@hunter-harness/workflow-harness 0.2.54 → 0.2.55

package/harness/bundles/java/codebuddy/scripts/harness_archive.py

@@ -17,6 +17,7 @@ import argparse
 import datetime as dt
 import hashlib
 import io
+import ipaddress
 import json
 import os
 import re
@@ -31,6 +32,7 @@ import zipfile
 from collections.abc import Mapping
 from pathlib import Path
 from typing import Any
+from urllib.parse import urlsplit
 
 
 if hasattr(sys.stdout, "reconfigure"):
@@ -192,9 +194,9 @@ def append_event(
     for key, value in fields.items():
         if value is not None:
             event[key] = value
-    line = json.dumps(event, ensure_ascii=False, separators=(",", ":"))
-    he.atomic_append_line(path, line)
-    all_events = existing + [he.normalize_event(event)]
+    result = he.append_with_auto_seal(path, event, existing_events=existing)
+    event = result["event"]
+    all_events = he.load_events(path)
     he.write_execution_log(change_dir, he.render_execution_log(all_events))
     return event
 
@@ -3053,6 +3055,25 @@ def build_verification_projection(
         "apiTests": _ledger_api_tests(effective_ledger, change_dir=change_dir),
     }
     db_compatibility = _ledger_db_compat(effective_ledger)
+    if db_compatibility["status"] == "NOT_RUN" and change_dir is not None:
+        gate_policy_path = change_dir / "meta" / "gate-policy.json"
+        try:
+            gate_policy = read_json(gate_policy_path) if gate_policy_path.is_file() else None
+        except (OSError, json.JSONDecodeError):
+            gate_policy = None
+        if isinstance(gate_policy, dict):
+            capabilities = gate_policy.get("capabilities")
+            required = gate_policy.get("requiredValidations")
+            if (
+                isinstance(capabilities, list)
+                and "database" not in capabilities
+                and (not isinstance(required, list) or "dbCompatibility" not in required)
+            ):
+                db_compatibility = {
+                    "status": "NOT_APPLICABLE",
+                    "reason": "项目能力画像未声明数据库能力",
+                    "source": "capability-profile",
+                }
     projection["dbCompatibility"] = db_compatibility["status"]
     projection["dbCompatibilityEvidence"] = db_compatibility
     api_contract = validations.get("apiContract")
@@ -8377,6 +8398,27 @@ def _read_optional_text(path: Path) -> str:
         return ""
 
 
+def _archive_server_url_allowed(value: str | None) -> bool:
+    """Require TLS remotely while allowing explicit loopback HTTP for local testing."""
+    if value is None or not value.strip() or re.search(r"\s", value):
+        return False
+    try:
+        parsed = urlsplit(value)
+        host = (parsed.hostname or "").lower()
+    except ValueError:
+        return False
+    if parsed.scheme.lower() == "https":
+        return bool(host)
+    if parsed.scheme.lower() != "http":
+        return False
+    if host == "localhost":
+        return True
+    try:
+        return ipaddress.ip_address(host).is_loopback
+    except ValueError:
+        return False
+
+
 def _resolve_archive_remote_credentials(
     project_root: Path,
     environment: Mapping[str, str],
@@ -8403,10 +8445,7 @@ def _resolve_archive_remote_credentials(
         else ""
     )
     token_available = bool(env_token or local_token)
-    url_available = bool(
-        server_url
-        and re.fullmatch(r"https://[^\s]+", server_url, flags=re.IGNORECASE)
-    )
+    url_available = _archive_server_url_allowed(server_url)
     return {
         "configured": bool(url_available and token_available),
         "serverUrl": server_url if url_available else None,

