@jaimevalasek/aioson 1.33.1 → 1.37.0

package/src/commands/feature-close.js

@@ -16,6 +16,7 @@ const fs = require('node:fs/promises');
 const path = require('node:path');
 const { contextDir, readFileSafe, parseFrontmatter } = require('../preflight-engine');
 const { runFeatureArchive } = require('./feature-archive');
+const { runStateReset } = require('./state-save');
 const dossierBootstrap = require('../dossier/dossier-bootstrap');
 const dossierStore = require('../dossier/store');
 const { emitDossierEvent } = require('../lib/dossier-telemetry');
@@ -26,6 +27,10 @@ const { runDistillation, readFeatureClassification } = require('../learning-loop
 const { openRuntimeDb } = require('../runtime-store');
 const { runNotify } = require('./notify');
 const { splitCurrentState, buildArchiveContent, parseActiveSlugs } = require('../current-state-trim');
+const {
+  evaluateContractIntegrityGate,
+  formatContractIntegrityGateError
+} = require('../harness/contract-integrity-gate');
 
 // P0 agent-loading-contract: a feature closing is the natural cadence to roll
 // aged-out current-state.md entries into the cold archive. Conservative window
@@ -298,6 +303,72 @@ async function archiveScoutsForFeature(targetDir, slug) {
   return result;
 }
 
+// retireDevStateForClosedFeature — clear the @dev cold-start pointer when it
+// still points at the feature being closed. @dev reads dev-state.md DIRECTLY on
+// cold start (its session-start protocol "starts on next_step immediately"),
+// bypassing the dev:resume-data guard that already checks features.md status —
+// so a stale pointer to a done feature would make a future @dev session try to
+// "resume" work that is already closed (e.g. next_step: aioson feature:close).
+// Only retires when active_feature matches this slug; a pointer to a DIFFERENT
+// active feature is left untouched. Archived (not blind-deleted) for audit via
+// the existing state:reset --archive path. Idempotent and best-effort.
+async function retireDevStateForClosedFeature(targetDir, ctxDir, slug) {
+  const statePath = path.join(ctxDir, 'dev-state.md');
+  const content = await readFileSafe(statePath);
+  if (!content) return { retired: false, reason: 'no_dev_state' };
+  const fm = parseFrontmatter(content);
+  const active = String(fm.active_feature || '').trim();
+  if (active !== slug) {
+    return { retired: false, reason: 'points_to_other', active_feature: active || null };
+  }
+  const reset = await runStateReset({
+    args: [targetDir],
+    options: { archive: true, json: true },
+    logger: { log() {} }
+  });
+  return {
+    retired: Boolean(reset && reset.removed),
+    archived: reset && reset.archived ? reset.archived : null
+  };
+}
+
+// retireWorkflowStateForClosedFeature — clear the per-feature workflow runtime
+// state when it still references the feature being closed. Both files live in
+// .aioson/context/, are not slug-named, and are excluded from feature:archive —
+// so without this they linger and break the NEXT feature:
+//   - workflow.state.json: seedFeatureWorkflowState refuses to seed a new slug
+//     while a stale feature state is present ("different_active_feature").
+//   - workflow-execute.json: its enabled agentic_policy is the autopilot signal
+//     downstream agents read — a stale one would auto-run the next feature.
+// Only clears when the file references THIS slug (feature mode); a project-mode
+// state or a pointer to another feature is left untouched. Best-effort.
