@hunter-harness/workflow-harness 0.2.46 → 0.2.48

package/harness/bundles/java/cursor/scripts/harness_gate.py

@@ -124,6 +124,93 @@ def _read_json(path: Path) -> Any:
     return json.loads(path.read_text(encoding="utf-8-sig"))
 
 
+# ---------------------------------------------------------------------------
+# Gate severity tiering (P1 controllability)
+#
+# Hard invariants stay fail-closed in every mode:
+#   1. submit/merge identity & final-hash consistency (ledger/integration);
+#   2. archive integrity (manifest/minimal set, enforced in harness_archive);
+#   3. destructive-action protection (cleanup topology / protected paths).
+# The sites listed in SOFT_GATE_SITES guard regenerable bookkeeping
+# (plan-handoff projections, phase capsules, scenario coverage receipts,
+# test-guard tracking). In "lenient" mode a failure at one of those sites is
+# recorded as a WARN receipt (evidence/gate-warnings.ndjson) instead of
+# blocking the phase. Release phases (submit/merge/archive/release/deploy)
+# never downgrade.
+# ---------------------------------------------------------------------------
+
+GATE_RELEASE_PHASES = frozenset({"submit", "merge", "archive", "release", "deploy"})
+SOFT_GATE_SITES = frozenset({
+    "plan-handoff",
+    "capsule",
+    "scenario-coverage",
+    "test-guard",
+})
+GATE_WARNINGS_REL = Path("evidence") / "gate-warnings.ndjson"
+
+
+def gate_severity_mode(project: Path, change_dir: Path | None = None) -> str:
+    """Resolve gate severity mode: env > change gate-policy > project config.
+
+    Default is ``lenient`` (soft regenerable sites → WARN). Release phases and
+    the three hard invariants stay fail-closed; set ``HUNTER_HARNESS_GATE_MODE``
+    or ``gate-policy.json`` ``severityMode`` to ``strict`` to force fail-closed
+    soft sites as well.
+    """
+    env_mode = str(os.environ.get("HUNTER_HARNESS_GATE_MODE") or "").strip().lower()
+    if env_mode in {"strict", "lenient"}:
+        return env_mode
+    candidates: list[Path] = []
+    if change_dir is not None:
+        candidates.append(change_dir / "meta" / "gate-policy.json")
+    candidates.append(project / ".harness" / "config" / "gate-policy.json")
+    for path in candidates:
+        if not path.is_file():
+            continue
+        try:
+            document = _read_json(path)
+        except (OSError, json.JSONDecodeError):
+            continue
+        if not isinstance(document, dict):
+            continue
+        value = str(document.get("severityMode") or "").strip().lower()
+        if value in {"strict", "lenient"}:
+            return value
+    return "lenient"
+
+
+def gate_soft_allowed(mode: str, phase: str, site: str) -> bool:
+    return (
+        mode == "lenient"
+        and phase not in GATE_RELEASE_PHASES
+        and site in SOFT_GATE_SITES
+    )
+
+
+def record_gate_warning(
+    change_dir: Path,
+    *,
+    phase: str,
+    site: str,
+    code: str,
+    message: str,
+) -> dict[str, Any]:
+    """Append a downgraded-gate receipt; the phase continues with WARN."""
