@hunter-harness/workflow-harness 0.2.32 → 0.2.34

package/harness/bundles/general/cursor/scripts/harness_gate.py

@@ -77,6 +77,7 @@ VALIDATION_DEPENDENCIES: dict[str, tuple[str, ...]] = {
     "unitTest": ("compile",),
     "unitTestFull": ("unitTest",),
     "apiTest": ("unitTest",),
+    "browserTest": ("unitTest",),
     "dbCompatibility": ("unitTest",),
     "package": ("unitTestFull", "apiTest", "dbCompatibility"),
 }

package/harness/bundles/general/cursor/scripts/harness_ledger.py

@@ -43,6 +43,7 @@ VERIFICATIONS = frozenset(
         "unitTest",
         "unitTestFull",
         "apiTest",
+        "browserTest",
         "install",
         "package",
         "dbCompatibility",
@@ -72,6 +73,7 @@ REQUIRED_COVERAGE = {
     "unitTestFull": 1,  # module or broader
     "compile": 1,
     "apiTest": 1,
+    "browserTest": 1,
     "install": 2,       # module-am or broader
     "package": 2,
     "dbCompatibility": 1,
@@ -784,6 +786,7 @@ _METRICS_SCHEMAS: dict[str, dict[str, tuple[str, ...]]] = {
     "unitTest": {"required": ("total", "passed", "failed"), "optional": ("errors", "skipped")},
     "unitTestFull": {"required": ("total", "passed", "failed"), "optional": ("errors", "skipped")},
     "apiTest": {"required": ("total", "passed", "failed"), "optional": ("blocked",)},
+    "browserTest": {"required": ("total", "passed", "failed"), "optional": ("skipped", "retries")},
     "apiContract": {"required": ("scenariosTotal", "passed", "failed"), "optional": ("blocked",)},
     "browserE2E": {"required": ("total", "passed", "failed"), "optional": ("skipped", "retries")},
 }
@@ -1086,7 +1089,22 @@ def decide_can_reuse(
         }
 
     validations = ledger.get("validations")
-    if not isinstance(validations, dict):
+    targets_raw = ledger.get("verificationTargets")
+    targets = (
+        list(targets_raw.values())
+        if isinstance(targets_raw, dict)
+        else targets_raw
+        if isinstance(targets_raw, list)
+        else []
+    )
+    target_entries = [
+        target
+        for target in targets
+        if isinstance(target, dict) and target.get("verification") == verification
+    ]
+    target_entries.sort(key=lambda item: str(item.get("finishedAt") or ""))
+    entry = target_entries[-1] if target_entries else None
+    if not isinstance(validations, dict) and entry is None:
         return {
             "ok": True,
             "reuse": False,
@@ -1097,7 +1115,8 @@ def decide_can_reuse(
             "ledger_path": str(ledger_path) if ledger_path else None,
         }
 
-    entry = validations.get(verification)
+    if entry is None and isinstance(validations, dict):
+        entry = validations.get(verification)
     if not isinstance(entry, dict):
         return {
             "ok": True,
@@ -1118,6 +1137,17 @@ def decide_can_reuse(
     algorithm_version = entry.get("algorithmVersion")
     coverage = entry.get("coverage")
 
