@hunter-harness/workflow-harness 0.2.14 → 0.2.16

package/harness/bundles/general/claude-code/scripts/harness_gate.py

@@ -1201,6 +1201,70 @@ def _phase_event_exists(change_dir: Path, phase: str, type_: str, run_id: str) -
     )
 
 
+def _validate_scenario_coverage(change_dir: Path) -> dict[str, Any]:
+    """C9: validate all P0 scenarios have a ledger entry with scenarioIds covering them.
+
+    Reads meta/scenario-manifest.json and evidence/verification-ledger.json.
+    Returns ok=True when manifest missing (backward compat) or all P0 scenarios covered.
+    """
+    manifest_path = change_dir / "meta" / "scenario-manifest.json"
+    if not manifest_path.is_file():
+        return {"ok": True, "code": "MANIFEST_MISSING", "skipped": True}
+    try:
+        manifest = json.loads(manifest_path.read_text(encoding="utf-8-sig"))
+    except (OSError, json.JSONDecodeError) as exc:
+        return {
+            "ok": False,
+            "code": "SCENARIO_MANIFEST_INVALID",
+            "message": f"scenario-manifest.json unreadable: {exc}",
+        }
+    scenarios = manifest.get("scenarios") or []
+    p0_ids = {
+        str(s.get("id"))
+        for s in scenarios
+        if isinstance(s, dict)
+        and str(s.get("priority", "")).upper() == "P0"
+        and s.get("requiredEvidenceKind") == "ledger"
+    }
+    if not p0_ids:
+        return {"ok": True, "code": "NO_P0_SCENARIOS"}
+
+    ledger_path = change_dir / "evidence" / "verification-ledger.json"
+    if not ledger_path.is_file():
+        return {
+            "ok": False,
+            "code": "SCENARIO_COVERAGE_FAILED",
+            "message": "ledger missing; cannot verify P0 scenario coverage",
+            "missing": sorted(p0_ids),
+        }
+    try:
+        ledger = json.loads(ledger_path.read_text(encoding="utf-8-sig"))
+    except (OSError, json.JSONDecodeError) as exc:
+        return {
+            "ok": False,
+            "code": "SCENARIO_COVERAGE_FAILED",
+            "message": f"ledger unreadable: {exc}",
+            "missing": sorted(p0_ids),
+        }
+    covered: set[str] = set()
+    validations = ledger.get("validations") or {}
+    if isinstance(validations, dict):
+        for entry in validations.values():
+            if isinstance(entry, dict):
+                ids = entry.get("scenarioIds")
+                if isinstance(ids, list):
+                    covered.update(str(i) for i in ids)
+    missing = sorted(p0_ids - covered)
+    if missing:
+        return {
+            "ok": False,
+            "code": "SCENARIO_COVERAGE_FAILED",
+            "message": f"P0 scenarios without ledger entry: {', '.join(missing)}",
+            "missing": missing,
+        }
+    return {"ok": True, "code": "SCENARIO_COVERAGE_OK", "covered": sorted(covered & p0_ids)}
+
+
 def cmd_begin(args: argparse.Namespace) -> int:
     as_json = bool(args.json)
     project = hc.resolve_main_project_root()
@@ -1470,6 +1534,17 @@ def cmd_close(args: argparse.Namespace) -> int:
             extra={k: v for k, v in ledger_result.items() if k not in {"ok", "message", "code"}},
         )
 
+    # C9: scenario coverage check — all P0 scenarios must have a ledger entry.
+    if args.phase in {"run", "test"}:
+        coverage = _validate_scenario_coverage(change_dir)
+        if not coverage.get("ok"):
+            return emit_error(
+                str(coverage.get("code", "SCENARIO_COVERAGE_FAILED")),
+                str(coverage.get("message", "scenario coverage validation failed")),
+                as_json=as_json,
+                extra={k: v for k, v in coverage.items() if k not in {"ok", "message", "code"}},
+            )
+
     close_status = args.status
     close_code = "PHASE_CLOSED"
     if ledger_result.get("code") == "LEDGER_OK_DEGRADED":

package/harness/bundles/general/claude-code/scripts/harness_integration.py

@@ -84,6 +84,12 @@ class TargetMovedError(IntegrationError):
     code = "TARGET_MOVED"
 
