@hunter-harness/workflow-harness 0.2.31 → 0.2.32

package/harness/bundles/general/claude-code/scripts/harness_gate.py

@@ -1635,31 +1635,27 @@ def _validate_scenario_coverage(change_dir: Path) -> dict[str, Any]:
         for s in scenarios
         if isinstance(s, dict)
         and (
-            s.get("requiredEvidenceKind") == "ledger"
-            or (
-                not s.get("requiredEvidenceKind")
-                and str(s.get("priority", "")).upper() in {"P0", "P1"}
-            )
+            str(s.get("priority", "")).upper() in {"P0", "P1"}
+            or s.get("requiredEvidenceKind") == "ledger"
         )
     }
     if not required_ids:
         return {"ok": True, "code": "NO_LEDGER_REQUIRED_SCENARIOS"}
 
-    ledger_path = change_dir / "evidence" / "verification-ledger.json"
-    if not ledger_path.is_file():
+    try:
+        ledger, ledger_path = hl.load_ledger(change_dir)
+    except (OSError, ValueError, json.JSONDecodeError) as exc:
         return {
             "ok": False,
             "code": "SCENARIO_COVERAGE_FAILED",
-            "message": "ledger missing; cannot verify required scenario coverage",
+            "message": f"ledger unreadable: {exc}",
             "missing": sorted(required_ids),
         }
-    try:
-        ledger = json.loads(ledger_path.read_text(encoding="utf-8-sig"))
-    except (OSError, json.JSONDecodeError) as exc:
+    if ledger is None or ledger_path is None:
         return {
             "ok": False,
             "code": "SCENARIO_COVERAGE_FAILED",
-            "message": f"ledger unreadable: {exc}",
+            "message": "ledger missing; cannot verify required scenario coverage",
             "missing": sorted(required_ids),
         }
     covered: set[str] = set()
@@ -1728,13 +1724,6 @@ def cmd_begin(args: argparse.Namespace) -> int:
                 or plan_verification.get("message")
                 or "finalized plan verification failed"
             )
-            record_blocked_attempt(
-                change_dir,
-                phase=args.phase,
-                code=code,
-                message=message,
-                run_id=args.run_id or os.environ.get("HUNTER_HARNESS_RUN_ID"),
-            )
             return emit_error(
                 code,
                 message,

package/harness/bundles/general/claude-code/scripts/harness_plan_finalize.py

@@ -13,7 +13,7 @@ import re
 import shutil
 import sys
 import tempfile
-from pathlib import Path
+from pathlib import Path, PurePosixPath
 from typing import Any
 
 SCRIPTS_DIR = Path(__file__).resolve().parent
@@ -51,6 +51,12 @@ def _result_error(code: str, message: str) -> dict[str, Any]:
     return {"ok": False, "code": code, "error": message}
 
 
+class PlanParseError(ValueError):
+    def __init__(self, code: str, message: str) -> None:
+        super().__init__(message)
+        self.code = code
+
+
 def _normalize_header(value: str) -> str:
     return re.sub(r"[\s_-]+", "", value).lower()
 
