@hunter-harness/workflow-harness 0.2.20 → 0.2.21

package/harness/bundles/java/cursor/scripts/harness_ledger.py

@@ -1055,6 +1055,7 @@ def decide_can_reuse(
     requested_toolchain_hash: str | None = None,
     requested_profile_hash: str | None = None,
     requested_environment_hash: str | None = None,
+    requested_db_schema_hash: str | None = None,
 ) -> dict[str, Any]:
     ledger, ledger_path = load_ledger(change_dir)
     if ledger is None:
@@ -1183,6 +1184,7 @@ def decide_can_reuse(
         ("toolchainHash", requested_toolchain_hash, "TOOLCHAIN_CHANGED"),
         ("profileHash", requested_profile_hash, "PROFILE_CHANGED"),
         ("environmentHash", requested_environment_hash, "ENVIRONMENT_CHANGED"),
+        ("dbSchemaHash", requested_db_schema_hash, "DB_SCHEMA_CHANGED"),
     ):
         stored = entry.get(field)
         if (
@@ -1249,6 +1251,7 @@ def decide_can_reuse(
         "reuse": True,
         "reason": "reuse",
         "code": "REUSED",
+        "invalidationCode": None,
         "verification": verification,
         "ledger_path": str(ledger_path) if ledger_path else None,
         "inputsHash": stored_hash,
@@ -1258,6 +1261,90 @@ def decide_can_reuse(
     }
 
 
+_INVALIDATION_ALIASES = {
+    "INPUTS_HASH_CHANGED": "INPUT_CHANGED",
+    "ENVIRONMENT_CHANGED": "ENV_CHANGED",
+    "MISSING_FIELDS": "MISSING_IDENTITY_FIELD",
+    "MISSING_V2_FIELDS": "MISSING_IDENTITY_FIELD",
+    "LEDGER_MISSING": "MISSING_IDENTITY_FIELD",
+    "VALIDATIONS_MISSING": "MISSING_IDENTITY_FIELD",
+    "VALIDATION_MISSING": "MISSING_IDENTITY_FIELD",
+}
+
+
+def _attach_invalidation_code(payload: dict[str, Any]) -> dict[str, Any]:
+    """Wave-2 H-9: expose stable invalidationCode alongside legacy code."""
+    if payload.get("reuse") is True:
+        payload.setdefault("invalidationCode", None)
+        return payload
+    code = str(payload.get("code") or "").strip()
+    if code:
+        payload["invalidationCode"] = _INVALIDATION_ALIASES.get(code, code)
+    return payload
+
+
+def verification_graph_path(change_dir: Path) -> Path:
+    return Path(change_dir) / "evidence" / "verification-graph.json"
+
+
+def upsert_verification_graph_node(
+    change_dir: Path,
+    *,
+    verification: str,
+    status: str,
+    inputs_hash: str,
+    command: str | None = None,
+    toolchain_hash: str | None = None,
+    environment_hash: str | None = None,
+    db_schema_hash: str | None = None,
+    diff_hash: str | None = None,
+) -> dict[str, Any]:
+    """Persist a verification graph node keyed by canonical identity (H-9)."""
