@hunter-harness/workflow-harness 0.2.37 → 0.2.39

package/harness/bundles/java/claude-code/scripts/harness_integration.py

@@ -36,6 +36,7 @@ if str(SCRIPTS_DIR) not in sys.path:
 import harness_change  # noqa: E402
 import harness_ledger as hl  # noqa: E402
 import harness_paths  # noqa: E402
+import harness_service  # noqa: E402
 
 if hasattr(sys.stdout, "reconfigure"):
     sys.stdout.reconfigure(encoding="utf-8")
@@ -293,6 +294,68 @@ def _dedupe_verify_commands(
     return result
 
 
+_HEAVY_VERIFICATIONS = frozenset({"unitTestFull", "apiTest", "browserTest", "package"})
+
+
+def _merge_command_kind(item: Any) -> tuple[str, str | None]:
+    """Classify typed merge commands; legacy strings remain smoke."""
+    if not isinstance(item, dict):
+        return "smoke", None
+    verification = str(item.get("verification") or item.get("target") or "").strip() or None
+    declared = str(item.get("kind") or item.get("class") or "").strip().lower()
+    if declared in {"integrity", "smoke", "heavyweight"}:
+        return declared, verification
+    return ("heavyweight" if verification in _HEAVY_VERIFICATIONS else "smoke"), verification
+
+
+def _reusable_merge_evidence(
+    ledger_path: Path | None,
+    *,
+    verification: str | None,
+    command: Sequence[str],
+    product_tree_hash: str | None,
+    reuse_context: dict[str, str],
+) -> dict[str, Any] | None:
+    """Return feature-tip evidence when merge content and execution key match."""
+    if ledger_path is None or verification is None or not product_tree_hash:
+        return None
+    try:
+        ledger = json.loads(ledger_path.read_text(encoding="utf-8-sig"))
+    except (OSError, json.JSONDecodeError):
+        return None
+    raw = ledger.get("verificationTargets")
+    entries = raw.values() if isinstance(raw, dict) else raw if isinstance(raw, list) else []
+    command_hash = hl.command_set_hash(" ".join(str(part) for part in command))
+    for entry in reversed(list(entries)):
+        if not isinstance(entry, dict) or entry.get("verification") != verification:
+            continue
+        if entry.get("status") != "OK":
+            continue
+        if str(entry.get("productTreeHash") or "").removeprefix("sha256:") != product_tree_hash.removeprefix("sha256:"):
+            continue
+        if str(entry.get("commandSetHash") or "") != command_hash:
+            continue
+        # Context identity is fail-closed: an evidence field may only be
+        # reused when the merge policy supplies the same current value.
+        if any(
+            str(entry.get(field) or "").strip()
+            and str(entry.get(field) or "").strip()
+            != str(reuse_context.get(field) or "").strip()
+            for field in ("environmentHash", "toolchainHash", "lockHash", "dbSchemaHash")
+        ):
+            continue
+        return {
+            "reusedFrom": {
+                "targetId": entry.get("id"),
+                "sourceCommit": entry.get("productCommit") or entry.get("currentHead"),
+                "sourceCandidate": entry.get("candidateId"),
+            },
+            "reuseReason": "product tree and canonical execution key matched",
+            "reuseKey": hl.canonical_reuse_key({**entry, "verification": verification}),
+        }
+    return None
+
+
 def _normalize_verify_command(
     command: Sequence[str],
     *,
@@ -1210,6 +1273,49 @@ class IntegrationTransaction:
                 raise ValueError(f"requiredOnMerge[{index}].command missing")
         return commands
 