package/harness/bundles/java/codebuddy/scripts/harness_context.py

@@ -474,7 +474,7 @@ def close_transition(
     *,
     from_phase: str,
     to_phase: str,
-    executor: str,
+    executor: str | None,
     artifacts: list[str] | None = None,
     status: str = "OK",
 ) -> dict[str, Any]:
@@ -491,13 +491,81 @@ def close_transition(
     except (OSError, ValueError, json.JSONDecodeError) as exc:
         return {"ok": False, "code": "CHANGE_NOT_FOUND", "error": str(exc)}
     paths = _paths(state_root)
+
+    artifact_entries: list[dict[str, Any]] = []
+    for raw in artifacts or []:
+        requested = Path(raw)
+        candidates = (
+            [requested]
+            if requested.is_absolute()
+            else [project / requested, contract_root / requested]
+        )
+        valid: list[Path] = []
+        for candidate in candidates:
+            try:
+                resolved_candidate = candidate.resolve()
+            except OSError:
+                continue
+            if resolved_candidate in valid:
+                continue
+            if resolved_candidate.is_relative_to(project) and resolved_candidate.is_file():
+                valid.append(resolved_candidate)
+        if len(valid) > 1:
+            return {
+                "ok": False,
+                "code": "TRANSITION_ARTIFACT_AMBIGUOUS",
+                "path": raw,
+                "candidates": [item.relative_to(project).as_posix() for item in valid],
+                "message": "relative artifact exists under both project and change roots",
+            }
+        if not valid:
+            return {
+                "ok": False,
+                "code": "TRANSITION_ARTIFACT_INVALID",
+                "path": raw,
+                "acceptedBases": [str(project), str(contract_root)],
+                "examples": [
+                    str(contract_root / "meta" / "plan-finalization.json"),
+                    f".harness/changes/{change}/meta/plan-finalization.json",
+                    "meta/plan-finalization.json",
+                ],
+            }
+        resolved_artifact = valid[0]
+        artifact_entries.append(
+            {
+                "path": resolved_artifact.relative_to(project).as_posix(),
+                "sha256": _sha256(resolved_artifact),
+            }
+        )
+
+    transitions = _read_ndjson(paths["transitions"])
     if not paths["lease"].is_file():
+        latest = transitions[-1] if transitions else None
+        if (
+            isinstance(latest, dict)
+            and latest.get("fromPhase") == from_phase
+            and latest.get("toPhase") == to_phase
+            and latest.get("status") == status
+            and latest.get("artifacts") == artifact_entries
+            and (executor is None or latest.get("executor") == executor)
+        ):
+            return {
+                "ok": True,
+                "code": "TRANSITION_ALREADY_CLOSED",
+                "idempotent": True,
+                "receipt": latest,
+                "path": str(paths["transitions"]),
+                "invalidation": None,
+            }
         return {"ok": False, "code": "CONTEXT_LEASE_REQUIRED"}
     try:
         lease = _read_json(paths["lease"])
     except (OSError, ValueError, json.JSONDecodeError):
         return {"ok": False, "code": "CONTEXT_LEASE_INVALID"}
-    if lease.get("owner") != executor or lease.get("phase") != from_phase:
+    effective_executor = executor or str(lease.get("owner") or "")
+    if not effective_executor:
+        return {"ok": False, "code": "CONTEXT_EXECUTOR_REQUIRED"}
+    if lease.get("owner") != effective_executor or lease.get("phase") != from_phase:
         return {
             "ok": False,
             "code": "CONTEXT_LEASE_MISMATCH",
@@ -508,25 +576,6 @@ def close_transition(
     if expiry is None or _now() >= expiry:
         return {"ok": False, "code": "CONTEXT_LEASE_EXPIRED"}
 
-    artifact_entries: list[dict[str, Any]] = []
-    for raw in artifacts or []:
-        path = Path(raw)
-        if not path.is_absolute():
-            path = contract_root / path
-        resolved = path.resolve()
-        if not resolved.is_relative_to(project) or not resolved.is_file():
-            return {
-                "ok": False,
-                "code": "TRANSITION_ARTIFACT_INVALID",
-                "path": str(path),
-            }
-        artifact_entries.append(
-            {
-                "path": resolved.relative_to(project).as_posix(),
-                "sha256": _sha256(resolved),
-            }
-        )
-    transitions = _read_ndjson(paths["transitions"])
     previous_hash = transitions[-1].get("receiptHash") if transitions else None
     attempt = (
         1
@@ -543,7 +592,7 @@ def close_transition(
         "fromPhase": from_phase,
         "toPhase": to_phase,
         "status": status,
-        "executor": executor,
+        "executor": effective_executor,
         "productCommit": _head(project),
         "artifacts": artifact_entries,
         "attempt": attempt,

package/harness/bundles/java/codebuddy/scripts/harness_events.py

@@ -41,7 +41,7 @@ def _project_root_for_change(change_dir: Path) -> Path | None:
     return None
 