+async function retireWorkflowStateForClosedFeature(ctxDir, slug) {
+  const retired = [];
+  const statePath = path.join(ctxDir, 'workflow.state.json');
+  const stateRaw = await readFileSafe(statePath);
+  if (stateRaw) {
+    try {
+      const st = JSON.parse(stateRaw);
+      if (st && st.mode === 'feature' && st.featureSlug === slug) {
+        await fs.unlink(statePath);
+        retired.push('workflow.state.json');
+      }
+    } catch { /* malformed — leave it for manual inspection */ }
+  }
+  const execPath = path.join(ctxDir, 'workflow-execute.json');
+  const execRaw = await readFileSafe(execPath);
+  if (execRaw) {
+    try {
+      const ex = JSON.parse(execRaw);
+      if (ex && ex.feature === slug) {
+        await fs.unlink(execPath);
+        retired.push('workflow-execute.json');
+      }
+    } catch { /* malformed — leave it */ }
+  }
+  return retired;
+}
+
 async function runFeatureClose({ args, options = {}, logger }) {
   const targetDir = path.resolve(process.cwd(), args[0] || '.');
   const slug = options.feature ? String(options.feature) : null;
@@ -323,15 +394,37 @@ async function runFeatureClose({ args, options = {}, logger }) {
 
   // 0a. Harness Done Gate (AC-HD-11 refined)
   // Only enforced on PASS — FAIL means QA already rejected and we want the
-  // closure to record that. Without `harness-contract.json` for the feature,
-  // behavior is unchanged (zero impact on MICRO/SMALL or any feature that
-  // never opted into the harness).
+  // closure to record that. Runtime features the CLI can detect (prototype or
+  // migration/Prisma evidence) must have a valid contract even on MICRO/SMALL;
+  // non-runtime features without a contract keep the historical lightweight path.
   if (verdict === 'PASS') {
     const planDir = path.join(targetDir, '.aioson', 'plans', slug);
     const contractPath = path.join(planDir, 'harness-contract.json');
     const progressPath = path.join(planDir, 'progress.json');
     const contractContent = await readFileSafe(contractPath);
     const progressContent = await readFileSafe(progressPath);
+    const force = options.force === true;
+
+    const integrityGate = await evaluateContractIntegrityGate(targetDir, slug, {
+      runChecks: Boolean(contractContent)
+    });
+    if (!integrityGate.ok) {
+      if (!force) {
+        const errMsg = formatContractIntegrityGateError(integrityGate);
+        if (options.json) {
+          return {
+            ok: false,
+            reason: 'harness_contract_gate_blocked',
+            feature: slug,
+            error: errMsg,
+            errors: integrityGate.errors
+          };
+        }
+        logger.log(errMsg);
+        return { ok: false, reason: 'harness_contract_gate_blocked' };
+      }
+      updates.push('harness contract gate: BYPASSED via --force');
+    }
 
     // REQ-13 (loop-guardrails): tema `publish` é gate de COMANDO — intercepta
     // o feature:close quando o contrato ativo o exige e não há gate publish
@@ -374,7 +467,6 @@ async function runFeatureClose({ args, options = {}, logger }) {
     }
 
     if (contractContent && progressContent) {
-      const force = options.force === true;
       let progress = null;
       try {
         progress = JSON.parse(progressContent);
@@ -446,6 +538,32 @@ async function runFeatureClose({ args, options = {}, logger }) {
     updates.push('features.md: not found (skipped)');
   }
 
+  // 2.5. Retire the @dev cold-start pointer if it still points at this feature.
+  // On PASS the feature is done; a lingering dev-state.md would make a future
+  // @dev cold-start try to resume it (it reads the file directly). FAIL leaves
+  // it — @dev keeps working the qa_failed feature. Never touches a pointer to a
+  // different active feature. Best-effort; never blocks the close.
