@hunter-harness/workflow-harness 0.2.63 → 0.2.65

package/harness/bundles/general/codebuddy/scripts/harness_gate.py

@@ -981,28 +981,24 @@ def read_identity(skills_root: Path) -> dict[str, Any]:
     return identity
 
 
+def resolve_skills_root(raw: str | None) -> Path | None:
+    """Resolve an explicit root or the installed bundle beside this script."""
+    if isinstance(raw, str) and raw.strip():
+        return Path(raw).expanduser().resolve()
+    adjacent = SCRIPTS_DIR.parent.resolve()
+    return adjacent if (adjacent / ".harness-build.json").is_file() else None
+
+
 def change_code_root(change_dir: Path) -> Path:
     project = change_dir.parents[2]
-    metadata = (
-        (change_dir / "meta" / "change-context.json", ("worktreeRoot",)),
-        (change_dir / "meta" / "worktree.json", ("worktreePath", "path")),
-    )
-    for context_path, fields in metadata:
-        if not context_path.is_file():
-            continue
-        try:
-            context = json.loads(context_path.read_text(encoding="utf-8"))
-            raw_root = next(
-                (str(context.get(field) or "").strip() for field in fields if context.get(field)),
-                "",
-            )
-            if raw_root:
-                raw_path = Path(raw_root).expanduser()
-                candidate = (raw_path if raw_path.is_absolute() else project / raw_path).resolve()
-                if candidate.is_dir():
-                    return candidate
-        except (OSError, ValueError, json.JSONDecodeError):
-            pass
+    inferred = hl.infer_execution_project_root(change_dir)
+    if inferred is not None:
+        return inferred
+    if hl.declares_execution_worktree(change_dir):
+        raise ValueError(
+            "EXECUTION_WORKTREE_INVALID: declared worktree is missing, not a Git root, "
+            "or belongs to another repository"
+        )
     return project
 
 
@@ -2388,16 +2384,15 @@ def cmd_begin(args: argparse.Namespace) -> int:
         return emit_error("POLICY_LOAD_FAILED", str(exc), as_json=as_json)
 
     executor_tool = args.executor_tool or os.environ.get("HUNTER_HARNESS_TOOL")
-    if not args.skills_root:
+    skills_root = resolve_skills_root(args.skills_root)
+    if skills_root is None:
         return emit_error(
             "BUNDLE_IDENTITY_REQUIRED",
             "--skills-root is required; refresh the selected Harness adapter if identity is missing",
             as_json=as_json,
         )
     try:
-        identity = validate_identity(
-            project, Path(args.skills_root).expanduser().resolve(), executor_tool
-        )
+        identity = validate_identity(project, skills_root, executor_tool)
     except (OSError, json.JSONDecodeError, ValueError) as exc:
         return emit_error("BUNDLE_IDENTITY_INVALID", str(exc), as_json=as_json)
     executor_tool = executor_tool or str(identity.get("adapter") or "") or None
@@ -2446,7 +2441,7 @@ def cmd_begin(args: argparse.Namespace) -> int:
                 run_id=run_id,
                 project=project,
                 execution_root=execution_root,
-                skills_root=Path(args.skills_root).expanduser(),
+                skills_root=skills_root,
             )
         except ValueError as exc:
             if gate_soft_allowed(severity_mode, args.phase, "capsule"):
@@ -2532,7 +2527,7 @@ def cmd_begin(args: argparse.Namespace) -> int:
                 "projectRoot": str(project.resolve()),
                 "stateRoot": str(state_root),
                 "executionRoot": str(execution_root),
-                "skillsRoot": str(Path(args.skills_root).expanduser().resolve()),
+                "skillsRoot": str(skills_root.resolve()),
                 "repositoryId": hp.repository_identity(execution_root),
                 "baseCommit": base_commit or current_head,
                 "currentHead": current_head,
@@ -2574,7 +2569,7 @@ def cmd_begin(args: argparse.Namespace) -> int:
         "projectRoot": str(project),
         "stateRoot": capsule.get("stateRoot") if capsule else None,
         "executionRoot": capsule.get("executionRoot") if capsule else str(execution_root),
-        "skillsRoot": capsule.get("skillsRoot") if capsule else str(Path(args.skills_root).resolve()),
+        "skillsRoot": capsule.get("skillsRoot") if capsule else str(skills_root.resolve()),
         "lease": claim.get("lease"),
         "identity": identity,
         "event": event_result,

package/harness/bundles/general/codebuddy/scripts/harness_ledger.py

@@ -412,6 +412,131 @@ def input_files_from_args(args: argparse.Namespace) -> tuple[list[str], Path | N
     return resolve_input_files(selected, project_root), project_root
 
