@hunter-harness/workflow-harness 0.2.31 → 0.2.33

package/harness/bundles/general/claude-code/harness-plan/SKILL.md

@@ -106,7 +106,7 @@ change-name 范围变更 → 提示重命名或记 🟡WARN（→ `reference.md`
 |------|------|
 | 产物路径 | 只写 `.harness/changes/<cn>/`；禁止 superpowers 输入 |
 | 设计审批包 | 一次 blocking user confirmation 含 worktree（读 `harness.json` `defaultWorktree`） |
-| 阶段 8 | spec/plan/detail/scenarios/worktree.json 先进入 staging；仅 finalizer 校验成功后发布并写唯一 `phase.end`/log；随后 `verify` 必须确认 start/end、收据哈希、全部任务表和非空场景清单一致，失败不得手工补终态 |
+| 阶段 8 | spec/plan/detail/scenarios/gate-policy/worktree 六项标准产物先进入 staging；仅 finalizer 校验成功后发布并写唯一 `phase.end`/log；随后 `verify` 必须确认 start/end、收据完整覆盖六项标准产物、哈希、全部任务表和非空场景清单一致，失败不得手工补终态 |
 | Plan 结束 | **禁止**询问执行模式；只提示 `/harness-run` |
 | 知识查询 | 0.5 失败不得假装已读历史 |
 | 歧义优先检查 | 否定、对比、动作对象或范围存在多种合理解释时，最小取证后先给推荐理解并一次一问；确认前不深挖错误方向 |

package/harness/bundles/general/claude-code/harness-plan/checklist.md

@@ -214,6 +214,7 @@ source: harness-plan
 - [ ] finalizer 返回 `ok=true` 与 `artifactsHash`；重复执行返回 `idempotent=true`
 - [ ] 紧接着执行 `harness_plan_finalize.py verify --change-dir ... --json`
 - [ ] verify 返回 `phaseStartCount=1`、`phaseEndCount=1`、`phaseEndStatus=OK`、`receiptConsistent=true`
+- [ ] 收据 `files` 完整包含 design / plan / implementation-detail / test-scenarios / gate-policy / worktree 六项标准产物；不得省略、重复或经 symlink/junction/reparse point 引用
 - [ ] verify 的 `taskCount` 等于全部任务表行数，`scenarioCount` 等于 Markdown 中全部唯一场景 ID 数；任一为 0 或不一致即 ❌FAIL
 - [ ] finalizer 失败时正式目录无半发布产物、无成功 `phase.end`、无伪造 execution log
 - [ ] 禁止在 finalizer 之前手工追加成功 `phase.end`
@@ -224,6 +225,7 @@ source: harness-plan
 | `.harness/changes/<change>/plans/<change>-plan.md` | ✅ | □ |
 | `.harness/changes/<change>/plans/<change>-implementation-detail.md` | ✅ | □ |
 | `.harness/changes/<change>/plans/<change>-test-scenarios.md` | ✅ | □ |
+| `.harness/changes/<change>/meta/gate-policy.json` | ✅ | □ |
 | `.harness/changes/<change>/meta/worktree.json` | ✅ | □ |
 | `.harness/changes/<change>/meta/implementation-checkpoints.json` | ✅ | □ |
 | `.harness/changes/<change>/meta/scenario-manifest.json`（非空且计数一致） | ✅ | □ |

package/harness/bundles/general/claude-code/harness-plan/reference.md

@@ -335,10 +335,16 @@ status: approved
 | `.harness/changes/<change>/plans/<change>-plan.md` | ✅ |
 | `.harness/changes/<change>/plans/<change>-implementation-detail.md` | ✅ |
 | `.harness/changes/<change>/plans/<change>-test-scenarios.md` | ✅ |
+| `.harness/changes/<change>/meta/gate-policy.json` | ✅ |
 | `.harness/changes/<change>/meta/worktree.json` | ✅ |
+| `.harness/changes/<change>/meta/implementation-checkpoints.json` | ✅ |
+| `.harness/changes/<change>/meta/scenario-manifest.json` | ✅ |
+| `.harness/changes/<change>/meta/plan-finalization.json` | ✅ |
 | `.harness/changes/<change>/logs/execution-log.md` | ✅ |
 | `.harness/changes/<change>/events.ndjson` | ✅ |
 
