@hunter-harness/workflow-harness 0.2.12 → 0.2.14

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (194) hide show
  1. package/harness/bundles/general/claude-code/.harness-build.json +1 -1
  2. package/harness/bundles/general/claude-code/harness-archive/SKILL.md +1 -1
  3. package/harness/bundles/general/claude-code/harness-codebase-map/SKILL.md +1 -1
  4. package/harness/bundles/general/claude-code/harness-knowledge-ingest/SKILL.md +1 -1
  5. package/harness/bundles/general/claude-code/harness-knowledge-query/SKILL.md +1 -1
  6. package/harness/bundles/general/claude-code/harness-plan/SKILL.md +1 -1
  7. package/harness/bundles/general/claude-code/harness-review/SKILL.md +1 -1
  8. package/harness/bundles/general/claude-code/harness-run/SKILL.md +1 -1
  9. package/harness/bundles/general/claude-code/harness-submit/SKILL.md +2 -2
  10. package/harness/bundles/general/claude-code/harness-submit/checklist.md +1 -1
  11. package/harness/bundles/general/claude-code/harness-sync/SKILL.md +2 -2
  12. package/harness/bundles/general/claude-code/harness-sync/reference.md +5 -4
  13. package/harness/bundles/general/claude-code/harness-test/SKILL.md +1 -1
  14. package/harness/bundles/general/claude-code/scripts/harness_archive.py +124 -0
  15. package/harness/bundles/general/claude-code/scripts/harness_change.py +54 -0
  16. package/harness/bundles/general/claude-code/scripts/harness_deploy.py +177 -0
  17. package/harness/bundles/general/claude-code/scripts/harness_events.py +99 -1
  18. package/harness/bundles/general/claude-code/scripts/harness_gate.py +57 -4
  19. package/harness/bundles/general/claude-code/scripts/harness_integration.py +3 -0
  20. package/harness/bundles/general/claude-code/scripts/harness_ledger.py +15 -3
  21. package/harness/bundles/general/claude-code/scripts/harness_preflight.py +47 -0
  22. package/harness/bundles/general/claude-code/scripts/harness_test_guard.py +86 -13
  23. package/harness/bundles/general/codebuddy/.harness-build.json +1 -1
  24. package/harness/bundles/general/codebuddy/harness-archive/SKILL.md +1 -1
  25. package/harness/bundles/general/codebuddy/harness-codebase-map/SKILL.md +1 -1
  26. package/harness/bundles/general/codebuddy/harness-knowledge-ingest/SKILL.md +1 -1
  27. package/harness/bundles/general/codebuddy/harness-knowledge-query/SKILL.md +1 -1
  28. package/harness/bundles/general/codebuddy/harness-plan/SKILL.md +1 -1
  29. package/harness/bundles/general/codebuddy/harness-review/SKILL.md +1 -1
  30. package/harness/bundles/general/codebuddy/harness-run/SKILL.md +1 -1
  31. package/harness/bundles/general/codebuddy/harness-submit/SKILL.md +2 -2
  32. package/harness/bundles/general/codebuddy/harness-submit/checklist.md +1 -1
  33. package/harness/bundles/general/codebuddy/harness-sync/SKILL.md +2 -2
  34. package/harness/bundles/general/codebuddy/harness-sync/reference.md +5 -4
  35. package/harness/bundles/general/codebuddy/harness-test/SKILL.md +1 -1
  36. package/harness/bundles/general/codebuddy/scripts/harness_archive.py +124 -0
  37. package/harness/bundles/general/codebuddy/scripts/harness_change.py +54 -0
  38. package/harness/bundles/general/codebuddy/scripts/harness_deploy.py +177 -0
  39. package/harness/bundles/general/codebuddy/scripts/harness_events.py +99 -1
  40. package/harness/bundles/general/codebuddy/scripts/harness_gate.py +57 -4
  41. package/harness/bundles/general/codebuddy/scripts/harness_integration.py +3 -0
  42. package/harness/bundles/general/codebuddy/scripts/harness_ledger.py +15 -3
  43. package/harness/bundles/general/codebuddy/scripts/harness_preflight.py +47 -0
  44. package/harness/bundles/general/codebuddy/scripts/harness_test_guard.py +86 -13
  45. package/harness/bundles/general/codex/.harness-build.json +1 -1
  46. package/harness/bundles/general/codex/harness-archive/SKILL.md +1 -1
  47. package/harness/bundles/general/codex/harness-codebase-map/SKILL.md +1 -1
  48. package/harness/bundles/general/codex/harness-knowledge-ingest/SKILL.md +1 -1
  49. package/harness/bundles/general/codex/harness-knowledge-query/SKILL.md +1 -1
  50. package/harness/bundles/general/codex/harness-plan/SKILL.md +1 -1
  51. package/harness/bundles/general/codex/harness-review/SKILL.md +1 -1
  52. package/harness/bundles/general/codex/harness-run/SKILL.md +1 -1
  53. package/harness/bundles/general/codex/harness-submit/SKILL.md +2 -2
  54. package/harness/bundles/general/codex/harness-submit/checklist.md +1 -1
  55. package/harness/bundles/general/codex/harness-sync/SKILL.md +2 -2
  56. package/harness/bundles/general/codex/harness-sync/reference.md +5 -4
  57. package/harness/bundles/general/codex/harness-test/SKILL.md +1 -1
  58. package/harness/bundles/general/codex/scripts/harness_archive.py +124 -0
  59. package/harness/bundles/general/codex/scripts/harness_change.py +54 -0
  60. package/harness/bundles/general/codex/scripts/harness_deploy.py +177 -0
  61. package/harness/bundles/general/codex/scripts/harness_events.py +99 -1
  62. package/harness/bundles/general/codex/scripts/harness_gate.py +57 -4
