@hunter-harness/workflow-harness 0.2.46 → 0.2.48

package/README.md

@@ -7,7 +7,7 @@ Harness 工作流族的**纯数据 npm 包**（bundles + manifests + migrations
 - npm 包 `version` 与 Registry 中 **Workflow Family 发布版本** 1:1 对齐（例如 Family `1.0.0` → 本包 `1.0.0`）。
 - `hunter-workflow-family.json` 记录族 slug、所需 profile 与 bundle 元数据，以及 `content_sha256`
   ——对 `harness/` 下所有文件按路径排序后 `{path, content}` 规范化 JSON（`canonicalJson`）取 SHA-256，
-  与 `apps/server/src/npm/publisher.ts` 的 `buildWorkflowFamilyManifest` 使用同一算法，
+  与 hunter-platform `apps/server/src/npm/publisher.ts` 的 `buildWorkflowFamilyManifest` 使用同一算法，
   供离线/本地校验本包内容完整性。
 
 ## 布局

package/harness/bundles/general/claude-code/.harness-build.json

@@ -2,5 +2,5 @@
   "schemaVersion": 1,
   "overlay": "none",
   "agent": "claude-code",
-  "coreHash": "519b79b5e5c36857"
+  "coreHash": "0c6cb544b7c0aef7"
 }

package/harness/bundles/general/claude-code/README.md

@@ -221,17 +221,18 @@ harness-skills/
 |-------|----------|------|:--------:|:--------:|----------|
 | harness-sync | `/harness-sync` | 10 项元数据检查（7 核心 + 3 辅助） | 初始化检查 | ✅ | 控制台报告 + 自动更新 |
 | harness-codebase-map | `/harness-codebase-map` | 生成代码库地图（7 类文档 + summary + manifest） | `sync`/独立 | ✅ | `.harness/codebase/map/` |
-| harness-plan | `/harness-plan` | 需求→设计→任务拆分→**测试场景表** + 自动命名变更名 | `sync` | ✅ | `.harness/changes/<cn>/plans/` |
-| harness-run | `/harness-run` | TDD 循环 变更簇编码 | `plan` | ✅ | `.harness/changes/<cn>/sqls/` |
-| harness-test | `/harness-test` | 单元测试+接口测试+30条避坑 | `run` | ✅ | `.harness/changes/<cn>/reports/test/` |
-| harness-review | `/harness-review` | 6维度参考性审查（不阻塞后续流程） | `test` | ✅ | `.harness/changes/<cn>/reports/review/` |
-| harness-submit | `/harness-submit` 或 `/harness-merge`（别名） | commit+push（主目录）/ worktree：本地 commit→--no-ff 合并→push 主分支 | `review` | ✅ | ledger `mergeFinalHash` + 控制台报告 |
-| harness-archive | `/harness-archive` | 归档产出到 archive/YYYY-MM-DD-<cn>，释放工作区 | `submit` | ✅ | `.harness/archive/YYYY-MM-DD-<cn>/` |
+| harness-plan | `/harness-plan` | 需求→设计→任务拆分→**测试场景表** + 自动命名变更名 | `sync` | 手动 | `.harness/changes/<cn>/plans/` |
+| harness-run | `/harness-run` | TDD 循环 变更簇编码 | `plan` | 手动 | `.harness/changes/<cn>/sqls/` |
+| harness-test | `/harness-test` | 单元测试+接口测试+30条避坑 | `run` | 手动 | `.harness/changes/<cn>/reports/test/` |
+| harness-review | `/harness-review` | 6维度参考性审查（不阻塞后续流程） | `test` | 手动 | `.harness/changes/<cn>/reports/review/` |
+| harness-submit | `/harness-submit` 或 `/harness-merge`（别名） | commit+push（主目录）/ worktree：本地 commit→--no-ff 合并→push 主分支 | `review` | 手动 | ledger `mergeFinalHash` + 控制台报告 |
+| harness-archive | `/harness-archive` | 归档产出到 archive/YYYY-MM-DD-<cn>，释放工作区 | `submit` | 手动 | `.harness/archive/YYYY-MM-DD-<cn>/` |
 | harness-knowledge-query | `/harness-knowledge-query` | 查询 .harness/knowledge 历史上下文，生成需求 context pack | `sync`/独立 | ✅ | `.harness/knowledge/context-packs/` |
 | harness-knowledge-ingest | `/harness-knowledge-ingest` | 从 archive 整理/同步/维护知识索引（promote/demote/audit） | `archive` | ✅ | `.harness/knowledge/index.json` |
 
