@hunter-harness/workflow-harness 0.2.14 → 0.2.15

package/harness/bundles/java/codebuddy/scripts/harness_change.py

@@ -590,7 +590,9 @@ def lease_port(
         }
         for port in range(start, end + 1):
             if port not in used:
+                lease_id = str(uuid.uuid4())
                 entry = {
+                    "leaseId": lease_id,
                     "changeId": change_id,
                     "runId": run_id,
                     "pid": os.getpid(),
@@ -603,7 +605,7 @@ def lease_port(
                 leases.append(entry)
                 registry["leases"] = leases
                 _write_json(registry_path, registry)
-                return {"ok": True, "code": "PORT_LEASED", "port": port, "lease": entry}
+                return {"ok": True, "code": "PORT_LEASED", "port": port, "leaseId": lease_id, "lease": entry}
     return {
         "ok": False,
         "code": "PORT_RANGE_EXHAUSTED",
@@ -616,7 +618,16 @@ def release_port(
     *,
     change_id: str,
     run_id: str,
+    port: int | None = None,
+    lease_id: str | None = None,
 ) -> dict[str, Any]:
+    """Release port leases by subset (retro §5.16).
+
+    - `--lease-id`: release only the matching leaseId.
+    - `--port`: release only the matching port (must match changeId+runId).
+    - Neither: release all leases matching (changeId, runId) — does NOT require
+      all leases under changeId to have the same runId.
+    """
     registry_path = project_root / PORTS_REL / "registry.json"
     if not registry_path.is_file():
         return {"ok": True, "code": "PORT_LEASE_ABSENT", "changeId": change_id}
@@ -628,27 +639,84 @@ def release_port(
         leases = registry.get("leases") if isinstance(registry, dict) else None
         if not isinstance(leases, list):
             return {"ok": False, "code": "PORT_REGISTRY_INVALID", "message": "leases is not a list"}
-        owned = [
-            item for item in leases
-            if isinstance(item, dict) and str(item.get("changeId")) == change_id
-        ]
-        if not owned:
+
+        # Select the subset to release based on lease_id, port, or (changeId, runId)
+        if lease_id is not None:
+            to_release = [
+                item for item in leases
+                if isinstance(item, dict) and str(item.get("leaseId")) == lease_id
+            ]
+            # Validate that the lease belongs to this change
+            for item in to_release:
+                if str(item.get("changeId")) != change_id:
+                    return {
+                        "ok": False,
+                        "code": "PORT_LEASE_OWNER_MISMATCH",
+                        "message": "leaseId does not belong to this change",
+                        "holder": item,
+                    }
+        elif port is not None:
+            to_release = [
+                item for item in leases
+                if isinstance(item, dict)
+                and item.get("port") == port
+                and str(item.get("changeId")) == change_id
+            ]
+            # Validate runId matches
+            for item in to_release:
+                if str(item.get("runId")) != run_id:
+                    return {
+                        "ok": False,
+                        "code": "PORT_LEASE_OWNER_MISMATCH",
+                        "message": f"port {port} owned by different runId",
+                        "holder": item,
+                        "conflictingOwners": [
+                            {"runId": str(i.get("runId")), "port": i.get("port")}
+                            for i in leases
+                            if isinstance(i, dict)
+                            and i.get("port") == port
+                            and str(i.get("changeId")) == change_id
+                        ],
+                    }
+        else:
+            # Release all matching (changeId, runId) — subset release
+            to_release = [
+                item for item in leases
+                if isinstance(item, dict)
+                and str(item.get("changeId")) == change_id
+                and str(item.get("runId")) == run_id
+            ]
+
+        if not to_release:
+            # Check if there are other leases under this changeId (different runId)
+            other_owned = [
+                item for item in leases
+                if isinstance(item, dict)
+                and str(item.get("changeId")) == change_id
+                and str(item.get("runId")) != run_id
+            ]
+            if other_owned:
+                return {
+                    "ok": False,
+                    "code": "PORT_LEASE_OWNER_MISMATCH",
+                    "message": "no matching leases for this runId; other runIds exist under this changeId",
+                    "conflictingOwners": [
+                        {"runId": str(i.get("runId")), "port": i.get("port"), "leaseId": i.get("leaseId")}
+                        for i in other_owned
+                    ],
+                }
             return {"ok": True, "code": "PORT_LEASE_ABSENT", "changeId": change_id}
-        if any(str(item.get("runId")) != run_id for item in owned):
-            return {
-                "ok": False,
-                "code": "PORT_LEASE_OWNER_MISMATCH",
-                "message": "run id does not match port lease owner",
-                "holder": owned[0],
-            }
-        released_ports = [item.get("port") for item in owned]
-        registry["leases"] = [item for item in leases if item not in owned]
+
+        released_ports = [item.get("port") for item in to_release]
+        released_ids = [item.get("leaseId") for item in to_release]
+        registry["leases"] = [item for item in leases if item not in to_release]
         _write_json(registry_path, registry)
         return {
             "ok": True,
             "code": "PORT_LEASE_RELEASED",
             "changeId": change_id,
             "ports": released_ports,
+            "leaseIds": released_ids,
         }
 