 
+def infer_execution_project_root(change_dir: Path) -> Path | None:
+    """Resolve the tree under test from trusted change metadata.
+
+    Worktree changes keep their durable contract under the main checkout while
+    product files live in the execution worktree.  Requiring every caller to
+    reconstruct that split caused ledger commands to hash the main checkout or
+    fail repeatedly.  Prefer the persisted execution root and otherwise leave
+    legacy callers unchanged.
+    """
+    change_dir = change_dir.expanduser().resolve()
+    project_root = next(
+        (ancestor.parent for ancestor in change_dir.parents if ancestor.name == ".harness"),
+        None,
+    )
+    if project_root is None:
+        return None
+
+    def git_common_dir(root: Path) -> Path | None:
+        process = subprocess.run(
+            ["git", "-C", str(root), "rev-parse", "--path-format=absolute", "--git-common-dir"],
+            text=True,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            check=False,
+        )
+        if process.returncode != 0 or not process.stdout.strip():
+            return None
+        raw = Path(process.stdout.strip()).expanduser()
+        return raw.resolve() if raw.is_absolute() else (root / raw).resolve()
+
+    project_common_dir = git_common_dir(project_root)
+
+    def trusted_worktree(candidate: Path) -> Path | None:
+        if not candidate.is_dir():
+            return None
+        process = subprocess.run(
+            ["git", "-C", str(candidate), "rev-parse", "--show-toplevel"],
+            text=True,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            check=False,
+        )
+        if process.returncode != 0 or not process.stdout.strip():
+            return None
+        top_level = Path(process.stdout.strip()).expanduser().resolve()
+        if top_level != candidate:
+            return None
+        # Origin URL + root commit identifies a repository lineage, not a
+        # linked checkout. Independent clones can share both. A real linked
+        # worktree must share the exact Git common directory with the main tree.
+        if project_common_dir is None or git_common_dir(top_level) != project_common_dir:
+            return None
+        return top_level
+
+    candidates = (
+        (
+            change_dir / "meta" / "change-context.json",
+            ("worktreePath", "path", "worktreeRoot"),
+        ),
+        (
+            change_dir / "meta" / "worktree.json",
+            ("worktreePath", "path", "worktreeRoot"),
+        ),
+    )
+    for metadata_path, keys in candidates:
+        if not metadata_path.is_file():
+            continue
+        try:
+            payload = json.loads(metadata_path.read_text(encoding="utf-8-sig"))
+        except (OSError, json.JSONDecodeError):
+            continue
+        if not isinstance(payload, dict):
+            continue
+        for key in keys:
+            raw = payload.get(key)
+            if not isinstance(raw, str) or not raw.strip():
+                continue
+            raw_path = Path(raw).expanduser()
+            candidate = (
+                raw_path.resolve()
+                if raw_path.is_absolute()
+                else (project_root / raw_path).resolve()
+            )
+            if key == "worktreeRoot" and candidate.name != change_dir.name:
+                nested = (candidate / change_dir.name).resolve()
+                trusted_nested = trusted_worktree(nested)
+                if trusted_nested is not None:
+                    return trusted_nested
+                if trusted_worktree(candidate) is None:
+                    continue
+            trusted_candidate = trusted_worktree(candidate)
+            if trusted_candidate is not None:
+                return trusted_candidate
+    return None
+
+
+def declares_execution_worktree(change_dir: Path) -> bool:
+    """Return whether persisted metadata explicitly selects another checkout."""
+    for metadata_path in (
+        change_dir / "meta" / "change-context.json",
+        change_dir / "meta" / "worktree.json",
+    ):
+        if not metadata_path.is_file():
+            continue
+        try:
+            payload = json.loads(metadata_path.read_text(encoding="utf-8-sig"))
+        except (OSError, json.JSONDecodeError):
+            continue
+        if isinstance(payload, dict) and any(
+            isinstance(payload.get(key), str) and str(payload[key]).strip()
+            for key in ("worktreePath", "path", "worktreeRoot")
+        ):
+            return True
+    return False
+
+
+def apply_inferred_project_root(args: argparse.Namespace, change_dir: Path) -> None:
+    """Fill an omitted --project without overriding an explicit caller choice."""
+    if getattr(args, "project", None):
+        return
+    inferred = infer_execution_project_root(change_dir)
+    if inferred is not None:
+        args.project = str(inferred)
+
+
 def sha256_file(path: Path) -> str:
     digest = hashlib.sha256()
     with path.open("rb") as handle:
@@ -1774,20 +1899,10 @@ def worktree_ready(ledger: dict[str, Any], change_dir: Path) -> bool:
     root = ledger.get("worktreeRoot")
     if root is not None and _nonempty_str(root):
         return True
-    meta = change_dir / "meta" / "worktree.json"
-    if not meta.is_file():
-        return False
-    try:
-        data = json.loads(meta.read_text(encoding="utf-8-sig"))
-    except (OSError, json.JSONDecodeError):
-        return False
-    if not isinstance(data, dict):
-        return False
-    if data.get("requested") is True and data.get("created") is True:
-        return True
-    if _nonempty_str(data.get("path")) or _nonempty_str(data.get("worktreeRoot")):
-        return True
-    return False
+    # Metadata aliases are accepted only when they resolve to a real linked
+    # worktree of this repository. This keeps install reuse aligned with the
+    # execution root used by context and gate, including `worktreePath`.
+    return infer_execution_project_root(change_dir) is not None
 
