@hunter-harness/workflow-harness 0.2.16 → 0.2.17

package/harness/bundles/java/claude-code/harness-submit/checklist.md

@@ -12,7 +12,7 @@ description: harness-submit 的8 步工作流详细步骤和执行日志记录
 - commit message 必须写入 `.harness/changes/<change>/runtime/commit-message.txt`。
 - 使用 `git commit -F`，禁止先英文 commit 再 amend。
 - commit message 禁止 `Co-Authored-By`、`Generated by`、`AI generated`。
-- AskUserQuestion 参数错误时不得自行绕过，必须改用固定模板重问。
+- blocking user confirmation 参数错误时不得自行绕过，必须改用固定模板重问。
 - staged diff 是唯一提交依据。
 
 
@@ -130,7 +130,7 @@ powershell.exe -Command "Select-String -Path '<项目路径>\.gitignore' -Patter
 
 如果未包含：
 - **必须提醒用户**：`⚠️ .gitignore 未包含 .harness/，会导致 .harness/ 下文件被提交（含日志、报告、可能含敏感信息）`
-- **默认不提交 .harness/ 下文件**：使用 AskUserQuestion 询问用户是否：
+- **默认不提交 .harness/ 下文件**：使用 blocking user confirmation 询问用户是否：
   1. 添加 .harness/ 到 .gitignore（推荐）
   2. 仅 stage 业务代码文件，不提交 .harness/
   3. 取消提交
@@ -146,7 +146,7 @@ powershell.exe -Command "git -C '<项目路径>' status --porcelain | Select-Str
 
 **worktree 模式（requested=true）**：固定为「仅本地 commit」，不展示「commit+push」选项；commit 完成后继续下方「worktree 合并流程」，跳过下方三选项询问。
 
-`harness-submit` 不调用 Superpowers 呈现合并选项。只允许使用固定 AskUserQuestion 模板：
+`harness-submit` 不调用 Superpowers 呈现合并选项。只允许使用固定 blocking user confirmation 模板：
 
 ```text
 本次变更已完成验证，请选择提交方式：
@@ -156,7 +156,7 @@ powershell.exe -Command "git -C '<项目路径>' status --porcelain | Select-Str
 3. 取消提交
 ```
 
-禁止在此步骤引入“创建 PR”“丢弃所有变更”“直接合并到主分支”等旧选项，避免 AskUserQuestion 参数错误和流程歧义。
+禁止在此步骤引入"创建 PR""丢弃所有变更""直接合并到主分支"等旧选项，避免 blocking user confirmation 参数错误和流程歧义。
 