 
@@ -848,7 +916,13 @@ def cmd_lease_port(args: argparse.Namespace) -> int:
 
 def cmd_release_port(args: argparse.Namespace) -> int:
     project = resolve_main_project_root()
-    payload = release_port(project, change_id=args.change, run_id=args.run_id)
+    payload = release_port(
+        project,
+        change_id=args.change,
+        run_id=args.run_id,
+        port=getattr(args, "port", None),
+        lease_id=getattr(args, "lease_id", None),
+    )
     if payload.get("ok"):
         emit(payload, as_json=bool(args.json))
         return 0
@@ -881,6 +955,161 @@ def cmd_integration_lock(args: argparse.Namespace) -> int:
     )
 
 
+def _ensure_change_identity(change_dir: Path) -> dict[str, str]:
+    """Ensure meta/change-identity.json exists with a stable UUID (retro §5.5).
+
+    Returns the identity dict with changeUuid and changeName.
+    """
+    identity_path = change_dir / "meta" / "change-identity.json"
+    if identity_path.is_file():
+        try:
+            data = json.loads(identity_path.read_text(encoding="utf-8-sig"))
+            if isinstance(data, dict) and data.get("changeUuid"):
+                return data
+        except (OSError, json.JSONDecodeError):
+            pass
+    # Generate new identity
+    identity = {
+        "schemaVersion": 1,
+        "changeUuid": str(uuid.uuid4()),
+        "changeName": change_dir.name,
+        "createdAt": now_iso(),
+    }
+    identity_path.parent.mkdir(parents=True, exist_ok=True)
+    identity_path.write_text(
+        json.dumps(identity, ensure_ascii=False, indent=2) + "\n",
+        encoding="utf-8",
+        newline="\n",
+    )
+    return identity
+
+
+def cmd_rename(args: argparse.Namespace) -> int:
+    """Rename a change atomically: directory, pointers, worktree, identity (retro §5.5).
+
+    Appends a change.rename event; does not rewrite history.
+    """
+    project = resolve_main_project_root()
+    changes_root = project / ".harness" / "changes"
+    old_dir = changes_root / args.change
+    new_dir = changes_root / args.to
+
+    if not old_dir.is_dir():
+        return emit_error(
+            "CHANGE_NOT_FOUND",
+            f"change directory not found: {old_dir}",
+            as_json=bool(args.json),
+        )
+    if new_dir.exists():
+        return emit_error(
+            "CHANGE_ALREADY_EXISTS",
+            f"target change directory already exists: {new_dir}",
+            as_json=bool(args.json),
+        )
+
+    # Ensure identity exists before rename
+    identity = _ensure_change_identity(old_dir)
+    old_uuid = identity.get("changeUuid", "")
+
+    # Rename directory
+    import shutil
+    shutil.move(str(old_dir), str(new_dir))
+
+    # Update knowledge-context.json.changeId if present
+    kc_path = new_dir / "meta" / "knowledge-context.json"
+    if kc_path.is_file():
+        try:
+            kc = json.loads(kc_path.read_text(encoding="utf-8-sig"))
+            if isinstance(kc, dict):
+                kc["changeId"] = args.to
+                kc["changeUuid"] = old_uuid
+                kc_path.write_text(
+                    json.dumps(kc, ensure_ascii=False, indent=2) + "\n",
+                    encoding="utf-8",
+                    newline="\n",
+                )
+        except (OSError, json.JSONDecodeError):
+            pass
+
+    # Update worktree.json path/branch if present
+    wt_path = new_dir / "meta" / "worktree.json"
+    if wt_path.is_file():
+        try:
+            wt = json.loads(wt_path.read_text(encoding="utf-8-sig"))
+            if isinstance(wt, dict):
+                old_name = args.change
+                new_name = args.to
+                # Update path and branch if they contain old name
+                if isinstance(wt.get("path"), str) and old_name in wt["path"]:
+                    wt["path"] = wt["path"].replace(old_name, new_name)
+                if isinstance(wt.get("branch"), str) and old_name in wt["branch"]:
