@hunter-harness/workflow-harness 0.2.20 → 0.2.21

package/harness/bundles/general/codex/scripts/harness_events.py

@@ -24,7 +24,7 @@ import tempfile
 import time
 import uuid
 from pathlib import Path
-from typing import Any
+from typing import Any, Sequence
 
 SCRIPTS_DIR = Path(__file__).resolve().parent
 if str(SCRIPTS_DIR) not in sys.path:
@@ -595,6 +595,132 @@ def append_event(
     return {"ok": True, "event": event, "events_path": str(events_path_obj), "rendered": False}
 
 
+def batch_append_events(
+    change_dir: Path,
+    events: Sequence[dict[str, Any]],
+) -> dict[str, Any]:
+    """Validate then append many events under one lock (Wave-2 H-15).
+
+    Any invalid item aborts the whole batch before mutation. ``phase.end`` items
+    are rejected here — use single ``append`` so render semantics stay explicit.
+    """
+    if not isinstance(events, (list, tuple)) or not events:
+        return {
+            "ok": False,
+            "code": "BATCH_EMPTY",
+            "message": "batch-append requires a non-empty events array",
+        }
+    archived = archived_change_dir(change_dir)
+    if archived is not None:
+        return {
+            "ok": False,
+            "code": "ARCHIVED_CHANGE_IMMUTABLE",
+            "message": str(archived),
+        }
+
+    built: list[dict[str, Any]] = []
+    for index, raw in enumerate(events):
+        if not isinstance(raw, dict):
+            return {
+                "ok": False,
+                "code": "BATCH_ITEM_INVALID",
+                "message": f"events[{index}] must be an object",
+                "index": index,
+            }
+        type_ = str(raw.get("type") or "").strip()
+        phase = str(raw.get("phase") or "").strip()
+        if not type_ or type_ not in EVENT_TYPES:
+            return {
+                "ok": False,
+                "code": "EVENT_TYPE_INVALID",
+                "message": f"events[{index}]: unsupported type: {type_}",
+                "index": index,
+            }
+        if not phase:
+            return {
+                "ok": False,
+                "code": "EVENT_REQUIRED_FIELD",
+                "message": f"events[{index}]: phase required",
+                "index": index,
+            }
+        if type_ == "phase.end":
+            return {
+                "ok": False,
+                "code": "BATCH_PHASE_END_FORBIDDEN",
+                "message": f"events[{index}]: phase.end must use single append",
+                "index": index,
+            }
+        args = argparse.Namespace(
+            change_dir=str(change_dir),
+            phase=phase,
+            type=type_,
+            note=raw.get("note"),
+            kind=raw.get("kind"),
+            path=raw.get("path"),
+            run_id=raw.get("run_id"),
+            executor_tool=raw.get("executor_tool"),
+            command=raw.get("command"),
+            exit_code=raw.get("exit_code"),
+            duration_ms=raw.get("duration_ms"),
+            status=raw.get("status"),
+            name=raw.get("name"),
+            code=raw.get("code"),
+            severity=raw.get("severity"),
+            message=raw.get("message"),
+            decision=raw.get("decision"),
+            reason=raw.get("reason"),
+            issue_id=raw.get("issue_id"),
+            scope=raw.get("scope"),
+            target_event_id=raw.get("target_event_id"),
+            target_field=raw.get("target_field"),
+            old_value_hash=raw.get("old_value_hash"),
+            new_value_json=raw.get("new_value_json"),
+            renamed_from=raw.get("renamed_from"),
+            renamed_to=raw.get("renamed_to"),
+            change_uuid=raw.get("change_uuid"),
+            attempt=raw.get("attempt"),
+            executor_agent=raw.get("executor_agent"),
+            executor_model=raw.get("executor_model"),
+            handoff_from_tool=raw.get("handoff_from_tool"),
+            handoff_reason=raw.get("handoff_reason"),
+            trace_id=raw.get("trace_id"),
+            span_id=raw.get("span_id"),
+            parent_span_id=raw.get("parent_span_id"),
+            runner_ms=raw.get("runner_ms"),
+            orchestration_active_ms=raw.get("orchestration_active_ms"),
+            wall_clock_ms=raw.get("wall_clock_ms"),
+            user_wait_ms=raw.get("user_wait_ms"),
+            legacy_lenient=False,
+            json=True,
+        )
+        validation = validate_append_event(args)
+        if validation:
+            error_code, message = validation
+            return {
+                "ok": False,
+                "code": error_code,
+                "message": f"events[{index}]: {message}",
+                "index": index,
+            }
+        built.append(build_event(args, []))
+
+    events_path_obj = events_path(change_dir)
+    lock_path = events_path_obj.with_name(events_path_obj.name + ".lock")
+    with event_file_lock(lock_path):
+        for event in built:
+            atomic_append_line(
+                events_path_obj, json.dumps(event, ensure_ascii=False, separators=(",", ":"))
+            )
+    return {
+        "ok": True,
+        "action": "batch-append",
+        "count": len(built),
+        "events": built,
+        "events_path": str(events_path_obj),
+        "rendered": False,
+    }
+
+
 def build_event(args: argparse.Namespace, existing: list[dict[str, Any]]) -> dict[str, Any]:
     event: dict[str, Any] = {
         "schema_version": SCHEMA_VERSION,
@@ -1295,6 +1421,25 @@ def cmd_append(args: argparse.Namespace) -> int:
     return 0
 