+  if (verdict === 'PASS') {
+    try {
+      const ds = await retireDevStateForClosedFeature(targetDir, dir, slug);
+      if (ds.retired) {
+        updates.push(`dev-state.md: retired closed-feature pointer${ds.archived ? ` (archived to ${ds.archived})` : ''}`);
+      } else if (ds.reason === 'points_to_other') {
+        updates.push(`dev-state.md: left intact (points at ${ds.active_feature}, not ${slug})`);
+      }
+    } catch (err) {
+      updates.push(`dev-state.md: retire hook error (${(err && err.message) || err})`);
+    }
+    try {
+      const wf = await retireWorkflowStateForClosedFeature(dir, slug);
+      if (wf.length > 0) {
+        updates.push(`workflow state: retired ${wf.join(', ')} (closed-feature runtime state)`);
+      }
+    } catch (err) {
+      updates.push(`workflow state: retire hook error (${(err && err.message) || err})`);
+    }
+  }
+
   // 3. Update project-pulse.md
   const pulsePath = path.join(dir, 'project-pulse.md');
   const pulseUpdated = await updateProjectPulseFile(

package/src/commands/harness-check.js

@@ -1,175 +1,259 @@
-'use strict';
-
-/**
- * aioson harness:check [path] --slug=<slug> [--criteria=C1,C2] [--timeout=<ms>]
- * [--json] — runner standalone e determinístico de criteria[].verification.
- *
- * Executa os checks executáveis do contrato FORA do self:loop, para consumo
- * pelo @validator (verificação binária antes de julgamento LLM), pelo @dev
- * (feedback rápido pré-done) ou por CI. Reusa runCriteria/executeInSandbox —
- * NÃO cria runner novo.
- *
- * Read-only sobre progress.json: quem muda estado do circuito continua sendo
- * o ciclo harness:validate/apply-validation. Persiste o resultado em
- * `last-check-output.json` no plan dir (espelha a convenção
- * last-validator-output.json) e emite telemetria criteria_check_failed
- * (best-effort, nunca quebra).
- */
-
-const fs = require('node:fs');
-const path = require('node:path');
-
-const { validateContract, resolveContract } = require('../harness/contract-schema');
-const { runCriteria, DEFAULT_CHECK_TIMEOUT_MS } = require('../harness/criteria-runner');
-const { emitGuardEvent } = require('../harness/guard-events');
-const { findActiveContract } = require('../harness/active-contract');
-
-function resolveSlug(targetDir, options) {
-  const explicit = String(options.slug || '').trim();
-  if (explicit) return explicit;
-  try {
-    const active = findActiveContract(targetDir);
-    return active ? active.slug : '';
-  } catch {
-    return '';
-  }
-}
-
-async function runHarnessCheck({ args, options = {}, logger, t }) {
-  const targetDir = path.resolve(process.cwd(), args?.[0] || '.');
-  const slug = resolveSlug(targetDir, options);
-
-  if (!slug) {
-    logger.error(t('errors.missing_slug') || 'Error: --slug is required');
-    return { ok: false, error: 'missing_slug' };
-  }
-
-  const planDir = path.join(targetDir, '.aioson', 'plans', slug);
-  const contractPath = path.join(planDir, 'harness-contract.json');
-
-  if (!fs.existsSync(contractPath)) {
-    logger.error(t('harness.contract_not_found', { slug }) || `Contract not found for slug: ${slug}`);
-    return { ok: false, error: 'contract_not_found', slug };
-  }
-
-  let contract;
-  try {
-    contract = JSON.parse(fs.readFileSync(contractPath, 'utf8'));
-  } catch (err) {
-    logger.error(`Invalid JSON in contract: ${err.message}`);
-    return { ok: false, error: 'invalid_json', slug, detail: err.message };
-  }
-
-  const schemaResult = validateContract(contract);
-  if (!schemaResult.ok) {
-    const first = schemaResult.errors[0];
-    logger.error(`Contract schema invalid: ${first.field} — ${first.reason}`);
-    await emitGuardEvent(targetDir, {
-      eventType: 'contract_invalid',
-      agent: 'harness-check',
-      message: `${first.field}: ${first.reason}`,
-      payload: { slug }
-    });
-    return { ok: false, error: 'contract_schema_invalid', slug, errors: schemaResult.errors };
-  }
-
-  const resolved = resolveContract(contract);
-
-  let criteria = resolved.criteria;
