@hunter-harness/workflow-harness 0.2.84 → 0.2.85

package/harness/bundles/general/claude-code/.harness-build.json

@@ -2,5 +2,5 @@
   "schemaVersion": 1,
   "overlay": "none",
   "agent": "claude-code",
-  "coreHash": "2e7fe0fb0fef6467"
+  "coreHash": "b0e6891811c856ce"
 }

package/harness/bundles/general/claude-code/harness-archive/SKILL.md

@@ -21,7 +21,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=2e7fe0fb0fef6467; overlay=none; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=b0e6891811c856ce; overlay=none; agent=claude-code; do not edit -->
 # harness-archive — 变更归档
 
 ## Purpose
@@ -178,9 +178,16 @@ disallowed-tools:
 > ⚠️ 行内标注是**申报**，不是绕过：它把"这是设计决策"写进文档本身，可审计、可追溯。
 > **不要**为了过扫描去删改设计文档的事实内容——那是篡改证据。
 >
-> ⚠️ 已知限制：`hunter-harness-ignore` 在本地扫描器上确认生效；**服务端是否认这条标注尚未验证**
-> （归档上传端点只收裸 ZIP，没有独立的豁免申报通道）。若加了标注仍被 422 拒收，
-> 剩余动作是在平台侧对该规则/内容加白，本地无法自解。
+> ✅ 行内标注**服务端确认生效**：平台归档入口跑的是同一个 `scanSensitiveFiles`，
+> 它直接从文件内容里解析 `hunter-harness-ignore`，命中转为 `overridden`、不再阻断。
+> 上传端点只收裸 ZIP、没有独立申报通道，靠的就是这条写在文档里的标注。
+>
+> ⚠️ 一处已知的服务端滞后：**不带凭据的连接串**（如 `postgres://dbhost:5432/appdb`）
+> 本地预检判 `low`/可豁免，而线上服务端目前仍判 `high`——high 不接受行内标注，
+> 这类设计文档暂时无法上传。平台侧修复已提交（见 hunter-platform
+> `fix(archive): 归档 422 给出可执行出路`），**部署后**两侧一致。在那之前遇到这一条：
+> 等平台部署，不要为了过扫描删掉连接串。带凭据的连接串（`user:pass@host`）两侧都是
+> `high`，必须真正脱敏。
 
 ### 二·B、归档补传（上传失败或历史归档缺条目）
 

package/harness/bundles/general/claude-code/harness-codebase-map/SKILL.md

@@ -20,7 +20,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=2e7fe0fb0fef6467; overlay=none; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=b0e6891811c856ce; overlay=none; agent=claude-code; do not edit -->
 # harness-codebase-map — 代码库地图
 
 ## Purpose

package/harness/bundles/general/claude-code/harness-knowledge-ingest/SKILL.md

@@ -8,7 +8,7 @@ disallowed-tools:
   - Bash(git *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=2e7fe0fb0fef6467; overlay=none; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=b0e6891811c856ce; overlay=none; agent=claude-code; do not edit -->
 # harness-knowledge-ingest
 
 知识 ingest 完全由 Hunter Platform 负责。归档完成时，客户端生成一个确定性 ZIP；

package/harness/bundles/general/claude-code/harness-knowledge-query/SKILL.md

@@ -8,7 +8,7 @@ disallowed-tools:
   - Bash(git *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=2e7fe0fb0fef6467; overlay=none; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=b0e6891811c856ce; overlay=none; agent=claude-code; do not edit -->
 # harness-knowledge-query
 
 项目知识以 Hunter Platform 的服务端索引为唯一真源。客户端只提交查询并消费结果：

package/harness/bundles/general/claude-code/harness-plan/SKILL.md

@@ -21,7 +21,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=2e7fe0fb0fef6467; overlay=none; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=b0e6891811c856ce; overlay=none; agent=claude-code; do not edit -->
 # harness-plan — 需求规划
 