+`plan-finalization.json.files` 必须完整列出 design、plan、implementation-detail、test-scenarios、gate-policy、worktree 六项标准输入。`verify` 对缺项、重复项、越界路径以及 symlink/junction/reparse point 一律 fail-closed；不得通过删减收据文件集后重算哈希来绕过完整性检查。
+
 ### Plan 结束行为规则
 
 - **禁止询问执行模式**：Subagent-Driven / Inline Execution 属于 /harness-run 阶段

package/harness/bundles/general/claude-code/scripts/harness_gate.py

@@ -1635,31 +1635,27 @@ def _validate_scenario_coverage(change_dir: Path) -> dict[str, Any]:
         for s in scenarios
         if isinstance(s, dict)
         and (
-            s.get("requiredEvidenceKind") == "ledger"
-            or (
-                not s.get("requiredEvidenceKind")
-                and str(s.get("priority", "")).upper() in {"P0", "P1"}
-            )
+            str(s.get("priority", "")).upper() in {"P0", "P1"}
+            or s.get("requiredEvidenceKind") == "ledger"
         )
     }
     if not required_ids:
         return {"ok": True, "code": "NO_LEDGER_REQUIRED_SCENARIOS"}
 
-    ledger_path = change_dir / "evidence" / "verification-ledger.json"
-    if not ledger_path.is_file():
+    try:
+        ledger, ledger_path = hl.load_ledger(change_dir)
+    except (OSError, ValueError, json.JSONDecodeError) as exc:
         return {
             "ok": False,
             "code": "SCENARIO_COVERAGE_FAILED",
-            "message": "ledger missing; cannot verify required scenario coverage",
+            "message": f"ledger unreadable: {exc}",
             "missing": sorted(required_ids),
         }
-    try:
-        ledger = json.loads(ledger_path.read_text(encoding="utf-8-sig"))
-    except (OSError, json.JSONDecodeError) as exc:
+    if ledger is None or ledger_path is None:
         return {
             "ok": False,
             "code": "SCENARIO_COVERAGE_FAILED",
-            "message": f"ledger unreadable: {exc}",
+            "message": "ledger missing; cannot verify required scenario coverage",
             "missing": sorted(required_ids),
         }
     covered: set[str] = set()
@@ -1728,13 +1724,6 @@ def cmd_begin(args: argparse.Namespace) -> int:
                 or plan_verification.get("message")
                 or "finalized plan verification failed"
             )
-            record_blocked_attempt(
-                change_dir,
-                phase=args.phase,
-                code=code,
-                message=message,
-                run_id=args.run_id or os.environ.get("HUNTER_HARNESS_RUN_ID"),
-            )
             return emit_error(
                 code,
                 message,

package/harness/bundles/general/claude-code/scripts/harness_plan_finalize.py

@@ -11,9 +11,10 @@ import json
 import os
 import re
 import shutil
+import stat
 import sys
 import tempfile
-from pathlib import Path
+from pathlib import Path, PurePosixPath
 from typing import Any
 
 SCRIPTS_DIR = Path(__file__).resolve().parent
@@ -45,12 +46,19 @@ PRIORITY_EVIDENCE_KIND = {
     "P1": "ledger",
     "P2": "advisory",
 }
+_FILE_ATTRIBUTE_REPARSE_POINT = getattr(stat, "FILE_ATTRIBUTE_REPARSE_POINT", 0x400)
 
 
 def _result_error(code: str, message: str) -> dict[str, Any]:
     return {"ok": False, "code": code, "error": message}
 
 
+class PlanParseError(ValueError):
+    def __init__(self, code: str, message: str) -> None:
+        super().__init__(message)
+        self.code = code
+
+
 def _normalize_header(value: str) -> str:
     return re.sub(r"[\s_-]+", "", value).lower()
 
