@hunter-harness/workflow-harness 0.2.55 → 0.2.56

package/harness/bundles/java/cursor/scripts/harness_ledger.py

@@ -145,7 +145,91 @@ def _hash_text(value: str) -> str:
 
 def command_set_hash(command: str) -> str:
     """Stable identity for the exact command set represented by one target."""
-    return _hash_text(str(command).strip())
+    return _hash_text(canonical_command(command))
+
+
+def canonical_command(command: str) -> str:
+    """Normalize supported launch wrappers without mixing runner notes into identity."""
+    value = re.sub(r"\s+", " ", str(command).strip())
+    value = re.sub(r"\s*\(safe runner\)\s*$", "", value, flags=re.I)
+    value = re.sub(r"^npx(?:\s+--no-install)?\s+", "", value, flags=re.I)
+    return value.strip()
+
+
+def default_environment_hash(project_root: Path | None = None) -> str:
+    payload = {
+        "osName": os.name,
+        "platform": sys.platform,
+        "pythonImplementation": sys.implementation.name,
+        "projectFilesystem": "windows" if os.name == "nt" else "posix",
+    }
+    return _hash_text(json.dumps(payload, sort_keys=True, separators=(",", ":")))
+
+
+def default_toolchain_hash(project_root: Path | None = None) -> str:
+    root = Path(project_root).resolve() if project_root is not None else None
+    manifests: list[dict[str, str]] = []
+    if root is not None:
+        for name in (
+            "package.json", "pyproject.toml", "pom.xml", "build.gradle",
+            "build.gradle.kts", "go.mod", "Cargo.toml",
+        ):
+            path = root / name
+            if path.is_file():
+                manifests.append({
+                    "name": name,
+                    "sha256": hashlib.sha256(path.read_bytes()).hexdigest(),
+                })
+    payload = {
+        "python": sys.version.split()[0],
+        "implementation": sys.implementation.name,
+        "manifests": manifests,
+    }
+    return _hash_text(json.dumps(payload, sort_keys=True, separators=(",", ":")))
+
+
+def frozen_ownership_check(change_dir: Path) -> dict[str, Any]:
+    """Reject evidence writes after a Run capsule's ownership scope changed."""
+    try:
+        state_root = Path(
+            harness_paths.resolve_state_dir_for_contract(change_dir)
+        ).resolve()
+        contract = harness_paths.load_change_contract(change_dir)
+    except (OSError, ValueError, json.JSONDecodeError):
+        return {"ok": True, "code": "OWNERSHIP_FREEZE_NOT_APPLICABLE"}
+    capsule_root = state_root / "runtime" / "phase-context"
+    if not capsule_root.is_dir():
+        return {"ok": True, "code": "OWNERSHIP_FREEZE_NOT_APPLICABLE"}
+    capsules: list[dict[str, Any]] = []
+    for path in capsule_root.glob("run-*.json"):
+        try:
+            item = json.loads(path.read_text(encoding="utf-8-sig"))
+        except (OSError, json.JSONDecodeError):
+            continue
+        if (
+            isinstance(item, dict)
+            and item.get("phase") == "run"
+            and not item.get("closedAt")
+            and _nonempty_str(item.get("ownershipHash"))
+        ):
+            capsules.append(item)
+    if not capsules:
+        return {"ok": True, "code": "OWNERSHIP_FREEZE_NOT_APPLICABLE"}
+    capsule = sorted(capsules, key=lambda item: str(item.get("createdAt") or ""))[-1]
+    current = ownership_hash(contract)
+    if capsule.get("ownershipHash") != current:
+        return {
+            "ok": False,
+            "code": "OWNERSHIP_CHANGED_BEFORE_VERIFICATION",
+            "message": (
+                "产品范围在 Run 启动后发生变化；请先通过受控范围更新重启 Run，"
+                "系统将只失效受影响的验证。"
+            ),
+            "storedOwnershipHash": capsule.get("ownershipHash"),
+            "currentOwnershipHash": current,
+            "runId": capsule.get("runId"),
+        }
+    return {"ok": True, "code": "OWNERSHIP_FROZEN"}
 
 
 def product_tree_hash(project_root: Path | None) -> str | None:
@@ -284,6 +368,10 @@ def parse_files_manifest(raw: str | None) -> list[str]:
     ]
 
