@hunter-harness/workflow-harness 0.2.13 → 0.2.15

package/harness/bundles/java/claude-code/scripts/harness_change.py

@@ -224,6 +224,60 @@ def _layout_fields(project_root: Path, change_id: str) -> dict[str, Any]:
     }
 
 
+def read_concurrency_mode(project_root: Path) -> str:
+    """Return the configured concurrency mode (retro §5.2).
+
+    Defaults to ``single-active`` when no config declares a mode. Supported
+    values: ``single-active`` (default, blocks a second active Change),
+    ``isolated-multi-active`` (allows multiple active Changes but all
+    Change-scoped commands require ``--change``).
+    """
+    cfg = project_root / ".harness" / "config.json"
+    if cfg.is_file():
+        try:
+            data = json.loads(cfg.read_text(encoding="utf-8"))
+            if isinstance(data, dict):
+                mode = data.get("concurrencyMode")
+                if isinstance(mode, str) and mode in {
+                    "single-active",
+                    "isolated-multi-active",
+                }:
+                    return mode
+        except (OSError, json.JSONDecodeError):
+            pass
+    return "single-active"
+
+
+def check_concurrency_block(
+    project_root: Path, change_id: str
+) -> dict[str, Any] | None:
+    """Return a blocking payload when a second active Change is forbidden.
+
+    Returns ``None`` when the begin may proceed. In ``single-active`` mode a
+    second active Change (any other than ``change_id``) blocks begin; in
+    ``isolated-multi-active`` mode multiple active Changes are allowed.
+    """
+    mode = read_concurrency_mode(project_root)
+    if mode == "isolated-multi-active":
+        return None
+    active = list_active_changes(project_root)
+    others = [entry for entry in active if entry.get("changeId") != change_id]
+    if not others:
+        return None
+    return {
+        "ok": False,
+        "code": "SINGLE_ACTIVE_BLOCKED",
+        "message": (
+            "single-active concurrency mode: another active Change exists; "
+            "use portfolio/decompose to sequence multiple Changes, or switch "
+            "to isolated-multi-active after ensuring full Change-scoped isolation"
+        ),
+        "concurrencyMode": mode,
+        "activeChanges": active,
+        "blockingChanges": others,
+    }
+
+
 def resolve_change(
     project_root: Path,
     change_id: str | None,
@@ -536,7 +590,9 @@ def lease_port(
         }
         for port in range(start, end + 1):
             if port not in used:
+                lease_id = str(uuid.uuid4())
                 entry = {
+                    "leaseId": lease_id,
                     "changeId": change_id,
                     "runId": run_id,
                     "pid": os.getpid(),
@@ -549,7 +605,7 @@ def lease_port(
                 leases.append(entry)
                 registry["leases"] = leases
                 _write_json(registry_path, registry)
-                return {"ok": True, "code": "PORT_LEASED", "port": port, "lease": entry}
+                return {"ok": True, "code": "PORT_LEASED", "port": port, "leaseId": lease_id, "lease": entry}
     return {
         "ok": False,
         "code": "PORT_RANGE_EXHAUSTED",
@@ -562,7 +618,16 @@ def release_port(
     *,
     change_id: str,
     run_id: str,
+    port: int | None = None,
+    lease_id: str | None = None,
 ) -> dict[str, Any]:
+    """Release port leases by subset (retro §5.16).
+
+    - `--lease-id`: release only the matching leaseId.
+    - `--port`: release only the matching port (must match changeId+runId).
+    - Neither: release all leases matching (changeId, runId) — does NOT require
+      all leases under changeId to have the same runId.
+    """
     registry_path = project_root / PORTS_REL / "registry.json"
     if not registry_path.is_file():
         return {"ok": True, "code": "PORT_LEASE_ABSENT", "changeId": change_id}
@@ -574,27 +639,84 @@ def release_port(
         leases = registry.get("leases") if isinstance(registry, dict) else None
         if not isinstance(leases, list):
             return {"ok": False, "code": "PORT_REGISTRY_INVALID", "message": "leases is not a list"}