+    if entry.get("reusable") is False or isinstance(entry.get("invalidation"), dict):
+        return {
+            "ok": True,
+            "reuse": False,
+            "reason": "rerun",
+            "code": "EVIDENCE_INVALIDATED",
+            "verification": verification,
+            "detail": "recorded target was invalidated by workflow fixback",
+            "invalidation": entry.get("invalidation"),
+        }
+
     # v2 fields: a v1 entry (no algorithmVersion/coverage) is conservatively
     # invalidated once and must be re-recorded with v2 fields (COM-002). No
     # silent upgrade of stale evidence.
@@ -1204,12 +1234,17 @@ def decide_can_reuse(
         ("dbSchemaHash", requested_db_schema_hash, "DB_SCHEMA_CHANGED"),
     ):
         stored = entry.get(field)
-        if (
-            requested
-            and str(requested).strip()
-            and _nonempty_str(stored)
-            and str(stored).strip() != str(requested).strip()
-        ):
+        if requested and str(requested).strip() and not _nonempty_str(stored):
+            return {
+                "ok": True,
+                "reuse": False,
+                "reason": "insufficient-evidence",
+                "code": "MISSING_TARGET_IDENTITY",
+                "verification": verification,
+                "detail": f"{field} missing from recorded target",
+                "field": field,
+            }
+        if requested and str(requested).strip() and str(stored).strip() != str(requested).strip():
             return {
                 "ok": True,
                 "reuse": False,
@@ -1608,7 +1643,40 @@ def cmd_record(args: argparse.Namespace) -> int:
             # Fresh record without scenario-ids must not keep stale ids from prev.
             entry.pop("scenarioIds", None)
 
-        ledger["validations"][verification] = entry
+        target_identity = {
+            "verification": verification,
+            "command": entry.get("command"),
+            "scope": entry.get("scope"),
+            "coverage": entry.get("coverage"),
+            "inputsHash": entry.get("inputsHash"),
+            "toolchainHash": entry.get("toolchainHash"),
+            "profileHash": entry.get("profileHash"),
+            "environmentHash": entry.get("environmentHash"),
+            "dbSchemaHash": entry.get("dbSchemaHash"),
+        }
+        target_id = (
+            verification
+            + "-"
+            + hashlib.sha256(
+                json.dumps(
+                    target_identity,
+                    ensure_ascii=False,
+                    sort_keys=True,
+                    separators=(",", ":"),
+                ).encode("utf-8")
+            ).hexdigest()[:16]
+        )
+        target = {"id": target_id, "verification": verification, **entry}
+        targets = ledger.setdefault("verificationTargets", {})
+        if not isinstance(targets, dict):
+            targets = {}
+            ledger["verificationTargets"] = targets
+        targets[target_id] = target
+        ledger["validations"][verification] = {
+            key: value
+            for key, value in target.items()
+            if key not in {"id", "verification"}
+        }
         if "changeName" not in ledger:
             ledger["changeName"] = change_dir.name
         if "stateDir" not in ledger:

package/harness/bundles/general/cursor/scripts/harness_phase.py

@@ -39,6 +39,7 @@ VALIDATION_PHASES = {
     "unitTest": "run",
     "unitTestFull": "test",
     "apiTest": "test",
+    "browserTest": "test",
     "dbCompatibility": "test",
     "package": "package",
 }