 
+def cmd_batch_append(args: argparse.Namespace) -> int:
+    as_json = bool(args.json)
+    change_dir = resolve_change_dir(args.change_dir)
+    batch_path = Path(str(args.file)).expanduser()
+    try:
+        raw = json.loads(batch_path.read_text(encoding="utf-8-sig"))
+    except (OSError, json.JSONDecodeError) as exc:
+        return emit_error(f"batch-append failed to read --file: {exc}", as_json=as_json)
+    result = batch_append_events(change_dir, raw if isinstance(raw, list) else [])
+    if not result.get("ok"):
+        return emit_error(
+            str(result.get("message") or "batch-append failed"),
+            as_json=as_json,
+            error_code=str(result.get("code") or "BATCH_APPEND_FAILED"),
+        )
+    emit_json(result, as_json=as_json)
+    return 0
+
+
 def cmd_render(args: argparse.Namespace) -> int:
     as_json = bool(args.json)
     change_dir = resolve_change_dir(args.change_dir)
@@ -1395,6 +1540,19 @@ def build_parser() -> argparse.ArgumentParser:
     )
     p_append.set_defaults(func=cmd_append)
 
+    p_batch = sub.add_parser(
+        "batch-append",
+        parents=[common],
+        help="validate and append many events under one lock (H-15)",
+    )
+    p_batch.add_argument("--change-dir", required=True)
+    p_batch.add_argument(
+        "--file",
+        required=True,
+        help="JSON file containing a non-empty array of event objects",
+    )
+    p_batch.set_defaults(func=cmd_batch_append)
+
     p_render = sub.add_parser(
         "render",
         parents=[common],

package/harness/bundles/general/codex/scripts/harness_integration.py

@@ -862,8 +862,42 @@ class IntegrationTransaction:
 
         return self._run_step("merge", action)
 