-        owned = [
-            item for item in leases
-            if isinstance(item, dict) and str(item.get("changeId")) == change_id
-        ]
-        if not owned:
+
+        # Select the subset to release based on lease_id, port, or (changeId, runId)
+        if lease_id is not None:
+            to_release = [
+                item for item in leases
+                if isinstance(item, dict) and str(item.get("leaseId")) == lease_id
+            ]
+            # Validate that the lease belongs to this change
+            for item in to_release:
+                if str(item.get("changeId")) != change_id:
+                    return {
+                        "ok": False,
+                        "code": "PORT_LEASE_OWNER_MISMATCH",
+                        "message": "leaseId does not belong to this change",
+                        "holder": item,
+                    }
+        elif port is not None:
+            to_release = [
+                item for item in leases
+                if isinstance(item, dict)
+                and item.get("port") == port
+                and str(item.get("changeId")) == change_id
+            ]
+            # Validate runId matches
+            for item in to_release:
+                if str(item.get("runId")) != run_id:
+                    return {
+                        "ok": False,
+                        "code": "PORT_LEASE_OWNER_MISMATCH",
+                        "message": f"port {port} owned by different runId",
+                        "holder": item,
+                        "conflictingOwners": [
+                            {"runId": str(i.get("runId")), "port": i.get("port")}
+                            for i in leases
+                            if isinstance(i, dict)
+                            and i.get("port") == port
+                            and str(i.get("changeId")) == change_id
+                        ],
+                    }
+        else:
+            # Release all matching (changeId, runId) — subset release
+            to_release = [
+                item for item in leases
+                if isinstance(item, dict)
+                and str(item.get("changeId")) == change_id
+                and str(item.get("runId")) == run_id
+            ]
+
+        if not to_release:
+            # Check if there are other leases under this changeId (different runId)
+            other_owned = [
+                item for item in leases
+                if isinstance(item, dict)
+                and str(item.get("changeId")) == change_id
+                and str(item.get("runId")) != run_id
+            ]
+            if other_owned:
+                return {
+                    "ok": False,
+                    "code": "PORT_LEASE_OWNER_MISMATCH",
+                    "message": "no matching leases for this runId; other runIds exist under this changeId",
+                    "conflictingOwners": [
+                        {"runId": str(i.get("runId")), "port": i.get("port"), "leaseId": i.get("leaseId")}
+                        for i in other_owned
+                    ],
+                }
             return {"ok": True, "code": "PORT_LEASE_ABSENT", "changeId": change_id}
-        if any(str(item.get("runId")) != run_id for item in owned):
-            return {
-                "ok": False,
-                "code": "PORT_LEASE_OWNER_MISMATCH",
-                "message": "run id does not match port lease owner",
-                "holder": owned[0],
-            }
-        released_ports = [item.get("port") for item in owned]
-        registry["leases"] = [item for item in leases if item not in owned]
+
+        released_ports = [item.get("port") for item in to_release]
+        released_ids = [item.get("leaseId") for item in to_release]
+        registry["leases"] = [item for item in leases if item not in to_release]
         _write_json(registry_path, registry)
         return {
             "ok": True,
             "code": "PORT_LEASE_RELEASED",
             "changeId": change_id,
             "ports": released_ports,
+            "leaseIds": released_ids,
         }
 
