@hunter-harness/workflow-harness 0.2.43 → 0.2.44

package/harness/bundles/java/codex/scripts/harness_archive.py

@@ -77,6 +77,7 @@ import harness_paths as hp  # noqa: E402
 import harness_phase as hphase  # noqa: E402
 import harness_report_model as hrm  # noqa: E402
 import harness_review as hr  # noqa: E402
+import harness_runtime as hruntime  # noqa: E402
 
 
 # ---------------------------------------------------------------------------
@@ -1957,6 +1958,131 @@ def check_archive_exact_byte_policy(project_root: Path) -> dict[str, Any]:
     }
 
 
+def validate_sensitive_evidence_publication_gate(
+    change_dir: Path,
+    *,
+    copy_root: Path | None = None,
+    require_receipt: bool = False,
+) -> dict[str, Any]:
+    """Fail closed before freeze/copy when plaintext evidence is unresolved.
+
+    The receipt is deliberately self-excluded from the tree digest.  It may
+    therefore bind the exact publishable bytes without creating a recursive
+    digest.  Private quarantine paths are evidence metadata only and must be
+    outside both the project/copy roots.
+    """
+    change_dir = change_dir.expanduser().resolve()
+    copy_root = (copy_root or change_dir).expanduser().resolve()
+    receipt_path = hruntime.sensitive_evidence_receipt_path(change_dir)
+    candidates = hruntime.sensitive_evidence_candidates(change_dir)
+    if candidates:
+        return {
+            "ok": False,
+            "reasonCode": "SENSITIVE_EVIDENCE_UNQUARANTINED",
+            "receiptPath": str(receipt_path),
+            "unresolvedFailures": candidates,
+            "nextAction": "Quarantine the original bytes before archive publication.",
+        }
+    if not receipt_path.is_file():
+        if require_receipt:
+            return {
+                "ok": False,
+                "reasonCode": "SECRET_SCAN_RECEIPT_MISSING",
+                "receiptPath": str(receipt_path),
+                "unresolvedFailures": [],
+            }
+        return {
+            "ok": True,
+            "reasonCode": "SECRET_SCAN_NOT_APPLICABLE",
+            "receiptPath": str(receipt_path),
+            "receiptRequired": False,
+            "unresolvedFailures": [],
+        }
+    try:
+        receipt = read_json(receipt_path)
+    except (OSError, json.JSONDecodeError, TypeError) as exc:
+        return {
+            "ok": False,
+            "reasonCode": "SECRET_SCAN_RECEIPT_INVALID",
+            "receiptPath": str(receipt_path),
+            "error": str(exc),
+        }
+    if not isinstance(receipt, dict):
+        return {
+            "ok": False,
+            "reasonCode": "SECRET_SCAN_RECEIPT_INVALID",
+            "receiptPath": str(receipt_path),
+            "error": "receipt must be an object",
+        }
+    issues: list[dict[str, Any]] = []
+    if receipt.get("schemaVersion") != 1:
+        issues.append({"code": "SECRET_SCAN_SCHEMA_INVALID"})
+    if receipt.get("rulesVersion") != hruntime.SECRET_SCAN_RULES_VERSION:
+        issues.append({"code": "SECRET_SCAN_RULES_MISMATCH"})
+    if receipt.get("changeId") != change_dir.name:
+        issues.append({"code": "SECRET_SCAN_CHANGE_ID_MISMATCH"})
+    if str(receipt.get("status") or "").upper() not in {"OK", "QUARANTINED"}:
+        issues.append({"code": "SENSITIVE_EVIDENCE_QUARANTINE_FAILED"})
+    unresolved = receipt.get("unresolvedFailures")
+    if isinstance(unresolved, list) and unresolved:
+        issues.append({"code": "SENSITIVE_EVIDENCE_QUARANTINE_FAILED", "count": len(unresolved)})
+    elif unresolved not in (None, []):
+        issues.append({"code": "SECRET_SCAN_UNRESOLVED_INVALID"})
+    try:
+        actual_digest = hruntime.publishable_tree_digest(change_dir)
+    except OSError as exc:
+        actual_digest = None
+        issues.append({"code": "SECRET_SCAN_TREE_UNREADABLE", "error": str(exc)})
+    if actual_digest is not None and receipt.get("publishableTreeDigest") != actual_digest:
+        issues.append({
+            "code": "SECRET_SCAN_TREE_DIGEST_MISMATCH",
+            "expected": receipt.get("publishableTreeDigest"),
+            "actual": actual_digest,
+        })
+    if receipt.get("publicationExcluded") is not True:
+        issues.append({"code": "SECRET_SCAN_PUBLICATION_NOT_EXCLUDED"})
+    project_root = find_project_root(change_dir)
+    for entry in receipt.get("entries") or []:
+        if not isinstance(entry, dict):
+            issues.append({"code": "SECRET_SCAN_ENTRY_INVALID"})
+            continue
+        private_raw = entry.get("privatePath")
+        if not isinstance(private_raw, str) or not private_raw.strip():
+            issues.append({"code": "SECRET_SCAN_PRIVATE_PATH_MISSING"})
+            continue
+        private_path = Path(private_raw).expanduser().resolve()
+        if (
+            _path_is_within(private_path, copy_root)
+            or _path_is_within(private_path, project_root)
+            or _path_is_within(private_path, change_dir)
+        ):
+            issues.append({
+                "code": "SECRET_SCAN_PRIVATE_PATH_IN_COPY_ROOT",
+                "privatePath": str(private_path),
+            })
+        if not private_path.is_file():
+            issues.append({
+                "code": "SECRET_SCAN_PRIVATE_PATH_MISSING",
+                "privatePath": str(private_path),
+            })
+        source_raw = entry.get("sourcePath")
+        if isinstance(source_raw, str) and source_raw.strip():
+            source_path = (change_dir / source_raw).resolve()
+            if _path_is_within(source_path, change_dir) and source_path.exists():
+                issues.append({
+                    "code": "SENSITIVE_EVIDENCE_SOURCE_REMAINS",
+                    "sourcePath": source_raw,
+                })
+    return {
+        "ok": not issues,
+        "reasonCode": "SECRET_SCAN_GATE_SATISFIED" if not issues else "SECRET_SCAN_GATE_BLOCKED",
+        "receiptPath": str(receipt_path),
+        "receipt": receipt,
+        "issues": issues,
+        "treeDigest": actual_digest,
+    }
+
+
 # ---------------------------------------------------------------------------
 # status
 # ---------------------------------------------------------------------------
@@ -2001,6 +2127,22 @@ def check_status(
             }
         )
 
