@walwal-harness/cli 6.1.5 → 7.1.0

package/scripts/harness-parity-audit.sh

@@ -0,0 +1,101 @@
+#!/bin/bash
+# harness-parity-audit.sh — compare installed project company-loop surface to walwal-harness
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+HARNESS_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+MANIFEST="$HARNESS_ROOT/assets/templates/company-pipeline-manifest.json"
+
+usage() {
+  echo "usage: bash scripts/harness-parity-audit.sh <project-root> [<project-root> ...]" >&2
+}
+
+[ "$#" -gt 0 ] || { usage; exit 2; }
+[ -f "$MANIFEST" ] || { echo "MISSING manifest: $MANIFEST" >&2; exit 2; }
+command -v jq >/dev/null 2>&1 || { echo "MISSING jq" >&2; exit 2; }
+
+sha() {
+  LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 shasum -a 256 "$1" | awk '{print $1}'
+}
+
+project_path_for() {
+  local rel="$1"
+  case "$rel" in
+    conventions/*) echo ".harness/$rel" ;;
+    gotchas/*) echo ".harness/$rel" ;;
+    skills/*) echo ".harness/$rel" ;;
+    *) echo "$rel" ;;
+  esac
+}
+
+config_core_filter() {
+  jq -S '
+    del(.project, .name, .description, .paths, .production, .telegram, .services, .owners, .runtime, .tech_stack, .integrations)
+  ' "$1"
+}
+
+status=0
+for project in "$@"; do
+  project="$(cd "$project" && pwd)"
+  echo "== $project =="
+
+  if [ ! -d "$project/.harness" ]; then
+    echo "DRIFT missing .harness"
+    status=1
+    continue
+  fi
+
+  while IFS= read -r rel; do
+    src="$HARNESS_ROOT/$rel"
+    dst="$project/$(project_path_for "$rel")"
+    if [ ! -f "$src" ]; then
+      echo "UPSTREAM_REQUIRED missing-source $rel"
+      status=1
+    elif [ ! -f "$dst" ]; then
+      echo "DRIFT missing $rel -> $(project_path_for "$rel")"
+      status=1
+    elif [ "$(sha "$src")" != "$(sha "$dst")" ]; then
+      echo "DRIFT hash $rel -> $(project_path_for "$rel")"
+      status=1
+    else
+      echo "PASS $rel"
+    fi
+  done < <(jq -r '.identical_files[]' "$MANIFEST")
+
+  while IFS=$'\t' read -r src_rel dst_rel mode; do
+    src="$HARNESS_ROOT/$src_rel"
+    dst="$project/$dst_rel"
+    if [ ! -f "$dst" ]; then
+      echo "DRIFT missing $dst_rel"
+      status=1
+    elif [ "$mode" = "identical" ] && [ "$(sha "$src")" != "$(sha "$dst")" ]; then
+      echo "DRIFT hash $src_rel -> $dst_rel"
+      status=1
+    else
+      echo "PASS $src_rel -> $dst_rel"
+    fi
+  done < <(jq -r '.template_mappings[] | [.source, .target, .mode] | @tsv' "$MANIFEST")
+
+  if [ -f "$project/.harness/config.json" ]; then
+    tmp_src="$(mktemp)"
+    tmp_dst="$(mktemp)"
+    config_core_filter "$HARNESS_ROOT/assets/templates/config.json" > "$tmp_src"
+    config_core_filter "$project/.harness/config.json" > "$tmp_dst"
+    if jq -e -s '.[0] == .[1]' "$tmp_src" "$tmp_dst" >/dev/null; then
+      echo "PASS config-core"
+    else
+      echo "DRIFT config-core"
+      diff -u "$tmp_src" "$tmp_dst" | sed 's/^/  /'
+      status=1
+    fi
+    rm -f "$tmp_src" "$tmp_dst"
+  else
+    echo "DRIFT missing .harness/config.json"
+    status=1
+  fi
+
+  echo
+done
+
+exit "$status"

package/scripts/harness-queue-manager.sh

@@ -141,7 +141,7 @@ cmd_init() {
         }) | from_entries
       )
     }
-  ' "$FEATURES" > "$QUEUE"
+  ' "$FEATURES" > "${QUEUE}.tmp.$$" && mv "${QUEUE}.tmp.$$" "$QUEUE"
 