  63. package/harness/bundles/general/codex/scripts/harness_integration.py +3 -0
  64. package/harness/bundles/general/codex/scripts/harness_ledger.py +15 -3
  65. package/harness/bundles/general/codex/scripts/harness_preflight.py +47 -0
  66. package/harness/bundles/general/codex/scripts/harness_test_guard.py +86 -13
  67. package/harness/bundles/general/cursor/.harness-build.json +1 -1
  68. package/harness/bundles/general/cursor/harness-archive/SKILL.md +1 -1
  69. package/harness/bundles/general/cursor/harness-codebase-map/SKILL.md +1 -1
  70. package/harness/bundles/general/cursor/harness-knowledge-ingest/SKILL.md +1 -1
  71. package/harness/bundles/general/cursor/harness-knowledge-query/SKILL.md +1 -1
  72. package/harness/bundles/general/cursor/harness-plan/SKILL.md +1 -1
  73. package/harness/bundles/general/cursor/harness-review/SKILL.md +1 -1
  74. package/harness/bundles/general/cursor/harness-run/SKILL.md +1 -1
  75. package/harness/bundles/general/cursor/harness-submit/SKILL.md +2 -2
  76. package/harness/bundles/general/cursor/harness-submit/checklist.md +1 -1
  77. package/harness/bundles/general/cursor/harness-sync/SKILL.md +2 -2
  78. package/harness/bundles/general/cursor/harness-sync/reference.md +5 -4
  79. package/harness/bundles/general/cursor/harness-test/SKILL.md +1 -1
  80. package/harness/bundles/general/cursor/scripts/harness_archive.py +124 -0
  81. package/harness/bundles/general/cursor/scripts/harness_change.py +54 -0
  82. package/harness/bundles/general/cursor/scripts/harness_deploy.py +177 -0
  83. package/harness/bundles/general/cursor/scripts/harness_events.py +99 -1
  84. package/harness/bundles/general/cursor/scripts/harness_gate.py +57 -4
  85. package/harness/bundles/general/cursor/scripts/harness_integration.py +3 -0
  86. package/harness/bundles/general/cursor/scripts/harness_ledger.py +15 -3
  87. package/harness/bundles/general/cursor/scripts/harness_preflight.py +47 -0
  88. package/harness/bundles/general/cursor/scripts/harness_test_guard.py +86 -13
  89. package/harness/bundles/java/claude-code/.harness-build.json +1 -1
  90. package/harness/bundles/java/claude-code/harness-apidoc/SKILL.md +1 -1
  91. package/harness/bundles/java/claude-code/harness-archive/SKILL.md +1 -1
  92. package/harness/bundles/java/claude-code/harness-codebase-map/SKILL.md +1 -1
  93. package/harness/bundles/java/claude-code/harness-knowledge-ingest/SKILL.md +1 -1
  94. package/harness/bundles/java/claude-code/harness-knowledge-query/SKILL.md +1 -1
  95. package/harness/bundles/java/claude-code/harness-package/SKILL.md +1 -1
  96. package/harness/bundles/java/claude-code/harness-plan/SKILL.md +1 -1
  97. package/harness/bundles/java/claude-code/harness-review/SKILL.md +1 -1
  98. package/harness/bundles/java/claude-code/harness-run/SKILL.md +1 -1
  99. package/harness/bundles/java/claude-code/harness-submit/SKILL.md +2 -2
  100. package/harness/bundles/java/claude-code/harness-submit/checklist.md +1 -1
  101. package/harness/bundles/java/claude-code/harness-sync/SKILL.md +2 -2
  102. package/harness/bundles/java/claude-code/harness-sync/reference.md +5 -4
  103. package/harness/bundles/java/claude-code/harness-test/SKILL.md +1 -1
  104. package/harness/bundles/java/claude-code/scripts/harness_archive.py +124 -0
  105. package/harness/bundles/java/claude-code/scripts/harness_change.py +54 -0
  106. package/harness/bundles/java/claude-code/scripts/harness_deploy.py +177 -0
  107. package/harness/bundles/java/claude-code/scripts/harness_events.py +99 -1
  108. package/harness/bundles/java/claude-code/scripts/harness_gate.py +57 -4
  109. package/harness/bundles/java/claude-code/scripts/harness_integration.py +3 -0
  110. package/harness/bundles/java/claude-code/scripts/harness_ledger.py +15 -3
  111. package/harness/bundles/java/claude-code/scripts/harness_preflight.py +47 -0
  112. package/harness/bundles/java/claude-code/scripts/harness_test_guard.py +86 -13
  113. package/harness/bundles/java/codebuddy/.harness-build.json +1 -1
  114. package/harness/bundles/java/codebuddy/harness-apidoc/SKILL.md +1 -1
  115. package/harness/bundles/java/codebuddy/harness-archive/SKILL.md +1 -1
  116. package/harness/bundles/java/codebuddy/harness-codebase-map/SKILL.md +1 -1
  117. package/harness/bundles/java/codebuddy/harness-knowledge-ingest/SKILL.md +1 -1
  118. package/harness/bundles/java/codebuddy/harness-knowledge-query/SKILL.md +1 -1
  119. package/harness/bundles/java/codebuddy/harness-package/SKILL.md +1 -1
  120. package/harness/bundles/java/codebuddy/harness-plan/SKILL.md +1 -1
  121. package/harness/bundles/java/codebuddy/harness-review/SKILL.md +1 -1
  122. package/harness/bundles/java/codebuddy/harness-run/SKILL.md +1 -1
  123. package/harness/bundles/java/codebuddy/harness-submit/SKILL.md +2 -2
  124. package/harness/bundles/java/codebuddy/harness-submit/checklist.md +1 -1
  125. package/harness/bundles/java/codebuddy/harness-sync/SKILL.md +2 -2
  126. package/harness/bundles/java/codebuddy/harness-sync/reference.md +5 -4