 ## 步骤 5：展示提交摘要 + 确认 ⚠️ 强制阻断
 
@@ -256,7 +256,7 @@ powershell.exe -Command "git -C '<项目路径>' log HEAD..@{u} --oneline"
 - **不得直接 pull 后 push**
 - 必须 pull/rebase 后**重新构建/测试**（ledger 复用条件被破坏，须重跑并写回 ledger）
 - 验证通过后再 push
-- 使用 AskUserQuestion 询问用户：
+- 使用 blocking user confirmation 询问用户：
   ```
   远程有新提交（N 个），需要 pull/rebase 后重新验证：
   1. 重新验证（pull/rebase + 构建 + 测试）

package/harness/bundles/java/claude-code/harness-submit/reference.md

@@ -4,7 +4,7 @@ description: harness-submit 的提交格式、固定交互模板和中文 commit
 
 # harness-submit 参考
 
-## 提交方式 AskUserQuestion 固定模板
+## 提交方式 blocking user confirmation 固定模板
 
 问题标题：`请选择提交方式`
 
@@ -14,7 +14,7 @@ description: harness-submit 的提交格式、固定交互模板和中文 commit
 2. `仅本地 commit，不 push`
 3. `取消提交`
 
-不得临场增加复杂对象或嵌套参数，避免 AskUserQuestion 参数错误。
+不得临场增加复杂对象或嵌套参数，避免 blocking user confirmation 参数错误。
 
 > **worktree 模式（meta/worktree.json requested=true）**：固定选项 2「仅本地 commit」，不展示「commit+push」；commit 成功后 skill **自动接续** worktree 合并流程（`/harness-merge` 为别名）。push 只在主分支完成，产出 `mergeFinalHash`。
 
@@ -148,5 +148,5 @@ powershell.exe -NoProfile -Command "git -C '<项目路径>' log HEAD..@{u} --one
 
 - 步骤 1（合并最新代码）：按无 upstream / 远端无新提交判定 N/A，在执行日志记录理由。
 - 步骤 5（commit-message.txt + `git commit -F`）N/A：无可暂存 diff，无新 commit 需生成。执行日志标注 `commit-message.txt / git commit -F: N/A（工作树 clean，无新 commit；N 个 wip 提交已存在，原样推送）`。
-- 步骤 4（提交方式选择）：固定三选项仍适用。但当 review 标了 RED 兼容性破坏等需人工确认项时，可在"commit + push"选项的描述中注明"并确认 <RED 项>"，**不得新增第四选项**、不得临场拼复杂 AskUserQuestion 参数。
+- 步骤 4（提交方式选择）：固定三选项仍适用。但当 review 标了 RED 兼容性破坏等需人工确认项时，可在"commit + push"选项的描述中注明"并确认 <RED 项>"，**不得新增第四选项**、不得临场拼复杂 blocking user confirmation 参数。
 - push 仍按步骤 6：fetch 检查远端 → `git push -u`（无 upstream 则新建远端分支）→ 记录 pre-pull hash + final pushed hash。

package/harness/bundles/java/claude-code/harness-sync/SKILL.md

@@ -19,7 +19,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=822ced2e1d949aed; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=6e87bc67bd51cbe9; overlay=java; agent=claude-code; do not edit -->
 # harness-sync — 元数据同步
 
 ## Purpose
@@ -55,7 +55,7 @@ python <skills-root>/scripts/harness_sync.py finalize --project . --run-id <run-
 | 3 | `.harness/codebase/map/` 是否过期 → 报告建议 `/harness-codebase-map` |
 | 3.5 | `harness_knowledge.py sync`；可 `sync --update`；失败不得假装可用。**知识闭环主入口**是 `/harness-knowledge-ingest auto`（含 Agent judge），sync 不重复列人工知识待办 |
 | 3.6 | 单次运行 `harness_knowledge.py maintain --project . --drain --json`，有界推进全部 `.harness/knowledge/maintenance-outbox/{pending,failed}`；不得为每个条目重复启动 Python/重建索引（§8.2：archive close 只 enqueue，sync 异步推进 outbox 到 completed/pending-judge） |
-| 4 | CLAUDE.md 完整性/行数 → 超限 AskUserQuestion 瘦身 |
+| 4 | CLAUDE.md 完整性/行数 → 超限 blocking user confirmation 瘦身 |
 | 5 | AGENTS.md 与各 Agent 指令入口一致；Claude Code 启用时验证 CLAUDE.md 引用 AGENTS.md，禁止反向循环引用 |
 | 6 | `.harness/` 结构（init 规程 → `reference.md` 第 6 步）；已装 skill 新鲜度只经 `hunter-harness refresh --dry-run --json` 的 post-adaptation freshness 判断，禁止 raw build 字节比较 |
 | 7–9 | `项目规则（见 .harness/context-index.json）/`、构建配置、测试目录 — **只提示不自动修复** |
@@ -67,6 +67,7 @@ python <skills-root>/scripts/harness_sync.py finalize --project . --run-id <run-
 - 命令结果不得靠猜测；普通 Bash 被拒 → 立即改用等价 PowerShell 重试一次
 - 仅 PowerShell 成功且有明确证据（构建/git/测试输出、文件存在、exit 0）时可标 ✅OK；否则 ❌FAIL 或 🟡WARN