 
+class ProjectRootRequiredError(ValueError):
+    """Raised when relative verification inputs have no stable project basis."""
+
+
 def resolve_input_files(
     files: list[str], project_root: Path | None
 ) -> list[str]:
@@ -313,7 +401,15 @@ def input_files_from_args(args: argparse.Namespace) -> tuple[list[str], Path | N
     manifest = parse_files_manifest(getattr(args, "files_from", None))
     if files and manifest:
         raise ValueError("use only one of --files and --files-from")
-    return resolve_input_files(files or manifest, project_root), project_root
+    selected = files or manifest
+    if project_root is None and any(
+        not Path(raw).expanduser().is_absolute() for raw in selected
+    ):
+        raise ProjectRootRequiredError(
+            "relative verification inputs require --project so their identity "
+            "does not depend on the caller's current directory"
+        )
+    return resolve_input_files(selected, project_root), project_root
 
 
 def sha256_file(path: Path) -> str:
@@ -1674,8 +1770,8 @@ def decide_can_reuse(
         )
         and (
             not _nonempty_str(requested_command)
-            or str(candidate.get("command") or "").strip()
-            == str(requested_command).strip()
+            or canonical_command(str(candidate.get("command") or ""))
+            == canonical_command(str(requested_command))
         )
     ]
     entry = (
@@ -1823,7 +1919,7 @@ def decide_can_reuse(
             }
 
