@hunter-harness/workflow-harness 0.2.20 → 0.2.21

package/harness/bundles/general/codebuddy/scripts/harness_ledger.py

@@ -1055,6 +1055,7 @@ def decide_can_reuse(
     requested_toolchain_hash: str | None = None,
     requested_profile_hash: str | None = None,
     requested_environment_hash: str | None = None,
+    requested_db_schema_hash: str | None = None,
 ) -> dict[str, Any]:
     ledger, ledger_path = load_ledger(change_dir)
     if ledger is None:
@@ -1183,6 +1184,7 @@ def decide_can_reuse(
         ("toolchainHash", requested_toolchain_hash, "TOOLCHAIN_CHANGED"),
         ("profileHash", requested_profile_hash, "PROFILE_CHANGED"),
         ("environmentHash", requested_environment_hash, "ENVIRONMENT_CHANGED"),
+        ("dbSchemaHash", requested_db_schema_hash, "DB_SCHEMA_CHANGED"),
     ):
         stored = entry.get(field)
         if (
@@ -1249,6 +1251,7 @@ def decide_can_reuse(
         "reuse": True,
         "reason": "reuse",
         "code": "REUSED",
+        "invalidationCode": None,
         "verification": verification,
         "ledger_path": str(ledger_path) if ledger_path else None,
         "inputsHash": stored_hash,
@@ -1258,6 +1261,90 @@ def decide_can_reuse(
     }
 
 
+_INVALIDATION_ALIASES = {
+    "INPUTS_HASH_CHANGED": "INPUT_CHANGED",
+    "ENVIRONMENT_CHANGED": "ENV_CHANGED",
+    "MISSING_FIELDS": "MISSING_IDENTITY_FIELD",
+    "MISSING_V2_FIELDS": "MISSING_IDENTITY_FIELD",
+    "LEDGER_MISSING": "MISSING_IDENTITY_FIELD",
+    "VALIDATIONS_MISSING": "MISSING_IDENTITY_FIELD",
+    "VALIDATION_MISSING": "MISSING_IDENTITY_FIELD",
+}
+
+
+def _attach_invalidation_code(payload: dict[str, Any]) -> dict[str, Any]:
+    """Wave-2 H-9: expose stable invalidationCode alongside legacy code."""
+    if payload.get("reuse") is True:
+        payload.setdefault("invalidationCode", None)
+        return payload
+    code = str(payload.get("code") or "").strip()
+    if code:
+        payload["invalidationCode"] = _INVALIDATION_ALIASES.get(code, code)
+    return payload
+
+
+def verification_graph_path(change_dir: Path) -> Path:
+    return Path(change_dir) / "evidence" / "verification-graph.json"
+
+
+def upsert_verification_graph_node(
+    change_dir: Path,
+    *,
+    verification: str,
+    status: str,
+    inputs_hash: str,
+    command: str | None = None,
+    toolchain_hash: str | None = None,
+    environment_hash: str | None = None,
+    db_schema_hash: str | None = None,
+    diff_hash: str | None = None,
+) -> dict[str, Any]:
+    """Persist a verification graph node keyed by canonical identity (H-9)."""
+    path = verification_graph_path(change_dir)
+    path.parent.mkdir(parents=True, exist_ok=True)
+    graph: dict[str, Any]
+    if path.is_file():
+        try:
+            loaded = json.loads(path.read_text(encoding="utf-8-sig"))
+            graph = loaded if isinstance(loaded, dict) else {"schemaVersion": 1, "nodes": []}
+        except (OSError, json.JSONDecodeError):
+            graph = {"schemaVersion": 1, "nodes": []}
+    else:
+        graph = {"schemaVersion": 1, "nodes": []}
+    nodes = graph.get("nodes")
+    if not isinstance(nodes, list):
+        nodes = []
+    identity = {
+        "verification": verification,
+        "inputsHash": inputs_hash,
+        "command": command,
+        "toolchainHash": toolchain_hash,
+        "environmentHash": environment_hash,
+        "dbSchemaHash": db_schema_hash,
+        "diffHash": diff_hash,
+    }
+    node = {
+        "identity": identity,
+        "status": status,
+        "recordedAt": dt.datetime.now().astimezone().isoformat(timespec="milliseconds"),
+    }
+    replaced = False
+    for index, existing in enumerate(nodes):
+        if not isinstance(existing, dict):
+            continue
+        existing_id = existing.get("identity")
+        if isinstance(existing_id, dict) and existing_id == identity:
+            nodes[index] = node
+            replaced = True
+            break
+    if not replaced:
+        nodes.append(node)
+    graph["schemaVersion"] = 1
+    graph["nodes"] = nodes
+    write_ledger(path, graph)  # atomic json write helper already used for ledger
+    return {"ok": True, "path": str(path), "nodeCount": len(nodes), "replaced": replaced}
+
+
 def cmd_hash(args: argparse.Namespace) -> int:
     as_json = bool(args.json)
     try:
@@ -1330,10 +1417,12 @@ def cmd_can_reuse(args: argparse.Namespace) -> int:
             requested_toolchain_hash=getattr(args, "toolchain_hash", None),
             requested_profile_hash=getattr(args, "profile_hash", None),
             requested_environment_hash=getattr(args, "environment_hash", None),
+            requested_db_schema_hash=getattr(args, "db_schema_hash", None),
         )
     except (OSError, ValueError, json.JSONDecodeError) as exc:
         return emit_error(f"can-reuse failed: {exc}", as_json=as_json)
 