+                    wt["branch"] = wt["branch"].replace(old_name, new_name)
+                wt_path.write_text(
+                    json.dumps(wt, ensure_ascii=False, indent=2) + "\n",
+                    encoding="utf-8",
+                    newline="\n",
+                )
+        except (OSError, json.JSONDecodeError):
+            pass
+
+    # Update change-identity.json.changeName
+    identity_path = new_dir / "meta" / "change-identity.json"
+    if identity_path.is_file():
+        try:
+            ident = json.loads(identity_path.read_text(encoding="utf-8-sig"))
+            if isinstance(ident, dict):
+                ident["changeName"] = args.to
+                ident["renamedFrom"] = args.change
+                identity_path.write_text(
+                    json.dumps(ident, ensure_ascii=False, indent=2) + "\n",
+                    encoding="utf-8",
+                    newline="\n",
+                )
+        except (OSError, json.JSONDecodeError):
+            pass
+
+    # Append change.rename event (does not rewrite history)
+    try:
+        import harness_events
+        harness_events.append_event(
+            new_dir,
+            phase="plan",
+            type_="change.rename",
+            renamed_from=args.change,
+            renamed_to=args.to,
+            change_uuid=old_uuid,
+            note=f"change renamed from {args.change} to {args.to}",
+        )
+    except Exception:
+        pass  # event append failure should not block rename
+
+    payload = {
+        "ok": True,
+        "code": "RENAMED",
+        "changeUuid": old_uuid,
+        "renamedFrom": args.change,
+        "renamedTo": args.to,
+        "changeDir": str(new_dir),
+    }
+    emit(payload, as_json=bool(args.json))
+    return 0
+
+
+def cmd_ensure_identity(args: argparse.Namespace) -> int:
+    """Ensure meta/change-identity.json exists with a stable UUID (retro §5.5)."""
+    project = resolve_main_project_root()
+    change_dir = project / ".harness" / "changes" / args.change
+    if not change_dir.is_dir():
+        return emit_error(
+            "CHANGE_NOT_FOUND",
+            f"change directory not found: {change_dir}",
+            as_json=bool(args.json),
+        )
+    identity = _ensure_change_identity(change_dir)
+    emit(identity, as_json=bool(args.json))
+    return 0
+
+
 def build_parser() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(prog="harness_change.py")
     parser.add_argument("--json", action="store_true")
@@ -923,6 +1152,8 @@ def build_parser() -> argparse.ArgumentParser:
     p_port_release = sub.add_parser("release-port", parents=[shared])
     p_port_release.add_argument("--change", required=True)
     p_port_release.add_argument("--run-id", required=True)
+    p_port_release.add_argument("--port", type=int, default=None)
+    p_port_release.add_argument("--lease-id", default=None)
     p_port_release.set_defaults(func=cmd_release_port)
 
     p_lock = sub.add_parser("integration-lock", parents=[shared])
@@ -931,6 +1162,15 @@ def build_parser() -> argparse.ArgumentParser:
     p_lock.add_argument("--ttl-seconds", type=int, default=3600)
     p_lock.set_defaults(func=cmd_integration_lock)
 
+    p_rename = sub.add_parser("rename", parents=[shared])
+    p_rename.add_argument("--change", required=True)
+    p_rename.add_argument("--to", required=True)
+    p_rename.set_defaults(func=cmd_rename)
+
+    p_identity = sub.add_parser("ensure-identity", parents=[shared])
+    p_identity.add_argument("--change", required=True)
+    p_identity.set_defaults(func=cmd_ensure_identity)
+
     return parser
 
 

package/harness/bundles/java/codebuddy/scripts/harness_events.py

@@ -50,6 +50,7 @@ EVENT_TYPES = frozenset(
         "issue.resolve",
         "decision",
         "correction",
+        "change.rename",
     }
 )
 
@@ -94,6 +95,9 @@ OPTIONAL_FIELDS = (
     "orchestration_active_ms",
     "wall_clock_ms",
     "user_wait_ms",
+    "renamed_from",
+    "renamed_to",
+    "change_uuid",
 )
 