     if requested_command is not None and str(requested_command).strip():
-        if str(command).strip() != str(requested_command).strip():
+        if canonical_command(str(command)) != canonical_command(str(requested_command)):
             return {
                 "ok": True,
                 "reuse": False,
@@ -2053,10 +2149,29 @@ def cmd_can_reuse(args: argparse.Namespace) -> int:
     verbose = bool(getattr(args, "verbose", False))
     verification = args.verification
     change_dir = resolve_path(args.change_dir)
+    ownership_check = frozen_ownership_check(change_dir)
+    if not ownership_check.get("ok"):
+        return emit_error(
+            str(ownership_check.get("message")),
+            as_json=as_json,
+            error_code=str(ownership_check.get("code")),
+            extra={
+                key: value
+                for key, value in ownership_check.items()
+                if key not in {"ok", "code", "message"}
+            },
+        )
     try:
         files, project_root = input_files_from_args(args)
+    except ProjectRootRequiredError as exc:
+        return emit_error(
+            str(exc),
+            as_json=as_json,
+            error_code="PROJECT_ROOT_REQUIRED",
+        )
     except (OSError, ValueError) as exc:
         return emit_error(f"can-reuse failed: {exc}", as_json=as_json)
+    explicit_files = list(files)
     target = resolve_verification_target(verification, project_root)
     if target is None:
         return emit_error(
@@ -2085,7 +2200,22 @@ def cmd_can_reuse(args: argparse.Namespace) -> int:
                 compact_fn=_compact_can_reuse_payload,
             )
             return 0
-        files = resolve_input_files(resolved_files, project_root)
+        profile_files = resolve_input_files(resolved_files, project_root)
+        if explicit_files:
+            _explicit_hash, explicit_names = compute_inputs_hash(
+                explicit_files, project_root=project_root
+            )
+            _profile_hash, profile_names = compute_inputs_hash(
+                profile_files, project_root=project_root
+            )
+            if explicit_names != profile_names:
+                return emit_error(
+                    "PROFILE_INPUT_FILES_CONFLICT: --files does not match the "
+                    "declared build-profile input set",
+                    as_json=as_json,
+                    error_code="PROFILE_INPUT_FILES_CONFLICT",
+                )
+        files = profile_files
     if not files:
         return emit_error(
             "can-reuse requires --files or a non-empty --profile-input file set",
@@ -2097,10 +2227,20 @@ def cmd_can_reuse(args: argparse.Namespace) -> int:
             verification=verification,
             files=files,
             requested_scope=getattr(args, "scope", None),
-            requested_command=getattr(args, "command", None),
-            requested_toolchain_hash=getattr(args, "toolchain_hash", None),
+            requested_command=(
+                canonical_command(str(getattr(args, "command", "")))
+                if _nonempty_str(getattr(args, "command", None))
+                else None
+            ),
+            requested_toolchain_hash=(
+                getattr(args, "toolchain_hash", None)
+                or default_toolchain_hash(project_root)
+            ),
             requested_profile_hash=getattr(args, "profile_hash", None),
-            requested_environment_hash=getattr(args, "environment_hash", None),
+            requested_environment_hash=(
+                getattr(args, "environment_hash", None)
+                or default_environment_hash(project_root)
+            ),
             requested_db_schema_hash=getattr(args, "db_schema_hash", None),
             requested_product_tree_hash=(
                 getattr(args, "product_tree_hash", None) or product_tree_hash(project_root)
@@ -2137,6 +2277,18 @@ def cmd_record(args: argparse.Namespace) -> int:
     as_json = bool(args.json)
     verbose = bool(getattr(args, "verbose", False))
     change_dir = resolve_path(args.change_dir)
+    ownership_check = frozen_ownership_check(change_dir)