  127. package/harness/bundles/java/codebuddy/harness-test/SKILL.md +1 -1
  128. package/harness/bundles/java/codebuddy/scripts/harness_archive.py +124 -0
  129. package/harness/bundles/java/codebuddy/scripts/harness_change.py +54 -0
  130. package/harness/bundles/java/codebuddy/scripts/harness_deploy.py +177 -0
  131. package/harness/bundles/java/codebuddy/scripts/harness_events.py +99 -1
  132. package/harness/bundles/java/codebuddy/scripts/harness_gate.py +57 -4
  133. package/harness/bundles/java/codebuddy/scripts/harness_integration.py +3 -0
  134. package/harness/bundles/java/codebuddy/scripts/harness_ledger.py +15 -3
  135. package/harness/bundles/java/codebuddy/scripts/harness_preflight.py +47 -0
  136. package/harness/bundles/java/codebuddy/scripts/harness_test_guard.py +86 -13
  137. package/harness/bundles/java/codex/.harness-build.json +1 -1
  138. package/harness/bundles/java/codex/harness-apidoc/SKILL.md +1 -1
  139. package/harness/bundles/java/codex/harness-archive/SKILL.md +1 -1
  140. package/harness/bundles/java/codex/harness-codebase-map/SKILL.md +1 -1
  141. package/harness/bundles/java/codex/harness-knowledge-ingest/SKILL.md +1 -1
  142. package/harness/bundles/java/codex/harness-knowledge-query/SKILL.md +1 -1
  143. package/harness/bundles/java/codex/harness-package/SKILL.md +1 -1
  144. package/harness/bundles/java/codex/harness-plan/SKILL.md +1 -1
  145. package/harness/bundles/java/codex/harness-review/SKILL.md +1 -1
  146. package/harness/bundles/java/codex/harness-run/SKILL.md +1 -1
  147. package/harness/bundles/java/codex/harness-submit/SKILL.md +2 -2
  148. package/harness/bundles/java/codex/harness-submit/checklist.md +1 -1
  149. package/harness/bundles/java/codex/harness-sync/SKILL.md +2 -2
  150. package/harness/bundles/java/codex/harness-sync/reference.md +5 -4
  151. package/harness/bundles/java/codex/harness-test/SKILL.md +1 -1
  152. package/harness/bundles/java/codex/scripts/harness_archive.py +124 -0
  153. package/harness/bundles/java/codex/scripts/harness_change.py +54 -0
  154. package/harness/bundles/java/codex/scripts/harness_deploy.py +177 -0
  155. package/harness/bundles/java/codex/scripts/harness_events.py +99 -1
  156. package/harness/bundles/java/codex/scripts/harness_gate.py +57 -4
  157. package/harness/bundles/java/codex/scripts/harness_integration.py +3 -0
  158. package/harness/bundles/java/codex/scripts/harness_ledger.py +15 -3
  159. package/harness/bundles/java/codex/scripts/harness_preflight.py +47 -0
  160. package/harness/bundles/java/codex/scripts/harness_test_guard.py +86 -13
  161. package/harness/bundles/java/cursor/.harness-build.json +1 -1
  162. package/harness/bundles/java/cursor/harness-apidoc/SKILL.md +1 -1
  163. package/harness/bundles/java/cursor/harness-archive/SKILL.md +1 -1
  164. package/harness/bundles/java/cursor/harness-codebase-map/SKILL.md +1 -1
  165. package/harness/bundles/java/cursor/harness-knowledge-ingest/SKILL.md +1 -1
  166. package/harness/bundles/java/cursor/harness-knowledge-query/SKILL.md +1 -1
  167. package/harness/bundles/java/cursor/harness-package/SKILL.md +1 -1
  168. package/harness/bundles/java/cursor/harness-plan/SKILL.md +1 -1
  169. package/harness/bundles/java/cursor/harness-review/SKILL.md +1 -1
  170. package/harness/bundles/java/cursor/harness-run/SKILL.md +1 -1
  171. package/harness/bundles/java/cursor/harness-submit/SKILL.md +2 -2
  172. package/harness/bundles/java/cursor/harness-submit/checklist.md +1 -1
  173. package/harness/bundles/java/cursor/harness-sync/SKILL.md +2 -2
  174. package/harness/bundles/java/cursor/harness-sync/reference.md +5 -4
  175. package/harness/bundles/java/cursor/harness-test/SKILL.md +1 -1
  176. package/harness/bundles/java/cursor/scripts/harness_archive.py +124 -0
  177. package/harness/bundles/java/cursor/scripts/harness_change.py +54 -0
  178. package/harness/bundles/java/cursor/scripts/harness_deploy.py +177 -0
  179. package/harness/bundles/java/cursor/scripts/harness_events.py +99 -1
  180. package/harness/bundles/java/cursor/scripts/harness_gate.py +57 -4
  181. package/harness/bundles/java/cursor/scripts/harness_integration.py +3 -0
  182. package/harness/bundles/java/cursor/scripts/harness_ledger.py +15 -3
  183. package/harness/bundles/java/cursor/scripts/harness_preflight.py +47 -0
  184. package/harness/bundles/java/cursor/scripts/harness_test_guard.py +86 -13
  185. package/harness/manifests/general/claude-code.json +23 -23
  186. package/harness/manifests/general/codebuddy.json +23 -23
  187. package/harness/manifests/general/codex.json +23 -23
  188. package/harness/manifests/general/cursor.json +23 -23
  189. package/harness/manifests/java/claude-code.json +25 -25
  190. package/harness/manifests/java/codebuddy.json +25 -25
  191. package/harness/manifests/java/codex.json +25 -25
  192. package/harness/manifests/java/cursor.json +25 -25
  193. package/hunter-workflow-family.json +2 -2
  194. package/package.json +15 -15
@@ -19,16 +19,17 @@ powershell.exe -Command "git -C '<项目路径>' diff --stat HEAD~5 2>$null"
19
19
 