   local ready_count blocked_count passed_count
   ready_count=$(jq '.queue.ready | length' "$QUEUE")

package/scripts/harness-runtime-stop.sh

@@ -0,0 +1,58 @@
+#!/bin/bash
+# harness-runtime-stop.sh — Stop walwal harness play/release runtime mode.
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/lib/harness-render-progress.sh"
+
+PROJECT_ROOT="$(resolve_harness_root "${HARNESS_PROJECT_ROOT:-.}")" || exit 1
+HARNESS_DIR="$PROJECT_ROOT/.harness"
+PROGRESS="$HARNESS_DIR/progress.json"
+CONFIG="$HARNESS_DIR/config.json"
+RUNTIME_DIR="$HARNESS_DIR/runtime"
+
+[ -d "$HARNESS_DIR" ] || { echo "ERROR: .harness/ not found" >&2; exit 1; }
+[ -f "$PROGRESS" ] || { echo "ERROR: .harness/progress.json not found" >&2; exit 1; }
+[ -f "$CONFIG" ] || { echo "ERROR: .harness/config.json not found" >&2; exit 1; }
+command -v jq >/dev/null 2>&1 || { echo "ERROR: jq is required" >&2; exit 1; }
+
+MODE_FILE="$RUNTIME_DIR/harness-mode"
+ts="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+stopped=0
+
+for pid_file in "$RUNTIME_DIR/play.pid" "$RUNTIME_DIR/release.pid"; do
+  [ -f "$pid_file" ] || continue
+  pid="$(cat "$pid_file" 2>/dev/null || true)"
+  if [ -n "$pid" ] && kill -0 "$pid" 2>/dev/null; then
+    kill "$pid" 2>/dev/null || true
+    sleep 1
+    if kill -0 "$pid" 2>/dev/null; then
+      kill -9 "$pid" 2>/dev/null || true
+    fi
+    stopped=$((stopped + 1))
+  fi
+  rm -f "$pid_file"
+done
+
+rm -f "$MODE_FILE"
+
+tmp_config="$(mktemp)"
+jq '
+  .runtime.build.live = false |
+  .runtime.production.live = false
+' "$CONFIG" > "$tmp_config" && mv "$tmp_config" "$CONFIG" || rm -f "$tmp_config"
+
+tmp="$(mktemp)"
+jq --arg ts "$ts" --arg reason "$*" '
+  .runtime_state.mode = "stopped" |
+  .runtime_state.stopped_at = $ts |
+  .runtime_state.stop_reason = $reason |
+  .runtime_state.pid = null |
+  .service_ops.requested_mode = null |
+  .service_ops.monitor.stream_active = false |
+  .runtime.build.live = false |
+  .runtime.production.live = false
+' "$PROGRESS" > "$tmp" && mv "$tmp" "$PROGRESS" || rm -f "$tmp"
+
+echo "stopped runtime processes: $stopped"

package/scripts/harness-service-ops-monitor.sh

@@ -1,7 +1,8 @@
 #!/bin/bash
 # harness-service-ops-monitor.sh — deterministic Service-Ops production check
 #
-# Reads .harness/config.json runtime.production.services[] and writes:
+# Reads .env plus .harness/config.json runtime.build.commands[] and
+# runtime.production.services[] and writes:
 #   - progress.json.service_ops.health[]
 #   - progress.json.service_ops.monitor.last_check
 #   - .harness/actions/ops-report-hourly-<timestamp>.md
@@ -26,6 +27,29 @@ command -v jq >/dev/null 2>&1 || exit 0
 
 mkdir -p "$ACTIONS_DIR" "$OPS_DIR"
 