+    if not ownership_check.get("ok"):
+        return emit_error(
+            str(ownership_check.get("message")),
+            as_json=as_json,
+            error_code=str(ownership_check.get("code")),
+            extra={
+                key: value
+                for key, value in ownership_check.items()
+                if key not in {"ok", "code", "message"}
+            },
+        )
     verification = args.verification
     contract_v2 = _contract_is_v2(change_dir)
     migration_receipt: dict[str, Any] | None = None
@@ -2144,6 +2296,7 @@ def cmd_record(args: argparse.Namespace) -> int:
         files, project_root = input_files_from_args(args)
     except (OSError, ValueError) as exc:
         return emit_error(f"record failed: {exc}", as_json=as_json)
+    explicit_files = list(files)
     target = resolve_verification_target(verification, project_root)
     if target is None:
         return emit_error(
@@ -2160,7 +2313,22 @@ def cmd_record(args: argparse.Namespace) -> int:
         resolved_files, err = expand_profile_input_files(project_root, profile_input)
         if err:
             return emit_error(f"record failed: {err}", as_json=as_json)
-        files = resolve_input_files(resolved_files, project_root)
+        profile_files = resolve_input_files(resolved_files, project_root)
+        if explicit_files:
+            _explicit_hash, explicit_names = compute_inputs_hash(
+                explicit_files, project_root=project_root
+            )
+            _profile_hash, profile_names = compute_inputs_hash(
+                profile_files, project_root=project_root
+            )
+            if explicit_names != profile_names:
+                return emit_error(
+                    "PROFILE_INPUT_FILES_CONFLICT: --files does not match the "
+                    "declared build-profile input set",
+                    as_json=as_json,
+                    error_code="PROFILE_INPUT_FILES_CONFLICT",
+                )
+        files = profile_files
     if not files:
         return emit_error(
             "record requires --files or a non-empty --profile-input file set",
@@ -2226,7 +2394,12 @@ def cmd_record(args: argparse.Namespace) -> int:
         entry.update(
             {
                 "status": status,
-                "command": args.command,
+                "command": canonical_command(args.command),
+                "runnerCommand": (
+                    str(getattr(args, "runner_command", None)).strip()
+                    if _nonempty_str(getattr(args, "runner_command", None))
+                    else str(args.command).strip()
+                ),
                 "evidence": args.evidence,
                 "exitCode": args.exit_code,
                 "durationMs": args.duration_ms,
@@ -2306,6 +2479,10 @@ def cmd_record(args: argparse.Namespace) -> int:
             ("dbSchemaHash", "db_schema_hash"),
         ):
             val = getattr(args, attr, None)
+            if field == "toolchainHash" and not _nonempty_str(val):
+                val = default_toolchain_hash(project_root)
+            elif field == "environmentHash" and not _nonempty_str(val):
+                val = default_environment_hash(project_root)
             if _nonempty_str(val):
                 entry[field] = str(val).strip()
         entry["commandSetHash"] = command_set_hash(args.command)
@@ -2658,6 +2835,11 @@ def build_parser() -> argparse.ArgumentParser:
     p_record.add_argument("--verification", required=True)
     p_record.add_argument("--status", required=True)
     p_record.add_argument("--command", required=True)
+    p_record.add_argument(
+        "--runner-command",
+        default=None,
+        help="actual launcher command; stored as execution metadata, not target identity",
+    )
     p_record.add_argument("--exit-code", type=int, required=True)
     p_record.add_argument("--duration-ms", type=int, required=True)
     p_record_files = p_record.add_mutually_exclusive_group()

package/harness/bundles/java/cursor/scripts/harness_plan_finalize.py

@@ -30,6 +30,18 @@ if hasattr(sys.stderr, "reconfigure"):
 