20
20
  ### 2. CodeGraph 索引
21
21
 
22
- 检查索引状态,**优先使用 MCP 工具**(若当前环境提供 `mcp__codegraph__codegraph_status` 则调用);该工具不可用时**降级**为用 Glob 比对 `.codegraph/` 目录修改时间与最近提交时间。不允许通过普通 Bash 调 codegraph 命令:
22
+ 检查索引状态,**优先使用 MCP 工具**:若当前环境提供 `mcp__codegraph__codegraph_status` 则调用;没有 status 工具但提供 `codegraph_explore` 时,执行一次只读查询验证索引确实可响应,再用 Glob 比对 `.codegraph/` 目录修改时间与最近提交时间。两种 MCP 工具都不可用时才仅按时间戳降级。不允许通过普通 Bash 调 codegraph 命令:
23
23
 
24
24
  | 判断条件 | 状态 | 操作 |
25
25
  |----------|:----:|------|
26
26
  | 覆盖率 > 0% 且索引时间在最近提交之后 | ✅OK | 无需操作 |
27
+ | `codegraph_explore` 查询成功且索引时间在最近提交之后 | ✅OK(功能已验证,覆盖率数值未暴露) | 报告真实证据,不虚构覆盖率百分比 |
27
28
  | 覆盖率 = 0% | ❌FAIL(未初始化) | 通过 PowerShell 执行 `npx @colbymchenry/codegraph && codegraph init --index` |
28
29
  | 索引时间在最近提交之前 | 🟡WARN(过期) | 同上 |
29
30
 
30
31
  > 前提:项目构建命令必须已成功。构建失败时先执行 `npx hunter-harness` 初始化检查。
31
- > 若 MCP 工具与 codegraph CLI 均不可用,标记 🟡WARN(CodeGraph 状态无法验证) 并在报告中说明"CodeGraph 状态无法验证,需用户手动确认"。
32
+ > 若 status/explore MCP 工具均不可用,且时间戳证据也不足,标记 🟡WARN(CodeGraph 状态无法验证) 并在报告中说明具体缺失证据。成功的 explore 只能证明索引可用,不得伪造覆盖率数值。
32
33
 
33
34
  ### 3. harness-codebase-map 分析文档
34
35
 
@@ -61,7 +62,7 @@ powershell.exe -Command "git -C '<项目路径>' diff --stat HEAD~5 2>$null"
61
62
 
62
63
  ### 5. AGENTS.md 一致性
63
64
 
64
- 检查 `AGENTS.md` 是否引用最新版 CLAUDE.md,是否包含项目概述和规则索引。如果 CLAUDE.md 刚刚更新过,同步更新 AGENTS.md 中的引用描述。
65
+ 检查 `AGENTS.md` 是否包含项目概述和规则索引。Claude Code adapter 启用时,检查 `CLAUDE.md` 引用 `AGENTS.md`(canonical managed block 使用 `@AGENTS.md`),让共享约束保持单一来源;不得要求 `AGENTS.md` 反向引用 `CLAUDE.md`,否则会形成循环,且会破坏未启用 Claude Code 的项目。
65
66
 
66
67
  ### 6. .harness/ 完整性
67
68
 
@@ -133,7 +134,7 @@ powershell.exe -Command "git -C '<项目路径>' diff --stat HEAD~5 2>$null"
133
134
  | CodeGraph | 🟡WARN(索引过期) | 索引已过期(上次: 3天前,最近提交: 今天),已重新索引 |
134
135
  | harness-codebase-map (.harness/codebase/map/) | ✅OK | 2 天前更新,变更量 5 个文件,无需更新 |
135
136
  | CLAUDE.md | ✅OK | 180 行,6 个必要章节完整 |
136
- | AGENTS.md | ✅OK | 已正确引用 CLAUDE.md |
137
+ | AGENTS.md | ✅OK | 共享规则索引完整;CLAUDE.md 已单向引用 AGENTS.md |
137
138
  | .harness/ | ✅OK | config 目录存在,1 个变更目录(contribution-module) |
138
139
 
139
140
  ### 自动更新
@@ -2,7 +2,7 @@
2
2
  name: harness-test
3
3
  description: 测试执行:读取场景表,执行单元测试+API接口测试+数据兼容验证,输出测试报告。当用户说'跑测试/验证/跑用例/接口测试/单元测试'时使用
4
4
  ---
5
- <!-- generated by harness_deploy.py; core=8dd8ce9aa1ac47f5; overlay=none; agent=codebuddy; do not edit -->
5
+ <!-- generated by harness_deploy.py; core=50a141f3d56ac500; overlay=none; agent=codebuddy; do not edit -->
6
6
  # harness-test — 测试执行
7
7
 
8
8
  ## Purpose
@@ -2799,6 +2799,130 @@ def _html_escape(text: str) -> str:
2799
2799
  # ---------------------------------------------------------------------------
2800
2800
 