 _PROVENANCE_FIELDS = frozenset(
@@ -144,6 +148,10 @@ _EVENT_ALLOWED_FIELDS = {
         }
     )
     | _PROVENANCE_FIELDS,
+    "change.rename": frozenset(
+        {"renamed_from", "renamed_to", "change_uuid", "note"}
+    )
+    | _PROVENANCE_FIELDS,
 }
 _EVENT_REQUIRED_FIELDS = {
     "issue": ("severity",),
@@ -516,6 +524,9 @@ def append_event(
     path: str | None = None,
     run_id: str | None = None,
     executor_tool: str | None = None,
+    renamed_from: str | None = None,
+    renamed_to: str | None = None,
+    change_uuid: str | None = None,
 ) -> dict[str, Any]:
     """Programmatic append API (retro §5.31 C5/T16).
 
@@ -547,6 +558,9 @@ def append_event(
         target_field=None,
         old_value_hash=None,
         new_value_json=None,
+        renamed_from=renamed_from,
+        renamed_to=renamed_to,
+        change_uuid=change_uuid,
         attempt=None,
         executor_agent=None,
         executor_model=None,

package/harness/bundles/java/codebuddy/scripts/harness_integration.py

@@ -84,6 +84,12 @@ class TargetMovedError(IntegrationError):
     code = "TARGET_MOVED"
 
 
+class RemoteProbeFailedError(IntegrationError):
+    """Remote probe failed (network/auth/process error), not target moved (retro §5.28)."""
+
+    code = "REMOTE_PROBE_FAILED"
+
+
 class LedgerSyncError(IntegrationError):
     code = "LEDGER_SYNC_PENDING"
 
@@ -139,6 +145,52 @@ class GitRunner:
             return None
         return proc.stdout.strip()
 
+    def remote_probe(self, cwd: Path, *args: str) -> dict[str, Any]:
+        """Typed remote probe result (retro §5.28).
+
+        Returns:
+            {
+                "exitCode": int,
+                "stdoutHash": str | None,   # first whitespace-delimited token
+                "redactedStderr": str,       # stderr with credentials redacted
+                "category": "ok" | "target-moved" | "probe-failed" | "auth-failed",
+            }
+
+        `category` distinguishes:
+        - `ok`: exit=0, hash available
+        - `target-moved`: only meaningful when caller compares hash to expected
+        - `probe-failed`: exit!=0, network/process error (allow bounded retry)
+        - `auth-failed`: exit!=0, stderr contains auth/credential indicators
+
+        `None` must never enter the "found head" field; callers must branch on
+        `exitCode` before comparing hashes.
+        """
+        proc = self.run(cwd, *args, check=False)
+        stderr = (proc.stderr or "").strip()
+        # Redact potential credentials in stderr (URLs with user:pass@, tokens)
+        redacted = re.sub(
+            r"(https?|ssh)://[^\s]+@[^\s]+", r"\1://***@***", stderr
+        )
+        redacted = re.sub(r"(token|password|secret|key)\s*[:=]\s*\S+", r"\1=***", redacted, flags=re.I)
+        stdout_hash: str | None = None
+        if proc.returncode == 0:
+            stdout = (proc.stdout or "").strip()
+            if stdout:
+                stdout_hash = stdout.split()[0]
+        # Classify category
+        if proc.returncode == 0:
+            category = "ok"
+        elif re.search(r"auth|credential|permission|forbidden|unauthorized", stderr, re.I):
+            category = "auth-failed"
+        else:
+            category = "probe-failed"
+        return {
+            "exitCode": proc.returncode,
+            "stdoutHash": stdout_hash,
+            "redactedStderr": redacted,
+            "category": category,
+        }
+
 
 def _sanitize(value: str) -> str:
     return re.sub(r"[^A-Za-z0-9._-]+", "-", value).strip("-") or "txn"
@@ -763,16 +815,21 @@ class IntegrationTransaction:
                     f"{expected_local}, found {current_target}"
                 )
             if journal.get("remoteTargetHead"):
-                remote_line = self.runner.text(
+                # Use typed remote probe (retro §5.28): distinguish probe failure
+                # (network/auth/process) from genuine target movement. `None`
+                # must never enter the "found head" field.
+                probe = self.runner.remote_probe(
                     self.project_root, "ls-remote", "origin", self.target_branch
                 )
-                current_remote = (
-                    remote_line.split()[0]
-                    if remote_line and remote_line.split()
-                    else None
-                )
                 expected_remote = journal.get("remoteTargetHead")
-                if current_remote != expected_remote:
+                if probe["exitCode"] != 0:
+                    # Probe failed: network/auth/process error, not target moved.
+                    raise RemoteProbeFailedError(
+                        f"remote probe failed (exit={probe['exitCode']}, "
+                        f"category={probe['category']}): {probe['redactedStderr']}"
+                    )
+                current_remote = probe["stdoutHash"]
+                if current_remote is not None and current_remote != expected_remote:
                     raise TargetMovedError(
                         f"remote {self.target_branch} moved: expected "
                         f"{expected_remote}, found {current_remote}"