package/harness/bundles/general/cursor/scripts/harness_plan_aggregate.py

@@ -0,0 +1,249 @@
+#!/usr/bin/env python3
+"""Aggregate-plan scale, ownership and dependency-graph contracts."""
+
+from __future__ import annotations
+
+import argparse
+import fnmatch
+import json
+from pathlib import Path
+from typing import Any
+
+
+def analyze_scale(payload: dict[str, Any]) -> dict[str, Any]:
+    file_count = int(payload.get("fileCount") or 0)
+    task_count = int(payload.get("taskCount") or 0)
+    module_count = len(
+        {str(item) for item in payload.get("modules", []) if str(item).strip()}
+    )
+    reasons: list[str] = []
+    if file_count >= 30:
+        reasons.append("file-count")
+    if task_count >= 20:
+        reasons.append("task-count")
+    if module_count >= 3:
+        reasons.append("module-count")
+    return {
+        "ok": True,
+        "code": "PLAN_SCALE_ANALYZED",
+        "mode": "aggregate" if reasons else "single",
+        "reasons": reasons,
+        "measurements": {
+            "fileCount": file_count,
+            "taskCount": task_count,
+            "moduleCount": module_count,
+        },
+        "thresholds": {"fileCount": 30, "taskCount": 20, "moduleCount": 3},
+    }
+
+
+def _literal_prefix(pattern: str) -> str:
+    normalized = pattern.replace("\\", "/").strip("/")
+    wildcard = min(
+        [index for token in ("*", "?", "[") if (index := normalized.find(token)) >= 0]
+        or [len(normalized)]
+    )
+    return normalized[:wildcard].rstrip("/")
+
+
+def _paths_overlap(left: str, right: str) -> bool:
+    left_prefix = _literal_prefix(left)
+    right_prefix = _literal_prefix(right)
+    if not left_prefix or not right_prefix:
+        return True
+    if (
+        left_prefix == right_prefix
+        or left_prefix.startswith(right_prefix + "/")
+        or right_prefix.startswith(left_prefix + "/")
+    ):
+        return True
+    return fnmatch.fnmatch(left_prefix, right) or fnmatch.fnmatch(right_prefix, left)
+
+
+def _cycle(children: list[dict[str, Any]]) -> list[str]:
+    ids = {str(child.get("id") or "") for child in children}
+    graph = {
+        str(child.get("id") or ""): [
+            str(dep) for dep in child.get("dependsOn", []) if str(dep) in ids
+        ]
+        for child in children
+    }
+    visiting: set[str] = set()
+    visited: set[str] = set()
+
+    def visit(node: str, trail: list[str]) -> list[str]:
+        if node in visiting:
+            return trail[trail.index(node) :] + [node]
+        if node in visited:
+            return []
+        visiting.add(node)
+        for dependency in graph.get(node, []):
+            found = visit(dependency, trail + [dependency])
+            if found:
+                return found
+        visiting.remove(node)
+        visited.add(node)
+        return []
+
+    for child_id in sorted(ids):
+        found = visit(child_id, [child_id])
+        if found:
+            return found
+    return []
+
+
+def validate_aggregate(plan: dict[str, Any]) -> dict[str, Any]:
+    children = [
+        child for child in plan.get("children", []) if isinstance(child, dict)
+    ]
+    ids = [str(child.get("id") or "") for child in children]
+    if not children or any(not child_id for child_id in ids) or len(set(ids)) != len(ids):
+        return {
+            "ok": False,
+            "code": "AGGREGATE_CHILD_ID_INVALID",
+            "parallelEligible": False,
+        }
+    cycle = _cycle(children)
+    if cycle:
+        return {
+            "ok": False,
+            "code": "AGGREGATE_DAG_CYCLE",
+            "cycle": cycle,
+            "parallelEligible": False,
+        }
+    overlaps: list[dict[str, str]] = []
+    resource_conflicts: list[dict[str, str]] = []
+    for index, left in enumerate(children):
+        for right in children[index + 1 :]:
+            for left_path in left.get("ownedPaths", []):
+                for right_path in right.get("ownedPaths", []):
+                    if _paths_overlap(str(left_path), str(right_path)):
+                        overlaps.append(
+                            {
+                                "left": str(left["id"]),
+                                "right": str(right["id"]),
+                                "leftPath": str(left_path),
+                                "rightPath": str(right_path),
+                            }
+                        )
+            left_writes = {
+                str(item)