 ## Purpose

package/harness/bundles/general/claude-code/harness-pull/SKILL.md

@@ -21,7 +21,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=2e7fe0fb0fef6467; overlay=none; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=b0e6891811c856ce; overlay=none; agent=claude-code; do not edit -->
 # harness-pull — 从 Hunter Platform 下拉与恢复
 
 ## Purpose

package/harness/bundles/general/claude-code/harness-push/SKILL.md

@@ -21,7 +21,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=2e7fe0fb0fef6467; overlay=none; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=b0e6891811c856ce; overlay=none; agent=claude-code; do not edit -->
 # harness-push — 上传到 Hunter Platform
 
 ## Purpose

package/harness/bundles/general/claude-code/harness-review/SKILL.md

@@ -22,7 +22,7 @@ disallowed-tools:
   - Bash(curl *)
   - Bash(codegraph *)
 ---
-<!-- generated by harness_deploy.py; core=2e7fe0fb0fef6467; overlay=none; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=b0e6891811c856ce; overlay=none; agent=claude-code; do not edit -->
 # harness-review — 代码审查
 
 ## Purpose

package/harness/bundles/general/claude-code/harness-run/SKILL.md

@@ -22,7 +22,7 @@ disallowed-tools:
   - Bash(curl *)
   - Bash(codegraph *)
 ---
-<!-- generated by harness_deploy.py; core=2e7fe0fb0fef6467; overlay=none; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=b0e6891811c856ce; overlay=none; agent=claude-code; do not edit -->
 # harness-run — 需求编码
 
 ## Purpose

package/harness/bundles/general/claude-code/harness-submit/SKILL.md

@@ -21,7 +21,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=2e7fe0fb0fef6467; overlay=none; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=b0e6891811c856ce; overlay=none; agent=claude-code; do not edit -->
 # harness-submit — 最终提交（含 worktree 合并）
 
 ## Purpose

package/harness/bundles/general/claude-code/harness-sync/SKILL.md

@@ -19,7 +19,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=2e7fe0fb0fef6467; overlay=none; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=b0e6891811c856ce; overlay=none; agent=claude-code; do not edit -->
 # harness-sync
 
 ## Purpose

package/harness/bundles/general/claude-code/harness-test/SKILL.md

@@ -23,7 +23,7 @@ disallowed-tools:
   - Bash(node *)
   - Bash(codegraph *)
 ---
-<!-- generated by harness_deploy.py; core=2e7fe0fb0fef6467; overlay=none; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=b0e6891811c856ce; overlay=none; agent=claude-code; do not edit -->
 # harness-test — 测试执行
 
 ## Purpose

package/harness/bundles/general/claude-code/scripts/harness_archive.py

@@ -2599,23 +2599,12 @@ def check_status(
             }
         )
 
-    # 发布内容预检：与服务端同源的规则，扫的是真正会进 ZIP 的那批文件。
-    # 服务端策略不归本地裁决，所以只预警不阻断——但必须在归档开始时就说出来，
-    # 而不是等跑完全流程由 upload 返回 422。
-    content_scan = precheck_publication_content(change_dir)
-    checks["publication_content_scan"] = content_scan
-    if content_scan.get("blocked"):
-        warnings.append({
-            "code": "PUBLICATION_CONTENT_SCAN_FLAGGED",
-            "message": str(content_scan.get("nextAction") or ""),
-        })
-    elif not content_scan.get("ok"):
-        warnings.append({
-            "code": str(
-                content_scan.get("reasonCode") or "PUBLICATION_CONTENT_SCAN_UNAVAILABLE"
-            ),
-            "message": str(content_scan.get("message") or ""),
-        })
+    checks["publication_content_scan"] = {
+        "ok": True,
+        "scan_performed": False,
+        "findings": [],
+        "message": "上传归档链路已停用内容敏感扫描；保留路径、凭据与 ZIP 安全校验。",
+    }
 