 
 def decide_can_reuse(
@@ -2242,6 +2357,7 @@ def cmd_can_reuse(args: argparse.Namespace) -> int:
     verbose = bool(getattr(args, "verbose", False))
     verification = args.verification
     change_dir = resolve_path(args.change_dir)
+    apply_inferred_project_root(args, change_dir)
     ownership_check = frozen_ownership_check(change_dir)
     if not ownership_check.get("ok"):
         return emit_error(
@@ -2359,6 +2475,9 @@ def cmd_can_reuse(args: argparse.Namespace) -> int:
         return emit_error(f"can-reuse failed: {exc}", as_json=as_json)
 
     payload = _attach_invalidation_code(payload)
+    payload["resolvedProjectRoot"] = (
+        str(project_root) if project_root is not None else None
+    )
     emit_compact_or_verbose(
         payload, as_json=as_json, verbose=verbose,
         compact_fn=_compact_can_reuse_payload,
@@ -2370,6 +2489,7 @@ def cmd_record(args: argparse.Namespace) -> int:
     as_json = bool(args.json)
     verbose = bool(getattr(args, "verbose", False))
     change_dir = resolve_path(args.change_dir)
+    apply_inferred_project_root(args, change_dir)
     ownership_check = frozen_ownership_check(change_dir)
     if not ownership_check.get("ok"):
         return emit_error(
@@ -2836,11 +2956,26 @@ def cmd_record(args: argparse.Namespace) -> int:
 def cmd_diff_hash(args: argparse.Namespace) -> int:
     as_json = bool(args.json)
     repo_raw = getattr(args, "repo", None)
-    repo = Path(repo_raw).expanduser().resolve() if repo_raw else Path.cwd().resolve()
     base = getattr(args, "base", None)
     change_dir_raw = getattr(args, "change_dir", None)
     try:
         change_dir = resolve_path(change_dir_raw) if change_dir_raw else None
+        repo = Path(repo_raw).expanduser().resolve() if repo_raw else Path.cwd().resolve()
+        # Historical skill text passed ``--repo .`` even when the active change
+        # ran in a linked worktree.  Treat that shorthand like the default and
+        # recover the authoritative execution root captured during Plan.
+        repo_hint = str(repo_raw or "").strip().replace("\\", "/")
+        if change_dir is not None and repo_hint in {"", ".", "./"}:
+            inferred_repo = infer_execution_project_root(change_dir)
+            if inferred_repo is not None:
+                repo = inferred_repo
+            elif declares_execution_worktree(change_dir):
+                return emit_error(
+                    "change metadata declares an execution worktree that is missing or belongs "
+                    "to another repository",
+                    as_json=as_json,
+                    error_code="EXECUTION_WORKTREE_INVALID",
+                )
         if change_dir is not None and _contract_is_v2(change_dir):
             resolved_base = str(base or "").strip()
             if not resolved_base:
@@ -3086,7 +3221,11 @@ def build_parser() -> argparse.ArgumentParser:
         parents=[shared_json],
         help="compute commit-invariant byte-level diff hash for a repo",
     )
-    p_diff.add_argument("--repo", default=None, help="repo root (default: cwd)")
+    p_diff.add_argument(
+        "--repo",
+        default=None,
+        help="repo root (default: change worktree when recorded, otherwise cwd)",
+    )
     p_diff.add_argument("--base", default=None, help="base commit (default: root commit)")
     p_diff.add_argument(
         "--change-dir",