@@ -127,13 +135,23 @@ def parse_test_scenarios(scenarios_path: Path) -> list[dict[str, str]]:
                     break
                 cells = _table_cells(row)
                 if max(id_index, scenario_index) >= len(cells):
-                    row_index += 1
-                    continue
+                    raise PlanParseError(
+                        "PLAN_SCENARIO_ROW_INVALID",
+                        f"{scenarios_path.name}: line {row_index + 1} is missing scenario ID or description",
+                    )
                 complete_row = len(cells) == len(headers)
                 scenario_id = cells[id_index].strip()
                 if not scenario_id or set(scenario_id) <= {"-", ":"}:
-                    row_index += 1
-                    continue
+                    raise PlanParseError(
+                        "PLAN_SCENARIO_ROW_INVALID",
+                        f"{scenarios_path.name}: line {row_index + 1} has an empty scenario ID",
+                    )
+                scenario_text = cells[scenario_index].strip()
+                if not scenario_text or set(scenario_text) <= {"-", ":"}:
+                    raise PlanParseError(
+                        "PLAN_SCENARIO_ROW_INVALID",
+                        f"{scenarios_path.name}: line {row_index + 1} has an empty scenario description",
+                    )
                 priority = (
                     cells[priority_index].strip().upper()
                     if priority_index is not None
@@ -144,7 +162,7 @@ def parse_test_scenarios(scenarios_path: Path) -> list[dict[str, str]]:
                 scenario = {
                     "id": scenario_id,
                     "priority": priority,
-                    "scenario": cells[scenario_index].strip(),
+                    "scenario": scenario_text,
                     "ownerPhase": (
                         cells[owner_phase_index].strip()
                         if owner_phase_index is not None
@@ -219,19 +237,34 @@ def parse_plan_tasks(plan_path: Path) -> list[dict[str, str]]:
             if not row.startswith("|"):
                 break
             cells = _table_cells(row)
-            if len(cells) < len(headers):
-                row_index += 1
-                continue
+            if max(number_index, task_index) >= len(cells):
+                raise PlanParseError(
+                    "PLAN_TASK_ROW_INVALID",
+                    f"{plan_path.name}: line {row_index + 1} is missing task ID or description",
+                )
+            complete_row = len(cells) == len(headers)
             number = cells[number_index].strip()
             task_text = cells[task_index].strip()
-            if not number or not task_text or set(number) <= {"-", ":"}:
-                row_index += 1
-                continue
+            if (
+                not number
+                or not task_text
+                or set(number) <= {"-", ":"}
+                or set(task_text) <= {"-", ":"}
+            ):
+                raise PlanParseError(
+                    "PLAN_TASK_ROW_INVALID",
+                    f"{plan_path.name}: line {row_index + 1} has an empty task ID or description",
+                )
             task: dict[str, str] = {"num": number, "task": task_text}
             if cluster_index is not None and cells[cluster_index].strip():
                 task["cluster"] = cells[cluster_index].strip()
             for name, index in optional_indices.items():
-                if index is not None and cells[index].strip():
+                if (
+                    complete_row
+                    and index is not None
+                    and index < len(cells)
+                    and cells[index].strip()
+                ):
                     task[name] = cells[index].strip()
             tasks.append(task)
             row_index += 1
@@ -271,6 +304,28 @@ def _frontmatter(text: str) -> dict[str, str] | None:
     return None
 
 
+def _required_artifact_names(change_name: str) -> set[str]:
+    return {
+        f"spec/{change_name}-design.md",
+        f"plans/{change_name}-plan.md",
+        f"plans/{change_name}-implementation-detail.md",
+        f"plans/{change_name}-test-scenarios.md",
+        "meta/gate-policy.json",
+        "meta/worktree.json",
+    }
+
+
+def _is_link_or_reparse(path: Path) -> bool:
+    """Detect symlinks and Windows reparse points on every supported Python."""
+    try:
+        if path.is_symlink():
+            return True
+        attributes = getattr(os.lstat(path), "st_file_attributes", 0)
+    except OSError:
+        return False
+    return bool(attributes & _FILE_ATTRIBUTE_REPARSE_POINT)
+
+
 def lint_slice_plan(plan_path: Path) -> dict[str, Any]:
     """Validate the identity, reuse, and storage contract for a slice plan."""
     text = Path(plan_path).read_text(encoding="utf-8-sig")
@@ -338,7 +393,7 @@ def lint_slice_plan(plan_path: Path) -> dict[str, Any]:
 def _artifact_files(staging: Path) -> list[Path]:
     files: list[Path] = []
     for path in staging.rglob("*"):
-        if path.is_symlink():
+        if _is_link_or_reparse(path):
             raise ValueError(f"PLAN_ARTIFACT_SYMLINK: {path}")
         if path.is_file():
             files.append(path)
@@ -347,14 +402,7 @@ def _artifact_files(staging: Path) -> list[Path]:
 
