@hunter-harness/workflow-harness 0.2.19 → 0.2.21

package/harness/bundles/general/codebuddy/scripts/harness_events.py

@@ -24,7 +24,7 @@ import tempfile
 import time
 import uuid
 from pathlib import Path
-from typing import Any
+from typing import Any, Sequence
 
 SCRIPTS_DIR = Path(__file__).resolve().parent
 if str(SCRIPTS_DIR) not in sys.path:
@@ -595,6 +595,132 @@ def append_event(
     return {"ok": True, "event": event, "events_path": str(events_path_obj), "rendered": False}
 
 
+def batch_append_events(
+    change_dir: Path,
+    events: Sequence[dict[str, Any]],
+) -> dict[str, Any]:
+    """Validate then append many events under one lock (Wave-2 H-15).
+
+    Any invalid item aborts the whole batch before mutation. ``phase.end`` items
+    are rejected here — use single ``append`` so render semantics stay explicit.
+    """
+    if not isinstance(events, (list, tuple)) or not events:
+        return {
+            "ok": False,
+            "code": "BATCH_EMPTY",
+            "message": "batch-append requires a non-empty events array",
+        }
+    archived = archived_change_dir(change_dir)
+    if archived is not None:
+        return {
+            "ok": False,
+            "code": "ARCHIVED_CHANGE_IMMUTABLE",
+            "message": str(archived),
+        }
+
+    built: list[dict[str, Any]] = []
+    for index, raw in enumerate(events):
+        if not isinstance(raw, dict):
+            return {
+                "ok": False,
+                "code": "BATCH_ITEM_INVALID",
+                "message": f"events[{index}] must be an object",
+                "index": index,
+            }
+        type_ = str(raw.get("type") or "").strip()
+        phase = str(raw.get("phase") or "").strip()
+        if not type_ or type_ not in EVENT_TYPES:
+            return {
+                "ok": False,
+                "code": "EVENT_TYPE_INVALID",
+                "message": f"events[{index}]: unsupported type: {type_}",
+                "index": index,
+            }
+        if not phase:
+            return {
+                "ok": False,
+                "code": "EVENT_REQUIRED_FIELD",
+                "message": f"events[{index}]: phase required",
+                "index": index,
+            }
+        if type_ == "phase.end":
+            return {
+                "ok": False,
+                "code": "BATCH_PHASE_END_FORBIDDEN",
+                "message": f"events[{index}]: phase.end must use single append",
+                "index": index,
+            }
+        args = argparse.Namespace(
+            change_dir=str(change_dir),
+            phase=phase,
+            type=type_,
+            note=raw.get("note"),
+            kind=raw.get("kind"),
+            path=raw.get("path"),
+            run_id=raw.get("run_id"),
+            executor_tool=raw.get("executor_tool"),
+            command=raw.get("command"),
+            exit_code=raw.get("exit_code"),
+            duration_ms=raw.get("duration_ms"),
+            status=raw.get("status"),
+            name=raw.get("name"),
+            code=raw.get("code"),
+            severity=raw.get("severity"),
+            message=raw.get("message"),
+            decision=raw.get("decision"),
+            reason=raw.get("reason"),
+            issue_id=raw.get("issue_id"),
+            scope=raw.get("scope"),
+            target_event_id=raw.get("target_event_id"),
+            target_field=raw.get("target_field"),
+            old_value_hash=raw.get("old_value_hash"),
+            new_value_json=raw.get("new_value_json"),
+            renamed_from=raw.get("renamed_from"),
+            renamed_to=raw.get("renamed_to"),
+            change_uuid=raw.get("change_uuid"),
+            attempt=raw.get("attempt"),
+            executor_agent=raw.get("executor_agent"),
+            executor_model=raw.get("executor_model"),
+            handoff_from_tool=raw.get("handoff_from_tool"),
+            handoff_reason=raw.get("handoff_reason"),
+            trace_id=raw.get("trace_id"),
+            span_id=raw.get("span_id"),
+            parent_span_id=raw.get("parent_span_id"),
+            runner_ms=raw.get("runner_ms"),
+            orchestration_active_ms=raw.get("orchestration_active_ms"),
+            wall_clock_ms=raw.get("wall_clock_ms"),
+            user_wait_ms=raw.get("user_wait_ms"),
+            legacy_lenient=False,
+            json=True,
+        )
+        validation = validate_append_event(args)
+        if validation:
+            error_code, message = validation
+            return {
+                "ok": False,
+                "code": error_code,
+                "message": f"events[{index}]: {message}",
+                "index": index,
+            }
+        built.append(build_event(args, []))
+
+    events_path_obj = events_path(change_dir)
+    lock_path = events_path_obj.with_name(events_path_obj.name + ".lock")
+    with event_file_lock(lock_path):
+        for event in built:
+            atomic_append_line(
+                events_path_obj, json.dumps(event, ensure_ascii=False, separators=(",", ":"))
+            )
+    return {
+        "ok": True,
+        "action": "batch-append",
+        "count": len(built),
+        "events": built,
+        "events_path": str(events_path_obj),
+        "rendered": False,
+    }
+
+
 def build_event(args: argparse.Namespace, existing: list[dict[str, Any]]) -> dict[str, Any]:
     event: dict[str, Any] = {
         "schema_version": SCHEMA_VERSION,
@@ -1295,6 +1421,25 @@ def cmd_append(args: argparse.Namespace) -> int:
     return 0
 