 
@@ -794,7 +916,13 @@ def cmd_lease_port(args: argparse.Namespace) -> int:
 
 def cmd_release_port(args: argparse.Namespace) -> int:
     project = resolve_main_project_root()
-    payload = release_port(project, change_id=args.change, run_id=args.run_id)
+    payload = release_port(
+        project,
+        change_id=args.change,
+        run_id=args.run_id,
+        port=getattr(args, "port", None),
+        lease_id=getattr(args, "lease_id", None),
+    )
     if payload.get("ok"):
         emit(payload, as_json=bool(args.json))
         return 0
@@ -827,6 +955,161 @@ def cmd_integration_lock(args: argparse.Namespace) -> int:
     )
 
 
+def _ensure_change_identity(change_dir: Path) -> dict[str, str]:
+    """Ensure meta/change-identity.json exists with a stable UUID (retro §5.5).
+
+    Returns the identity dict with changeUuid and changeName.
+    """
+    identity_path = change_dir / "meta" / "change-identity.json"
+    if identity_path.is_file():
+        try:
+            data = json.loads(identity_path.read_text(encoding="utf-8-sig"))
+            if isinstance(data, dict) and data.get("changeUuid"):
+                return data
+        except (OSError, json.JSONDecodeError):
+            pass
+    # Generate new identity
+    identity = {
+        "schemaVersion": 1,
+        "changeUuid": str(uuid.uuid4()),
+        "changeName": change_dir.name,
+        "createdAt": now_iso(),
+    }
+    identity_path.parent.mkdir(parents=True, exist_ok=True)
+    identity_path.write_text(
+        json.dumps(identity, ensure_ascii=False, indent=2) + "\n",
+        encoding="utf-8",
+        newline="\n",
+    )
+    return identity
+
+
+def cmd_rename(args: argparse.Namespace) -> int:
+    """Rename a change atomically: directory, pointers, worktree, identity (retro §5.5).
+
+    Appends a change.rename event; does not rewrite history.
+    """
+    project = resolve_main_project_root()
+    changes_root = project / ".harness" / "changes"
+    old_dir = changes_root / args.change
+    new_dir = changes_root / args.to
+
+    if not old_dir.is_dir():
+        return emit_error(
+            "CHANGE_NOT_FOUND",
+            f"change directory not found: {old_dir}",
+            as_json=bool(args.json),
+        )
+    if new_dir.exists():
+        return emit_error(
+            "CHANGE_ALREADY_EXISTS",
+            f"target change directory already exists: {new_dir}",
+            as_json=bool(args.json),
+        )
+
+    # Ensure identity exists before rename
+    identity = _ensure_change_identity(old_dir)
+    old_uuid = identity.get("changeUuid", "")
+
+    # Rename directory
+    import shutil
+    shutil.move(str(old_dir), str(new_dir))
+
+    # Update knowledge-context.json.changeId if present
+    kc_path = new_dir / "meta" / "knowledge-context.json"
+    if kc_path.is_file():
+        try:
+            kc = json.loads(kc_path.read_text(encoding="utf-8-sig"))
+            if isinstance(kc, dict):
+                kc["changeId"] = args.to
+                kc["changeUuid"] = old_uuid
+                kc_path.write_text(
+                    json.dumps(kc, ensure_ascii=False, indent=2) + "\n",
+                    encoding="utf-8",
+                    newline="\n",
+                )
+        except (OSError, json.JSONDecodeError):
+            pass
+
+    # Update worktree.json path/branch if present
+    wt_path = new_dir / "meta" / "worktree.json"
+    if wt_path.is_file():
+        try:
+            wt = json.loads(wt_path.read_text(encoding="utf-8-sig"))
+            if isinstance(wt, dict):
+                old_name = args.change
+                new_name = args.to
+                # Update path and branch if they contain old name
+                if isinstance(wt.get("path"), str) and old_name in wt["path"]:
+                    wt["path"] = wt["path"].replace(old_name, new_name)
+                if isinstance(wt.get("branch"), str) and old_name in wt["branch"]:
+                    wt["branch"] = wt["branch"].replace(old_name, new_name)
+                wt_path.write_text(
+                    json.dumps(wt, ensure_ascii=False, indent=2) + "\n",
+                    encoding="utf-8",
+                    newline="\n",
+                )
+        except (OSError, json.JSONDecodeError):
+            pass
+
+    # Update change-identity.json.changeName
+    identity_path = new_dir / "meta" / "change-identity.json"
+    if identity_path.is_file():
+        try:
+            ident = json.loads(identity_path.read_text(encoding="utf-8-sig"))
+            if isinstance(ident, dict):
+                ident["changeName"] = args.to
+                ident["renamedFrom"] = args.change
+                identity_path.write_text(
+                    json.dumps(ident, ensure_ascii=False, indent=2) + "\n",
+                    encoding="utf-8",
+                    newline="\n",
+                )
+        except (OSError, json.JSONDecodeError):
+            pass
+
+    # Append change.rename event (does not rewrite history)
+    try:
+        import harness_events
+        harness_events.append_event(
+            new_dir,
+            phase="plan",
+            type_="change.rename",
+            renamed_from=args.change,
+            renamed_to=args.to,
+            change_uuid=old_uuid,
+            note=f"change renamed from {args.change} to {args.to}",
+        )
+    except Exception:
+        pass  # event append failure should not block rename
+
+    payload = {
+        "ok": True,
+        "code": "RENAMED",
+        "changeUuid": old_uuid,
+        "renamedFrom": args.change,
+        "renamedTo": args.to,
+        "changeDir": str(new_dir),
+    }
+    emit(payload, as_json=bool(args.json))
+    return 0
+
+
+def cmd_ensure_identity(args: argparse.Namespace) -> int:
+    """Ensure meta/change-identity.json exists with a stable UUID (retro §5.5)."""
+    project = resolve_main_project_root()
+    change_dir = project / ".harness" / "changes" / args.change
+    if not change_dir.is_dir():
+        return emit_error(
+            "CHANGE_NOT_FOUND",
+            f"change directory not found: {change_dir}",
+            as_json=bool(args.json),
+        )
+    identity = _ensure_change_identity(change_dir)
+    emit(identity, as_json=bool(args.json))
+    return 0
+
+
 def build_parser() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(prog="harness_change.py")
     parser.add_argument("--json", action="store_true")
@@ -869,6 +1152,8 @@ def build_parser() -> argparse.ArgumentParser:
     p_port_release = sub.add_parser("release-port", parents=[shared])
     p_port_release.add_argument("--change", required=True)
     p_port_release.add_argument("--run-id", required=True)
+    p_port_release.add_argument("--port", type=int, default=None)
+    p_port_release.add_argument("--lease-id", default=None)
     p_port_release.set_defaults(func=cmd_release_port)
 