 def validate_staging(staging: Path, change_name: str) -> dict[str, Any]:
     staging = staging.resolve()
-    required = {
-        Path("spec") / f"{change_name}-design.md",
-        Path("plans") / f"{change_name}-plan.md",
-        Path("plans") / f"{change_name}-implementation-detail.md",
-        Path("plans") / f"{change_name}-test-scenarios.md",
-        Path("meta") / "gate-policy.json",
-        Path("meta") / "worktree.json",
-    }
+    required = {Path(name) for name in _required_artifact_names(change_name)}
     try:
         files = _artifact_files(staging)
     except ValueError as exc:
@@ -416,7 +464,10 @@ def validate_staging(staging: Path, change_name: str) -> dict[str, Any]:
 
     # C8: validate ownerPhase values in plan.md task table.
     plan_path = staging / "plans" / f"{change_name}-plan.md"
-    tasks = parse_plan_tasks(plan_path)
+    try:
+        tasks = parse_plan_tasks(plan_path)
+    except PlanParseError as exc:
+        return _result_error(exc.code, str(exc))
     if not tasks:
         return _result_error(
             "PLAN_TASKS_EMPTY",
@@ -444,7 +495,10 @@ def validate_staging(staging: Path, change_name: str) -> dict[str, Any]:
 
     # C9: parse test-scenarios.md for scenario manifest.
     scenarios_path = staging / "plans" / f"{change_name}-test-scenarios.md"
-    scenarios = parse_test_scenarios(scenarios_path)
+    try:
+        scenarios = parse_test_scenarios(scenarios_path)
+    except PlanParseError as exc:
+        return _result_error(exc.code, str(exc))
     if not scenarios:
         return _result_error(
             "PLAN_SCENARIOS_EMPTY",
@@ -542,6 +596,64 @@ def _validate_plan_start(
     return {"ok": True, "phaseStartCount": 1}
 
 
+def _receipt_artifact_targets(
+    change_dir: Path,
+    files_list: list[Any],
+) -> tuple[list[tuple[str, Path]] | None, dict[str, Any] | None]:
+    targets: list[tuple[str, Path]] = []
+    seen: set[str] = set()
+    for index, value in enumerate(files_list):
+        if not isinstance(value, str):
+            return None, _result_error(
+                "RECEIPT_FILE_PATH_INVALID",
+                f"receipt files[{index}] must be a string",
+            )
+        raw = value
+        segments = raw.split("/")
+        rel = PurePosixPath(raw)
+        invalid = (
+            not raw
+            or raw != raw.strip()
+            or "\\" in raw
+            or ":" in raw
+            or rel.is_absolute()
+            or any(segment in {"", ".", ".."} for segment in segments)
+            or any(segment.endswith((".", " ")) for segment in segments)
+            or not rel.parts
+            or rel.parts[0] not in {"spec", "plans", "meta"}
+        )
+        if invalid:
+            return None, _result_error(
+                "RECEIPT_FILE_PATH_INVALID",
+                f"receipt files[{index}] is not a safe artifact-relative path: {raw!r}",
+            )
+        normalized = rel.as_posix()
+        if normalized in seen:
+            return None, _result_error(
+                "RECEIPT_FILE_PATH_INVALID",
+                f"receipt contains duplicate artifact path: {normalized}",
+            )
+        seen.add(normalized)
+        target = change_dir.joinpath(*rel.parts)
+        cursor = change_dir
+        for part in rel.parts:
+            cursor = cursor / part
+            if _is_link_or_reparse(cursor):
+                return None, _result_error(
+                    "RECEIPT_FILE_PATH_INVALID",
+                    f"receipt artifact path traverses a link: {normalized}",
+                )
+        try:
+            target.resolve(strict=False).relative_to(change_dir)
+        except (OSError, RuntimeError, ValueError):
+            return None, _result_error(
+                "RECEIPT_FILE_PATH_INVALID",
+                f"receipt artifact path resolves outside the change directory: {normalized}",
+            )
+        targets.append((normalized, target))
+    return targets, None
+
+
 def verify_plan(change_dir: Path) -> dict[str, Any]:
     """Read-only verification of a finalized plan (retro §5.8).
 