+    def _required_on_merge_commands(self) -> list[list[str]]:
+        """Load build-profile mergeVerification.requiredOnMerge (Wave-2 H-9)."""
+        import harness_profile
+
+        profile = harness_profile.load_profile(self.project_root)
+        if not isinstance(profile, dict):
+            return []
+        merge = profile.get("mergeVerification")
+        if not isinstance(merge, dict):
+            return []
+        required = merge.get("requiredOnMerge")
+        if not isinstance(required, list):
+            return []
+        commands: list[list[str]] = []
+        for index, item in enumerate(required):
+            if isinstance(item, str) and item.strip():
+                commands.append(shlex.split(item.strip()))
+                continue
+            if not isinstance(item, dict):
+                raise ValueError(f"requiredOnMerge[{index}] must be string or object")
+            raw = item.get("command")
+            if isinstance(raw, list) and raw and all(isinstance(x, str) and x for x in raw):
+                commands.append([str(x) for x in raw])
+            elif isinstance(raw, str) and raw.strip():
+                commands.append(shlex.split(raw.strip()))
+            else:
+                raise ValueError(f"requiredOnMerge[{index}].command missing")
+        return commands
+
     def verify(self, commands: Sequence[Sequence[str]] | None = None) -> dict[str, Any]:
         commands = list(commands or [])
+        # Wave-2 H-9: append profile mergeVerification.requiredOnMerge commands.
+        try:
+            commands.extend(self._required_on_merge_commands())
+        except Exception as exc:  # noqa: BLE001 — surface as verify plan error
+            raise VerifyPlanMissingError(f"mergeVerification load failed: {exc}") from exc
 
         def action(journal: dict[str, Any]) -> None:
             if not commands or any(

package/harness/bundles/general/codex/scripts/harness_ledger.py

@@ -1055,6 +1055,7 @@ def decide_can_reuse(
     requested_toolchain_hash: str | None = None,
     requested_profile_hash: str | None = None,
     requested_environment_hash: str | None = None,
+    requested_db_schema_hash: str | None = None,
 ) -> dict[str, Any]:
     ledger, ledger_path = load_ledger(change_dir)
     if ledger is None:
@@ -1183,6 +1184,7 @@ def decide_can_reuse(
         ("toolchainHash", requested_toolchain_hash, "TOOLCHAIN_CHANGED"),
         ("profileHash", requested_profile_hash, "PROFILE_CHANGED"),
         ("environmentHash", requested_environment_hash, "ENVIRONMENT_CHANGED"),
+        ("dbSchemaHash", requested_db_schema_hash, "DB_SCHEMA_CHANGED"),
     ):
         stored = entry.get(field)
         if (
@@ -1249,6 +1251,7 @@ def decide_can_reuse(
         "reuse": True,
         "reason": "reuse",
         "code": "REUSED",
+        "invalidationCode": None,
         "verification": verification,
         "ledger_path": str(ledger_path) if ledger_path else None,
         "inputsHash": stored_hash,
@@ -1258,6 +1261,90 @@ def decide_can_reuse(
     }
 