+    path = verification_graph_path(change_dir)
+    path.parent.mkdir(parents=True, exist_ok=True)
+    graph: dict[str, Any]
+    if path.is_file():
+        try:
+            loaded = json.loads(path.read_text(encoding="utf-8-sig"))
+            graph = loaded if isinstance(loaded, dict) else {"schemaVersion": 1, "nodes": []}
+        except (OSError, json.JSONDecodeError):
+            graph = {"schemaVersion": 1, "nodes": []}
+    else:
+        graph = {"schemaVersion": 1, "nodes": []}
+    nodes = graph.get("nodes")
+    if not isinstance(nodes, list):
+        nodes = []
+    identity = {
+        "verification": verification,
+        "inputsHash": inputs_hash,
+        "command": command,
+        "toolchainHash": toolchain_hash,
+        "environmentHash": environment_hash,
+        "dbSchemaHash": db_schema_hash,
+        "diffHash": diff_hash,
+    }
+    node = {
+        "identity": identity,
+        "status": status,
+        "recordedAt": dt.datetime.now().astimezone().isoformat(timespec="milliseconds"),
+    }
+    replaced = False
+    for index, existing in enumerate(nodes):
+        if not isinstance(existing, dict):
+            continue
+        existing_id = existing.get("identity")
+        if isinstance(existing_id, dict) and existing_id == identity:
+            nodes[index] = node
+            replaced = True
+            break
+    if not replaced:
+        nodes.append(node)
+    graph["schemaVersion"] = 1
+    graph["nodes"] = nodes
+    write_ledger(path, graph)  # atomic json write helper already used for ledger
+    return {"ok": True, "path": str(path), "nodeCount": len(nodes), "replaced": replaced}
+
+
 def cmd_hash(args: argparse.Namespace) -> int:
     as_json = bool(args.json)
     try:
@@ -1330,10 +1417,12 @@ def cmd_can_reuse(args: argparse.Namespace) -> int:
             requested_toolchain_hash=getattr(args, "toolchain_hash", None),
             requested_profile_hash=getattr(args, "profile_hash", None),
             requested_environment_hash=getattr(args, "environment_hash", None),
+            requested_db_schema_hash=getattr(args, "db_schema_hash", None),
         )
     except (OSError, ValueError, json.JSONDecodeError) as exc:
         return emit_error(f"can-reuse failed: {exc}", as_json=as_json)
 
+    payload = _attach_invalidation_code(payload)
     emit_compact_or_verbose(
         payload, as_json=as_json, verbose=verbose,
         compact_fn=_compact_can_reuse_payload,
@@ -1470,6 +1559,7 @@ def cmd_record(args: argparse.Namespace) -> int:
             ("toolchainHash", "toolchain_hash"),
             ("profileHash", "profile_hash"),
             ("environmentHash", "environment_hash"),
+            ("dbSchemaHash", "db_schema_hash"),
         ):
             val = getattr(args, attr, None)
             if _nonempty_str(val):
@@ -1548,6 +1638,37 @@ def cmd_record(args: argparse.Namespace) -> int:
                     extra={"missing": missing},
                 )
         write_ledger(out_path, ledger)
+        try:
+            upsert_verification_graph_node(
+                change_dir,
+                verification=verification,
+                status=str(status),
+                inputs_hash=str(inputs_hash),
+                command=str(entry.get("command") or "") or None,
+                toolchain_hash=(
+                    str(entry.get("toolchainHash")).strip()
+                    if _nonempty_str(entry.get("toolchainHash"))
+                    else None
+                ),
+                environment_hash=(
+                    str(entry.get("environmentHash")).strip()
+                    if _nonempty_str(entry.get("environmentHash"))
+                    else None
+                ),
+                db_schema_hash=(
+                    str(entry.get("dbSchemaHash")).strip()
+                    if _nonempty_str(entry.get("dbSchemaHash"))
+                    else None
+                ),
+                diff_hash=(
+                    str(ledger.get("diffHash")).strip()
+                    if _nonempty_str(ledger.get("diffHash"))
+                    else None
+                ),
+            )
+        except (OSError, ValueError, TypeError):
+            # Graph is advisory persistence; ledger write already succeeded.
+            pass
     except (OSError, ValueError, FileNotFoundError, json.JSONDecodeError) as exc:
         return emit_error(f"record failed: {exc}", as_json=as_json)
 
@@ -1667,6 +1788,11 @@ def build_parser() -> argparse.ArgumentParser:
         default=None,
         help="optional environment hash to compare against ledger entry (UT-017)",
     )
+    p_reuse.add_argument(
+        "--db-schema-hash",
+        default=None,
+        help="optional DB schema hash to compare against ledger entry (H-9)",
+    )
     p_reuse.add_argument(
         "--verbose",
         action="store_true",
@@ -1708,6 +1834,7 @@ def build_parser() -> argparse.ArgumentParser:
     p_record.add_argument("--toolchain-hash", default=None)
     p_record.add_argument("--profile-hash", default=None)
     p_record.add_argument("--environment-hash", default=None)
+    p_record.add_argument("--db-schema-hash", default=None)
     p_record.add_argument("--deploy-artifact", default=None, help="package: built artifact path")
     p_record.add_argument("--artifact-hash", default=None, help="package: artifact sha256")
     p_record.add_argument(

package/harness/bundles/java/cursor/scripts/harness_migration_head.py

@@ -0,0 +1,220 @@
+#!/usr/bin/env python3
+"""Migration head single-source consistency check (Wave-2 H-7).
