@hunter-harness/workflow-harness 0.2.18 → 0.2.20

package/harness/bundles/general/claude-code/scripts/harness_integration.py

@@ -109,6 +109,10 @@ class CleanupResidualError(IntegrationError):
         )
 
 
+class AbandonRefusedError(IntegrationError):
+    code = "ABANDON_REFUSED"
+
+
 class JournalConflictError(IntegrationError):
     code = "JOURNAL_CONFLICT"
 
@@ -740,6 +744,8 @@ class IntegrationTransaction:
                 str(intg_root),
                 self.temp_branch,
             )
+            # H-5: LF-stable hashing in the integration worktree.
+            self.runner.run(intg_root, "config", "core.autocrlf", "false")
 
         return self._run_step("prepare", action)
 
@@ -1195,6 +1201,148 @@ class IntegrationTransaction:
         harness_change.integration_lock_release(self.project_root, run_id=self.run_id)
         return journal
 
+    # ------------------------------------------------------------ abandon
+
+    def _remote_contains_merge(self, journal: dict[str, Any]) -> bool:
+        merge_commit = str(journal.get("mergeCommit") or "")
+        if not merge_commit:
+            return False
+        remote_line = self.runner.text(
+            self.project_root, "ls-remote", "origin", self.target_branch
+        )
+        observed_remote = (
+            remote_line.split()[0] if remote_line and remote_line.split() else ""
+        )
+        return bool(observed_remote and observed_remote == merge_commit)
+
+    def _force_remove_integration_root(
+        self, journal: dict[str, Any], intg_root: Path
+    ) -> dict[str, Any]:
+        """Best-effort remove of the integration worktree for abandon only."""
+        allowed = Path(str(journal.get("allowedCleanupRoot") or "")).resolve()
+        resolved = harness_paths.assert_path_within(intg_root, self.temp_root)
+        if not allowed or resolved != allowed:
+            raise CleanupRefusedError(
+                f"refusing to abandon non-transaction path: {resolved}"
+            )
+        self.runner.run(
+            self.project_root,
+            "worktree",
+            "remove",
+            "--force",
+            str(resolved),
+            check=False,
+        )
+        residual: list[str] = []
+        if resolved.exists():
+            for name in HEAVY_WORKTREE_ROOTS:
+                heavy = resolved / name
+                if heavy.exists():
+                    harness_paths.assert_path_within(heavy, resolved)
+                    try:
+                        if heavy.is_dir() and not heavy.is_symlink():
+                            shutil.rmtree(heavy)
+                        else:
+                            heavy.unlink()
+                    except OSError:
+                        residual.append(name)
+            if resolved.exists():
+                try:
+                    shutil.rmtree(resolved)
+                except OSError:
+                    residual.append(str(resolved))
+        listed = self.runner.text(self.project_root, "worktree", "list", "--porcelain")
+        still_registered = str(resolved) in {
+            str(Path(line.removeprefix("worktree ")).resolve())
+            for line in (listed or "").splitlines()
+            if line.startswith("worktree ")
+        }
+        ok = not still_registered and not residual and not resolved.exists()
+        return {
+            "ok": ok,
+            "code": "CLEANUP_COMPLETE" if ok else "CLEANUP_RESIDUAL",
+            "target": str(resolved),
+            "worktreeRegistered": still_registered,
+            "diskPathPresent": resolved.exists(),
+            "residualPaths": residual,
+        }
+
+    def abandon(self) -> dict[str, Any]:
+        """Official recovery for a failed integration transaction (H-6).
+
+        Allowed only when push is not DONE and the remote does not already
+        contain ``mergeCommit``. Removes the integration worktree, temp branch,
+        protection refs, and integration lock. Never deletes the feature
+        worktree or feature branch.
+        """
+        try:
+            journal = self._load()
+        except FileNotFoundError as exc:
+            raise AbandonRefusedError(
+                f"no journal for transaction {self.transaction_id}"
+            ) from exc
+
+        push_status = str(self._step(journal, "push").get("status") or "")
+        push_intent = journal.get("pushIntent") or {}
+        push_confirmed = (
+            push_status == "DONE"
+            or (
+                isinstance(push_intent, dict)
+                and push_intent.get("status") == "REMOTE_CONFIRMED"
+            )
+            or bool(journal.get("pushedHead"))
+            or bool(journal.get("mergeFinalHash"))
+        )
+        remote_has_merge = self._remote_contains_merge(journal)
+        if push_confirmed or remote_has_merge:
+            raise AbandonRefusedError(
+                "refuse abandon: push succeeded or remote already contains "
+                "the merge commit; use cleanup instead"
+            )
+
+        intg_root = Path(str(journal.get("integrationRoot") or ""))
+        cleanup_result: dict[str, Any] = {
+            "ok": True,
+            "code": "ALREADY_ABSENT",
+            "target": str(intg_root) if intg_root else "",
+            "worktreeRegistered": False,
+            "diskPathPresent": False,
+            "residualPaths": [],
+        }
+        prepare_done = self._step(journal, "prepare").get("status") == "DONE"
+        if prepare_done and str(journal.get("integrationRoot") or "").strip():
+            try:
+                cleanup_result = self.cleanup_target(intg_root)
+            except CleanupRefusedError:
+                cleanup_result = self._force_remove_integration_root(journal, intg_root)
+
+        self.runner.run(
+            self.project_root, "branch", "-D", self.temp_branch, check=False
+        )
+        refs = journal.get("protectionRefs") or {}
+        if isinstance(refs, dict):
+            for ref in (refs.get("base"), refs.get("head")):
+                if ref:
+                    self.runner.run(
+                        self.project_root, "update-ref", "-d", str(ref), check=False
+                    )
+
+        harness_change.integration_lock_release(self.project_root, run_id=self.run_id)
+
+        journal = self._load()
+        journal["abandonedAt"] = now_iso()
+        journal["abandonResult"] = cleanup_result
+        self._save(journal)
+
+        return {
+            "ok": True,
+            "code": "ABANDON_COMPLETE",
+            "transactionId": self.transaction_id,
+            "cleanup": cleanup_result,
+            "featureBranchRetained": True,
+            "featureWorktreeRetained": True,
+        }
+
     # ------------------------------------------------------------ recover
 