2801
2801
 
2802
+ def validate_report_adequacy(summary: dict[str, Any]) -> dict[str, Any]:
2803
+ """Validate that final summary is factually complete (retro §5.32).
2804
+
2805
+ The archive validator must not return all-green when the summary is
2806
+ factually incomplete. This gate checks independent sources (git facts,
2807
+ typed metrics, stage status) rather than comparing the summary against
2808
+ a lossy projection of itself.
2809
+ """
2810
+ issues: list[dict[str, str]] = []
2811
+
2812
+ git_facts = summary.get("gitFacts") or {}
2813
+ if isinstance(git_facts, dict):
2814
+ base = str(git_facts.get("baseCommit") or "").strip()
2815
+ final = str(git_facts.get("finalCommit") or "").strip()
2816
+ files_changed = int(git_facts.get("filesChanged") or 0)
2817
+ # base != final but diff=0 → factually incomplete.
2818
+ if base and final and base != final and files_changed == 0:
2819
+ issues.append({
2820
+ "code": "DIFF_ZERO_WITH_NONEMPTY_COMMIT",
2821
+ "severity": "error",
2822
+ "message": f"final commit {final} differs from base {base} but filesChanged=0",
2823
+ })
2824
+
2825
+ # Typed metrics missing despite test report artifacts present.
2826
+ verification = summary.get("verification") or {}
2827
+ if isinstance(verification, dict):
2828
+ unit = verification.get("unitTests") or {}
2829
+ api = verification.get("apiTests") or {}
2830
+ artifacts = summary.get("artifacts") or []
2831
+ has_test_report = any(
2832
+ isinstance(a, dict) and "test" in str(a.get("path") or "").lower()
2833
+ for a in artifacts
2834
+ ) if isinstance(artifacts, list) else False
2835
+ unit_pass = int(unit.get("passed") or 0) if isinstance(unit, dict) else 0
2836
+ api_status = str(api.get("status") or "") if isinstance(api, dict) else ""
2837
+ if has_test_report and unit_pass == 0 and api_status in {"", "not_available"}:
2838
+ issues.append({
2839
+ "code": "TYPED_METRICS_MISSING",
2840
+ "severity": "error",
2841
+ "message": "test report artifacts present but unitTests/apiTests typed metrics are empty",
2842
+ })
2843
+
2844
+ # stageStatus contradicts event reducer.
2845
+ stage = summary.get("stageStatus") or {}
2846
+ stage_from_events = summary.get("stageStatusFromEvents") or {}
2847
+ if isinstance(stage, dict) and isinstance(stage_from_events, dict):
2848
+ for phase, status in stage.items():
2849
+ event_status = stage_from_events.get(phase)
2850
+ if event_status is not None and str(status) != str(event_status):
2851
+ issues.append({
2852
+ "code": "STAGE_STATUS_CONTRADICTION",
2853
+ "severity": "error",
2854
+ "message": f"stageStatus.{phase}={status} but event reducer says {event_status}",
2855
+ })
2856
+
2857
+ return {"ok": not issues, "issues": issues}
2858
+
2859
+
2860
+ def artifact_preflight(change_dir: Path) -> dict[str, Any]:
2861
+ """Classify artifact events before destructive finalize (retro §5.31).
2862
+
2863
+ Returns per-artifact classification: informational (no path, OK),
2864
+ canonicalizable (same-change repo-relative path, auto-normalize), or
2865
+ blocking (cross-change/absolute/escaping path, fail closed).
2866
+ """
2867
+ change_dir = change_dir.resolve()
2868
+ events_p = change_dir / "events.ndjson"
2869
+ items: list[dict[str, Any]] = []
2870
+ blocking: list[dict[str, Any]] = []
2871
+ if not events_p.is_file():
2872
+ return {"ok": True, "items": [], "blocking": []}
2873
+ change_id = change_dir.name
2874
+ for line in events_p.read_text(encoding="utf-8").splitlines():
2875
+ try:
2876
+ event = json.loads(line)
2877
+ except json.JSONDecodeError:
2878
+ continue
2879
+ if not isinstance(event, dict) or event.get("type") != "artifact":
2880
+ continue
2881
+ path = str(event.get("path") or "").strip()
2882
+ kind = str(event.get("kind") or "").strip()
2883
+ event_id = str(event.get("id") or "")
2884
+ if not path:
2885
+ items.append({
2886
+ "eventId": event_id,
2887
+ "category": "informational",
2888
+ "kind": kind or "informational",
2889
+ "note": str(event.get("note") or "")[:80],
2890
+ })
2891
+ continue
2892
+ # Check for escaping/cross-change paths.
2893
+ parts = path.replace("\\", "/").split("/")
2894
+ if ".." in parts or path.startswith("/") or re.match(r"^[A-Za-z]:", path):
2895
+ item = {
2896
+ "eventId": event_id,
2897
+ "category": "blocking",
2898
+ "path": path,
2899
+ "reason": "absolute or escaping path",
2900
+ }
2901
+ items.append(item)
2902
+ blocking.append(item)
2903
+ continue
2904
+ # Same-change repo-relative path: canonicalizable.
2905
+ prefix = f".harness/changes/{change_id}/"
2906
+ if path.startswith(prefix):
2907
+ canonical = path[len(prefix):]
2908
+ items.append({
2909
+ "eventId": event_id,
2910
+ "category": "canonicalizable",
2911
+ "path": path,
2912
+ "canonicalPath": canonical,
2913
+ "correction": f"append correction --target-event-id {event_id} --target-field path --new-value-json \"{canonical}\"",
2914
+ })
2915
+ continue
2916
+ # Change-relative path: OK.
2917
+ items.append({
2918
+ "eventId": event_id,
2919
+ "category": "file-backed",
2920
+ "path": path,
2921
+ "exists": (change_dir / path).is_file(),
2922
+ })
2923
+ return {"ok": not blocking, "items": items, "blocking": blocking}
2924
+
2925
+
2802
2926
  def run_knowledge_poststeps(project_root: Path) -> dict[str, Any]:
2803
2927
  results: dict[str, Any] = {"ran": False, "steps": [], "warnings": []}
2804
2928
  if not KNOWLEDGE_SCRIPT.is_file():
@@ -224,6 +224,60 @@ def _layout_fields(project_root: Path, change_id: str) -> dict[str, Any]:
224
224
  }
225
225
 
