@hunter-harness/workflow-harness 0.2.27 → 0.2.28

package/harness/bundles/general/codebuddy/scripts/harness_test_guard.py

@@ -56,6 +56,11 @@ REASONS = ("tdd-created", "stale-test-repair", "test-updated")
 class LockUnavailable(RuntimeError):
     """A compatible lock file is already held by another process."""
 
+
+class ProfileConfigInvalid(ValueError):
+    """The selected project-owned test-tracking profile is malformed."""
+
+
 if hasattr(sys.stdout, "reconfigure"):
     sys.stdout.reconfigure(encoding="utf-8")
 if hasattr(sys.stderr, "reconfigure"):
@@ -218,30 +223,69 @@ def _manifest_target_inside(change_root: Path, manifest: Path) -> bool:
     )
 
 
-def _profile_config(project: Path) -> tuple[list[str], list[str]] | None:
-    profile_path = project / PROFILE_REL
-    if not profile_path.is_file():
-        return None
+def _profile_config(
+    project: Path,
+    *,
+    strict: bool = False,
+) -> tuple[list[str], list[str]] | None:
+    def invalid(message: str) -> tuple[list[str], list[str]]:
+        if strict:
+            raise ProfileConfigInvalid(message)
+        return [], []
+
+    local_profile = project / PROFILE_REL
+    if os.path.lexists(local_profile):
+        profile_path = local_profile
+        if not profile_path.is_file():
+            return invalid(f"{PROFILE_REL.as_posix()} is not a regular file")
+    else:
+        state_project = _state_project_root(project)
+        common_root = harness_paths.common_root(project)
+        common_profile = state_project / PROFILE_REL
+        if (
+            state_project == project
+            or state_project != common_root
+            or not os.path.lexists(common_profile)
+        ):
+            return None
+        if not common_profile.is_file():
+            return invalid(
+                f"common {PROFILE_REL.as_posix()} is not a regular file"
+            )
+        profile_path = common_profile
     try:
         profile = _read_json(profile_path)
-    except (OSError, json.JSONDecodeError):
-        return [], []
-    tracking = profile.get("testTracking") if isinstance(profile, dict) else None
+    except (OSError, json.JSONDecodeError) as exc:
+        return invalid(f"cannot read {profile_path}: {exc}")
+    if not isinstance(profile, dict):
+        return invalid(f"{profile_path} must contain a JSON object")
+    tracking = profile.get("testTracking")
+    if not isinstance(tracking, dict):
+        return invalid(f"{profile_path} testTracking must be an object")
     paths = tracking.get("paths") if isinstance(tracking, dict) else None
-    if not isinstance(paths, list):
-        return [], []
-    excluded = profile.get("excludedRoots") if isinstance(profile, dict) else None
+    if (
+        not isinstance(paths, list)
+        or not paths
+        or any(not isinstance(item, str) or not item.strip() for item in paths)
+    ):
+        return invalid(
+            f"{profile_path} testTracking.paths must be a non-empty string list"
+        )
+    excluded = profile.get("excludedRoots")
+    if excluded is not None and (
+        not isinstance(excluded, list)
+        or any(not isinstance(item, str) or not item.strip() for item in excluded)
+    ):
+        return invalid(f"{profile_path} excludedRoots must be a string list")
     configured_roots = (
-        [item.replace("\\", "/").strip("/") for item in excluded if isinstance(item, str) and item]
+        [item.replace("\\", "/").strip("/") for item in excluded]
         if isinstance(excluded, list)
         else []
     )
     excluded_roots = list(
         dict.fromkeys([*configured_roots, *MANDATORY_EXCLUDED_ROOTS])
     )
-    patterns = [
-        item.replace("\\", "/") for item in paths if isinstance(item, str) and item
-    ]
+    patterns = [item.replace("\\", "/") for item in paths]
     return patterns, excluded_roots
 
 
@@ -297,6 +341,29 @@ def _validate_file(project: Path, raw: str) -> tuple[Path | None, str | None, st
     return resolved, rel, None
 