+ENV_FILE="$PROJECT_ROOT/.env"
+env_base_port=""
+if [ -f "$ENV_FILE" ]; then
+  env_base_port="$(grep -E '^HARNESS_BASE_PORT=[0-9]' "$ENV_FILE" 2>/dev/null | tail -1 | cut -d= -f2- | tr -d '"' || true)"
+fi
+config_base_port="$(jq -r 'if .runtime.ports.base == null then "" else (.runtime.ports.base|tostring) end' "$CONFIG" 2>/dev/null || true)"
+base_port="${env_base_port:-$config_base_port}"
+
+if [ -z "$base_port" ]; then
+  echo "ERROR: HARNESS_BASE_PORT is not set." >&2
+  echo "" >&2
+  echo "  CEO must agree on a {xx}000 base port with the Owner and add it to .env:" >&2
+  echo "    HARNESS_BASE_PORT=3000" >&2
+  echo "" >&2
+  echo "  OPS cannot monitor ports without a declared base. Set the value and re-run." >&2
+  exit 1
+fi
+
+range_size="$(jq -r '.runtime.ports.range_size // 1000' "$CONFIG" 2>/dev/null || echo 1000)"
+range_max=$((base_port + range_size - 1))
+
+build_live=$(jq -r '.runtime.build.live // false' "$CONFIG" 2>/dev/null || echo false)
+build_count=$(jq -r '(.runtime.build.commands // []) | length' "$CONFIG" 2>/dev/null || echo 0)
 live=$(jq -r '.runtime.production.live // false' "$CONFIG" 2>/dev/null || echo false)
 service_count=$(jq -r '(.runtime.production.services // []) | length' "$CONFIG" 2>/dev/null || echo 0)
 ts="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
@@ -74,12 +98,92 @@ log_summary_json() {
     '{configured:true, exists:true, path:$path, recent_errors:$errors, last_line:$last}'
 }
 
+port_drift() {
+  local port="$1"
+  if [ -z "$port" ] || [ "$port" = "null" ]; then
+    echo "missing"
+  elif [ "$port" -lt "$base_port" ] || [ "$port" -gt "$range_max" ]; then
+    echo "outside_base_range"
+  else
+    echo "ok"
+  fi
+}
+
+build_results_file="$(mktemp)"
+: > "$build_results_file"
+if [ "$build_live" = "true" ] && [ "${build_count:-0}" -gt 0 ]; then
+  b=0
+  while [ "$b" -lt "$build_count" ]; do
+    cmd_cfg="$(jq -c ".runtime.build.commands[$b]" "$CONFIG")"
+    name="$(jq -r '.name // ("build-" + (input_line_number|tostring))' <<<"$cmd_cfg")"
+    cwd="$(jq -r '.cwd // "."' <<<"$cmd_cfg")"
+    command_text="$(jq -r '.command // empty' <<<"$cmd_cfg")"
+    expected_port="$(jq -r '.expected_port // empty' <<<"$cmd_cfg")"
+    log_path="$(jq -r '.log_path // empty' <<<"$cmd_cfg")"
+    owner="$(jq -r '.owner // "cto"' <<<"$cmd_cfg")"
+    drift="$(port_drift "$expected_port")"
+
+    port_state="not_configured"
+    if [ -n "$expected_port" ]; then
+      if tcp_check "127.0.0.1" "$expected_port"; then port_state="listening"; else port_state="down"; fi
+    fi
+
+    log_json="$(log_summary_json "$log_path")"
+    status="ok"
+    if [ "$drift" != "ok" ]; then
+      status="port_drift"
+    elif [ -n "$expected_port" ] && [ "$port_state" != "listening" ]; then
+      status="down"
+    elif [ "$(jq -r '.configured and (.exists|not)' <<<"$log_json")" = "true" ]; then
+      status="log_missing"
+    elif [ "$(jq -r '.recent_errors // 0' <<<"$log_json")" -gt 0 ]; then
+      status="warn"
+    fi
+
+    jq -n \
+      --arg ts "$ts" \
+      --arg name "$name" \
+      --arg cwd "$cwd" \
+      --arg command "$command_text" \
+      --arg expected_port "$expected_port" \
+      --arg owner "$owner" \
+      --arg port_state "$port_state" \
+      --arg port_drift "$drift" \
+      --arg status "$status" \
+      --argjson log "$log_json" \
+      '{
+        ts:$ts,
+        name:$name,
+        cwd:$cwd,
+        command:$command,
+        expected_port:(if $expected_port == "" or $expected_port == "null" then null else ($expected_port|tonumber?) end),
+        owner:$owner,
+        port_state:$port_state,
+        port_drift:$port_drift,
+        log:$log,
+        status:$status
+      }' >> "$build_results_file"
+    b=$((b + 1))
+  done
+fi
+build_results_json="$(jq -s '.' "$build_results_file")"
+rm -f "$build_results_file"
+
 if [ "$live" != "true" ] || [ "${service_count:-0}" -eq 0 ]; then
-  jq --arg ts "$ts" --arg report "$report_rel" '
+  jq --arg ts "$ts" --arg report "$report_rel" --argjson build "$build_results_json" '
     .service_ops.monitor.last_check = $ts |
     .service_ops.monitor.stream_active = false |
     .service_ops.monitor.last_report = $report |
-    .service_ops.health = []
+    .service_ops.build = $build |
+    .service_ops.health = [] |
+    .service_ops.incident.open = [] |
+    .service_ops.incident.signature = "" |
+    .service_ops.incident.repeat_count = 0 |
+    .service_ops.incident.recovery_required = false |
+    .service_ops.incident.partial_recovery = false |
+    .service_ops.incident.close_candidate = false |
+    .service_ops.incident.closed = false |
+    .service_ops.incident.last_seen_at = $ts
   ' "$PROGRESS" > "${PROGRESS}.tmp" && mv "${PROGRESS}.tmp" "$PROGRESS"
 