     sensitive_gate = validate_sensitive_evidence_publication_gate(
         change_dir,
@@ -9408,6 +9397,9 @@ def resolve_hunter_cli_command(project_root: Path) -> list[str]:
     """Command prefix that runs the hunter-harness CLI, cheapest route first."""
     node = shutil.which("node")
     if node:
+        current_entry = os.environ.get("HUNTER_HARNESS_CLI_ENTRY", "").strip()
+        if current_entry and Path(current_entry).is_file():
+            return [node, str(Path(current_entry).resolve())]
         entry = _installed_cli_entry(project_root)
         if entry is not None:
             return [node, str(entry)]
@@ -9774,6 +9766,7 @@ def auto_push_archive_core(
     change_key: str | None = None,
     extra_entries: dict[str, tuple[str, str, bytes]] | None = None,
     reuse_retained_package: bool = False,
+    prepared_package: dict[str, Any] | None = None,
 ) -> dict[str, Any]:
     """Build and upload one deterministic core ZIP after finalize.
 
@@ -9786,11 +9779,13 @@ def auto_push_archive_core(
     """
     project_root = project_root.resolve()
     effective_change_key = change_key or archive_dir.name
-    package = (
-        load_retained_package(project_root, effective_change_key)
-        if reuse_retained_package
-        else None
-    )
+    package = prepared_package
+    if package is None:
+        package = (
+            load_retained_package(project_root, effective_change_key)
+            if reuse_retained_package
+            else None
+        )
     if package is None:
         try:
             package = build_archive_package(
@@ -10637,6 +10632,28 @@ def resolve_archive_dir_for_change(
     return archive_root / matches[-1], matches
 
 
+def resolve_latest_unpublished_archive(project_root: Path) -> tuple[str | None, list[str]]:
+    """Choose the newest sealed archive without a durable local receipt."""
+    archive_root = project_root / ".harness" / "archive"
+    if not archive_root.is_dir():
+        return None, []
+    candidates: list[tuple[str, str]] = []
+    for entry in archive_root.iterdir():
+        if not entry.is_dir():
+            continue
+        change = entry.name
+        try:
+            summary = read_json(entry / "reports" / "final" / "summary-data.json")
+            if isinstance(summary, dict) and isinstance(summary.get("changeName"), str):
+                change = str(summary["changeName"]).strip() or change
+        except (OSError, ValueError, json.JSONDecodeError):
+            pass
+        if read_durable_archive_receipt(project_root, change) is None:
+            candidates.append((entry.name, change))
+    candidates.sort(reverse=True)
+    return (candidates[0][1] if candidates else None), [item[1] for item in candidates]
+
+
 def _republish_knowledge_entry(archive_dir: Path) -> dict[str, tuple[str, str, bytes]]:
     """Knowledge candidates for archives sealed before the candidates step.
 
@@ -10707,12 +10724,26 @@ def cmd_republish(
         "changeKey": change_key,
         "dryRun": dry_run,
     }
+    root = resolve_republish_project_root(project_root, archive_dir)
+    if change_key == "latest":
+        selected, available = resolve_latest_unpublished_archive(root)
+        if selected is None:
+            payload.update({
+                "ok": True,
+                "reasonCode": "ARCHIVE_NO_UNPUBLISHED_ARCHIVE",
+                "noChanges": True,
+                "availableChanges": available,
+                "projectRoot": str(root)
+            })
+            return 0, payload
+        change_key = selected
+        payload["changeKey"] = change_key
+        payload["selectedChange"] = selected
     if re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9._-]{0,159}", change_key) is None:
         payload["error"] = "change key must be a portable path segment"
         payload["reasonCode"] = "ARCHIVE_CHANGE_KEY_INVALID"
         return 2, payload
 