     p_lock = sub.add_parser("integration-lock", parents=[shared])
@@ -877,6 +1162,15 @@ def build_parser() -> argparse.ArgumentParser:
     p_lock.add_argument("--ttl-seconds", type=int, default=3600)
     p_lock.set_defaults(func=cmd_integration_lock)
 
+    p_rename = sub.add_parser("rename", parents=[shared])
+    p_rename.add_argument("--change", required=True)
+    p_rename.add_argument("--to", required=True)
+    p_rename.set_defaults(func=cmd_rename)
+
+    p_identity = sub.add_parser("ensure-identity", parents=[shared])
+    p_identity.add_argument("--change", required=True)
+    p_identity.set_defaults(func=cmd_ensure_identity)
+
     return parser
 
 

package/harness/bundles/java/claude-code/scripts/harness_deploy.py

@@ -623,6 +623,107 @@ def collect_files(root: Path) -> dict[str, str]:
     return files
 
 
+# --- Per-file bundle manifest (retro 2026-07-20 §5.1/5.25) -----------------
+#
+# registry_version + bundle_hash alone cannot prove every installed file
+# belongs to the declared bundle. The bundle therefore ships a per-file
+# manifest (relpath/sha256/size/mode/adapterTransformationId); install
+# verifies staging content against it BEFORE the atomic switch and never
+# updates metadata on partial failure.
+
+BUNDLE_MANIFEST_NAME = "bundle-manifest.json"
+_MANIFEST_EXCLUDED = frozenset(
+    {BUILD_MARKER, MANIFEST_NAME, AGENTS_MANAGED_NAME, BUNDLE_MANIFEST_NAME}
+)
+
+
+def build_manifest(root: Path, transformation_id: str = "raw") -> list[dict[str, Any]]:
+    """Return per-file manifest entries for every bundle file under ``root``.
+
+    Install metadata (build marker, managed manifests, the manifest itself)
+    is excluded. Entries are sorted by relpath for deterministic output.
+    """
+    root = root.resolve()
+    entries: list[dict[str, Any]] = []
+    for path in sorted(root.rglob("*")):
+        if not path.is_file() or "__pycache__" in path.parts:
+            continue
+        rel = path.relative_to(root).as_posix()
+        if rel in _MANIFEST_EXCLUDED:
+            continue
+        stat = path.stat()
+        entries.append(
+            {
+                "relpath": rel,
+                "sha256": sha256_file(path),
+                "size": stat.st_size,
+                "mode": stat.st_mode,
+                "adapterTransformationId": transformation_id,
+            }
+        )
+    return entries
+
+
+def compute_bundle_manifest_hash(entries: list[dict[str, Any]]) -> str:
+    """Deterministic aggregate hash over manifest entries (order-independent).
+
+    Must match packages/contracts/src/bundle-manifest.ts computeBundleManifestHash.
+    """
+    ordered = sorted(entries, key=lambda entry: entry["relpath"])
+    lines = [
+        f"{entry['relpath']}:{entry['sha256']}:{entry['size']}:{entry['mode']}:{entry['adapterTransformationId']}"
+        for entry in ordered
+    ]
+    return hashlib.sha256("\n".join(lines).encode("utf-8")).hexdigest()
+
+
+def aggregate_installed_content_hash(files: dict[str, str]) -> str:
+    """Deterministic aggregate hash over actually-installed relpath->sha256."""
+    lines = [f"{rel}:{files[rel]}" for rel in sorted(files)]
+    return hashlib.sha256("\n".join(lines).encode("utf-8")).hexdigest()
+
+
+def _verify_tree_against_manifest(
+    root: Path, entries: list[dict[str, Any]]
+) -> list[dict[str, str]]:
+    """Return mismatch details for files under ``root`` vs manifest entries."""
+    mismatches: list[dict[str, str]] = []
+    actual = collect_files(root)
+    declared = {entry["relpath"]: entry["sha256"] for entry in entries}
+    for rel, expected in sorted(declared.items()):
+        if rel not in actual:
+            mismatches.append({"relpath": rel, "expected": expected, "actual": "<missing>"})