 
+def cmd_batch_append(args: argparse.Namespace) -> int:
+    as_json = bool(args.json)
+    change_dir = resolve_change_dir(args.change_dir)
+    batch_path = Path(str(args.file)).expanduser()
+    try:
+        raw = json.loads(batch_path.read_text(encoding="utf-8-sig"))
+    except (OSError, json.JSONDecodeError) as exc:
+        return emit_error(f"batch-append failed to read --file: {exc}", as_json=as_json)
+    result = batch_append_events(change_dir, raw if isinstance(raw, list) else [])
+    if not result.get("ok"):
+        return emit_error(
+            str(result.get("message") or "batch-append failed"),
+            as_json=as_json,
+            error_code=str(result.get("code") or "BATCH_APPEND_FAILED"),
+        )
+    emit_json(result, as_json=as_json)
+    return 0
+
+
 def cmd_render(args: argparse.Namespace) -> int:
     as_json = bool(args.json)
     change_dir = resolve_change_dir(args.change_dir)
@@ -1395,6 +1540,19 @@ def build_parser() -> argparse.ArgumentParser:
     )
     p_append.set_defaults(func=cmd_append)
 
+    p_batch = sub.add_parser(
+        "batch-append",
+        parents=[common],
+        help="validate and append many events under one lock (H-15)",
+    )
+    p_batch.add_argument("--change-dir", required=True)
+    p_batch.add_argument(
+        "--file",
+        required=True,
+        help="JSON file containing a non-empty array of event objects",
+    )
+    p_batch.set_defaults(func=cmd_batch_append)
+
     p_render = sub.add_parser(
         "render",
         parents=[common],

package/harness/bundles/general/codebuddy/scripts/harness_integration.py

@@ -862,8 +862,42 @@ class IntegrationTransaction:
 
         return self._run_step("merge", action)
 
