@hunter-harness/workflow-harness 0.2.76 → 0.2.78

package/harness/bundles/general/cursor/scripts/harness_knowledge_candidates.py

@@ -0,0 +1,262 @@
+#!/usr/bin/env python3
+"""Knowledge candidate generation from an archived change's summary-data.json.
+
+The archive workflow has already filtered once: review findings were produced by
+an independent reviewer and then adjudicated, and knownRisks are evidence-derived
+facts. This module turns those two — and only those two — into KnowledgeCandidate
+records for the archive package's ``candidates/knowledge.json``.
+
+Mapping is fixed by docs/superpowers/specs/2026-08-18-three-views-data-flow-design.md
+("知识来源的选定")::
+
+    disposition = FIXED                      -> pitfall   RED 0.95 / YELLOW 0.85
+    disposition = ACCEPTED_RISK | DEFERRED   -> risk      RED 0.95 / YELLOW 0.85
+    knownRisks[]                             -> risk      0.85
+    severity = OK | disposition = NOT_APPLICABLE -> dropped
+
+Dispositions outside the adopted set (OPEN / UNKNOWN) are dropped too: an
+unadjudicated finding is not yet knowledge. maintenanceNotes, finalStatusReasons
+and manualActions are deliberately excluded — the spec evaluated each and found
+them too noisy or empty to be worth persisting.
+
+No LLM is involved. Every emitted field is copied or derived from a real
+summary-data field, so the output is reproducible and free of invention.
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+from typing import Any
+
+SCHEMA_VERSION = 1
+PRODUCER = "harness-archive"
+
+# Only these severities carry knowledge; OK is explicitly dropped by the spec.
+_SEVERITIES = {"RED", "YELLOW"}
+# Adjudicated dispositions the spec adopts, mapped to the knowledge entry type.
+_DISPOSITION_ENTRY_TYPES = {
+    "FIXED": "pitfall",
+    "ACCEPTED_RISK": "risk",
+    "DEFERRED": "risk",
+}
+_SEVERITY_CONFIDENCE = {"RED": 0.95, "YELLOW": 0.85}
+_KNOWN_RISK_CONFIDENCE = 0.85
+
+_MAX_KEYWORDS = 32
+_MAX_KEYWORD_CHARS = 80
+_MAX_BODY_CHARS = 20_000
+
+
+def _text(value: Any) -> str:
+    return value.strip() if isinstance(value, str) else ""
+
+
+def _digest(*parts: str) -> str:
+    return hashlib.sha256("\0".join(parts).encode("utf-8")).hexdigest()
+
+
+def _candidate_id(change_key: str, kind: str, identity: str) -> str:
+    return f"kc_{_digest(change_key, kind, identity)[:32]}"
+
+
+def _content_hash(entry_type: str, summary: str, body: str, keywords: list[str]) -> str:
+    canonical = json.dumps(
+        {"entry_type": entry_type, "summary": summary, "body": body, "keywords": keywords},
+        ensure_ascii=False,
+        sort_keys=True,
+        separators=(",", ":"),
+    )
+    return "sha256:" + hashlib.sha256(canonical.encode("utf-8")).hexdigest()
+
+
+def _keywords(*values: str) -> list[str]:
+    """Deduplicate, preserve order, and honour the contract's bounds."""
+    seen: list[str] = []
+    for value in values:
+        keyword = _text(value)[:_MAX_KEYWORD_CHARS]
+        if keyword and keyword not in seen:
+            seen.append(keyword)
+    return seen[:_MAX_KEYWORDS]
+
+
+def _path_segments(path: str) -> list[str]:
+    return [segment for segment in path.replace("\\", "/").split("/") if segment]
+
+
+def _location(path: str, line: Any) -> str:
+    """``path:line`` when the line number is real, otherwise just the path."""
+    if not path:
+        return ""
+    if isinstance(line, bool) or not isinstance(line, int) or line < 1:
+        return path
+    return f"{path}:{line}"
+
+
+def _finding_candidate(
+    finding: dict[str, Any],
+    *,
+    change_key: str,
+    archive_id: str,
+    producer_version: str,
+    created_at: str,
+) -> dict[str, Any] | None:
+    severity = _text(finding.get("severity"))
+    disposition = _text(finding.get("disposition"))
+    entry_type = _DISPOSITION_ENTRY_TYPES.get(disposition)
+    title = _text(finding.get("title"))
+    if severity not in _SEVERITIES or entry_type is None or not title:
+        return None
+
+    path = _text(finding.get("path"))
+    line = finding.get("line")
+    location = _location(path, line)
+    segments = _path_segments(path)
+    finding_id = _text(finding.get("id"))
+
+    body_lines = [title]
+    if location:
+        body_lines.append(f"位置：{location}")
+    body_lines.append(f"严重度：{severity}")
+    body_lines.append(f"裁决：{disposition}")
+    body = "\n".join(body_lines)[:_MAX_BODY_CHARS]
+
+    keywords = _keywords(
+        segments[-1] if segments else "",
+        segments[-2] if len(segments) >= 2 else "",
+        severity,