+    entry = {
+        "ts": he.now_iso(),
+        "phase": phase,
+        "site": site,
+        "code": code,
+        "message": message,
+        "mode": "lenient",
+    }
+    path = change_dir / GATE_WARNINGS_REL
+    path.parent.mkdir(parents=True, exist_ok=True)
+    with path.open("a", encoding="utf-8", newline="\n") as handle:
+        handle.write(json.dumps(entry, ensure_ascii=False, separators=(",", ":")) + "\n")
+    return entry
+
+
 def _write_json(path: Path, data: Any) -> None:
     path.parent.mkdir(parents=True, exist_ok=True)
     text = json.dumps(data, ensure_ascii=False, indent=2) + "\n"
@@ -1561,7 +1648,8 @@ def append_phase_event(
         he.atomic_append_line(events_file, line)
     rendered = False
     log_path = None
-    if type_ == "phase.end" or auto_sealed:
+    if (type_ == "phase.end" or auto_sealed) and \
+            he.execution_log_render_enabled(change_dir):
         events = he.load_events(events_file)
         content = he.render_execution_log(events)
         log_path = he.write_execution_log(change_dir, content)
@@ -1882,6 +1970,8 @@ def cmd_begin(args: argparse.Namespace) -> int:
             extra={k: v for k, v in resolved.items() if k not in {"ok", "message"}},
         )
     change_dir = Path(resolved["changeDir"])
+    severity_mode = gate_severity_mode(project, change_dir)
+    gate_warnings: list[dict[str, Any]] = []
     plan_verification: dict[str, Any] | None = None
     if args.phase == "run":
         plan_verification = validate_plan_handoff(change_dir)
@@ -1894,16 +1984,25 @@ def cmd_begin(args: argparse.Namespace) -> int:
                 or plan_verification.get("message")
                 or "finalized plan verification failed"
             )
-            return emit_error(
-                code,
-                message,
-                as_json=as_json,
-                extra={
-                    key: value
-                    for key, value in plan_verification.items()
-                    if key not in {"ok", "code", "error", "message"}
-                },
-            )
+            if gate_soft_allowed(severity_mode, args.phase, "plan-handoff"):
+                gate_warnings.append(record_gate_warning(
+                    change_dir,
+                    phase=args.phase,
+                    site="plan-handoff",
+                    code=code,
+                    message=message,
+                ))
+            else:
+                return emit_error(
+                    code,
+                    message,
+                    as_json=as_json,
+                    extra={
+                        key: value
+                        for key, value in plan_verification.items()
+                        if key not in {"ok", "code", "error", "message"}
+                    },
+                )
     concurrency_block = hc.check_concurrency_block(project, resolved["changeId"])
     if concurrency_block is not None:
         record_blocked_attempt(
@@ -1998,7 +2097,18 @@ def cmd_begin(args: argparse.Namespace) -> int:
                 skills_root=Path(args.skills_root).expanduser(),
             )
         except ValueError as exc:
-            return emit_error("PHASE_CAPSULE_MISMATCH", str(exc), as_json=as_json)
+            if gate_soft_allowed(severity_mode, args.phase, "capsule"):
+                gate_warnings.append(record_gate_warning(
+                    change_dir,
+                    phase=args.phase,
+                    site="capsule",
+                    code="PHASE_CAPSULE_MISMATCH",
+                    message=str(exc),
+                ))
+                # Stale capsule is regenerable state: rebuild it below.
+                capsule = None
+            else:
+                return emit_error("PHASE_CAPSULE_MISMATCH", str(exc), as_json=as_json)
     claim = hc.claim_lease(
         project,
         change_id=resolved["changeId"],
@@ -2022,18 +2132,27 @@ def cmd_begin(args: argparse.Namespace) -> int:
             if args.phase in {"run", "test"}:
                 guard_result = htg.begin(execution_root, change_dir)
                 if not guard_result.get("ok"):
-                    hc.release_lease(
-                        project,
-                        change_id=resolved["changeId"],
-                        phase=args.phase,
-                        run_id=run_id,
-                    )
-                    return emit_error(
-                        str(guard_result.get("code", "TEST_GUARD_BEGIN_FAILED")),
-                        "test guard begin failed",
-                        as_json=as_json,
-                        extra=guard_result,
-                    )
+                    if gate_soft_allowed(severity_mode, args.phase, "test-guard"):
+                        gate_warnings.append(record_gate_warning(
+                            change_dir,
+                            phase=args.phase,
+                            site="test-guard",
+                            code=str(guard_result.get("code", "TEST_GUARD_BEGIN_FAILED")),
+                            message="test guard begin failed (downgraded to WARN)",
+                        ))
+                    else:
+                        hc.release_lease(