 
+class RemoteProbeFailedError(IntegrationError):
+    """Remote probe failed (network/auth/process error), not target moved (retro §5.28)."""
+
+    code = "REMOTE_PROBE_FAILED"
+
+
 class LedgerSyncError(IntegrationError):
     code = "LEDGER_SYNC_PENDING"
 
@@ -139,6 +145,52 @@ class GitRunner:
             return None
         return proc.stdout.strip()
 
+    def remote_probe(self, cwd: Path, *args: str) -> dict[str, Any]:
+        """Typed remote probe result (retro §5.28).
+
+        Returns:
+            {
+                "exitCode": int,
+                "stdoutHash": str | None,   # first whitespace-delimited token
+                "redactedStderr": str,       # stderr with credentials redacted
+                "category": "ok" | "target-moved" | "probe-failed" | "auth-failed",
+            }
+
+        `category` distinguishes:
+        - `ok`: exit=0, hash available
+        - `target-moved`: only meaningful when caller compares hash to expected
+        - `probe-failed`: exit!=0, network/process error (allow bounded retry)
+        - `auth-failed`: exit!=0, stderr contains auth/credential indicators
+
+        `None` must never enter the "found head" field; callers must branch on
+        `exitCode` before comparing hashes.
+        """
+        proc = self.run(cwd, *args, check=False)
+        stderr = (proc.stderr or "").strip()
+        # Redact potential credentials in stderr (URLs with user:pass@, tokens)
+        redacted = re.sub(
+            r"(https?|ssh)://[^\s]+@[^\s]+", r"\1://***@***", stderr
+        )
+        redacted = re.sub(r"(token|password|secret|key)\s*[:=]\s*\S+", r"\1=***", redacted, flags=re.I)
+        stdout_hash: str | None = None
+        if proc.returncode == 0:
+            stdout = (proc.stdout or "").strip()
+            if stdout:
+                stdout_hash = stdout.split()[0]
+        # Classify category
+        if proc.returncode == 0:
+            category = "ok"
+        elif re.search(r"auth|credential|permission|forbidden|unauthorized", stderr, re.I):
+            category = "auth-failed"
+        else:
+            category = "probe-failed"
+        return {
+            "exitCode": proc.returncode,
+            "stdoutHash": stdout_hash,
+            "redactedStderr": redacted,
+            "category": category,
+        }
+
 
 def _sanitize(value: str) -> str:
     return re.sub(r"[^A-Za-z0-9._-]+", "-", value).strip("-") or "txn"
@@ -763,16 +815,21 @@ class IntegrationTransaction:
                     f"{expected_local}, found {current_target}"
                 )
             if journal.get("remoteTargetHead"):
-                remote_line = self.runner.text(
+                # Use typed remote probe (retro §5.28): distinguish probe failure
+                # (network/auth/process) from genuine target movement. `None`
+                # must never enter the "found head" field.
+                probe = self.runner.remote_probe(
                     self.project_root, "ls-remote", "origin", self.target_branch
                 )
-                current_remote = (
-                    remote_line.split()[0]
-                    if remote_line and remote_line.split()
-                    else None
-                )
                 expected_remote = journal.get("remoteTargetHead")
-                if current_remote != expected_remote:
+                if probe["exitCode"] != 0:
+                    # Probe failed: network/auth/process error, not target moved.
+                    raise RemoteProbeFailedError(
+                        f"remote probe failed (exit={probe['exitCode']}, "
+                        f"category={probe['category']}): {probe['redactedStderr']}"
+                    )
+                current_remote = probe["stdoutHash"]
+                if current_remote is not None and current_remote != expected_remote:
                     raise TargetMovedError(
                         f"remote {self.target_branch} moved: expected "
                         f"{expected_remote}, found {current_remote}"
@@ -1209,6 +1266,31 @@ def cmd_status(args: argparse.Namespace) -> int:
     return _emit(_txn_from_args(args).status())
 