package/harness/bundles/general/codebuddy/scripts/harness_runtime.py

@@ -33,11 +33,15 @@ SCHEMA_VERSION = 1
 RUN_SESSION_SCHEMA_VERSION = 1
 RUN_TERMINAL_STATUSES = {"OK", "FAIL", "INCOMPLETE", "CANCELLED"}
 _CHANGE_ID = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$")
-SECRET_SCAN_RULES_VERSION = "secret-scan-v1"
+SECRET_SCAN_RULES_VERSION = "secret-scan-v2"
 SECRET_SCAN_RECEIPT_REL = Path("meta") / "secret-scan-receipt.json"
 _SENSITIVE_ASSIGNMENT = re.compile(
-    rb"(?i)[\"']?(?:password|passwd|token|secret|cookie|authorization|database[_-]?url)"
-    rb"[\"']?\s*[:=]\s*[\"']?[^\s\"']{4,}"
+    rb"(?i)[\"']?(?:password|passwd|token|secret|cookie|database[_-]?url)"
+    rb"[\"']?\s*[:=]\s*[\"']?(?P<value>[^\s\"']{4,})"
+)
+_AUTHORIZATION_ASSIGNMENT = re.compile(
+    rb"(?i)[\"']?authorization[\"']?\s*[:=]\s*[\"']?"
+    rb"(?:(?:bearer|basic)\s+)?(?P<value>[^\s\"']{4,})"
 )
 _ADAPTERS = {
     "claude-code": (".worktrees", "harness/"),
@@ -193,8 +197,16 @@ def _sensitive_candidates(root: Path) -> list[dict[str, Any]]:
             raw = path.read_bytes()
         except OSError:
             continue
-        match = _SENSITIVE_ASSIGNMENT.search(raw)
-        if match is None:
+        finding = next(
+            (
+                match
+                for pattern in (_SENSITIVE_ASSIGNMENT, _AUTHORIZATION_ASSIGNMENT)
+                for match in pattern.finditer(raw)
+                if not _is_sensitive_placeholder(match.group("value"))
+            ),
+            None,
+        )
+        if finding is None:
             continue
         candidates.append({
             "path": path.relative_to(root).as_posix(),
@@ -204,6 +216,20 @@ def _sensitive_candidates(root: Path) -> list[dict[str, Any]]:
     return candidates
 
 
+def _is_sensitive_placeholder(value: bytes) -> bool:
+    text = value.decode("utf-8", errors="ignore").strip().strip("`'").strip()
+    return bool(
+        re.fullmatch(r"<[^<>]+>", text)
+        or re.fullmatch(r"\$\{[A-Za-z_][A-Za-z0-9_]*\}", text)
+        or re.fullmatch(r"\{\{[^{}]+\}\}", text)
+        or re.fullmatch(
+            r"(?i)(?:example|placeholder|redacted|masked|bearer|basic|"
+            r"your[-_][A-Za-z0-9_-]+|x{4,})",
+            text,
+        )
+    )
+
+
 def publishable_tree_digest(root: Path) -> str:
     """Public digest helper shared by the archive publication gate."""
     return _publishable_tree_digest(root)

package/harness/bundles/general/codex/.harness-build.json

@@ -2,5 +2,5 @@
   "schemaVersion": 1,
   "overlay": "none",
   "agent": "codex",
-  "coreHash": "b737565b4074dee2"
+  "coreHash": "81932532e802506f"
 }

package/harness/bundles/general/codex/contracts/workflow-policy.json

@@ -110,7 +110,7 @@
       "artifacts": ["summary-data", "archive-manifest"],
       "events": ["phase.start", "phase.end", "artifact"],
       "allowedInteractions": [],
-      "capabilities": ["gate-begin", "gate-close"]
+      "capabilities": []
     },
     "harness-sync": {
       "phase": "sync",

package/harness/bundles/general/codex/harness-archive/SKILL.md

@@ -3,7 +3,7 @@ name: harness-archive
 description: 归档所有变更产出（计划/测试报告/审查/SQL/API文档）到 .harness/archive/，含归档元数据。仅当用户显式调用
   /harness-archive 时使用；不得被其他阶段 skill 自动接续触发。
 ---
-<!-- generated by harness_deploy.py; core=b737565b4074dee2; overlay=none; agent=codex; do not edit -->
+<!-- generated by harness_deploy.py; core=81932532e802506f; overlay=none; agent=codex; do not edit -->
 # harness-archive — 变更归档
 
 ## Purpose

package/harness/bundles/general/codex/harness-codebase-map/SKILL.md

@@ -3,7 +3,7 @@ name: harness-codebase-map
 description: 分析现有代码库并生成 .harness/codebase/map/
   下的结构化代码库地图。用于陌生项目理解、重大改造前梳理、harness-sync 提示 map 过期后的人工刷新。
 ---
-<!-- generated by harness_deploy.py; core=b737565b4074dee2; overlay=none; agent=codex; do not edit -->
+<!-- generated by harness_deploy.py; core=81932532e802506f; overlay=none; agent=codex; do not edit -->
 # harness-codebase-map — 代码库地图
 
 ## Purpose
@@ -12,8 +12,8 @@ description: 分析现有代码库并生成 .harness/codebase/map/
 
 ## 核心边界
 
-- **只写** `.harness/codebase/map/`、`map-summary.md`、`map-manifest.json`、`.harness/reports/codebase-map-*.md`
-- **禁止** `.planning/`、Git 写操作、修改 `.codegraph/`、自动 commit/push
+- **内容只写** `.harness/codebase/map/`、`map-summary.md`、`map-manifest.json`、`.harness/reports/codebase-map-*.md`；平台同步只更新 Harness 协议状态
+- **禁止** `.planning/`、Git 写操作、修改 `.codegraph/`、自动 commit 或 Git push
 - `harness-sync` 只**建议**刷新，不自动跑全量 map
 