     def recover(
@@ -1282,6 +1430,10 @@ def cmd_cleanup(args: argparse.Namespace) -> int:
     return _emit(_txn_from_args(args).cleanup())
 
 
+def cmd_abandon(args: argparse.Namespace) -> int:
+    return _emit(_txn_from_args(args).abandon())
+
+
 def cmd_recover(args: argparse.Namespace) -> int:
     return _emit(_txn_from_args(args).recover())
 
@@ -1333,6 +1485,7 @@ def build_parser() -> argparse.ArgumentParser:
     add("merge", cmd_merge)
     add("push", cmd_push)
     add("cleanup", cmd_cleanup)
+    add("abandon", cmd_abandon)
     add("recover", cmd_recover)
     add("status", cmd_status)
 

package/harness/bundles/general/claude-code/scripts/harness_ledger.py

@@ -28,6 +28,7 @@ if str(SCRIPTS_DIR) not in sys.path:
     sys.path.insert(0, str(SCRIPTS_DIR))
 
 import harness_paths  # noqa: E402
+import harness_profile  # noqa: E402
 
 
 if hasattr(sys.stdout, "reconfigure"):
@@ -131,8 +132,19 @@ def emit_compact_or_verbose(
     emit_json(out, as_json=as_json)
 
 
-def emit_error(message: str, *, as_json: bool, code: int = 1) -> int:
-    payload = {"ok": False, "error": message}
+def emit_error(
+    message: str,
+    *,
+    as_json: bool,
+    code: int = 1,
+    error_code: str | None = None,
+    extra: dict[str, Any] | None = None,
+) -> int:
+    payload: dict[str, Any] = {"ok": False, "error": message}
+    if error_code:
+        payload["code"] = error_code
+    if extra:
+        payload.update(extra)
     if as_json:
         sys.stderr.write(json.dumps(payload, ensure_ascii=False) + "\n")
     else:
@@ -523,18 +535,30 @@ def expand_profile_input_files(
 ) -> tuple[list[str], str | None]:
     """Expand verificationInputs[profile_input] globs from build-profile.json.
 