 
+def cmd_journal(args: argparse.Namespace) -> int:
+    """C5: journal 子命令 — 默认 compact (transactionId/currentStep/status)，--verbose 全量。"""
+    txn = _txn_from_args(args)
+    full = txn.status()
+    if getattr(args, "verbose", False):
+        return _emit(full)
+    # Derive currentStep: first non-DONE step, or last step name if all DONE.
+    current_step = None
+    for step in full.get("steps", []):
+        if step.get("status") != "DONE":
+            current_step = step.get("name")
+            break
+    if current_step is None and full.get("steps"):
+        current_step = full["steps"][-1].get("name")
+    overall_status = "DONE" if all(
+        step.get("status") == "DONE" for step in full.get("steps", [])
+    ) else "IN_PROGRESS"
+    compact = {
+        "transactionId": full.get("transactionId"),
+        "currentStep": current_step,
+        "status": overall_status,
+    }
+    return _emit(compact)
+
+
 def build_parser() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(prog="harness_integration.py")
     sub = parser.add_subparsers(dest="command_name", required=True)
@@ -1230,6 +1312,19 @@ def build_parser() -> argparse.ArgumentParser:
     add("recover", cmd_recover)
     add("status", cmd_status)
 
+    p_journal = sub.add_parser("journal")
+    p_journal.add_argument("--change", required=True)
+    p_journal.add_argument("--run-id", required=True)
+    p_journal.add_argument("--target-branch", default="main")
+    p_journal.add_argument("--feature-branch", required=True)
+    p_journal.add_argument("--temp-root", required=True)
+    p_journal.add_argument(
+        "--verbose",
+        action="store_true",
+        help="emit full journal payload (default: compact transactionId/currentStep/status)",
+    )
+    p_journal.set_defaults(func=cmd_journal)
+
     p_verify = sub.add_parser("verify")
     p_verify.add_argument("--change", required=True)
     p_verify.add_argument("--run-id", required=True)

package/harness/bundles/general/claude-code/scripts/harness_ledger.py

@@ -100,6 +100,37 @@ def emit_json(payload: dict[str, Any], *, as_json: bool) -> None:
             sys.stdout.write(("ok" if ok else "error") + "\n")
 
 
+def _compact_record_payload(payload: dict[str, Any]) -> dict[str, Any]:
+    """C5: record compact — ok/action/verification/status only."""
+    return {
+        "ok": payload.get("ok", True),
+        "action": payload.get("action"),
+        "verification": payload.get("verification"),
+        "status": payload.get("status"),
+    }
+
+
+def _compact_can_reuse_payload(payload: dict[str, Any]) -> dict[str, Any]:
+    """C5: can-reuse compact — ok/reuse/code only."""
+    return {
+        "ok": payload.get("ok", True),
+        "reuse": payload.get("reuse"),
+        "code": payload.get("code"),
+    }
+
+
+def emit_compact_or_verbose(
+    payload: dict[str, Any],
+    *,
+    as_json: bool,
+    verbose: bool,
+    compact_fn,
+) -> None:
+    """Emit compact payload by default; full payload when --verbose."""
+    out = payload if verbose else compact_fn(payload)
+    emit_json(out, as_json=as_json)
+
+
 def emit_error(message: str, *, as_json: bool, code: int = 1) -> int:
     payload = {"ok": False, "error": message}
     if as_json:
@@ -1227,6 +1258,7 @@ def cmd_hash(args: argparse.Namespace) -> int:
 
