@walwal-harness/cli 7.1.56 → 7.1.58

package/scripts/harness-lessons-gate.sh

@@ -11,17 +11,19 @@
 #   ## Lessons Preflight   — which convention/gotcha items apply, and why
 #   ## Lessons Tally       — one line: which of them actually fired ("0 fired" is valid)
 #
-# Usage: harness-lessons-gate.sh <project-root> [text|json] [all|latest-active]
+# Usage: harness-lessons-gate.sh <project-root> [text|json] [all|latest-active|mission:<rel>]
 set -euo pipefail
 
 PROJECT_ROOT="${1:-.}"
 DOC_ROOT="$PROJECT_ROOT/.harness/documents"
 CONFIG="$PROJECT_ROOT/.harness/config.json"
 
-[ -d "$DOC_ROOT" ] || exit 0
-
 mode="${2:-text}"
 scope="${3:-all}"
+if [ ! -d "$DOC_ROOT" ]; then
+  [[ "$scope" != mission:* && "$mode" != direct-work-sha ]] || exit 1
+  exit 0
+fi
 
 # Opt-out for projects that have not adopted the sections yet.
 if command -v jq >/dev/null 2>&1 && [ -f "$CONFIG" ]; then
@@ -57,7 +59,10 @@ mission_mtime() {
   stat -f '%m' "$1" 2>/dev/null || stat -c '%Y' "$1" 2>/dev/null || echo 0
 }
 
-mission_dirs=$(find "$DOC_ROOT" -type f \( -name 'ceo.md' -o -name 'coo.md' -o -name 'cdo.md' -o -name 'cto.md' -o -name 'cqo.md' -o -name 'ops.md' \) -exec dirname {} \; 2>/dev/null | sort -u)
+mission_dirs=""
+if [[ "$scope" != mission:* ]]; then
+  mission_dirs=$(find "$DOC_ROOT" -type f \( -name 'ceo.md' -o -name 'coo.md' -o -name 'cdo.md' -o -name 'cto.md' -o -name 'cqo.md' -o -name 'ops.md' \) -exec dirname {} \; 2>/dev/null | sort -u)
+fi
 
 if [ "$scope" = "latest-active" ]; then
   latest_active_mission=""
@@ -83,14 +88,37 @@ EOF
   mission_dirs="$latest_active_mission"
 fi
 
+if [[ "$scope" == mission:* ]]; then
+  mission_rel="${scope#mission:}"
+  case "$mission_rel" in ""|/*|*..*) echo "invalid mission path" >&2; exit 1 ;; esac
+  mission_dirs="$(cd "$DOC_ROOT/$mission_rel" 2>/dev/null && pwd -P)" || exit 1
+  case "$mission_dirs/" in "$(cd "$DOC_ROOT" && pwd -P)/"*) ;; *) exit 1 ;; esac
+  [ -f "$mission_dirs/mission-state.json" ] || exit 1
+fi
+
 while IFS= read -r mission_dir; do
   [ -n "$mission_dir" ] || continue
   [ -d "$mission_dir" ] || continue
   mission_name="${mission_dir#"$DOC_ROOT"/}"
+  tier=2
+  if [ -f "$mission_dir/mission-state.json" ]; then
+    tier=$(jq -r 'def r: if . == "S" then 0 elif . == "M" then 1 else 2 end;
+      [.tier, (.tier_history[]? | .from, .to)] | map(r) | max' "$mission_dir/mission-state.json")
+  fi
+  if [ -f "$PROJECT_ROOT/.harness/config.json" ]; then
+    enabled=$(jq -r 'if .behavior.mission_tiers == null then true else .behavior.mission_tiers end' "$PROJECT_ROOT/.harness/config.json")
+    [ "$enabled" != false ] || tier=2
+  fi
 
   for role in ceo coo cdo cto cqo ops; do
     role_path="$mission_dir/$role.md"
     [ -s "$role_path" ] || continue
+    if [[ "$role" == coo || "$role" == cdo || "$role" == ops ]] && has_section "$role_path" "Not Applicable"; then
+      continue
+    fi
+    if [ "$tier" -lt 2 ] && has_section "$role_path" "Lessons"; then
+      continue
+    fi
     if ! has_section "$role_path" "Lessons Preflight"; then
       violations+=("$mission_name:$role.md-missing-lessons-preflight")
     fi
@@ -116,12 +144,13 @@ if [ "$mode" = "json" ]; then
     | {ok:false, violations:.}
   '
 else
-  echo "Lessons-before-plan violation (AGENTS.md Hard Rule 20):"
+  echo "Lessons-before-plan violation (AGENTS.md Hard Rule 20; unknown tier → L):"
   for violation in "${violations[@]}"; do
     mission="${violation%%:*}"
     docs="${violation#*:}"
     echo "- mission: $mission"
     echo "  issue: $docs"
+    echo "  S/M role documents may instead use ## Lessons (Preflight/Fired)."
     echo "  required: '## Lessons Preflight' (which convention/gotcha items apply, and why)"
     echo "            '## Lessons Tally' (one line: which fired; '0 fired' is valid and must be stated)"
   done