-> 所有 harness skill 均支持被其他 skill 调用。`harness-run`、`harness-submit`、`harness-archive` 涉及 git 写操作、文件移动或归档，被其他 skill 调用时必须确保前置条件已满足。
+> 生命周期 skill（plan → run → test → review → submit → archive）为**手动触发**：单阶段结束后停止，不自动接续下一阶段（已设 `disable-model-invocation`）。sync / codebase-map / knowledge 等辅助 skill 仍可按需被调用。`harness-run`、`harness-submit`、`harness-archive` 涉及 git 写操作、文件移动或归档，调用前必须确保前置条件已满足。
 > `<cn>` = change-name，由 harness-plan 阶段7确定。其他 skill 自动扫描未归档变更定位。
+> 门禁默认 `gate_severity_mode=lenient`（可再生 soft site → WARN）；发布阶段与 3 类硬不变量仍 fail-closed。可用 `HUNTER_HARNESS_GATE_MODE` 或 `gate-policy.json` 的 `severityMode` 强制 `strict`。
 
 ## 关键合规约束（强制）
 
@@ -279,7 +280,7 @@ harness-skills/
 | **submit hash 记录** | pre-pull local hash + final pushed hash 双标注（主目录）；worktree 模式 submit 段只本地 commit，合并段产生 `mergeFinalHash`，archive 以 `mergeFinalHash` 为准（无则回退 final pushed hash） |
 | **archive 阶段 1** | 归档前确认 commit 已 push、hash 与 submit/merge 记录一致、test/review 报告状态；阶段边界由 finalize 单进程维护，调用者不额外 append |
 | **archive 文件移动** | 只用 PowerShell 或 Read+Write+验证，**禁止 Bash mv/cp/rm**；移动失败时不删除原目录 |
-| **archive final-summary.html** | 默认运行 `harness_archive.py finalize`：由 events/ledger/log/manifest 生成 `summary-data.json`，再由 `templates/render-summary.mjs` 渲染 `final-summary.html`，内嵌 validate。无测试或无 review 时必须在 JSON 中标记 `NOT_RUN` / `ADVISORY_NOT_RUN`，禁止伪造 100% 通过率。必须真实展示状态演进（✅OK / 🟡WARN / 🔁REUSED / 🔁RETESTED / 📝ADVISORY / 🧹NON_BEHAVIORAL_CLEANUP） |
+| **archive final-summary** | 必须运行 `harness_archive.py finalize` 生成权威 `summary-data.json` 并完成 validate；`final-summary.html` 为可选展示投影（默认渲染，失败只记 warning 不回滚；`finalize --no-html` 可跳过）。无测试或无 review 时必须在 JSON 中标记 `NOT_RUN` / `ADVISORY_NOT_RUN`，禁止伪造 100% 通过率。状态演进须真实展示（✅OK / 🟡WARN / 🔁REUSED / 🔁RETESTED / 📝ADVISORY / 🧹NON_BEHAVIORAL_CLEANUP） |
 
 ### 敏感信息脱敏
 

package/harness/bundles/general/claude-code/harness-archive/SKILL.md

@@ -1,6 +1,7 @@
 ---
 name: harness-archive
-description: "归档所有变更产出（计划/测试报告/审查/SQL/API文档）到 .harness/archive/，含归档元数据和可视化最终总结。使用场景：归档、完成归档、收尾、打包产出物"
+description: "归档所有变更产出（计划/测试报告/审查/SQL/API文档）到 .harness/archive/，含归档元数据。仅当用户显式调用 /harness-archive 时使用；不得被其他阶段 skill 自动接续触发。"
+disable-model-invocation: true
 argument-hint: "变更名或留空自动检测"
 effort: medium
 allowed-tools: [Bash(powershell.exe:*), Read, Write, Edit, Glob, Grep]
@@ -20,7 +21,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=519b79b5e5c36857; overlay=none; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=0c6cb544b7c0aef7; overlay=none; agent=claude-code; do not edit -->
 # harness-archive — 变更归档
 
 ## Purpose
@@ -29,11 +30,9 @@ disallowed-tools:
 
 ## When to Use
 
-使用场景：
+仅当用户显式调用 `/harness-archive` 时执行。submit/merge 完成后**不自动**进入本阶段；用户口头说"归档/收尾"而未调用本 skill 时，先确认。
 