 
-def _nudge_remote_sync(change_dir: Path) -> None:
+def nudge_remote_sync(change_dir: Path) -> None:
     """Best-effort wake-up after the event append has been flushed to disk."""
     project_root = _project_root_for_change(change_dir)
     if project_root is None:
@@ -55,6 +55,11 @@ def _nudge_remote_sync(change_dir: Path) -> None:
         return
 
 
+def _nudge_remote_sync(change_dir: Path) -> None:
+    """Compatibility wrapper for older callers and focused tests."""
+    nudge_remote_sync(change_dir)
+
+
 if hasattr(sys.stdout, "reconfigure"):
     sys.stdout.reconfigure(encoding="utf-8")
 if hasattr(sys.stderr, "reconfigure"):
@@ -121,6 +126,12 @@ OPTIONAL_FIELDS = (
     "renamed_from",
     "renamed_to",
     "change_uuid",
+    "execution_mode",
+    "decision_reason_code",
+    "fallback_reason_code",
+    "trigger",
+    "from_phase",
+    "result_status",
 )
 
 _PROVENANCE_FIELDS = frozenset(
@@ -139,6 +150,12 @@ _PROVENANCE_FIELDS = frozenset(
         "orchestration_active_ms",
         "wall_clock_ms",
         "user_wait_ms",
+        "execution_mode",
+        "decision_reason_code",
+        "fallback_reason_code",
+        "trigger",
+        "from_phase",
+        "result_status",
     }
 )
 _EVENT_ALLOWED_FIELDS = {
@@ -1698,6 +1715,22 @@ def append_with_auto_seal(
                 else []
             )
         )
+        if event_type in {"phase.start", "phase.end", "phase.auto_sealed"} and phase:
+            phase_attempts = split_phase_attempts(
+                [item for item in loaded if item.get("phase") == phase]
+            )
+            latest_attempt = max(
+                (
+                    int(item.get("attempt"))
+                    for item in phase_attempts
+                    if isinstance(item.get("attempt"), int)
+                ),
+                default=0,
+            )
+            if not isinstance(event.get("attempt"), int) or int(event["attempt"]) <= 0:
+                event["attempt"] = (
+                    latest_attempt + 1 if event_type == "phase.start" else latest_attempt or 1
+                )
         if event_type == "phase.start" and phase:
             auto_sealed = seal_open_phase_attempts(loaded, phase=phase)
             for seal_event in auto_sealed:
@@ -1967,6 +2000,12 @@ def build_parser() -> argparse.ArgumentParser:
     p_append.add_argument("--orchestration-active-ms", type=int, default=None)
     p_append.add_argument("--wall-clock-ms", type=int, default=None)
     p_append.add_argument("--user-wait-ms", type=int, default=None)
+    p_append.add_argument("--execution-mode", default=None)
+    p_append.add_argument("--decision-reason-code", default=None)
+    p_append.add_argument("--fallback-reason-code", default=None)
+    p_append.add_argument("--trigger", default=None)
+    p_append.add_argument("--from-phase", default=None)
+    p_append.add_argument("--result-status", default=None)
     p_append.add_argument(
         "--legacy-lenient",
         action="store_true",

package/harness/bundles/java/codebuddy/scripts/harness_events_sync.py

@@ -51,6 +51,15 @@ WHITELIST = {
     "duration_ms",
     "schemaVersion",
     "summary",
+    "executor_tool",
+    "executor_agent",
+    "executor_model",
+    "execution_mode",
+    "decision_reason_code",
+    "fallback_reason_code",
+    "trigger",
+    "from_phase",
+    "result_status",
 }
 
 MAX_BATCH_SIZE = 100
@@ -110,20 +119,43 @@ def _summary_text(value: Any) -> str:
     return text[:EVENT_SUMMARY_MAX_LENGTH].rstrip()
 
 
+_MACHINE_DETAIL_RE = re.compile(
+    r"(?:\s*[；;,，]?\s*)"
+    r"(?:artifactsHash|artifactHash|receiptHash|content_sha256|contentSha256)"
+    r"\s*[:=]\s*(?:sha256:)?[0-9a-f]{32,64}",
+    re.IGNORECASE,
+)
+
+
+def _readable_summary_text(value: Any) -> str:
+    text = _summary_text(value)
+    if not text:
+        return ""
+    text = _MACHINE_DETAIL_RE.sub("", text)
+    text = re.sub(
+        r"\bfinalize\s+ok\b",
+        "规划产物已校验并发布",
+        text,
+        flags=re.IGNORECASE,
+    )
+    text = re.sub(r"\s*([；;，,])\s*([；;，,])", r"\1", text)
+    return _summary_text(text.strip(" ；;，,"))
+
+
 def build_event_summary(event: dict[str, Any]) -> str:
-    explicit = _summary_text(event.get("summary"))
+    explicit = _readable_summary_text(event.get("summary"))
     if explicit:
         return explicit
 