 SCHEMA_VERSION = 1
 _LINK = re.compile(r"\[[^\]]+\]\(([^)]+)\)")
+_BACKTICK = re.compile(r"`([^`\r\n]+)`")
+_CODE_PATH_SUFFIXES = {
+    ".c", ".cc", ".cpp", ".cs", ".css", ".go", ".h", ".hpp", ".html",
+    ".java", ".js", ".jsx", ".kt", ".kts", ".mjs", ".php", ".py", ".rb",
+    ".rs", ".scss", ".sh", ".svelte", ".swift", ".ts", ".tsx", ".vue",
+}
+_BUILD_FILE_NAMES = {
+    "build.gradle", "build.gradle.kts", "cargo.toml", "composer.json", "go.mod",
+    "gradle.properties", "package-lock.json", "package.json", "pnpm-lock.yaml",
+    "pom.xml", "pyproject.toml", "requirements.txt", "settings.gradle",
+    "settings.gradle.kts", "tsconfig.json", "yarn.lock",
+}
 
 # C8: valid ownerPhase values (lifecycle phases that can own tasks).
 VALID_OWNER_PHASES = {"plan", "run", "test", "review", "submit"}
@@ -615,6 +627,71 @@ def validate_staging(staging: Path, change_name: str) -> dict[str, Any]:
     }
 
 
+def validate_product_ownership(change_dir: Path, staging: Path) -> dict[str, Any]:
+    """Ensure Plan declares stable prefix ownership for explicit code/test/build paths."""
+    context_path = change_dir / "meta" / "change-context.json"
+    if not context_path.is_file():
+        return {"ok": True, "code": "PLAN_PRODUCT_PATHS_LEGACY_UNDECLARED"}
+    try:
+        context = json.loads(context_path.read_text(encoding="utf-8-sig"))
+    except (OSError, json.JSONDecodeError) as exc:
+        return _result_error("PLAN_CHANGE_CONTEXT_INVALID", str(exc))
+    ownership = context.get("ownership") if isinstance(context, dict) else None
+    raw_paths = ownership.get("productPaths") if isinstance(ownership, dict) else None
+    product_paths = [
+        str(item).strip().replace("\\", "/").removeprefix("./")
+        for item in raw_paths or []
+        if isinstance(item, str) and item.strip()
+    ]
+    unsupported = sorted(path for path in product_paths if any(char in path for char in "*?[]"))
+    if unsupported:
+        result = _result_error(
+            "PLAN_PRODUCT_PATHS_GLOB_UNSUPPORTED",
+            "productPaths 只接受精确文件或目录前缀，不支持通配：" + ", ".join(unsupported),
+        )
+        result["unsupportedPaths"] = unsupported
+        return result
+
+    planned_paths: set[str] = set()
+    for document in sorted(staging.rglob("*.md")):
+        text = document.read_text(encoding="utf-8-sig")
+        for raw in _BACKTICK.findall(text):
+            candidate = raw.strip().strip("'\"").replace("\\", "/")
+            if not candidate or " " in candidate or "://" in candidate or "<" in candidate:
+                continue
+            candidate = re.sub(r":\d+(?::\d+)?$", "", candidate)
+            candidate = candidate.removeprefix("./").strip("/.,;，；")
+            if not candidate or candidate.startswith("../") or candidate.startswith(".harness/"):
+                continue
+            pure = PurePosixPath(candidate)
+            if pure.name.lower() in _BUILD_FILE_NAMES or pure.suffix.lower() in _CODE_PATH_SUFFIXES:
+                planned_paths.add(candidate)
+
+    def covered(path: str) -> bool:
+        return any(
+            path == owned.rstrip("/")
+            or path.startswith(owned.rstrip("/") + "/")
+            for owned in product_paths
+            if owned.rstrip("/")
+        )
+
+    missing = sorted(path for path in planned_paths if not covered(path))
+    if missing:
+        result = _result_error(
+            "PLAN_PRODUCT_PATHS_INCOMPLETE",
+            "productPaths 未覆盖计划明确引用的产品文件：" + ", ".join(missing),
+        )
+        result["missingPaths"] = missing
+        result["recoveryAction"] = "在 Plan 阶段补充精确文件或目录前缀后重新 finalize。"
+        return result
+    return {
+        "ok": True,
+        "code": "PLAN_PRODUCT_PATHS_COMPLETE",
+        "plannedPaths": sorted(planned_paths),
+        "productPaths": product_paths,
+    }
+
+
 def _terminal_exists(change_dir: Path, run_id: str, attempt: int) -> bool:
     try:
         events = harness_events.load_events(harness_events.events_path(change_dir))
@@ -1125,6 +1202,9 @@ def finalize_plan(
     validation = validate_staging(staging, change_name)
     if not validation["ok"]:
         return validation
+    ownership_validation = validate_product_ownership(change_dir, staging)
+    if not ownership_validation["ok"]:
+        return ownership_validation
     start_validation = _validate_plan_start(change_dir, run_id, attempt)
     if not start_validation["ok"]:
         return start_validation