@@ -127,13 +133,23 @@ def parse_test_scenarios(scenarios_path: Path) -> list[dict[str, str]]:
                     break
                 cells = _table_cells(row)
                 if max(id_index, scenario_index) >= len(cells):
-                    row_index += 1
-                    continue
+                    raise PlanParseError(
+                        "PLAN_SCENARIO_ROW_INVALID",
+                        f"{scenarios_path.name}: line {row_index + 1} is missing scenario ID or description",
+                    )
                 complete_row = len(cells) == len(headers)
                 scenario_id = cells[id_index].strip()
                 if not scenario_id or set(scenario_id) <= {"-", ":"}:
-                    row_index += 1
-                    continue
+                    raise PlanParseError(
+                        "PLAN_SCENARIO_ROW_INVALID",
+                        f"{scenarios_path.name}: line {row_index + 1} has an empty scenario ID",
+                    )
+                scenario_text = cells[scenario_index].strip()
+                if not scenario_text or set(scenario_text) <= {"-", ":"}:
+                    raise PlanParseError(
+                        "PLAN_SCENARIO_ROW_INVALID",
+                        f"{scenarios_path.name}: line {row_index + 1} has an empty scenario description",
+                    )
                 priority = (
                     cells[priority_index].strip().upper()
                     if priority_index is not None
@@ -144,7 +160,7 @@ def parse_test_scenarios(scenarios_path: Path) -> list[dict[str, str]]:
                 scenario = {
                     "id": scenario_id,
                     "priority": priority,
-                    "scenario": cells[scenario_index].strip(),
+                    "scenario": scenario_text,
                     "ownerPhase": (
                         cells[owner_phase_index].strip()
                         if owner_phase_index is not None
@@ -219,19 +235,34 @@ def parse_plan_tasks(plan_path: Path) -> list[dict[str, str]]:
             if not row.startswith("|"):
                 break
             cells = _table_cells(row)
-            if len(cells) < len(headers):
-                row_index += 1
-                continue
+            if max(number_index, task_index) >= len(cells):
+                raise PlanParseError(
+                    "PLAN_TASK_ROW_INVALID",
+                    f"{plan_path.name}: line {row_index + 1} is missing task ID or description",
+                )
+            complete_row = len(cells) == len(headers)
             number = cells[number_index].strip()
             task_text = cells[task_index].strip()
-            if not number or not task_text or set(number) <= {"-", ":"}:
-                row_index += 1
-                continue
+            if (
+                not number
+                or not task_text
+                or set(number) <= {"-", ":"}
+                or set(task_text) <= {"-", ":"}
+            ):
+                raise PlanParseError(
+                    "PLAN_TASK_ROW_INVALID",
+                    f"{plan_path.name}: line {row_index + 1} has an empty task ID or description",
+                )
             task: dict[str, str] = {"num": number, "task": task_text}
             if cluster_index is not None and cells[cluster_index].strip():
                 task["cluster"] = cells[cluster_index].strip()
             for name, index in optional_indices.items():
-                if index is not None and cells[index].strip():
+                if (
+                    complete_row
+                    and index is not None
+                    and index < len(cells)
+                    and cells[index].strip()
+                ):
                     task[name] = cells[index].strip()
             tasks.append(task)
             row_index += 1
@@ -416,7 +447,10 @@ def validate_staging(staging: Path, change_name: str) -> dict[str, Any]:
 
     # C8: validate ownerPhase values in plan.md task table.
     plan_path = staging / "plans" / f"{change_name}-plan.md"
-    tasks = parse_plan_tasks(plan_path)
+    try:
+        tasks = parse_plan_tasks(plan_path)
+    except PlanParseError as exc:
+        return _result_error(exc.code, str(exc))
     if not tasks:
         return _result_error(
             "PLAN_TASKS_EMPTY",
@@ -444,7 +478,10 @@ def validate_staging(staging: Path, change_name: str) -> dict[str, Any]:
 
     # C9: parse test-scenarios.md for scenario manifest.
     scenarios_path = staging / "plans" / f"{change_name}-test-scenarios.md"
-    scenarios = parse_test_scenarios(scenarios_path)
+    try:
+        scenarios = parse_test_scenarios(scenarios_path)
+    except PlanParseError as exc:
+        return _result_error(exc.code, str(exc))
     if not scenarios:
         return _result_error(
             "PLAN_SCENARIOS_EMPTY",
@@ -542,6 +579,58 @@ def _validate_plan_start(
     return {"ok": True, "phaseStartCount": 1}
 
 
+def _receipt_artifact_targets(
+    change_dir: Path,
+    files_list: list[Any],
+) -> tuple[list[tuple[str, Path]] | None, dict[str, Any] | None]:
+    targets: list[tuple[str, Path]] = []
+    seen: set[str] = set()
+    for index, value in enumerate(files_list):
+        if not isinstance(value, str):
+            return None, _result_error(
+                "RECEIPT_FILE_PATH_INVALID",
+                f"receipt files[{index}] must be a string",
+            )
+        raw = value
+        segments = raw.split("/")
+        rel = PurePosixPath(raw)
+        invalid = (
+            not raw
+            or raw != raw.strip()
+            or "\\" in raw
+            or ":" in raw
+            or rel.is_absolute()
+            or any(segment in {"", ".", ".."} for segment in segments)
+            or any(segment.endswith((".", " ")) for segment in segments)
+            or not rel.parts
+            or rel.parts[0] not in {"spec", "plans", "meta"}
+        )
+        if invalid:
+            return None, _result_error(
+                "RECEIPT_FILE_PATH_INVALID",
+                f"receipt files[{index}] is not a safe artifact-relative path: {raw!r}",
+            )
+        normalized = rel.as_posix()
+        if normalized in seen:
+            return None, _result_error(
+                "RECEIPT_FILE_PATH_INVALID",
+                f"receipt contains duplicate artifact path: {normalized}",
+            )
+        seen.add(normalized)
+        target = change_dir.joinpath(*rel.parts)
+        cursor = change_dir
+        for part in rel.parts:
+            cursor = cursor / part
+            is_junction = getattr(cursor, "is_junction", lambda: False)
+            if cursor.is_symlink() or is_junction():
+                return None, _result_error(
+                    "RECEIPT_FILE_PATH_INVALID",
+                    f"receipt artifact path traverses a link: {normalized}",
+                )
+        targets.append((normalized, target))
+    return targets, None
+
+
 def verify_plan(change_dir: Path) -> dict[str, Any]:
     """Read-only verification of a finalized plan (retro §5.8).
 