     event_type = _summary_text(event.get("type"))
     phase = _summary_text(event.get("phase"))
     phase_label = PHASE_LABELS.get(phase, phase or "当前")
-    note = _summary_text(event.get("note"))
-    message = _summary_text(event.get("message"))
-    decision = _summary_text(event.get("decision"))
-    reason = _summary_text(event.get("reason"))
-    name = _summary_text(event.get("name"))
-    code = _summary_text(event.get("code"))
+    note = _readable_summary_text(event.get("note"))
+    message = _readable_summary_text(event.get("message"))
+    decision = _readable_summary_text(event.get("decision"))
+    reason = _readable_summary_text(event.get("reason"))
+    name = _readable_summary_text(event.get("name"))
+    code = _readable_summary_text(event.get("code"))
     status = _summary_text(event.get("status"))
 
     if event_type == "decision" and decision:
@@ -754,6 +786,39 @@ def _discover_changes(project_root: Path) -> list[Path]:
     return sorted(path for path in root.glob("*") if path.is_dir()) if root.is_dir() else []
 
 
+def _change_has_open_phase(change_dir: Path) -> bool:
+    """Project the append-only stream into open/closed phase state."""
+    try:
+        path = Path(harness_paths.resolve_state_dir_for_contract(change_dir)) / "events.ndjson"
+    except (OSError, ValueError):
+        return False
+    if not path.is_file():
+        return False
+    open_phases: dict[str, bool] = {}
+    try:
+        for line in path.read_text(encoding="utf-8-sig").splitlines():
+            if not line.strip():
+                continue
+            event = json.loads(line)
+            if not isinstance(event, dict):
+                continue
+            phase = event.get("phase")
+            event_type = event.get("type")
+            if not isinstance(phase, str) or not phase:
+                continue
+            if event_type == "phase.start":
+                open_phases[phase] = True
+            elif event_type in {"phase.end", "phase.auto_sealed", "workflow.end", "run.end"}:
+                open_phases[phase] = False
+    except (OSError, json.JSONDecodeError):
+        return False
+    return any(open_phases.values())
+
+
+def _project_has_open_phase(project_root: Path) -> bool:
+    return any(_change_has_open_phase(path) for path in _discover_changes(project_root))
+
+
 def _run_agent_session(project_root: Path) -> dict[str, Any]:
     attempts = 0
     uploaded = 0
@@ -766,14 +831,28 @@ def _run_agent_session(project_root: Path) -> dict[str, Any]:
         if all(item.get("ok") for item in results):
             time.sleep(0.6)
             if generation == _read_nudge_generation(project_root):
-                return {
-                    "ok": True,
-                    "uploaded": uploaded,
-                    "quarantined": quarantined,
-                    "attempts": attempts + 1,
-                }
+                if not _project_has_open_phase(project_root):
+                    return {
+                        "ok": True,
+                        "uploaded": uploaded,
+                        "quarantined": quarantined,
+                        "attempts": attempts + 1,
+                    }
+                # Keep a finite workflow lease alive while a phase is open.
+                # A phase.end nudge is observed on the next pass and releases
+                # the worker naturally; no terminal window is created.
+                time.sleep(10.0)
+                heartbeat_results = [
+                    sync_change(project_root, path, heartbeat_only=True)
+                    for path in _discover_changes(project_root)
+                ]
+                if all(item.get("ok") for item in heartbeat_results):
+                    attempts = 0
+                    continue
+                results = heartbeat_results
             attempts = 0
-            continue
+            if generation != _read_nudge_generation(project_root):
+                continue
         time.sleep(min(16.0, float(2 ** attempts)))
         attempts += 1
     return {

package/harness/bundles/java/codebuddy/scripts/harness_gate.py

@@ -30,6 +30,7 @@ if str(SCRIPTS_DIR) not in sys.path:
     sys.path.insert(0, str(SCRIPTS_DIR))
 