 
+_INVALIDATION_ALIASES = {
+    "INPUTS_HASH_CHANGED": "INPUT_CHANGED",
+    "ENVIRONMENT_CHANGED": "ENV_CHANGED",
+    "MISSING_FIELDS": "MISSING_IDENTITY_FIELD",
+    "MISSING_V2_FIELDS": "MISSING_IDENTITY_FIELD",
+    "LEDGER_MISSING": "MISSING_IDENTITY_FIELD",
+    "VALIDATIONS_MISSING": "MISSING_IDENTITY_FIELD",
+    "VALIDATION_MISSING": "MISSING_IDENTITY_FIELD",
+}
+
+
+def _attach_invalidation_code(payload: dict[str, Any]) -> dict[str, Any]:
+    """Wave-2 H-9: expose stable invalidationCode alongside legacy code."""
+    if payload.get("reuse") is True:
+        payload.setdefault("invalidationCode", None)
+        return payload
+    code = str(payload.get("code") or "").strip()
+    if code:
+        payload["invalidationCode"] = _INVALIDATION_ALIASES.get(code, code)
+    return payload
+
+
+def verification_graph_path(change_dir: Path) -> Path:
+    return Path(change_dir) / "evidence" / "verification-graph.json"
+
+
+def upsert_verification_graph_node(
+    change_dir: Path,
+    *,
+    verification: str,
+    status: str,
+    inputs_hash: str,
+    command: str | None = None,
+    toolchain_hash: str | None = None,
+    environment_hash: str | None = None,
+    db_schema_hash: str | None = None,
+    diff_hash: str | None = None,
+) -> dict[str, Any]:
+    """Persist a verification graph node keyed by canonical identity (H-9)."""
+    path = verification_graph_path(change_dir)
+    path.parent.mkdir(parents=True, exist_ok=True)
+    graph: dict[str, Any]
+    if path.is_file():
+        try:
+            loaded = json.loads(path.read_text(encoding="utf-8-sig"))
+            graph = loaded if isinstance(loaded, dict) else {"schemaVersion": 1, "nodes": []}
+        except (OSError, json.JSONDecodeError):
+            graph = {"schemaVersion": 1, "nodes": []}
+    else:
+        graph = {"schemaVersion": 1, "nodes": []}
+    nodes = graph.get("nodes")
+    if not isinstance(nodes, list):
+        nodes = []
+    identity = {
+        "verification": verification,
+        "inputsHash": inputs_hash,
+        "command": command,
+        "toolchainHash": toolchain_hash,
+        "environmentHash": environment_hash,
+        "dbSchemaHash": db_schema_hash,
+        "diffHash": diff_hash,
+    }
+    node = {
+        "identity": identity,
+        "status": status,
+        "recordedAt": dt.datetime.now().astimezone().isoformat(timespec="milliseconds"),
+    }
+    replaced = False
+    for index, existing in enumerate(nodes):
+        if not isinstance(existing, dict):
+            continue
+        existing_id = existing.get("identity")
+        if isinstance(existing_id, dict) and existing_id == identity:
+            nodes[index] = node
+            replaced = True
+            break
+    if not replaced:
+        nodes.append(node)
+    graph["schemaVersion"] = 1
+    graph["nodes"] = nodes
+    write_ledger(path, graph)  # atomic json write helper already used for ledger
+    return {"ok": True, "path": str(path), "nodeCount": len(nodes), "replaced": replaced}
+
+
 def cmd_hash(args: argparse.Namespace) -> int:
     as_json = bool(args.json)
     try:
@@ -1330,10 +1417,12 @@ def cmd_can_reuse(args: argparse.Namespace) -> int:
             requested_toolchain_hash=getattr(args, "toolchain_hash", None),
             requested_profile_hash=getattr(args, "profile_hash", None),
             requested_environment_hash=getattr(args, "environment_hash", None),
+            requested_db_schema_hash=getattr(args, "db_schema_hash", None),
         )
     except (OSError, ValueError, json.JSONDecodeError) as exc:
         return emit_error(f"can-reuse failed: {exc}", as_json=as_json)
 
+    payload = _attach_invalidation_code(payload)
     emit_compact_or_verbose(
         payload, as_json=as_json, verbose=verbose,
         compact_fn=_compact_can_reuse_payload,
@@ -1470,6 +1559,7 @@ def cmd_record(args: argparse.Namespace) -> int:
             ("toolchainHash", "toolchain_hash"),
             ("profileHash", "profile_hash"),
             ("environmentHash", "environment_hash"),
+            ("dbSchemaHash", "db_schema_hash"),
         ):
             val = getattr(args, attr, None)
             if _nonempty_str(val):
@@ -1548,6 +1638,37 @@ def cmd_record(args: argparse.Namespace) -> int:
                     extra={"missing": missing},
                 )
         write_ledger(out_path, ledger)
+        try:
+            upsert_verification_graph_node(
+                change_dir,
+                verification=verification,
+                status=str(status),
+                inputs_hash=str(inputs_hash),
+                command=str(entry.get("command") or "") or None,
+                toolchain_hash=(
+                    str(entry.get("toolchainHash")).strip()
+                    if _nonempty_str(entry.get("toolchainHash"))
+                    else None
+                ),
+                environment_hash=(
+                    str(entry.get("environmentHash")).strip()
+                    if _nonempty_str(entry.get("environmentHash"))
+                    else None
+                ),
+                db_schema_hash=(
+                    str(entry.get("dbSchemaHash")).strip()
+                    if _nonempty_str(entry.get("dbSchemaHash"))
+                    else None
+                ),
+                diff_hash=(
+                    str(ledger.get("diffHash")).strip()
+                    if _nonempty_str(ledger.get("diffHash"))
+                    else None
+                ),
+            )
+        except (OSError, ValueError, TypeError):
+            # Graph is advisory persistence; ledger write already succeeded.
+            pass
     except (OSError, ValueError, FileNotFoundError, json.JSONDecodeError) as exc:
         return emit_error(f"record failed: {exc}", as_json=as_json)
 
