@hunter-harness/workflow-harness 0.2.28 → 0.2.29

package/harness/bundles/general/cursor/scripts/harness_workflow_policy.py

@@ -15,6 +15,7 @@ POLICY_REL = Path("harness") / "contracts" / "workflow-policy.json"
 TOP_LEVEL_KEYS = frozenset(
     {
         "schemaVersion",
+        "testExecution",
         "riskTiers",
         "skills",
         "requiredArtifacts",
@@ -62,6 +63,27 @@ CHECKPOINT_RULE_KEYS = frozenset(
         "reviewerTool",
     }
 )
+TEST_EXECUTION_KEYS = frozenset(
+    {
+        "runner",
+        "defaultProfile",
+        "maxWorkers",
+        "singleInstance",
+        "processTreeCleanup",
+        "detachedProcessPreflight",
+        "confirmationFlag",
+        "confirmationRequiredProfiles",
+        "resourceIntensiveModules",
+        "profiles",
+    }
+)
+TEST_EXECUTION_PROFILE_KEYS = frozenset(
+    {
+        "description",
+        "includesResourceIntensive",
+        "moduleTimeoutSeconds",
+    }
+)
 
 
 class PolicyValidationError(ValueError):
@@ -94,6 +116,71 @@ def validate_policy(data: Any) -> dict[str, Any]:
     if data["schemaVersion"] != 1:
         raise PolicyValidationError("unsupported schemaVersion")
 
+    test_execution = data["testExecution"]
+    _require_type(test_execution, dict, "testExecution")
+    _reject_unknown(test_execution, TEST_EXECUTION_KEYS, "testExecution")
+    for key in ("runner", "defaultProfile", "confirmationFlag"):
+        _require_type(test_execution[key], str, f"testExecution.{key}")
+    max_workers = test_execution["maxWorkers"]
+    _require_type(max_workers, int, "testExecution.maxWorkers")
+    if isinstance(max_workers, bool) or max_workers < 1 or max_workers > 2:
+        raise PolicyValidationError("testExecution.maxWorkers must be 1 or 2")
+    for key in (
+        "singleInstance",
+        "processTreeCleanup",
+        "detachedProcessPreflight",
+    ):
+        _require_type(test_execution[key], bool, f"testExecution.{key}")
+        if not test_execution[key]:
+            raise PolicyValidationError(f"testExecution.{key} must be true")
+    for key in ("confirmationRequiredProfiles", "resourceIntensiveModules"):
+        values = test_execution[key]
+        _require_type(values, list, f"testExecution.{key}")
+        if any(not isinstance(item, str) or not item for item in values):
+            raise PolicyValidationError(
+                f"testExecution.{key} must contain non-empty strings"
+            )
+
+    execution_profiles = test_execution["profiles"]
+    _require_type(execution_profiles, dict, "testExecution.profiles")
+    required_profile_names = {"safe", "system", "full"}
+    if set(execution_profiles) != required_profile_names:
+        raise PolicyValidationError(
+            "testExecution.profiles must define exactly safe, system, and full"
+        )
+    if test_execution["defaultProfile"] != "safe":
+        raise PolicyValidationError("testExecution.defaultProfile must be safe")
+    confirmation_profiles = set(test_execution["confirmationRequiredProfiles"])
+    if not {"system", "full"}.issubset(confirmation_profiles):
+        raise PolicyValidationError(
+            "testExecution confirmation must cover system and full"
+        )
+    for profile_name, profile in execution_profiles.items():
+        path = f"testExecution.profiles.{profile_name}"
+        _require_type(profile, dict, path)
+        _reject_unknown(profile, TEST_EXECUTION_PROFILE_KEYS, path)
+        _require_type(profile["description"], str, f"{path}.description")
+        _require_type(
+            profile["includesResourceIntensive"],
+            bool,
+            f"{path}.includesResourceIntensive",
+        )
+        timeout = profile["moduleTimeoutSeconds"]
+        _require_type(timeout, int, f"{path}.moduleTimeoutSeconds")
+        if isinstance(timeout, bool) or timeout <= 0:
+            raise PolicyValidationError(
+                f"{path}.moduleTimeoutSeconds must be a positive integer"
+            )
+    if execution_profiles["safe"]["includesResourceIntensive"]:
+        raise PolicyValidationError(
+            "testExecution.profiles.safe must exclude resource-intensive tests"
+        )
+    for profile_name in ("system", "full"):
+        if not execution_profiles[profile_name]["includesResourceIntensive"]:
+            raise PolicyValidationError(
+                f"testExecution.profiles.{profile_name} must include resource-intensive tests"
+            )
+
     risk_tiers = data["riskTiers"]
     _require_type(risk_tiers, dict, "riskTiers")
     for tier_name, tier in risk_tiers.items():