-    root = resolve_republish_project_root(project_root, archive_dir)
     payload["projectRoot"] = str(root)
     matches: list[str] = []
     if archive_dir is None:
@@ -10821,7 +10852,7 @@ def cmd_republish(
     # distinct name; it must never be mistaken for a pending upload.
     preview_path = (
         root / ".harness" / "state" / "local" / "archive-packages"
-        / f"{change_key}.preview.zip"
+        / f"{change_key}{'.preview.zip' if dry_run else '.zip'}"
     )
     try:
         package = build_archive_package(
@@ -10837,7 +10868,8 @@ def cmd_republish(
         return 1, payload
     finally:
         try:
-            preview_path.unlink(missing_ok=True)
+            if dry_run:
+                preview_path.unlink(missing_ok=True)
         except OSError:
             pass
 
@@ -10907,6 +10939,7 @@ def cmd_republish(
         archive_dir,
         change_key=change_key,
         extra_entries=extra_entries,
+        prepared_package=package,
     )
     payload["push"] = result
     payload["ok"] = bool(result.get("ok"))

package/harness/bundles/general/codebuddy/.harness-build.json

@@ -2,5 +2,5 @@
   "schemaVersion": 1,
   "overlay": "none",
   "agent": "codebuddy",
-  "coreHash": "2e7fe0fb0fef6467"
+  "coreHash": "b0e6891811c856ce"
 }

package/harness/bundles/general/codebuddy/harness-archive/SKILL.md

@@ -3,7 +3,7 @@ name: harness-archive
 description: 归档所有变更产出（计划/测试报告/审查/SQL/API文档）到 .harness/archive/，含归档元数据。仅当用户显式调用
   /harness-archive 时使用；不得被其他阶段 skill 自动接续触发。
 ---
-<!-- generated by harness_deploy.py; core=2e7fe0fb0fef6467; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=b0e6891811c856ce; overlay=none; agent=codebuddy; do not edit -->
 # harness-archive — 变更归档
 
 ## Purpose
@@ -160,9 +160,16 @@ description: 归档所有变更产出（计划/测试报告/审查/SQL/API文档
 > ⚠️ 行内标注是**申报**，不是绕过：它把"这是设计决策"写进文档本身，可审计、可追溯。
 > **不要**为了过扫描去删改设计文档的事实内容——那是篡改证据。
 >
-> ⚠️ 已知限制：`hunter-harness-ignore` 在本地扫描器上确认生效；**服务端是否认这条标注尚未验证**
-> （归档上传端点只收裸 ZIP，没有独立的豁免申报通道）。若加了标注仍被 422 拒收，
-> 剩余动作是在平台侧对该规则/内容加白，本地无法自解。
+> ✅ 行内标注**服务端确认生效**：平台归档入口跑的是同一个 `scanSensitiveFiles`，
+> 它直接从文件内容里解析 `hunter-harness-ignore`，命中转为 `overridden`、不再阻断。
+> 上传端点只收裸 ZIP、没有独立申报通道，靠的就是这条写在文档里的标注。
+>
+> ⚠️ 一处已知的服务端滞后：**不带凭据的连接串**（如 `postgres://dbhost:5432/appdb`）
+> 本地预检判 `low`/可豁免，而线上服务端目前仍判 `high`——high 不接受行内标注，
+> 这类设计文档暂时无法上传。平台侧修复已提交（见 hunter-platform
+> `fix(archive): 归档 422 给出可执行出路`），**部署后**两侧一致。在那之前遇到这一条：
+> 等平台部署，不要为了过扫描删掉连接串。带凭据的连接串（`user:pass@host`）两侧都是
+> `high`，必须真正脱敏。
 