+    payload = _attach_invalidation_code(payload)
     emit_compact_or_verbose(
         payload, as_json=as_json, verbose=verbose,
         compact_fn=_compact_can_reuse_payload,
@@ -1470,6 +1559,7 @@ def cmd_record(args: argparse.Namespace) -> int:
             ("toolchainHash", "toolchain_hash"),
             ("profileHash", "profile_hash"),
             ("environmentHash", "environment_hash"),
+            ("dbSchemaHash", "db_schema_hash"),
         ):
             val = getattr(args, attr, None)
             if _nonempty_str(val):
@@ -1548,6 +1638,37 @@ def cmd_record(args: argparse.Namespace) -> int:
                     extra={"missing": missing},
                 )
         write_ledger(out_path, ledger)
+        try:
+            upsert_verification_graph_node(
+                change_dir,
+                verification=verification,
+                status=str(status),
+                inputs_hash=str(inputs_hash),
+                command=str(entry.get("command") or "") or None,
+                toolchain_hash=(
+                    str(entry.get("toolchainHash")).strip()
+                    if _nonempty_str(entry.get("toolchainHash"))
+                    else None
+                ),
+                environment_hash=(
+                    str(entry.get("environmentHash")).strip()
+                    if _nonempty_str(entry.get("environmentHash"))
+                    else None
+                ),
+                db_schema_hash=(
+                    str(entry.get("dbSchemaHash")).strip()
+                    if _nonempty_str(entry.get("dbSchemaHash"))
+                    else None
+                ),
+                diff_hash=(
+                    str(ledger.get("diffHash")).strip()
+                    if _nonempty_str(ledger.get("diffHash"))
+                    else None
+                ),
+            )
+        except (OSError, ValueError, TypeError):
+            # Graph is advisory persistence; ledger write already succeeded.
+            pass
     except (OSError, ValueError, FileNotFoundError, json.JSONDecodeError) as exc:
         return emit_error(f"record failed: {exc}", as_json=as_json)
 
@@ -1667,6 +1788,11 @@ def build_parser() -> argparse.ArgumentParser:
         default=None,
         help="optional environment hash to compare against ledger entry (UT-017)",
     )
+    p_reuse.add_argument(
+        "--db-schema-hash",
+        default=None,
+        help="optional DB schema hash to compare against ledger entry (H-9)",
+    )
     p_reuse.add_argument(
         "--verbose",
         action="store_true",
@@ -1708,6 +1834,7 @@ def build_parser() -> argparse.ArgumentParser:
     p_record.add_argument("--toolchain-hash", default=None)
     p_record.add_argument("--profile-hash", default=None)
     p_record.add_argument("--environment-hash", default=None)
+    p_record.add_argument("--db-schema-hash", default=None)
     p_record.add_argument("--deploy-artifact", default=None, help="package: built artifact path")
     p_record.add_argument("--artifact-hash", default=None, help="package: artifact sha256")
     p_record.add_argument(