+        disposition,
+    )
+    source_ref = f"archive:{archive_id}#{finding_id}" if finding_id else f"archive:{archive_id}"
+    if path and location != path:
+        source_refs = [f"{path}#L{line}"]
+    elif path:
+        source_refs = [path]
+    else:
+        source_refs = [f"archive:{archive_id}"]
+
+    return {
+        "schema_version": SCHEMA_VERSION,
+        "candidate_id": _candidate_id(
+            change_key, "review", finding_id or f"{title}\0{path}\0{line}"
+        ),
+        "source_change_key": change_key,
+        "source_refs": source_refs,
+        "summary": title,
+        "reusability_scope": segments[0] if segments else "project",
+        "content_hash": _content_hash(entry_type, title, body, keywords),
+        "confidence": _SEVERITY_CONFIDENCE[severity],
+        "status": "pending",
+        "entry_type": entry_type,
+        "body": body,
+        "keywords": keywords,
+        "provenance": {
+            "source_kind": "review",
+            "source_ref": source_ref,
+            "producer": PRODUCER,
+            "producer_version": producer_version,
+            "created_at": created_at,
+        },
+    }
+
+
+def _risk_candidate(
+    risk: dict[str, Any],
+    *,
+    change_key: str,
+    archive_id: str,
+    producer_version: str,
+    created_at: str,
+) -> dict[str, Any] | None:
+    message = _text(risk.get("message"))
+    if not message:
+        return None
+    phase = _text(risk.get("phase"))
+    severity = _text(risk.get("severity"))
+
+    body_lines = [message]
+    if phase:
+        body_lines.append(f"阶段：{phase}")
+    if severity:
+        body_lines.append(f"严重度：{severity}")
+    body = "\n".join(body_lines)[:_MAX_BODY_CHARS]
+    keywords = _keywords(phase, severity)
+
+    return {
+        "schema_version": SCHEMA_VERSION,
+        "candidate_id": _candidate_id(change_key, "known_risk", f"{phase}\0{message}"),
+        "source_change_key": change_key,
+        "source_refs": [f"archive:{archive_id}"],
+        "summary": message,
+        "reusability_scope": phase or "project",
+        "content_hash": _content_hash("risk", message, body, keywords),
+        "confidence": _KNOWN_RISK_CONFIDENCE,
+        "status": "pending",
+        "entry_type": "risk",
+        "body": body,
+        "keywords": keywords,
+        "provenance": {
+            "source_kind": "archive",
+            "source_ref": f"archive:{archive_id}",
+            "producer": PRODUCER,
+            "producer_version": producer_version,
+            "created_at": created_at,
+        },
+    }
+
+
+def build_knowledge_candidates(
+    summary: dict[str, Any],
+    *,
+    change_key: str,
+    archive_id: str,
+    producer_version: str,
+    created_at: str,
+) -> list[dict[str, Any]]:
+    """Project reviewFindings + knownRisks into KnowledgeCandidate records.
+
+    Returns [] for missing or malformed input: an archive with nothing worth
+    persisting must still produce a valid (empty) candidates file.
+    """
+    if not isinstance(summary, dict):
+        return []
+    candidates: list[dict[str, Any]] = []
+    seen_ids: set[str] = set()
+
+    def collect(candidate: dict[str, Any] | None) -> None:
+        if candidate is None or candidate["candidate_id"] in seen_ids:
+            return
+        seen_ids.add(candidate["candidate_id"])
+        candidates.append(candidate)
+
+    findings = summary.get("reviewFindings")
+    if isinstance(findings, list):
+        for finding in findings:
+            if isinstance(finding, dict):
+                collect(_finding_candidate(
+                    finding,
+                    change_key=change_key,
+                    archive_id=archive_id,
+                    producer_version=producer_version,
+                    created_at=created_at,
+                ))
+
+    risks = summary.get("knownRisks")
+    if isinstance(risks, list):
+        for risk in risks:
+            if isinstance(risk, dict):
+                collect(_risk_candidate(
+                    risk,
+                    change_key=change_key,
+                    archive_id=archive_id,
+                    producer_version=producer_version,
+                    created_at=created_at,
+                ))
+
+    return candidates
+
+
+def render_knowledge_candidates_json(candidates: list[dict[str, Any]]) -> str:
+    """Deterministic bytes for the archive package entry."""
+    return json.dumps(
+        candidates, ensure_ascii=False, sort_keys=True, separators=(",", ":")
+    ) + "\n"