package/harness/manifests/general/claude-code.json

@@ -2,9 +2,9 @@
   "schema_version": 2,
   "profile": "general",
   "adapter": "claude-code",
-  "bundle_version": "0.2.44",
+  "bundle_version": "0.2.45",
   "requires": {
-    "minimumCliVersion": "0.2.60",
+    "minimumCliVersion": "0.2.62",
     "capabilities": [
       "sync@2",
       "rules-sync@1",
@@ -23,7 +23,7 @@
   "files": [
     {
       "path": ".harness-build.json",
-      "sha256": "489494066d32ece3ef71e7753f8d006a54463751d95b26903613076185420e12"
+      "sha256": "d4202746c08d340f62a509ec914a772dc81a6c0e37a256270faeada9b9e30cfd"
     },
     {
       "path": "agents/harness-evaluator.md",
@@ -79,11 +79,11 @@
     },
     {
       "path": "contracts/workflow-policy.json",
-      "sha256": "c979394cdecc6a1a8cfec4d319c8539c90d93e17eac6c66c388efdeec28446a5"
+      "sha256": "3da83c2d769d536cb8bf356f1a03f0ad08eb19ff385ac36960bf53b5083b4f32"
     },
     {
       "path": "harness-archive/checklist.md",
-      "sha256": "5087988f03878439519da40b0a9bc630fec87c1b42b7749a4f0e43baf7c5fd5d"
+      "sha256": "05d320f6558fd1cd75f75ffc05574c20c2d5737393068cab76185860c9056b9e"
     },
     {
       "path": "harness-archive/reference.md",
@@ -95,7 +95,7 @@
     },
     {
       "path": "harness-archive/SKILL.md",
-      "sha256": "8bdecd1b5470e10c0e907caf036bf39efb04cfd1d8792765bab5931292003dc9"
+      "sha256": "3f9ba00fcd9a1b0466fe16d8e15930b0ab31003a88a02054f13461d06ee9f54f"
     },
     {
       "path": "harness-archive/templates/render-summary.mjs",
@@ -115,7 +115,7 @@
     },
     {
       "path": "harness-codebase-map/SKILL.md",
-      "sha256": "16009fa030c6e719a23a5f7e1b3fa990683ac5981d61536e6e0cb8600f6af127"
+      "sha256": "add80cabe2627c1afff9b75d21a407c11700b601b11009050d7ef2666d4cbdd7"
     },
     {
       "path": "harness-codebase-map/templates/ARCHITECTURE.md",
@@ -155,11 +155,11 @@
     },
     {
       "path": "harness-knowledge-ingest/SKILL.md",
-      "sha256": "74685dc48ba432cf51ba522dda7b588915e58406b1e4796a15d911b7855e6294"
+      "sha256": "3bd26e5b434b53d0d4737d5bc4bcb8d5a0aa8338b32149596adf50e795224941"
     },
     {
       "path": "harness-knowledge-query/SKILL.md",
-      "sha256": "69d6700228d3ddbe1f3906dd55d37619471b5e3bf4b7b05b8f9982afc2a55d8c"
+      "sha256": "01ca1cc97d22664785a7dacd4da5fc70063ecef3deffa59029b254ed304c8e5c"
     },
     {
       "path": "harness-plan/checklist.md",
@@ -175,7 +175,7 @@
     },
     {
       "path": "harness-plan/SKILL.md",
-      "sha256": "f4b5a1d0fe472fd5b957a3a99af2299fa18f3e8c08c64088980804a781dea3c0"
+      "sha256": "f9bd2015eebdf9d8c997687bfa9c445e24eedd7f6a1edffdd643e77550491e4a"
     },
     {
       "path": "harness-review/checklist.md",
@@ -191,11 +191,11 @@
     },
     {
       "path": "harness-review/SKILL.md",
-      "sha256": "e66dbec214193999d4697461d241de8629f597ad7916101e8ad986485326fe1c"
+      "sha256": "507f3ab550f39243c6eb62d9efdfe9202a67bc3c6108081b70093d10b6f96cae"
     },
     {
       "path": "harness-run/checklist.md",
-      "sha256": "ec88566dab4ec2805a9e05e01c0aea1d3aeb8b487ee24538910d738983cf21d2"
+      "sha256": "ccbad9ef784da2fbe4c1f1483ab1b02dc995eed6aa1d1750cc0df012b8235bbe"
     },
     {
       "path": "harness-run/protocols.md",
@@ -203,15 +203,15 @@
     },
     {
       "path": "harness-run/reference.md",
-      "sha256": "b034bab5f5f8b9a39cebc705bd8e0d3f5d7065dc0a0070f64499dc81f9d7fd67"
+      "sha256": "db97a547190bc364f20fff5ff363b78f5cc9732bc93d57900b163c2cf8a73655"
     },
     {
       "path": "harness-run/SKILL.md",
-      "sha256": "8374c2f0d3b298fac04b6d85858b93d385db6de693efd0453d5f8afff87fa139"
+      "sha256": "977e35bb9604aea9072b5ca865c155e323df276a5dc3b1b22667e6aa854d814d"
     },
     {
       "path": "harness-submit/checklist.md",
-      "sha256": "51952901c222d79212e11d4c0e2ede9a072ed8fc6e5a2a1edd82e4d3167bd6c3"
+      "sha256": "63aded0d06b986c28a54783ec5b5dca55a8b20d7966029a517bc35c5b3cf11a3"
     },
     {
       "path": "harness-submit/reference.md",
@@ -219,7 +219,7 @@
     },
     {
       "path": "harness-submit/SKILL.md",
-      "sha256": "2630ee53df84f00ac5e6d3871a180affb8c7c976d1185cef9e0f53be74ba0ad7"
+      "sha256": "d74e4f8278865d35f64d58677f79c7586fee2ba403f6883b88ea9f0e946e21b1"