package/harness/bundles/general/codebuddy/scripts/harness_migration_head.py

@@ -0,0 +1,220 @@
+#!/usr/bin/env python3
+"""Migration head single-source consistency check (Wave-2 H-7).
+
+Canonical file (default ``.harness/config/migration-head.json``)::
+
+    {
+      "schemaVersion": 1,
+      "head": "005_example",
+      "sources": [
+        {"path": "backend/app/config.py", "pattern": "EXPECTED_ALEMBIC_HEAD\\s*=\\s*[\\\"']([^\\\"']+)[\\\"']"},
+        {"path": "integration/manifest.json", "jsonPointer": "/migrationHead"}
+      ]
+    }
+
+Each source must resolve to the same ``head`` value. This harness repo may not
+ship alembic; consumer projects declare the canonical file and run::
+
+    python harness_migration_head.py check --project . --json
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import sys
+from pathlib import Path
+from typing import Any
+
+DEFAULT_REL = ".harness/config/migration-head.json"
+
+
+def emit_json(payload: dict[str, Any], *, as_json: bool) -> None:
+    if as_json:
+        sys.stdout.write(json.dumps(payload, ensure_ascii=False, indent=2) + "\n")
+    else:
+        code = payload.get("code") or ("OK" if payload.get("ok") else "FAIL")
+        sys.stdout.write(f"{code}\n")
+
+
+def emit_error(code: str, message: str, *, as_json: bool, extra: dict[str, Any] | None = None) -> int:
+    payload: dict[str, Any] = {"ok": False, "code": code, "message": message}
+    if extra:
+        payload.update(extra)
+    stream = sys.stdout if as_json else sys.stderr
+    if as_json:
+        stream.write(json.dumps(payload, ensure_ascii=False, indent=2) + "\n")
+    else:
+        stream.write(f"{code}: {message}\n")
+    return 1
+
+
+def _read_json_pointer(data: Any, pointer: str) -> Any:
+    if not pointer.startswith("/"):
+        raise ValueError(f"jsonPointer must start with /: {pointer}")
+    cur = data
+    for part in pointer.lstrip("/").split("/"):
+        part = part.replace("~1", "/").replace("~0", "~")
+        if isinstance(cur, dict) and part in cur:
+            cur = cur[part]
+        else:
+            raise KeyError(pointer)
+    return cur
+
+
+def _extract_source(project: Path, source: dict[str, Any]) -> str:
+    rel = str(source.get("path") or "").strip().replace("\\", "/")
+    if not rel or rel.startswith("/") or ".." in rel.split("/"):
+        raise ValueError(f"invalid source path: {rel}")
+    target = (project / rel).resolve()
+    try:
+        target.relative_to(project.resolve())
+    except ValueError as exc:
+        raise ValueError(f"source escapes project: {rel}") from exc
+    if not target.is_file():
+        raise FileNotFoundError(rel)
+    text = target.read_text(encoding="utf-8-sig")
+    if "jsonPointer" in source and source["jsonPointer"]:
+        data = json.loads(text)
+        value = _read_json_pointer(data, str(source["jsonPointer"]))
+        if value is None or (isinstance(value, str) and not value.strip()):
+            raise ValueError(f"empty value at {source['jsonPointer']} in {rel}")
+        return str(value).strip()
+    pattern = str(source.get("pattern") or "").strip()
+    if not pattern:
+        raise ValueError(f"source {rel} requires pattern or jsonPointer")
+    match = re.search(pattern, text, flags=re.MULTILINE)
+    if not match:
+        raise ValueError(f"pattern did not match in {rel}")
+    return str(match.group(1) if match.lastindex else match.group(0)).strip()
+
+
+def check_migration_head(
+    project: Path,
+    *,
+    config_rel: str = DEFAULT_REL,
+) -> dict[str, Any]:
+    project = project.resolve()
+    config_path = (project / config_rel).resolve()
+    try:
+        config_path.relative_to(project)
+    except ValueError:
+        return {
+            "ok": False,
+            "code": "MIGRATION_HEAD_CONFIG_ESCAPE",
+            "message": f"config path escapes project: {config_rel}",
+        }
+    if not config_path.is_file():
+        return {
+            "ok": False,
+            "code": "MIGRATION_HEAD_MISSING",