 def cmd_can_reuse(args: argparse.Namespace) -> int:
     as_json = bool(args.json)
+    verbose = bool(getattr(args, "verbose", False))
     verification = args.verification
     if verification not in VERIFICATIONS:
         return emit_error(
@@ -1253,7 +1285,10 @@ def cmd_can_reuse(args: argparse.Namespace) -> int:
                 "verification": verification,
                 "detail": err,
             }
-            emit_json(payload, as_json=as_json)
+            emit_compact_or_verbose(
+                payload, as_json=as_json, verbose=verbose,
+                compact_fn=_compact_can_reuse_payload,
+            )
             return 0
         files = resolve_input_files(resolved_files, project_root)
     if not files:
@@ -1275,12 +1310,16 @@ def cmd_can_reuse(args: argparse.Namespace) -> int:
     except (OSError, ValueError, json.JSONDecodeError) as exc:
         return emit_error(f"can-reuse failed: {exc}", as_json=as_json)
 
-    emit_json(payload, as_json=as_json)
+    emit_compact_or_verbose(
+        payload, as_json=as_json, verbose=verbose,
+        compact_fn=_compact_can_reuse_payload,
+    )
     return 0
 
 
 def cmd_record(args: argparse.Namespace) -> int:
     as_json = bool(args.json)
+    verbose = bool(getattr(args, "verbose", False))
     change_dir = resolve_path(args.change_dir)
     verification = args.verification
     if verification not in VERIFICATIONS:
@@ -1421,6 +1460,16 @@ def cmd_record(args: argparse.Namespace) -> int:
             if _nonempty_str(getattr(args, "tests_reused_from", None)):
                 entry["testsReusedFrom"] = str(args.tests_reused_from).strip()
 
+        # C9: bind scenario IDs from --scenario-ids to this ledger entry.
+        scenario_ids_raw = getattr(args, "scenario_ids", None)
+        if _nonempty_str(scenario_ids_raw):
+            ids = [s.strip() for s in str(scenario_ids_raw).split(",") if s.strip()]
+            if ids:
+                entry["scenarioIds"] = ids
+        elif "scenarioIds" in entry:
+            # Fresh record without scenario-ids must not keep stale ids from prev.
+            entry.pop("scenarioIds", None)
+
         ledger["validations"][verification] = entry
         if "changeName" not in ledger:
             ledger["changeName"] = change_dir.name
@@ -1487,7 +1536,10 @@ def cmd_record(args: argparse.Namespace) -> int:
         "diffHash": ledger.get("diffHash"),
         "resolvedProjectRoot": str(project_root) if project_root else None,
     }
-    emit_json(payload, as_json=as_json)
+    emit_compact_or_verbose(
+        payload, as_json=as_json, verbose=verbose,
+        compact_fn=_compact_record_payload,
+    )
     return 0
 
 
@@ -1589,6 +1641,11 @@ def build_parser() -> argparse.ArgumentParser:
         default=None,
         help="optional environment hash to compare against ledger entry (UT-017)",
     )
+    p_reuse.add_argument(
+        "--verbose",
+        action="store_true",
+        help="emit full payload (default: compact ok/reuse/code)",
+    )
     p_reuse.set_defaults(func=cmd_can_reuse)
 
     p_record = sub.add_parser("record", parents=[shared_json], help="write validation result into ledger")
@@ -1669,6 +1726,16 @@ def build_parser() -> argparse.ArgumentParser:
         default=None,
         help="ledger v3: scope reason (required when --applicability NOT_APPLICABLE)",
     )
+    p_record.add_argument(
+        "--scenario-ids",
+        default=None,
+        help="comma-separated scenario IDs from scenario-manifest.json to bind to this entry",
+    )
+    p_record.add_argument(
+        "--verbose",
+        action="store_true",
+        help="emit full payload (default: compact ok/action/verification/status)",
+    )
     p_record.set_defaults(func=cmd_record)
 
     p_diff = sub.add_parser(

package/harness/bundles/general/claude-code/scripts/harness_paths.py

@@ -83,6 +83,23 @@ def _git_common_dir(cwd: Path) -> Path | None:
     return common
 