@@ -565,6 +677,11 @@ def verify_plan(change_dir: Path) -> dict[str, Any]:
     change_name = str(receipt.get("changeName") or "").strip()
     if not change_name:
         return _result_error("RECEIPT_INVALID", "receipt missing changeName")
+    if change_name != change_dir.name:
+        return _result_error(
+            "RECEIPT_CHANGE_NAME_INVALID",
+            f"receipt changeName {change_name!r} does not match {change_dir.name!r}",
+        )
 
     expected_hash = str(receipt.get("artifactsHash") or "").strip()
     if not expected_hash.startswith("sha256:"):
@@ -573,6 +690,19 @@ def verify_plan(change_dir: Path) -> dict[str, Any]:
     files_list = receipt.get("files")
     if not isinstance(files_list, list) or not files_list:
         return _result_error("RECEIPT_INVALID", "receipt files list missing or empty")
+    artifact_targets, path_error = _receipt_artifact_targets(change_dir, files_list)
+    if path_error is not None:
+        return path_error
+    assert artifact_targets is not None
+    artifact_name_set = {rel for rel, _ in artifact_targets}
+    missing_required = sorted(
+        _required_artifact_names(change_name) - artifact_name_set
+    )
+    if missing_required:
+        return _result_error(
+            "RECEIPT_FILES_INCOMPLETE",
+            "receipt omits required artifacts: " + ", ".join(missing_required),
+        )
     if receipt.get("status") != "finalized":
         return _result_error(
             "RECEIPT_NOT_FINALIZED",
@@ -589,9 +719,7 @@ def verify_plan(change_dir: Path) -> dict[str, Any]:
     # Recompute artifacts hash from published files.
     digest = hashlib.sha256()
     artifact_names: list[str] = []
-    for rel_text in files_list:
-        rel = rel_text.as_posix() if hasattr(rel_text, "as_posix") else str(rel_text)
-        target = change_dir / rel
+    for rel, target in artifact_targets:
         if not target.is_file():
             return _result_error(
                 "ARTIFACT_MISSING", f"published artifact missing: {rel}"
@@ -634,7 +762,10 @@ def verify_plan(change_dir: Path) -> dict[str, Any]:
         }
 
     plan_path = change_dir / "plans" / f"{change_name}-plan.md"
-    expected_tasks = parse_plan_tasks(plan_path)
+    try:
+        expected_tasks = parse_plan_tasks(plan_path)
+    except PlanParseError as exc:
+        return _result_error(exc.code, str(exc))
     if not expected_tasks:
         return _result_error(
             "PLAN_TASKS_EMPTY",
@@ -652,24 +783,25 @@ def verify_plan(change_dir: Path) -> dict[str, Any]:
         )
     except (OSError, json.JSONDecodeError) as exc:
         return _result_error("IMPLEMENTATION_CHECKPOINTS_INVALID", str(exc))
-    actual_tasks = checkpoints.get("tasks") if isinstance(checkpoints, dict) else None
-    expected_task_ids = [str(item.get("num") or "") for item in expected_tasks]
-    actual_task_ids = (
-        [str(item.get("num") or "") for item in actual_tasks if isinstance(item, dict)]
-        if isinstance(actual_tasks, list)
-        else []
-    )
-    if expected_task_ids != actual_task_ids:
+    expected_checkpoints = {
+        "schemaVersion": 1,
+        "changeName": change_name,
+        "tasks": expected_tasks,
+        "foundationGate": "approved",
+    }
+    if checkpoints != expected_checkpoints:
         return _result_error(
             "IMPLEMENTATION_CHECKPOINTS_DRIFT",
-            "derived task IDs do not match the finalized plan: "
-            f"expected={expected_task_ids}, actual={actual_task_ids}",
+            "derived implementation checkpoints do not match the finalized plan",
         )
 
     scenarios_path = (
         change_dir / "plans" / f"{change_name}-test-scenarios.md"
     )
-    expected_scenarios = parse_test_scenarios(scenarios_path)
+    try:
+        expected_scenarios = parse_test_scenarios(scenarios_path)
+    except PlanParseError as exc:
+        return _result_error(exc.code, str(exc))
     if not expected_scenarios:
         return _result_error(
             "PLAN_SCENARIOS_EMPTY",
@@ -694,26 +826,15 @@ def verify_plan(change_dir: Path) -> dict[str, Any]:
             "scenario-manifest.json must contain at least one scenario",
         )
 