+                            project,
+                            change_id=resolved["changeId"],
+                            phase=args.phase,
+                            run_id=run_id,
+                        )
+                        return emit_error(
+                            str(guard_result.get("code", "TEST_GUARD_BEGIN_FAILED")),
+                            "test guard begin failed",
+                            as_json=as_json,
+                            extra=guard_result,
+                        )
             state_root = Path(hp.resolve_state_dir_for_contract(change_dir)).resolve()
             current_head = _git_text(execution_root, "rev-parse", "--verify", "HEAD")
             ledger, _ = hl.load_ledger(change_dir)
@@ -2091,6 +2210,8 @@ def cmd_begin(args: argparse.Namespace) -> int:
         "planVerification": plan_verification,
         "projection": projection,
         "executionRootSource": execution_hint["source"],
+        "gateSeverityMode": severity_mode,
+        "gateWarnings": gate_warnings,
     }
     emit(payload, as_json=as_json)
     return 0
@@ -2108,6 +2229,8 @@ def cmd_close(args: argparse.Namespace) -> int:
             extra={k: v for k, v in resolved.items() if k not in {"ok", "message"}},
         )
     change_dir = Path(resolved["changeDir"])
+    severity_mode = gate_severity_mode(project, change_dir)
+    gate_warnings: list[dict[str, Any]] = []
     blocked = foundation_gate_blocks(getattr(args, "task", None), change_dir)
     if blocked:
         return emit_error(
@@ -2204,18 +2327,27 @@ def cmd_close(args: argparse.Namespace) -> int:
                 allow_head_advance=args.phase in {"run", "submit", "merge"},
             )
         except ValueError as exc:
-            persist_close_failure(
-                change_dir,
-                args.phase,
-                run_id,
-                capsule,
-                status="CAPSULE_VALIDATION_FAILED",
-                error={
-                    "code": "PHASE_CAPSULE_MISMATCH",
-                    "message": str(exc),
-                },
-            )
-            return emit_error("PHASE_CAPSULE_MISMATCH", str(exc), as_json=as_json)
+            if gate_soft_allowed(severity_mode, args.phase, "capsule"):
+                gate_warnings.append(record_gate_warning(
+                    change_dir,
+                    phase=args.phase,
+                    site="capsule",
+                    code="PHASE_CAPSULE_MISMATCH",
+                    message=str(exc),
+                ))
+            else:
+                persist_close_failure(
+                    change_dir,
+                    args.phase,
+                    run_id,
+                    capsule,
+                    status="CAPSULE_VALIDATION_FAILED",
+                    error={
+                        "code": "PHASE_CAPSULE_MISMATCH",
+                        "message": str(exc),
+                    },
+                )
+                return emit_error("PHASE_CAPSULE_MISMATCH", str(exc), as_json=as_json)
 
     projection = evaluate_projection_gate(project, args.phase)
     if not projection.get("ok"):
@@ -2294,20 +2426,29 @@ def cmd_close(args: argparse.Namespace) -> int:
     if args.phase in {"run", "test"}:
         coverage = _validate_scenario_coverage(change_dir)
         if not coverage.get("ok"):
-            persist_close_failure(
-                change_dir,
-                args.phase,
-                run_id,
-                capsule,
-                status="SCENARIO_VALIDATION_FAILED",
-                error=coverage,
-            )
-            return emit_error(
-                str(coverage.get("code", "SCENARIO_COVERAGE_FAILED")),
-                str(coverage.get("message", "scenario coverage validation failed")),
-                as_json=as_json,
-                extra={k: v for k, v in coverage.items() if k not in {"ok", "message", "code"}},
-            )
+            if gate_soft_allowed(severity_mode, args.phase, "scenario-coverage"):
+                gate_warnings.append(record_gate_warning(
+                    change_dir,
+                    phase=args.phase,
+                    site="scenario-coverage",
+                    code=str(coverage.get("code", "SCENARIO_COVERAGE_FAILED")),
+                    message=str(coverage.get("message", "scenario coverage validation failed")),
+                ))
+            else:
+                persist_close_failure(
+                    change_dir,
+                    args.phase,
+                    run_id,
+                    capsule,
+                    status="SCENARIO_VALIDATION_FAILED",
+                    error=coverage,
+                )
+                return emit_error(
+                    str(coverage.get("code", "SCENARIO_COVERAGE_FAILED")),
+                    str(coverage.get("message", "scenario coverage validation failed")),
+                    as_json=as_json,
+                    extra={k: v for k, v in coverage.items() if k not in {"ok", "message", "code"}},
+                )
 
     close_status = args.status
     close_code = "PHASE_CLOSED"
@@ -2316,6 +2457,12 @@ def cmd_close(args: argparse.Namespace) -> int:
         # Degraded close: phase.end status must not exceed WARN (OK → WARN).
         if close_status == "OK":
             close_status = "WARN"
+    if gate_warnings:
+        # Lenient-mode downgrades: phase closes, but never better than WARN.
+        if close_status == "OK":
+            close_status = "WARN"
+        if close_code == "PHASE_CLOSED":
+            close_code = "CLOSED_WITH_WARNINGS"
 
     close_transaction: dict[str, Any] = {}
     if capsule is not None:
@@ -2340,20 +2487,29 @@ def cmd_close(args: argparse.Namespace) -> int:
         else:
             guard_result = htg.close(execution_root, change_dir)
             if not guard_result.get("ok"):
-                if capsule is not None:
-                    close_transaction.update({
-                        "status": "GUARD_CLOSE_FAILED",
-                        "lastError": guard_result,
-                        "updatedAt": he.now_iso(),
-                    })
-                    write_phase_capsule(change_dir, args.phase, run_id, capsule)
-                return emit_error(
-                    str(guard_result.get("code", "TEST_GUARD_CLOSE_FAILED")),
-                    "test guard close failed",
-                    as_json=as_json,
-                    extra=guard_result,
-                )
-            if capsule is not None:
+                if gate_soft_allowed(severity_mode, args.phase, "test-guard"):
+                    gate_warnings.append(record_gate_warning(
+                        change_dir,
+                        phase=args.phase,
+                        site="test-guard",
+                        code=str(guard_result.get("code", "TEST_GUARD_CLOSE_FAILED")),
+                        message="test guard close failed (downgraded to WARN)",
+                    ))
+                else:
+                    if capsule is not None:
+                        close_transaction.update({
+                            "status": "GUARD_CLOSE_FAILED",
+                            "lastError": guard_result,
+                            "updatedAt": he.now_iso(),
+                        })
+                        write_phase_capsule(change_dir, args.phase, run_id, capsule)
+                    return emit_error(
+                        str(guard_result.get("code", "TEST_GUARD_CLOSE_FAILED")),
+                        "test guard close failed",
+                        as_json=as_json,
+                        extra=guard_result,
+                    )
+            if guard_result.get("ok") and capsule is not None:
                 close_transaction["guardClosed"] = True
                 close_transaction["updatedAt"] = he.now_iso()
                 write_phase_capsule(change_dir, args.phase, run_id, capsule)
@@ -2437,6 +2593,8 @@ def cmd_close(args: argparse.Namespace) -> int:
         "testGuard": guard_result,
         "event": event_result,
         "lease": release,
+        "gateSeverityMode": severity_mode,
+        "gateWarnings": gate_warnings,
     }
     emit(payload, as_json=as_json)
     return 0

package/harness/bundles/java/cursor/scripts/harness_headless.py

@@ -0,0 +1,37 @@
+#!/usr/bin/env python3
+"""Shared headless JSON envelope helpers for stage scripts (P5 contract)."""