+        elif actual[rel] != expected:
+            mismatches.append(
+                {"relpath": rel, "expected": expected, "actual": actual[rel]}
+            )
+    return mismatches
+
+
+def cmd_verify_installed(
+    installed_dir: Path, entries: list[dict[str, Any]], bundle_version: str
+) -> dict[str, Any]:
+    """Verify installed content against the bundle manifest, per file."""
+    installed_dir = installed_dir.resolve()
+    mismatches = _verify_tree_against_manifest(installed_dir, entries)
+    actual = collect_files(installed_dir)
+    declared = {entry["relpath"] for entry in entries}
+    content = {
+        rel: digest
+        for rel, digest in actual.items()
+        if rel not in _MANIFEST_EXCLUDED and rel in declared
+    }
+    return {
+        "ok": not mismatches,
+        "action": "verify-installed",
+        "bundleVersion": bundle_version,
+        "verificationStatus": "verified" if not mismatches else "degraded",
+        "installedContentHash": aggregate_installed_content_hash(content),
+        "verifiedAt": now_iso(),
+        "mismatchDetails": mismatches,
+    }
+
+
 def cmd_install(build_out: Path, project: Path, target: Path | None) -> dict[str, Any]:
     build_out = build_out.resolve()
     project = project.resolve()
@@ -644,6 +745,23 @@ def cmd_install(build_out: Path, project: Path, target: Path | None) -> dict[str
     backup: str | None = None
     staging = dest.parent / f".{dest.name}.staging-{uuid.uuid4().hex[:8]}"
     shutil.copytree(build_out, staging)
+    # Per-file content proof (retro §5.1): if the build carries a
+    # bundle-manifest.json, staging must match it exactly before anything is
+    # switched. A mismatch aborts the install without touching dest or any
+    # metadata — never a partial install under a fresh version label.
+    manifest_path = staging / BUNDLE_MANIFEST_NAME
+    if manifest_path.is_file():
+        manifest_data = json.loads(manifest_path.read_text(encoding="utf-8"))
+        manifest_entries = (
+            manifest_data.get("files", []) if isinstance(manifest_data, dict) else []
+        )
+        mismatches = _verify_tree_against_manifest(staging, manifest_entries)
+        if mismatches:
+            shutil.rmtree(staging, ignore_errors=True)
+            raise ValueError(
+                "BUNDLE_CONTENT_MISMATCH: staging diverges from bundle-manifest.json: "
+                + ", ".join(m["relpath"] for m in mismatches)
+            )
     if dest.exists() and any(dest.iterdir()):
         managed_old = _read_managed_set(dest / MANIFEST_NAME)
         # Preserve user-owned files: anything in dest that was NOT managed by a
@@ -771,6 +889,28 @@ def build_parser() -> argparse.ArgumentParser:
     v.add_argument("--bundle", type=Path, required=True)
     v.add_argument("--manifest", type=Path, required=True)
     v.add_argument("--json", action="store_true")
+
+    g = sub.add_parser(
+        "generate-manifest",
+        help="Generate per-file bundle-manifest.json for a bundle dir",
+    )
+    g.add_argument("--bundle", type=Path, required=True)
+    g.add_argument("--bundle-version", required=True)
+    g.add_argument(
+        "--transformation",
+        choices=["raw", "adapted", "workflow-packaged"],
+        default="raw",
+    )
+    g.add_argument("--out", type=Path)
+    g.add_argument("--json", action="store_true")
+
+    vi = sub.add_parser(
+        "verify-installed",
+        help="Verify installed tree content against bundle-manifest.json",
+    )
+    vi.add_argument("--installed", type=Path, required=True)
+    vi.add_argument("--manifest", type=Path, required=True)
+    vi.add_argument("--json", action="store_true")
     return p
 