   {
@@ -87,10 +191,24 @@ if [ "$live" != "true" ] || [ "${service_count:-0}" -eq 0 ]; then
     echo ""
     echo "- ts: $ts"
     echo "- production.live: $live"
+    echo "- build.live: $build_live"
+    echo "- base_port: $base_port"
     echo "- services: $service_count"
+    echo "- build_commands: $build_count"
     echo "- verdict: NO_PRODUCTION_SERVICES"
     echo ""
-    echo "No production service endpoints are configured. Owner+CEO+CTO must define runtime.production.services[] before Service-Ops can monitor live servers."
+    echo "## Build Environments"
+    echo ""
+    echo "| Build | Command | Expected Port | Logs | Status |"
+    echo "|---|---|---:|---|---|"
+    jq -r '.[] |
+      "| \(.name) | `\(.command)` | " +
+      ((.expected_port // "n/a")|tostring) + " " + .port_state + " " + .port_drift +
+      " | " +
+      (if (.log.configured|not) then "not configured" elif (.log.exists|not) then "missing" else ((.log.recent_errors|tostring) + " recent errors") end) +
+      " | \(.status) |"' <<<"$build_results_json"
+    echo ""
+    echo "No production service endpoints are configured. Owner+CEO+CTO must define runtime.production.services[] before OPS can monitor live servers."
   } > "$report_path"
   echo "$report_rel"
   exit 0
@@ -103,14 +221,20 @@ i=0
 while [ "$i" -lt "$service_count" ]; do
   svc="$(jq -c ".runtime.production.services[$i]" "$CONFIG")"
   name="$(jq -r '.name // ("service-" + (input_line_number|tostring))' <<<"$svc")"
+  environment="$(jq -r '.environment // "unknown"' <<<"$svc")"
   host="$(jq -r '.host // "127.0.0.1"' <<<"$svc")"
   port="$(jq -r '.port // empty' <<<"$svc")"
   health_path="$(jq -r '.health_path // empty' <<<"$svc")"
   expected_status="$(jq -r '.expected_status // 200' <<<"$svc")"
   log_path="$(jq -r '.log_path // empty' <<<"$svc")"
+  owner="$(jq -r '.owner // "cto"' <<<"$svc")"
+  source="$(jq -r '.source // "owner-provided"' <<<"$svc")"
+  drift="$(port_drift "$port")"
 
   port_state="unknown"
-  if [ -n "$port" ] && tcp_check "$host" "$port"; then
+  if [ -z "$port" ] || [ "$port" = "null" ]; then
+    port_state="not_configured"
+  elif tcp_check "$host" "$port"; then
     port_state="listening"
   else
     port_state="down"
@@ -128,7 +252,9 @@ while [ "$i" -lt "$service_count" ]; do
   log_json="$(log_summary_json "$log_path")"
 