-    Globs are relative to project; only files inside project are kept
-    (deduped, path-sorted). Returns (files, error); error is None on success.
+    Profile is loaded via ``harness_profile.load_profile`` (C7: common_root then
+    execution overlay) so linked worktrees without a local build-profile still
+    reuse the main checkout profile. Globs remain relative to the execution
+    ``project`` root (not common_root) so inputsHash tracks the tree under test.
+
+    Returns (files, error); error is None on success.
     profile 缺失 / key 缺失 / glob 无匹配 / 结果为空 → 返回 ([], "<reason>")，
     调用方据此返回 insufficient-evidence，执行全量测试但不允许缓存复用。
     """
-    profile_path = project / ".harness" / "config" / "build-profile.json"
-    if not profile_path.is_file():
+    profile = harness_profile.load_profile(Path(project))
+    if profile is None:
+        # load_profile swallows JSON errors; restore actionable unreadable diag
+        # when a profile file exists but cannot be parsed (review YELLOW-1).
+        project_root = Path(project).resolve()
+        common = harness_paths.common_root(project_root)
+        for root in (common, project_root):
+            candidate = root / ".harness" / "config" / "build-profile.json"
+            if not candidate.is_file():
+                continue
+            try:
+                json.loads(candidate.read_text(encoding="utf-8-sig"))
+            except (OSError, json.JSONDecodeError) as exc:
+                return [], f"build-profile.json unreadable: {exc}"
         return [], "build-profile.json missing; run harness_preflight.py detect"
-    try:
-        profile = json.loads(profile_path.read_text(encoding="utf-8-sig"))
-    except (OSError, json.JSONDecodeError) as exc:
-        return [], f"build-profile.json unreadable: {exc}"
     if not isinstance(profile, dict):
         return [], "build-profile.json is not an object"
     inputs = profile.get("verificationInputs")
@@ -544,7 +568,7 @@ def expand_profile_input_files(
     if not isinstance(patterns, list) or not patterns:
         return [], f"verificationInputs.{profile_input} is empty or invalid"
 
-    base = project.resolve()
+    base = Path(project).resolve()
     seen: set[str] = set()
     for pat in patterns:
         if not isinstance(pat, str) or not pat.strip():
@@ -1520,6 +1544,8 @@ def cmd_record(args: argparse.Namespace) -> int:
                 return emit_error(
                     "ledger identity incomplete: " + ", ".join(missing),
                     as_json=as_json,
+                    error_code="LEDGER_IDENTITY_INVALID",
+                    extra={"missing": missing},
                 )
         write_ledger(out_path, ledger)
     except (OSError, ValueError, FileNotFoundError, json.JSONDecodeError) as exc:

package/harness/bundles/general/claude-code/scripts/harness_paths.py

@@ -20,7 +20,7 @@ import re
 import subprocess
 import sys
 from pathlib import Path
-from typing import Any
+from typing import Any, Sequence
 
 SCRIPTS_DIR = Path(__file__).resolve().parent
 if str(SCRIPTS_DIR) not in sys.path:
@@ -289,6 +289,175 @@ def assert_path_within(
     return resolved
 