+    def _required_on_merge_plan(self) -> list[dict[str, Any]]:
+        """Classify profile commands without breaking the legacy command API."""
+        import harness_profile
+
+        profile = harness_profile.load_profile(self.project_root)
+        merge = profile.get("mergeVerification") if isinstance(profile, dict) else None
+        required = merge.get("requiredOnMerge") if isinstance(merge, dict) else []
+        if not isinstance(required, list):
+            return []
+        plan: list[dict[str, Any]] = []
+        for index, item in enumerate(required):
+            if isinstance(item, str) and item.strip():
+                plan.append({"command": _split_verify_command(item.strip()), "kind": "smoke"})
+                continue
+            if not isinstance(item, dict):
+                raise ValueError(f"requiredOnMerge[{index}] must be string or object")
+            raw = item.get("command")
+            if isinstance(raw, list) and raw and all(isinstance(value, str) and value for value in raw):
+                command = [str(value) for value in raw]
+            elif isinstance(raw, str) and raw.strip():
+                command = _split_verify_command(raw.strip())
+            else:
+                raise ValueError(f"requiredOnMerge[{index}].command missing")
+            kind, verification = _merge_command_kind(item)
+            plan.append(
+                {
+                    "command": command,
+                    "kind": kind,
+                    "verification": verification,
+                    "reuseContext": {
+                        field: str(item.get(field)).strip()
+                        for field in (
+                            "environmentHash",
+                            "toolchainHash",
+                            "lockHash",
+                            "dbSchemaHash",
+                        )
+                        if str(item.get(field) or "").strip()
+                    },
+                }
+            )
+        return plan
+
     def verify(
         self,
         commands: Sequence[Sequence[str]] | None = None,
@@ -1217,12 +1323,16 @@ class IntegrationTransaction:
         timeout_seconds: float = DEFAULT_VERIFY_TIMEOUT_SECONDS,
     ) -> dict[str, Any]:
         commands = list(commands or [])
-        # Wave-2 H-9: append profile mergeVerification.requiredOnMerge commands.
         try:
-            commands.extend(self._required_on_merge_commands())
+            profile_plan = self._required_on_merge_plan()
         except Exception as exc:  # noqa: BLE001 — surface as verify plan error
             raise VerifyPlanMissingError(f"mergeVerification load failed: {exc}") from exc
-        commands = _dedupe_verify_commands(commands)
+        plan = [
+            {"command": list(command), "kind": "smoke", "verification": None}
+            for command in commands
+        ]
+        plan.extend(profile_plan)
+        commands = _dedupe_verify_commands([item["command"] for item in plan])
         if timeout_seconds <= 0:
             raise VerifyPlanMissingError("verification timeout must be greater than zero")
 
@@ -1236,7 +1346,35 @@ class IntegrationTransaction:
                 )
             intg_root = Path(journal["integrationRoot"]).resolve()
             results: list[dict[str, Any]] = []
+            merge_tree = self.runner.text(intg_root, "rev-parse", "--verify", "HEAD^{tree}")
+            merge_tree_hash = "sha256:" + merge_tree if merge_tree else None
+            policies = {tuple(item["command"]): item for item in plan}
             for index, command in enumerate(commands):
+                policy = policies.get(
+                    tuple(command), {"kind": "smoke", "verification": None}
+                )
+                reused = (
+                    _reusable_merge_evidence(
+                        self._ledger_path(),
+                        verification=policy.get("verification"),
+                        command=command,
+                        product_tree_hash=merge_tree_hash,
+                        reuse_context=policy.get("reuseContext") or {},
+                    )
+                    if policy.get("kind") == "heavyweight"
+                    else None
+                )
+                if reused is not None:
+                    results.append(
+                        {
+                            "command": list(command),
+                            "exitCode": 0,
+                            "reused": True,
+                            "kind": "heavyweight",
+                            **reused,
+                        }
+                    )
+                    continue
                 executable_command = _normalize_verify_command(command)
                 started = dt.datetime.now().astimezone()
                 try:
@@ -1579,6 +1717,51 @@ class IntegrationTransaction:
             "residualPaths": residual_paths,
         }
 