226
226
 
227
+ def read_concurrency_mode(project_root: Path) -> str:
228
+ """Return the configured concurrency mode (retro §5.2).
229
+
230
+ Defaults to ``single-active`` when no config declares a mode. Supported
231
+ values: ``single-active`` (default, blocks a second active Change),
232
+ ``isolated-multi-active`` (allows multiple active Changes but all
233
+ Change-scoped commands require ``--change``).
234
+ """
235
+ cfg = project_root / ".harness" / "config.json"
236
+ if cfg.is_file():
237
+ try:
238
+ data = json.loads(cfg.read_text(encoding="utf-8"))
239
+ if isinstance(data, dict):
240
+ mode = data.get("concurrencyMode")
241
+ if isinstance(mode, str) and mode in {
242
+ "single-active",
243
+ "isolated-multi-active",
244
+ }:
245
+ return mode
246
+ except (OSError, json.JSONDecodeError):
247
+ pass
248
+ return "single-active"
249
+
250
+
251
+ def check_concurrency_block(
252
+ project_root: Path, change_id: str
253
+ ) -> dict[str, Any] | None:
254
+ """Return a blocking payload when a second active Change is forbidden.
255
+
256
+ Returns ``None`` when the begin may proceed. In ``single-active`` mode a
257
+ second active Change (any other than ``change_id``) blocks begin; in
258
+ ``isolated-multi-active`` mode multiple active Changes are allowed.
259
+ """
260
+ mode = read_concurrency_mode(project_root)
261
+ if mode == "isolated-multi-active":
262
+ return None
263
+ active = list_active_changes(project_root)
264
+ others = [entry for entry in active if entry.get("changeId") != change_id]
265
+ if not others:
266
+ return None
267
+ return {
268
+ "ok": False,
269
+ "code": "SINGLE_ACTIVE_BLOCKED",
270
+ "message": (
271
+ "single-active concurrency mode: another active Change exists; "
272
+ "use portfolio/decompose to sequence multiple Changes, or switch "
273
+ "to isolated-multi-active after ensuring full Change-scoped isolation"
274
+ ),
275
+ "concurrencyMode": mode,
276
+ "activeChanges": active,
277
+ "blockingChanges": others,
278
+ }
279
+
280
+
227
281
  def resolve_change(
228
282
  project_root: Path,
229
283
  change_id: str | None,
@@ -623,6 +623,107 @@ def collect_files(root: Path) -> dict[str, str]:
623
623
  return files
624
624
 