@@ -565,6 +654,11 @@ def verify_plan(change_dir: Path) -> dict[str, Any]:
     change_name = str(receipt.get("changeName") or "").strip()
     if not change_name:
         return _result_error("RECEIPT_INVALID", "receipt missing changeName")
+    if change_name != change_dir.name:
+        return _result_error(
+            "RECEIPT_CHANGE_NAME_INVALID",
+            f"receipt changeName {change_name!r} does not match {change_dir.name!r}",
+        )
 
     expected_hash = str(receipt.get("artifactsHash") or "").strip()
     if not expected_hash.startswith("sha256:"):
@@ -573,6 +667,10 @@ def verify_plan(change_dir: Path) -> dict[str, Any]:
     files_list = receipt.get("files")
     if not isinstance(files_list, list) or not files_list:
         return _result_error("RECEIPT_INVALID", "receipt files list missing or empty")
+    artifact_targets, path_error = _receipt_artifact_targets(change_dir, files_list)
+    if path_error is not None:
+        return path_error
+    assert artifact_targets is not None
     if receipt.get("status") != "finalized":
         return _result_error(
             "RECEIPT_NOT_FINALIZED",
@@ -589,9 +687,7 @@ def verify_plan(change_dir: Path) -> dict[str, Any]:
     # Recompute artifacts hash from published files.
     digest = hashlib.sha256()
     artifact_names: list[str] = []
-    for rel_text in files_list:
-        rel = rel_text.as_posix() if hasattr(rel_text, "as_posix") else str(rel_text)
-        target = change_dir / rel
+    for rel, target in artifact_targets:
         if not target.is_file():
             return _result_error(
                 "ARTIFACT_MISSING", f"published artifact missing: {rel}"
@@ -634,7 +730,10 @@ def verify_plan(change_dir: Path) -> dict[str, Any]:
         }
 
     plan_path = change_dir / "plans" / f"{change_name}-plan.md"
-    expected_tasks = parse_plan_tasks(plan_path)
+    try:
+        expected_tasks = parse_plan_tasks(plan_path)
+    except PlanParseError as exc:
+        return _result_error(exc.code, str(exc))
     if not expected_tasks:
         return _result_error(
             "PLAN_TASKS_EMPTY",
@@ -652,24 +751,25 @@ def verify_plan(change_dir: Path) -> dict[str, Any]:
         )
     except (OSError, json.JSONDecodeError) as exc:
         return _result_error("IMPLEMENTATION_CHECKPOINTS_INVALID", str(exc))
-    actual_tasks = checkpoints.get("tasks") if isinstance(checkpoints, dict) else None
-    expected_task_ids = [str(item.get("num") or "") for item in expected_tasks]
-    actual_task_ids = (
-        [str(item.get("num") or "") for item in actual_tasks if isinstance(item, dict)]
-        if isinstance(actual_tasks, list)
-        else []
-    )
-    if expected_task_ids != actual_task_ids:
+    expected_checkpoints = {
+        "schemaVersion": 1,
+        "changeName": change_name,
+        "tasks": expected_tasks,
+        "foundationGate": "approved",
+    }
+    if checkpoints != expected_checkpoints:
         return _result_error(
             "IMPLEMENTATION_CHECKPOINTS_DRIFT",
-            "derived task IDs do not match the finalized plan: "
-            f"expected={expected_task_ids}, actual={actual_task_ids}",
+            "derived implementation checkpoints do not match the finalized plan",
         )
 