+            "message": f"canonical migration-head file missing: {config_rel}",
+            "configPath": str(config_path),
+        }
+    try:
+        data = json.loads(config_path.read_text(encoding="utf-8-sig"))
+    except (OSError, json.JSONDecodeError) as exc:
+        return {
+            "ok": False,
+            "code": "MIGRATION_HEAD_UNREADABLE",
+            "message": str(exc),
+            "configPath": str(config_path),
+        }
+    if not isinstance(data, dict) or data.get("schemaVersion") != 1:
+        return {
+            "ok": False,
+            "code": "MIGRATION_HEAD_SCHEMA_INVALID",
+            "message": "migration-head.json must be schemaVersion 1 object",
+            "configPath": str(config_path),
+        }
+    head = str(data.get("head") or "").strip()
+    sources = data.get("sources")
+    if not head:
+        return {
+            "ok": False,
+            "code": "MIGRATION_HEAD_EMPTY",
+            "message": "head must be a non-empty string",
+            "configPath": str(config_path),
+        }
+    if not isinstance(sources, list) or not sources:
+        return {
+            "ok": False,
+            "code": "MIGRATION_HEAD_SOURCES_EMPTY",
+            "message": "sources must be a non-empty array",
+            "configPath": str(config_path),
+        }
+
+    observed: list[dict[str, Any]] = []
+    drifts: list[dict[str, Any]] = []
+    for index, source in enumerate(sources):
+        if not isinstance(source, dict):
+            return {
+                "ok": False,
+                "code": "MIGRATION_HEAD_SOURCE_INVALID",
+                "message": f"sources[{index}] must be an object",
+            }
+        try:
+            value = _extract_source(project, source)
+        except (OSError, ValueError, KeyError, json.JSONDecodeError) as exc:
+            return {
+                "ok": False,
+                "code": "MIGRATION_HEAD_SOURCE_UNREADABLE",
+                "message": str(exc),
+                "index": index,
+                "path": source.get("path"),
+            }
+        item = {"path": source.get("path"), "value": value}
+        observed.append(item)
+        if value != head:
+            drifts.append({**item, "expected": head})
+
+    if drifts:
+        return {
+            "ok": False,
+            "code": "MIGRATION_HEAD_DRIFT",
+            "message": "one or more sources disagree with canonical head",
+            "head": head,
+            "drifts": drifts,
+            "observed": observed,
+            "configPath": str(config_path),
+        }
+    return {
+        "ok": True,
+        "code": "MIGRATION_HEAD_OK",
+        "head": head,
+        "observed": observed,
+        "configPath": str(config_path),
+        "sourceCount": len(observed),
+    }
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(prog="harness_migration_head.py")
+    sub = parser.add_subparsers(dest="command", required=True)
+    check = sub.add_parser("check", help="verify sources match canonical head")
+    check.add_argument("--project", required=True)
+    check.add_argument("--config", default=DEFAULT_REL)
+    check.add_argument("--json", action="store_true")
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = build_parser().parse_args(argv)
+    as_json = bool(getattr(args, "json", False))
+    if args.command == "check":
+        result = check_migration_head(Path(args.project), config_rel=str(args.config))
+        if not result.get("ok"):
+            return emit_error(
+                str(result.get("code") or "MIGRATION_HEAD_FAIL"),
+                str(result.get("message") or "check failed"),
+                as_json=as_json,
+                extra={k: v for k, v in result.items() if k not in {"ok", "code", "message"}},
+            )
+        emit_json(result, as_json=as_json)
+        return 0
+    return emit_error("UNKNOWN_COMMAND", f"unknown command: {args.command}", as_json=as_json)
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/harness/bundles/general/codex/.harness-build.json