625
625
 
626
+ # --- Per-file bundle manifest (retro 2026-07-20 §5.1/5.25) -----------------
627
+ #
628
+ # registry_version + bundle_hash alone cannot prove every installed file
629
+ # belongs to the declared bundle. The bundle therefore ships a per-file
630
+ # manifest (relpath/sha256/size/mode/adapterTransformationId); install
631
+ # verifies staging content against it BEFORE the atomic switch and never
632
+ # updates metadata on partial failure.
633
+
634
+ BUNDLE_MANIFEST_NAME = "bundle-manifest.json"
635
+ _MANIFEST_EXCLUDED = frozenset(
636
+ {BUILD_MARKER, MANIFEST_NAME, AGENTS_MANAGED_NAME, BUNDLE_MANIFEST_NAME}
637
+ )
638
+
639
+
640
+ def build_manifest(root: Path, transformation_id: str = "raw") -> list[dict[str, Any]]:
641
+ """Return per-file manifest entries for every bundle file under ``root``.
642
+
643
+ Install metadata (build marker, managed manifests, the manifest itself)
644
+ is excluded. Entries are sorted by relpath for deterministic output.
645
+ """
646
+ root = root.resolve()
647
+ entries: list[dict[str, Any]] = []
648
+ for path in sorted(root.rglob("*")):
649
+ if not path.is_file() or "__pycache__" in path.parts:
650
+ continue
651
+ rel = path.relative_to(root).as_posix()
652
+ if rel in _MANIFEST_EXCLUDED:
653
+ continue
654
+ stat = path.stat()
655
+ entries.append(
656
+ {
657
+ "relpath": rel,
658
+ "sha256": sha256_file(path),
659
+ "size": stat.st_size,
660
+ "mode": stat.st_mode,
661
+ "adapterTransformationId": transformation_id,
662
+ }
663
+ )
664
+ return entries
665
+
666
+
667
+ def compute_bundle_manifest_hash(entries: list[dict[str, Any]]) -> str:
668
+ """Deterministic aggregate hash over manifest entries (order-independent).
669
+
670
+ Must match packages/contracts/src/bundle-manifest.ts computeBundleManifestHash.
671
+ """
672
+ ordered = sorted(entries, key=lambda entry: entry["relpath"])
673
+ lines = [
674
+ f"{entry['relpath']}:{entry['sha256']}:{entry['size']}:{entry['mode']}:{entry['adapterTransformationId']}"
675
+ for entry in ordered
676
+ ]
677
+ return hashlib.sha256("\n".join(lines).encode("utf-8")).hexdigest()
678
+
679
+
680
+ def aggregate_installed_content_hash(files: dict[str, str]) -> str:
681
+ """Deterministic aggregate hash over actually-installed relpath->sha256."""
682
+ lines = [f"{rel}:{files[rel]}" for rel in sorted(files)]
683
+ return hashlib.sha256("\n".join(lines).encode("utf-8")).hexdigest()
684
+
685
+
686
+ def _verify_tree_against_manifest(
687
+ root: Path, entries: list[dict[str, Any]]
688
+ ) -> list[dict[str, str]]:
689
+ """Return mismatch details for files under ``root`` vs manifest entries."""
690
+ mismatches: list[dict[str, str]] = []
691
+ actual = collect_files(root)
692
+ declared = {entry["relpath"]: entry["sha256"] for entry in entries}
693
+ for rel, expected in sorted(declared.items()):
694
+ if rel not in actual:
695
+ mismatches.append({"relpath": rel, "expected": expected, "actual": "<missing>"})
696
+ elif actual[rel] != expected:
697
+ mismatches.append(
698
+ {"relpath": rel, "expected": expected, "actual": actual[rel]}
699
+ )
700
+ return mismatches
701
+
702
+
703
+ def cmd_verify_installed(
704
+ installed_dir: Path, entries: list[dict[str, Any]], bundle_version: str
705
+ ) -> dict[str, Any]:
706
+ """Verify installed content against the bundle manifest, per file."""
707
+ installed_dir = installed_dir.resolve()
708
+ mismatches = _verify_tree_against_manifest(installed_dir, entries)
709
+ actual = collect_files(installed_dir)
710
+ declared = {entry["relpath"] for entry in entries}
711
+ content = {
712
+ rel: digest
713
+ for rel, digest in actual.items()
714
+ if rel not in _MANIFEST_EXCLUDED and rel in declared
715
+ }
716
+ return {
717
+ "ok": not mismatches,
718
+ "action": "verify-installed",
719
+ "bundleVersion": bundle_version,
720
+ "verificationStatus": "verified" if not mismatches else "degraded",
721
+ "installedContentHash": aggregate_installed_content_hash(content),
722
+ "verifiedAt": now_iso(),
723
+ "mismatchDetails": mismatches,
724
+ }
725
+
726
+
626
727
  def cmd_install(build_out: Path, project: Path, target: Path | None) -> dict[str, Any]:
627
728
  build_out = build_out.resolve()
628
729
  project = project.resolve()
@@ -644,6 +745,23 @@ def cmd_install(build_out: Path, project: Path, target: Path | None) -> dict[str
644
745
  backup: str | None = None
645
746
  staging = dest.parent / f".{dest.name}.staging-{uuid.uuid4().hex[:8]}"
646
747
  shutil.copytree(build_out, staging)
748
+ # Per-file content proof (retro §5.1): if the build carries a
749
+ # bundle-manifest.json, staging must match it exactly before anything is
750
+ # switched. A mismatch aborts the install without touching dest or any
751
+ # metadata — never a partial install under a fresh version label.
752
+ manifest_path = staging / BUNDLE_MANIFEST_NAME
753
+ if manifest_path.is_file():
754
+ manifest_data = json.loads(manifest_path.read_text(encoding="utf-8"))
755
+ manifest_entries = (
756
+ manifest_data.get("files", []) if isinstance(manifest_data, dict) else []
757
+ )
758
+ mismatches = _verify_tree_against_manifest(staging, manifest_entries)
759
+ if mismatches:
760
+ shutil.rmtree(staging, ignore_errors=True)
761
+ raise ValueError(
762
+ "BUNDLE_CONTENT_MISMATCH: staging diverges from bundle-manifest.json: "
763
+ + ", ".join(m["relpath"] for m in mismatches)
764
+ )
647
765
  if dest.exists() and any(dest.iterdir()):
648
766
  managed_old = _read_managed_set(dest / MANIFEST_NAME)
649
767
  # Preserve user-owned files: anything in dest that was NOT managed by a
@@ -771,6 +889,28 @@ def build_parser() -> argparse.ArgumentParser:
771
889
  v.add_argument("--bundle", type=Path, required=True)
772
890
  v.add_argument("--manifest", type=Path, required=True)
773
891
  v.add_argument("--json", action="store_true")
892
+
893
+ g = sub.add_parser(
894
+ "generate-manifest",
895
+ help="Generate per-file bundle-manifest.json for a bundle dir",
896
+ )
897
+ g.add_argument("--bundle", type=Path, required=True)
898
+ g.add_argument("--bundle-version", required=True)
899
+ g.add_argument(
900
+ "--transformation",
901
+ choices=["raw", "adapted", "workflow-packaged"],
902
+ default="raw",
903
+ )
904
+ g.add_argument("--out", type=Path)
905
+ g.add_argument("--json", action="store_true")
906
+
907
+ vi = sub.add_parser(
908
+ "verify-installed",
909
+ help="Verify installed tree content against bundle-manifest.json",
910
+ )
911
+ vi.add_argument("--installed", type=Path, required=True)
912
+ vi.add_argument("--manifest", type=Path, required=True)
913
+ vi.add_argument("--json", action="store_true")
774
914
  return p
775
915
 
776
916
 
@@ -794,6 +934,43 @@ def main(argv: list[str] | None = None) -> int:
794
934
  if args.json:
795
935
  return emit_json(result)
796
936
  return 0 if result["ok"] else 1
937
+ if args.command == "generate-manifest":
938
+ entries = build_manifest(args.bundle, transformation_id=args.transformation)
939
+ manifest = {
940
+ "schemaVersion": 1,
941
+ "bundleVersion": args.bundle_version,
942
+ "bundleManifestHash": compute_bundle_manifest_hash(entries),
943
+ "files": entries,
944
+ }
945
+ text = json.dumps(manifest, ensure_ascii=False, indent=2) + "\n"
946
+ if args.out is not None:
947
+ args.out.parent.mkdir(parents=True, exist_ok=True)
948
+ args.out.write_text(text, encoding="utf-8", newline="\n")
949
+ result = {
950
+ "ok": True,
951
+ "action": "generate-manifest",
952
+ "bundleVersion": args.bundle_version,
953
+ "bundleManifestHash": manifest["bundleManifestHash"],
954
+ "fileCount": len(entries),
955
+ "out": str(args.out) if args.out is not None else None,
956
+ }
957
+ if args.json:
958
+ return emit_json(result)
959
+ if args.out is None:
960
+ print(text, end="")
961
+ return 0
962
+ if args.command == "verify-installed":
963
+ manifest_data = json.loads(args.manifest.read_text(encoding="utf-8"))
964
+ if not isinstance(manifest_data, dict):
965
+ raise ValueError("manifest must be a JSON object")
966
+ result = cmd_verify_installed(
967
+ args.installed,
968
+ manifest_data.get("files", []),
969
+ str(manifest_data.get("bundleVersion", "")),
970
+ )
971
+ if args.json:
972
+ return emit_json(result)
973
+ return 0 if result["ok"] else 1
797
974
  except (FileNotFoundError, KeyError, RuntimeError, ValueError) as exc:
798
975
  if getattr(args, "json", False):
799
976
  return emit_json({"ok": False, "error": str(exc)}, ok=False)
@@ -506,6 +506,81 @@ def new_event_id(existing: list[dict[str, Any]] | None = None) -> str:
506
506
  return f"evt-{uuid.uuid4().hex}"
507
507
 