+
+Canonical file (default ``.harness/config/migration-head.json``)::
+
+    {
+      "schemaVersion": 1,
+      "head": "005_example",
+      "sources": [
+        {"path": "backend/app/config.py", "pattern": "EXPECTED_ALEMBIC_HEAD\\s*=\\s*[\\\"']([^\\\"']+)[\\\"']"},
+        {"path": "integration/manifest.json", "jsonPointer": "/migrationHead"}
+      ]
+    }
+
+Each source must resolve to the same ``head`` value. This harness repo may not
+ship alembic; consumer projects declare the canonical file and run::
+
+    python harness_migration_head.py check --project . --json
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import sys
+from pathlib import Path
+from typing import Any
+
+DEFAULT_REL = ".harness/config/migration-head.json"
+
+
+def emit_json(payload: dict[str, Any], *, as_json: bool) -> None:
+    if as_json:
+        sys.stdout.write(json.dumps(payload, ensure_ascii=False, indent=2) + "\n")
+    else:
+        code = payload.get("code") or ("OK" if payload.get("ok") else "FAIL")
+        sys.stdout.write(f"{code}\n")
+
+
+def emit_error(code: str, message: str, *, as_json: bool, extra: dict[str, Any] | None = None) -> int:
+    payload: dict[str, Any] = {"ok": False, "code": code, "message": message}
+    if extra:
+        payload.update(extra)
+    stream = sys.stdout if as_json else sys.stderr
+    if as_json:
+        stream.write(json.dumps(payload, ensure_ascii=False, indent=2) + "\n")
+    else:
+        stream.write(f"{code}: {message}\n")
+    return 1
+
+
+def _read_json_pointer(data: Any, pointer: str) -> Any:
+    if not pointer.startswith("/"):
+        raise ValueError(f"jsonPointer must start with /: {pointer}")
+    cur = data
+    for part in pointer.lstrip("/").split("/"):
+        part = part.replace("~1", "/").replace("~0", "~")
+        if isinstance(cur, dict) and part in cur:
+            cur = cur[part]
+        else:
+            raise KeyError(pointer)
+    return cur
+
+
+def _extract_source(project: Path, source: dict[str, Any]) -> str:
+    rel = str(source.get("path") or "").strip().replace("\\", "/")
+    if not rel or rel.startswith("/") or ".." in rel.split("/"):
+        raise ValueError(f"invalid source path: {rel}")
+    target = (project / rel).resolve()
+    try:
+        target.relative_to(project.resolve())
+    except ValueError as exc:
+        raise ValueError(f"source escapes project: {rel}") from exc
+    if not target.is_file():
+        raise FileNotFoundError(rel)
+    text = target.read_text(encoding="utf-8-sig")
+    if "jsonPointer" in source and source["jsonPointer"]:
+        data = json.loads(text)
+        value = _read_json_pointer(data, str(source["jsonPointer"]))
+        if value is None or (isinstance(value, str) and not value.strip()):
+            raise ValueError(f"empty value at {source['jsonPointer']} in {rel}")
+        return str(value).strip()
+    pattern = str(source.get("pattern") or "").strip()
+    if not pattern:
+        raise ValueError(f"source {rel} requires pattern or jsonPointer")
+    match = re.search(pattern, text, flags=re.MULTILINE)
+    if not match:
+        raise ValueError(f"pattern did not match in {rel}")
+    return str(match.group(1) if match.lastindex else match.group(0)).strip()
+
+
+def check_migration_head(
+    project: Path,
+    *,
+    config_rel: str = DEFAULT_REL,