 ## When to Use
@@ -44,6 +44,7 @@ description: 分析现有代码库并生成 .harness/codebase/map/
 | 6 | 写 summary + manifest（schema → `templates/map-manifest.schema.json`） |
 | 7 | 更新 `.harness/context-index.json` codebase 入口（若存在） |
 | 8 | 控制台 + `.harness/reports/codebase-map-*.md` 报告 |
+| 9 | 项目已绑定平台时，运行 `npx hunter-harness push --yes --non-interactive --json` 上传受控规则与架构快照；失败只报告“平台同步待重试”，不回滚本地地图 |
 
 逐步细节、frontmatter 字段、git 允许列表 → `reference.md` / `checklist.md`
 
@@ -69,7 +70,7 @@ description: 分析现有代码库并生成 .harness/codebase/map/
 |---|------|
 | 1 | 唯一输出 `.harness/codebase/map/` |
 | 2 | `generated_reviewable`，不建议手工改 map 正文 |
-| 3 | 不 Git 写操作、不改业务代码 |
+| 3 | 不做 Git 写操作、不改业务代码；受控平台上传不等于 Git push |
 | 4 | 不管理 CodeGraph |
 | 5 | 敏感信息脱敏 → `sensitive-info-protocol` |
 | 6 | 证据化输出 → `evidence-based-reporting-protocol` |
@@ -77,7 +78,7 @@ description: 分析现有代码库并生成 .harness/codebase/map/
 
 ## Output Format
 
-模式、范围、7/7 文档路径与行数、manifest/summary、context-index 状态、WARN/FAIL → `reference.md` 报告模板
+模式、范围、7/7 文档路径与行数、manifest/summary、context-index 状态、平台同步状态、WARN/FAIL → `reference.md` 报告模板
 
 ## 渐进披露
 

package/harness/bundles/general/codex/harness-knowledge-ingest/SKILL.md

@@ -2,7 +2,7 @@
 name: harness-knowledge-ingest
 description: 确认归档 ZIP 已上传并由 Hunter Platform 在服务端解包、校验和入库。客户端不再构建或维护本地知识索引。
 ---
-<!-- generated by harness_deploy.py; core=b737565b4074dee2; overlay=none; agent=codex; do not edit -->
+<!-- generated by harness_deploy.py; core=81932532e802506f; overlay=none; agent=codex; do not edit -->
 # harness-knowledge-ingest
 
 知识 ingest 完全由 Hunter Platform 负责。归档完成时，客户端生成一个确定性 ZIP；
@@ -27,15 +27,21 @@ description: 确认归档 ZIP 已上传并由 Hunter Platform 在服务端解包
 
 ## Normal Workflow
 
-1. `harness-archive` 的 finalize 生成确定性 ZIP，并调用：
+1. 先读取最近归档操作记录中的 `archiveRemote`，以及本地状态目录
+   `.harness/state/local/archive-packages/<change-key>.remote.json`。若 `archiveStatus=durable` 且
+   `knowledgeStatus=ready`，直接报告已完成，禁止重新打包或上传。
+2. 若存在 `.harness/state/local/archive-packages/<change-key>.zip`，只重试该包；
+   禁止搜索实现源码、调用 Python 内部函数或手工重新拼包。
+3. 只有旧归档没有 ZIP/回执时，调用公开命令重新生成并上传；`harness-archive`
+   的 finalize 正常情况下会生成确定性 ZIP，并调用：
 
 ```powershell
 powershell.exe -Command "npx hunter-harness archive upload --file '<archive.zip>' --change-key '<change-key>' --yes --non-interactive --json"
 ```
 
-2. 检查响应中的包哈希、服务端保存状态和 `knowledge_status`。
-3. 只有服务端确认原 ZIP 已持久保存且知识状态为 ready，才删除本地待上传 ZIP。
-4. 上传或 ingest 失败时保留 ZIP 与失败收据；修复连接后重试同一个 ZIP，不重新拼散文件。
+4. 检查响应中的包哈希、服务端保存状态和 `knowledge_status`。
+5. 只有服务端确认原 ZIP 已持久保存且知识状态为 ready，才删除本地待上传 ZIP。
+6. 上传或 ingest 失败时保留 ZIP 与失败收据；修复连接后重试同一个 ZIP，不重新拼散文件。
 
 ## Ownership Rules
 

package/harness/bundles/general/codex/harness-knowledge-query/SKILL.md

@@ -2,7 +2,7 @@
 name: harness-knowledge-query
 description: 在规划、实现或排查前，通过 hunter-harness CLI 查询远端项目知识库。远端不可用时直接报告不可用，不建立本地索引或离线回退。
 ---
-<!-- generated by harness_deploy.py; core=b737565b4074dee2; overlay=none; agent=codex; do not edit -->
+<!-- generated by harness_deploy.py; core=81932532e802506f; overlay=none; agent=codex; do not edit -->
 # harness-knowledge-query
 