package/harness/bundles/java/codebuddy/scripts/harness_plan_finalize.py

@@ -177,6 +177,82 @@ def _terminal_exists(change_dir: Path, run_id: str, attempt: int) -> bool:
     )
 
 
+def _read_design_capabilities(staging: Path, change_name: str) -> list[str]:
+    """Read capabilities from design frontmatter (retro §5.4)."""
+    design_path = staging / "spec" / f"{change_name}-design.md"
+    if not design_path.is_file():
+        return []
+    try:
+        text = design_path.read_text(encoding="utf-8-sig")
+    except OSError:
+        return []
+    frontmatter = _frontmatter(text)
+    if not frontmatter:
+        return []
+    raw = frontmatter.get("capabilities") or ""
+    if not raw:
+        return []
+    # capabilities may be comma-separated or YAML list
+    if raw.startswith("["):
+        try:
+            parsed = json.loads(raw)
+            if isinstance(parsed, list):
+                return [str(c) for c in parsed if isinstance(c, str)]
+        except json.JSONDecodeError:
+            pass
+    return [c.strip() for c in raw.split(",") if c.strip()]
+
+
+def _reclassify_gate_policy(
+    staging: Path,
+    change_name: str,
+) -> dict[str, Any]:
+    """Reclassify gate policy based on approved design capabilities (retro §5.4).
+
+    Reads design frontmatter `capabilities`, invokes harness_gate.py classify
+    to recompute the gate DAG, and updates staging/meta/gate-policy.json.
+    Returns {"ok": bool, "capabilities": [...], "drift": bool}.
+    """
+    capabilities = _read_design_capabilities(staging, change_name)
+    if not capabilities:
+        return {"ok": True, "capabilities": [], "drift": False, "updated": False}
+
+    gate_policy_path = staging / "meta" / "gate-policy.json"
+    try:
+        existing = json.loads(gate_policy_path.read_text(encoding="utf-8-sig"))
+    except (OSError, json.JSONDecodeError):
+        existing = {}
+
+    existing_caps = set(existing.get("capabilities") or [])
+    design_caps = set(capabilities)
+    drift = existing_caps != design_caps
+
+    if drift:
+        # Update gate-policy.json with design capabilities
+        existing["capabilities"] = sorted(design_caps)
+        try:
+            gate_policy_path.write_text(
+                json.dumps(existing, ensure_ascii=False, indent=2) + "\n",
+                encoding="utf-8",
+                newline="\n",
+            )
+        except OSError as exc:
+            return {
+                "ok": False,
+                "error": f"failed to update gate-policy.json: {exc}",
+                "capabilities": capabilities,
+                "drift": True,
+                "updated": False,
+            }
+
+    return {
+        "ok": True,
+        "capabilities": sorted(design_caps),
+        "drift": drift,
+        "updated": drift,
+    }
+
+
 def _append_terminal(change_dir: Path, run_id: str, attempt: int) -> tuple[int, str]:
     stdout = io.StringIO()
     stderr = io.StringIO()
@@ -214,6 +290,15 @@ def finalize_plan(
 ) -> dict[str, Any]:
     change_dir = change_dir.resolve()
     staging = staging.resolve()
+
+    # C2 (retro §5.4): reclassify gate policy based on approved design capabilities.
+    # This updates staging/meta/gate-policy.json before validation, so the hash
+    # reflects the final gate policy. Drift between design capabilities and
+    # gate-policy capabilities is resolved in favor of the approved design.
+    reclassify = _reclassify_gate_policy(staging, change_name)
+    if not reclassify.get("ok"):
+        return _result_error("CAPABILITY_GATE_DRIFT", reclassify.get("error", "reclassify failed"))
+
     validation = validate_staging(staging, change_name)
     if not validation["ok"]:
         return validation