 - 禁止把 hook 拒绝、静态验证、无输出、用户跳过说成成功 → 详见 [[../protocols/powershell-protocol.md|powershell-protocol]]、[[../protocols/evidence-based-reporting-protocol.md|evidence-based-reporting-protocol]]
+> 片段：p0-trust
 
 ## 关键规则
 
@@ -97,3 +98,4 @@ python <skills-root>/scripts/harness_events.py append --change-dir ".harness/cha
 > **Task 4 §6.1 写入契约**：普通 `append` = 加锁 -> 追加一行 -> fsync -> 解锁，**不 load 历史、不渲染**（O(1)，跨进程锁 `events.ndjson.lock`，UUID 用完整 `uuid4().hex` 无需去重扫描）。仅 `--type phase.end` append 在追加成功后渲染一次 `execution-log.md`；显式 `harness_events.py render` 随时从完整 events 重建；`harness_archive.py finalize` 在 collect 前强制 render 一次。高频 command append 期间 log 可能滞后，phase 边界保持最新。
 
 每次阶段结束必须写 `--status OK|WARN|FAIL|BLOCKED`；重试同一阶段时增加 `--attempt <n>`，不得覆盖或伪装成一次执行。跨工具继续执行时写 `--executor-tool <codex|claude-code|codebuddy|cursor>`，并在接棒事件写 `--handoff-from-tool` / `--handoff-reason`；也可由 `HUNTER_HARNESS_TOOL/AGENT/MODEL/RUN_ID` 环境变量统一注入。
+> 片段：logging · phase=`sync`；有未归档变更时写入其 change-dir events

package/harness/bundles/java/claude-code/harness-sync/reference.md

@@ -58,7 +58,7 @@ powershell.exe -Command "git -C '<项目路径>' diff --stat HEAD~5 2>$null"
 
 **瘦身策略**：如果超过 200 行，不是简单截断——而是把可独立成篇的细节（如完整编码规范、详细架构图）迁移到 `项目规则（见 .harness/context-index.json）/` 下，CLAUDE.md 保留简洁的索引和关键命令。
 
-> ⚠️ CLAUDE.md 需要瘦身时，必须用 AskUserQuestion 与用户确认拆分方案后再执行。
+> ⚠️ CLAUDE.md 需要瘦身时，必须用 blocking user confirmation 与用户确认拆分方案后再执行。
 
 ### 5. AGENTS.md 一致性
 

package/harness/bundles/java/claude-code/harness-test/SKILL.md

@@ -22,7 +22,7 @@ disallowed-tools:
   - Bash(node *)
   - Bash(codegraph *)
 ---
-<!-- generated by harness_deploy.py; core=822ced2e1d949aed; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=6e87bc67bd51cbe9; overlay=java; agent=claude-code; do not edit -->
 # harness-test — 测试执行
 
 ## Purpose
@@ -59,6 +59,7 @@ disallowed-tools:
 9. **每个 skill 边界只刷新一次状态快照** — 先运行 `python <skills-root>/scripts/harness_state.py capture --project . --change-dir ".harness/changes/<change-name>" --base <baseCommit> --json`；`changedSegments=[]` 时复用已有 profile/rules/map/knowledge/change/code 指纹，不再重复跑全量 `harness-sync`、知识重建或代码库扫描。只有对应 segment 变化或缺失时才定向刷新；快照不能替代源码读取和验证门禁。
 
 状态目录分层：新路径优先，旧路径兼容 → [[../protocols/state-layout-protocol.md|state-layout-protocol]]
+> 片段：read-protocol
 
 ## Workflow
 
@@ -115,12 +116,13 @@ disallowed-tools:
 - **runtime overlay**：`-Dspring.config.additional-location=file:<ascii-abs-path>/application-harness-test.yml`；禁止默认 Edit tracked `application*.yml`
 - **known-good-test-profile**：profile 名、baseURL、healthUrl 写在 build-profile，非 skill 硬编码
 - **多租户请求头**：header 名/值来自 build-profile 的 `httpHeaders` 配置
-- **Service Gate**：`harness_service.py ensure` 返回 `needs-user-decision`（用户进程占端口）时**才** AskUserQuestion
+- **Service Gate**：`harness_service.py ensure` 返回 `needs-user-decision`（用户进程占端口）时**才** blocking user confirmation
 ## P0 执行可信度规则
 
 - 命令结果不得靠猜测；普通 Bash 被拒 → 立即改用等价 PowerShell 重试一次
 - 仅 PowerShell 成功且有明确证据（构建/git/测试输出、文件存在、exit 0）时可标 ✅OK；否则 ❌FAIL 或 🟡WARN
 - 禁止把 hook 拒绝、静态验证、无输出、用户跳过说成成功 → 详见 [[../protocols/powershell-protocol.md|powershell-protocol]]、[[../protocols/evidence-based-reporting-protocol.md|evidence-based-reporting-protocol]]
+> 片段：p0-trust
 
 ## 关键规则（硬门禁速查）
 
@@ -160,11 +162,11 @@ python <skills-root>/scripts/harness_test_guard.py record --project . --change-d
 