-    def scenario_identity(item: dict[str, Any]) -> tuple[str, str, str, str]:
-        return (
-            str(item.get("id") or ""),
-            str(item.get("priority") or ""),
-            str(item.get("ownerPhase") or ""),
-            str(item.get("requiredEvidenceKind") or ""),
-        )
-
-    expected_scenario_identities = [
-        scenario_identity(item) for item in expected_scenarios
-    ]
-    actual_scenario_identities = [
-        scenario_identity(item)
-        for item in actual_scenarios
-        if isinstance(item, dict)
-    ]
-    if expected_scenario_identities != actual_scenario_identities:
+    expected_manifest = {
+        "schemaVersion": 1,
+        "changeName": change_name,
+        "scenarios": expected_scenarios,
+    }
+    if manifest != expected_manifest:
         return _result_error(
             "SCENARIO_MANIFEST_DRIFT",
-            "derived scenario identities do not match the finalized scenario table",
+            "derived scenario manifest does not match the finalized scenario table",
         )
 
     # Validate gate-policy.json is parseable JSON.
@@ -730,7 +851,7 @@ def verify_plan(change_dir: Path) -> dict[str, Any]:
     gate_policy_consistent = True
 
     # Validate events.ndjson: require one matching start/end lifecycle.
-    events_path = change_dir / "events.ndjson"
+    events_path = harness_events.events_path(change_dir)
     phase_start_count = 0
     phase_end_count = 0
     phase_end_status: str | None = None

package/harness/bundles/general/codebuddy/harness-plan/SKILL.md

@@ -88,7 +88,7 @@ change-name 范围变更 → 提示重命名或记 🟡WARN（→ `reference.md`
 |------|------|
 | 产物路径 | 只写 `.harness/changes/<cn>/`；禁止 superpowers 输入 |
 | 设计审批包 | 一次 blocking user confirmation 含 worktree（读 `harness.json` `defaultWorktree`） |
-| 阶段 8 | spec/plan/detail/scenarios/worktree.json 先进入 staging；仅 finalizer 校验成功后发布并写唯一 `phase.end`/log；随后 `verify` 必须确认 start/end、收据哈希、全部任务表和非空场景清单一致，失败不得手工补终态 |
+| 阶段 8 | spec/plan/detail/scenarios/gate-policy/worktree 六项标准产物先进入 staging；仅 finalizer 校验成功后发布并写唯一 `phase.end`/log；随后 `verify` 必须确认 start/end、收据完整覆盖六项标准产物、哈希、全部任务表和非空场景清单一致，失败不得手工补终态 |
 | Plan 结束 | **禁止**询问执行模式；只提示 `/harness-run` |
 | 知识查询 | 0.5 失败不得假装已读历史 |
 | 歧义优先检查 | 否定、对比、动作对象或范围存在多种合理解释时，最小取证后先给推荐理解并一次一问；确认前不深挖错误方向 |

package/harness/bundles/general/codebuddy/harness-plan/checklist.md

@@ -214,6 +214,7 @@ source: harness-plan
 - [ ] finalizer 返回 `ok=true` 与 `artifactsHash`；重复执行返回 `idempotent=true`
 - [ ] 紧接着执行 `harness_plan_finalize.py verify --change-dir ... --json`
 - [ ] verify 返回 `phaseStartCount=1`、`phaseEndCount=1`、`phaseEndStatus=OK`、`receiptConsistent=true`
+- [ ] 收据 `files` 完整包含 design / plan / implementation-detail / test-scenarios / gate-policy / worktree 六项标准产物；不得省略、重复或经 symlink/junction/reparse point 引用
 - [ ] verify 的 `taskCount` 等于全部任务表行数，`scenarioCount` 等于 Markdown 中全部唯一场景 ID 数；任一为 0 或不一致即 ❌FAIL
 - [ ] finalizer 失败时正式目录无半发布产物、无成功 `phase.end`、无伪造 execution log
 - [ ] 禁止在 finalizer 之前手工追加成功 `phase.end`
@@ -224,6 +225,7 @@ source: harness-plan
 | `.harness/changes/<change>/plans/<change>-plan.md` | ✅ | □ |
 | `.harness/changes/<change>/plans/<change>-implementation-detail.md` | ✅ | □ |
 | `.harness/changes/<change>/plans/<change>-test-scenarios.md` | ✅ | □ |
+| `.harness/changes/<change>/meta/gate-policy.json` | ✅ | □ |
 | `.harness/changes/<change>/meta/worktree.json` | ✅ | □ |
 | `.harness/changes/<change>/meta/implementation-checkpoints.json` | ✅ | □ |
 | `.harness/changes/<change>/meta/scenario-manifest.json`（非空且计数一致） | ✅ | □ |