+    def _required_on_merge_commands(self) -> list[list[str]]:
+        """Load build-profile mergeVerification.requiredOnMerge (Wave-2 H-9)."""
+        import harness_profile
+
+        profile = harness_profile.load_profile(self.project_root)
+        if not isinstance(profile, dict):
+            return []
+        merge = profile.get("mergeVerification")
+        if not isinstance(merge, dict):
+            return []
+        required = merge.get("requiredOnMerge")
+        if not isinstance(required, list):
+            return []
+        commands: list[list[str]] = []
+        for index, item in enumerate(required):
+            if isinstance(item, str) and item.strip():
+                commands.append(shlex.split(item.strip()))
+                continue
+            if not isinstance(item, dict):
+                raise ValueError(f"requiredOnMerge[{index}] must be string or object")
+            raw = item.get("command")
+            if isinstance(raw, list) and raw and all(isinstance(x, str) and x for x in raw):
+                commands.append([str(x) for x in raw])
+            elif isinstance(raw, str) and raw.strip():
+                commands.append(shlex.split(raw.strip()))
+            else:
+                raise ValueError(f"requiredOnMerge[{index}].command missing")
+        return commands
+
     def verify(self, commands: Sequence[Sequence[str]] | None = None) -> dict[str, Any]:
         commands = list(commands or [])
+        # Wave-2 H-9: append profile mergeVerification.requiredOnMerge commands.
+        try:
+            commands.extend(self._required_on_merge_commands())
+        except Exception as exc:  # noqa: BLE001 — surface as verify plan error
+            raise VerifyPlanMissingError(f"mergeVerification load failed: {exc}") from exc
 
         def action(journal: dict[str, Any]) -> None:
             if not commands or any(

package/harness/bundles/general/codebuddy/scripts/harness_ledger.py

@@ -28,6 +28,7 @@ if str(SCRIPTS_DIR) not in sys.path:
     sys.path.insert(0, str(SCRIPTS_DIR))
 
 import harness_paths  # noqa: E402
+import harness_profile  # noqa: E402
 
 
 if hasattr(sys.stdout, "reconfigure"):
@@ -534,18 +535,30 @@ def expand_profile_input_files(
 ) -> tuple[list[str], str | None]:
     """Expand verificationInputs[profile_input] globs from build-profile.json.
 
-    Globs are relative to project; only files inside project are kept
-    (deduped, path-sorted). Returns (files, error); error is None on success.
+    Profile is loaded via ``harness_profile.load_profile`` (C7: common_root then
+    execution overlay) so linked worktrees without a local build-profile still
+    reuse the main checkout profile. Globs remain relative to the execution
+    ``project`` root (not common_root) so inputsHash tracks the tree under test.
+
+    Returns (files, error); error is None on success.
     profile 缺失 / key 缺失 / glob 无匹配 / 结果为空 → 返回 ([], "<reason>")，
     调用方据此返回 insufficient-evidence，执行全量测试但不允许缓存复用。
     """
-    profile_path = project / ".harness" / "config" / "build-profile.json"
-    if not profile_path.is_file():
+    profile = harness_profile.load_profile(Path(project))
+    if profile is None:
+        # load_profile swallows JSON errors; restore actionable unreadable diag
+        # when a profile file exists but cannot be parsed (review YELLOW-1).
+        project_root = Path(project).resolve()
+        common = harness_paths.common_root(project_root)
+        for root in (common, project_root):
+            candidate = root / ".harness" / "config" / "build-profile.json"
+            if not candidate.is_file():
+                continue
+            try:
+                json.loads(candidate.read_text(encoding="utf-8-sig"))
+            except (OSError, json.JSONDecodeError) as exc:
+                return [], f"build-profile.json unreadable: {exc}"
         return [], "build-profile.json missing; run harness_preflight.py detect"
-    try:
-        profile = json.loads(profile_path.read_text(encoding="utf-8-sig"))
-    except (OSError, json.JSONDecodeError) as exc:
-        return [], f"build-profile.json unreadable: {exc}"
     if not isinstance(profile, dict):
         return [], "build-profile.json is not an object"
     inputs = profile.get("verificationInputs")
@@ -555,7 +568,7 @@ def expand_profile_input_files(
     if not isinstance(patterns, list) or not patterns:
         return [], f"verificationInputs.{profile_input} is empty or invalid"
 
