!-- generated by harness_deploy.py; core=5b442d7ce7db2ecd; overlay=java; agent=cursor; do not edit -->
 # harness-review — 代码审查
 
 ## Purpose

package/harness/bundles/java/cursor/harness-run/SKILL.md

@@ -2,7 +2,7 @@
 name: harness-run
 description: 按变更簇执行 TDD 编码循环（RED→GREEN→REFACTOR→编译验证），逐变更簇实现计划中的任务。使用场景：开始编码、实现功能、写代码、TDD 编码
 ---
-<!-- generated by harness_deploy.py; core=2adf80c5975eb711; overlay=java; agent=cursor; do not edit -->
+<!-- generated by harness_deploy.py; core=5b442d7ce7db2ecd; overlay=java; agent=cursor; do not edit -->
 # harness-run — 需求编码
 
 ## Purpose

package/harness/bundles/java/cursor/harness-submit/SKILL.md

@@ -3,7 +3,7 @@ name: harness-submit
 description: 最终提交封装：验证→中文 commit→提交/推送；worktree 模式含 --no-ff
   合并回主分支。使用场景：提交代码、commit、push、合并分支、merge to main、完成开发
 ---
-<!-- generated by harness_deploy.py; core=2adf80c5975eb711; overlay=java; agent=cursor; do not edit -->
+<!-- generated by harness_deploy.py; core=5b442d7ce7db2ecd; overlay=java; agent=cursor; do not edit -->
 # harness-submit — 最终提交（含 worktree 合并）
 
 ## Purpose
@@ -113,7 +113,7 @@ commit+push / 仅本地 commit / 取消；**不调用 Superpowers 呈现 PR/丢
 
 见 `checklist.md` 与 `../protocols/ledger-protocol.md`、`../protocols/submit-protocol.md`。
 
-test-tracking manifest 是 ignored test 的唯一强制暂存授权：只允许 `harness_test_guard.py stage` 暂存 manifest 中已校验路径，禁止 `git add -f .`、目录级 `git add -f` 或全局修改 `.gitignore`。worktree commit 前须确认 manifest 路径全部进入 cached diff；合并回主分支后、删除 worktree 前须确认这些路径已由目标 commit 跟踪，否则停止清理。
+test-tracking manifest 是 ignored test 的唯一强制暂存授权：只允许 `harness_test_guard.py stage` 暂存 manifest 中已校验且相对 `HEAD` 仍有差异的路径，禁止 `git add -f .`、目录级 `git add -f` 或全局修改 `.gitignore`。worktree commit 前须确认 guard 返回的 `files` 全部进入 cached diff；manifest 中已由 `HEAD` 跟踪且未变化的历史条目允许保留而不进入本次 cached diff。合并回主分支后、删除 worktree 前仍须确认 manifest 路径已由目标 commit 跟踪，否则停止清理。
 
 ### 四、worktree 合并硬规则
 

package/harness/bundles/java/cursor/harness-submit/checklist.md

@@ -119,7 +119,7 @@ python <skills-root>/scripts/harness_ledger.py can-reuse `
 
 - [ ] 检查 `.harness/changes/<change-name>/evidence/test-tracking.json` 是否存在
 - [ ] 存在时先执行 `python <skills-root>/scripts/harness_test_guard.py stage --project . --change-dir ".harness/changes/<change-name>" --json`；任一 manifest/path/hash/index 校验失败立即停止
-- [ ] 用 `git diff --cached --name-only` 验证 manifest 中每个精确路径均已暂存，且没有 guard 引入的额外路径
+- [ ] 用 `git diff --cached --name-only` 验证 guard 响应 `files` 中的每个精确路径均已暂存，且没有 guard 引入的额外路径；manifest 中已由 `HEAD` 跟踪且未变化的历史条目无需进入本次 cached diff
 - [ ] 无 manifest 时禁止使用 `git add -f`；有 manifest 时也只允许 guard 内部的 exact force-add，**禁止全局 force-add**、目录级 force-add 和全局修改 `.gitignore`
 
 提交前**强制检查 `.gitignore`** 是否包含 `.harness/`：

package/harness/bundles/java/cursor/harness-sync/SKILL.md

@@ -2,7 +2,7 @@
 name: harness-sync
 description: 检查并更新项目AI元数据（CodeGraph索引、harness-codebase-map分析、CLAUDE.md、AGENTS.md、.harness/完整性），确保Claude对代码库的理解与最新代码一致。当用户说'同步/更新索引/刷新元数据/检查一致性'时使用
 ---
-<!-- generated by harness_deploy.py; core=2adf80c5975eb711; overlay=java; agent=cursor; do not edit -->
+<!-- generated by harness_deploy.py; core=5b442d7ce7db2ecd; overlay=java; agent=cursor; do not edit -->
 # harness-sync — 元数据同步
 