 import harness_change as hc  # noqa: E402
+import harness_context as hctx  # noqa: E402
 import harness_events as he  # noqa: E402
 import harness_events_sync as hes  # noqa: E402
 import harness_ledger as hl  # noqa: E402
@@ -1602,6 +1603,18 @@ def append_phase_event(
     auto_sealed: list[dict[str, Any]] = []
     with he.event_file_lock(lock_path):
         existing = he.load_events(events_file)
+        phase_attempts = he.split_phase_attempts(
+            [event for event in existing if event.get("phase") == phase]
+        )
+        latest_attempt = max(
+            (
+                int(item.get("attempt"))
+                for item in phase_attempts
+                if isinstance(item.get("attempt"), int)
+            ),
+            default=0,
+        )
+        event_attempt = latest_attempt + 1 if type_ == "phase.start" else latest_attempt or 1
         args = argparse.Namespace(
             phase=phase,
             type=type_,
@@ -1619,12 +1632,18 @@ def append_phase_event(
             decision=None,
             reason=None,
             run_id=run_id,
-            attempt=None,
+            attempt=event_attempt,
             executor_tool=executor_tool,
             executor_agent=executor_agent,
             executor_model=executor_model,
             handoff_from_tool=None,
             handoff_reason=None,
+            execution_mode=None,
+            decision_reason_code=None,
+            fallback_reason_code=None,
+            trigger=("fixback" if "fixback" in note.lower() else None),
+            from_phase=("review" if phase == "run" and "fixback" in note.lower() else None),
+            result_status=None,
         )
         event = he.build_event(args, existing)
         if identity:
@@ -1655,6 +1674,7 @@ def append_phase_event(
         content = he.render_execution_log(events)
         log_path = he.write_execution_log(change_dir, content)
         rendered = True
+    he.nudge_remote_sync(change_dir)
     return {
         "ok": True,
         "eventId": event.get("id"),
@@ -1702,6 +1722,80 @@ def _phase_event_exists(change_dir: Path, phase: str, type_: str, run_id: str) -
     )
 
 
+def _latest_phase_end(
+    change_dir: Path,
+    phase: str,
+    run_id: str | None = None,
+) -> dict[str, Any] | None:
+    for event in reversed(he.load_events(he.events_path(change_dir))):
+        if event.get("phase") != phase or event.get("type") != "phase.end":
+            continue
+        if run_id and event.get("run_id") != run_id:
+            continue
+        return event
+    return None
+
+
+def _terminal_matches_context_session(
+    project: Path,
+    change_id: str,
+    phase: str,
+    terminal: dict[str, Any],
+) -> bool:
+    view = hctx.context_view(project, change_id)
+    current = view.get("current") if isinstance(view, dict) else None
+    if not isinstance(current, dict) or current.get("phase") != phase:
+        return False
+    prepared_at = he.parse_timestamp(current.get("preparedAt"))
+    terminal_at = he.parse_timestamp(
+        terminal.get("timestamp") or terminal.get("occurred_at")
+    )
+    return (
+        prepared_at is not None
+        and terminal_at is not None
+        and terminal_at >= prepared_at
+    )
+
+
+def _close_context_handoff(
+    project: Path,
+    change_id: str,
+    args: argparse.Namespace,
+    *,
+    status: str,
+) -> dict[str, Any] | None:
+    to_phase = getattr(args, "to_phase", None)
+    if not to_phase:
+        return None
+    try:
+        return hctx.close_transition(
+            project,
+            change_id,
+            from_phase=args.phase,
+            to_phase=str(to_phase),
+            executor=getattr(args, "executor", None),
+            artifacts=list(getattr(args, "artifact", None) or []),
+            status=status,
+        )
+    except Exception as exc:  # noqa: BLE001 — phase close remains locally durable
+        return {
+            "ok": False,
+            "code": "CONTEXT_HANDOFF_FAILED",
+            "message": str(exc),
+        }
+
+
+def _sync_after_phase_close(project: Path, change_dir: Path) -> dict[str, Any]:
+    try:
+        return hes.auto_events_sync(project, change_dir)
+    except Exception as exc:  # noqa: BLE001 — remote sync is recoverable
+        return {
+            "ok": False,
+            "code": "PLATFORM_EVENTS_SYNC_WARN",
+            "warning": f"events-sync hook failed: {exc}",
+        }
+
+
 def _validate_scenario_coverage(change_dir: Path) -> dict[str, Any]:
     """C9: validate all ledger-required scenarios are covered by ledger entries.
 