 ### 二·B、归档补传（上传失败或历史归档缺条目）
 

package/harness/bundles/general/codebuddy/harness-codebase-map/SKILL.md

@@ -3,7 +3,7 @@ name: harness-codebase-map
 description: 分析现有代码库并生成 .harness/codebase/map/
   下的结构化代码库地图。用于陌生项目理解、重大改造前梳理、harness-sync 提示 map 过期后的人工刷新。
 ---
-<!-- generated by harness_deploy.py; core=2e7fe0fb0fef6467; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=b0e6891811c856ce; overlay=none; agent=codebuddy; do not edit -->
 # harness-codebase-map — 代码库地图
 
 ## Purpose

package/harness/bundles/general/codebuddy/harness-knowledge-ingest/SKILL.md

@@ -2,7 +2,7 @@
 name: harness-knowledge-ingest
 description: 确认归档 ZIP 已上传并由 Hunter Platform 在服务端解包、校验和入库。客户端不再构建或维护本地知识索引。
 ---
-<!-- generated by harness_deploy.py; core=2e7fe0fb0fef6467; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=b0e6891811c856ce; overlay=none; agent=codebuddy; do not edit -->
 # harness-knowledge-ingest
 
 知识 ingest 完全由 Hunter Platform 负责。归档完成时，客户端生成一个确定性 ZIP；

package/harness/bundles/general/codebuddy/harness-knowledge-query/SKILL.md

@@ -2,7 +2,7 @@
 name: harness-knowledge-query
 description: 在规划、实现或排查前，通过 hunter-harness CLI 查询远端项目知识库。远端不可用时直接报告不可用，不建立本地索引或离线回退。
 ---
-<!-- generated by harness_deploy.py; core=2e7fe0fb0fef6467; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=b0e6891811c856ce; overlay=none; agent=codebuddy; do not edit -->
 # harness-knowledge-query
 
 项目知识以 Hunter Platform 的服务端索引为唯一真源。客户端只提交查询并消费结果：

package/harness/bundles/general/codebuddy/harness-plan/SKILL.md

@@ -3,7 +3,7 @@ name: harness-plan
 description: 将需求转化为设计文档+实施计划+完整测试场景表，必须在编码前完成。仅当用户显式调用 /harness-plan 或明确要求进入
   Harness 规划阶段时使用；不得因用户描述需求就自动触发。
 ---
-<!-- generated by harness_deploy.py; core=2e7fe0fb0fef6467; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=b0e6891811c856ce; overlay=none; agent=codebuddy; do not edit -->
 # harness-plan — 需求规划
 
 ## Purpose

package/harness/bundles/general/codebuddy/harness-pull/SKILL.md

@@ -3,7 +3,7 @@ name: harness-pull
 description: 从 Hunter Platform 下拉配置/规则/架构/指令（及显式来源分支的分支文件恢复）。仅当用户显式调用
   /harness-pull 或明确说'从平台拉取/恢复'时使用；不得自动触发。
 ---
-<!-- generated by harness_deploy.py; core=2e7fe0fb0fef6467; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=b0e6891811c856ce; overlay=none; agent=codebuddy; do not edit -->
 # harness-pull — 从 Hunter Platform 下拉与恢复
 
 ## Purpose

package/harness/bundles/general/codebuddy/harness-push/SKILL.md

@@ -3,7 +3,7 @@ name: harness-push
 description: 上传本地配置/规则/架构/指令（及显式归档）到 Hunter Platform。仅当用户显式调用 /harness-push
   或明确说'上传到平台'时使用；不得因存在本地修改就自动触发。
 ---
-<!-- generated by harness_deploy.py; core=2e7fe0fb0fef6467; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=b0e6891811c856ce; overlay=none; agent=codebuddy; do not edit -->
 # harness-push — 上传到 Hunter Platform
 
 ## Purpose

package/harness/bundles/general/codebuddy/harness-review/SKILL.md

@@ -4,7 +4,7 @@ description: 6维度代码审查（架构/安全/规范/兼容/测试/性能）
   .harness/context-index.json）和测试场景表，在隔离上下文运行。仅当用户显式调用 /harness-review 时使用；不得在
   test 结束后自动接续执行。
 ---
-<!-- generated by harness_deploy.py; core=2e7fe0fb0fef6467; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=b0e6891811c856ce; overlay=none; agent=codebuddy; do not edit -->
 # harness-review — 代码审查
 