-    base = project.resolve()
+    base = Path(project).resolve()
     seen: set[str] = set()
     for pat in patterns:
         if not isinstance(pat, str) or not pat.strip():
@@ -1042,6 +1055,7 @@ def decide_can_reuse(
     requested_toolchain_hash: str | None = None,
     requested_profile_hash: str | None = None,
     requested_environment_hash: str | None = None,
+    requested_db_schema_hash: str | None = None,
 ) -> dict[str, Any]:
     ledger, ledger_path = load_ledger(change_dir)
     if ledger is None:
@@ -1170,6 +1184,7 @@ def decide_can_reuse(
         ("toolchainHash", requested_toolchain_hash, "TOOLCHAIN_CHANGED"),
         ("profileHash", requested_profile_hash, "PROFILE_CHANGED"),
         ("environmentHash", requested_environment_hash, "ENVIRONMENT_CHANGED"),
+        ("dbSchemaHash", requested_db_schema_hash, "DB_SCHEMA_CHANGED"),
     ):
         stored = entry.get(field)
         if (
@@ -1236,6 +1251,7 @@ def decide_can_reuse(
         "reuse": True,
         "reason": "reuse",
         "code": "REUSED",
+        "invalidationCode": None,
         "verification": verification,
         "ledger_path": str(ledger_path) if ledger_path else None,
         "inputsHash": stored_hash,
@@ -1245,6 +1261,90 @@ def decide_can_reuse(
     }
 
 
+_INVALIDATION_ALIASES = {
+    "INPUTS_HASH_CHANGED": "INPUT_CHANGED",
+    "ENVIRONMENT_CHANGED": "ENV_CHANGED",
+    "MISSING_FIELDS": "MISSING_IDENTITY_FIELD",
+    "MISSING_V2_FIELDS": "MISSING_IDENTITY_FIELD",
+    "LEDGER_MISSING": "MISSING_IDENTITY_FIELD",
+    "VALIDATIONS_MISSING": "MISSING_IDENTITY_FIELD",
+    "VALIDATION_MISSING": "MISSING_IDENTITY_FIELD",
+}
+
+
+def _attach_invalidation_code(payload: dict[str, Any]) -> dict[str, Any]:
+    """Wave-2 H-9: expose stable invalidationCode alongside legacy code."""
+    if payload.get("reuse") is True:
+        payload.setdefault("invalidationCode", None)
+        return payload
+    code = str(payload.get("code") or "").strip()
+    if code:
+        payload["invalidationCode"] = _INVALIDATION_ALIASES.get(code, code)
+    return payload
+
+
+def verification_graph_path(change_dir: Path) -> Path:
+    return Path(change_dir) / "evidence" / "verification-graph.json"
+
+
+def upsert_verification_graph_node(
+    change_dir: Path,
+    *,
+    verification: str,
+    status: str,
+    inputs_hash: str,
+    command: str | None = None,
+    toolchain_hash: str | None = None,
+    environment_hash: str | None = None,
+    db_schema_hash: str | None = None,
+    diff_hash: str | None = None,
+) -> dict[str, Any]:
+    """Persist a verification graph node keyed by canonical identity (H-9)."""
+    path = verification_graph_path(change_dir)
+    path.parent.mkdir(parents=True, exist_ok=True)
+    graph: dict[str, Any]
+    if path.is_file():
+        try:
+            loaded = json.loads(path.read_text(encoding="utf-8-sig"))
+            graph = loaded if isinstance(loaded, dict) else {"schemaVersion": 1, "nodes": []}
+        except (OSError, json.JSONDecodeError):
+            graph = {"schemaVersion": 1, "nodes": []}
+    else:
+        graph = {"schemaVersion": 1, "nodes": []}
+    nodes = graph.get("nodes")
+    if not isinstance(nodes, list):
+        nodes = []
+    identity = {
+        "verification": verification,
+        "inputsHash": inputs_hash,
+        "command": command,
+        "toolchainHash": toolchain_hash,
+        "environmentHash": environment_hash,
+        "dbSchemaHash": db_schema_hash,
+        "diffHash": diff_hash,
+    }
+    node = {
+        "identity": identity,
+        "status": status,
+        "recordedAt": dt.datetime.now().astimezone().isoformat(timespec="milliseconds"),
+    }
+    replaced = False
+    for index, existing in enumerate(nodes):
+        if not isinstance(existing, dict):
+            continue
+        existing_id = existing.get("identity")
+        if isinstance(existing_id, dict) and existing_id == identity:
+            nodes[index] = node
+            replaced = True
+            break
+    if not replaced:
+        nodes.append(node)
+    graph["schemaVersion"] = 1
+    graph["nodes"] = nodes
+    write_ledger(path, graph)  # atomic json write helper already used for ledger
+    return {"ok": True, "path": str(path), "nodeCount": len(nodes), "replaced": replaced}
+
+
 def cmd_hash(args: argparse.Namespace) -> int:
     as_json = bool(args.json)
     try:
@@ -1317,10 +1417,12 @@ def cmd_can_reuse(args: argparse.Namespace) -> int:
             requested_toolchain_hash=getattr(args, "toolchain_hash", None),
             requested_profile_hash=getattr(args, "profile_hash", None),
             requested_environment_hash=getattr(args, "environment_hash", None),
+            requested_db_schema_hash=getattr(args, "db_schema_hash", None),
         )
     except (OSError, ValueError, json.JSONDecodeError) as exc:
         return emit_error(f"can-reuse failed: {exc}", as_json=as_json)
 