-- 用户说"归档 / 完成归档 / 收尾 / 打包产出物"。
-- submit 已推送、test/review 报告已就绪（或已明确标记跳过/未运行），需要封存变更产出。
-- 变更闭环最后一站，归档后从工作区移除 `.harness/changes/<change-name>/`。
+前置：submit 已推送、test/review 报告已就绪（或已明确标记跳过/未运行）。变更闭环最后一站，归档后从工作区移除 `.harness/changes/<change-name>/`。
 
 跳过场景：
 
@@ -42,8 +41,8 @@ disallowed-tools:
 
 自动调用边界：
 
-- 归档涉及移动/删除原变更目录，支持被其他 skill 调用，但调用前必须确保前置条件已满足；也支持用户显式 `/harness-archive` 调用。
-- 默认归档前确认是阻断检查点。若 `harness_archive.py auto-gate` 返回 `ARCHIVE_AUTO_GATE_SATISFIED`（Submit 或 Merge 已终态，archive-boundary snapshot 存在且全部归档门禁满足），后续 Archive 可无 AskQuestion 自动运行；其他情况仍须确认。
+- 归档涉及移动/删除原变更目录，**禁止被其他 skill 自动调用**；只接受用户显式 `/harness-archive` 调用。
+- `harness_archive.py auto-gate` 只影响**本次显式调用内**是否需要归档确认对话：返回 `ARCHIVE_AUTO_GATE_SATISFIED`（Submit 或 Merge 已终态，archive-boundary snapshot 存在且全部归档门禁满足）时可跳过 AskQuestion 直接归档；其他情况仍须确认。auto-gate 不构成跨阶段自动触发的授权。
 
 ## 前置条件
 
@@ -156,7 +155,7 @@ disallowed-tools:
 
 ### 四、数据化归档门禁（先数据后渲染）
 
-必须通过 `harness_archive.py finalize` 生成 `reports/final/summary-data.json` 与 `final-summary.html` 并完成 validate；**禁止模型临场写 500+ 行 HTML**。统计数字只能来自 summary-data、events、ledger 或 manifest。详见 `../protocols/report-pipeline-protocol.md`、`../protocols/archive-report-protocol.md`、`reference.md`。
+必须通过 `harness_archive.py finalize` 生成权威 `reports/final/summary-data.json` 并完成 validate；`final-summary.html` 为可选展示投影（默认渲染；渲染失败只记 warning、不回滚归档；`finalize --no-html` 可完全跳过本地 HTML）。**禁止模型临场写 500+ 行 HTML**。统计数字只能来自 summary-data、events、ledger 或 manifest。详见 `../protocols/report-pipeline-protocol.md`、`../protocols/archive-report-protocol.md`、`reference.md`。
 
 ### 五、manifest/checksum 必须存在
 
@@ -177,7 +176,7 @@ disallowed-tools:
 
 无测试报告 → 显示"未运行测试 / 静态验证"，不得 100% 通过率；无 review → "📝ADVISORY：未运行 review"。状态用 ✅OK / 🟡WARN / 🔁REUSED / 🔁RETESTED / 📝ADVISORY / 🧹NON_BEHAVIORAL_CLEANUP，复用前一阶段结果显示 🔁REUSED，**不得伪装成重新执行，不得无脑全绿**。
 
-**final-summary 必须产出**：Node 渲染器不可用/超时/exit 非 0/未产出文件时，`harness_archive.py` 自动用内置 Python fallback 渲染（含 changeName/finalStatus/commands/verification/changedFiles/archiveManifest/knownRisks/manualActions/maintenanceNotes，USER_SKIPPED/BLOCKED_BY_DBA/失败状态可见，全部 HTML 转义）。Node 与 Python fallback **都失败**时，finalize 立即恢复原 change 目录并 exit 非 0，**绝不归档一个没有 final-summary.html 的变更**。
+**final-summary 是可再生展示投影，非硬产物**：`summary-data.json` 是最终报告的唯一权威数据源，必须产出并通过 validate/adequacy。HTML 渲染默认执行（Node 渲染器失败时自动 Python fallback），但渲染失败只记 warning，**不再回滚归档**；`finalize --no-html` 可完全跳过本地 HTML（配置远端平台时由平台按 summary-data.json 渲染）。
 