 ### 六、服务启动 + 生命周期管理
 
-启动等待状态机：0–30s 每 2s 探测、30–120s 每 5s 探测、>120s 读日志判定；遇启动失败特征立即停。**Service Gate**：`harness_service.py ensure` 返回 `action=needs-user-decision`（用户自启服务占端口）时 **才** AskUserQuestion；AI 托管服务或端口空闲则自动继续，不询问。服务指纹（`moduleInputsHash`，来自 CLI `--files` ∪ `serviceStart.inputFiles`）+ `startCommandHash` + `profile` + `overlayPath` + 进程身份任一变化即 restart；**空输入被拒绝**，不生成可复用空指纹。测试结束默认清理 AI 启动的服务。详见 `reference.md`「服务决策门」。
+启动等待状态机：0–30s 每 2s 探测、30–120s 每 5s 探测、>120s 读日志判定；遇启动失败特征立即停。**Service Gate**：`harness_service.py ensure` 返回 `action=needs-user-decision`（用户自启服务占端口）时 **才** blocking user confirmation；AI 托管服务或端口空闲则自动继续，不询问。服务指纹（`moduleInputsHash`，来自 CLI `--files` ∪ `serviceStart.inputFiles`）+ `startCommandHash` + `profile` + `overlayPath` + 进程身份任一变化即 restart；**空输入被拒绝**，不生成可复用空指纹。测试结束默认清理 AI 启动的服务。详见 `reference.md`「服务决策门」。
 
 ### 七、运行时配置叠加（不动 tracked 配置）
 
-禁止默认 Edit tracked 应用配置文件。默认运行时配置叠加（ASCII 绝对路径）；改 tracked 配置 → 默认拒绝，记 `decision` 事件（不 AskUserQuestion，报告 🟡 WARN）。详见 `reference.md`。
+禁止默认 Edit tracked 应用配置文件。默认运行时配置叠加（ASCII 绝对路径）；改 tracked 配置 → 默认拒绝，记 `decision` 事件（不 blocking user confirmation，报告 🟡 WARN）。详见 `reference.md`。
 
 ### 八、Token 缓存与复用
 
@@ -196,7 +198,7 @@ python <skills-root>/scripts/harness_test_guard.py record --project . --change-d
 
 ## 交互白名单
 
-本 skill **仅允许**以下 AskUserQuestion；其余默认值 + `decision` 事件：
+本 skill **仅允许**以下 blocking user confirmation；其余默认值 + `decision` 事件：
 
 1. **Service Gate**：仅当 `harness_service.py ensure` 返回 `needs-user-decision`（用户进程占端口）时询问处理方式
 
@@ -213,3 +215,4 @@ python <skills-root>/scripts/harness_events.py append --change-dir ".harness/cha
 > **Task 4 §6.1 写入契约**：普通 `append` = 加锁 -> 追加一行 -> fsync -> 解锁，**不 load 历史、不渲染**（O(1)，跨进程锁 `events.ndjson.lock`，UUID 用完整 `uuid4().hex` 无需去重扫描）。仅 `--type phase.end` append 在追加成功后渲染一次 `execution-log.md`；显式 `harness_events.py render` 随时从完整 events 重建；`harness_archive.py finalize` 在 collect 前强制 render 一次。高频 command append 期间 log 可能滞后，phase 边界保持最新。
 
 每次阶段结束必须写 `--status OK|WARN|FAIL|BLOCKED`；重试同一阶段时增加 `--attempt <n>`，不得覆盖或伪装成一次执行。跨工具继续执行时写 `--executor-tool <codex|claude-code|codebuddy|cursor>`，并在接棒事件写 `--handoff-from-tool` / `--handoff-reason`；也可由 `HUNTER_HARNESS_TOOL/AGENT/MODEL/RUN_ID` 环境变量统一注入。
+> 片段：logging · phase=`test` · 事件：phase/command/verification/decision/issue/artifact

package/harness/bundles/java/claude-code/harness-test/pitfalls.md

@@ -191,7 +191,7 @@ $cred = $resp.data.accessToken
 **严重度**：🟡WARN
 **场景**：测试期间为了切换外部服务配置直接 Edit tracked 配置文件（如 `application-local-dev.yml`），测试后再还原，留下 diff 噪声
 **后果**：git diff --stat 出现意外文件、提交风险、误以为有业务变更
-**正确做法**：生成运行时配置叠加 `.harness/changes/<change>/runtime/application-harness-test.yml`（不提交），启动用 `-Dspring.config.additional-location=file:...` 叠加（按技术栈）；如必须改 tracked 配置，先 AskUserQuestion，最终报告至少 🟡 WARN
+**正确做法**：生成运行时配置叠加 `.harness/changes/<change>/runtime/application-harness-test.yml`（不提交），启动用 `-Dspring.config.additional-location=file:...` 叠加（按技术栈）；如必须改 tracked 配置，先 blocking user confirmation，最终报告至少 🟡 WARN
 
 ### 规则 22：唯一约束字段与本地预存数据冲突
 **严重度**：❌FAIL

package/harness/bundles/java/claude-code/harness-test/reference.md

@@ -151,7 +151,7 @@ spring:
 powershell.exe -NoProfile -Command "mvn spring-boot:run -pl <module-from-build-profile> -Dspring-boot.run.profiles=local-dev -Dspring-boot.run.jvmArguments='-Dspring.config.additional-location=file:C:/temp/harness-test-overlay/<change-name>/application-harness-test.yml'"
 ```
 