package/scripts/harness-secret-scan.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+# Pass variable names, never secret values, on the command line. Do not use bash -x.
+set -o pipefail
+fail() { echo "[secret-scan] $*" >&2; exit 2; }
+VALS=()
+while [ "$#" -gt 0 ] && [ "$1" != -- ]; do
+  [[ "$1" =~ ^[a-zA-Z_][a-zA-Z0-9_]*$ ]] || fail "invalid variable name"
+  [ -n "${!1}" ] || fail "unset or empty variable: $1"
+  VALS+=("${!1}")
+  shift
+done
+[ "${#VALS[@]}" -gt 0 ] && [ "${1:-}" = -- ] || fail "expected VAR_NAME... -- PATH..."
+shift
+[ "$#" -gt 0 ] || fail "no paths"
+for path in "$@"; do [ -e "$path" ] || fail "missing path"; done
+OUT=$(grep -rlF -f <(printf '%s\n' "${VALS[@]}") -- "$@")
+RC=$?
+COUNT=0
+if [ -n "$OUT" ]; then
+  while IFS= read -r path; do
+    printf 'leak: %s\n' "$path"
+    COUNT=$((COUNT+1))
+  done <<< "$OUT"
+fi
+case "$RC" in
+  0) printf 'leaks=%s\n' "$COUNT"; exit 1 ;;
+  1) echo 'leaks=0'; exit 0 ;;
+  *) echo "scan incomplete (grep rc=$RC)" >&2; exit 2 ;;
+esac