 ### 九、CONDITIONAL_OK 最终状态
 
@@ -208,7 +207,7 @@ git 命令通过 `powershell.exe -Command "..."` 执行；archive-meta.md 和 fi
 - `.harness/archive/YYYY-MM-DD-<change-name>/meta/archive-meta.md` — 归档元数据
 - `.harness/archive/YYYY-MM-DD-<change-name>/events.ndjson` — 结构化事件层（新流程推荐；旧 archive 可缺失）
 - `.harness/archive/YYYY-MM-DD-<change-name>/reports/final/summary-data.json` — 最终报告数据源
-- `.harness/archive/YYYY-MM-DD-<change-name>/reports/final/final-summary.html` — 由 `render-summary.mjs` 渲染（Node 不可用或失败时由 `harness_archive.py` 内置 Python fallback 渲染）；**始终必须存在**，否则 finalize 恢复原 change 目录并 exit 非 0
+- `.harness/archive/YYYY-MM-DD-<change-name>/reports/final/final-summary.html` — 可选展示投影，由 `render-summary.mjs` 渲染（Node 失败时 Python fallback）；渲染失败降级 warning，`--no-html` 可跳过
 - `.harness/archive/YYYY-MM-DD-<change-name>/evidence/archive-manifest-before.json` / `archive-manifest-after.json` — 归档前后 manifest/checksum
 
 ## 渐进披露

package/harness/bundles/general/claude-code/harness-codebase-map/SKILL.md

@@ -20,7 +20,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=519b79b5e5c36857; overlay=none; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=0c6cb544b7c0aef7; overlay=none; agent=claude-code; do not edit -->
 # harness-codebase-map — 代码库地图
 
 ## Purpose

package/harness/bundles/general/claude-code/harness-knowledge-ingest/SKILL.md

@@ -20,7 +20,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=519b79b5e5c36857; overlay=none; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=0c6cb544b7c0aef7; overlay=none; agent=claude-code; do not edit -->
 # harness-knowledge-ingest
 
 从 `.harness/archive/**/reports/final/summary-data.json` 抽取项目知识，生成并维护本地 `.harness/knowledge/` 索引。

package/harness/bundles/general/claude-code/harness-knowledge-ingest/scripts/harness_knowledge.py

@@ -22,6 +22,8 @@ import subprocess
 import sys
 import time
 import unicodedata
+import urllib.error
+import urllib.request
 from difflib import SequenceMatcher
 from pathlib import Path
 from typing import Any
@@ -394,6 +396,187 @@ def project_id(project: Path) -> str:
     return slugify(project.name, 80)
 