 
+class CleanupTopologyError(ValueError):
+    """Raised when cleanup would delete or traverse into state/archive roots."""
+
+    code = "CLEANUP_TOPOLOGY_REFUSED"
+
+
+# Skip descending into these when scanning for junction/symlink escapes.
+# Matches integration HEAVY_WORKTREE_ROOTS plus .git (topology scan only).
+CLEANUP_WALK_SKIP_DIRS = frozenset(
+    {
+        "node_modules",
+        ".venv",
+        "venv",
+        "build",
+        "dist",
+        "target",
+        ".cache",
+        "__pycache__",
+        ".git",
+    }
+)
+
+
+def assert_cleanup_safe(
+    cleanup_root: Path,
+    state_roots: Sequence[Path] | None = None,
+    archive_roots: Sequence[Path] | None = None,
+) -> Path:
+    """Refuse cleanup when state/archive roots resolve inside the cleanup tree.
+
+    Also refuses when a junction/symlink under ``cleanup_root`` resolves into a
+    protected state/archive root (Windows junction / symlink escape).
+    """
+    cleanup = Path(cleanup_root).resolve()
+    protected: list[Path] = []
+    for raw in [*(state_roots or ()), *(archive_roots or ())]:
+        try:
+            protected.append(Path(raw).resolve())
+        except OSError as exc:
+            raise CleanupTopologyError(
+                f"CLEANUP_TOPOLOGY_REFUSED: cannot resolve protected path {raw}: {exc}"
+            ) from exc
+
+    for prot in protected:
+        if prot == cleanup or prot.is_relative_to(cleanup):
+            raise CleanupTopologyError(
+                "CLEANUP_TOPOLOGY_REFUSED: protected path "
+                f"{prot} is inside cleanup root {cleanup}"
+            )
+
+    if cleanup.is_dir():
+        for dirpath, dirnames, filenames in os.walk(cleanup, followlinks=False):
+            # Inspect this level (including heavy names) for link escapes, then
+            # prune descent so we do not walk install/cache trees.
+            entries = [*dirnames, *filenames]
+            dirnames[:] = [d for d in dirnames if d not in CLEANUP_WALK_SKIP_DIRS]
+            for name in entries:
+                child = Path(dirpath) / name
+                try:
+                    is_link = child.is_symlink()
+                except OSError:
+                    continue
+                # Junctions often report as directories; resolve and compare.
+                try:
+                    resolved_child = child.resolve()
+                except OSError:
+                    continue
+                escaped = not (
+                    resolved_child == cleanup or resolved_child.is_relative_to(cleanup)
+                )
+                if not (is_link or escaped):
+                    continue
+                for prot in protected:
+                    if (
+                        resolved_child == prot
+                        or resolved_child.is_relative_to(prot)
+                        or prot.is_relative_to(resolved_child)
+                    ):
+                        raise CleanupTopologyError(
+                            "CLEANUP_TOPOLOGY_REFUSED: cleanup path "
+                            f"{child} resolves to protected {resolved_child}"
+                        )
+    return cleanup
+
+
+_FORMAL_SNAPSHOT_DIRS = ("plans", "spec", "evidence", "reports", "meta")
+_FORMAL_SNAPSHOT_FILES = ("events.ndjson",)
+
+
+def snapshot_change_formal_layer(
+    project_root: Path,
+    change_id: str,
+    *,
+    change_dir: Path | None = None,
+) -> dict[str, Any]:
+    """Copy change formal layer into ``.harness/cache/change-snapshots/<change>/``.
+
+    Destination is always under the main project / common harness root — never
+    under a feature worktree path alone.
+    """
+    import shutil
+
+    project = resolve_main_project_root(Path(project_root))
+    src = Path(change_dir).resolve() if change_dir is not None else (
+        project / ".harness" / "changes" / change_id
+    ).resolve()
+    if not src.is_dir():
+        raise FileNotFoundError(f"change dir not found for snapshot: {src}")
+
+    dest = (project / ".harness" / "cache" / "change-snapshots" / change_id).resolve()
+    # Hard guard: never write the snapshot inside the source tree itself.
+    if dest == src or dest.is_relative_to(src):
+        raise ValueError(
+            f"snapshot destination must not be inside change dir: {dest}"
+        )
+    dest.mkdir(parents=True, exist_ok=True)
+
+    copied: list[str] = []
+    for name in _FORMAL_SNAPSHOT_DIRS:
+        source_dir = src / name
+        if not source_dir.is_dir():
+            continue
+        target_dir = dest / name
+        shutil.copytree(source_dir, target_dir, dirs_exist_ok=True)
+        copied.append(name + "/")
+    for name in _FORMAL_SNAPSHOT_FILES:
+        source_file = src / name
+        if not source_file.is_file():
+            continue
+        shutil.copy2(source_file, dest / name)
+        copied.append(name)
+
+    file_hashes: dict[str, str] = {}
+    for path in sorted(dest.rglob("*")):
+        if not path.is_file():
+            continue
+        rel = path.relative_to(dest).as_posix()
+        if rel == "manifest.json":
+            continue
+        digest = hashlib.sha256(path.read_bytes()).hexdigest()
+        file_hashes[rel] = "sha256:" + digest
+
+    manifest = {
+        "schemaVersion": 1,
+        "changeId": change_id,
+        "source": str(src),
+        "destination": str(dest),
+        "projectRoot": str(project),
+        "copied": copied,
+        "files": file_hashes,
+        "fileCount": len(file_hashes),
+    }
+    manifest_path = dest / "manifest.json"
+    manifest_path.write_text(
+        json.dumps(manifest, ensure_ascii=False, indent=2) + "\n",
+        encoding="utf-8",
+        newline="\n",
+    )
+    return {
+        "ok": True,
+        "code": "CHANGE_SNAPSHOT_WRITTEN",
+        "changeId": change_id,
+        "destination": str(dest),
+        "fileCount": len(file_hashes),
+        "copied": copied,
+        "manifestPath": str(manifest_path),
+    }
+
+
 def cmd_resolve_layout(args: argparse.Namespace) -> int:
     layout = resolve_change_layout(Path.cwd(), args.change)
     sys.stdout.write(json.dumps(layout, ensure_ascii=False, indent=2) + "\n")