+                for item in left.get("sharedResources", {}).get("writes", [])
+            }
+            right_writes = {
+                str(item)
+                for item in right.get("sharedResources", {}).get("writes", [])
+            }
+            for resource in sorted(left_writes & right_writes):
+                resource_conflicts.append(
+                    {
+                        "left": str(left["id"]),
+                        "right": str(right["id"]),
+                        "resource": resource,
+                    }
+                )
+    if overlaps:
+        return {
+            "ok": False,
+            "code": "AGGREGATE_OWNERSHIP_OVERLAP",
+            "parallelEligible": False,
+            "overlaps": overlaps,
+        }
+    if resource_conflicts:
+        return {
+            "ok": False,
+            "code": "AGGREGATE_RESOURCE_CONFLICT",
+            "parallelEligible": False,
+            "conflicts": resource_conflicts,
+        }
+    integration = [child for child in children if child.get("kind") == "integration"]
+    leaf_ids = {str(child["id"]) for child in children if child.get("kind") != "integration"}
+    if integration:
+        dependencies = {str(item) for item in integration[-1].get("dependsOn", [])}
+        if not leaf_ids.issubset(dependencies):
+            return {
+                "ok": False,
+                "code": "AGGREGATE_INTEGRATION_CLOSURE_MISSING",
+                "parallelEligible": False,
+                "missingChildren": sorted(leaf_ids - dependencies),
+            }
+    receipts = {
+        str(receipt.get("childId") or ""): receipt
+        for receipt in plan.get("receipts", [])
+        if isinstance(receipt, dict)
+    }
+    if receipts and integration:
+        leaf_commits = {
+            str(receipts.get(child_id, {}).get("productCommit") or "")
+            for child_id in leaf_ids
+        }
+        leaf_commits.discard("")
+        integration_receipt = receipts.get(str(integration[-1]["id"]), {})
+        covered = {
+            str(item) for item in integration_receipt.get("coversProductCommits", [])
+        }
+        if leaf_commits != covered:
+            return {
+                "ok": False,
+                "code": "AGGREGATE_PRODUCT_COMMIT_CLOSURE_MISSING",
+                "parallelEligible": False,
+                "missingProductCommits": sorted(leaf_commits - covered),
+            }
+    return {
+        "ok": True,
+        "code": "AGGREGATE_PLAN_VALID",
+        "parallelEligible": True,
+        "childOrder": ids,
+        "integrationChild": str(integration[-1]["id"]) if integration else None,
+    }
+
+
+def materialize(payload: dict[str, Any]) -> dict[str, Any]:
+    scale = analyze_scale(payload)
+    children = payload.get("children") or payload.get("slices") or []
+    result = {
+        "schemaVersion": 1,
+        "code": "AGGREGATE_PLAN_MATERIALIZED",
+        "parent": {
+            "id": str(payload.get("id") or payload.get("changeName") or "aggregate"),
+            "scaleDecision": scale,
+        },
+        "children": children,
+        "integration": payload.get("integration"),
+    }
+    validation = validate_aggregate({"children": children})
+    result["validation"] = validation
+    result["ok"] = validation["ok"]
+    return result
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(prog="harness_plan_aggregate.py")
+    sub = parser.add_subparsers(dest="command", required=True)
+    for command in ("analyze", "validate", "materialize"):
+        child = sub.add_parser(command)
+        child.add_argument("--input", required=True, type=Path)
+        child.add_argument("--out", type=Path)
+        child.add_argument("--json", action="store_true")
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = build_parser().parse_args(argv)
+    payload = json.loads(args.input.read_text(encoding="utf-8-sig"))
+    result = (
+        analyze_scale(payload)
+        if args.command == "analyze"
+        else validate_aggregate(payload)
+        if args.command == "validate"
+        else materialize(payload)
+    )
+    if args.out:
+        args.out.parent.mkdir(parents=True, exist_ok=True)
+        args.out.write_text(json.dumps(result, ensure_ascii=False, indent=2) + "\n", encoding="utf-8")
+    print(json.dumps(result, ensure_ascii=False, indent=2))
+    return 0 if result.get("ok", True) else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/harness/bundles/general/cursor/scripts/harness_plan_finalize.py