-不得默认使用 `.harness/changes/<change>/runtime/application-harness-test.yml` 相对路径作为 JVM `additional-location`。如必须修改 tracked yml，先 AskUserQuestion，最终报告至少 🟡 WARN。
+不得默认使用 `.harness/changes/<change>/runtime/application-harness-test.yml` 相对路径作为 JVM `additional-location`。如必须修改 tracked yml，先 blocking user confirmation，最终报告至少 🟡 WARN。
 
 ## Service Decision Gate 与服务生命周期管理
 

package/harness/bundles/java/claude-code/protocols/submit-protocol.md

@@ -1,5 +1,5 @@
 ---
-description: harness-submit 的确定性提交协议。用于避免 AskUserQuestion 参数错误、中文 commit message 失败、Co-Authored-By 违规和先 commit 后 amend。
+description: harness-submit 的确定性提交协议。用于避免 blocking user confirmation 参数错误、中文 commit message 失败、Co-Authored-By 违规和先 commit 后 amend。
 ---
 
 # Submit Protocol

package/harness/bundles/java/claude-code/scripts/harness_deploy.py

@@ -26,6 +26,10 @@ if hasattr(sys.stderr, "reconfigure"):
     sys.stderr.reconfigure(encoding="utf-8")
 
 INCLUDE_RE = re.compile(r"<!--\s*@include\s+shared/([^\s]+)\s*-->")
+# retro §5.17: wiki links [[shared/xxx.md|alias]] reference shared fragments
+# that are inlined by expand_includes. After expansion, replace the wiki link
+# with the alias text (the shared content is already in the document).
+WIKI_LINK_RE = re.compile(r"\[\[shared/([^\]|]+)\|([^\]]*)\]\]")
 # §7.5: overlay anchors support both new section-id and legacy section:"title".
 OVERRIDE_RE = re.compile(r'<!--\s*@override\s+(?:section-id:"([^"]+)"|section:"([^"]+)")\s*-->')
 APPEND_RE = re.compile(r'<!--\s*@append-after\s+(?:section-id:"([^"]+)"|section:"([^"]+)")\s*-->')
@@ -148,6 +152,9 @@ def expand_includes(text: str, shared_dir: Path) -> str:
         return body
 
     expanded = INCLUDE_RE.sub(repl, text)
+    # §5.17: replace [[shared/xxx.md|alias]] wiki links with the alias text,
+    # since the shared content has been inlined by @include expansion above.
+    expanded = WIKI_LINK_RE.sub(lambda m: m.group(2), expanded)
     lines = [ln for ln in expanded.splitlines() if not FRAGMENT_HINT_RE.match(ln)]
     return "\n".join(lines) + ("\n" if text.endswith("\n") else "")
 

package/harness/bundles/java/claude-code/scripts/harness_integration.py

@@ -1049,10 +1049,11 @@ class IntegrationTransaction:
                     heavy_removed.append(name)
                 except OSError as exc:
                     heavy_failures.append({"path": name, "error": str(exc)})
-        self.runner.run(
+        remove_result = self.runner.run(
             self.project_root, "worktree", "remove", "--force", str(resolved),
             check=False,
         )
+        remove_returncode = getattr(remove_result, "returncode", 0)
         listed = self.runner.text(self.project_root, "worktree", "list", "--porcelain")
         registered_after = {
             str(Path(line.removeprefix("worktree ")).resolve())
@@ -1061,7 +1062,8 @@ class IntegrationTransaction:
         }
         still_registered = str(resolved) in registered_after
         residual_paths: list[str] = []
-        if resolved.exists():
+        disk_path_present = resolved.exists()
+        if disk_path_present:
             if resolved.is_file():
                 residual_paths.append(resolved.name)
             else:
@@ -1075,6 +1077,27 @@ class IntegrationTransaction:
                             break
                     if len(residual_paths) >= 200:
                         break
+        # §5.30: Windows half-success — git worktree remove returned non-zero
+        # but registration is already deleted and disk path remains. Return a
+        # structured status distinct from generic CLEANUP_RESIDUAL so callers
+        # can apply the allowlisted residual cleaner.
+        if (
+            remove_returncode != 0
+            and not still_registered
+            and disk_path_present
+            and residual_paths
+            and not heavy_failures
+        ):
+            return {
+                "ok": False,
+                "code": "REGISTRATION_REMOVED_RESIDUAL_PRESENT",
+                "target": str(resolved),
+                "heavyRootsRemoved": heavy_removed,
+                "heavyRootFailures": heavy_failures,
+                "worktreeRegistered": False,
+                "diskPathPresent": True,
+                "residualPaths": residual_paths,
+            }
         ok = not heavy_failures and not still_registered and not residual_paths
         return {
             "ok": ok,
@@ -1083,6 +1106,7 @@ class IntegrationTransaction:
             "heavyRootsRemoved": heavy_removed,
             "heavyRootFailures": heavy_failures,
             "worktreeRegistered": still_registered,
+            "diskPathPresent": disk_path_present,
             "residualPaths": residual_paths,
         }
 

package/harness/bundles/java/claude-code/scripts/harness_plan_finalize.py

@@ -300,6 +300,152 @@ def _terminal_exists(change_dir: Path, run_id: str, attempt: int) -> bool:
     )
 