package/harness/bundles/general/codebuddy/.harness-build.json

@@ -2,5 +2,5 @@
   "schemaVersion": 1,
   "overlay": "none",
   "agent": "codebuddy",
-  "coreHash": "d5b51ad56d4d4535"
+  "coreHash": "5b9a3abb544f8fb2"
 }

package/harness/bundles/general/codebuddy/harness-archive/SKILL.md

@@ -3,7 +3,7 @@ name: harness-archive
 description: 归档所有变更产出（计划/测试报告/审查/SQL/API文档）到
   .harness/archive/，含归档元数据和可视化最终总结。使用场景：归档、完成归档、收尾、打包产出物
 ---
-<!-- generated by harness_deploy.py; core=d5b51ad56d4d4535; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=5b9a3abb544f8fb2; overlay=none; agent=codebuddy; do not edit -->
 # harness-archive — 变更归档
 
 ## Purpose
@@ -33,6 +33,12 @@ description: 归档所有变更产出（计划/测试报告/审查/SQL/API文档
 - commit 已 push（`git log @{u}..HEAD` 输出为空）
 - **最终 hash 来源**：worktree 模式（`meta/worktree.json` requested=true）下读 ledger 的 `mergeFinalHash`（由 `/harness-submit` 合并段写入）；主目录模式读 submit 的 `final pushed hash`。当前 `git rev-parse HEAD` 须一致
 - test 报告存在或标记"跳过"；review 报告存在或标记"未运行 review"（review 不阻塞归档）
+- **最小必备集（H-4 / `harness_archive.py status` blockers）**：
+  - `plans/*-plan.md`
+  - 非空 `events.ndjson`
+  - `evidence/verification-ledger.json`
+  - 至少一个 test 或 review 报告/证据
+  - 缺失任一项 → `archivable=false`；可从 `.harness/cache/change-snapshots/<change>/` 恢复正式层后再重试
 
 ## Inputs
 

package/harness/bundles/general/codebuddy/harness-archive/checklist.md

@@ -20,6 +20,12 @@ description: harness-archive 的归档前检查项和归档后验证项。仅在
 
 - [ ] 未在调用 finalize 前手工追加 archive 阶段边界
 - [ ] 只有一个未归档变更目录（多个时终止或让用户选择）
+- [ ] **最小必备集 blockers**（`harness_archive.py status`）：
+  - [ ] `plans/*-plan.md` 存在
+  - [ ] `events.ndjson` 存在且非空
+  - [ ] `evidence/verification-ledger.json` 存在
+  - [ ] 至少一个 test 或 review 报告/证据
+  - [ ] 若缺失：优先从 `.harness/cache/change-snapshots/<change>/` 恢复，禁止空壳归档
 - [ ] 变更目录下有 plans/ 子目录（至少有计划文件）
 - [ ] `events.ndjson` 存在；执行日志允许由 finalize 从事件流重新渲染（旧 archive 才兼容根目录 `execution-log.md`）
 - [ ] 准备生成 `archive-manifest-before.json`（path/size/sha256）

package/harness/bundles/general/codebuddy/harness-codebase-map/SKILL.md

@@ -3,7 +3,7 @@ name: harness-codebase-map
 description: 分析现有代码库并生成 .harness/codebase/map/
   下的结构化代码库地图。用于陌生项目理解、重大改造前梳理、harness-sync 提示 map 过期后的人工刷新。
 ---
-<!-- generated by harness_deploy.py; core=d5b51ad56d4d4535; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=5b9a3abb544f8fb2; overlay=none; agent=codebuddy; do not edit -->
 # harness-codebase-map — 代码库地图
 