+
+from __future__ import annotations
+
+import json
+import sys
+from typing import Any
+
+
+def headless_envelope(
+    *,
+    command: str,
+    ok: bool,
+    exit_code: int,
+    change: str | None = None,
+    phase: str | None = None,
+    warnings: list[Any] | None = None,
+    errors: list[Any] | None = None,
+    result: dict[str, Any] | None = None,
+) -> dict[str, Any]:
+    return {
+        "schema_version": 1,
+        "ok": ok,
+        "command": command,
+        "change": change,
+        "phase": phase,
+        "exit_code": exit_code,
+        "warnings": warnings or [],
+        "errors": errors or [],
+        "result": result or {},
+    }
+
+
+def emit_headless(payload: dict[str, Any], *, stream=None) -> None:
+    out = stream or sys.stdout
+    print(json.dumps(payload, ensure_ascii=False, indent=2), file=out)

package/harness/manifests/general/claude-code.json

@@ -2,9 +2,9 @@
   "schema_version": 2,
   "profile": "general",
   "adapter": "claude-code",
-  "bundle_version": "0.2.35",
+  "bundle_version": "0.2.37",
   "requires": {
-    "minimumCliVersion": "0.2.48",
+    "minimumCliVersion": "0.2.50",
     "capabilities": [
       "sync@2",
       "rules-sync@1",
@@ -23,7 +23,7 @@
   "files": [
     {
       "path": ".harness-build.json",
-      "sha256": "5293ddd95f5ab1c68ae0372e0c3f95ab0a461d8ef5f02170548db5ab7c13d7b4"
+      "sha256": "eadad2ab2439a1213cdd76b7acb9c16fb7a15da6d51c1829bb2288eb830eed2a"
     },
     {
       "path": "agents/harness-evaluator.md",
@@ -95,7 +95,7 @@
     },
     {
       "path": "harness-archive/SKILL.md",
-      "sha256": "e6359fc4c8973a22b830777295f5c606b7ae03fb790b98aca309ad000a98a29c"
+      "sha256": "55bef68b5a39d074df92590e5e1fd8d0ce24f0abbba6438de7561c691d59eb5e"
     },
     {
       "path": "harness-archive/templates/render-summary.mjs",
@@ -115,7 +115,7 @@
     },
     {
       "path": "harness-codebase-map/SKILL.md",
-      "sha256": "6914d4ce401dab5445eba401357d61a6ad4e677c08b12e8e3f940faa84e73bc8"
+      "sha256": "666e18d829b6e54e878737950470002cc9c1fb4f0292cb1af9da13ab21cb488e"
     },
     {
       "path": "harness-codebase-map/templates/ARCHITECTURE.md",
@@ -175,15 +175,15 @@
     },
     {
       "path": "harness-knowledge-ingest/scripts/harness_knowledge.py",
-      "sha256": "1d7e6a59fcee223c6988f4993bc838a6bf435eae9d195afd015596298c3162b3"
+      "sha256": "e12d01a9695ccc6624a4a7690f831622d18866fc0a6c383c640dc7345394d047"
     },
     {
       "path": "harness-knowledge-ingest/SKILL.md",
-      "sha256": "bcdfee63fb5f4db5777a45fec78663ff7130434f49f6501e3190100232f3c8e0"
+      "sha256": "97173b627a90afafc3c77c0e1535194b42e7ff8453ed98a42fffe3fa12cbb8d4"
     },
     {
       "path": "harness-knowledge-query/SKILL.md",
-      "sha256": "2b8d669199c6f0115d8b921dd08f161d479c823fcb50668172adf4240f3a0cf2"
+      "sha256": "3a328158896c205980132d69ba5db420977db9639d2d8a94c44dec46e48654bb"
     },
     {
       "path": "harness-plan/checklist.md",
@@ -199,7 +199,7 @@
     },
     {
       "path": "harness-plan/SKILL.md",
-      "sha256": "a250a4935871136edc067f4b123638887962d5c20ae273fda94ea58befd6f20a"
+      "sha256": "ca4118e2ef6a1d952ec08c1fbdc099bcb886c75f078d2c61318790bf126e991b"
     },