 
+def verify_plan(change_dir: Path) -> dict[str, Any]:
+    """Read-only verification of a finalized plan (retro §5.8).
+
+    Validates the published artifacts, receipt and events stream without
+    requiring the original staging directory. Returns the artifact hash,
+    phase.end count/status, frontmatter, and consistency checks. Any parse
+    error or inconsistency results in ok=false with a non-zero exit code.
+    """
+    change_dir = change_dir.resolve()
+    receipt_path = change_dir / "meta" / "plan-finalization.json"
+    if not receipt_path.is_file():
+        return _result_error("RECEIPT_MISSING", f"receipt not found: {receipt_path}")
+
+    try:
+        receipt = json.loads(receipt_path.read_text(encoding="utf-8-sig"))
+    except (OSError, json.JSONDecodeError) as exc:
+        return _result_error("RECEIPT_INVALID", str(exc))
+    if not isinstance(receipt, dict):
+        return _result_error("RECEIPT_INVALID", "receipt top-level must be an object")
+
+    change_name = str(receipt.get("changeName") or "").strip()
+    if not change_name:
+        return _result_error("RECEIPT_INVALID", "receipt missing changeName")
+
+    expected_hash = str(receipt.get("artifactsHash") or "").strip()
+    if not expected_hash.startswith("sha256:"):
+        return _result_error("RECEIPT_INVALID", "receipt artifactsHash missing or malformed")
+
+    files_list = receipt.get("files")
+    if not isinstance(files_list, list) or not files_list:
+        return _result_error("RECEIPT_INVALID", "receipt files list missing or empty")
+
+    # Recompute artifacts hash from published files.
+    digest = hashlib.sha256()
+    artifact_names: list[str] = []
+    for rel_text in files_list:
+        rel = rel_text.as_posix() if hasattr(rel_text, "as_posix") else str(rel_text)
+        target = change_dir / rel
+        if not target.is_file():
+            return _result_error(
+                "ARTIFACT_MISSING", f"published artifact missing: {rel}"
+            )
+        artifact_names.append(rel)
+        digest.update(rel.encode("utf-8"))
+        digest.update(b"\0")
+        digest.update(target.read_bytes())
+        digest.update(b"\0")
+    actual_hash = "sha256:" + digest.hexdigest()
+    if actual_hash != expected_hash:
+        return _result_error(
+            "ARTIFACT_HASH_DRIFT",
+            f"published artifacts hash {actual_hash} != receipt {expected_hash}",
+        )
+
+    # Validate frontmatter on markdown artifacts.
+    frontmatter_results: dict[str, Any] = {}
+    for rel in artifact_names:
+        if not rel.endswith(".md"):
+            continue
+        target = change_dir / rel
+        try:
+            text = target.read_text(encoding="utf-8-sig")
+        except OSError as exc:
+            return _result_error("ARTIFACT_UNREADABLE", f"{rel}: {exc}")
+        fm = _frontmatter(text)
+        if fm is None:
+            return _result_error(
+                "ARTIFACT_FRONTMATTER_MISSING", f"{rel}: no frontmatter"
+            )
+        if fm.get("change-name") != change_name:
+            return _result_error(
+                "ARTIFACT_FRONTMATTER_INVALID",
+                f"{rel}: change-name '{fm.get('change-name')}' != '{change_name}'",
+            )
+        frontmatter_results[rel] = {
+            "change-name": fm.get("change-name"),
+            "status": fm.get("status"),
+        }
+
+    # Validate gate-policy.json is parseable JSON.
+    gate_policy_path = change_dir / "meta" / "gate-policy.json"
+    gate_policy_consistent = True
+    if gate_policy_path.is_file():
+        try:
+            json.loads(gate_policy_path.read_text(encoding="utf-8-sig"))
+        except (OSError, json.JSONDecodeError):
+            gate_policy_consistent = False
+    else:
+        gate_policy_consistent = False
+
+    # Validate events.ndjson: count phase.end, check for parse errors.
+    events_path = change_dir / "events.ndjson"
+    phase_end_count = 0
+    phase_end_status: str | None = None
+    events_parse_errors: list[str] = []
+    if events_path.is_file():
+        for line_no, line in enumerate(events_path.read_text(encoding="utf-8").splitlines(), 1):
+            if not line.strip():
+                continue
+            try:
+                event = json.loads(line)
+            except json.JSONDecodeError as exc:
+                events_parse_errors.append(f"line {line_no}: {exc}")
+                continue
+            if not isinstance(event, dict):
+                events_parse_errors.append(f"line {line_no}: not an object")
+                continue
+            if (
+                event.get("phase") == "plan"
+                and event.get("type") == "phase.end"
+            ):
+                phase_end_count += 1
+                phase_end_status = str(event.get("status") or "").upper()
+    else:
+        events_parse_errors.append("events.ndjson missing")
+
+    if events_parse_errors:
+        return _result_error(
+            "EVENTS_PARSE_ERROR", "; ".join(events_parse_errors[:5])
+        )
+
+    if phase_end_count == 0:
+        return _result_error("PHASE_END_MISSING", "no plan phase.end event found")
+    if phase_end_count > 1:
+        return _result_error(
+            "PHASE_END_DUPLICATE", f"found {phase_end_count} phase.end events"
+        )
+
+    # Receipt consistency: status should be finalized.
+    receipt_consistent = receipt.get("status") == "finalized"
+
+    return {
+        "ok": True,
+        "action": "verify",
+        "changeDir": str(change_dir),
+        "changeName": change_name,
+        "artifactsHash": actual_hash,
+        "phaseEndCount": phase_end_count,
+        "phaseEndStatus": phase_end_status,
+        "frontmatter": frontmatter_results,
+        "gatePolicyConsistent": gate_policy_consistent,
+        "receiptConsistent": receipt_consistent,
+        "files": artifact_names,
+    }
+
+
 def _read_design_capabilities(staging: Path, change_name: str) -> list[str]:
     """Read capabilities from design frontmatter (retro §5.4)."""
     design_path = staging / "spec" / f"{change_name}-design.md"
@@ -569,18 +715,24 @@ def build_parser() -> argparse.ArgumentParser:
     finalize.add_argument("--run-id", required=True)
     finalize.add_argument("--attempt", required=True, type=int)
     finalize.add_argument("--json", action="store_true")
+    verify = sub.add_parser("verify")
+    verify.add_argument("--change-dir", required=True)
+    verify.add_argument("--json", action="store_true")
     return parser
 