-  if (options.criteria) {
-    const wanted = new Set(
-      String(options.criteria).split(',').map((id) => id.trim()).filter(Boolean)
-    );
-    criteria = criteria.filter((c) => c && wanted.has(c.id));
-    const found = new Set(criteria.map((c) => c.id));
-    const missing = [...wanted].filter((id) => !found.has(id));
-    if (missing.length) {
-      logger.error(t('harness.check_unknown_criteria', { ids: missing.join(', ') }) || `Unknown criteria ids: ${missing.join(', ')}`);
-      return { ok: false, error: 'unknown_criteria', slug, missing };
-    }
-  }
-
-  const timeoutMs = Number.isInteger(Number(options.timeout)) && Number(options.timeout) > 0
-    ? Number(options.timeout)
-    : DEFAULT_CHECK_TIMEOUT_MS;
-
-  const executable = criteria.filter(
-    (c) => c && typeof c.verification === 'string' && c.verification.trim()
-  );
-  const skipped = criteria.length - executable.length;
-  const strict = Boolean(options.strict);
-  const binaryWithoutVerification = criteria.filter(
-    (c) => c && c.binary === true && !(typeof c.verification === 'string' && c.verification.trim())
-  );
-  const strictErrors = [];
-  if (strict && criteria.length > 0 && executable.length === 0) {
-    strictErrors.push('strict mode requires at least one executable verification criterion');
-  }
-  if (strict && binaryWithoutVerification.length > 0) {
-    strictErrors.push(`strict mode requires verification for binary criteria: ${binaryWithoutVerification.map((c) => c.id).join(', ')}`);
-  }
-
-  const checks = await runCriteria({ criteria, cwd: targetDir, timeoutMs });
-  const failed = checks.filter((c) => !c.ok);
-
-  for (const check of failed) {
-    await emitGuardEvent(targetDir, {
-      eventType: 'criteria_check_failed',
-      agent: 'harness-check',
-      message: `${check.id}: exit ${check.exitCode}${check.timedOut ? ' (timeout)' : ''}`,
-      payload: { slug, criterion_id: check.id, exit_code: check.exitCode, signature: check.signature }
-    });
-  }
-
-  const report = {
-    ok: failed.length === 0 && strictErrors.length === 0,
-    slug,
-    checked_at: new Date().toISOString(),
-    strict,
-    criteria_total: criteria.length,
-    executable_total: executable.length,
-    passed: checks.length - failed.length,
-    failed: failed.length,
-    skipped_no_verification: skipped,
-    strict_errors: strictErrors,
-    checks
-  };
-
-  try {
-    if (!fs.existsSync(planDir)) fs.mkdirSync(planDir, { recursive: true });
-    fs.writeFileSync(
-      path.join(planDir, 'last-check-output.json'),
-      JSON.stringify(report, null, 2),
-      'utf8'
-    );
-  } catch (err) {
-    // Persistência é conveniência, não gate — reporta sem falhar o run.
-    logger.error(`Could not persist last-check-output.json: ${err.message}`);
-  }
-
-  if (options.json) {
-    logger.log(JSON.stringify(report, null, 2));
-    return report;
-  }
-
-  logger.log(t('harness.check_header', { slug }) || `Harness check — ${slug}`);
-  for (const error of strictErrors) {
-    logger.log(`  ✗ ${error}`);
-  }
-  if (executable.length === 0) {
-    logger.log(t('harness.check_no_executable', { total: criteria.length }) || `  No criteria with verification commands (${criteria.length} criteria total). @validator judges them all.`);
-    return report;
-  }
-  for (const check of checks) {
-    const mark = check.ok ? '✓' : '✗';
-    const extra = check.ok ? '' : ` (exit ${check.exitCode}${check.timedOut ? ', timeout' : ''})`;
-    logger.log(`  ${mark} ${check.id} — ${check.command}${extra} [${check.durationMs}ms]`);
-  }
-  logger.log(
-    t('harness.check_summary', { passed: report.passed, executable: executable.length, skipped }) ||
-    `  Checks: ${report.passed}/${executable.length} passed (${skipped} without verification — judged by @validator)`
-  );
-  return report;
-}
-
-module.exports = { runHarnessCheck };
+'use strict';
+
+/**
+ * aioson harness:check [path] --slug=<slug> [--criteria=C1,C2] [--timeout=<ms>]
+ * [--json] — runner standalone e determinístico de criteria[].verification.