 ## Purpose
@@ -39,7 +39,7 @@ python <skills-root>/scripts/harness_sync.py finalize --project . --run-id <run-
 | 3.5 | `harness_knowledge.py sync`；可 `sync --update`；失败不得假装可用。**知识闭环主入口**是 `/harness-knowledge-ingest auto`（含 Agent judge），sync 不重复列人工知识待办 |
 | 3.6 | 单次运行 `harness_knowledge.py maintain --project . --drain --json`，有界推进全部 `.harness/knowledge/maintenance-outbox/{pending,failed}`；不得为每个条目重复启动 Python/重建索引（§8.2：archive close 只 enqueue，sync 异步推进 outbox 到 completed/pending-judge） |
 | 4 | CLAUDE.md 完整性/行数 → 超限 AskUserQuestion 瘦身 |
-| 5 | AGENTS.md 与 CLAUDE.md 一致 |
+| 5 | AGENTS.md 与各 Agent 指令入口一致；Claude Code 启用时验证 CLAUDE.md 引用 AGENTS.md，禁止反向循环引用 |
 | 6 | `.harness/` 结构（init 规程 → `reference.md` 第 6 步）；已装 skill 新鲜度只经 `hunter-harness refresh --dry-run --json` 的 post-adaptation freshness 判断，禁止 raw build 字节比较 |
 | 7–9 | `项目规则（见 .harness/context-index.json）/`、构建配置、测试目录 — **只提示不自动修复** |
 

package/harness/bundles/java/cursor/harness-sync/reference.md

@@ -19,16 +19,17 @@ powershell.exe -Command "git -C '<项目路径>' diff --stat HEAD~5 2>$null"
 
 ### 2. CodeGraph 索引
 
-检查索引状态，**优先使用 MCP 工具**（若当前环境提供 `mcp__codegraph__codegraph_status` 则调用）；该工具不可用时**降级**为用 Glob 比对 `.codegraph/` 目录修改时间与最近提交时间。不允许通过普通 Bash 调 codegraph 命令：
+检查索引状态，**优先使用 MCP 工具**：若当前环境提供 `mcp__codegraph__codegraph_status` 则调用；没有 status 工具但提供 `codegraph_explore` 时，执行一次只读查询验证索引确实可响应，再用 Glob 比对 `.codegraph/` 目录修改时间与最近提交时间。两种 MCP 工具都不可用时才仅按时间戳降级。不允许通过普通 Bash 调 codegraph 命令：
 
 | 判断条件 | 状态 | 操作 |
 |----------|:----:|------|
 | 覆盖率 > 0% 且索引时间在最近提交之后 | ✅OK | 无需操作 |
+| `codegraph_explore` 查询成功且索引时间在最近提交之后 | ✅OK（功能已验证，覆盖率数值未暴露） | 报告真实证据，不虚构覆盖率百分比 |
 | 覆盖率 = 0% | ❌FAIL(未初始化) | 通过 PowerShell 执行 `npx @colbymchenry/codegraph && codegraph init --index` |
 | 索引时间在最近提交之前 | 🟡WARN(过期) | 同上 |
 
 > 前提：项目构建命令必须已成功。构建失败时先执行 `npx hunter-harness` 初始化检查。
-> 若 MCP 工具与 codegraph CLI 均不可用，标记 🟡WARN(CodeGraph 状态无法验证) 并在报告中说明"CodeGraph 状态无法验证，需用户手动确认"。
+> 若 status/explore MCP 工具均不可用，且时间戳证据也不足，标记 🟡WARN(CodeGraph 状态无法验证) 并在报告中说明具体缺失证据。成功的 explore 只能证明索引可用，不得伪造覆盖率数值。
 
 ### 3. harness-codebase-map 分析文档
 
@@ -61,7 +62,7 @@ powershell.exe -Command "git -C '<项目路径>' diff --stat HEAD~5 2>$null"
 
 ### 5. AGENTS.md 一致性
 
-检查 `AGENTS.md` 是否引用最新版 CLAUDE.md，是否包含项目概述和规则索引。如果 CLAUDE.md 刚刚更新过，同步更新 AGENTS.md 中的引用描述。
+检查 `AGENTS.md` 是否包含项目概述和规则索引。Claude Code adapter 启用时，检查 `CLAUDE.md` 引用 `AGENTS.md`（canonical managed block 使用 `@AGENTS.md`），让共享约束保持单一来源；不得要求 `AGENTS.md` 反向引用 `CLAUDE.md`，否则会形成循环，且会破坏未启用 Claude Code 的项目。
 