 项目知识以 Hunter Platform 的服务端索引为唯一真源。客户端只提交查询并消费结果：

package/harness/bundles/general/codex/harness-plan/SKILL.md

@@ -3,14 +3,14 @@ name: harness-plan
 description: 将需求转化为设计文档+实施计划+完整测试场景表，必须在编码前完成。仅当用户显式调用 /harness-plan 或明确要求进入
   Harness 规划阶段时使用；不得因用户描述需求就自动触发。
 ---
-<!-- generated by harness_deploy.py; core=b737565b4074dee2; overlay=none; agent=codex; do not edit -->
+<!-- generated by harness_deploy.py; core=81932532e802506f; overlay=none; agent=codex; do not edit -->
 # harness-plan — 需求规划
 
 ## Purpose
 
 确定 change 后必须运行 `python <skills-root>/scripts/harness_gate.py classify --change <id> --stage plan --json`，并把脚本返回的 risk tier、默认阶段、条件阶段和必需验证写入计划；不得凭模型印象另建风险分级。
 
-需求 → 设计文档 → 任务拆分 → 测试场景表（编码/测试唯一真相源）。项目已绑定远端平台时先执行一次 `harness-knowledge-query`；远端不可用则记录 issue 并继续，不做本地回退。
+需求 → 设计文档 → 任务拆分 → 测试场景表（编码/测试唯一真相源）。项目已绑定远端平台时，阶段 1 只执行下表中的远端查询命令；远端不可用则记录 issue 并继续，不做本地回退。
 
 ## When to Use
 
@@ -68,7 +68,7 @@ description: 将需求转化为设计文档+实施计划+完整测试场景表
 | 0 | 用当前解释器运行 `harness_runtime.py doctor`，后续消费绝对 argv；git status；脏工作区 → baseline 隔离 + `decision`，不询问 |
 | 0.5 | 确定英文 `change-name` 后，根据需求生成一次简洁的中文展示标题（建议 6～24 个可见字符，保留必要产品名），执行 `harness_context.py prepare --phase plan --executor <tool> [--change <id>] --title "<中文标题>" --json`；英文名继续作为目录与稳定标识。立即运行一次 `harness_state.py capture --project . --change-dir "<executionRoot>" --json`，把此时 HEAD 固定为不可变 `changeBase`。以其唯一 change/executionRoot 初始化 plan-run-id 与 attempt（首次为 1），用同一身份追加 `phase.start`；从第一条知识查询起保留事件证据，并在 finalizer 中复用该身份 |
 | 0.6 | 使用 `classify` 返回的默认阶段和项目能力生成 `plannedPhases`，向用户用中文说明可选阶段；确认后运行 `harness_context.py configure-plan --project . --change <id> --phases "plan,run,...,archive" --operator <tool> --reason "<中文原因>" --json`。无 Git 或不需要提交时不得加入 `submit`；快速迭代默认 `plan,run,archive`。省略项由脚本写入 `skippedPhases`，不得伪造阶段事件 |
-| 1 | `harness-knowledge-query` 单次远端 query（失败记 `issue`，不建立本地索引或离线回退） |
+| 1 | 直接执行一次 `npx hunter-harness knowledge query "<用户需求原文>" --limit 10 --json`。这是唯一执行入口，不扫描技能目录、不查找其他脚本；失败记 `issue` 并继续，不建立本地索引或离线回退 |
 | 2 | 歧义优先检查 + 复杂度分级；先确认会改变实现方向的语义歧义 |
 | 3 | 按复杂度执行有预算的代码探索；简单修复不得扩散到无关模块 |
 | 4 | **设计审批包** blocking user confirmation；确认事件早于 approved 设计文档和 `meta/worktree.json` |
@@ -102,7 +102,7 @@ change-name 范围变更 → 提示重命名或记 🟡WARN（→ `reference.md`
 | 设计审批包 | 一次 blocking user confirmation 含 worktree（读 `harness.json` `defaultWorktree`） |
 | 阶段 8 | spec/plan/detail/scenarios/gate-policy/worktree 六项标准产物先进入 staging；仅 finalizer 校验成功后发布并写唯一 `phase.end`/log；随后 `verify` 必须确认 start/end、收据完整覆盖六项标准产物、哈希、全部任务表和非空场景清单一致，失败不得手工补终态 |
 | Plan 结束 | **禁止**询问执行模式；只提示 `/harness-run` |
-| 知识查询 | 0.5 失败不得假装已读历史 |
+| 知识查询 | 阶段 1 失败不得假装已读历史，也不得改用本地索引或其他执行入口 |
 | 歧义优先检查 | 否定、对比、动作对象或范围存在多种合理解释时，最小取证后先给推荐理解并一次一问；确认前不深挖错误方向 |
 | 简单修复探索预算 | 预计不超过 2 个代码文件、且不涉及认证/安全/迁移/并发/API 契约重设时，最多 1 次合并 CodeGraph 查询 + 1 次定向补查、1 个用户澄清问题；无关发现只记非阻断说明 |
 | 精简产物 | 简单修复只保留实现所需的设计、任务、边界和测试；禁止在 spec/plan/detail/scenarios 中重复同一背景和结论 |