 
+def _validate_snapshot_file(
+    project: Path,
+    raw: str,
+) -> tuple[Path | None, str | None, str | None]:
+    """Validate a path captured under the begin-time profile.
+
+    The active profile may legitimately change before close. Snapshot paths
+    remain constrained to the repository but are not reclassified against the
+    newer allowlist.
+    """
+    candidate = Path(raw)
+    if not candidate.is_absolute():
+        candidate = project / candidate
+    resolved = candidate.resolve()
+    if not _inside(resolved, project):
+        return None, None, "PATH_OUTSIDE_PROJECT"
+    if not resolved.exists():
+        return None, None, "FILE_NOT_FOUND"
+    if not resolved.is_file():
+        return None, None, "NOT_REGULAR_FILE"
+    return resolved, resolved.relative_to(project).as_posix(), None
+
+
 def _contract_is_v2(change_root: Path) -> bool:
     try:
         contract = harness_paths.load_change_contract(change_root)
@@ -744,6 +811,217 @@ def rehome(
     )
 
 
+def rebind_snapshot(
+    from_project: Path | str,
+    to_project: Path | str,
+    change_dir: Path | str,
+    expected_base: str,
+) -> dict[str, Any]:
+    """Rebind an unchanged pre-change snapshot to a descendant worktree.
+
+    This is the pre-merge counterpart to ``rehome``.  It is intentionally
+    narrow: the source root must still be exactly at ``expected_base``, every
+    snapshotted file must still match its captured byte hash there, and the
+    target HEAD must descend from that base.  A target-owned manifest, when
+    present, is validated but never rewritten.
+    """
+
+    action = "rebind-snapshot"
+    from_root = Path(from_project).resolve()
+    to_root = Path(to_project).resolve()
+    if not from_root.is_dir() or not to_root.is_dir():
+        return _result(False, action, "PROJECT_ROOT_MISSING", [])
+    if harness_paths.repository_identity(from_root) != harness_paths.repository_identity(to_root):
+        return _result(False, action, "REPOSITORY_MISMATCH", [])
+
+    from_head_result = _git(from_root, "rev-parse", "--verify", "HEAD")
+    from_head = from_head_result.stdout.strip() if from_head_result.returncode == 0 else ""
+    if not expected_base or from_head != expected_base:
+        return _result(
+            False,
+            action,
+            "EXPECTED_BASE_MISMATCH",
+            [],
+            expectedBase=expected_base,
+            actualBase=from_head,
+        )
+
+    to_head_result = _git(to_root, "rev-parse", "--verify", "HEAD")
+    to_head = to_head_result.stdout.strip() if to_head_result.returncode == 0 else ""
+    descendant = _git(
+        to_root,
+        "merge-base",
+        "--is-ancestor",
+        expected_base,
+        to_head,
+    )
+    if not to_head or descendant.returncode != 0:
+        return _result(
+            False,
+            action,
+            "TARGET_NOT_DESCENDANT",
+            [],
+            expectedBase=expected_base,
+            targetHead=to_head,
+        )
+
+    change_root = _change_dir(from_root, change_dir)
+    if change_root is None:
+        return _result(False, action, "CHANGE_DIR_OUTSIDE_PROJECT", [])
+    snapshot_path = _state_root(change_root) / SNAPSHOT_REL
+    if not _manifest_target_inside(change_root, snapshot_path):
+        return _result(False, action, "SNAPSHOT_PATH_OUTSIDE_PROJECT", [])
+    manifest_path = _manifest_path(change_root)
+    if manifest_path is None:
+        return _result(False, action, "MANIFEST_PATH_OUTSIDE_PROJECT", [])
+
+    lock_path = snapshot_path.with_name(snapshot_path.name + ".lock")
+    try:
+        with _exclusive_lock(lock_path, wait_seconds=5.0):
+            try:
+                snapshot = _read_json(snapshot_path)
+            except FileNotFoundError:
+                return _result(False, action, "SNAPSHOT_MISSING", [])
+            except (OSError, json.JSONDecodeError) as exc:
+                return _result(False, action, "SNAPSHOT_INVALID", [], error=str(exc))
+
+            entries = snapshot.get("files") if isinstance(snapshot, dict) else None
+            snapshot_root = snapshot.get("projectRoot") if isinstance(snapshot, dict) else None
+            if (
+                not isinstance(snapshot, dict)
+                or snapshot.get("schemaVersion") != SCHEMA_VERSION
+                or snapshot.get("mode") != MODE
+                or snapshot_root not in {str(from_root), str(to_root)}
+                or not isinstance(entries, list)
+            ):
+                return _result(False, action, "SNAPSHOT_INVALID", [])
+
+            validated_paths: list[str] = []
+            for item in entries:
+                if (
+                    not isinstance(item, dict)
+                    or not isinstance(item.get("path"), str)
+                    or not isinstance(item.get("sha256"), str)
+                ):
+                    return _result(False, action, "SNAPSHOT_INVALID", [])
+                rel = item["path"]
+                source, normalized, error = _validate_file(from_root, rel)
+                if error or normalized != rel or source is None:
+                    return _result(False, action, error or "SNAPSHOT_INVALID", [rel])