 
@@ -794,6 +934,43 @@ def main(argv: list[str] | None = None) -> int:
             if args.json:
                 return emit_json(result)
             return 0 if result["ok"] else 1
+        if args.command == "generate-manifest":
+            entries = build_manifest(args.bundle, transformation_id=args.transformation)
+            manifest = {
+                "schemaVersion": 1,
+                "bundleVersion": args.bundle_version,
+                "bundleManifestHash": compute_bundle_manifest_hash(entries),
+                "files": entries,
+            }
+            text = json.dumps(manifest, ensure_ascii=False, indent=2) + "\n"
+            if args.out is not None:
+                args.out.parent.mkdir(parents=True, exist_ok=True)
+                args.out.write_text(text, encoding="utf-8", newline="\n")
+            result = {
+                "ok": True,
+                "action": "generate-manifest",
+                "bundleVersion": args.bundle_version,
+                "bundleManifestHash": manifest["bundleManifestHash"],
+                "fileCount": len(entries),
+                "out": str(args.out) if args.out is not None else None,
+            }
+            if args.json:
+                return emit_json(result)
+            if args.out is None:
+                print(text, end="")
+            return 0
+        if args.command == "verify-installed":
+            manifest_data = json.loads(args.manifest.read_text(encoding="utf-8"))
+            if not isinstance(manifest_data, dict):
+                raise ValueError("manifest must be a JSON object")
+            result = cmd_verify_installed(
+                args.installed,
+                manifest_data.get("files", []),
+                str(manifest_data.get("bundleVersion", "")),
+            )
+            if args.json:
+                return emit_json(result)
+            return 0 if result["ok"] else 1
     except (FileNotFoundError, KeyError, RuntimeError, ValueError) as exc:
         if getattr(args, "json", False):
             return emit_json({"ok": False, "error": str(exc)}, ok=False)