   status="ok"
-  if [ "$port_state" != "listening" ]; then
+  if [ "$drift" != "ok" ]; then
+    status="port_drift"
+  elif [ "$port_state" != "listening" ]; then
     status="down"
   elif [ "$health_ok" = "false" ]; then
     status="degraded"
@@ -141,6 +267,7 @@ while [ "$i" -lt "$service_count" ]; do
   jq -n \
     --arg ts "$ts" \
     --arg name "$name" \
+    --arg environment "$environment" \
     --arg host "$host" \
     --arg port "$port" \
     --arg port_state "$port_state" \
@@ -150,12 +277,16 @@ while [ "$i" -lt "$service_count" ]; do
     --arg health_status "$health_status" \
     --arg health_ok "$health_ok" \
     --arg status "$status" \
+    --arg owner "$owner" \
+    --arg source "$source" \
+    --arg port_drift "$drift" \
     --argjson log "$log_json" \
     '{
       ts:$ts,
       name:$name,
+      environment:$environment,
       host:$host,
-      port:($port|tonumber?),
+      port:(if $port == "" or $port == "null" then null else ($port|tonumber?) end),
       port_state:$port_state,
       health_path:(if $health_path == "" or $health_path == "null" then null else $health_path end),
       health_url:(if $health_url == "" then null else $health_url end),
@@ -163,6 +294,9 @@ while [ "$i" -lt "$service_count" ]; do
       health_status:(if $health_status == "null" then null else ($health_status|tonumber?) end),
       health_ok:(if $health_ok == "true" then true elif $health_ok == "false" then false else null end),
       log:$log,
+      owner:$owner,
+      source:$source,
+      port_drift:$port_drift,
       status:$status
     }' >> "$results_file"
   i=$((i + 1))
@@ -171,31 +305,65 @@ done
 results_json="$(jq -s '.' "$results_file")"
 rm -f "$results_file"
 
-down_count="$(jq '[.[] | select(.status == "down" or .status == "degraded")] | length' <<<"$results_json")"
-warn_count="$(jq '[.[] | select(.status == "warn" or .status == "log_missing")] | length' <<<"$results_json")"
+down_count="$(jq '[.[] | select(.status == "down" or .status == "degraded" or (.status == "port_drift" and .port_drift != "missing"))] | length' <<<"$results_json")"
+warn_count="$(jq '[.[] | select(.status == "warn" or .status == "log_missing" or (.status == "port_drift" and .port_drift == "missing"))] | length' <<<"$results_json")"
 ok_count="$(jq '[.[] | select(.status == "ok")] | length' <<<"$results_json")"
+build_warn_count="$(jq '[.[] | select(.status != "ok")] | length' <<<"$build_results_json")"
 verdict="OK"
-if [ "$down_count" -gt 0 ]; then verdict="INCIDENT"; elif [ "$warn_count" -gt 0 ]; then verdict="WARN"; fi
+if [ "$down_count" -gt 0 ]; then verdict="INCIDENT"; elif [ "$warn_count" -gt 0 ] || [ "$build_warn_count" -gt 0 ]; then verdict="WARN"; fi
 