+                if item["sha256"] != _sha256(source):
+                    return _result(False, action, "SOURCE_SNAPSHOT_DRIFT", [rel])
+                item["logicalHash"] = logical_file_hash(from_root, rel)
+                validated_paths.append(rel)
+
+            manifest = None
+            if manifest_path.is_file():
+                try:
+                    manifest = _read_json(manifest_path)
+                except (OSError, json.JSONDecodeError) as exc:
+                    return _result(False, action, "MANIFEST_INVALID", [], error=str(exc))
+                validator = (
+                    _validate_existing_manifest_v2
+                    if isinstance(manifest, dict) and manifest.get("schemaVersion") == 2
+                    else _validate_existing_manifest
+                )
+                error, _ = validator(to_root, manifest, require_files=False)
+                if error:
+                    return _result(False, action, error, [])
+
+            before_hash = _sha256(snapshot_path)
+            rebound_at = time.strftime("%Y-%m-%dT%H:%M:%S")
+            rebind_id = "rebind-" + hashlib.sha256(
+                f"{from_root}\0{to_root}\0{expected_base}\0{to_head}".encode("utf-8")
+            ).hexdigest()[:20]
+            updated = json.loads(json.dumps(snapshot))
+            updated["files"] = entries
+            rebinds = updated.get("rebinds")
+            if rebinds is None:
+                rebinds = []
+            if not isinstance(rebinds, list):
+                return _result(False, action, "SNAPSHOT_INVALID", [])
+            record = {
+                "id": rebind_id,
+                "fromRoot": str(from_root),
+                "toRoot": str(to_root),
+                "expectedBase": expected_base,
+                "targetHead": to_head,
+                "at": rebound_at,
+                "snapshotHashBefore": before_hash,
+            }
+            if not any(
+                isinstance(item, dict) and item.get("id") == rebind_id
+                for item in rebinds
+            ):
+                rebinds.append(record)
+            updated["projectRoot"] = str(to_root)
+            updated["rebinds"] = rebinds
+            _write_json(snapshot_path, updated)
+            after_hash = _sha256(snapshot_path)
+
+            removed_manifest_paths: list[str] = []
+            if isinstance(manifest, dict):
+                manifest_entries = manifest.get("files")
+                if not isinstance(manifest_entries, list):
+                    return _result(False, action, "MANIFEST_INVALID", [])
+                baseline = {
+                    item["path"]: item["logicalHash"]
+                    for item in entries
+                    if isinstance(item, dict)
+                    and isinstance(item.get("path"), str)
+                    and isinstance(item.get("logicalHash"), str)
+                }
+                kept_entries: list[dict[str, Any]] = []
+                for item in manifest_entries:
+                    rel = item.get("path") if isinstance(item, dict) else None
+                    if (
+                        isinstance(rel, str)
+                        and rel in baseline
+                        and item.get("reason") in REASONS
+                        and logical_file_hash(to_root, rel) == baseline[rel]
+                    ):
+                        removed_manifest_paths.append(rel)
+                        continue
+                    kept_entries.append(item)
+                if removed_manifest_paths:
+                    cleaned = json.loads(json.dumps(manifest))
+                    cleaned["files"] = kept_entries
+                    cleanups = cleaned.get("reconciliations")
+                    if cleanups is None:
+                        cleanups = []
+                    if not isinstance(cleanups, list):
+                        return _result(False, action, "MANIFEST_INVALID", [])
+                    cleanups.append(
+                        {
+                            "rebindId": rebind_id,
+                            "at": rebound_at,
+                            "reason": "logical-baseline-match",
+                            "removedPaths": sorted(removed_manifest_paths),
+                        }
+                    )
+                    cleaned["reconciliations"] = cleanups
+                    _write_json(manifest_path, cleaned)
+    except LockUnavailable:
+        return _result(False, action, "SNAPSHOT_LOCKED", [])
+
+    return _result(
+        True,
+        action,
+        "SNAPSHOT_REBOUND",
+        sorted(validated_paths),
+        fromRoot=str(from_root),
+        toRoot=str(to_root),
+        expectedBase=expected_base,
+        targetHead=to_head,
+        rebindId=rebind_id,
+        snapshotHashBefore=before_hash,
+        snapshotHashAfter=after_hash,
+        manifestEntriesRemoved=len(removed_manifest_paths),
+        removedManifestPaths=sorted(removed_manifest_paths),
+        snapshotPath=str(snapshot_path),
+    )
+
+
 def _stage_locked(
     project_root: Path, change_root: Path, manifest_path: Path, index_path: Path
 ) -> dict[str, Any]:
@@ -870,10 +1148,14 @@ def _walk_matching_files(
     return matches
 