 ## Purpose

package/harness/bundles/general/codebuddy/harness-knowledge-ingest/SKILL.md

@@ -3,7 +3,7 @@ name: harness-knowledge-ingest
 description: 从 .harness/archive 归档整理、同步和维护项目知识索引。适用场景：ingest knowledge、sync
   knowledge、rebuild knowledge index、promote knowledge、确认知识条目、检查知识库是否过期。
 ---
-<!-- generated by harness_deploy.py; core=d5b51ad56d4d4535; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=5b9a3abb544f8fb2; overlay=none; agent=codebuddy; do not edit -->
 # harness-knowledge-ingest
 
 从 `.harness/archive/**/reports/final/summary-data.json` 抽取项目知识，生成并维护本地 `.harness/knowledge/` 索引。

package/harness/bundles/general/codebuddy/harness-knowledge-query/SKILL.md

@@ -3,7 +3,7 @@ name: harness-knowledge-query
 description: 根据新需求、设计任务、代码修改请求或问题排查，在规划和编码前查询 .harness/knowledge
   历史上下文。适用场景：query knowledge、查找历史需求、根据归档理解需求、继续之前类似开发、生成需求上下文包。
 ---
-<!-- generated by harness_deploy.py; core=d5b51ad56d4d4535; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=5b9a3abb544f8fb2; overlay=none; agent=codebuddy; do not edit -->
 # harness-knowledge-query
 
 并行 change 中查询必须传 `--change <change-id>`；成功后以该 change 的 `meta/knowledge-context.json` 为稳定指针。全局 `context-packs/latest.json` 仅向后兼容，不得用于判断多个 active change 的上下文归属。

package/harness/bundles/general/codebuddy/harness-plan/SKILL.md

@@ -2,7 +2,7 @@
 name: harness-plan
 description: 将需求转化为设计文档+实施计划+完整测试场景表，必须在编码前完成。使用场景：需求分析、feature plan、技术方案设计、实现方案规划
 ---
-<!-- generated by harness_deploy.py; core=d5b51ad56d4d4535; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=5b9a3abb544f8fb2; overlay=none; agent=codebuddy; do not edit -->
 # harness-plan — 需求规划
 
 ## Purpose

package/harness/bundles/general/codebuddy/harness-review/SKILL.md

@@ -3,7 +3,7 @@ name: harness-review
 description: 6维度代码审查（架构/安全/规范/兼容/测试/性能），对照项目规则（见
   .harness/context-index.json）和测试场景表，在隔离上下文运行。使用场景：代码审查、提交前检查、合并评审
 ---
-<!-- generated by harness_deploy.py; core=d5b51ad56d4d4535; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=5b9a3abb544f8fb2; overlay=none; agent=codebuddy; do not edit -->
 # harness-review — 代码审查
 
 ## Purpose

package/harness/bundles/general/codebuddy/harness-run/SKILL.md

@@ -2,7 +2,7 @@
 name: harness-run
 description: 按变更簇执行 TDD 编码循环（RED→GREEN→REFACTOR→编译验证），逐变更簇实现计划中的任务。使用场景：开始编码、实现功能、写代码、TDD 编码
 ---
-<!-- generated by harness_deploy.py; core=d5b51ad56d4d4535; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=5b9a3abb544f8fb2; overlay=none; agent=codebuddy; do not edit -->
 # harness-run — 需求编码
 
 ## Purpose

package/harness/bundles/general/codebuddy/harness-submit/SKILL.md

@@ -3,7 +3,7 @@ name: harness-submit
 description: 最终提交封装：验证→中文 commit→提交/推送；worktree 模式含 --no-ff
   合并回主分支。使用场景：提交代码、commit、push、合并分支、merge to main、完成开发
 ---
-<!-- generated by harness_deploy.py; core=d5b51ad56d4d4535; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=5b9a3abb544f8fb2; overlay=none; agent=codebuddy; do not edit -->
 # harness-submit — 最终提交（含 worktree 合并）
 