package/scripts/harness-spec-pin.sh

@@ -0,0 +1,91 @@
+#!/bin/bash
+# harness-spec-pin.sh — AGENTS.md Hard Rule 4 (spec-pin clause).
+#
+# A category is complete AGAINST A SPEC VERSION, never in the abstract. Measured:
+# a spec moved v0.7 -> v0.9, changing a response contract, while the category
+# built against v0.7 sat marked complete — two later revisions had landed
+# silently, and nothing in the harness recorded which version the work was for.
+# The symptom was a lookup key that no longer matched: no error, no log, three
+# overlays dropped as null.
+#
+# Usage:
+#   harness-spec-pin.sh <project-root> <mission-rel> add <name> <path> [version]
+#   harness-spec-pin.sh <project-root> <mission-rel> verify [text|json]
+#   harness-spec-pin.sh <project-root> <mission-rel> list
+set -uo pipefail
+
+PROJECT_ROOT="${1:-.}"
+MISSION_REL="${2:-}"
+CMD="${3:-verify}"
+DOCS="$PROJECT_ROOT/.harness/documents"
+PINS="$DOCS/$MISSION_REL/spec-pins.json"
+
+command -v jq >/dev/null 2>&1 || { echo "[spec-pin] jq required" >&2; exit 2; }
+[ -n "$MISSION_REL" ] || { echo "[spec-pin] mission path required" >&2; exit 2; }
+
+hash_of() {
+  local f="$1"
+  [ -f "$f" ] || { printf 'MISSING'; return; }
+  if command -v shasum >/dev/null 2>&1; then shasum -a 256 "$f" | awk '{print $1}'
+  elif command -v sha256sum >/dev/null 2>&1; then sha256sum "$f" | awk '{print $1}'
+  else printf 'NOHASHER'; fi
+}
+
+case "$CMD" in
+  add)
+    name="${4:-}"; specpath="${5:-}"; version="${6:-unversioned}"
+    [ -n "$name" ] && [ -n "$specpath" ] || { echo "[spec-pin] usage: add <name> <path> [version]" >&2; exit 2; }
+    mkdir -p "$(dirname "$PINS")"
+    [ -f "$PINS" ] || echo '{"pins":[]}' > "$PINS"
+    abs="$specpath"; case "$specpath" in /*) ;; *) abs="$PROJECT_ROOT/$specpath" ;; esac
+    h="$(hash_of "$abs")"
+    tmp="$(mktemp)"
+    jq --arg n "$name" --arg p "$specpath" --arg v "$version" --arg h "$h" \
+       '.pins = ((.pins // []) | map(select(.name != $n)) + [{name:$n, path:$p, version:$v, sha256:$h, pinned_at:(now|todate)}])' \
+       "$PINS" > "$tmp" && mv "$tmp" "$PINS"
+    echo "[spec-pin] pinned $name @ $version ($h)"
+    ;;
+  list)
+    [ -f "$PINS" ] && jq -r '.pins[] | "- \(.name) @ \(.version) — \(.path) [\(.sha256[0:12])]"' "$PINS" || echo "(no pins)"
+    ;;
+  verify)
+    mode="${4:-text}"
+    # No pins file is not a failure: not every mission builds against an external spec.
+    if [ ! -f "$PINS" ]; then
+      [ "$mode" = "json" ] && jq -nc '{ok:true, drifted:[], pinned:0}'
+      exit 0
+    fi
+    drifted=()
+    while IFS=$'\t' read -r name specpath version want; do
+      [ -n "$name" ] || continue
+      abs="$specpath"; case "$specpath" in /*) ;; *) abs="$PROJECT_ROOT/$specpath" ;; esac
+      got="$(hash_of "$abs")"
+      [ "$got" = "NOHASHER" ] && continue
+      if [ "$got" != "$want" ]; then
+        if [ "$got" = "MISSING" ]; then drifted+=("$name|$version|spec file is gone: $specpath")
+        else drifted+=("$name|$version|content changed since it was pinned: $specpath"); fi
+      fi
+    done < <(jq -r '.pins[]? | [.name, .path, .version, .sha256] | @tsv' "$PINS" 2>/dev/null)
+    total="$(jq '[.pins[]?] | length' "$PINS" 2>/dev/null || echo 0)"
+    if [ "${#drifted[@]}" -eq 0 ]; then
+      [ "$mode" = "json" ] && jq -nc --argjson n "$total" '{ok:true, drifted:[], pinned:$n}'
+      [ "$mode" = "text" ] && echo "[spec-pin] $total pin(s) still match the current documents"
+      exit 0
+    fi
+    if [ "$mode" = "json" ]; then
+      printf '%s\n' "${drifted[@]}" | jq -Rcs 'split("\n")[:-1] | map(split("|") | {name:.[0], pinned_version:.[1], detail:.[2]}) | {ok:false, drifted:.}'
+    else
+      echo "Spec pin drift (AGENTS.md Hard Rule 4):"
+      for d in "${drifted[@]}"; do
+        rest="${d#*|}"
+        echo "- ${d%%|*} (built against ${rest%%|*})"
+        echo "    ${d##*|}"
+      done
+      echo "  This mission was built against a spec that has since moved. Re-check the"
+      echo "  affected work before marking anything complete, then re-pin:"
+      echo "    scripts/harness-spec-pin.sh . $MISSION_REL add <name> <path> <new-version>"
+    fi
+    exit 1
+    ;;
+  *) echo "[spec-pin] unknown command: $CMD" >&2; exit 2 ;;
+esac