 
-def _enumerate_allowed_test_files(project_root: Path) -> dict[str, str]:
+def _enumerate_allowed_test_files(
+    project_root: Path,
+    *,
+    strict_profile: bool = False,
+) -> dict[str, str]:
     """Map repo-relative test path -> sha256 for all allowed existing files."""
     found: dict[str, str] = {}
-    config = _profile_config(project_root)
+    config = _profile_config(project_root, strict=strict_profile)
     if config is None:
         patterns = ["test/**", "tests/**", "src/test/**"]
         excluded_roots = [
@@ -888,13 +1170,285 @@ def _enumerate_allowed_test_files(project_root: Path) -> dict[str, str]:
         if not _inside(resolved, base):
             continue
         rel = resolved.relative_to(base).as_posix()
-        if rel in seen or not _allowed_test_path(project_root, rel):
+        if (
+            rel in seen
+            or _path_is_excluded(rel, excluded_roots)
+            or not any(_matches_pattern(rel, pattern) for pattern in patterns)
+        ):
             continue
         seen.add(rel)
         found[rel] = _sha256(resolved)
     return found
 
 
+def _current_head(project_root: Path) -> str | None:
+    result = _git(project_root, "rev-parse", "--verify", "HEAD")
+    value = result.stdout.strip() if result.returncode == 0 else ""
+    return value if re.fullmatch(r"[0-9a-fA-F]{40,64}", value) else None
+
+
+def _snapshot_baseline_commit(
+    project_root: Path,
+    change_root: Path,
+    snapshot: dict[str, Any],
+) -> str | None:
+    candidates: list[Any] = [snapshot.get("headCommit")]
+    for state_snapshot_path in dict.fromkeys(
+        [
+            change_root / "meta" / "state-snapshot.json",
+            _state_root(change_root) / "meta" / "state-snapshot.json",
+        ]
+    ):
+        if not state_snapshot_path.is_file():
+            continue
+        try:
+            state_snapshot = _read_json(state_snapshot_path)
+        except (OSError, json.JSONDecodeError):
+            continue
+        if isinstance(state_snapshot, dict):
+            git_state = state_snapshot.get("git")
+            if isinstance(git_state, dict):
+                candidates.extend([git_state.get("base"), git_state.get("head")])
+    for candidate in candidates:
+        if not isinstance(candidate, str) or re.fullmatch(
+            r"[0-9a-fA-F]{40,64}", candidate
+        ) is None:
+            continue
+        exists = _git(project_root, "cat-file", "-e", f"{candidate}^{{commit}}")
+        if exists.returncode == 0:
+            return candidate
+    return None
+
+
+def _classify_against_baseline(
+    project_root: Path,
+    rel: str,
+    baseline_commit: str | None,
+) -> tuple[str | None, str | None]:
+    """Return touched reason (or None when unchanged) and an optional error."""
+    if baseline_commit is None:
+        return None, "BASELINE_COMMIT_MISSING"
+    listed = _git(
+        project_root,
+        "ls-tree",
+        "-r",
+        "--name-only",
+        "-z",
+        baseline_commit,
+        "--",
+        rel,
+    )
+    if listed.returncode != 0:
+        return None, "BASELINE_LOOKUP_FAILED"
+    tracked_at_baseline = rel in {
+        item for item in listed.stdout.split("\0") if item
+    }
+    if not tracked_at_baseline:
+        return "tdd-created", None
+    changed = _git(
+        project_root,
+        "diff",
+        "--quiet",
+        baseline_commit,
+        "--",
+        rel,
+    )
+    if changed.returncode == 0:
+        return None, None
+    if changed.returncode == 1:
+        return "test-updated", None
+    return None, "BASELINE_DIFF_FAILED"
+
+
+def _profile_fingerprint(
+    project_root: Path,
+    *,
+    strict_profile: bool = False,
+) -> str:
+    config = _profile_config(project_root, strict=strict_profile)
+    payload = json.dumps(
+        {"mode": "fallback"} if config is None else {"mode": "profile", "value": config},
+        ensure_ascii=False,