 
 def main(argv: list[str] | None = None) -> int:
     args = build_parser().parse_args(argv)
-    result = finalize_plan(
-        Path(args.change_dir),
-        Path(args.staging_dir),
-        change_name=args.change,
-        run_id=args.run_id,
-        attempt=args.attempt,
-    )
+    if args.command == "verify":
+        result = verify_plan(Path(args.change_dir))
+    else:
+        result = finalize_plan(
+            Path(args.change_dir),
+            Path(args.staging_dir),
+            change_name=args.change,
+            run_id=args.run_id,
+            attempt=args.attempt,
+        )
     stream = sys.stdout if result["ok"] else sys.stderr
     if args.json:
         stream.write(json.dumps(result, ensure_ascii=False, indent=2) + "\n")

package/harness/bundles/java/claude-code/scripts/harness_test_cleanup.py

@@ -0,0 +1,175 @@
+#!/usr/bin/env python3
+"""Controlled cleanup helper for test fixtures (retro §5.23).
+
+Provides a host-policy-friendly entry point for removing gitignored test
+fixtures (e.g. .pytest_data) within an execution root. Performs realpath
+containment, rejects symlink/reparse escapes, lists exact counts before
+deletion, and outputs a structured receipt.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import shutil
+import sys
+from pathlib import Path
+from typing import Any
+
+if hasattr(sys.stdout, "reconfigure"):
+    sys.stdout.reconfigure(encoding="utf-8")
+if hasattr(sys.stderr, "reconfigure"):
+    sys.stderr.reconfigure(encoding="utf-8")
+
+
+def _resolve_within(execution_root: Path, rel: str) -> Path | None:
+    """Resolve rel under execution_root, rejecting escapes and symlinks."""
+    if not rel or rel.startswith("/"):
+        return None
+    # Reject absolute paths (Windows drive letter or POSIX).
+    if len(rel) >= 2 and rel[1] == ":":
+        return None
+    parts = rel.replace("\\", "/").split("/")
+    if ".." in parts:
+        return None
+    candidate = (execution_root / rel).resolve(strict=False)
+    # Containment check: candidate must be under execution_root.
+    try:
+        candidate.relative_to(execution_root.resolve(strict=False))
+    except ValueError:
+        return None
+    # Reject symlink/reparse escape: if the path is a symlink, check its target.
+    if candidate.is_symlink():
+        target = Path(os.readlink(candidate)).resolve(strict=False)
+        try:
+            target.relative_to(execution_root.resolve(strict=False))
+        except ValueError:
+            return None
+        # Even if target is inside, a symlinked cleanup root is suspicious;
+        # reject to avoid following links into unexpected locations.
+        return None
+    return candidate
+
+
+def _count_files(root: Path) -> tuple[int, int]:
+    """Count files and total bytes under root."""
+    count = 0
+    total = 0
+    for dirpath, _dirs, files in os.walk(root):
+        for name in files:
+            fp = Path(dirpath) / name
+            try:
+                total += fp.stat().st_size
+                count += 1
+            except OSError:
+                continue
+    return count, total
+
+
+def cleanup(execution_root: Path, cleanup_roots: list[str]) -> dict[str, Any]:
+    """Remove allowlisted cleanup roots within execution_root.
+
+    Returns a structured receipt. Any path escape, symlink escape, or
+    unallowed root results in ok=false with zero files removed.
+    """
+    execution_root = Path(execution_root).resolve(strict=False)
+    if not execution_root.is_dir():
+        return {