@@ -1667,6 +1788,11 @@ def build_parser() -> argparse.ArgumentParser:
         default=None,
         help="optional environment hash to compare against ledger entry (UT-017)",
     )
+    p_reuse.add_argument(
+        "--db-schema-hash",
+        default=None,
+        help="optional DB schema hash to compare against ledger entry (H-9)",
+    )
     p_reuse.add_argument(
         "--verbose",
         action="store_true",
@@ -1708,6 +1834,7 @@ def build_parser() -> argparse.ArgumentParser:
     p_record.add_argument("--toolchain-hash", default=None)
     p_record.add_argument("--profile-hash", default=None)
     p_record.add_argument("--environment-hash", default=None)
+    p_record.add_argument("--db-schema-hash", default=None)
     p_record.add_argument("--deploy-artifact", default=None, help="package: built artifact path")
     p_record.add_argument("--artifact-hash", default=None, help="package: artifact sha256")
     p_record.add_argument(

package/harness/bundles/general/codex/scripts/harness_migration_head.py

@@ -0,0 +1,220 @@
+#!/usr/bin/env python3
+"""Migration head single-source consistency check (Wave-2 H-7).
+
+Canonical file (default ``.harness/config/migration-head.json``)::
+
+    {
+      "schemaVersion": 1,
+      "head": "005_example",
+      "sources": [
+        {"path": "backend/app/config.py", "pattern": "EXPECTED_ALEMBIC_HEAD\\s*=\\s*[\\\"']([^\\\"']+)[\\\"']"},
+        {"path": "integration/manifest.json", "jsonPointer": "/migrationHead"}
+      ]
+    }
+
+Each source must resolve to the same ``head`` value. This harness repo may not
+ship alembic; consumer projects declare the canonical file and run::
+
+    python harness_migration_head.py check --project . --json
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import sys
+from pathlib import Path
+from typing import Any
+
+DEFAULT_REL = ".harness/config/migration-head.json"
+
+
+def emit_json(payload: dict[str, Any], *, as_json: bool) -> None:
+    if as_json:
+        sys.stdout.write(json.dumps(payload, ensure_ascii=False, indent=2) + "\n")
+    else:
+        code = payload.get("code") or ("OK" if payload.get("ok") else "FAIL")
+        sys.stdout.write(f"{code}\n")
+
+
+def emit_error(code: str, message: str, *, as_json: bool, extra: dict[str, Any] | None = None) -> int:
+    payload: dict[str, Any] = {"ok": False, "code": code, "message": message}
+    if extra:
+        payload.update(extra)
+    stream = sys.stdout if as_json else sys.stderr
+    if as_json:
+        stream.write(json.dumps(payload, ensure_ascii=False, indent=2) + "\n")
+    else:
+        stream.write(f"{code}: {message}\n")
+    return 1
+
+
+def _read_json_pointer(data: Any, pointer: str) -> Any:
+    if not pointer.startswith("/"):
+        raise ValueError(f"jsonPointer must start with /: {pointer}")
+    cur = data
+    for part in pointer.lstrip("/").split("/"):
+        part = part.replace("~1", "/").replace("~0", "~")
+        if isinstance(cur, dict) and part in cur:
+            cur = cur[part]
+        else:
+            raise KeyError(pointer)
+    return cur
+
+
+def _extract_source(project: Path, source: dict[str, Any]) -> str:
+    rel = str(source.get("path") or "").strip().replace("\\", "/")
+    if not rel or rel.startswith("/") or ".." in rel.split("/"):
+        raise ValueError(f"invalid source path: {rel}")
+    target = (project / rel).resolve()
+    try:
+        target.relative_to(project.resolve())
+    except ValueError as exc:
+        raise ValueError(f"source escapes project: {rel}") from exc
+    if not target.is_file():
+        raise FileNotFoundError(rel)
+    text = target.read_text(encoding="utf-8-sig")
+    if "jsonPointer" in source and source["jsonPointer"]:
+        data = json.loads(text)
+        value = _read_json_pointer(data, str(source["jsonPointer"]))
+        if value is None or (isinstance(value, str) and not value.strip()):
+            raise ValueError(f"empty value at {source['jsonPointer']} in {rel}")
+        return str(value).strip()
+    pattern = str(source.get("pattern") or "").strip()
+    if not pattern:
+        raise ValueError(f"source {rel} requires pattern or jsonPointer")
+    match = re.search(pattern, text, flags=re.MULTILINE)
+    if not match:
+        raise ValueError(f"pattern did not match in {rel}")
+    return str(match.group(1) if match.lastindex else match.group(0)).strip()
+
+
+def check_migration_head(
+    project: Path,
+    *,
+    config_rel: str = DEFAULT_REL,
+) -> dict[str, Any]:
+    project = project.resolve()
+    config_path = (project / config_rel).resolve()
+    try:
+        config_path.relative_to(project)
+    except ValueError:
+        return {
+            "ok": False,
+            "code": "MIGRATION_HEAD_CONFIG_ESCAPE",
+            "message": f"config path escapes project: {config_rel}",
+        }
+    if not config_path.is_file():
+        return {
+            "ok": False,
+            "code": "MIGRATION_HEAD_MISSING",
+            "message": f"canonical migration-head file missing: {config_rel}",
+            "configPath": str(config_path),
+        }
+    try:
+        data = json.loads(config_path.read_text(encoding="utf-8-sig"))
+    except (OSError, json.JSONDecodeError) as exc:
+        return {
+            "ok": False,
+            "code": "MIGRATION_HEAD_UNREADABLE",
+            "message": str(exc),
+            "configPath": str(config_path),
+        }
+    if not isinstance(data, dict) or data.get("schemaVersion") != 1:
+        return {
+            "ok": False,
+            "code": "MIGRATION_HEAD_SCHEMA_INVALID",
+            "message": "migration-head.json must be schemaVersion 1 object",
+            "configPath": str(config_path),
+        }
+    head = str(data.get("head") or "").strip()
+    sources = data.get("sources")
+    if not head:
+        return {
+            "ok": False,
+            "code": "MIGRATION_HEAD_EMPTY",
+            "message": "head must be a non-empty string",
+            "configPath": str(config_path),
+        }
+    if not isinstance(sources, list) or not sources:
+        return {
+            "ok": False,
+            "code": "MIGRATION_HEAD_SOURCES_EMPTY",
+            "message": "sources must be a non-empty array",
+            "configPath": str(config_path),
+        }
+
+    observed: list[dict[str, Any]] = []
+    drifts: list[dict[str, Any]] = []
+    for index, source in enumerate(sources):
+        if not isinstance(source, dict):
+            return {
+                "ok": False,
+                "code": "MIGRATION_HEAD_SOURCE_INVALID",
+                "message": f"sources[{index}] must be an object",
+            }
+        try:
+            value = _extract_source(project, source)
+        except (OSError, ValueError, KeyError, json.JSONDecodeError) as exc:
+            return {
+                "ok": False,
+                "code": "MIGRATION_HEAD_SOURCE_UNREADABLE",
+                "message": str(exc),
+                "index": index,
+                "path": source.get("path"),
+            }
+        item = {"path": source.get("path"), "value": value}
+        observed.append(item)
+        if value != head:
+            drifts.append({**item, "expected": head})
+
+    if drifts:
+        return {
+            "ok": False,
+            "code": "MIGRATION_HEAD_DRIFT",
+            "message": "one or more sources disagree with canonical head",
+            "head": head,
+            "drifts": drifts,
+            "observed": observed,
+            "configPath": str(config_path),
+        }
+    return {
+        "ok": True,
+        "code": "MIGRATION_HEAD_OK",
+        "head": head,
+        "observed": observed,
+        "configPath": str(config_path),
+        "sourceCount": len(observed),
+    }
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(prog="harness_migration_head.py")
+    sub = parser.add_subparsers(dest="command", required=True)
+    check = sub.add_parser("check", help="verify sources match canonical head")
+    check.add_argument("--project", required=True)
+    check.add_argument("--config", default=DEFAULT_REL)
+    check.add_argument("--json", action="store_true")
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = build_parser().parse_args(argv)
+    as_json = bool(getattr(args, "json", False))
+    if args.command == "check":
+        result = check_migration_head(Path(args.project), config_rel=str(args.config))
+        if not result.get("ok"):
+            return emit_error(
+                str(result.get("code") or "MIGRATION_HEAD_FAIL"),
+                str(result.get("message") or "check failed"),
+                as_json=as_json,
+                extra={k: v for k, v in result.items() if k not in {"ok", "code", "message"}},
+            )
+        emit_json(result, as_json=as_json)
+        return 0
+    return emit_error("UNKNOWN_COMMAND", f"unknown command: {args.command}", as_json=as_json)
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/harness/bundles/general/cursor/.harness-build.json