     {
       "path": "harness-review/checklist.md",
@@ -215,7 +215,7 @@
     },
     {
       "path": "harness-review/SKILL.md",
-      "sha256": "dd2f478045249b2b339a8837e47f3863b2fbbe8c7268794f5f0ef34d9b0bd86a"
+      "sha256": "ab978e9d4a9e90043628a75e3b47c3668b028e1b278bdcc7c8e977fa7eefe19d"
     },
     {
       "path": "harness-run/checklist.md",
@@ -231,7 +231,7 @@
     },
     {
       "path": "harness-run/SKILL.md",
-      "sha256": "05d1d9f17e191888c616509f53691b9a637d3f4bf42103d86ed1a1ed4f6fe354"
+      "sha256": "8790202ebeeea57c40236353c03b68f476de4b092a1e519cb01fce1d56bef19f"
     },
     {
       "path": "harness-submit/checklist.md",
@@ -243,7 +243,7 @@
     },
     {
       "path": "harness-submit/SKILL.md",
-      "sha256": "c82a054e55ecee061e36114063032180baadbbe17c4270a2c89bd0bc03418d32"
+      "sha256": "8f2fe6de526027d2af9a7261626c912226c2c42a7a2c05404c51ea4a2c8b1f5b"
     },
     {
       "path": "harness-sync/reference.md",
@@ -251,7 +251,7 @@
     },
     {
       "path": "harness-sync/SKILL.md",
-      "sha256": "d846ccfaa0421b5c339667012f78644b362d81d4c08c54eab74887e4464716de"
+      "sha256": "76963989cbf601dcd8b8bec19033b097f79e30bb2c5b348fc3fa9cd20bc400bc"
     },
     {
       "path": "harness-test/checklist.md",
@@ -275,7 +275,7 @@
     },
     {
       "path": "harness-test/SKILL.md",
-      "sha256": "4a8ca56bb771e6fab5f2bbb1e83cbaf23975f13554eac362a4f44fa9bce5457c"
+      "sha256": "0337985e4716861ad656194eb16048a18814414ec1563aa1177882c589144398"
     },
     {
       "path": "protocols/archive-report-protocol.md",
@@ -339,7 +339,7 @@
     },
     {
       "path": "README.md",
-      "sha256": "0b2cd9f95c49abdc3b250219b7f885fce3a78248cccc859f1f186d862af1f201"
+      "sha256": "74a3ee92b7c7cc015e000143e53a0746a66bb6adcc6d2b6a648edc9c41cca32b"
     },
     {
       "path": "scripts/harness_apidoc.py",
@@ -347,7 +347,7 @@
     },
     {
       "path": "scripts/harness_archive.py",
-      "sha256": "0d47db600eefe508032b5b1fed390907856e65efcaf5e9a16395fa95e45bf1b7"
+      "sha256": "5ca2338060125a5cc2df55d53864be2122e7f573b4c35a4f14c5803a232b1ec7"
     },
     {
       "path": "scripts/harness_change.py",
@@ -373,9 +373,13 @@
       "path": "scripts/harness_environment.py",
       "sha256": "dcbc6d17de9f07bea1d85e7cc2c2a96257f5b2e1f4aa08577815ad7b0ef548ff"
     },
+    {
+      "path": "scripts/harness_events_sync.py",
+      "sha256": "1097e6fccc1b81a54db2ccacdd8f8db835b5763dbf5c472873b82eb718e33f5f"
+    },
     {
       "path": "scripts/harness_events.py",
-      "sha256": "0d4db19d71d5945837c255192f7c915af447f98e2ac66bf60e25b93f1613b391"
+      "sha256": "922240bc7ede9c17a6e99bbe9a04177363cc5101fca23e221523d3ddc3c27d3f"
     },
     {
       "path": "scripts/harness_execution_contracts.py",
@@ -387,7 +391,11 @@
     },
     {
       "path": "scripts/harness_gate.py",
-      "sha256": "404ad6fdf0f5508a22e12086a05f728df41074bbc2c8072f577d500a797c91c5"
+      "sha256": "69588cf964a12e4819f4539090e39a2eb73666c9289fc1cf55f3846da4dc353c"
+    },
+    {
+      "path": "scripts/harness_headless.py",
+      "sha256": "1015d375244086edd501b3312c23c827cca3d72e3640676fd6f8b940f2649bf9"
     },
     {
       "path": "scripts/harness_integration.py",