+) -> dict[str, Any]:
+    project = project.resolve()
+    config_path = (project / config_rel).resolve()
+    try:
+        config_path.relative_to(project)
+    except ValueError:
+        return {
+            "ok": False,
+            "code": "MIGRATION_HEAD_CONFIG_ESCAPE",
+            "message": f"config path escapes project: {config_rel}",
+        }
+    if not config_path.is_file():
+        return {
+            "ok": False,
+            "code": "MIGRATION_HEAD_MISSING",
+            "message": f"canonical migration-head file missing: {config_rel}",
+            "configPath": str(config_path),
+        }
+    try:
+        data = json.loads(config_path.read_text(encoding="utf-8-sig"))
+    except (OSError, json.JSONDecodeError) as exc:
+        return {
+            "ok": False,
+            "code": "MIGRATION_HEAD_UNREADABLE",
+            "message": str(exc),
+            "configPath": str(config_path),
+        }
+    if not isinstance(data, dict) or data.get("schemaVersion") != 1:
+        return {
+            "ok": False,
+            "code": "MIGRATION_HEAD_SCHEMA_INVALID",
+            "message": "migration-head.json must be schemaVersion 1 object",
+            "configPath": str(config_path),
+        }
+    head = str(data.get("head") or "").strip()
+    sources = data.get("sources")
+    if not head:
+        return {
+            "ok": False,
+            "code": "MIGRATION_HEAD_EMPTY",
+            "message": "head must be a non-empty string",
+            "configPath": str(config_path),
+        }
+    if not isinstance(sources, list) or not sources:
+        return {
+            "ok": False,
+            "code": "MIGRATION_HEAD_SOURCES_EMPTY",
+            "message": "sources must be a non-empty array",
+            "configPath": str(config_path),
+        }
+
+    observed: list[dict[str, Any]] = []
+    drifts: list[dict[str, Any]] = []
+    for index, source in enumerate(sources):
+        if not isinstance(source, dict):
+            return {
+                "ok": False,
+                "code": "MIGRATION_HEAD_SOURCE_INVALID",
+                "message": f"sources[{index}] must be an object",
+            }
+        try:
+            value = _extract_source(project, source)
+        except (OSError, ValueError, KeyError, json.JSONDecodeError) as exc:
+            return {
+                "ok": False,
+                "code": "MIGRATION_HEAD_SOURCE_UNREADABLE",
+                "message": str(exc),
+                "index": index,
+                "path": source.get("path"),
+            }
+        item = {"path": source.get("path"), "value": value}
+        observed.append(item)
+        if value != head:
+            drifts.append({**item, "expected": head})
+
+    if drifts:
+        return {
+            "ok": False,
+            "code": "MIGRATION_HEAD_DRIFT",
+            "message": "one or more sources disagree with canonical head",
+            "head": head,
+            "drifts": drifts,
+            "observed": observed,
+            "configPath": str(config_path),
+        }
+    return {
+        "ok": True,
+        "code": "MIGRATION_HEAD_OK",
+        "head": head,
+        "observed": observed,
+        "configPath": str(config_path),
+        "sourceCount": len(observed),
+    }
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(prog="harness_migration_head.py")