 
+def _yaml_scalar(text: str, key: str) -> str | None:
+    """Read a top-level or nested YAML scalar without depending on PyYAML."""
+    pattern = rf"(?m)^[ \t]*{re.escape(key)}:\s*['\"]?([^'\"\n#]+)"
+    match = re.search(pattern, text)
+    if match is None:
+        return None
+    value = match.group(1).strip()
+    return value or None
+
+
+def platform_project_id(project: Path) -> str | None:
+    """Platform-bound project id from project.yaml / credentials (not the local slug)."""
+    for relative in (
+        ".harness/credentials.local.yaml",
+        ".harness/project.yaml",
+    ):
+        path = project / relative
+        if not path.is_file():
+            continue
+        text = path.read_text(encoding="utf-8", errors="ignore")
+        value = _yaml_scalar(text, "project_id")
+        if value and value.lower() not in {"null", "~", "none"}:
+            return value
+    return None
+
+
+def resolve_remote_endpoint(project: Path) -> dict[str, str] | None:
+    """P3 remote mode: credentials.local.yaml with server_url+token enables platform ingest.
+
+    When configured, local index.json / index.sqlite / judge / maintenance-outbox are
+    not maintained; entries still land under entries/ for offline grep fallback.
+    """
+    creds = project / ".harness" / "credentials.local.yaml"
+    if not creds.is_file():
+        return None
+    text = creds.read_text(encoding="utf-8", errors="ignore")
+    server_url = _yaml_scalar(text, "server_url")
+    token = _yaml_scalar(text, "token")
+    if not server_url or not token:
+        return None
+    project_bound = platform_project_id(project)
+    if not project_bound:
+        return None
+    return {
+        "server_url": server_url.rstrip("/"),
+        "token": token,
+        "project_id": project_bound,
+    }
+
+
+def post_knowledge_ingest(
+    endpoint: dict[str, str],
+    entries: list[dict[str, Any]],
+    *,
+    timeout: float = 30.0,
+) -> dict[str, Any]:
+    """POST entries to the platform knowledge ingest API (idempotent)."""
+    if not entries:
+        return {"accepted": 0, "created": 0, "updated": 0, "duplicates": 0, "skipped": True}
+    url = (
+        f"{endpoint['server_url']}/api/v1/projects/"
+        f"{endpoint['project_id']}/knowledge/ingest"
+    )
+    body = json.dumps(
+        {"schema_version": 1, "entries": entries},
+        ensure_ascii=False,
+        separators=(",", ":"),
+    ).encode("utf-8")
+    request = urllib.request.Request(
+        url,
+        data=body,
+        method="POST",
+        headers={
+            "Accept": "application/json",
+            "Authorization": f"Bearer {endpoint['token']}",
+            "Content-Type": "application/json",
+        },
+    )
+    try:
+        with urllib.request.urlopen(request, timeout=timeout) as response:
+            payload = json.loads(response.read().decode("utf-8"))
+    except urllib.error.HTTPError as exc:
+        detail = exc.read().decode("utf-8", errors="replace")
+        raise RuntimeError(f"knowledge ingest HTTP {exc.code}: {detail}") from exc
+    except (urllib.error.URLError, TimeoutError, OSError, json.JSONDecodeError) as exc:
+        raise RuntimeError(f"knowledge ingest failed: {exc}") from exc
+    if not isinstance(payload, dict):
+        raise RuntimeError("knowledge ingest returned a non-object payload")
+    return payload
+
+
+def query_remote_semantic(
+    endpoint: dict[str, str],
+    query: str,
+    *,
+    limit: int = 10,
+    timeout: float = 20.0,
+) -> list[dict[str, Any]]:
+    """Query the platform semantic search API; empty list when unreachable."""
+    from urllib.parse import urlencode
+
+    params = urlencode({"q": query, "project_id": endpoint["project_id"]})
+    url = f"{endpoint['server_url']}/api/v1/semantic/search?{params}"
+    request = urllib.request.Request(
+        url,
+        method="GET",
+        headers={
+            "Accept": "application/json",
+            "Authorization": f"Bearer {endpoint['token']}",
+        },
+    )
+    try:
+        with urllib.request.urlopen(request, timeout=timeout) as response:
+            payload = json.loads(response.read().decode("utf-8"))
+    except (urllib.error.URLError, TimeoutError, OSError, json.JSONDecodeError):
+        return []
+    items = payload.get("items") if isinstance(payload, dict) else None
+    if not isinstance(items, list):
+        return []
+    matches: list[dict[str, Any]] = []
+    for item in items[:limit]:
+        if not isinstance(item, dict):
+            continue
+        document = item.get("document") if isinstance(item.get("document"), dict) else item
+        metadata = document.get("metadata") if isinstance(document.get("metadata"), dict) else {}
+        matches.append(
+            {
+                "id": str(metadata.get("entry_id") or document.get("document_id") or ""),
+                "type": str(metadata.get("entry_type") or "decision"),
+                "status": str(metadata.get("status") or "active"),
+                "title": str(document.get("title") or ""),
+                "source": {
+                    "archive": str(metadata.get("source_archive") or "remote"),
+                },
+                "scope": {
+                    "sourceFiles": list(metadata.get("source_files") or []),
+                },
+                "body": str(document.get("body") or ""),
+                "summary": str(document.get("title") or ""),
+            }
+        )
+    return [match for match in matches if match["id"]]
+
+
+def grep_entry_files(
+    knowledge: Path,
+    query: str,
+    limit: int = 10,
+    statuses: list[str] | None = None,
+) -> list[dict[str, Any]]:
+    """Offline fallback: substring scan over entries/*.json when remote is down."""
+    needle = query.strip().lower()
+    if not needle:
+        return []
+    selected = set(statuses or ["active", "candidate"])
+    matches: list[dict[str, Any]] = []
+    for status in sorted(selected):
+        folder = knowledge / "entries" / status
+        if not folder.is_dir():
+            continue
+        for path in sorted(folder.glob("*.json")):
+            try:
+                entry = read_json(path)
+            except (OSError, json.JSONDecodeError):
+                continue
+            if not isinstance(entry, dict):
+                continue
+            haystack = " ".join(
+                str(entry.get(key) or "")
+                for key in ("id", "title", "summary", "body", "type", "status")
+            ).lower()
+            keywords = entry.get("keywords") if isinstance(entry.get("keywords"), list) else []
+            haystack += " " + " ".join(str(item) for item in keywords).lower()
+            if needle not in haystack:
+                continue
+            matches.append(entry)
+            if len(matches) >= limit:
+                return matches
+    return matches
+
+
 def git_head(project: Path) -> str | None:
     result = run_git(project, ["rev-parse", "HEAD"])
     return result.stdout.strip() if result.returncode == 0 else None
@@ -3110,11 +3293,16 @@ def build_index(
     # so a repeated ingest is a true no-op (design §3.5, cluster 6, UT-025).
     # Also require index.sqlite to exist so a query never sees a stale index.json
     # pointing at a missing sqlite (API-009 single ensure-current).
+    # P3 remote mode does not maintain sqlite; the remote pointer index is enough.
+    remote_endpoint = resolve_remote_endpoint(project)
     if incremental:
         if (
             isinstance(old_index, dict)
             and old_index.get("inputsHash") == inputs_hash
-            and (knowledge / "index.sqlite").exists()
+            and (
+                remote_endpoint is not None
+                or (knowledge / "index.sqlite").exists()
+            )
         ):
             stale_mode = dict(old_index.get("ingestMode", {}))
             stale_mode.update(
@@ -3134,6 +3322,7 @@ def build_index(
                     "archivesChanged": 0,
                     "archivesRemoved": 0,
                     "archivesDelta": 0,
+                    **({"remote": True} if remote_endpoint is not None else {}),
                 }
             )
             result = dict(old_index)
@@ -3363,6 +3552,40 @@ def build_index(
     )
 