+    sensitive_gate = validate_sensitive_evidence_publication_gate(
+        change_dir,
+        copy_root=change_dir,
+        require_receipt=False,
+    )
+    checks["sensitive_evidence_publication"] = sensitive_gate
+    if not sensitive_gate.get("ok"):
+        blockers.append({
+            "code": str(sensitive_gate.get("reasonCode") or "SECRET_SCAN_GATE_BLOCKED"),
+            "message": str(
+                sensitive_gate.get("nextAction")
+                or sensitive_gate.get("error")
+                or "sensitive evidence publication gate failed"
+            ),
+        })
+
     # --- H-4 formal-layer minimum set ---
     plans_dir = change_dir / "plans"
     plan_files = (
@@ -2246,6 +2388,14 @@ def check_status(
     except Exception as exc:  # noqa: BLE001 — preflight must not crash status
         preflight = {"ok": False, "items": [], "blocking": [], "error": str(exc)}
     checks["artifact_preflight"] = preflight
+    if preflight.get("ok") is not True and not preflight.get("blocking"):
+        blockers.append({
+            "code": "artifact-preflight-invalid",
+            "message": str(
+                preflight.get("error")
+                or "artifact event projection or preflight validation failed"
+            ),
+        })
     for item in preflight.get("blocking") or []:
         blockers.append({
             "code": "artifact-path-blocking",
@@ -6465,12 +6615,9 @@ def artifact_preflight(change_dir: Path) -> dict[str, Any]:
         return {"ok": True, "items": [], "blocking": []}
     change_id = change_dir.name
     project_root = find_project_root(change_dir)
-    for line in events_p.read_text(encoding="utf-8").splitlines():
-        try:
-            event = json.loads(line)
-        except json.JSONDecodeError:
-            continue
-        if not isinstance(event, dict) or event.get("type") != "artifact":
+    events = he.apply_event_corrections(he.load_events(events_p))
+    for event in events:
+        if event.get("type") != "artifact":
             continue
         path = str(event.get("path") or "").strip()
         kind = str(event.get("kind") or "").strip()
@@ -6657,9 +6804,19 @@ def evaluate_artifact_budget(change_dir: Path) -> dict[str, Any]:
     except (OSError, ValueError, json.JSONDecodeError) as exc:
         return {
             "ok": False,
-            "code": "ARTIFACT_POLICY_INVALID",
+            "code": "ARTIFACT_PREFLIGHT_INVALID",
             "message": str(exc),
         }
+    if preflight.get("ok") is not True:
+        return {
+            "ok": False,
+            "code": "ARTIFACT_PREFLIGHT_INVALID",
+            "message": str(
+                preflight.get("error")
+                or "artifact event projection or preflight validation failed"
+            ),
+            "preflightBlocking": preflight.get("blocking") or [],
+        }
     excluded_parts = {
         "node_modules",
         ".venv",
@@ -6697,7 +6854,7 @@ def evaluate_artifact_budget(change_dir: Path) -> dict[str, Any]:
     oversized = [
         item for item in entries if int(item["bytes"]) > max_file
     ]
-    ok = total <= max_total and not oversized and bool(preflight.get("ok"))
+    ok = total <= max_total and not oversized
     return {
         "ok": ok,
         "code": (
@@ -6726,6 +6883,13 @@ def materialize_repository_artifacts(change_dir: Path) -> dict[str, Any]:
     change_dir = change_dir.resolve()
     project_root = find_project_root(change_dir)
     preflight = artifact_preflight(change_dir)
+    if preflight.get("ok") is not True:
+        raise ValueError(
+            str(
+                preflight.get("error")
+                or "artifact event projection or preflight validation failed"
+            )
+        )
     copied: list[str] = []
     objects: list[dict[str, Any]] = []
     bytes_added = 0
@@ -7299,6 +7463,32 @@ def cmd_finalize(
         payload["error"] = f"archive target already exists: {archive_dir}"
         return 1, payload
 