+        sort_keys=True,
+        separators=(",", ":"),
+    ).encode("utf-8")
+    return "sha256:" + hashlib.sha256(payload).hexdigest()
+
+
+def _reconcile_close_manifest(
+    project_root: Path,
+    change_root: Path,
+    recorded: set[str],
+    baseline_commit: str | None,
+) -> dict[str, Any]:
+    manifest_path = _manifest_path(change_root)
+    if manifest_path is None:
+        return {"ok": False, "code": "MANIFEST_PATH_OUTSIDE_PROJECT"}
+    if not manifest_path.is_file():
+        return {
+            "ok": True,
+            "code": "NO_MANIFEST",
+            "removedCurrentTouches": 0,
+            "deletedEntries": 0,
+            "preservedForeignEntries": 0,
+        }
+
+    lock_path = manifest_path.with_name(manifest_path.name + ".lock")
+    try:
+        with _exclusive_lock(lock_path, wait_seconds=5.0):
+            try:
+                manifest = _read_json(manifest_path)
+            except (OSError, json.JSONDecodeError) as exc:
+                return {"ok": False, "code": "MANIFEST_INVALID", "error": str(exc)}
+            is_v2 = isinstance(manifest, dict) and manifest.get("schemaVersion") == 2
+            validator = (
+                _validate_existing_manifest_v2
+                if is_v2
+                else _validate_existing_manifest
+            )
+            head_before = _current_head(project_root)
+            if head_before is None:
+                return {"ok": False, "code": "HEAD_MISSING"}
+            allow_hash_drift: set[str] = set()
+            raw_entries = (
+                manifest.get("files")
+                if isinstance(manifest, dict)
+                else None
+            )
+            if isinstance(raw_entries, list):
+                for raw_item in raw_entries:
+                    if not isinstance(raw_item, dict):
+                        continue
+                    rel = raw_item.get("path")
+                    if (
+                        not isinstance(rel, str)
+                        or not rel
+                        or rel in recorded
+                        or raw_item.get("reason") == "stale-test-repair"
+                    ):
+                        continue
+                    touched_reason, classify_error = _classify_against_baseline(
+                        project_root,
+                        rel,
+                        baseline_commit,
+                    )
+                    if classify_error:
+                        return {
+                            "ok": False,
+                            "code": classify_error,
+                            "files": [rel],
+                        }
+                    if touched_reason is None:
+                        allow_hash_drift.add(rel)
+            error, validated = validator(
+                project_root,
+                manifest,
+                allow_hash_drift=allow_hash_drift,
+                require_files=False,
+            )
+            if error:
+                return {"ok": False, "code": error}
+
+            before_hash = _sha256(manifest_path)
+            change_id = change_root.name
+            reconciled: list[dict[str, Any]] = []
+            removed_paths: list[str] = []
+            removed_current_touches = 0
+            deleted_entries = 0
+            preserved_foreign_entries = 0
+
+            for rel in sorted(validated):
+                item = dict(validated[rel])
+                if rel in recorded or item.get("reason") == "stale-test-repair":
+                    reconciled.append(item)
+                    continue
+                touched_reason, classify_error = _classify_against_baseline(
+                    project_root,
+                    rel,
+                    baseline_commit,
+                )
+                if classify_error:
+                    return {"ok": False, "code": classify_error, "files": [rel]}
+                if touched_reason is not None:
+                    reconciled.append(item)
+                    continue
+
+                if not is_v2:
+                    removed_paths.append(rel)
+                    deleted_entries += 1
+                    continue
+
+                touched_by = list(item.get("touchedBy") or [])
+                if change_id not in touched_by:
+                    reconciled.append(item)
+                    preserved_foreign_entries += 1
+                    continue
+                remaining = [owner for owner in touched_by if owner != change_id]
+                removed_current_touches += 1
+                if item.get("introducedBy") == change_id:
+                    if remaining:
+                        return {
+                            "ok": False,
+                            "code": "FOREIGN_PROVENANCE_CONFLICT",
+                            "files": [rel],
+                        }
+                    removed_paths.append(rel)
+                    deleted_entries += 1
+                    continue
+                item["touchedBy"] = remaining
+                item["commitScope"] = "foreign-change"
+                current_hash = logical_file_hash(project_root, rel)
+                item["logicalHash"] = current_hash
+                item["binaryHash"] = (
+                    None if current_hash.startswith("gitblob:") else current_hash
+                )
+                reconciled.append(item)
+                preserved_foreign_entries += 1
+
+            for rel in removed_paths:
+                touched_reason, classify_error = _classify_against_baseline(
+                    project_root,
+                    rel,
+                    baseline_commit,
+                )
+                if classify_error or touched_reason is not None:
+                    return {
+                        "ok": False,
+                        "code": classify_error or "FILE_CHANGED_DURING_RECONCILE",
+                        "files": [rel],
+                    }
+            if _current_head(project_root) != head_before:
+                return {"ok": False, "code": "HEAD_MOVED"}
+
+            updated = json.loads(json.dumps(manifest))
+            updated["files"] = reconciled
+            if reconciled:
+                recheck_error, _ = validator(
+                    project_root,
+                    updated,
+                    require_files=False,
+                )
+                if recheck_error:
+                    return {"ok": False, "code": recheck_error}
+                _write_json(manifest_path, updated)
+                after_hash: str | None = _sha256(manifest_path)
+            else:
+                manifest_path.unlink()
+                after_hash = None
+    except LockUnavailable:
+        return {"ok": False, "code": "MANIFEST_LOCKED"}
+
+    return {
+        "ok": True,
+        "code": "RECONCILED",
+        "manifestHashBefore": before_hash,
+        "manifestHashAfter": after_hash,
+        "removedCurrentTouches": removed_current_touches,
+        "deletedEntries": deleted_entries,
+        "preservedForeignEntries": preserved_foreign_entries,
+    }
+
+
 def begin(project: Path | str, change_dir: Path | str) -> dict[str, Any]:
     action = "begin"
     project_root = Path(project).resolve()
@@ -907,6 +1461,19 @@ def begin(project: Path | str, change_dir: Path | str) -> dict[str, Any]:
     snapshot_path = _state_root(change_root) / SNAPSHOT_REL
     if not _manifest_target_inside(change_root, snapshot_path):
         return _result(False, action, "SNAPSHOT_PATH_OUTSIDE_PROJECT", [])
+    try:
+        current_profile_fingerprint = _profile_fingerprint(
+            project_root,
+            strict_profile=True,
+        )
+    except ProfileConfigInvalid as exc:
+        return _result(
+            False,
+            action,
+            "PROFILE_INVALID",
+            [],
+            error=str(exc),
+        )
 