+ *
+ * Executa os checks executáveis do contrato FORA do self:loop, para consumo
+ * pelo @validator (verificação binária antes de julgamento LLM), pelo @dev
+ * (feedback rápido pré-done) ou por CI. Reusa runCriteria/executeInSandbox —
+ * NÃO cria runner novo.
+ *
+ * Read-only sobre progress.json: quem muda estado do circuito continua sendo
+ * o ciclo harness:validate/apply-validation. Persiste o resultado em
+ * `last-check-output.json` no plan dir (espelha a convenção
+ * last-validator-output.json) e emite telemetria criteria_check_failed
+ * (best-effort, nunca quebra).
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { validateContract, resolveContract } = require('../harness/contract-schema');
+const { runCriteria, DEFAULT_CHECK_TIMEOUT_MS } = require('../harness/criteria-runner');
+const { evaluateStaticCriteria, isStaticCriterion } = require('../harness/static-criteria');
+const { emitGuardEvent } = require('../harness/guard-events');
+const { findActiveContract } = require('../harness/active-contract');
+const { checkContractIntegrity } = require('../harness/contract-integrity');
+const { detectRuntimeFeature, gitChangedFiles } = require('../harness/detect-runtime-feature');
+
+function readProgressSignals(planDir) {
+  // Same progress fields the contract-integrity gate consults, so standalone
+  // `harness:check` detects the identical migration surface (completed_steps +
+  // changed_files + touched_files) the workflow finalize / feature:close gate does.
+  try {
+    const progressPath = path.join(planDir, 'progress.json');
+    if (!fs.existsSync(progressPath)) return [];
+    const progress = JSON.parse(fs.readFileSync(progressPath, 'utf8'));
+    return [progress.completed_steps, progress.changed_files, progress.touched_files]
+      .flatMap((value) => (Array.isArray(value) ? value : []));
+  } catch {
+    return [];
+  }
+}
+
+function resolveSlug(targetDir, options) {
+  const explicit = String(options.slug || '').trim();
+  if (explicit) return explicit;
+  try {
+    const active = findActiveContract(targetDir);
+    return active ? active.slug : '';
+  } catch {
+    return '';
+  }
+}
+
+async function runHarnessCheck({ args, options = {}, logger, t }) {
+  const targetDir = path.resolve(process.cwd(), args?.[0] || '.');
+  const slug = resolveSlug(targetDir, options);
+
+  if (!slug) {
+    logger.error(t('errors.missing_slug') || 'Error: --slug is required');
+    return { ok: false, error: 'missing_slug' };
+  }
+
+  const planDir = path.join(targetDir, '.aioson', 'plans', slug);
+  const contractPath = path.join(planDir, 'harness-contract.json');
+
+  if (!fs.existsSync(contractPath)) {
+    logger.error(t('harness.contract_not_found', { slug }) || `Contract not found for slug: ${slug}`);
+    return { ok: false, error: 'contract_not_found', slug };
+  }
+
+  let contract;
+  try {
+    contract = JSON.parse(fs.readFileSync(contractPath, 'utf8'));
+  } catch (err) {
+    logger.error(`Invalid JSON in contract: ${err.message}`);
+    return { ok: false, error: 'invalid_json', slug, detail: err.message };
+  }
+
+  const schemaResult = validateContract(contract);
+  if (!schemaResult.ok) {
+    const first = schemaResult.errors[0];
+    logger.error(`Contract schema invalid: ${first.field} — ${first.reason}`);
+    await emitGuardEvent(targetDir, {
+      eventType: 'contract_invalid',
+      agent: 'harness-check',
+      message: `${first.field}: ${first.reason}`,
+      payload: { slug }
+    });
+    return { ok: false, error: 'contract_schema_invalid', slug, errors: schemaResult.errors };
+  }
+
+  const resolved = resolveContract(contract);
+
+  // ── Contract-integrity precheck (§2c, deterministic core of @validator Step 0) ──
+  // A runtime feature whose contract has no RG-* criterion, or that pads binary
+  // criteria with duplicate verification commands, cannot prove the app runs.