+            "ok": False,
+            "code": "EXECUTION_ROOT_MISSING",
+            "executionRoot": str(execution_root),
+            "removedFiles": 0,
+            "removedBytes": 0,
+            "rejectedEscapes": [],
+        }
+
+    rejected: list[dict[str, str]] = []
+    removed_files = 0
+    removed_bytes = 0
+    cleaned: list[str] = []
+
+    for rel in cleanup_roots:
+        target = _resolve_within(execution_root, rel)
+        if target is None:
+            rejected.append({"path": rel, "reason": "PATH_ESCAPE_REJECTED"})
+            continue
+        if not target.exists():
+            # Already absent — idempotent reentry.
+            continue
+        # Re-check symlink after resolution (the parent might be a symlink).
+        if target.is_symlink():
+            rejected.append({"path": rel, "reason": "SYMLINK_ESCAPE_REJECTED"})
+            continue
+        # Count before deletion for the receipt.
+        try:
+            count, total = _count_files(target)
+        except OSError:
+            count, total = 0, 0
+        # Delete.
+        try:
+            shutil.rmtree(target)
+        except OSError as exc:
+            rejected.append({"path": rel, "reason": f"DELETE_FAILED: {exc}"})
+            continue
+        removed_files += count
+        removed_bytes += total
+        cleaned.append(rel)
+
+    if rejected:
+        return {
+            "ok": False,
+            "code": rejected[0]["reason"],
+            "executionRoot": str(execution_root),
+            "removedFiles": removed_files,
+            "removedBytes": removed_bytes,
+            "rejectedEscapes": rejected,
+            "cleaned": cleaned,
+        }
+
+    if removed_files == 0 and not cleaned:
+        return {
+            "ok": True,
+            "code": "ALREADY_ABSENT",
+            "executionRoot": str(execution_root),
+            "removedFiles": 0,
+            "removedBytes": 0,
+            "rejectedEscapes": [],
+            "cleaned": [],
+        }
+
+    return {
+        "ok": True,
+        "code": "CLEANUP_COMPLETE",
+        "executionRoot": str(execution_root),
+        "removedFiles": removed_files,
+        "removedBytes": removed_bytes,
+        "rejectedEscapes": [],
+        "cleaned": cleaned,
+    }
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    sub = parser.add_subparsers(dest="action", required=True)
+    clean_parser = sub.add_parser("cleanup")
+    clean_parser.add_argument("--execution-root", required=True)
+    clean_parser.add_argument("--cleanup-roots", required=True, help="JSON array of relative paths")
+    clean_parser.add_argument("--json", action="store_true")
+    args = parser.parse_args(argv)
+
+    try:
+        roots = json.loads(args.cleanup_roots)
+        if not isinstance(roots, list):
+            raise ValueError("cleanup-roots must be a JSON array")
+    except (json.JSONDecodeError, ValueError) as exc:
+        result = {"ok": False, "code": "INVALID_CLEANUP_ROOTS", "error": str(exc)}
+        print(json.dumps(result, ensure_ascii=False, indent=2))
+        return 1
+
+    result = cleanup(Path(args.execution_root), roots)
+    print(json.dumps(result, ensure_ascii=False, indent=2 if args.json else None))
+    return 0 if result["ok"] else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/harness/bundles/java/codebuddy/.harness-build.json

@@ -2,5 +2,5 @@
   "schemaVersion": 1,
   "overlay": "java",
   "agent": "codebuddy",
-  "coreHash": "822ced2e1d949aed"
+  "coreHash": "6e87bc67bd51cbe9"
 }