     reporter.emit("sqlite", 0, len(indexed_entries), force=True)
+    remote = resolve_remote_endpoint(project)
+    if remote is not None:
+        # P3 remote mode: keep entry JSON files for offline grep; skip local
+        # index.json / index.sqlite / views / outbox projections and push to platform.
+        ingest_mode["mode"] = "remote"
+        ingest_mode["remote"] = True
+        ingest_mode["remoteProjectId"] = remote["project_id"]
+        ingest_mode["sqliteRebuild"] = 0
+        ingest_mode["sqliteUpsert"] = 0
+        ingest_mode["sqliteDelete"] = 0
+        ingest_mode["sqliteRowsTouched"] = 0
+        try:
+            remote_result = post_knowledge_ingest(remote, indexed_entries)
+            ingest_mode["remoteIngest"] = remote_result
+            ingest_mode["remoteOk"] = True
+        except RuntimeError as exc:
+            ingest_mode["remoteOk"] = False
+            ingest_mode["remoteError"] = str(exc)
+        index = make_manifest(
+            project,
+            pname,
+            summary_paths,
+            archive_records,
+            indexed_entries,
+            failures,
+            duplicates,
+            ingest_mode,
+        )
+        # Lightweight pointer only — not a local search index.
+        write_json_if_changed(knowledge / "index.json", index)
+        write_ingest_report(knowledge, index, failures, duplicates)
+        reporter.emit("complete", len(indexed_entries), len(indexed_entries), force=True)
+        return index
+
     sqlite_dirty_entries = [
         entry
         for entry in indexed_entries
@@ -4417,6 +4640,27 @@ def auto_knowledge(
     audit_limit: int = 10,
 ) -> dict[str, Any]:
     project = project.resolve()
+    remote = resolve_remote_endpoint(project)
+    if remote is not None:
+        sync = sync_status(project, update=True, incremental=incremental)
+        return {
+            "command": "auto",
+            "project": str(project),
+            "generatedAt": now_iso(),
+            "mode": "remote",
+            "remote": {
+                "serverUrl": remote["server_url"],
+                "projectId": remote["project_id"],
+            },
+            "sync": sync,
+            "skipped": {
+                "suggestValidators": True,
+                "verify": True,
+                "audit": True,
+                "judge": True,
+                "reason": "remote mode: candidate review happens on the platform",
+            },
+        }
     knowledge = project / ".harness" / "knowledge"
     config_summary = ensure_auto_knowledge_config(knowledge)
     sync = sync_status(project, update=True, incremental=incremental)
@@ -4530,6 +4774,46 @@ def query_index(
 ) -> dict[str, Any]:
     project = project.resolve()
     knowledge = project / ".harness" / "knowledge"
+    remote = resolve_remote_endpoint(project)
+    if remote is not None:
+        # P3: prefer platform semantic search; degrade to local entry grep when offline.
+        entries = query_remote_semantic(remote, query, limit=limit)
+        source = "remote"
+        if not entries:
+            entries = grep_entry_files(knowledge, query, limit=limit, statuses=statuses)
+            source = "offline-grep"
+        context_path = write_context_pack(project, knowledge, query, entries)
+        filters = {
+            "files": file_filters or [],
+            "statuses": statuses or [],
+            "types": types or [],
+        }
+        return {
+            "query": query,
+            "matchCount": len(entries),
+            "contextPack": str(context_path),
+            "filters": filters,
+            "mode": "remote",
+            "source": source,
+            "planInput": {
+                "kind": "harness-knowledge-context-pack",
+                "path": str(context_path),
+                "requiredBefore": "harness-plan",
+                "usage": "Read this context pack before design, planning, code exploration, or implementation.",
+            },
+            "matches": [
+                {
+                    "id": entry.get("id"),
+                    "type": entry.get("type"),
+                    "status": entry.get("status"),
+                    "title": entry.get("title"),
+                    "sourceArchive": (entry.get("source") or {}).get("archive"),
+                    "sourceFiles": (entry.get("scope") or {}).get("sourceFiles") or [],
+                }
+                for entry in entries
+            ],
+        }
+
     sqlite_path = knowledge / "index.sqlite"
     # API-009: one ensure-current. Build the shared snapshot once (inputs_hash
     # computed exactly once) and a single build_index call whose no-op fast path
@@ -4621,6 +4905,45 @@ def sync_status(
     check: bool = False,
 ) -> dict[str, Any]:
     project = project.resolve()
+    remote = resolve_remote_endpoint(project)
+    if remote is not None:
+        # P3: remote mode — local sqlite/outbox are intentionally not maintained.
+        refreshed: dict[str, Any] | None = None
+        action = "none"
+        if update and not check:
+            refreshed = build_index(
+                project,
+                incremental=incremental,
+                progress=progress,
+            )
+            action = "ingested-remote"
+        remote_ok = True
+        remote_error = None
+        if refreshed is not None:
+            mode = refreshed.get("ingestMode") or {}
+            remote_ok = bool(mode.get("remoteOk", True))
+            remote_error = mode.get("remoteError")
+        return {
+            "ok": remote_ok,
+            "current": remote_ok,
+            "action": action,
+            "reasons": [] if remote_ok else [str(remote_error or "remote ingest failed")],
+            "mode": "remote",
+            "remote": {
+                "serverUrl": remote["server_url"],
+                "projectId": remote["project_id"],
+                "ok": remote_ok,
+                **({} if remote_error is None else {"error": remote_error}),
+            },
+            "maintenance": {
+                "attempted": False,
+                "skipped": True,
+                "skippedReason": "remote mode: judge/outbox run on the platform",
+                "ok": True,
+            },
+            "index": refreshed,
+        }
+
     snapshot = build_snapshot(project)
     knowledge = snapshot.knowledge
     index_path = knowledge / "index.json"
@@ -6295,6 +6618,16 @@ def maintain_knowledge(project: Path, archive_id: str) -> dict[str, Any]:
     judge checklist, running->completed (or completed_rules_pending_judge).
     Idempotent for completed items. Failure -> failed, attempts+1, retryable."""
     project = project.resolve()
+    remote = resolve_remote_endpoint(project)
+    if remote is not None:
+        return {
+            "ok": True,
+            "archiveId": archive_id,
+            "status": "skipped-remote",
+            "skipped": True,
+            "skippedReason": "remote mode: maintenance runs on the platform",
+            "remoteProjectId": remote["project_id"],
+        }
     outbox_root = _outbox_root(project)
     outbox_root.mkdir(parents=True, exist_ok=True)
 