package/scripts/harness-stop.sh

@@ -160,10 +160,10 @@ if [ -x "$SCRIPT_DIR/harness-worker-evidence-validate.sh" ]; then
   WORKER_EVIDENCE_OK=$(echo "$WORKER_EVIDENCE_JSON" | jq -r 'if has("ok") then .ok else true end' 2>/dev/null || echo true)
   if [ "$WORKER_EVIDENCE_OK" != "true" ]; then
     REASON=$(echo "$WORKER_EVIDENCE_JSON" | jq -r '
-      "CXX 직접 실행 차단: " +
-      ([.violations[] | "\(.mission) has CXX docs without worker reports: \(.docs | join(","))"] | join("; ")) +
-      ". harness-hiring/resource-manager로 전문 worker를 고용 또는 배정하고 .harness/documents/{goal-or-child-mission}/{owning-cxx}/workers/{worker-name}.md 를 남긴 뒤 계속하라."
-    ' 2>/dev/null || echo "CXX 직접 실행 차단: worker report가 없는 active mission이 있습니다. hired worker 보고서를 먼저 생성하세요.")
+      "등급별 worker/문서 증거 차단: " +
+      ([.violations[] | "\(.mission) has evidence violations: \(.docs | join(","))"] | join("; ")) +
+      ". S의 CTO/CQO만 worker 면제이며 S/M 역할 Notes는 축약 가능하다. 나머지는 harness-hiring/resource-manager로 전문 worker를 고용 또는 배정하고 .harness/documents/{goal-or-child-mission}/{owning-cxx}/workers/{worker-name}.md 를 남긴 뒤 계속하라."
+    ' 2>/dev/null || echo "등급별 worker/문서 증거 차단: worker report가 없는 active mission이 있습니다. hired worker 보고서를 먼저 생성하세요.")
     jq -nc --arg reason "$REASON" '{decision:"block", reason:$reason}'
     exit 0
   fi
@@ -184,7 +184,7 @@ if [ -x "$SCRIPT_DIR/harness-lessons-gate.sh" ]; then
       ([.violations[] | "\(.mission) → \(.docs | join(","))"] | join("; ")) +
       ". 각 role 문서에 `## Lessons Preflight`(이 미션에 적용되는 conventions/gotchas 항목과 이유)와 " +
       "그 아래 `## Implementation Notes` 바로 앞에 한 줄짜리 `## Lessons Tally`(실제로 발동한 항목; `0 fired` 도 유효하며 생략은 불가)를 " +
-      "추가한 뒤 계속하라. 코퍼스를 다시 요약한 별도 체크리스트 파일을 만들지 말 것 — 읽는 순서를 고치는 규칙이다."
+      "추가한 뒤 계속하라. S/M 역할 문서는 ## Lessons (Preflight/Fired) 한 섹션으로 대체 가능하다. 코퍼스를 다시 요약한 별도 체크리스트 파일을 만들지 말 것 — 읽는 순서를 고치는 규칙이다."
     ' 2>/dev/null || echo "교훈 선행 게이트(Hard Rule 20): active mission 의 role 문서에 ## Lessons Preflight / ## Lessons Tally 가 없습니다. 먼저 추가하세요.")
     jq -nc --arg reason "$REASON" '{decision:"block", reason:$reason}'
     exit 0

package/scripts/harness-verify-fingerprint.sh

@@ -0,0 +1,71 @@
+#!/bin/bash
+# Source identity is necessary, not sufficient: see CQO Evidence Reuse.
+set -o pipefail
+fail() { echo "[verify-fingerprint] $*" >&2; exit 2; }
+CMD=fingerprint
+ROOT=.
+LOG=
+INCLUDES=()
+[ "${1:-}" != run ] || { CMD=run; shift; }
+SEPARATOR=false
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --root|--include|--log)
+      [ "$#" -ge 2 ] && [ -n "$2" ] || fail "missing option value"
+      case "$1" in
+        --root) ROOT=$2 ;;
+        --include) INCLUDES+=("$2") ;;
+        --log) LOG=$2 ;;
+      esac
+      shift 2 ;;
+    --) SEPARATOR=true; shift; break ;;
+    *) fail "unknown option" ;;
+  esac
+done
+if [ "$CMD" = run ]; then
+  [ -n "$LOG" ] && [ "$SEPARATOR" = true ] && [ "$#" -gt 0 ] || fail "run requires --log PATH and -- CMD..."
+else
+  [ "$SEPARATOR" = false ] && [ -z "$LOG" ] || fail "unexpected run options"
+fi
+cd -- "$ROOT" 2>/dev/null || fail "invalid root"
+ROOT=$(git rev-parse --show-toplevel 2>/dev/null) || fail "not a git repository"
+cd -- "$ROOT" || fail "invalid repository root"
+if command -v shasum >/dev/null 2>&1; then HASH=(shasum -a 256)
+elif command -v sha256sum >/dev/null 2>&1; then HASH=(sha256sum)
+else fail "SHA-256 tool required"; fi
+hash() { "${HASH[@]}" | awk '{print $1}'; }
+PATHS=(. ':(top,exclude).harness' ':(top,exclude).myterm')
+file_input() {
+  printf '%s\0' "$1"
+  if [ -e "$1" ] || [ -L "$1" ]; then
+    [ -f "$1" ] || return 2
+    hash < "$1" || return 2
+  else printf 'MISSING\n'; fi
+}
+fingerprint() {
+  {
+    git rev-parse --verify HEAD || return 2
+    git diff HEAD --binary --no-ext-diff --no-textconv -- "${PATHS[@]}" || return 2
+    git ls-files --others --exclude-standard -z -- "${PATHS[@]}" |
+      while IFS= read -r -d '' file; do file_input "$file" || exit 2; done || return 2
+    for file in "${INCLUDES[@]}"; do file_input "$file" || return 2; done
+  } | hash
+}
+BEFORE=$(fingerprint) || fail "cannot fingerprint inputs"
+case "$CMD" in
+  fingerprint) printf '%s\n' "$BEFORE" ;;
+  run)
+    # ponytail: before/after misses ABA edits; wait for editors or use a fixed worktree.
+    # Relative log/include paths and the command are resolved from the repository root.
+    (umask 077; : > "$LOG") || fail "cannot open log"
+    "$@" > "$LOG" 2>&1
+    RC=$?
+    AFTER=$(fingerprint) || fail "cannot fingerprint inputs after run"
+    [ "$BEFORE" = "$AFTER" ] || { echo 'tree changed during run' >&2; exit 3; }
+    printf 'Baseline: cmd='
+    printf '%q ' "$@"
+    printf 'exit=%s log=%q fingerprint=%s includes=' "$RC" "$LOG" "$BEFORE"
+    printf '%q ' "${INCLUDES[@]}"
+    printf '\n'
+    exit "$RC" ;;
+esac