 ## Purpose
@@ -79,12 +79,17 @@ M3. **merge** — `--no-ff` 合并 feature 分支；merge diff 出现其他 Chan
 M4. **verify** — 在 integration worktree 内执行组合态验证；他人提交引入或 ledger 不可复用时必跑
 M5. **push** — 仅在验证身份与远端基线仍匹配时 push；远端漂移 → `TARGET_MOVED` 结构化失败，不继续
 M6. **cleanup** — `git worktree remove --force` 精确路径 + 临时分支 + （push 成功后）保护 ref；释放 integration lock；失败保留 journal 与诊断证据；更新 `worktree.json`（`created=false` + removedAt）
+M6.5. **formal snapshot** — mergeFinalHash 写入后调用 `harness_paths.snapshot_change_formal_layer(projectRoot, changeId)`，备份到主仓 `.harness/cache/change-snapshots/<change>/`（不得写在 feature worktree 内）
 M7. **ledger + 收尾** — 经 `harness_ledger.py record` 写入 `mergeFinalHash`（= journal `pushedHead`）；**`harness_gate.py close --phase merge`**（禁止手工 phase.end）；提示 `/harness-archive`
 
-> Ledger v3（v2 契约 / split-v1 布局起）：`record` 强制顶层身份（`schemaVersion=3/repositoryId/baseCommit/currentHead/diffHash/ownershipHash`，缺失非零退出、不写账本）与 typed metrics；legacy 契约行为不变。详见 `../protocols/ledger-protocol.md` 第十节。
+> Ledger v3（v2 契约 / split-v1 布局起）：`record` 强制顶层身份（`schemaVersion=3/repositoryId/baseCommit/currentHead/diffHash/ownershipHash`，缺失非零退出、`LEDGER_IDENTITY_INVALID`，不写账本）与 typed metrics；legacy 契约行为不变。详见 `../protocols/ledger-protocol.md` 第十节。
 
 正常路径**禁止创建、应用或删除仓库级 stash**。中断恢复：`harness_integration.py status` 读 journal，`recover` 从首个未完成步骤续跑；protection refs 只在 push 成功后的 cleanup 删除。
 
+**失败 txn 回收（abandon）**：verify/push 未成功且 remote 不含 mergeCommit 时，运行 `harness_integration.py abandon --change … --run-id …`：清理 integrationRoot / temp branch / protection refs / lock；**绝不删除 feature worktree**。push 已成功或 remote 已含 merge → `ABANDON_REFUSED`，改走 cleanup。
+
+**清 feature worktree 迁根硬门槛（H-1/H-2）**：删除 feature worktree 前，若 Agent root / cwd 落在待删路径内，必须先 `move_agent_to_root(projectRoot)`（目标为主仓已存在的 `main`/`master`；**禁止**为迁根去 fetch 已删除的 feature 分支）。迁根失败 → **拒绝删除**。清理前调用 `harness_paths.assert_cleanup_safe(cleanupRoot, stateRoots, archiveRoots)`；state/archive（含 junction/symlink 解析后）落在 cleanup 内 → `CLEANUP_TOPOLOGY_REFUSED`。
+
 ## P0 执行可信度规则
 
 - 命令结果不得靠猜测；普通 Bash 被拒 → 立即改用等价 PowerShell 重试一次
@@ -116,6 +121,10 @@ test-tracking manifest 是 ignored test 的唯一强制暂存授权：只允许
 - **`git merge --no-ff` 固定**；禁止 fast-forward
 - **冲突不自动解** → 停下 → 用户手动解 → 确认后继续
 - **`mergeFinalHash`** = 主分支 push 后 HEAD；archive 优先读此字段
+- **迁根后再删 feature WT**：Agent 仍在待删 root 内则拒绝删除；目标分支已删时切主仓 `main`/`master`，禁止强行 fetch
+- **snapshot 后再清**：正式层已写入 `.harness/cache/change-snapshots/<change>/`
+- **拓扑安全**：`assert_cleanup_safe` 拒绝 state/archive ⊆ cleanup（含 junction）
+- **abandon ≠ cleanup**：仅失败 txn；永不删 feature worktree
 