package/harness/bundles/general/codebuddy/harness-plan/reference.md

@@ -335,10 +335,16 @@ status: approved
 | `.harness/changes/<change>/plans/<change>-plan.md` | ✅ |
 | `.harness/changes/<change>/plans/<change>-implementation-detail.md` | ✅ |
 | `.harness/changes/<change>/plans/<change>-test-scenarios.md` | ✅ |
+| `.harness/changes/<change>/meta/gate-policy.json` | ✅ |
 | `.harness/changes/<change>/meta/worktree.json` | ✅ |
+| `.harness/changes/<change>/meta/implementation-checkpoints.json` | ✅ |
+| `.harness/changes/<change>/meta/scenario-manifest.json` | ✅ |
+| `.harness/changes/<change>/meta/plan-finalization.json` | ✅ |
 | `.harness/changes/<change>/logs/execution-log.md` | ✅ |
 | `.harness/changes/<change>/events.ndjson` | ✅ |
 
+`plan-finalization.json.files` 必须完整列出 design、plan、implementation-detail、test-scenarios、gate-policy、worktree 六项标准输入。`verify` 对缺项、重复项、越界路径以及 symlink/junction/reparse point 一律 fail-closed；不得通过删减收据文件集后重算哈希来绕过完整性检查。
+
 ### Plan 结束行为规则
 
 - **禁止询问执行模式**：Subagent-Driven / Inline Execution 属于 /harness-run 阶段

package/harness/bundles/general/codebuddy/scripts/harness_gate.py

@@ -1635,31 +1635,27 @@ def _validate_scenario_coverage(change_dir: Path) -> dict[str, Any]:
         for s in scenarios
         if isinstance(s, dict)
         and (
-            s.get("requiredEvidenceKind") == "ledger"
-            or (
-                not s.get("requiredEvidenceKind")
-                and str(s.get("priority", "")).upper() in {"P0", "P1"}
-            )
+            str(s.get("priority", "")).upper() in {"P0", "P1"}
+            or s.get("requiredEvidenceKind") == "ledger"
         )
     }
     if not required_ids:
         return {"ok": True, "code": "NO_LEDGER_REQUIRED_SCENARIOS"}
 
-    ledger_path = change_dir / "evidence" / "verification-ledger.json"
-    if not ledger_path.is_file():
+    try:
+        ledger, ledger_path = hl.load_ledger(change_dir)
+    except (OSError, ValueError, json.JSONDecodeError) as exc:
         return {
             "ok": False,
             "code": "SCENARIO_COVERAGE_FAILED",
-            "message": "ledger missing; cannot verify required scenario coverage",
+            "message": f"ledger unreadable: {exc}",
             "missing": sorted(required_ids),
         }
-    try:
-        ledger = json.loads(ledger_path.read_text(encoding="utf-8-sig"))
-    except (OSError, json.JSONDecodeError) as exc:
+    if ledger is None or ledger_path is None:
         return {
             "ok": False,
             "code": "SCENARIO_COVERAGE_FAILED",
-            "message": f"ledger unreadable: {exc}",
+            "message": "ledger missing; cannot verify required scenario coverage",
             "missing": sorted(required_ids),
         }
     covered: set[str] = set()
@@ -1728,13 +1724,6 @@ def cmd_begin(args: argparse.Namespace) -> int:
                 or plan_verification.get("message")
                 or "finalized plan verification failed"
             )
-            record_blocked_attempt(
-                change_dir,
-                phase=args.phase,
-                code=code,
-                message=message,
-                run_id=args.run_id or os.environ.get("HUNTER_HARNESS_RUN_ID"),
-            )
             return emit_error(
                 code,
                 message,