 ### 6. .harness/ 完整性
 
@@ -133,7 +134,7 @@ powershell.exe -Command "git -C '<项目路径>' diff --stat HEAD~5 2>$null"
 | CodeGraph | 🟡WARN(索引过期) | 索引已过期（上次: 3天前，最近提交: 今天），已重新索引 |
 | harness-codebase-map (.harness/codebase/map/) | ✅OK | 2 天前更新，变更量 5 个文件，无需更新 |
 | CLAUDE.md | ✅OK | 180 行，6 个必要章节完整 |
-| AGENTS.md | ✅OK | 已正确引用 CLAUDE.md |
+| AGENTS.md | ✅OK | 共享规则索引完整；CLAUDE.md 已单向引用 AGENTS.md |
 | .harness/ | ✅OK | config 目录存在，1 个变更目录（contribution-module） |
 
 ### 自动更新

package/harness/bundles/java/cursor/harness-test/SKILL.md

@@ -2,7 +2,7 @@
 name: harness-test
 description: 测试执行：读取场景表，执行单元测试+API接口测试+数据兼容验证，输出测试报告。当用户说'跑测试/验证/跑用例/接口测试/单元测试'时使用
 ---
-<!-- generated by harness_deploy.py; core=2adf80c5975eb711; overlay=java; agent=cursor; do not edit -->
+<!-- generated by harness_deploy.py; core=5b442d7ce7db2ecd; overlay=java; agent=cursor; do not edit -->
 # harness-test — 测试执行
 
 ## Purpose

package/harness/bundles/java/cursor/scripts/harness_archive.py

@@ -2799,6 +2799,130 @@ def _html_escape(text: str) -> str:
 # ---------------------------------------------------------------------------
 
 
+def validate_report_adequacy(summary: dict[str, Any]) -> dict[str, Any]:
+    """Validate that final summary is factually complete (retro §5.32).
+
+    The archive validator must not return all-green when the summary is
+    factually incomplete. This gate checks independent sources (git facts,
+    typed metrics, stage status) rather than comparing the summary against
+    a lossy projection of itself.
+    """
+    issues: list[dict[str, str]] = []
+
+    git_facts = summary.get("gitFacts") or {}
+    if isinstance(git_facts, dict):
+        base = str(git_facts.get("baseCommit") or "").strip()
+        final = str(git_facts.get("finalCommit") or "").strip()
+        files_changed = int(git_facts.get("filesChanged") or 0)
+        # base != final but diff=0 → factually incomplete.
+        if base and final and base != final and files_changed == 0:
+            issues.append({
+                "code": "DIFF_ZERO_WITH_NONEMPTY_COMMIT",
+                "severity": "error",
+                "message": f"final commit {final} differs from base {base} but filesChanged=0",
+            })
+
+    # Typed metrics missing despite test report artifacts present.
+    verification = summary.get("verification") or {}
+    if isinstance(verification, dict):
+        unit = verification.get("unitTests") or {}
+        api = verification.get("apiTests") or {}
+        artifacts = summary.get("artifacts") or []
+        has_test_report = any(
+            isinstance(a, dict) and "test" in str(a.get("path") or "").lower()
+            for a in artifacts
+        ) if isinstance(artifacts, list) else False
+        unit_pass = int(unit.get("passed") or 0) if isinstance(unit, dict) else 0
+        api_status = str(api.get("status") or "") if isinstance(api, dict) else ""
+        if has_test_report and unit_pass == 0 and api_status in {"", "not_available"}:
+            issues.append({
+                "code": "TYPED_METRICS_MISSING",
+                "severity": "error",
+                "message": "test report artifacts present but unitTests/apiTests typed metrics are empty",
+            })
+
+    # stageStatus contradicts event reducer.
+    stage = summary.get("stageStatus") or {}
+    stage_from_events = summary.get("stageStatusFromEvents") or {}
+    if isinstance(stage, dict) and isinstance(stage_from_events, dict):
+        for phase, status in stage.items():
+            event_status = stage_from_events.get(phase)
+            if event_status is not None and str(status) != str(event_status):
+                issues.append({
+                    "code": "STAGE_STATUS_CONTRADICTION",
+                    "severity": "error",
+                    "message": f"stageStatus.{phase}={status} but event reducer says {event_status}",
+                })
+
+    return {"ok": not issues, "issues": issues}
+
+
+def artifact_preflight(change_dir: Path) -> dict[str, Any]:
+    """Classify artifact events before destructive finalize (retro §5.31).
+
+    Returns per-artifact classification: informational (no path, OK),
+    canonicalizable (same-change repo-relative path, auto-normalize), or
+    blocking (cross-change/absolute/escaping path, fail closed).
+    """
+    change_dir = change_dir.resolve()
+    events_p = change_dir / "events.ndjson"
+    items: list[dict[str, Any]] = []
+    blocking: list[dict[str, Any]] = []
+    if not events_p.is_file():
+        return {"ok": True, "items": [], "blocking": []}
+    change_id = change_dir.name
+    for line in events_p.read_text(encoding="utf-8").splitlines():
+        try:
+            event = json.loads(line)
+        except json.JSONDecodeError:
+            continue
+        if not isinstance(event, dict) or event.get("type") != "artifact":
+            continue
+        path = str(event.get("path") or "").strip()
+        kind = str(event.get("kind") or "").strip()
+        event_id = str(event.get("id") or "")
+        if not path:
+            items.append({
+                "eventId": event_id,
+                "category": "informational",
+                "kind": kind or "informational",
+                "note": str(event.get("note") or "")[:80],
+            })
+            continue
+        # Check for escaping/cross-change paths.
+        parts = path.replace("\\", "/").split("/")
+        if ".." in parts or path.startswith("/") or re.match(r"^[A-Za-z]:", path):
+            item = {
+                "eventId": event_id,
+                "category": "blocking",
+                "path": path,
+                "reason": "absolute or escaping path",
+            }
+            items.append(item)
+            blocking.append(item)
+            continue
+        # Same-change repo-relative path: canonicalizable.
+        prefix = f".harness/changes/{change_id}/"
+        if path.startswith(prefix):
+            canonical = path[len(prefix):]
+            items.append({
+                "eventId": event_id,
+                "category": "canonicalizable",
+                "path": path,
+                "canonicalPath": canonical,
+                "correction": f"append correction --target-event-id {event_id} --target-field path --new-value-json \"{canonical}\"",
+            })
+            continue
+        # Change-relative path: OK.
+        items.append({
+            "eventId": event_id,
+            "category": "file-backed",
+            "path": path,
+            "exists": (change_dir / path).is_file(),
+        })
+    return {"ok": not blocking, "items": items, "blocking": blocking}
+
+
 def run_knowledge_poststeps(project_root: Path) -> dict[str, Any]:
     results: dict[str, Any] = {"ran": False, "steps": [], "warnings": []}
     if not KNOWLEDGE_SCRIPT.is_file():