@@ -2266,6 +2360,48 @@ def cmd_close(args: argparse.Namespace) -> int:
     explicit_run_id = args.run_id or os.environ.get("HUNTER_HARNESS_RUN_ID")
     current_lease = hc.inspect_lease(project, resolved["changeId"])
     if current_lease is None:
+        terminal = _latest_phase_end(change_dir, args.phase, explicit_run_id)
+        if (
+            getattr(args, "to_phase", None)
+            and terminal is not None
+            and _terminal_matches_context_session(
+                project, str(resolved["changeId"]), args.phase, terminal
+            )
+        ):
+            terminal_status = str(terminal.get("status") or args.status)
+            handoff = _close_context_handoff(
+                project,
+                str(resolved["changeId"]),
+                args,
+                status=terminal_status,
+            )
+            monitor = _sync_after_phase_close(project, change_dir)
+            if not isinstance(handoff, dict) or not handoff.get("ok"):
+                return emit_error(
+                    "PHASE_HANDOFF_PENDING",
+                    "phase gate is closed, but context handoff still needs attention",
+                    as_json=as_json,
+                    extra={
+                        "localCloseComplete": True,
+                        "retryable": True,
+                        "contextHandoff": handoff,
+                        "platformMonitor": monitor,
+                    },
+                )
+            emit(
+                {
+                    "ok": True,
+                    "code": "PHASE_CLOSE_RESUMED",
+                    "phase": args.phase,
+                    "status": terminal_status,
+                    "changeId": resolved["changeId"],
+                    "localCloseComplete": True,
+                    "contextHandoff": handoff,
+                    "platformMonitor": monitor,
+                },
+                as_json=as_json,
+            )
+            return 0
         return emit_error("LEASE_ABSENT", "no active lease for phase close", as_json=as_json)
     run_id = explicit_run_id or str(current_lease.get("runId") or "")
     if str(current_lease.get("runId")) != run_id or str(current_lease.get("phase")) != args.phase:
@@ -2597,6 +2733,29 @@ def cmd_close(args: argparse.Namespace) -> int:
         capsule["closeStatus"] = close_status
         write_phase_capsule(change_dir, args.phase, run_id, capsule)
 
+    context_handoff = _close_context_handoff(
+        project,
+        str(resolved["changeId"]),
+        args,
+        status=close_status,
+    )
+    platform_monitor = _sync_after_phase_close(project, change_dir)
+    if isinstance(context_handoff, dict) and not context_handoff.get("ok"):
+        return emit_error(
+            "PHASE_HANDOFF_PENDING",
+            "phase gate closed locally, but context handoff failed; retry the same close command",
+            as_json=as_json,
+            extra={
+                "localCloseComplete": True,
+                "retryable": True,
+                "phase": args.phase,
+                "status": close_status,
+                "changeId": resolved["changeId"],
+                "contextHandoff": context_handoff,
+                "platformMonitor": platform_monitor,
+            },
+        )
+
     payload = {
         "ok": True,
         "code": close_code,
@@ -2612,6 +2771,8 @@ def cmd_close(args: argparse.Namespace) -> int:
         "lease": release,
         "gateSeverityMode": severity_mode,
         "gateWarnings": gate_warnings,
+        "contextHandoff": context_handoff,
+        "platformMonitor": platform_monitor,
     }
     emit(payload, as_json=as_json)
     return 0
@@ -2806,6 +2967,9 @@ def build_parser() -> argparse.ArgumentParser:
     p_close.add_argument("--run-id", default=None)
     p_close.add_argument("--task", type=int, default=None)
     p_close.add_argument("--note", default="")
+    p_close.add_argument("--to-phase", default=None)
+    p_close.add_argument("--executor", default=None)
+    p_close.add_argument("--artifact", action="append", default=[])
     p_close.set_defaults(func=cmd_close)
 
     p_classify = sub.add_parser("classify", parents=[shared])

package/harness/bundles/java/codebuddy/scripts/harness_ledger.py

@@ -1160,6 +1160,8 @@ _DYNAMIC_OWN_DIRS = ("events.ndjson", "logs", "evidence", "reports", "runtime",
 
 def _matches_ownership_path(rel: str, declared: Any) -> bool:
     scope = str(declared).replace("\\", "/").strip("/")
+    if scope.endswith("/**"):
+        scope = scope[:-3].rstrip("/")
     if not scope:
         return False
     normalized = rel.replace("\\", "/").strip("/")