     if snapshot_path.is_file():
         try:
@@ -924,6 +1491,11 @@ def begin(project: Path | str, change_dir: Path | str) -> dict[str, Any]:
                    for item in entries)
         ):
             return _result(False, action, "SNAPSHOT_INVALID", [])
+        if (
+            isinstance(snapshot.get("profileFingerprint"), str)
+            and snapshot["profileFingerprint"] != current_profile_fingerprint
+        ):
+            return _result(False, action, "PROFILE_CHANGED", [])
         return _result(
             True,
             action,
@@ -933,11 +1505,26 @@ def begin(project: Path | str, change_dir: Path | str) -> dict[str, Any]:
             fileCount=len(entries),
         )
 
-    files = _enumerate_allowed_test_files(project_root)
+    try:
+        files = _enumerate_allowed_test_files(
+            project_root,
+            strict_profile=True,
+        )
+    except ProfileConfigInvalid as exc:
+        return _result(
+            False,
+            action,
+            "PROFILE_INVALID",
+            [],
+            error=str(exc),
+        )
     snapshot = {
         "schemaVersion": SCHEMA_VERSION,
         "mode": MODE,
         "projectRoot": str(project_root),
+        "repositoryId": harness_paths.repository_identity(project_root),
+        "headCommit": _current_head(project_root),
+        "profileFingerprint": current_profile_fingerprint,
         "capturedAt": time.strftime("%Y-%m-%dT%H:%M:%S"),
         "files": [
             {"path": rel, "sha256": digest, "ignored": _is_ignored(project_root, rel)}
@@ -987,6 +1574,36 @@ def close(project: Path | str, change_dir: Path | str) -> dict[str, Any]:
             expectedRoot=snapshot_root,
             actualRoot=str(project_root),
         )
+    snapshot_repository = snapshot.get("repositoryId")
+    if (
+        snapshot_repository is not None
+        and snapshot_repository != harness_paths.repository_identity(project_root)
+    ):
+        return _result(False, action, "REPOSITORY_MISMATCH", [])
+    try:
+        current_profile_fingerprint = _profile_fingerprint(
+            project_root,
+            strict_profile=True,
+        )
+    except ProfileConfigInvalid as exc:
+        return _result(
+            False,
+            action,
+            "PROFILE_INVALID",
+            [],
+            error=str(exc),
+        )
+    if (
+        isinstance(snapshot.get("profileFingerprint"), str)
+        and snapshot["profileFingerprint"] != current_profile_fingerprint
+    ):
+        return _result(False, action, "PROFILE_CHANGED", [])
+    baseline_commit = _snapshot_baseline_commit(
+        project_root,
+        change_root,
+        snapshot,
+    )
+    profile_changed = False
 
     before_entries = snapshot.get("files")
     if not isinstance(before_entries, list):
@@ -999,14 +1616,26 @@ def close(project: Path | str, change_dir: Path | str) -> dict[str, Any]:
         digest = item.get("sha256")
         if not isinstance(rel, str) or not rel or not isinstance(digest, str):
             return _result(False, action, "SNAPSHOT_INVALID", [])
-        path, normalized, error = _validate_file(project_root, rel)
+        path, normalized, error = _validate_snapshot_file(project_root, rel)
         if error:
             return _result(False, action, error, [rel])
         if normalized != rel or path is None:
             return _result(False, action, "PATH_ESCAPE", [rel])
         before[rel] = item
 