package/harness/bundles/general/cursor/scripts/harness_ledger.py

@@ -444,6 +444,8 @@ def infer_execution_project_root(change_dir: Path) -> Path | None:
         process = subprocess.run(
             ["git", "-C", str(root), "rev-parse", "--path-format=absolute", "--git-common-dir"],
             text=True,
+            encoding="utf-8",
+            errors="replace",
             stdout=subprocess.PIPE,
             stderr=subprocess.PIPE,
             check=False,
@@ -461,6 +463,8 @@ def infer_execution_project_root(change_dir: Path) -> Path | None:
         process = subprocess.run(
             ["git", "-C", str(candidate), "rev-parse", "--show-toplevel"],
             text=True,
+            encoding="utf-8",
+            errors="replace",
             stdout=subprocess.PIPE,
             stderr=subprocess.PIPE,
             check=False,

package/harness/bundles/general/cursor/scripts/harness_runtime.py

@@ -1578,7 +1578,7 @@ def _run_session_worker_with_log(state_root: Path, session_id: str) -> int:
             return _run_session_worker(state_root, session_id)
 
 
-def run_session_status(state_root: Path, session_id: str) -> dict[str, Any]:
+def _run_session_status_raw(state_root: Path, session_id: str) -> dict[str, Any]:
     from harness_service import is_pid_alive
 
     receipt = _load_run_receipt(state_root, session_id)
@@ -1651,6 +1651,65 @@ def run_session_status(state_root: Path, session_id: str) -> dict[str, Any]:
     return receipt
 