 
+def common_root(project_root: Path) -> Path:
+    """Resolve the shared "common" root for a project.
+
+    For a linked worktree, ``git rev-parse --git-common-dir`` points at the
+    main repository's ``.git`` directory; its parent is the main project root.
+    For the main worktree, the common dir is ``<root>/.git`` so the parent is
+    the project root itself. Falls back to the resolved input when not in a
+    git repo (e.g. exploratory scratch dirs).
+    """
+    cwd = Path(project_root).resolve()
+    common = _git_common_dir(cwd)
+    if common is None:
+        return cwd
+    # common dir is <root>/.git — its parent is the main project root.
+    return common.parent.resolve()
+
+
 def _root_commit(cwd: Path) -> str | None:
     raw = _git_text(cwd, "rev-list", "--max-parents=0", "HEAD")
     if not raw:

package/harness/bundles/general/claude-code/scripts/harness_plan_finalize.py

@@ -30,11 +30,117 @@ if hasattr(sys.stderr, "reconfigure"):
 SCHEMA_VERSION = 1
 _LINK = re.compile(r"\[[^\]]+\]\(([^)]+)\)")
 
+# C8: valid ownerPhase values (lifecycle phases that can own tasks).
+VALID_OWNER_PHASES = {"plan", "run", "test", "review", "submit"}
+
+# C9: map scenario priority to required evidence kind.
+PRIORITY_EVIDENCE_KIND = {
+    "P0": "ledger",
+    "P1": "ledger",
+    "P2": "advisory",
+}
+
 
 def _result_error(code: str, message: str) -> dict[str, Any]:
     return {"ok": False, "code": code, "error": message}
 
 
+def parse_test_scenarios(scenarios_path: Path) -> list[dict[str, str]]:
+    """C9: parse test-scenarios.md tables, extracting scenario rows.
+
+    Returns a list of dicts with keys: id / priority / scenario / verification /
+    ownerPhase / requiredEvidenceKind (last one derived from priority).
+    """
+    text = Path(scenarios_path).read_text(encoding="utf-8-sig")
+    lines = text.splitlines()
+    scenarios: list[dict[str, str]] = []
+    # Find all tables whose header includes "ID" and "优先级" (or "priority").
+    i = 0
+    while i < len(lines):
+        line = lines[i].strip()
+        if line.startswith("|") and "ID" in line and ("优先级" in line or "priority" in line):
+            header_line = line
+            headers = [h.strip() for h in header_line.strip("|").split("|")]
+            col_map: dict[str, int] = {}
+            for idx, name in enumerate(headers):
+                key = name.lower()
+                col_map[key] = idx
+            # Skip separator row
+            i += 2
+            while i < len(lines):
+                row = lines[i].strip()
+                if not row.startswith("|"):
+                    break
+                cells = [c.strip() for c in row.strip("|").split("|")]
+                if len(cells) < len(headers):
+                    i += 1
+                    continue
+                scenario: dict[str, str] = {}
+                for cn, en in (
+                    ("ID", "id"),
+                    ("优先级", "priority"),
+                    ("场景", "scenario"),
+                    ("验证方式", "verification"),
+                    ("owner phase", "ownerPhase"),
+                ):
+                    if cn.lower() in col_map:
+                        scenario[en] = cells[col_map[cn.lower()]]
+                # Derive requiredEvidenceKind from priority
+                priority = scenario.get("priority", "")
+                scenario["requiredEvidenceKind"] = PRIORITY_EVIDENCE_KIND.get(priority, "advisory")
+                scenarios.append(scenario)
+                i += 1
+            continue
+        i += 1
+    return scenarios
+
+
+def parse_plan_tasks(plan_path: Path) -> list[dict[str, str]]:
+    """C8: parse plan.md task table rows, extracting optional ownerPhase/implementationDoneWhen/verificationPhase columns.
+
+    Returns a list of dicts with keys: # / 簇 / 任务 / ownerPhase / implementationDoneWhen /
+    verificationPhase / requiresExplicitAuthority (last four optional, only present when
+    the column header includes them).
+    """
+    text = Path(plan_path).read_text(encoding="utf-8-sig")
+    lines = text.splitlines()
+    # Find the task table: a header row starting with "| #" followed by a separator row.
+    header_idx = -1
+    for i, line in enumerate(lines):
+        stripped = line.strip()
+        if stripped.startswith("|") and "#" in stripped and "任务" in stripped:
+            header_idx = i
+            break
+    if header_idx < 0:
+        return []
+    header_line = lines[header_idx]
+    headers = [h.strip() for h in header_line.strip().strip("|").split("|")]
+    # Map header names to column indices (case-insensitive, English keys).
+    col_map: dict[str, int] = {}
+    for idx, name in enumerate(headers):
+        key = name.lower()
+        col_map[key] = idx
+    tasks: list[dict[str, str]] = []
+    for line in lines[header_idx + 2 :]:  # skip header + separator
+        stripped = line.strip()
+        if not stripped.startswith("|"):
+            break  # end of table
+        cells = [c.strip() for c in stripped.strip("|").split("|")]
+        if len(cells) < len(headers):
+            continue
+        task: dict[str, str] = {}
+        # Chinese headers
+        for cn, en in (("#", "num"), ("簇", "cluster"), ("任务", "task")):
+            if cn in col_map:
+                task[en] = cells[col_map[cn]]
+        # English optional columns
+        for en in ("ownerPhase", "implementationDoneWhen", "verificationPhase", "requiresExplicitAuthority"):
+            if en.lower() in col_map:
+                task[en] = cells[col_map[en.lower()]]
+        tasks.append(task)
+    return tasks
+
+
 def _atomic_write_json(path: Path, payload: dict[str, Any]) -> None:
     path.parent.mkdir(parents=True, exist_ok=True)
     fd, raw_tmp = tempfile.mkstemp(
@@ -146,6 +252,21 @@ def validate_staging(staging: Path, change_name: str) -> dict[str, Any]:
                         f"{rel.as_posix()}: missing reference {raw_link}",
                     )
 