 ## Purpose

package/harness/bundles/general/codebuddy/harness-run/SKILL.md

@@ -3,7 +3,7 @@ name: harness-run
 description: 按变更簇执行 TDD 编码循环（RED→GREEN→REFACTOR→编译验证），逐变更簇实现计划中的任务。仅当用户显式调用
   /harness-run 时使用；不得因用户提到编码/实现就自动触发，也不得被其他阶段 skill 自动接续。
 ---
-<!-- generated by harness_deploy.py; core=2e7fe0fb0fef6467; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=b0e6891811c856ce; overlay=none; agent=codebuddy; do not edit -->
 # harness-run — 需求编码
 
 ## Purpose

package/harness/bundles/general/codebuddy/harness-submit/SKILL.md

@@ -3,7 +3,7 @@ name: harness-submit
 description: 最终提交封装：验证→中文 commit→提交/推送；worktree 模式含 --no-ff 合并回主分支。仅当用户显式调用
   /harness-submit（或 /harness-merge 重入合并段）时使用；用户口头说'提交/commit/push'时必须先确认，不得自动触发。
 ---
-<!-- generated by harness_deploy.py; core=2e7fe0fb0fef6467; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=b0e6891811c856ce; overlay=none; agent=codebuddy; do not edit -->
 # harness-submit — 最终提交（含 worktree 合并）
 
 ## Purpose

package/harness/bundles/general/codebuddy/harness-sync/SKILL.md

@@ -4,7 +4,7 @@ description: Use when the user asks to synchronize, refresh, or validate Harness
   metadata, adapters, remote knowledge ownership, instruction entrypoints,
   config origins, or CodeGraph status.
 ---
-<!-- generated by harness_deploy.py; core=2e7fe0fb0fef6467; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=b0e6891811c856ce; overlay=none; agent=codebuddy; do not edit -->
 # harness-sync
 
 ## Purpose

package/harness/bundles/general/codebuddy/harness-test/SKILL.md

@@ -3,7 +3,7 @@ name: harness-test
 description: 测试执行：读取场景表，执行单元测试+API接口测试+数据兼容验证，输出测试报告。仅当用户显式调用 /harness-test
   时使用；不得在 run 结束后自动接续执行。
 ---
-<!-- generated by harness_deploy.py; core=2e7fe0fb0fef6467; overlay=none; agent=codebuddy; do not edit -->
+<!-- generated by harness_deploy.py; core=b0e6891811c856ce; overlay=none; agent=codebuddy; do not edit -->
 # harness-test — 测试执行
 
 ## Purpose

package/harness/bundles/general/codebuddy/scripts/harness_archive.py

@@ -2599,23 +2599,12 @@ def check_status(
             }
         )
 
-    # 发布内容预检：与服务端同源的规则，扫的是真正会进 ZIP 的那批文件。
-    # 服务端策略不归本地裁决，所以只预警不阻断——但必须在归档开始时就说出来，
-    # 而不是等跑完全流程由 upload 返回 422。
-    content_scan = precheck_publication_content(change_dir)
-    checks["publication_content_scan"] = content_scan
-    if content_scan.get("blocked"):
-        warnings.append({
-            "code": "PUBLICATION_CONTENT_SCAN_FLAGGED",
-            "message": str(content_scan.get("nextAction") or ""),
-        })
-    elif not content_scan.get("ok"):
-        warnings.append({
-            "code": str(
-                content_scan.get("reasonCode") or "PUBLICATION_CONTENT_SCAN_UNAVAILABLE"
-            ),
-            "message": str(content_scan.get("message") or ""),
-        })
+    checks["publication_content_scan"] = {
+        "ok": True,
+        "scan_performed": False,
+        "findings": [],
+        "message": "上传归档链路已停用内容敏感扫描；保留路径、凭据与 ZIP 安全校验。",
+    }
 