+    payload = _attach_invalidation_code(payload)
     emit_compact_or_verbose(
         payload, as_json=as_json, verbose=verbose,
         compact_fn=_compact_can_reuse_payload,
@@ -1457,6 +1559,7 @@ def cmd_record(args: argparse.Namespace) -> int:
             ("toolchainHash", "toolchain_hash"),
             ("profileHash", "profile_hash"),
             ("environmentHash", "environment_hash"),
+            ("dbSchemaHash", "db_schema_hash"),
         ):
             val = getattr(args, attr, None)
             if _nonempty_str(val):
@@ -1535,6 +1638,37 @@ def cmd_record(args: argparse.Namespace) -> int:
                     extra={"missing": missing},
                 )
         write_ledger(out_path, ledger)
+        try:
+            upsert_verification_graph_node(
+                change_dir,
+                verification=verification,
+                status=str(status),
+                inputs_hash=str(inputs_hash),
+                command=str(entry.get("command") or "") or None,
+                toolchain_hash=(
+                    str(entry.get("toolchainHash")).strip()
+                    if _nonempty_str(entry.get("toolchainHash"))
+                    else None
+                ),
+                environment_hash=(
+                    str(entry.get("environmentHash")).strip()
+                    if _nonempty_str(entry.get("environmentHash"))
+                    else None
+                ),
+                db_schema_hash=(
+                    str(entry.get("dbSchemaHash")).strip()
+                    if _nonempty_str(entry.get("dbSchemaHash"))
+                    else None
+                ),
+                diff_hash=(
+                    str(ledger.get("diffHash")).strip()
+                    if _nonempty_str(ledger.get("diffHash"))
+                    else None
+                ),
+            )
+        except (OSError, ValueError, TypeError):
+            # Graph is advisory persistence; ledger write already succeeded.
+            pass
     except (OSError, ValueError, FileNotFoundError, json.JSONDecodeError) as exc:
         return emit_error(f"record failed: {exc}", as_json=as_json)
 
@@ -1654,6 +1788,11 @@ def build_parser() -> argparse.ArgumentParser:
         default=None,
         help="optional environment hash to compare against ledger entry (UT-017)",
     )
+    p_reuse.add_argument(
+        "--db-schema-hash",
+        default=None,
+        help="optional DB schema hash to compare against ledger entry (H-9)",
+    )
     p_reuse.add_argument(
         "--verbose",
         action="store_true",
@@ -1695,6 +1834,7 @@ def build_parser() -> argparse.ArgumentParser:
     p_record.add_argument("--toolchain-hash", default=None)
     p_record.add_argument("--profile-hash", default=None)
     p_record.add_argument("--environment-hash", default=None)
+    p_record.add_argument("--db-schema-hash", default=None)
     p_record.add_argument("--deploy-artifact", default=None, help="package: built artifact path")
     p_record.add_argument("--artifact-hash", default=None, help="package: artifact sha256")
     p_record.add_argument(