@@ -6379,6 +6712,19 @@ def drain_maintenance_outbox(
     simply including the stale id in the drain batch is sufficient recovery.
     """
     project = project.resolve()
+    remote = resolve_remote_endpoint(project)
+    if remote is not None:
+        return {
+            "ok": True,
+            "project": str(project),
+            "processed": 0,
+            "remaining": 0,
+            "staleRunningRecovered": 0,
+            "results": [],
+            "skipped": True,
+            "skippedReason": "remote mode: maintenance outbox is not used",
+            "mode": "remote",
+        }
     root = _outbox_root(project)
     now = time.time()
     retryable_ids = {

package/harness/bundles/general/claude-code/harness-knowledge-query/SKILL.md

@@ -20,7 +20,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=519b79b5e5c36857; overlay=none; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=0c6cb544b7c0aef7; overlay=none; agent=claude-code; do not edit -->
 # harness-knowledge-query
 
 并行 change 中查询必须传 `--change <change-id>`；成功后以该 change 的 `meta/knowledge-context.json` 为稳定指针。全局 `context-packs/latest.json` 仅向后兼容，不得用于判断多个 active change 的上下文归属。

package/harness/bundles/general/claude-code/harness-plan/SKILL.md

@@ -1,6 +1,7 @@
 ---
 name: harness-plan
-description: "将需求转化为设计文档+实施计划+完整测试场景表，必须在编码前完成。使用场景：需求分析、feature plan、技术方案设计、实现方案规划"
+description: "将需求转化为设计文档+实施计划+完整测试场景表，必须在编码前完成。仅当用户显式调用 /harness-plan 或明确要求进入 Harness 规划阶段时使用；不得因用户描述需求就自动触发。"
+disable-model-invocation: true
 argument-hint: "需求描述 | --adversarial"
 effort: medium
 allowed-tools: [Read, Glob, Grep, Edit, Write, Agent, Bash(powershell.exe:*)]
@@ -20,7 +21,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=519b79b5e5c36857; overlay=none; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=0c6cb544b7c0aef7; overlay=none; agent=claude-code; do not edit -->
 # harness-plan — 需求规划
 
 ## Purpose
@@ -31,7 +32,9 @@ disallowed-tools:
 
 ## When to Use
 
-`/harness-plan`、新功能设计、技术方案、测试场景表规划。
+仅当用户显式调用 `/harness-plan`（或明确说"用 harness 规划这个需求"）时执行。用户只是描述需求、提问或讨论方案时，**不得**自动进入本 skill。
+
+**单阶段原则**：本 skill 只负责 plan 阶段。plan finalize + verify 完成后必须停止并交还用户，仅提示下一步可执行 `/harness-run`；禁止自动开始编码或调用其他 harness 阶段 skill。
 
 ## 统一读取协议
 

package/harness/bundles/general/claude-code/harness-review/SKILL.md

@@ -1,6 +1,7 @@
 ---
 name: harness-review
-description: "6维度代码审查（架构/安全/规范/兼容/测试/性能），对照项目规则（见 .harness/context-index.json）和测试场景表，在隔离上下文运行。使用场景：代码审查、提交前检查、合并评审"
+description: "6维度代码审查（架构/安全/规范/兼容/测试/性能），对照项目规则（见 .harness/context-index.json）和测试场景表，在隔离上下文运行。仅当用户显式调用 /harness-review 时使用；不得在 test 结束后自动接续执行。"
+disable-model-invocation: true
 argument-hint: "变更名或留空自动检测"
 effort: high
 allowed-tools: [Read, Write, Edit, Glob, Grep, Agent, Bash(powershell.exe:*)]
@@ -21,7 +22,7 @@ disallowed-tools:
   - Bash(curl *)
   - Bash(codegraph *)
 ---
-<!-- generated by harness_deploy.py; core=519b79b5e5c36857; overlay=none; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=0c6cb544b7c0aef7; overlay=none; agent=claude-code; do not edit -->
 # harness-review — 代码审查
 
 ## Purpose
@@ -30,11 +31,9 @@ disallowed-tools:
 
 ## When to Use
 
-使用此 Skill 当：
-- 代码变更完成后需要审查
-- 提交前需要质量检查
-- 合并评审时需要系统性检查
-- 用户说"审查代码"、"review"、"检查代码质量"
+仅当用户显式调用 `/harness-review` 时执行。test 阶段结束后**不自动**进入本阶段；用户口头提到"审查/review"而未调用本 skill 时，先确认是否走 Harness 审查阶段。
+
+**单阶段原则**：review 关门（报告 + fixback 产出）后必须停止并交还用户，仅提示下一步可执行 `/harness-run --fixback`（有待修项）或 `/harness-submit`；禁止自动接续执行。
 
 ## Inputs