     sensitive_gate = validate_sensitive_evidence_publication_gate(
         change_dir,
@@ -9408,6 +9397,9 @@ def resolve_hunter_cli_command(project_root: Path) -> list[str]:
     """Command prefix that runs the hunter-harness CLI, cheapest route first."""
     node = shutil.which("node")
     if node:
+        current_entry = os.environ.get("HUNTER_HARNESS_CLI_ENTRY", "").strip()
+        if current_entry and Path(current_entry).is_file():
+            return [node, str(Path(current_entry).resolve())]
         entry = _installed_cli_entry(project_root)
         if entry is not None:
             return [node, str(entry)]
@@ -9774,6 +9766,7 @@ def auto_push_archive_core(
     change_key: str | None = None,
     extra_entries: dict[str, tuple[str, str, bytes]] | None = None,
     reuse_retained_package: bool = False,
+    prepared_package: dict[str, Any] | None = None,
 ) -> dict[str, Any]:
     """Build and upload one deterministic core ZIP after finalize.
 
@@ -9786,11 +9779,13 @@ def auto_push_archive_core(
     """
     project_root = project_root.resolve()
     effective_change_key = change_key or archive_dir.name
-    package = (
-        load_retained_package(project_root, effective_change_key)
-        if reuse_retained_package
-        else None
-    )
+    package = prepared_package
+    if package is None:
+        package = (
+            load_retained_package(project_root, effective_change_key)
+            if reuse_retained_package
+            else None
+        )
     if package is None:
         try:
             package = build_archive_package(
@@ -10637,6 +10632,28 @@ def resolve_archive_dir_for_change(
     return archive_root / matches[-1], matches
 
 
+def resolve_latest_unpublished_archive(project_root: Path) -> tuple[str | None, list[str]]:
+    """Choose the newest sealed archive without a durable local receipt."""
+    archive_root = project_root / ".harness" / "archive"
+    if not archive_root.is_dir():
+        return None, []
+    candidates: list[tuple[str, str]] = []
+    for entry in archive_root.iterdir():
+        if not entry.is_dir():
+            continue
+        change = entry.name
+        try:
+            summary = read_json(entry / "reports" / "final" / "summary-data.json")
+            if isinstance(summary, dict) and isinstance(summary.get("changeName"), str):
+                change = str(summary["changeName"]).strip() or change
+        except (OSError, ValueError, json.JSONDecodeError):
+            pass
+        if read_durable_archive_receipt(project_root, change) is None:
+            candidates.append((entry.name, change))
+    candidates.sort(reverse=True)
+    return (candidates[0][1] if candidates else None), [item[1] for item in candidates]
+
+
 def _republish_knowledge_entry(archive_dir: Path) -> dict[str, tuple[str, str, bytes]]:
     """Knowledge candidates for archives sealed before the candidates step.
 
@@ -10707,12 +10724,26 @@ def cmd_republish(
         "changeKey": change_key,
         "dryRun": dry_run,
     }
+    root = resolve_republish_project_root(project_root, archive_dir)
+    if change_key == "latest":
+        selected, available = resolve_latest_unpublished_archive(root)
+        if selected is None:
+            payload.update({
+                "ok": True,
+                "reasonCode": "ARCHIVE_NO_UNPUBLISHED_ARCHIVE",
+                "noChanges": True,
+                "availableChanges": available,
+                "projectRoot": str(root)
+            })
+            return 0, payload
+        change_key = selected
+        payload["changeKey"] = change_key
+        payload["selectedChange"] = selected
     if re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9._-]{0,159}", change_key) is None:
         payload["error"] = "change key must be a portable path segment"
         payload["reasonCode"] = "ARCHIVE_CHANGE_KEY_INVALID"
         return 2, payload
 