 
+# 终态判定此前只活在脚本内部的 RUN_TERMINAL_STATUSES 里，从不出现在返回体中。
+# 调用方于是只能按状态名猜——而 "INCOMPLETE" 读起来最像"还没结束"，实际是终态。
+# 2026-08-18 的一次 fixback 执行里，一个启动即失败（LAUNCHER_FAILED）的会话
+# 被连等 20s、60s，纯属这个缺口造成的浪费。
+_TERMINAL_HINTS = {
+    "LAUNCHER_FAILED": (
+        "被测进程未能启动（testProcessStarted=false），不是超时；"
+        "先核对 argv 的可执行文件在该工作目录下能否直接运行，再重跑 run-start。"
+    ),
+    "HEARTBEAT_LOST": "worker 心跳丢失，会话已判定结束；日志可能不完整。",
+    "WORKER_IDENTITY_MISMATCH": "worker 身份校验不通过，会话已终止且未采信其结果。",
+    "WORKER_EXITED_WITHOUT_FINAL_RECEIPT": "worker 未写最终回执即退出。",
+}
+
+
+def _annotate_run_status(receipt: dict[str, Any]) -> dict[str, Any]:
+    """给回执补上可判定的终态标记与可行动线索。
+
+    FINALIZING 刻意判为非终态：结果虽已确定，但 worker 尚未退出，
+    调用方此时取读数会与清理竞争。
+    """
+    status = receipt.get("status")
+    terminal = status in RUN_TERMINAL_STATUSES and status != "FINALIZING"
+    annotated = dict(receipt)
+    annotated["terminal"] = bool(terminal)
+    hint = _TERMINAL_HINTS.get(str(receipt.get("reasonCode") or ""))
+    if terminal and hint is not None:
+        annotated["terminalHint"] = hint
+    return annotated
+
+
+def run_session_status(state_root: Path, session_id: str) -> dict[str, Any]:
+    return _annotate_run_status(_run_session_status_raw(state_root, session_id))
+
+
+def await_run_session(
+    state_root: Path,
+    session_id: str,
+    *,
+    timeout_seconds: float = 600.0,
+    poll_seconds: float = 2.0,
+) -> dict[str, Any]:
+    """阻塞到会话进入终态，或超时后带 waitTimedOut 标记返回。
+
+    没有这个入口时，调用方只能 `sleep <猜一个时长>` 再查一次；上述执行日志里
+    连猜了 5s / 20s / 60s / 100s 四轮。等待逻辑属于会话语义，应由这里承担。
+    """
+    deadline = time.monotonic() + max(float(timeout_seconds), 0.0)
+    while True:
+        current = run_session_status(state_root, session_id)
+        if current.get("terminal") is True:
+            current["waitTimedOut"] = False
+            return current
+        if time.monotonic() >= deadline:
+            current["waitTimedOut"] = True
+            return current
+        time.sleep(max(float(poll_seconds), 0.01))
+
+
 def read_run_session_log(
     state_root: Path,
     session_id: str,
@@ -1974,6 +2033,13 @@ def build_parser() -> argparse.ArgumentParser:
     p_status = sub.add_parser("run-status", help="read a managed run receipt")
     p_status.add_argument("--state-root", required=True)
     p_status.add_argument("--session-id", required=True)
+    p_status.add_argument(
+        "--wait",
+        action="store_true",
+        help="阻塞到会话进入终态再返回，替代调用方自己 sleep 猜时长",
+    )
+    p_status.add_argument("--wait-timeout-seconds", type=float, default=600.0)
+    p_status.add_argument("--poll-seconds", type=float, default=2.0)
     p_status.add_argument("--json", action="store_true")
     p_log = sub.add_parser("run-log", help="read an incremental log page")
     p_log.add_argument("--state-root", required=True)
@@ -2022,7 +2088,15 @@ def main(argv: list[str] | None = None) -> int:
                 resource_locks=list(args.resource_lock),
             )
         elif args.command == "run-status":
-            result = run_session_status(Path(args.state_root), args.session_id)
+            if getattr(args, "wait", False):
+                result = await_run_session(
+                    Path(args.state_root),
+                    args.session_id,
+                    timeout_seconds=args.wait_timeout_seconds,
+                    poll_seconds=args.poll_seconds,
+                )
+            else:
+                result = run_session_status(Path(args.state_root), args.session_id)
         elif args.command == "run-log":
             result = read_run_session_log(
                 Path(args.state_root),

package/harness/bundles/java/claude-code/.harness-build.json

@@ -2,5 +2,5 @@
   "schemaVersion": 1,
   "overlay": "java",
   "agent": "claude-code",
-  "coreHash": "d8613ac610bcccc8"
+  "coreHash": "4e58f505d91f5969"
 }

package/harness/bundles/java/claude-code/harness-apidoc/SKILL.md

@@ -21,7 +21,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=d8613ac610bcccc8; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=4e58f505d91f5969; overlay=java; agent=claude-code; do not edit -->
 # harness-apidoc — 前端接口文档（Java overlay）
 
 ## Purpose

package/harness/bundles/java/claude-code/harness-archive/SKILL.md

@@ -21,7 +21,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=d8613ac610bcccc8; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=4e58f505d91f5969; overlay=java; agent=claude-code; do not edit -->
 # harness-archive — 变更归档
 