+    def _persist_cleanup_snapshot(
+        self, journal: dict[str, Any], execution_root: Path
+    ) -> dict[str, Any]:
+        """Persist all evidence needed to close cleanup after the root is gone."""
+        snapshot = {
+            "schemaVersion": 1,
+            "createdAt": now_iso(),
+            "changeId": self.change_id,
+            "attemptId": self.run_id,
+            "worktreeRoot": str(execution_root.resolve()),
+            "executionRoot": str(execution_root.resolve()),
+            "mergeEvidence": {
+                key: journal.get(key)
+                for key in (
+                    "mergeCommit",
+                    "pushedHead",
+                    "mergeFinalHash",
+                    "ciExpectedHead",
+                    "remoteHead",
+                )
+            },
+            "evidenceIdentity": journal.get("evidenceIdentity"),
+        }
+        journal["cleanupSnapshot"] = snapshot
+        self._save(journal)
+        return snapshot
+
+    def _stop_owned_services(
+        self, journal: dict[str, Any], execution_root: Path
+    ) -> dict[str, Any]:
+        """Stop only sessions explicitly owned by this transaction worktree."""
+        result = harness_service.stop_owned_sessions(
+            self.project_root,
+            change_id=self.change_id,
+            execution_root=execution_root,
+            worktree_root=execution_root,
+        )
+        journal["serviceStop"] = result
+        self._save(journal)
+        if not result["ok"]:
+            raise CleanupRefusedError(
+                "owned service could not be identity-verified and stopped"
+            )
+        return result
+
     def cleanup(self) -> dict[str, Any]:
         try:
             existing = self._load()
@@ -1592,6 +1775,8 @@ class IntegrationTransaction:
         def action(journal: dict[str, Any]) -> None:
             self._assert_cleanup_consistency(journal)
             intg_root = Path(journal["integrationRoot"])
+            self._persist_cleanup_snapshot(journal, intg_root)
+            service_stop = self._stop_owned_services(journal, intg_root)
             cleanup_result: dict[str, Any] = {
                 "ok": True,
                 "code": "ALREADY_ABSENT",
@@ -1657,6 +1842,15 @@ class IntegrationTransaction:
                 "primaryHead": local_target,
                 "remoteHead": remote_target,
                 "residualPaths": cleanup_result.get("residualPaths") or [],
+                "serviceStop": service_stop,
+            }
+            journal["cleanupReceipt"] = {
+                "schemaVersion": 1,
+                "completedAt": now_iso(),
+                "snapshot": journal.get("cleanupSnapshot"),
+                "worktreeRemoval": cleanup_result,
+                "serviceStop": service_stop,
+                "worktreeGone": not intg_root.exists(),
             }
             self._save(journal)
 

package/harness/bundles/java/claude-code/scripts/harness_ledger.py

@@ -139,6 +139,55 @@ def verification_target_identity(
     return "sha256:" + hashlib.sha256(payload).hexdigest()
 
 
+def _hash_text(value: str) -> str:
+    return "sha256:" + hashlib.sha256(value.encode("utf-8")).hexdigest()
+
+
+def command_set_hash(command: str) -> str:
+    """Stable identity for the exact command set represented by one target."""
+    return _hash_text(str(command).strip())
+
+
+def product_tree_hash(project_root: Path | None) -> str | None:
+    """Git tree identity is content provenance; a commit SHA is not."""
+    if project_root is None:
+        return None
+    tree = _git_text(project_root, "rev-parse", "--verify", "HEAD^{tree}")
+    return "sha256:" + tree if _nonempty_str(tree) else None
+
+
+def lock_hash(project_root: Path | None) -> str | None:
+    """Hash present dependency lockfiles, when the project exposes any."""
+    if project_root is None:
+        return None
+    names = (
+        "package-lock.json", "npm-shrinkwrap.json", "pnpm-lock.yaml",
+        "yarn.lock", "Cargo.lock", "go.sum", "poetry.lock",
+    )
+    files = [project_root / name for name in names if (project_root / name).is_file()]
+    if not files:
+        return None
+    digest = hashlib.sha256()
+    for path in files:
+        digest.update(path.name.encode("utf-8"))
+        digest.update(b"\0")
+        digest.update(hashlib.sha256(path.read_bytes()).digest())
+    return "sha256:" + digest.hexdigest()
+
+
+def canonical_reuse_key(entry: dict[str, Any]) -> dict[str, str]:
+    """Commit-independent verification identity used to authorize reuse."""
+    fields = (
+        "verification", "productTreeHash", "commandSetHash", "environmentHash",
+        "toolchainHash", "lockHash", "dbSchemaHash", "targetIdentity",
+    )
+    return {
+        field: str(entry.get(field)).strip()
+        for field in fields
+        if _nonempty_str(entry.get(field))
+    }
+
+
 def now_iso() -> str:
     return dt.datetime.now().astimezone().isoformat(timespec="milliseconds")
 