+    # C8: validate ownerPhase values in plan.md task table.
+    plan_path = staging / "plans" / f"{change_name}-plan.md"
+    tasks = parse_plan_tasks(plan_path)
+    for task in tasks:
+        owner = task.get("ownerPhase")
+        if owner is not None and owner != "" and owner not in VALID_OWNER_PHASES:
+            return _result_error(
+                "PLAN_OWNER_PHASE_INVALID",
+                f"task {task.get('num', '?')}: ownerPhase '{owner}' not in {sorted(VALID_OWNER_PHASES)}",
+            )
+
+    # C9: parse test-scenarios.md for scenario manifest.
+    scenarios_path = staging / "plans" / f"{change_name}-test-scenarios.md"
+    scenarios = parse_test_scenarios(scenarios_path)
+
     digest = hashlib.sha256()
     artifact_names: list[str] = []
     for path in files:
@@ -159,6 +280,8 @@ def validate_staging(staging: Path, change_name: str) -> dict[str, Any]:
         "ok": True,
         "files": artifact_names,
         "artifactsHash": "sha256:" + digest.hexdigest(),
+        "tasks": tasks,
+        "scenarios": scenarios,
     }
 
 
@@ -177,6 +300,82 @@ def _terminal_exists(change_dir: Path, run_id: str, attempt: int) -> bool:
     )
 