 ## Purpose
@@ -221,11 +221,13 @@ git 命令通过 `powershell.exe -Command "..."` 执行；archive-meta.md 和 su
 | 上传 | 载什么 | 结果在哪 |
 |------|--------|---------|
 | `steps.archive_push` | 归档 ZIP（核心产物） | `archiveId`/`archiveStatus`/`uploadStatus`/`knowledgeStatus`，同时落盘 `state/local/archive-packages/<cn>.remote.json` |
-| `steps.managed_snapshot_push` | **归档交付物（每个变更目录的 `plans/`、`spec/`、`reports/`、`docs/`）、`.harness/codebase` 架构地图、`.harness/rules`、`.harness/project.yaml`、指令入口** | `ok`/`reasonCode`/`exitCode`/`cliCode`/`detail` |
+| `steps.managed_snapshot_push` | **归档交付物（每个变更目录的 `plans/`、`spec/`、`docs/` 全部，`reports/` 只取 `final/` 定稿）、`.harness/codebase` 架构地图、`.harness/rules`、`.harness/project.yaml`、指令入口** | `ok`/`reasonCode`/`exitCode`/`cliCode`/`detail` |
 
 走 `harness-push`（remote-sync，产生分支快照）而非 legacy `push`（proposal 管道）。
 归档目录下的 `runtime/`、`meta/`、`evidence/`、`logs/`、`fixback/`、`.publication-staging/`
-等过程文件不上传；交付物目录里的 `*.log`、`*.tmp`、凭证与 `.env*` 也仍被安全规则拦下。
+等过程文件不上传；`reports/review/` 与 `reports/test/` 同样是过程产物，不上传——
+这条边界与归档 ZIP 的包内容边界一致。交付物目录里的 `*.log`、`*.tmp`、凭证与 `.env*`
+也仍被安全规则拦下。
 
 ```
 远端归档：arc_3ff325bb…（archiveStatus=durable，uploadStatus=ready，knowledgeStatus=ready，8 文件）

package/harness/bundles/java/claude-code/harness-codebase-map/SKILL.md

@@ -20,7 +20,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=d8613ac610bcccc8; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=4e58f505d91f5969; overlay=java; agent=claude-code; do not edit -->
 # harness-codebase-map — 代码库地图
 
 ## Purpose

package/harness/bundles/java/claude-code/harness-knowledge-ingest/SKILL.md

@@ -8,7 +8,7 @@ disallowed-tools:
   - Bash(git *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=d8613ac610bcccc8; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=4e58f505d91f5969; overlay=java; agent=claude-code; do not edit -->
 # harness-knowledge-ingest
 
 知识 ingest 完全由 Hunter Platform 负责。归档完成时，客户端生成一个确定性 ZIP；

package/harness/bundles/java/claude-code/harness-knowledge-query/SKILL.md

@@ -8,7 +8,7 @@ disallowed-tools:
   - Bash(git *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=d8613ac610bcccc8; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=4e58f505d91f5969; overlay=java; agent=claude-code; do not edit -->
 # harness-knowledge-query
 
 项目知识以 Hunter Platform 的服务端索引为唯一真源。客户端只提交查询并消费结果：

package/harness/bundles/java/claude-code/harness-package/SKILL.md

@@ -21,7 +21,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=d8613ac610bcccc8; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=4e58f505d91f5969; overlay=java; agent=claude-code; do not edit -->
 # harness-package — 增量模块打包（Java overlay）
 
 ## Purpose

package/harness/bundles/java/claude-code/harness-plan/SKILL.md

@@ -21,7 +21,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=d8613ac610bcccc8; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=4e58f505d91f5969; overlay=java; agent=claude-code; do not edit -->
 # harness-plan — 需求规划
 
 ## Purpose

package/harness/bundles/java/claude-code/harness-pull/SKILL.md

@@ -21,7 +21,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=d8613ac610bcccc8; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=4e58f505d91f5969; overlay=java; agent=claude-code; do not edit -->