+    sub = parser.add_subparsers(dest="command", required=True)
+    check = sub.add_parser("check", help="verify sources match canonical head")
+    check.add_argument("--project", required=True)
+    check.add_argument("--config", default=DEFAULT_REL)
+    check.add_argument("--json", action="store_true")
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = build_parser().parse_args(argv)
+    as_json = bool(getattr(args, "json", False))
+    if args.command == "check":
+        result = check_migration_head(Path(args.project), config_rel=str(args.config))
+        if not result.get("ok"):
+            return emit_error(
+                str(result.get("code") or "MIGRATION_HEAD_FAIL"),
+                str(result.get("message") or "check failed"),
+                as_json=as_json,
+                extra={k: v for k, v in result.items() if k not in {"ok", "code", "message"}},
+            )
+        emit_json(result, as_json=as_json)
+        return 0
+    return emit_error("UNKNOWN_COMMAND", f"unknown command: {args.command}", as_json=as_json)
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/harness/manifests/general/claude-code.json

@@ -7,7 +7,7 @@
   "files": [
     {
       "path": ".harness-build.json",
-      "sha256": "164e3dc420cf0c1297b2107160216e08a03966f12dc24dccb65cfaadf2d8b6de"
+      "sha256": "830e24478800623aa6989bbde0b7fd4cf85f1956647556fae2a75b6274ee938d"
     },
     {
       "path": "agents/harness-evaluator.md",
@@ -23,7 +23,7 @@
     },
     {
       "path": "CONTEXT.md",
-      "sha256": "2318aba4ff5ae4db0a0bff6380d1e9f4ed697caf9a4b2c1458ad2cdda1acb9e8"
+      "sha256": "4838854cc45e8bd47552fb34e41cadca3121eeaa4597196568f35e25534d5a33"
     },
     {
       "path": "contracts/ci-metrics.schema.json",
@@ -47,7 +47,7 @@
     },
     {
       "path": "harness-archive/SKILL.md",
-      "sha256": "de3cdccf65400963dd3a8a5d2eb41a422ed1cef951c43e7896e016a26d471392"
+      "sha256": "3a140ee15487b686c80ab0a92c3d1d3af196d60c1d625aeeb63daf60929668e1"
     },
     {
       "path": "harness-archive/templates/render-summary.mjs",
@@ -67,7 +67,7 @@
     },
     {
       "path": "harness-codebase-map/SKILL.md",
-      "sha256": "c67a91e1f274a29cea77d1da8f602a889fb9085e7a82370e5cf5a6064d195139"
+      "sha256": "3f5d3e6edaf5da133f4ec601d15fb4476a250256b62ba6c5e927411eb5eafcc0"
     },
     {
       "path": "harness-codebase-map/templates/ARCHITECTURE.md",
@@ -131,11 +131,11 @@
     },
     {
       "path": "harness-knowledge-ingest/SKILL.md",
-      "sha256": "3fa651d2ce8962e83f05b518df1a09fafa7e5a01ea9e6038776a753ab241c261"
+      "sha256": "0cdb9ef728b4771ce1d5aa85dcb562143a5c25ae7504cb78ebeef5a5635c50a8"
     },
     {
       "path": "harness-knowledge-query/SKILL.md",
-      "sha256": "7dccc07f4fbfd5dc2dee1db50c53d1eb8b4990d106f8a592e64f383e056921f1"
+      "sha256": "06c4bbe28d8752a318e8ca0d80ea74adb9c95b0d70002471345ad851be5333d0"
     },
     {
       "path": "harness-plan/checklist.md",
@@ -151,7 +151,7 @@
     },
     {
       "path": "harness-plan/SKILL.md",
-      "sha256": "58ee9c2ab2485b895b2aa971025e5d1c330cf140babbb3857f7bc2ea8331e958"
+      "sha256": "26a7ae5329dd2aead892e3a7802fe50f67ffa3df4c9c83f3e48e1e25cd3803f4"
     },
     {
       "path": "harness-review/checklist.md",
@@ -167,11 +167,11 @@
     },
     {
       "path": "harness-review/SKILL.md",