@@ -1132,6 +1181,9 @@ def decide_can_reuse(
     requested_profile_hash: str | None = None,
     requested_environment_hash: str | None = None,
     requested_db_schema_hash: str | None = None,
+    requested_product_tree_hash: str | None = None,
+    requested_command_set_hash: str | None = None,
+    requested_lock_hash: str | None = None,
     requested_target_identity: str | None = None,
     required_coverage: str | None = None,
     project_root: Path | str | None = None,
@@ -1162,7 +1214,40 @@ def decide_can_reuse(
         if isinstance(target, dict) and target.get("verification") == verification
     ]
     target_entries.sort(key=lambda item: str(item.get("finishedAt") or ""))
-    entry = target_entries[-1] if target_entries else None
+    # A ledger can contain both a feature-tip and a later merge target. Select
+    # the newest candidate matching the requested canonical key, rather than
+    # letting an unrelated newest commit mask reusable evidence.
+    requested_key_values = {
+        "productTreeHash": requested_product_tree_hash,
+        "commandSetHash": requested_command_set_hash,
+        "toolchainHash": requested_toolchain_hash,
+        "profileHash": requested_profile_hash,
+        "environmentHash": requested_environment_hash,
+        "lockHash": requested_lock_hash,
+        "dbSchemaHash": requested_db_schema_hash,
+    }
+    matching_entries = [
+        candidate
+        for candidate in target_entries
+        if all(
+            not _nonempty_str(requested)
+            or str(candidate.get(field) or "").strip().removeprefix("sha256:")
+            == str(requested).strip().removeprefix("sha256:")
+            for field, requested in requested_key_values.items()
+        )
+        and (
+            not _nonempty_str(requested_command)
+            or str(candidate.get("command") or "").strip()
+            == str(requested_command).strip()
+        )
+    ]
+    entry = (
+        matching_entries[-1]
+        if matching_entries
+        else target_entries[-1]
+        if target_entries
+        else None
+    )
     if not isinstance(validations, dict) and entry is None:
         return {
             "ok": True,
@@ -1314,12 +1399,17 @@ def decide_can_reuse(
                 "requested_command": requested_command,
             }
 
-    # Toolchain / profile / environment hash drift -> structured rerun (UT-017).
+    # The reusable identity is content and execution context, never commit SHA.
+    # productCommit remains provenance only so a feature tip can serve its no-ff
+    # merge when the merge has exactly the same product tree.
     # Only compared when both the stored entry and the request carry the field.
     for field, requested, code_name in (
+        ("productTreeHash", requested_product_tree_hash, "PRODUCT_TREE_CHANGED"),
+        ("commandSetHash", requested_command_set_hash, "COMMAND_SET_CHANGED"),
         ("toolchainHash", requested_toolchain_hash, "TOOLCHAIN_CHANGED"),
         ("profileHash", requested_profile_hash, "PROFILE_CHANGED"),
         ("environmentHash", requested_environment_hash, "ENVIRONMENT_CHANGED"),
+        ("lockHash", requested_lock_hash, "LOCK_CHANGED"),
         ("dbSchemaHash", requested_db_schema_hash, "DB_SCHEMA_CHANGED"),
     ):
         stored = entry.get(field)
@@ -1400,6 +1490,13 @@ def decide_can_reuse(
         "inputsHash": stored_hash,
         "inputsFiles": stored_files,
         "evidence_summary": evidence_summary(entry),
+        "reusedFrom": {
+            "targetId": entry.get("id"),
+            "sourceCommit": entry.get("productCommit") or entry.get("currentHead"),
+            "sourceCandidate": entry.get("candidateId"),
+        },
+        "reuseReason": "canonical reuse key matched; commit SHA is provenance only",
+        "reuseKey": canonical_reuse_key(entry),
         "marker": "REUSED",
     }
 
@@ -1568,6 +1665,20 @@ def cmd_can_reuse(args: argparse.Namespace) -> int:
             requested_profile_hash=getattr(args, "profile_hash", None),
             requested_environment_hash=getattr(args, "environment_hash", None),
             requested_db_schema_hash=getattr(args, "db_schema_hash", None),
+            requested_product_tree_hash=(
+                getattr(args, "product_tree_hash", None) or product_tree_hash(project_root)
+            ),
+            requested_command_set_hash=(
+                getattr(args, "command_set_hash", None)
+                or (
+                    command_set_hash(str(getattr(args, "command", "")))
+                    if _nonempty_str(getattr(args, "command", None))
+                    else None
+                )
+            ),
+            requested_lock_hash=(
+                getattr(args, "lock_hash", None) or lock_hash(project_root)
+            ),
             requested_target_identity=verification_target_identity(
                 verification, target
             ),
@@ -1727,6 +1838,13 @@ def cmd_record(args: argparse.Namespace) -> int:
             val = getattr(args, attr, None)
             if _nonempty_str(val):
                 entry[field] = str(val).strip()
+        entry["commandSetHash"] = command_set_hash(args.command)
+        tree_hash = product_tree_hash(project_root)
+        if tree_hash:
+            entry["productTreeHash"] = tree_hash
+        dependency_lock_hash = lock_hash(project_root)
+        if dependency_lock_hash:
+            entry["lockHash"] = dependency_lock_hash
         # package verification: record build artifact + test-reuse provenance.
         if verification == "package":
             if _nonempty_str(getattr(args, "deploy_artifact", None)):
@@ -1756,6 +1874,9 @@ def cmd_record(args: argparse.Namespace) -> int:
             "toolchainHash": entry.get("toolchainHash"),
             "profileHash": entry.get("profileHash"),
             "environmentHash": entry.get("environmentHash"),
+            "productTreeHash": entry.get("productTreeHash"),
+            "commandSetHash": entry.get("commandSetHash"),
+            "lockHash": entry.get("lockHash"),
             "dbSchemaHash": entry.get("dbSchemaHash"),
         }
         target_id = (
@@ -1994,6 +2115,9 @@ def build_parser() -> argparse.ArgumentParser:
         default=None,
         help="optional DB schema hash to compare against ledger entry (H-9)",
     )
+    p_reuse.add_argument("--product-tree-hash", default=None)
+    p_reuse.add_argument("--command-set-hash", default=None)
+    p_reuse.add_argument("--lock-hash", default=None)
     p_reuse.add_argument(
         "--verbose",
         action="store_true",