@@ -11,6 +11,7 @@ import json
 import os
 import re
 import shutil
+import stat
 import sys
 import tempfile
 from pathlib import Path, PurePosixPath
@@ -45,6 +46,7 @@ PRIORITY_EVIDENCE_KIND = {
     "P1": "ledger",
     "P2": "advisory",
 }
+_FILE_ATTRIBUTE_REPARSE_POINT = getattr(stat, "FILE_ATTRIBUTE_REPARSE_POINT", 0x400)
 
 
 def _result_error(code: str, message: str) -> dict[str, Any]:
@@ -302,6 +304,28 @@ def _frontmatter(text: str) -> dict[str, str] | None:
     return None
 
 
+def _required_artifact_names(change_name: str) -> set[str]:
+    return {
+        f"spec/{change_name}-design.md",
+        f"plans/{change_name}-plan.md",
+        f"plans/{change_name}-implementation-detail.md",
+        f"plans/{change_name}-test-scenarios.md",
+        "meta/gate-policy.json",
+        "meta/worktree.json",
+    }
+
+
+def _is_link_or_reparse(path: Path) -> bool:
+    """Detect symlinks and Windows reparse points on every supported Python."""
+    try:
+        if path.is_symlink():
+            return True
+        attributes = getattr(os.lstat(path), "st_file_attributes", 0)
+    except OSError:
+        return False
+    return bool(attributes & _FILE_ATTRIBUTE_REPARSE_POINT)
+
+
 def lint_slice_plan(plan_path: Path) -> dict[str, Any]:
     """Validate the identity, reuse, and storage contract for a slice plan."""
     text = Path(plan_path).read_text(encoding="utf-8-sig")
@@ -369,7 +393,7 @@ def lint_slice_plan(plan_path: Path) -> dict[str, Any]:
 def _artifact_files(staging: Path) -> list[Path]:
     files: list[Path] = []
     for path in staging.rglob("*"):
-        if path.is_symlink():
+        if _is_link_or_reparse(path):
             raise ValueError(f"PLAN_ARTIFACT_SYMLINK: {path}")
         if path.is_file():
             files.append(path)
@@ -378,14 +402,7 @@ def _artifact_files(staging: Path) -> list[Path]:
 
 def validate_staging(staging: Path, change_name: str) -> dict[str, Any]:
     staging = staging.resolve()
-    required = {
-        Path("spec") / f"{change_name}-design.md",
-        Path("plans") / f"{change_name}-plan.md",
-        Path("plans") / f"{change_name}-implementation-detail.md",
-        Path("plans") / f"{change_name}-test-scenarios.md",
-        Path("meta") / "gate-policy.json",
-        Path("meta") / "worktree.json",
-    }
+    required = {Path(name) for name in _required_artifact_names(change_name)}
     try:
         files = _artifact_files(staging)
     except ValueError as exc:
@@ -621,12 +638,18 @@ def _receipt_artifact_targets(
         cursor = change_dir
         for part in rel.parts:
             cursor = cursor / part
-            is_junction = getattr(cursor, "is_junction", lambda: False)
-            if cursor.is_symlink() or is_junction():
+            if _is_link_or_reparse(cursor):
                 return None, _result_error(
                     "RECEIPT_FILE_PATH_INVALID",
                     f"receipt artifact path traverses a link: {normalized}",
                 )
+        try:
+            target.resolve(strict=False).relative_to(change_dir)
+        except (OSError, RuntimeError, ValueError):
+            return None, _result_error(
+                "RECEIPT_FILE_PATH_INVALID",
+                f"receipt artifact path resolves outside the change directory: {normalized}",
+            )
         targets.append((normalized, target))
     return targets, None
 
@@ -671,6 +694,15 @@ def verify_plan(change_dir: Path) -> dict[str, Any]:
     if path_error is not None:
         return path_error
     assert artifact_targets is not None
+    artifact_name_set = {rel for rel, _ in artifact_targets}
+    missing_required = sorted(
+        _required_artifact_names(change_name) - artifact_name_set
+    )
+    if missing_required:
+        return _result_error(
+            "RECEIPT_FILES_INCOMPLETE",
+            "receipt omits required artifacts: " + ", ".join(missing_required),
+        )
     if receipt.get("status") != "finalized":
         return _result_error(
             "RECEIPT_NOT_FINALIZED",