-    root = resolve_republish_project_root(project_root, archive_dir)
     payload["projectRoot"] = str(root)
     matches: list[str] = []
     if archive_dir is None:
@@ -10821,7 +10852,7 @@ def cmd_republish(
     # distinct name; it must never be mistaken for a pending upload.
     preview_path = (
         root / ".harness" / "state" / "local" / "archive-packages"
-        / f"{change_key}.preview.zip"
+        / f"{change_key}{'.preview.zip' if dry_run else '.zip'}"
     )
     try:
         package = build_archive_package(
@@ -10837,7 +10868,8 @@ def cmd_republish(
         return 1, payload
     finally:
         try:
-            preview_path.unlink(missing_ok=True)
+            if dry_run:
+                preview_path.unlink(missing_ok=True)
         except OSError:
             pass
 
@@ -10907,6 +10939,7 @@ def cmd_republish(
         archive_dir,
         change_key=change_key,
         extra_entries=extra_entries,
+        prepared_package=package,
     )
     payload["push"] = result
     payload["ok"] = bool(result.get("ok"))

package/harness/bundles/general/codex/.harness-build.json

@@ -2,5 +2,5 @@
   "schemaVersion": 1,
   "overlay": "none",
   "agent": "codex",
-  "coreHash": "47340f933bad16d2"
+  "coreHash": "c0c77f0c226fcac9"
 }

package/harness/bundles/general/codex/harness-archive/SKILL.md

@@ -3,7 +3,7 @@ name: harness-archive
 description: 归档所有变更产出（计划/测试报告/审查/SQL/API文档）到 .harness/archive/，含归档元数据。仅当用户显式调用
   /harness-archive 时使用；不得被其他阶段 skill 自动接续触发。
 ---
-<!-- generated by harness_deploy.py; core=47340f933bad16d2; overlay=none; agent=codex; do not edit -->
+<!-- generated by harness_deploy.py; core=c0c77f0c226fcac9; overlay=none; agent=codex; do not edit -->
 # harness-archive — 变更归档
 
 ## Purpose
@@ -160,9 +160,16 @@ description: 归档所有变更产出（计划/测试报告/审查/SQL/API文档
 > ⚠️ 行内标注是**申报**，不是绕过：它把"这是设计决策"写进文档本身，可审计、可追溯。
 > **不要**为了过扫描去删改设计文档的事实内容——那是篡改证据。
 >
-> ⚠️ 已知限制：`hunter-harness-ignore` 在本地扫描器上确认生效；**服务端是否认这条标注尚未验证**
-> （归档上传端点只收裸 ZIP，没有独立的豁免申报通道）。若加了标注仍被 422 拒收，
-> 剩余动作是在平台侧对该规则/内容加白，本地无法自解。
+> ✅ 行内标注**服务端确认生效**：平台归档入口跑的是同一个 `scanSensitiveFiles`，
+> 它直接从文件内容里解析 `hunter-harness-ignore`，命中转为 `overridden`、不再阻断。
+> 上传端点只收裸 ZIP、没有独立申报通道，靠的就是这条写在文档里的标注。
+>
+> ⚠️ 一处已知的服务端滞后：**不带凭据的连接串**（如 `postgres://dbhost:5432/appdb`）
+> 本地预检判 `low`/可豁免，而线上服务端目前仍判 `high`——high 不接受行内标注，
+> 这类设计文档暂时无法上传。平台侧修复已提交（见 hunter-platform
+> `fix(archive): 归档 422 给出可执行出路`），**部署后**两侧一致。在那之前遇到这一条：
+> 等平台部署，不要为了过扫描删掉连接串。带凭据的连接串（`user:pass@host`）两侧都是
+> `high`，必须真正脱敏。
 
 ### 二·B、归档补传（上传失败或历史归档缺条目）