package/harness/bundles/java/claude-code/.harness-build.json

@@ -2,5 +2,5 @@
   "schemaVersion": 1,
   "overlay": "java",
   "agent": "claude-code",
-  "coreHash": "305f32827cd4de18"
+  "coreHash": "777d8783b2b2f001"
 }

package/harness/bundles/java/claude-code/contracts/workflow-policy.json

@@ -1,5 +1,36 @@
 {
   "schemaVersion": 1,
+  "testExecution": {
+    "runner": "harness/scripts/harness_test_runner.py",
+    "defaultProfile": "safe",
+    "maxWorkers": 2,
+    "singleInstance": true,
+    "processTreeCleanup": true,
+    "detachedProcessPreflight": true,
+    "confirmationFlag": "--confirm-resource-intensive",
+    "confirmationRequiredProfiles": ["system", "full"],
+    "resourceIntensiveModules": [
+      "test_harness_integration.py",
+      "test_harness_service.py"
+    ],
+    "profiles": {
+      "safe": {
+        "description": "Default low-load profile; runs regular test modules sequentially in isolated processes.",
+        "includesResourceIntensive": false,
+        "moduleTimeoutSeconds": 300
+      },
+      "system": {
+        "description": "Runs integration and service-lifecycle modules only after explicit confirmation.",
+        "includesResourceIntensive": true,
+        "moduleTimeoutSeconds": 600
+      },
+      "full": {
+        "description": "Runs regular modules followed by resource-intensive modules after explicit confirmation.",
+        "includesResourceIntensive": true,
+        "moduleTimeoutSeconds": 600
+      }
+    }
+  },
   "riskTiers": {
     "fast": {
       "description": "Low-risk docs/comments/non-behavioral config; no API/DB/security/concurrency. Policy notes: checkpointRules apply only when meta/implementation-checkpoints.json defines the entry for this change; missing file/entry = disabled (gate must not require --task).",
@@ -45,8 +76,8 @@
       "inputs": ["test-scenarios", "verification-ledger"],
       "artifacts": ["test-reports", "verification-ledger"],
       "events": ["phase.start", "phase.end", "command", "verification"],
-      "allowedInteractions": [],
-      "capabilities": ["gate-begin", "gate-close", "test-guard", "ledger-record"]
+      "allowedInteractions": ["resource-intensive-test-confirmation"],
+      "capabilities": ["gate-begin", "gate-close", "test-guard", "ledger-record", "resource-safe-test-runner"]
     },
     "harness-review": {
       "phase": "review",
@@ -184,6 +215,7 @@
   },
   "interactionWhitelist": {
     "global": [],
+    "harness-test": ["resource-intensive-test-confirmation"],
     "harness-submit": ["merge-conflict-resolution"],
     "harness-plan": ["risk-confirmation"]
   },

package/harness/bundles/java/claude-code/harness-apidoc/SKILL.md

@@ -20,7 +20,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=305f32827cd4de18; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=777d8783b2b2f001; overlay=java; agent=claude-code; do not edit -->
 # harness-apidoc — 前端接口文档（Java overlay）
 
 ## Purpose

package/harness/bundles/java/claude-code/harness-archive/SKILL.md

@@ -20,7 +20,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=305f32827cd4de18; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=777d8783b2b2f001; overlay=java; agent=claude-code; do not edit -->
 # harness-archive — 变更归档
 