@@ -2,5 +2,5 @@
   "schemaVersion": 1,
   "overlay": "none",
   "agent": "codex",
-  "coreHash": "61e21eb1206a0fa7"
+  "coreHash": "128b3eefb4330350"
 }

package/harness/bundles/general/codex/CONTEXT.md

@@ -48,6 +48,26 @@ _Avoid_: 每次重新探测, skill 内硬编码项目参数
 一项验证（compile/install/unitTest/apiTest）所依赖源文件集合的内容哈希。指纹一致且证据完整才允许 🔁REUSED；无法证明即保守重跑。
 _Avoid_: 仅凭 diffHash 复用, 无证据跳过
 
+**验证图（verification graph）**:
+`evidence/verification-graph.json` 按 canonical identity 持久化验证节点；`can-reuse` 返回 `invalidationCode`（如 `INPUT_CHANGED`）；profile `mergeVerification.requiredOnMerge` 进入 integration verify。详见 ledger / integration 脚本。
+_Avoid_: 冻结后无因重跑全量
+
+**Migration head 单源**:
+消费项目用 `.harness/config/migration-head.json` 声明 canonical head 与联动 sources；`harness_migration_head.py check` 做静态一致性门禁。
+_Avoid_: config/CI/manifest 多处手写 head
+
+**事件批处理**:
+同阶段多事件用 `harness_events.py batch-append`（单锁多行）；`phase.end` 仍走单次 append。
+_Avoid_: 机械事件逐条起进程
+
+**能力级模型路由**:
+任务用 `economy` / `balanced` / `frontier` 表述；禁止在通用 harness 规则硬编码供应商模型名。详见 `protocols/model-routing-protocol.md`。
+_Avoid_: skill 内写死 claude-/gpt- 模型 id
+
+**Overlay 所有权**:
+Bundle 安装目标由安装器管理；项目自有配置放 `.harness/project-overlay/`（或 project.yaml 侧）。`--force-managed` 必须配合 `--yes`/`--confirmed`，冲突 fail closed。
+_Avoid_: 静默 force-managed
+
 **服务会话**:
 `runtime/service-session.json` 记录的 AI 启动服务生命周期。指纹匹配静默复用、不匹配自动重启、归档收尾统一停止；只有用户自启服务占端口才询问。
 _Avoid_: 每轮测试后必杀服务

package/harness/bundles/general/codex/harness-archive/SKILL.md

@@ -3,7 +3,7 @@ name: harness-archive
 description: 归档所有变更产出（计划/测试报告/审查/SQL/API文档）到
   .harness/archive/，含归档元数据和可视化最终总结。使用场景：归档、完成归档、收尾、打包产出物
 ---
-<!-- generated by harness_deploy.py; core=61e21eb1206a0fa7; overlay=none; agent=codex; do not edit -->
+<!-- generated by harness_deploy.py; core=128b3eefb4330350; overlay=none; agent=codex; do not edit -->
 # harness-archive — 变更归档
 
 ## Purpose

package/harness/bundles/general/codex/harness-codebase-map/SKILL.md

@@ -3,7 +3,7 @@ name: harness-codebase-map
 description: 分析现有代码库并生成 .harness/codebase/map/
   下的结构化代码库地图。用于陌生项目理解、重大改造前梳理、harness-sync 提示 map 过期后的人工刷新。
 ---
-<!-- generated by harness_deploy.py; core=61e21eb1206a0fa7; overlay=none; agent=codex; do not edit -->
+<!-- generated by harness_deploy.py; core=128b3eefb4330350; overlay=none; agent=codex; do not edit -->
 # harness-codebase-map — 代码库地图
 
 ## Purpose

package/harness/bundles/general/codex/harness-knowledge-ingest/SKILL.md

@@ -3,7 +3,7 @@ name: harness-knowledge-ingest
 description: 从 .harness/archive 归档整理、同步和维护项目知识索引。适用场景：ingest knowledge、sync
   knowledge、rebuild knowledge index、promote knowledge、确认知识条目、检查知识库是否过期。
 ---
-<!-- generated by harness_deploy.py; core=61e21eb1206a0fa7; overlay=none; agent=codex; do not edit -->
+<!-- generated by harness_deploy.py; core=128b3eefb4330350; overlay=none; agent=codex; do not edit -->
 # harness-knowledge-ingest
 