     },
     {
       "path": "harness-sync/reference.md",
@@ -227,11 +227,11 @@
     },
     {
       "path": "harness-sync/SKILL.md",
-      "sha256": "2e38716d9225c19d15245f4bcfb65947da6bbbe254642306f1645e5d37bcf298"
+      "sha256": "ccb87a94cb82ed6e40518c982cb270e8d37bf43a0e3a33df970fb262d20992d6"
     },
     {
       "path": "harness-test/checklist.md",
-      "sha256": "bbe77038ac6fcd0b28e60e148691d1fde8b4338f6be6256d0b3e40331dfbc27e"
+      "sha256": "c68bb5e198522f27ac3c6ac53953d428e340898737b5c135de718a178e511e31"
     },
     {
       "path": "harness-test/pitfalls-java.md",
@@ -243,7 +243,7 @@
     },
     {
       "path": "harness-test/reference.md",
-      "sha256": "72ca942018df10857c03f0ee23df45633a8aa4f3f2e635a44e731219a9985c2f"
+      "sha256": "1bddf90be29efc1640a8d14801f7a5e1ef24ebb8f0bd2b33a76e6c42ddeb5483"
     },
     {
       "path": "harness-test/scripts/runtime-helpers.mjs",
@@ -251,7 +251,7 @@
     },
     {
       "path": "harness-test/SKILL.md",
-      "sha256": "f278d08e7729097190071ff25563a6c30dbcdc15dbd1a2cf75a9ac6c377cf68f"
+      "sha256": "4d9c77840bdf2b805c1c8786a25d5e0c5dbc3006f32edc46a0f21be0c5c22fd9"
     },
     {
       "path": "protocols/archive-report-protocol.md",
@@ -275,7 +275,7 @@
     },
     {
       "path": "protocols/ledger-protocol.md",
-      "sha256": "279e37a76ccd59cf6d89891418677a527a2be6061325c8cd9c7039dd84956d97"
+      "sha256": "bae14e9cb7422bf9e29551929af258948653ddc44624cc28efadefc5d189d358"
     },
     {
       "path": "protocols/memory-closeout-protocol.md",
@@ -315,7 +315,7 @@
     },
     {
       "path": "README.md",
-      "sha256": "9b97846381d413dc7d50f5d7841f4cabf6ea3e2c4b0163c43586317b481cec4c"
+      "sha256": "fe2b4a245c7820f3f21886580c17455a95d8411844fcc4e3932d7de0ad491b10"
     },
     {
       "path": "scripts/harness_apidoc.py",
@@ -323,7 +323,7 @@
     },
     {
       "path": "scripts/harness_archive.py",
-      "sha256": "97a4207a24177761af57e308c7b684c0664f866e8b0d618800916d97c580f8e5"
+      "sha256": "6ca1f096e69a61b356368c9c8e56859564087ac25b5fedc2edf71c289386d35c"
     },
     {
       "path": "scripts/harness_change.py",
@@ -335,7 +335,7 @@
     },
     {
       "path": "scripts/harness_context.py",
-      "sha256": "fa9557ffffba3866582054305aa74894dd3516eab9c6d088b705146b8e7e8729"
+      "sha256": "da936a9a2c033b2b84adea124a3990e382cfd24ccc1036b87a5dc48b0c7de82a"
     },
     {
       "path": "scripts/harness_deploy.py",
@@ -351,11 +351,11 @@
     },
     {
       "path": "scripts/harness_events_sync.py",
-      "sha256": "b5b6438cec03524b2837319d5889ffe5e94de88c98f52baa83fefebbd170e88b"
+      "sha256": "4f3883f72c656e634b9999ec62272406263474ad3915caf66779d4dbba369f13"
     },
     {
       "path": "scripts/harness_events.py",
-      "sha256": "59cccc6ddc24597c15f0542894b2d3a860ba581a5e6ecf277083bac2de94d589"
+      "sha256": "e7cbbe346ea9b208d4228219d78857840f862f829e5173ba17f61fb50b3c4794"
     },
     {
       "path": "scripts/harness_execution_contracts.py",
@@ -363,11 +363,11 @@
     },
     {
       "path": "scripts/harness_fixback.py",
-      "sha256": "723c48a0034648f8a96967749baacbfdde59774cec2a66b1b26a34ea5f7f2b0f"
+      "sha256": "68928ccb60b9a3bea112bf277303a90303ea80f024c569a5444eeebe2064aad2"
     },
     {
       "path": "scripts/harness_gate.py",
-      "sha256": "e6bbb9d177e8261d8c77ef55fdf87e9daf164ae9361ce09bb4e294c1c7f091ac"
+      "sha256": "aaf672fd00aa7bdb85454762cfa9e5297a0c19ae16bf90beea1fcb80a5f842a1"
     },
     {
       "path": "scripts/harness_headless.py",
@@ -379,7 +379,7 @@
     },
     {
       "path": "scripts/harness_ledger.py",
-      "sha256": "eea0c064f1430e1c98df1401eec5c11f12ac3e2be9476fe94b78b84d85d17fac"
+      "sha256": "a51f072959e383b18319fd879f55a8a20d6e44495002da4a3a735b4d66e72f27"
     },
     {
       "path": "scripts/harness_migration_head.py",
@@ -403,7 +403,7 @@
     },
     {
       "path": "scripts/harness_plan_finalize.py",
-      "sha256": "d415186905d314e9d768b9527b5564063060e524b359ffa5ba459ff1ad2b8fa1"
+      "sha256": "a71a1c7779946e51907bff724c4f6adf37d7be64bcf2a2a0039f0db9b771a09f"
     },
     {
       "path": "scripts/harness_preflight.py",