 ## Purpose

package/harness/bundles/java/claude-code/harness-codebase-map/SKILL.md

@@ -20,7 +20,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=305f32827cd4de18; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=777d8783b2b2f001; overlay=java; agent=claude-code; do not edit -->
 # harness-codebase-map — 代码库地图
 
 ## Purpose

package/harness/bundles/java/claude-code/harness-knowledge-ingest/SKILL.md

@@ -20,7 +20,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=305f32827cd4de18; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=777d8783b2b2f001; overlay=java; agent=claude-code; do not edit -->
 # harness-knowledge-ingest
 
 从 `.harness/archive/**/reports/final/summary-data.json` 抽取项目知识，生成并维护本地 `.harness/knowledge/` 索引。

package/harness/bundles/java/claude-code/harness-knowledge-query/SKILL.md

@@ -20,7 +20,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=305f32827cd4de18; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=777d8783b2b2f001; overlay=java; agent=claude-code; do not edit -->
 # harness-knowledge-query
 
 并行 change 中查询必须传 `--change <change-id>`；成功后以该 change 的 `meta/knowledge-context.json` 为稳定指针。全局 `context-packs/latest.json` 仅向后兼容，不得用于判断多个 active change 的上下文归属。

package/harness/bundles/java/claude-code/harness-package/SKILL.md

@@ -20,7 +20,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=305f32827cd4de18; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=777d8783b2b2f001; overlay=java; agent=claude-code; do not edit -->
 # harness-package — 增量模块打包（Java overlay）
 
 ## Purpose

package/harness/bundles/java/claude-code/harness-plan/SKILL.md

@@ -20,7 +20,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=305f32827cd4de18; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=777d8783b2b2f001; overlay=java; agent=claude-code; do not edit -->
 # harness-plan — 需求规划
 
 ## Purpose

package/harness/bundles/java/claude-code/harness-review/SKILL.md

@@ -21,7 +21,7 @@ disallowed-tools:
   - Bash(curl *)
   - Bash(codegraph *)
 ---
-<!-- generated by harness_deploy.py; core=305f32827cd4de18; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=777d8783b2b2f001; overlay=java; agent=claude-code; do not edit -->
 # harness-review — 代码审查
 
 ## Purpose

package/harness/bundles/java/claude-code/harness-run/SKILL.md

@@ -21,7 +21,7 @@ disallowed-tools:
   - Bash(curl *)
   - Bash(codegraph *)
 ---
-<!-- generated by harness_deploy.py; core=305f32827cd4de18; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=777d8783b2b2f001; overlay=java; agent=claude-code; do not edit -->
 # harness-run — 需求编码
 
 ## Purpose

package/harness/bundles/java/claude-code/harness-submit/SKILL.md

@@ -20,7 +20,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=305f32827cd4de18; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=777d8783b2b2f001; overlay=java; agent=claude-code; do not edit -->
 # harness-submit — 最终提交（含 worktree 合并）
 
 ## Purpose

package/harness/bundles/java/claude-code/harness-sync/SKILL.md

@@ -19,7 +19,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=305f32827cd4de18; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=777d8783b2b2f001; overlay=java; agent=claude-code; do not edit -->
 # harness-sync — 元数据同步
 
 ## Purpose

package/harness/bundles/java/claude-code/harness-test/SKILL.md

@@ -22,7 +22,7 @@ disallowed-tools:
   - Bash(node *)
   - Bash(codegraph *)
 ---
-<!-- generated by harness_deploy.py; core=305f32827cd4de18; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=777d8783b2b2f001; overlay=java; agent=claude-code; do not edit -->
 # harness-test — 测试执行
 
 ## Purpose
@@ -67,6 +67,29 @@ disallowed-tools:
 
 并行服务测试先运行 `harness_change.py lease-port --change <id> --run-id <run-id> --range <start-end> --json`，再把返回端口传给 `harness_service.py ensure --leased-port <port> --lease-owner <run-id>`。`serviceStart` 的 command/health/overlay 可用 `{leasedPort}` 占位符；用户自启进程仍只进入 Service Gate，禁止 kill。测试清理的 `finally` 中运行 `harness_change.py release-port --change <id> --run-id <run-id> --json`，避免租约池耗尽。
 