     scenarios_path = (
         change_dir / "plans" / f"{change_name}-test-scenarios.md"
     )
-    expected_scenarios = parse_test_scenarios(scenarios_path)
+    try:
+        expected_scenarios = parse_test_scenarios(scenarios_path)
+    except PlanParseError as exc:
+        return _result_error(exc.code, str(exc))
     if not expected_scenarios:
         return _result_error(
             "PLAN_SCENARIOS_EMPTY",
@@ -694,26 +794,15 @@ def verify_plan(change_dir: Path) -> dict[str, Any]:
             "scenario-manifest.json must contain at least one scenario",
         )
 
-    def scenario_identity(item: dict[str, Any]) -> tuple[str, str, str, str]:
-        return (
-            str(item.get("id") or ""),
-            str(item.get("priority") or ""),
-            str(item.get("ownerPhase") or ""),
-            str(item.get("requiredEvidenceKind") or ""),
-        )
-
-    expected_scenario_identities = [
-        scenario_identity(item) for item in expected_scenarios
-    ]
-    actual_scenario_identities = [
-        scenario_identity(item)
-        for item in actual_scenarios
-        if isinstance(item, dict)
-    ]
-    if expected_scenario_identities != actual_scenario_identities:
+    expected_manifest = {
+        "schemaVersion": 1,
+        "changeName": change_name,
+        "scenarios": expected_scenarios,
+    }
+    if manifest != expected_manifest:
         return _result_error(
             "SCENARIO_MANIFEST_DRIFT",
-            "derived scenario identities do not match the finalized scenario table",
+            "derived scenario manifest does not match the finalized scenario table",
         )
 
     # Validate gate-policy.json is parseable JSON.
@@ -730,7 +819,7 @@ def verify_plan(change_dir: Path) -> dict[str, Any]:
     gate_policy_consistent = True
 
     # Validate events.ndjson: require one matching start/end lifecycle.
-    events_path = change_dir / "events.ndjson"
+    events_path = harness_events.events_path(change_dir)
     phase_start_count = 0
     phase_end_count = 0
     phase_end_status: str | None = None

package/harness/bundles/general/codebuddy/scripts/harness_gate.py

@@ -1635,31 +1635,27 @@ def _validate_scenario_coverage(change_dir: Path) -> dict[str, Any]:
         for s in scenarios
         if isinstance(s, dict)
         and (
-            s.get("requiredEvidenceKind") == "ledger"
-            or (
-                not s.get("requiredEvidenceKind")
-                and str(s.get("priority", "")).upper() in {"P0", "P1"}
-            )
+            str(s.get("priority", "")).upper() in {"P0", "P1"}
+            or s.get("requiredEvidenceKind") == "ledger"
         )
     }
     if not required_ids:
         return {"ok": True, "code": "NO_LEDGER_REQUIRED_SCENARIOS"}
 
-    ledger_path = change_dir / "evidence" / "verification-ledger.json"
-    if not ledger_path.is_file():
+    try:
+        ledger, ledger_path = hl.load_ledger(change_dir)
+    except (OSError, ValueError, json.JSONDecodeError) as exc:
         return {
             "ok": False,
             "code": "SCENARIO_COVERAGE_FAILED",
-            "message": "ledger missing; cannot verify required scenario coverage",
+            "message": f"ledger unreadable: {exc}",
             "missing": sorted(required_ids),
         }
-    try:
-        ledger = json.loads(ledger_path.read_text(encoding="utf-8-sig"))
-    except (OSError, json.JSONDecodeError) as exc:
+    if ledger is None or ledger_path is None:
         return {
             "ok": False,
             "code": "SCENARIO_COVERAGE_FAILED",
-            "message": f"ledger unreadable: {exc}",
+            "message": "ledger missing; cannot verify required scenario coverage",
             "missing": sorted(required_ids),
         }
     covered: set[str] = set()
@@ -1728,13 +1724,6 @@ def cmd_begin(args: argparse.Namespace) -> int:
                 or plan_verification.get("message")
                 or "finalized plan verification failed"
             )
-            record_blocked_attempt(
-                change_dir,
-                phase=args.phase,
-                code=code,
-                message=message,
-                run_id=args.run_id or os.environ.get("HUNTER_HARNESS_RUN_ID"),
-            )
             return emit_error(
                 code,
                 message,