package/harness/bundles/java/claude-code/scripts/harness_report_model.py

@@ -34,21 +34,30 @@ IDENTITY_FIELDS = (
     "repositoryId",
     "changeName",
     "baseCommit",
+    "checkpointCommit",
     "productCommit",
+    "featureTip",
+    "mergeCommit",
+    "releaseTip",
     "featureMergeHash",
     "releaseTipHash",
     "productTreeHash",
     "environmentHash",
     "candidateId",
 )
-CONTENT_HASH_FIELDS = frozenset({"productTreeHash", "environmentHash"})
+CONTENT_HASH_FIELDS = frozenset(
+    {"productTreeHash", "commandSetHash", "environmentHash", "toolchainHash", "lockHash", "dbSchemaHash"}
+)
 TARGET_IDENTITY_FIELDS = (
     "target",
     "repositoryId",
     "changeName",
-    "productCommit",
     "productTreeHash",
+    "commandSetHash",
     "environmentHash",
+    "toolchainHash",
+    "lockHash",
+    "dbSchemaHash",
     "profile",
     "candidateId",
 )
@@ -92,18 +101,23 @@ def canonical_identity(summary: Mapping[str, Any]) -> dict[str, str]:
         "repositoryId": ("repositoryId",),
         "changeName": ("changeName",),
         "baseCommit": ("baseCommit",),
+        "checkpointCommit": ("checkpointCommit",),
         "productCommit": ("productCommit", "finalCommit"),
-        "featureMergeHash": ("featureMergeHash", "productCommit", "finalCommit"),
-        "releaseTipHash": ("releaseTipHash", "archiveCommit", "finalCommit"),
+        "featureTip": ("featureTip", "featureTipHash", "productCommit", "finalCommit"),
+        "mergeCommit": ("mergeCommit", "featureMergeHash"),
+        "releaseTip": ("releaseTip", "releaseTipHash", "archiveCommit", "finalCommit"),
+        "featureMergeHash": ("featureMergeHash", "mergeCommit", "featureTip", "productCommit", "finalCommit"),
+        "releaseTipHash": ("releaseTipHash", "releaseTip", "archiveCommit", "finalCommit"),
         "productTreeHash": ("productTreeHash",),
         "environmentHash": ("environmentHash",),
         "candidateId": ("candidateId",),
     }
     identity: dict[str, str] = {}
     for field in IDENTITY_FIELDS:
+        # Prefer changeIdentity, then nested aliases, then top-level mirrors.
         candidates = (nested.get(field),) + tuple(
-            summary.get(key) for key in fallbacks[field]
-        )
+            nested.get(key) for key in fallbacks[field]
+        ) + tuple(summary.get(key) for key in fallbacks[field])
         value = next(
             (
                 str(candidate).strip()
@@ -126,7 +140,11 @@ def apply_identity_mirrors(
     canonical = dict(identity or canonical_identity(summary))
     result["changeIdentity"] = copy.deepcopy(canonical)
     for field in (
+        "checkpointCommit",
         "productCommit",
+        "featureTip",
+        "mergeCommit",
+        "releaseTip",
         "featureMergeHash",
         "releaseTipHash",
         "productTreeHash",
@@ -138,7 +156,11 @@ def apply_identity_mirrors(
     git_facts = copy.deepcopy(git_facts) if isinstance(git_facts, Mapping) else {}
     for field in (
         "baseCommit",
+        "checkpointCommit",
         "productCommit",
+        "featureTip",
+        "mergeCommit",
+        "releaseTip",
         "featureMergeHash",
         "releaseTipHash",
         "productTreeHash",