+### Phase -1：资源安全门（任何测试命令之前）
+
+测试默认使用 `safe` 资源档位，禁止直接执行会把整套测试放进同一长生命周期的裸命令。所有本地测试命令必须由 `harness/scripts/harness_test_runner.py` 托管：
+
+```text
+python harness/scripts/harness_test_runner.py exec --profile safe --timeout-seconds <秒> -- <测试命令及参数>
+```
+
+对于 Python `unittest` 测试库，必须使用逐模块隔离模式，不得执行裸 `python -m unittest discover ...`：
+
+```text
+python harness/scripts/harness_test_runner.py unittest --profile safe --tests-dir <测试目录>
+```
+
+资源档位是硬合同：
+
+- `safe`：默认；普通测试模块串行执行，每个模块使用全新进程。
+- `system`：只执行服务生命周期、集成等资源密集型模块。
+- `full`：先执行普通模块，再执行资源密集型模块；仍保持逐模块串行。
+- `system` / `full` 只有在用户明确要求资源密集型测试、传入 `--confirm-resource-intensive`，或受控 CI 设置 `CI=true` / `HARNESS_ALLOW_RESOURCE_INTENSIVE_TESTS=1` 时才允许执行。
+
+Runner 强制同项目单实例、低调度优先级、逐命令超时、正常结束和异常结束的进程树清理。`HARNESS_TEST_MAX_WORKERS` 默认且最高为 `2`，只能调低，不能调高；技术栈自身的并发参数也必须收敛到该值。Windows detached-service 模块在执行前先做 nested-breakaway 能力探测，受限沙箱不支持时立即返回 `DETACHED_PROCESS_CAPABILITY_UNAVAILABLE`，不得让每个服务用例逐一超时。出现该错误、`TEST_RUN_ALREADY_ACTIVE`、`PROCESS_TREE_ISOLATION_UNAVAILABLE` 或 `TEST_COMMAND_TIMEOUT` 必须停止，不得绕过 Runner 重跑裸命令。完整约束见 `checklist.md`「0.0-A 资源安全档位」。
+
 ### Phase 0：环境准备（主会话执行，需要交互确认）
 
 先 `harness_change.py resolve [--change] --json` 解析 change-id；再 **`harness_gate.py begin --phase test --change <id>`**（禁止手工 phase.start / 手写 ledger）。执行各项强制环境检查 + **命令执行模式 preflight (0.1)**；只有首选执行器不可用时，才执行 fallback 执行器探测。
@@ -146,7 +169,7 @@ Phase 1 前先读 `.harness/changes/<change-name>/evidence/verification-ledger.j
 
 ### 五、命令与请求超时治理
 
-所有命令必须有「预期时长 + 超时上限」，超过预期必须输出一次状态行，**不得静默等待**。`durationMs > 10000` → 🟡 SLOW，`> 30000` → ❌ TIMEOUT_RISK。详见 `reference.md`「命令与请求超时治理」。
+所有命令必须通过资源安全 Runner 设置「预期时长 + 超时上限」，超过预期必须输出一次状态行，**不得静默等待**。测试模块超时或退出时必须清理其进程树；`durationMs > 10000` → 🟡 SLOW，`> 30000` → ❌ TIMEOUT_RISK。详见 `reference.md`「命令与请求超时治理」。
 
 ### 五-A、陈旧测试安全修复
 
@@ -201,6 +224,7 @@ python <skills-root>/scripts/harness_test_guard.py record --project . --change-d
 本 skill **仅允许**以下 blocking user confirmation；其余默认值 + `decision` 事件：
 
 1. **Service Gate**：仅当 `harness_service.py ensure` 返回 `needs-user-decision`（用户进程占端口）时询问处理方式
+2. **资源密集型测试确认**：仅当发布/验收确实需要 `system` 或 `full` 档位，且用户尚未明确授权时询问；获得授权后传入 `--confirm-resource-intensive`
 
 ## 执行日志