+  // Detection only fires on signals the framework locates reliably (prototype
+  // manifest, migration steps); the Play has_api trigger stays with @validator.
+  const runtime = detectRuntimeFeature(targetDir, slug, {
+    completedSteps: readProgressSignals(planDir),
+    changedFiles: gitChangedFiles(targetDir)
+  });
+  const integrity = checkContractIntegrity(contract, { isRuntimeFeature: runtime.isRuntimeFeature });
+  for (const err of integrity.errors) {
+    await emitGuardEvent(targetDir, {
+      eventType: 'contract_integrity_failed',
+      agent: 'harness-check',
+      message: `${err.code}: ${err.message}`,
+      payload: { slug, code: err.code, signals: runtime.signals }
+    });
+  }
+
+  let criteria = resolved.criteria;
+  if (options.criteria) {
+    const wanted = new Set(
+      String(options.criteria).split(',').map((id) => id.trim()).filter(Boolean)
+    );
+    criteria = criteria.filter((c) => c && wanted.has(c.id));
+    const found = new Set(criteria.map((c) => c.id));
+    const missing = [...wanted].filter((id) => !found.has(id));
+    if (missing.length) {
+      logger.error(t('harness.check_unknown_criteria', { ids: missing.join(', ') }) || `Unknown criteria ids: ${missing.join(', ')}`);
+      return { ok: false, error: 'unknown_criteria', slug, missing };
+    }
+  }
+
+  const timeoutMs = Number.isInteger(Number(options.timeout)) && Number(options.timeout) > 0
+    ? Number(options.timeout)
+    : DEFAULT_CHECK_TIMEOUT_MS;
+
+  const executable = criteria.filter(
+    (c) => c && typeof c.verification === 'string' && c.verification.trim()
+  );
+  // Static (SG-*) criteria are deterministically checkable too — they are NOT
+  // "skipped / @validator-judged", so exclude them from that count and from the
+  // strict-mode verification-debt checks below.
+  const staticCriteria = criteria.filter((c) => isStaticCriterion(c));
+  const skipped = criteria.length - executable.length - staticCriteria.length;
+  const strict = Boolean(options.strict);
+  const binaryWithoutVerification = criteria.filter(
+    (c) => c && c.binary === true && !(typeof c.verification === 'string' && c.verification.trim()) && !isStaticCriterion(c)
+  );
+  const strictErrors = [];
+  if (strict && criteria.length > 0 && executable.length === 0 && staticCriteria.length === 0) {
+    strictErrors.push('strict mode requires at least one executable or static (SG-*) verification criterion');
+  }
+  if (strict && binaryWithoutVerification.length > 0) {
+    strictErrors.push(`strict mode requires verification for binary criteria: ${binaryWithoutVerification.map((c) => c.id).join(', ')}`);
+  }
+
+  const checks = await runCriteria({ criteria, cwd: targetDir, timeoutMs });
+  const failed = checks.filter((c) => !c.ok);
+
+  // SG-* static criteria — build-independent (fs + RegExp + parse), evaluated on
+  // every run (cheap). They gate the report just like executable criteria.