 ### 五、Shell 安全 / 敏感信息 / 证据化
 

package/harness/bundles/general/codebuddy/harness-submit/checklist.md

@@ -369,6 +369,8 @@ powershell.exe -Command "python harness/scripts/harness_check_gate.py --write"
 
 ### 步骤 M5：push
 
+**硬门槛（eslint × feature worktree）**：integration / 主仓 `pre-push` 跑 `npm run check` 时，eslint 不得把 sibling `.worktrees/<change>/` 当成第二工程根（双 `tsconfigRootDir`）。本仓以 `eslint.config.mjs` 的 `.worktrees/**` ignore 为准；若自定义 eslint 未 ignore，须先 `move_agent_to_root(<projectRoot>)` 再清 feature worktree，再 push。
+
 ```powershell
 python harness/scripts/harness_integration.py push --change <change-name> --run-id <run-id> --feature-branch harness/<change-name> --target-branch <主分支> --temp-root <task-temp>
 ```
@@ -386,11 +388,26 @@ python harness/scripts/harness_integration.py cleanup --change <change-name> --r
 - 失败保留 journal 与诊断证据，状态 🟡WARN，不得宣称清理完成
 - 若存在 test-tracking manifest，确认其路径已由合并后的目标分支跟踪（`git ls-files --error-unmatch -- <exact-path>`），缺失即停止
 
+**失败 txn 改走 abandon（勿强行 cleanup）**：
+
+```powershell
+python harness/scripts/harness_integration.py abandon --change <change-name> --run-id <run-id> --feature-branch harness/<change-name> --target-branch <主分支> --temp-root <task-temp>
+```
+
+仅当 push ≠ DONE 且 remote 不含 mergeCommit；清理 integration 产物后可换新 run-id 重开。push 成功 → `ABANDON_REFUSED`。
+
 更新 `meta/worktree.json`：`created=false` + `removedAt`/`removedBy`/`removalNote`。
 
+**删除 feature worktree 前（硬门槛）**：
+
+1. 若 Agent root / cwd 落在待删 worktree → 先 `move_agent_to_root(<projectRoot>)`；目标为主仓，feature 分支已删则切 `main`/`master`，禁止 fetch 已不存在分支
+2. 迁根失败 → **停止删除**
+3. `assert_cleanup_safe(cleanupRoot, [.harness/changes/<id>, .harness/state/...], [.harness/archive])`；`CLEANUP_TOPOLOGY_REFUSED` → 停止
+4. mergeFinalHash 已写后先 `snapshot_change_formal_layer`，再清 feature WT
+
 ### 步骤 M7：更新 ledger + 收尾
 
-ledger 顶层写入 `"mergeFinalHash": "<journal pushedHead>"`；经 `harness_gate.py close --phase merge` 关闭（禁止手工 phase.end）。
+ledger 顶层写入 `"mergeFinalHash": "<journal pushedHead>"`；经 `harness_gate.py close --phase merge` 关闭（禁止手工 phase.end）。正式层快照确认存在于 `.harness/cache/change-snapshots/<change-name>/`。
 
 ```markdown
 ## 合并完成 — <change-name>
@@ -399,6 +416,7 @@ ledger 顶层写入 `"mergeFinalHash": "<journal pushedHead>"`；经 `harness_ga
 - 主分支 push: ✅（<old>..<new> → origin/<主分支>）
 - mergeFinalHash: `<merge-final-hash>`
 - 验证策略: 🔁REUSED / 🔄已重跑
-- worktree: 已清理
+- snapshot: `.harness/cache/change-snapshots/<change-name>/`
+- worktree: 已清理（迁根后）
 - 下一步: `/harness-archive`
 ```

package/harness/bundles/general/codebuddy/harness-sync/SKILL.md

@@ -2,7 +2,7 @@
 name: harness-sync
 description: 检查并更新项目AI元数据（CodeGraph索引、harness-codebase-map分析、CLAUDE.md、AGENTS.md、.harness/完整性），确保Claude对代码库的理解与最新代码一致。当用户说'同步/更新索引/刷新元数据/检查一致性'时使用
 ---
-<!-- generated by harness_deploy.py; core=d5b51ad56d4d4535; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=5b9a3abb544f8fb2; overlay=none; agent=codebuddy; do not edit -->
 # harness-sync — 元数据同步
 
 ## Purpose