+    source_sensitive_gate = validate_sensitive_evidence_publication_gate(
+        original_change_dir,
+        copy_root=original_change_dir,
+        require_receipt=False,
+    )
+    payload["steps"]["sensitive_evidence_source_gate"] = source_sensitive_gate
+    if not source_sensitive_gate.get("ok"):
+        payload["error"] = str(
+            source_sensitive_gate.get("nextAction")
+            or source_sensitive_gate.get("error")
+            or "sensitive evidence publication gate failed"
+        )
+        payload["issues"] = [
+            {
+                "code": str(
+                    source_sensitive_gate.get("reasonCode")
+                    or "SECRET_SCAN_GATE_BLOCKED"
+                ),
+                "severity": "error",
+                "message": payload["error"],
+            }
+        ]
+        payload["original_preserved"] = original_change_dir.is_dir()
+        payload["finalStatus"] = "FAIL"
+        return 1, payload
+
     exact_byte = check_archive_exact_byte_policy(project_root)
     payload["steps"]["archive_exact_byte"] = exact_byte
     if not exact_byte["ok"]:
@@ -7307,7 +7497,13 @@ def cmd_finalize(
     artifact_budget = evaluate_artifact_budget(original_change_dir)
     payload["steps"]["artifact_budget"] = artifact_budget
     if not artifact_budget.get("ok"):
-        payload["error"] = "artifact budget exceeded before staging"
+        if artifact_budget.get("code") == "ARTIFACT_PREFLIGHT_INVALID":
+            payload["error"] = str(
+                artifact_budget.get("message")
+                or "artifact validation failed before staging"
+            )
+        else:
+            payload["error"] = "artifact budget exceeded before staging"
         payload["issues"] = [
             {
                 "code": str(
@@ -7380,6 +7576,38 @@ def cmd_finalize(
     work_dir = operation_temp_dir
     before_manifest: dict[str, Any] | None = None
 