@@ -2,5 +2,5 @@
   "schemaVersion": 1,
   "overlay": "none",
   "agent": "cursor",
-  "coreHash": "1b338692377340e5"
+  "coreHash": "cd03d22b60760428"
 }

package/harness/bundles/general/cursor/CONTEXT.md

@@ -48,6 +48,26 @@ _Avoid_: 每次重新探测, skill 内硬编码项目参数
 一项验证（compile/install/unitTest/apiTest）所依赖源文件集合的内容哈希。指纹一致且证据完整才允许 🔁REUSED；无法证明即保守重跑。
 _Avoid_: 仅凭 diffHash 复用, 无证据跳过
 
+**验证图（verification graph）**:
+`evidence/verification-graph.json` 按 canonical identity 持久化验证节点；`can-reuse` 返回 `invalidationCode`（如 `INPUT_CHANGED`）；profile `mergeVerification.requiredOnMerge` 进入 integration verify。详见 ledger / integration 脚本。
+_Avoid_: 冻结后无因重跑全量
+
+**Migration head 单源**:
+消费项目用 `.harness/config/migration-head.json` 声明 canonical head 与联动 sources；`harness_migration_head.py check` 做静态一致性门禁。
+_Avoid_: config/CI/manifest 多处手写 head
+
+**事件批处理**:
+同阶段多事件用 `harness_events.py batch-append`（单锁多行）；`phase.end` 仍走单次 append。
+_Avoid_: 机械事件逐条起进程
+
+**能力级模型路由**:
+任务用 `economy` / `balanced` / `frontier` 表述；禁止在通用 harness 规则硬编码供应商模型名。详见 `protocols/model-routing-protocol.md`。
+_Avoid_: skill 内写死 claude-/gpt- 模型 id
+
+**Overlay 所有权**:
+Bundle 安装目标由安装器管理；项目自有配置放 `.harness/project-overlay/`（或 project.yaml 侧）。`--force-managed` 必须配合 `--yes`/`--confirmed`，冲突 fail closed。
+_Avoid_: 静默 force-managed
+
 **服务会话**:
 `runtime/service-session.json` 记录的 AI 启动服务生命周期。指纹匹配静默复用、不匹配自动重启、归档收尾统一停止；只有用户自启服务占端口才询问。
 _Avoid_: 每轮测试后必杀服务

package/harness/bundles/general/cursor/harness-archive/SKILL.md

@@ -3,7 +3,7 @@ name: harness-archive
 description: 归档所有变更产出（计划/测试报告/审查/SQL/API文档）到
   .harness/archive/，含归档元数据和可视化最终总结。使用场景：归档、完成归档、收尾、打包产出物
 ---
-<!-- generated by harness_deploy.py; core=1b338692377340e5; overlay=none; agent=cursor; do not edit -->
+<!-- generated by harness_deploy.py; core=cd03d22b60760428; overlay=none; agent=cursor; do not edit -->
 # harness-archive — 变更归档
 
 ## Purpose