+  const staticResult = evaluateStaticCriteria({ criteria, cwd: targetDir });
+  const staticFailed = staticResult.checks.filter((c) => !c.ok);
+
+  for (const check of failed) {
+    await emitGuardEvent(targetDir, {
+      eventType: 'criteria_check_failed',
+      agent: 'harness-check',
+      message: `${check.id}: exit ${check.exitCode}${check.timedOut ? ' (timeout)' : ''}`,
+      payload: { slug, criterion_id: check.id, exit_code: check.exitCode, signature: check.signature }
+    });
+  }
+  for (const check of staticFailed) {
+    await emitGuardEvent(targetDir, {
+      eventType: 'criteria_check_failed',
+      agent: 'harness-check',
+      message: `${check.id}: ${check.detail}`,
+      payload: { slug, criterion_id: check.id, kind: 'static' }
+    });
+  }
+
+  const report = {
+    ok: failed.length === 0 && staticFailed.length === 0 && strictErrors.length === 0 && integrity.ok,
+    slug,
+    checked_at: new Date().toISOString(),
+    strict,
+    criteria_total: criteria.length,
+    executable_total: executable.length,
+    passed: checks.length - failed.length,
+    failed: failed.length,
+    skipped_no_verification: skipped,
+    static_total: staticResult.total,
+    static_passed: staticResult.total - staticFailed.length,
+    static_failed: staticFailed.length,
+    strict_errors: strictErrors,
+    integrity: {
+      ok: integrity.ok,
+      is_runtime_feature: runtime.isRuntimeFeature,
+      runtime_signals: runtime.signals,
+      errors: integrity.errors,
+      warnings: integrity.warnings
+    },
+    checks,
+    static_checks: staticResult.checks
+  };
+
+  try {
+    if (!fs.existsSync(planDir)) fs.mkdirSync(planDir, { recursive: true });
+    fs.writeFileSync(
+      path.join(planDir, 'last-check-output.json'),
+      JSON.stringify(report, null, 2),
+      'utf8'
+    );
+  } catch (err) {
+    // Persistência é conveniência, não gate — reporta sem falhar o run.
+    logger.error(`Could not persist last-check-output.json: ${err.message}`);
+  }
+
+  if (options.json) {
+    logger.log(JSON.stringify(report, null, 2));
+    return report;
+  }
+
+  logger.log(t('harness.check_header', { slug }) || `Harness check — ${slug}`);
+  for (const err of integrity.errors) {
+    logger.log(`  ✗ contract-integrity (${err.code}): ${err.message}`);
+  }
+  for (const warn of integrity.warnings) {
+    logger.log(`  ⚠ contract-integrity (${warn.code}): ${warn.message}`);
+  }
+  for (const error of strictErrors) {
+    logger.log(`  ✗ ${error}`);
+  }
+  // SG-* static criteria render on every run — they are build-independent.
+  for (const check of staticResult.checks) {
+    const mark = check.ok ? '✓' : '✗';
+    const extra = check.ok ? ` [${check.files.join(', ')}]` : ` — ${check.detail}`;
+    logger.log(`  ${mark} ${check.id} (static)${extra}`);
+  }
+  if (executable.length === 0) {
+    if (staticResult.total > 0) {
+      logger.log(`  Static: ${report.static_passed}/${staticResult.total} SG-* passed${skipped > 0 ? ` (${skipped} without verification — judged by @validator)` : ''}.`);
+    } else {
+      logger.log(t('harness.check_no_executable', { total: criteria.length }) || `  No criteria with verification commands (${criteria.length} criteria total). @validator judges them all.`);
+    }
+    return report;
+  }
+  for (const check of checks) {
+    const mark = check.ok ? '✓' : '✗';
+    const extra = check.ok ? '' : ` (exit ${check.exitCode}${check.timedOut ? ', timeout' : ''})`;
+    logger.log(`  ${mark} ${check.id} — ${check.command}${extra} [${check.durationMs}ms]`);
+  }
+  logger.log(
+    t('harness.check_summary', { passed: report.passed, executable: executable.length, skipped }) ||
+    `  Checks: ${report.passed}/${executable.length} passed (${skipped} without verification — judged by @validator)`
+  );
+  if (staticResult.total > 0) {
+    logger.log(`  Static: ${report.static_passed}/${staticResult.total} SG-* passed.`);
+  }
+  return report;
+}
+
+module.exports = { runHarnessCheck };