+    # A source tree without sensitive evidence still receives a digest-bound
+    # receipt in the isolated staging tree.  This keeps legacy archives
+    # compatible while making every published archive auditable.
+    try:
+        staged_receipt = hruntime.sensitive_evidence_receipt_path(work_dir)
+        if not staged_receipt.is_file():
+            hruntime.ensure_sensitive_evidence_scan_receipt(work_dir)
+        staged_sensitive_gate = validate_sensitive_evidence_publication_gate(
+            work_dir,
+            copy_root=work_dir,
+            require_receipt=True,
+        )
+        payload["steps"]["sensitive_evidence_publication"] = staged_sensitive_gate
+        if not staged_sensitive_gate.get("ok"):
+            payload["error"] = "sensitive evidence publication gate failed before freeze"
+            payload["issues"] = [
+                {
+                    "code": str(
+                        staged_sensitive_gate.get("reasonCode")
+                        or "SECRET_SCAN_GATE_BLOCKED"
+                    ),
+                    "severity": "error",
+                    "message": payload["error"],
+                }
+            ]
+            _restore_finalize_failure()
+            return 1, payload
+    except (OSError, ValueError, json.JSONDecodeError) as exc:
+        payload["error"] = f"sensitive evidence publication gate failed: {exc}"
+        _restore_finalize_failure()
+        return 1, payload
+
     if split_state_dir is not None and split_state_dir.is_dir():
         _merge_runtime_state(split_state_dir, work_dir)
         payload["steps"]["split_state_merge"] = {
@@ -7478,19 +7706,36 @@ def cmd_finalize(
         "blockingCount": len(preflight.get("blocking") or []),
         "itemsCount": len(preflight.get("items") or []),
     }
-    if preflight.get("blocking"):
-        payload["error"] = (
-            f"artifact preflight blocking: "
-            f"{len(preflight['blocking'])} path(s) cannot be archived"
-        )
-        payload["issues"] = [
-            {
-                "code": "ARTIFACT_PATH_BLOCKING",
-                "severity": "error",
-                "message": f"{item.get('path', '')}: {item.get('reason', 'blocking')}",
-            }
-            for item in preflight["blocking"]
-        ]
+    if preflight.get("ok") is not True:
+        blocking_paths = preflight.get("blocking") or []
+        if blocking_paths:
+            payload["error"] = (
+                f"artifact preflight blocking: "
+                f"{len(blocking_paths)} path(s) cannot be archived"
+            )
+            payload["issues"] = [
+                {
+                    "code": "ARTIFACT_PATH_BLOCKING",
+                    "severity": "error",
+                    "message": f"{item.get('path', '')}: {item.get('reason', 'blocking')}",
+                }
+                for item in blocking_paths
+            ]
+        else:
+            payload["error"] = (
+                "artifact preflight invalid: "
+                + str(
+                    preflight.get("error")
+                    or "artifact event projection or preflight validation failed"
+                )
+            )
+            payload["issues"] = [
+                {
+                    "code": "ARTIFACT_PREFLIGHT_INVALID",
+                    "severity": "error",
+                    "message": payload["error"],
+                }
+            ]
         _restore_finalize_failure()
         payload["warnings"] = warnings
         payload["ok"] = False