-      "sha256": "8bddef05374f53c1956752c434d70bfa65063136ad111d67f1616ca9ff74e598"
+      "sha256": "ec6ae1bb0922c552f5390840995c294b8cb045860ba1583cd388c37e85a64757"
     },
     {
       "path": "harness-run/checklist.md",
-      "sha256": "8f8be29c43b2a37885d0ef729ca4a1cb748869d65de0498b0e38f3e1cc7f317a"
+      "sha256": "62063fd4c20a12eb9295fb5bade31e10adb2f5a4fd8600446b2109b959c82961"
     },
     {
       "path": "harness-run/protocols.md",
@@ -183,11 +183,11 @@
     },
     {
       "path": "harness-run/SKILL.md",
-      "sha256": "7cf03717705f385cbca018145306c4281ff95324d19294856b2b4d45f7cd3686"
+      "sha256": "dd43063183bed8dc0b31c6595abbaa41e7de1409daf803c222fef094180fe025"
     },
     {
       "path": "harness-submit/checklist.md",
-      "sha256": "2ebc0bc1ac5ce8cf13760ca967870b318633adaebbe0492a99152497d3285582"
+      "sha256": "85f157b611b69f1c10ed26c06308ad5e46233b5b31f22ad511df60cbc0c221cb"
     },
     {
       "path": "harness-submit/reference.md",
@@ -195,7 +195,7 @@
     },
     {
       "path": "harness-submit/SKILL.md",
-      "sha256": "cd1b2470ee449a04b4a6065c1e4108f28840831a6c4293ee3ae634ef488e774a"
+      "sha256": "95b370f04917ce20822c4f60855a8d6ce3d903cd67d874c28cffd2877fcdb1ea"
     },
     {
       "path": "harness-sync/reference.md",
@@ -203,7 +203,7 @@
     },
     {
       "path": "harness-sync/SKILL.md",
-      "sha256": "5d8b90759a12971b45c424915e4055d812680c23b3596a77dfb86ceb69107500"
+      "sha256": "04cab37d003d7f87824fc33281bb6404f7acb1d75a3f72565a9142f974e1f4b5"
     },
     {
       "path": "harness-test/checklist.md",
@@ -227,7 +227,7 @@
     },
     {
       "path": "harness-test/SKILL.md",
-      "sha256": "d284a936c3fec8cc427babc880ccdc17110432c8b19933952795f34e948f059c"
+      "sha256": "c7624934d596e906841f5afab27762887957ba54e30a590afbc8723fc693e4ef"
     },
     {
       "path": "protocols/archive-report-protocol.md",
@@ -241,6 +241,10 @@
       "path": "protocols/ledger-protocol.md",
       "sha256": "50f9deffcf71de009c56bd2cdd44fb05c7b18faf19ec56b00ff76e8ce897ecf7"
     },
+    {
+      "path": "protocols/model-routing-protocol.md",
+      "sha256": "1ce493d7dcc7a0c32b07b2d0118fdca40d72ca2487a63566f3c997293269f06e"
+    },
     {
       "path": "protocols/powershell-protocol.md",
       "sha256": "f723f18eee08125e75f387e655f7e604eb603f636cd6809dd6b5948748f32d04"
@@ -287,7 +291,7 @@
     },
     {
       "path": "scripts/harness_events.py",
-      "sha256": "dcc4c1e4c2967ec7a07c103890f45f2903fc2784adebe3d6c5ae8e92037efd4f"
+      "sha256": "94880e69acde59e13afaa338d9ac80a5481e1c84abfbffaf7f5438089655d21a"
     },
     {
       "path": "scripts/harness_gate.py",
@@ -295,11 +299,15 @@
     },
     {
       "path": "scripts/harness_integration.py",
-      "sha256": "ab963ef60b554118858124a6a8ed3af09bdc0bf78a873251825aee225ad77ad4"
+      "sha256": "78904ed2a6254be6671a2627863759c68a9576ef41584f423c5cde3faa6d6b25"
     },
     {
       "path": "scripts/harness_ledger.py",
-      "sha256": "7885b89510a8975c93fe367f9e557735ed70eb6d913f302b6aea3fa193af0f23"
+      "sha256": "11340d0e84fc3905d2d7383683ac94d2b9ab13655e56a26e460d7e9b0b515f1a"
+    },
+    {
+      "path": "scripts/harness_migration_head.py",
+      "sha256": "6bce06ce5c077185d6e40e1655c37ef98b2f8e6e39d64b2f3f3c45f12854ed51"
     },
     {
       "path": "scripts/harness_paths.py",