package/harness/bundles/java/cursor/scripts/harness_change.py

@@ -224,6 +224,60 @@ def _layout_fields(project_root: Path, change_id: str) -> dict[str, Any]:
     }
 
 
+def read_concurrency_mode(project_root: Path) -> str:
+    """Return the configured concurrency mode (retro §5.2).
+
+    Defaults to ``single-active`` when no config declares a mode. Supported
+    values: ``single-active`` (default, blocks a second active Change),
+    ``isolated-multi-active`` (allows multiple active Changes but all
+    Change-scoped commands require ``--change``).
+    """
+    cfg = project_root / ".harness" / "config.json"
+    if cfg.is_file():
+        try:
+            data = json.loads(cfg.read_text(encoding="utf-8"))
+            if isinstance(data, dict):
+                mode = data.get("concurrencyMode")
+                if isinstance(mode, str) and mode in {
+                    "single-active",
+                    "isolated-multi-active",
+                }:
+                    return mode
+        except (OSError, json.JSONDecodeError):
+            pass
+    return "single-active"
+
+
+def check_concurrency_block(
+    project_root: Path, change_id: str
+) -> dict[str, Any] | None:
+    """Return a blocking payload when a second active Change is forbidden.
+
+    Returns ``None`` when the begin may proceed. In ``single-active`` mode a
+    second active Change (any other than ``change_id``) blocks begin; in
+    ``isolated-multi-active`` mode multiple active Changes are allowed.
+    """
+    mode = read_concurrency_mode(project_root)
+    if mode == "isolated-multi-active":
+        return None
+    active = list_active_changes(project_root)
+    others = [entry for entry in active if entry.get("changeId") != change_id]
+    if not others:
+        return None
+    return {
+        "ok": False,
+        "code": "SINGLE_ACTIVE_BLOCKED",
+        "message": (
+            "single-active concurrency mode: another active Change exists; "
+            "use portfolio/decompose to sequence multiple Changes, or switch "
+            "to isolated-multi-active after ensuring full Change-scoped isolation"
+        ),
+        "concurrencyMode": mode,
+        "activeChanges": active,
+        "blockingChanges": others,
+    }
+
+
 def resolve_change(
     project_root: Path,
     change_id: str | None,