 incidents_json="$(jq '
-  [ .[] | select(.status == "down" or .status == "degraded") |
+  [ .[] | select(.status == "down" or .status == "degraded" or (.status == "port_drift" and .port_drift != "missing")) |
     {
       id: ("OPS-" + (.name | ascii_upcase | gsub("[^A-Z0-9]+";"-"))),
       dept: "Operations",
       severity: (if .status == "down" then "critical" else "high" end),
-      message: (.name + " " + .status + " (" + .host + ":" + (.port|tostring) + ")"),
+      message: (.name + " " + .status + " (" + .environment + " " + .host + ":" + (.port|tostring) + ")"),
       ts: .ts
     }
   ]' <<<"$results_json")"
+incident_signature="$(jq -r '[.[].id] | sort | join(",")' <<<"$incidents_json")"
+prev_signature="$(jq -r '(.service_ops.incident.signature // "") as $s | if $s != "" then $s else ([.service_ops.incident.open[]?.id] | sort | join(",")) end' "$PROGRESS" 2>/dev/null || echo "")"
+prev_repeat="$(jq -r '.service_ops.incident.repeat_count // 0' "$PROGRESS" 2>/dev/null || echo 0)"
+repeat_count=0
+if [ -n "$incident_signature" ]; then
+  if [ -n "$prev_signature" ] && [ "${prev_repeat:-0}" -lt 1 ]; then
+    prev_repeat=1
+  fi
+  if [ "$incident_signature" = "$prev_signature" ]; then
+    repeat_count=$((prev_repeat + 1))
+  else
+    repeat_count=1
+  fi
+fi
+recovery_required=false
+if [ "$repeat_count" -ge 2 ]; then
+  recovery_required=true
+fi
+partial_recovery=false
+close_candidate=false
+if [ "$ok_count" -gt 0 ] && [ "$down_count" -gt 0 ]; then
+  partial_recovery=true
+elif [ "$down_count" -eq 0 ] && [ "$warn_count" -eq 0 ]; then
+  close_candidate=true
+fi
 
-jq --arg ts "$ts" --arg report "$report_rel" --argjson health "$results_json" --argjson incidents "$incidents_json" --argjson warn "$warn_count" --argjson alert "$down_count" '
+jq --arg ts "$ts" --arg report "$report_rel" --arg signature "$incident_signature" --argjson repeat "$repeat_count" --argjson recovery "$recovery_required" --argjson partial "$partial_recovery" --argjson close_candidate "$close_candidate" --argjson build "$build_results_json" --argjson health "$results_json" --argjson incidents "$incidents_json" --argjson warn "$warn_count" --argjson alert "$down_count" '
   .service_ops.monitor.stream_active = false |
   .service_ops.monitor.last_check = $ts |
   .service_ops.monitor.last_report = $report |
   .service_ops.monitor.warns_this_sprint = ((.service_ops.monitor.warns_this_sprint // 0) + $warn) |
   .service_ops.monitor.alerts_this_sprint = ((.service_ops.monitor.alerts_this_sprint // 0) + $alert) |
+  .service_ops.build = $build |
   .service_ops.health = $health |
-  .service_ops.incident.open = $incidents
+  .service_ops.incident.open = $incidents |
+  .service_ops.incident.signature = $signature |
+  .service_ops.incident.repeat_count = $repeat |
+  .service_ops.incident.recovery_required = $recovery |
+  .service_ops.incident.partial_recovery = $partial |
+  .service_ops.incident.close_candidate = $close_candidate |
+  .service_ops.incident.closed = (if $close_candidate then true else false end) |
+  .service_ops.incident.last_seen_at = $ts
 ' "$PROGRESS" > "${PROGRESS}.tmp" && mv "${PROGRESS}.tmp" "$PROGRESS"
 
 {
@@ -203,16 +371,37 @@ jq --arg ts "$ts" --arg report "$report_rel" --argjson health "$results_json" --
   echo ""
   echo "- ts: $ts"
   echo "- production.live: true"
+  echo "- build.live: $build_live"
+  echo "- base_port: $base_port"
   echo "- services: $service_count"
+  echo "- build_commands: $build_count"
   echo "- verdict: $verdict"
   echo "- ok: $ok_count"
   echo "- warnings: $warn_count"
   echo "- alerts: $down_count"
+  echo "- incident_signature: ${incident_signature:-none}"
+  echo "- repeat_count: $repeat_count"
+  echo "- recovery_required: $recovery_required"
+  echo "- partial_recovery: $partial_recovery"
+  echo "- close_candidate: $close_candidate"
+  echo ""
+  echo "## Build Environments"
+  echo ""
+  echo "| Build | Command | Expected Port | Logs | Status |"
+  echo "|---|---|---:|---|---|"
+  jq -r '.[] |
+    "| \(.name) | `\(.command)` | " +
+    ((.expected_port // "n/a")|tostring) + " " + .port_state + " " + .port_drift +
+    " | " +
+    (if (.log.configured|not) then "not configured" elif (.log.exists|not) then "missing" else ((.log.recent_errors|tostring) + " recent errors") end) +
+    " | \(.status) |"' <<<"$build_results_json"
+  echo ""
+  echo "## Service Environments"
   echo ""
-  echo "| Service | Port | Health | Logs | Status |"
-  echo "|---|---:|---|---|---|"
+  echo "| Service | Env | Port | Health | Logs | Status |"
+  echo "|---|---|---:|---|---|---|"
   jq -r '.[] |
-    "| \(.name) | \(.host):\(.port) \(.port_state) | " +
+    "| \(.name) | \(.environment) | \(.host):" + ((.port // "n/a")|tostring) + " \(.port_state) \(.port_drift) | " +
     (if .health_path == null then "n/a" else ((.health_status // "000")|tostring) + " expected " + ((.expected_status // 200)|tostring) end) +
     " | " +
     (if (.log.configured|not) then "not configured" elif (.log.exists|not) then "missing" else ((.log.recent_errors|tostring) + " recent errors") end) +
@@ -221,7 +410,7 @@ jq --arg ts "$ts" --arg report "$report_rel" --argjson health "$results_json" --
   echo "## Raw"
   echo ""
   echo '```json'
-  jq '.' <<<"$results_json"
+  jq -n --argjson build "$build_results_json" --argjson services "$results_json" '{build:$build, services:$services}'
   echo '```'
 } > "$report_path"
 