package/harness/bundles/general/codex/harness-review/SKILL.md

@@ -4,7 +4,7 @@ description: 6维度代码审查（架构/安全/规范/兼容/测试/性能）
   .harness/context-index.json）和测试场景表，在隔离上下文运行。仅当用户显式调用 /harness-review 时使用；不得在
   test 结束后自动接续执行。
 ---
-<!-- generated by harness_deploy.py; core=b737565b4074dee2; overlay=none; agent=codex; do not edit -->
+<!-- generated by harness_deploy.py; core=81932532e802506f; overlay=none; agent=codex; do not edit -->
 # harness-review — 代码审查
 
 ## Purpose

package/harness/bundles/general/codex/harness-run/SKILL.md

@@ -3,7 +3,7 @@ name: harness-run
 description: 按变更簇执行 TDD 编码循环（RED→GREEN→REFACTOR→编译验证），逐变更簇实现计划中的任务。仅当用户显式调用
   /harness-run 时使用；不得因用户提到编码/实现就自动触发，也不得被其他阶段 skill 自动接续。
 ---
-<!-- generated by harness_deploy.py; core=b737565b4074dee2; overlay=none; agent=codex; do not edit -->
+<!-- generated by harness_deploy.py; core=81932532e802506f; overlay=none; agent=codex; do not edit -->
 # harness-run — 需求编码
 
 ## Purpose
@@ -59,7 +59,7 @@ description: 按变更簇执行 TDD 编码循环（RED→GREEN→REFACTOR→编
 
 ## Workflow 概要
 
-0. 加载上下文：普通 Run 先 `harness_context.py prepare --phase run --executor <tool> [--change <id>] --json`，再 **`harness_context.py begin --phase run --change <id> --executor <tool> --json`** 校验交接，最后运行 **`harness_gate.py begin --phase run --change <id>`**。`--fixback` 不得拼装这些底层步骤，必须只调用一次 `harness_fixback.py launch-review --project . --change <id> --change-dir <change-dir> --executor <tool> --skills-root <skills-root> --product-identity <当前产品身份> --json`：该命令会先筛选结构化评审项，再原子选择 Fixback 分支、确认上下文、取得 Run 门禁并创建已填充批次。返回 `FIXBACK_NOTHING_TO_APPLY` 时直接报告“本轮评审没有需要执行的代码修复”并停止；返回阻塞码时按 `recoveryAction` 停止，不搜索实现、不试探其他参数、不创建空批次。禁止手写 `events.ndjson` / `phase.end`。已连接平台时 begin 会 best-effort 补传事件，失败只告警。
+0. 加载上下文：普通 Run 先 `harness_context.py prepare --phase run --executor <tool> [--change <id>] --json`，再 **`harness_context.py begin --phase run --change <id> --executor <tool> --json`** 校验交接，最后运行 **`harness_gate.py begin --phase run --change <id>`**。`harness_gate.py` 会从当前已安装适配器自动识别 skills root；只有执行复制到别处的脚本时才显式传 `--skills-root`。`--fixback` 不得拼装这些底层步骤，必须只调用一次 `harness_fixback.py launch-review --project . --change <id> --change-dir <change-dir> --executor <tool> --skills-root <skills-root> --product-identity <当前产品身份> --json`：该命令会先筛选结构化评审项，再原子选择 Fixback 分支、确认上下文、取得 Run 门禁并创建已填充批次。返回 `FIXBACK_NOTHING_TO_APPLY` 时直接报告“本轮评审没有需要执行的代码修复”并停止；返回阻塞码时按 `recoveryAction` 停止，不搜索实现、不试探其他参数、不创建空批次。禁止手写 `events.ndjson` / `phase.end`。已连接平台时 begin 会 best-effort 补传事件，失败只告警。
 0.5. **测试基础设施探测**（先写 `CHECKING`，四项证据齐备后再结论）→ `reference.md` Step 0.5；测试基线已由上一步 gate begin 内部建立，不得再次执行 guard begin
 1. **变更簇 TDD** — `protocols.md` `run-tdd-protocol`；批量 RED/GREEN；按需 `change-cluster-review-protocol`（高风险 + reviewer 预检可用）
 2. 构建验证 + **仅**通过 `harness_ledger.py record` 写 ledger（禁止 Write/Edit `verification-ledger.json`）；若本阶段创建/删除了清单、锁文件、源码根或改变技术栈，最后一次产品编辑后、写账本与关门前必须执行 `harness_preflight.py detect --project . --json` 刷新 build profile。`record --project . --profile-input <key>` 会对缺失/陈旧 profile 自动检测并从同一 target 推导 scope、coverage、规范命令和输入闭包；不得再手填另一套身份。`diff-hash --change-dir` 纳入 ignored tests → `reference.md` Step 2c