 # harness-pull — 从 Hunter Platform 下拉与恢复
 
 ## Purpose

package/harness/bundles/java/claude-code/harness-push/SKILL.md

@@ -21,7 +21,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=d8613ac610bcccc8; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=4e58f505d91f5969; overlay=java; agent=claude-code; do not edit -->
 # harness-push — 上传到 Hunter Platform
 
 ## Purpose

package/harness/bundles/java/claude-code/harness-review/SKILL.md

@@ -22,7 +22,7 @@ disallowed-tools:
   - Bash(curl *)
   - Bash(codegraph *)
 ---
-<!-- generated by harness_deploy.py; core=d8613ac610bcccc8; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=4e58f505d91f5969; overlay=java; agent=claude-code; do not edit -->
 # harness-review — 代码审查
 
 ## Purpose

package/harness/bundles/java/claude-code/harness-run/SKILL.md

@@ -22,7 +22,7 @@ disallowed-tools:
   - Bash(curl *)
   - Bash(codegraph *)
 ---
-<!-- generated by harness_deploy.py; core=d8613ac610bcccc8; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=4e58f505d91f5969; overlay=java; agent=claude-code; do not edit -->
 # harness-run — 需求编码
 
 ## Purpose

package/harness/bundles/java/claude-code/harness-submit/SKILL.md

@@ -21,7 +21,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=d8613ac610bcccc8; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=4e58f505d91f5969; overlay=java; agent=claude-code; do not edit -->
 # harness-submit — 最终提交（含 worktree 合并）
 
 ## Purpose

package/harness/bundles/java/claude-code/harness-sync/SKILL.md

@@ -19,7 +19,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=d8613ac610bcccc8; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=4e58f505d91f5969; overlay=java; agent=claude-code; do not edit -->
 # harness-sync
 
 ## Purpose

package/harness/bundles/java/claude-code/harness-test/SKILL.md

@@ -23,7 +23,7 @@ disallowed-tools:
   - Bash(node *)
   - Bash(codegraph *)
 ---
-<!-- generated by harness_deploy.py; core=d8613ac610bcccc8; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=4e58f505d91f5969; overlay=java; agent=claude-code; do not edit -->
 # harness-test — 测试执行
 
 ## Purpose

package/harness/bundles/java/claude-code/protocols/powershell-protocol.md

@@ -196,6 +196,26 @@ Windows 默认常为 Windows PowerShell **5.1**。下列特性在 5.1 不可用
 - 非 ASCII 路径（含中文）仓库：git/构建/文件操作一律 PowerShell；Bash 被 hook 拒绝（如 `Denied: non-ASCII path`）后**立即**改用 PowerShell 重发等价命令，禁止原样重试 Bash。
 - Maven `-D` 参数在 PowerShell 中加引号：`"-Dmaven.test.skip=true"`。
 
+### 捕获子进程中文输出：`$env:PYTHONUTF8=1` 不够
+
+`PYTHONUTF8=1` 只让 **Python 按 UTF-8 输出**，不改变 **PowerShell 按什么编码读**。
+控制台代码页是 GBK(936) 时，PowerShell 会用 GBK 解码 UTF-8 字节，得到形如
+`绫?javadoc 鏈�闅� 6 绾х簿绠€` 的乱码——内容已在捕获阶段损坏，落进报告、回执与
+JSON 字段后无法还原。
+
+调用任何会输出中文的子进程前，**必须同时设置输出编码**：
+
+```powershell
+[Console]::OutputEncoding = [Text.Encoding]::UTF8
+$env:PYTHONUTF8 = 1
+python harness/scripts/harness_fixback.py <子命令> --json
+```
+
+- 两行缺一不可：只设 `PYTHONUTF8` 会乱码，只设 `OutputEncoding` 则 Python 可能仍按本地编码输出。
+- 写脚本时把这两行放在脚本开头，不要依赖调用方记得加。
+- 少用 `2>&1` 合并流：PowerShell 5.1 会把 stderr 包装成 `NativeCommandError`，
+  与编码问题叠加后更难判断真实失败原因；需要 stderr 时分开捕获。
+
 ## 13. PS5/PS7 原生参数合同
 
 复杂 JSON、Docker Go template、here-string 内容及多层引号不得作为 native process 的内联参数跨 `Bash → powershell -Command → native executable` 传递。统一写 UTF-8 JSON 参数文件：