 
+def _read_design_capabilities(staging: Path, change_name: str) -> list[str]:
+    """Read capabilities from design frontmatter (retro §5.4)."""
+    design_path = staging / "spec" / f"{change_name}-design.md"
+    if not design_path.is_file():
+        return []
+    try:
+        text = design_path.read_text(encoding="utf-8-sig")
+    except OSError:
+        return []
+    frontmatter = _frontmatter(text)
+    if not frontmatter:
+        return []
+    raw = frontmatter.get("capabilities") or ""
+    if not raw:
+        return []
+    # capabilities may be comma-separated or YAML list
+    if raw.startswith("["):
+        try:
+            parsed = json.loads(raw)
+            if isinstance(parsed, list):
+                return [str(c) for c in parsed if isinstance(c, str)]
+        except json.JSONDecodeError:
+            pass
+    return [c.strip() for c in raw.split(",") if c.strip()]
+
+
+def _reclassify_gate_policy(
+    staging: Path,
+    change_name: str,
+) -> dict[str, Any]:
+    """Reclassify gate policy based on approved design capabilities (retro §5.4).
+
+    Reads design frontmatter `capabilities`, invokes harness_gate.py classify
+    to recompute the gate DAG, and updates staging/meta/gate-policy.json.
+    Returns {"ok": bool, "capabilities": [...], "drift": bool}.
+    """
+    capabilities = _read_design_capabilities(staging, change_name)
+    if not capabilities:
+        return {"ok": True, "capabilities": [], "drift": False, "updated": False}
+
+    gate_policy_path = staging / "meta" / "gate-policy.json"
+    try:
+        existing = json.loads(gate_policy_path.read_text(encoding="utf-8-sig"))
+    except (OSError, json.JSONDecodeError):
+        existing = {}
+
+    existing_caps = set(existing.get("capabilities") or [])
+    design_caps = set(capabilities)
+    drift = existing_caps != design_caps
+
+    if drift:
+        # Update gate-policy.json with design capabilities
+        existing["capabilities"] = sorted(design_caps)
+        try:
+            gate_policy_path.write_text(
+                json.dumps(existing, ensure_ascii=False, indent=2) + "\n",
+                encoding="utf-8",
+                newline="\n",
+            )
+        except OSError as exc:
+            return {
+                "ok": False,
+                "error": f"failed to update gate-policy.json: {exc}",
+                "capabilities": capabilities,
+                "drift": True,
+                "updated": False,
+            }
+
+    return {
+        "ok": True,
+        "capabilities": sorted(design_caps),
+        "drift": drift,
+        "updated": drift,
+    }
+
+
 def _append_terminal(change_dir: Path, run_id: str, attempt: int) -> tuple[int, str]:
     stdout = io.StringIO()
     stderr = io.StringIO()
@@ -214,6 +413,15 @@ def finalize_plan(
 ) -> dict[str, Any]:
     change_dir = change_dir.resolve()
     staging = staging.resolve()
+
+    # C2 (retro §5.4): reclassify gate policy based on approved design capabilities.
+    # This updates staging/meta/gate-policy.json before validation, so the hash
+    # reflects the final gate policy. Drift between design capabilities and
+    # gate-policy capabilities is resolved in favor of the approved design.
+    reclassify = _reclassify_gate_policy(staging, change_name)
+    if not reclassify.get("ok"):
+        return _result_error("CAPABILITY_GATE_DRIFT", reclassify.get("error", "reclassify failed"))
+
     validation = validate_staging(staging, change_name)
     if not validation["ok"]:
         return validation
@@ -282,6 +490,30 @@ def finalize_plan(
             finally:
                 tmp.unlink(missing_ok=True)
 
+        # C8: write implementation-checkpoints.json with parsed task ownerPhase.
+        tasks = validation.get("tasks") or []
+        if tasks:
+            checkpoints_path = change_dir / "meta" / "implementation-checkpoints.json"
+            checkpoints_payload = {
+                "schemaVersion": 1,
+                "changeName": change_name,
+                "tasks": tasks,
+                "foundationGate": "approved",
+            }
+            _atomic_write_json(checkpoints_path, checkpoints_payload)
+            created.append(checkpoints_path)
+
+        # C9: write scenario-manifest.json with parsed scenarios.
+        scenarios = validation.get("scenarios") or []
+        manifest_path = change_dir / "meta" / "scenario-manifest.json"
+        manifest_payload = {
+            "schemaVersion": 1,
+            "changeName": change_name,
+            "scenarios": scenarios,
+        }
+        _atomic_write_json(manifest_path, manifest_payload)
+        created.append(manifest_path)
+
         pending_receipt = {
             "schemaVersion": SCHEMA_VERSION,
             "changeName": change_name,