508
508
 
509
+ def append_event(
510
+ change_dir: Path,
511
+ *,
512
+ phase: str,
513
+ type_: str,
514
+ note: str = "",
515
+ kind: str | None = None,
516
+ path: str | None = None,
517
+ run_id: str | None = None,
518
+ executor_tool: str | None = None,
519
+ ) -> dict[str, Any]:
520
+ """Programmatic append API (retro §5.31 C5/T16).
521
+
522
+ Validates and appends an event without going through argparse. Returns
523
+ a payload dict with ``ok``/``code``/``event``.
524
+ """
525
+ args = argparse.Namespace(
526
+ change_dir=str(change_dir),
527
+ phase=phase,
528
+ type=type_,
529
+ note=note,
530
+ kind=kind,
531
+ path=path,
532
+ run_id=run_id,
533
+ executor_tool=executor_tool,
534
+ command=None,
535
+ exit_code=None,
536
+ duration_ms=None,
537
+ status=None,
538
+ name=None,
539
+ code=None,
540
+ severity=None,
541
+ message=None,
542
+ decision=None,
543
+ reason=None,
544
+ issue_id=None,
545
+ scope=None,
546
+ target_event_id=None,
547
+ target_field=None,
548
+ old_value_hash=None,
549
+ new_value_json=None,
550
+ attempt=None,
551
+ executor_agent=None,
552
+ executor_model=None,
553
+ handoff_from_tool=None,
554
+ handoff_reason=None,
555
+ trace_id=None,
556
+ span_id=None,
557
+ parent_span_id=None,
558
+ runner_ms=None,
559
+ orchestration_active_ms=None,
560
+ wall_clock_ms=None,
561
+ user_wait_ms=None,
562
+ legacy_lenient=False,
563
+ json=True,
564
+ )
565
+ as_json = True
566
+ if type_ not in EVENT_TYPES:
567
+ return {"ok": False, "code": "EVENT_TYPE_INVALID", "message": f"unsupported type: {type_}"}
568
+ validation = validate_append_event(args)
569
+ if validation:
570
+ error_code, message = validation
571
+ return {"ok": False, "code": error_code, "message": message}
572
+ archived = archived_change_dir(change_dir)
573
+ if archived is not None:
574
+ return {"ok": False, "code": "ARCHIVED_CHANGE_IMMUTABLE", "message": str(archived)}
575
+ events_path_obj = events_path(change_dir)
576
+ lock_path = events_path_obj.with_name(events_path_obj.name + ".lock")
577
+ existing = []
578
+ event = build_event(args, existing)
579
+ with event_file_lock(lock_path):
580
+ atomic_append_line(events_path_obj, json.dumps(event, ensure_ascii=False))
581
+ return {"ok": True, "event": event, "events_path": str(events_path_obj), "rendered": False}
582
+
583
+
509
584
  def build_event(args: argparse.Namespace, existing: list[dict[str, Any]]) -> dict[str, Any]:
510
585
  event: dict[str, Any] = {
511
586
  "schema_version": SCHEMA_VERSION,
@@ -588,8 +663,31 @@ def validate_append_event(args: argparse.Namespace) -> tuple[str, str] | None:
588
663
  except json.JSONDecodeError as exc:
589
664
  return (
590
665
  "CORRECTION_VALUE_INVALID_JSON",
591
- f"CORRECTION_VALUE_INVALID_JSON: {exc.msg}",
666
+ f"CORRECTION_VALUE_INVALID_JSON: {exc}",
667
+ )
668
+ # Retro §5.31: artifact events must distinguish file-backed from
669
+ # informational. file-backed requires a change-relative path; informational
670
+ # (preview/summary) must not masquerade as a file artifact. Legacy kind
671
+ # values (ledger, report, etc.) are treated as file-backed aliases.
672
+ if event_type == "artifact":
673
+ kind = str(getattr(args, "kind", "") or "").strip()
674
+ path = str(getattr(args, "path", "") or "").strip()
675
+ is_informational = kind == "informational"
676
+ if kind == "file-backed" and not path:
677
+ return (
678
+ "ARTIFACT_PATH_REQUIRED",
679
+ "ARTIFACT_PATH_REQUIRED: file-backed artifact requires --path",
680
+ )
681
+ # If kind is explicitly informational, path is optional. If kind is
682
+ # absent and path is absent, reject (can't infer file-backed without path).
683
+ if not kind and not path:
684
+ return (
685
+ "ARTIFACT_PATH_REQUIRED",
686
+ "ARTIFACT_PATH_REQUIRED: artifact without --kind or --path is ambiguous; "
687
+ "use --kind informational for previews or --path for file artifacts",
592
688
  )
689
+ # If no kind is provided, infer from path presence: a path implies
690
+ # file-backed, absence implies informational (legacy compatibility).
593
691
  return None
594
692
 
595
693