 从 `.harness/archive/**/reports/final/summary-data.json` 抽取项目知识，生成并维护本地 `.harness/knowledge/` 索引。

package/harness/bundles/general/codex/harness-knowledge-query/SKILL.md

@@ -3,7 +3,7 @@ name: harness-knowledge-query
 description: 根据新需求、设计任务、代码修改请求或问题排查，在规划和编码前查询 .harness/knowledge
   历史上下文。适用场景：query knowledge、查找历史需求、根据归档理解需求、继续之前类似开发、生成需求上下文包。
 ---
-<!-- generated by harness_deploy.py; core=61e21eb1206a0fa7; overlay=none; agent=codex; do not edit -->
+<!-- generated by harness_deploy.py; core=128b3eefb4330350; overlay=none; agent=codex; do not edit -->
 # harness-knowledge-query
 
 并行 change 中查询必须传 `--change <change-id>`；成功后以该 change 的 `meta/knowledge-context.json` 为稳定指针。全局 `context-packs/latest.json` 仅向后兼容，不得用于判断多个 active change 的上下文归属。

package/harness/bundles/general/codex/harness-plan/SKILL.md

@@ -2,7 +2,7 @@
 name: harness-plan
 description: 将需求转化为设计文档+实施计划+完整测试场景表，必须在编码前完成。使用场景：需求分析、feature plan、技术方案设计、实现方案规划
 ---
-<!-- generated by harness_deploy.py; core=61e21eb1206a0fa7; overlay=none; agent=codex; do not edit -->
+<!-- generated by harness_deploy.py; core=128b3eefb4330350; overlay=none; agent=codex; do not edit -->
 # harness-plan — 需求规划
 
 ## Purpose

package/harness/bundles/general/codex/harness-review/SKILL.md

@@ -3,7 +3,7 @@ name: harness-review
 description: 6维度代码审查（架构/安全/规范/兼容/测试/性能），对照项目规则（见
   .harness/context-index.json）和测试场景表，在隔离上下文运行。使用场景：代码审查、提交前检查、合并评审
 ---
-<!-- generated by harness_deploy.py; core=61e21eb1206a0fa7; overlay=none; agent=codex; do not edit -->
+<!-- generated by harness_deploy.py; core=128b3eefb4330350; overlay=none; agent=codex; do not edit -->
 # harness-review — 代码审查
 
 ## Purpose

package/harness/bundles/general/codex/harness-run/SKILL.md

@@ -2,7 +2,7 @@
 name: harness-run
 description: 按变更簇执行 TDD 编码循环（RED→GREEN→REFACTOR→编译验证），逐变更簇实现计划中的任务。使用场景：开始编码、实现功能、写代码、TDD 编码
 ---
-<!-- generated by harness_deploy.py; core=61e21eb1206a0fa7; overlay=none; agent=codex; do not edit -->
+<!-- generated by harness_deploy.py; core=128b3eefb4330350; overlay=none; agent=codex; do not edit -->
 # harness-run — 需求编码
 
 ## Purpose

package/harness/bundles/general/codex/harness-run/checklist.md

@@ -267,3 +267,9 @@ description: harness-run 的执行检查清单。仅在编码执行时读取。
 - [ ] 如果新增筛选参数，设计中已明确非法值行为
 - [ ] 如果采用“忽略并不过滤”，必须有用户确认记录
 - [ ] 测试场景覆盖非法值
+
+
+## Wave-2 — Migration head（H-7）
+
+- [ ] 若变更触及 alembic/versions 或项目约定 migration 路径：列出 config / CI / env / manifest 联动文件
+- [ ] 消费项目存在 .harness/config/migration-head.json 时，跑 harness_migration_head.py check --project . --json

package/harness/bundles/general/codex/harness-submit/SKILL.md

@@ -3,7 +3,7 @@ name: harness-submit
 description: 最终提交封装：验证→中文 commit→提交/推送；worktree 模式含 --no-ff
   合并回主分支。使用场景：提交代码、commit、push、合并分支、merge to main、完成开发
 ---
-<!-- generated by harness_deploy.py; core=61e21eb1206a0fa7; overlay=none; agent=codex; do not edit -->
+<!-- generated by harness_deploy.py; core=128b3eefb4330350; overlay=none; agent=codex; do not edit -->
 # harness-submit — 最终提交（含 worktree 合并）
 