package/harness/bundles/general/codex/harness-submit/SKILL.md

@@ -3,7 +3,7 @@ name: harness-submit
 description: 最终提交封装：验证→中文 commit→提交/推送；worktree 模式含 --no-ff 合并回主分支。仅当用户显式调用
   /harness-submit（或 /harness-merge 重入合并段）时使用；用户口头说'提交/commit/push'时必须先确认，不得自动触发。
 ---
-<!-- generated by harness_deploy.py; core=b737565b4074dee2; overlay=none; agent=codex; do not edit -->
+<!-- generated by harness_deploy.py; core=81932532e802506f; overlay=none; agent=codex; do not edit -->
 # harness-submit — 最终提交（含 worktree 合并）
 
 ## Purpose
@@ -54,7 +54,7 @@ worktree 合并前必须运行 `harness_change.py integration-lock acquire --run
 
 ### 提交流程（步骤 0–7）
 
-0. **启动准备** — `harness_context.py prepare --phase submit --executor <tool> [--change <id>] --json` 确定唯一变更与 executionRoot；`harness_context.py begin --phase submit --change <id> --executor <tool> --json` 校验 review→submit receipt；**`harness_gate.py begin --phase submit --change <id>`**；读 ledger，以 `harness_ledger.py diff-hash --repo . --base <baseCommit> --change-dir ".harness/changes/<change-name>" --json` 计算 diffHash + post-test 7 类分类（禁止手写 ledger / 手工 phase.end）
+0. **启动准备** — `harness_context.py prepare --phase submit --executor <tool> [--change <id>] --json` 确定唯一变更与 executionRoot；`harness_context.py begin --phase submit --change <id> --executor <tool> --json` 校验 review→submit receipt；**`harness_gate.py begin --phase submit --change <id>`**；读 ledger，以 `harness_ledger.py diff-hash --repo <executionRoot> --base <baseCommit> --change-dir ".harness/changes/<change-name>" --json` 计算 diffHash + post-test 7 类分类（`executionRoot` 必须直接取准备回执；禁止手写 ledger / 手工 phase.end）
 1. **合并最新代码** — 主目录与 worktree 均**不在业务工作区 stash/pull**；远端同步由合并段 integration transaction 在隔离 integration worktree 内完成（见「worktree 合并流程」）；**正常路径禁止 `git stash` / `stash pop`**
 2. **最终验证** — ledger 复用优先；提交前只调用 `can-reuse --project . --profile-input unitTestFull --command <profile 规范命令>`。不得传入另一套 `--files`，不得把 runner 包装说明写进 `command`。`reuse=true` 时禁止重跑；只有真实输入、依赖、工具链或环境身份变化时才执行一次同一 profile 验证，并只登记一条结果。不要读取 ledger/archive 实现源码或临时编写散列脚本排查参数。
    - 无远端 CI 且 gate-policy 未强制 remote provider 时，验证通过/复用后运行 `harness_archive.py certify-local --change-dir ... --project . --json`，从同一 ledger 生成 `local-reproducible` 产品候选收据；该命令不执行测试。

package/harness/bundles/general/codex/harness-sync/SKILL.md

@@ -4,7 +4,7 @@ description: Use when the user asks to synchronize, refresh, or validate Harness
   metadata, adapters, remote knowledge ownership, instruction entrypoints,
   config origins, or CodeGraph status.
 ---
-<!-- generated by harness_deploy.py; core=b737565b4074dee2; overlay=none; agent=codex; do not edit -->
+<!-- generated by harness_deploy.py; core=81932532e802506f; overlay=none; agent=codex; do not edit -->
 # harness-sync
 
 ## Purpose

package/harness/bundles/general/codex/harness-test/SKILL.md

@@ -3,7 +3,7 @@ name: harness-test
 description: 测试执行：读取场景表，执行单元测试+API接口测试+数据兼容验证，输出测试报告。仅当用户显式调用 /harness-test
   时使用；不得在 run 结束后自动接续执行。
 ---
-<!-- generated by harness_deploy.py; core=b737565b4074dee2; overlay=none; agent=codex; do not edit -->
+<!-- generated by harness_deploy.py; core=81932532e802506f; overlay=none; agent=codex; do not edit -->
 # harness-test — 测试执行
 
 ## Purpose