-    current = _enumerate_allowed_test_files(project_root)
+    try:
+        current = _enumerate_allowed_test_files(
+            project_root,
+            strict_profile=True,
+        )
+    except ProfileConfigInvalid as exc:
+        return _result(
+            False,
+            action,
+            "PROFILE_INVALID",
+            [],
+            error=str(exc),
+        )
     for rel in current:
         path, normalized, error = _validate_file(project_root, rel)
         if error:
@@ -1017,9 +1646,23 @@ def close(project: Path | str, change_dir: Path | str) -> dict[str, Any]:
     touched: list[tuple[str, str]] = []
     for rel, digest in current.items():
         if rel not in before:
-            touched.append((rel, "tdd-created"))
+            reason, classify_error = _classify_against_baseline(
+                project_root,
+                rel,
+                baseline_commit,
+            )
+            if classify_error:
+                return _result(False, action, classify_error, [rel])
+            if reason is not None:
+                touched.append((rel, reason))
             continue
-        if before[rel]["sha256"] != digest:
+        before_digest = before[rel].get("logicalHash") or before[rel]["sha256"]
+        current_digest = (
+            logical_file_hash(project_root, rel)
+            if before[rel].get("logicalHash")
+            else digest
+        )
+        if before_digest != current_digest:
             touched.append((rel, "test-updated"))
 
     for reason in ("tdd-created", "test-updated"):
@@ -1039,6 +1682,19 @@ def close(project: Path | str, change_dir: Path | str) -> dict[str, Any]:
             return result
 
     recorded = [rel for rel, _ in touched]
+    reconciliation = _reconcile_close_manifest(
+        project_root,
+        change_root,
+        set(recorded),
+        baseline_commit,
+    )
+    if not reconciliation.get("ok"):
+        return _result(
+            False,
+            action,
+            str(reconciliation.get("code") or "MANIFEST_RECONCILE_FAILED"),
+            list(reconciliation.get("files") or []),
+        )
 
     # Cross-check (retro §5.10): if the manifest has active entries for this
     # change but close computed recordedCount=0, the snapshot/manifest/diff
@@ -1052,10 +1708,17 @@ def close(project: Path | str, change_dir: Path | str) -> dict[str, Any]:
         if isinstance(manifest, dict):
             manifest_files = manifest.get("files")
             if isinstance(manifest_files, list):
+                is_v2 = manifest.get("schemaVersion") == 2
+                change_id = change_root.name
                 active_entries = [
                     f for f in manifest_files
                     if isinstance(f, dict)
                     and f.get("reason") in ("tdd-created", "test-updated", "stale-test-repair")
+                    and (
+                        not is_v2
+                        or f.get("introducedBy") == change_id
+                        or change_id in (f.get("touchedBy") or [])
+                    )
                 ]
                 if active_entries and not recorded:
                     return _result(
@@ -1075,6 +1738,13 @@ def close(project: Path | str, change_dir: Path | str) -> dict[str, Any]:
         recorded,
         recordedCount=len(recorded),
         unchangedPreexisting=len(before) - sum(1 for rel, _ in touched if rel in before),
+        baselineCommit=baseline_commit,
+        profileChanged=profile_changed,
+        manifestReconciliation={
+            key: value
+            for key, value in reconciliation.items()
+            if key != "ok"
+        },
     )
 
 
@@ -1146,6 +1816,12 @@ def main(argv: list[str] | None = None) -> int:
     rehome_parser.add_argument("--change-dir", required=True)
     rehome_parser.add_argument("--expected-head", required=True)
     rehome_parser.add_argument("--json", action="store_true")
+    rebind_parser = sub.add_parser("rebind-snapshot")
+    rebind_parser.add_argument("--from", dest="from_project", required=True)
+    rebind_parser.add_argument("--to", dest="to_project", required=True)
+    rebind_parser.add_argument("--change-dir", required=True)
+    rebind_parser.add_argument("--expected-base", required=True)
+    rebind_parser.add_argument("--json", action="store_true")
     mark_parser = sub.add_parser("mark")
     mark_parser.add_argument("--project", required=True)
     mark_parser.add_argument("--change-dir", required=True)
@@ -1166,6 +1842,10 @@ def main(argv: list[str] | None = None) -> int:
         result = rehome(
             args.from_project, args.to_project, args.change_dir, args.expected_head
         )
+    elif args.action == "rebind-snapshot":
+        result = rebind_snapshot(
+            args.from_project, args.to_project, args.change_dir, args.expected_base
+        )
     else:
         result = stage(args.project, args.change_dir)
     print(json.dumps(result, ensure_ascii=False, indent=2 if args.json else None))