package/scripts/harness-stop.sh

@@ -22,11 +22,29 @@ command -v jq >/dev/null 2>&1 || exit 0
 
 PROGRESS="$CWD/.harness/progress.json"
 CONFIG="$CWD/.harness/config.json"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 
 # Opt-out
 AUTO_CHAIN=$(jq -r '.behavior.auto_chain_on_stop // true' "$CONFIG" 2>/dev/null || echo "true")
 if [ "$AUTO_CHAIN" != "true" ]; then exit 0; fi
 
+# CXX direct-execution guard:
+# If a mission has CXX documents but no worker reports, block the stop so the
+# company loop must hire/dispatch workers instead of ending with CXX-only work.
+if [ -x "$SCRIPT_DIR/harness-worker-evidence-validate.sh" ]; then
+  WORKER_EVIDENCE_JSON=$("$SCRIPT_DIR/harness-worker-evidence-validate.sh" "$CWD" json 2>/dev/null || true)
+  WORKER_EVIDENCE_OK=$(echo "$WORKER_EVIDENCE_JSON" | jq -r 'if has("ok") then .ok else true end' 2>/dev/null || echo true)
+  if [ "$WORKER_EVIDENCE_OK" != "true" ]; then
+    REASON=$(echo "$WORKER_EVIDENCE_JSON" | jq -r '
+      "CXX 직접 실행 차단: " +
+      ([.violations[] | "\(.mission) has CXX docs without worker reports: \(.docs | join(","))"] | join("; ")) +
+      ". harness-hiring/resource-manager로 전문 worker를 고용 또는 배정하고 .harness/documents/{mission}/workers/{worker-name}.md 를 남긴 뒤 계속하라."
+    ' 2>/dev/null || echo "CXX 직접 실행 차단: worker report가 없는 mission이 있습니다. hired worker 보고서를 먼저 생성하세요.")
+    jq -nc --arg reason "$REASON" '{decision:"block", reason:$reason}'
+    exit 0
+  fi
+fi
+
 # 무한루프 방지: 한 sprint 안에서 stop_chain_count 가 상한을 넘으면 중단
 STOP_CHAIN_MAX=$(jq -r '.behavior.auto_chain_max_per_sprint // 200' "$CONFIG" 2>/dev/null || echo 200)
 STOP_CHAIN_COUNT=$(jq -r '.conductor.stop_chain_count // 0' "$PROGRESS" 2>/dev/null || echo 0)

package/scripts/harness-wake-install.sh

@@ -123,6 +123,7 @@ cmd_install() {
   sed \
     -e "s|{{WAKE_SCRIPT}}|$WAKE_SH|g" \
     -e "s|{{LOG_DIR}}|$LOG_DIR|g" \
+    -e "s|{{HOME}}|$HOME|g" \
     "$template" > "$PLIST_PATH"
 
   # 기존 jobs 언로드 (idempotent)