 ## Purpose

package/harness/bundles/general/codex/harness-submit/checklist.md

@@ -420,3 +420,9 @@ ledger 顶层写入 `"mergeFinalHash": "<journal pushedHead>"`；经 `harness_ga
 - worktree: 已清理（迁根后）
 - 下一步: `/harness-archive`
 ```
+
+
+## Wave-2 — 验证复用与 merge 面（H-9）
+
+- [ ] 代码冻结后，同 identity 的 unitTestFull 须 can-reuse；禁止无 invalidationCode 整套重跑
+- [ ] integration verify 会合并 profile mergeVerification.requiredOnMerge（若配置）

package/harness/bundles/general/codex/harness-sync/SKILL.md

@@ -2,7 +2,7 @@
 name: harness-sync
 description: 检查并更新项目AI元数据（CodeGraph索引、harness-codebase-map分析、CLAUDE.md、AGENTS.md、.harness/完整性），确保Claude对代码库的理解与最新代码一致。当用户说'同步/更新索引/刷新元数据/检查一致性'时使用
 ---
-<!-- generated by harness_deploy.py; core=61e21eb1206a0fa7; overlay=none; agent=codex; do not edit -->
+<!-- generated by harness_deploy.py; core=128b3eefb4330350; overlay=none; agent=codex; do not edit -->
 # harness-sync — 元数据同步
 
 ## Purpose

package/harness/bundles/general/codex/harness-test/SKILL.md

@@ -2,7 +2,7 @@
 name: harness-test
 description: 测试执行：读取场景表，执行单元测试+API接口测试+数据兼容验证，输出测试报告。当用户说'跑测试/验证/跑用例/接口测试/单元测试'时使用
 ---
-<!-- generated by harness_deploy.py; core=61e21eb1206a0fa7; overlay=none; agent=codex; do not edit -->
+<!-- generated by harness_deploy.py; core=128b3eefb4330350; overlay=none; agent=codex; do not edit -->
 # harness-test — 测试执行
 
 ## Purpose

package/harness/bundles/general/codex/protocols/model-routing-protocol.md

@@ -0,0 +1,22 @@
+# model-routing-protocol — 能力级模型路由（Wave-2 H-16）
+
+> 本协议定义 **economy / balanced / frontier** 三档能力级。通用 Harness 规则与 skill **禁止**硬编码供应商模型名（如 `claude-*`、`gpt-*`、`gemini-*`）。宿主把能力级映射到具体模型；映射表属于项目/宿主配置，不属于本协议正文。
+
+## 能力级
+
+| 级别 | 适用任务 | 示例 |
+|------|----------|------|
+| `economy` | 机械提取、日志压缩、等待监控、格式化摘要 | 解析测试输出行、压缩长日志、轮询服务就绪 |
+| `balanced` | 常规实现、常规修复、常规文档修订 | 按 plan 实现 CRUD、修 YELLOW、补 checklist |
+| `frontier` | 架构取舍、安全/并发/迁移、最终审查、高风险判断 | 设计审批、RED 安全项、schema 迁移方案、merge 前终审 |
+
+## 路由规则
+
+1. Skill/任务描述用能力级（`--capability economy|balanced|frontier` 或文案「本任务=frontier」），不写供应商模型 id。  
+2. 宿主或 `HUNTER_HARNESS_MODEL` 仅作**遥测**（`executor_model`），不得反过来驱动通用规则分支。  
+3. **降级**（frontier→balanced→economy）必须由确定性命令结果或更高能力审查验收；不得用更低能力级的模型输出替代测试/门禁证据。  
+4. 无法映射某能力级时：fail closed，列出可用级别，禁止静默落到未知模型。
+
+## 与验证的关系
+
+能力级不改变 ledger / can-reuse / verification graph 合同。模型便宜不能成为跳过 `unitTestFull` 或忽略 `requiredOnMerge` 的理由。