package/scripts/harness-worker-evidence-validate.sh

@@ -1,14 +1,17 @@
 #!/bin/bash
-# harness-worker-evidence-validate.sh — block CXX direct execution without worker reports
+# harness-worker-evidence-validate.sh — enforce tier-scoped role and worker evidence
+# Usage: <root> [text|json|direct-work-sha] [all|latest-active|mission:<rel>]
 set -euo pipefail
 
 PROJECT_ROOT="${1:-.}"
 DOC_ROOT="$PROJECT_ROOT/.harness/documents"
 
-[ -d "$DOC_ROOT" ] || exit 0
-
 mode="${2:-text}"
 scope="${3:-all}"
+if [ ! -d "$DOC_ROOT" ]; then
+  [[ "$scope" != mission:* && "$mode" != direct-work-sha ]] || exit 1
+  exit 0
+fi
 violations=()
 
 # Section-scoped reading (conventions/shared.md): match `^>?\s*#{1,6}` and take
@@ -28,6 +31,29 @@ has_implementation_notes() {
     grep -Eq "${HEADING3}Open Questions[[:space:]]*$" "$file"
 }
 
+has_role_notes() {
+  if [ "$tier" -lt 2 ]; then
+    grep -Eq "${HEADING2}Implementation Notes[[:space:]]*$" "$1"
+  else
+    has_implementation_notes "$1"
+  fi
+}
+
+# Preserve the exact body bytes, including trailing spaces and final newline.
+direct_work_sha() {
+  node - "$1" <<'JS'
+const fs = require('fs'), crypto = require('crypto');
+const text = fs.readFileSync(process.argv[2], 'utf8');
+const heading = /^[ \t]*>?[ \t]*##[ \t]+Direct Work[ \t]*\r?$/m.exec(text);
+if (!heading) process.exit(1);
+let start = heading.index + heading[0].length;
+if (text[start] === '\n') start++;
+const rest = text.slice(start);
+const next = /^[ \t]*>?[ \t]*#/m.exec(rest);
+process.stdout.write(crypto.createHash('sha256').update(rest.slice(0, next ? next.index : rest.length)).digest('hex') + '\n');
+JS
+}
+
 has_worker_report() {
   local mission_dir="$1"
   local owner="${2:-}"
@@ -43,7 +69,10 @@ has_legacy_flat_worker_report() {
   find "$mission_dir/workers" -maxdepth 1 -type f -name '*.md' 2>/dev/null | grep -q .
 }
 
-mission_dirs=$(find "$DOC_ROOT" -type f \( -name 'ceo.md' -o -name 'coo.md' -o -name 'cdo.md' -o -name 'cto.md' -o -name 'cqo.md' -o -name 'ops.md' \) -exec dirname {} \; 2>/dev/null | sort -u)
+mission_dirs=""
+if [[ "$scope" != mission:* ]]; then
+  mission_dirs=$(find "$DOC_ROOT" -type f \( -name 'ceo.md' -o -name 'coo.md' -o -name 'cdo.md' -o -name 'cto.md' -o -name 'cqo.md' -o -name 'ops.md' \) -exec dirname {} \; 2>/dev/null | sort -u)
+fi
 
 mission_mtime() {
   stat -f '%m' "$1" 2>/dev/null || stat -c '%Y' "$1" 2>/dev/null || echo 0
@@ -79,13 +108,36 @@ EOF
   mission_dirs="$latest_active_mission"
 fi
 
+if [[ "$scope" == mission:* ]]; then
+  mission_rel="${scope#mission:}"
+  case "$mission_rel" in ""|/*|*..*) echo "invalid mission path" >&2; exit 1 ;; esac
+  mission_dirs="$(cd "$DOC_ROOT/$mission_rel" 2>/dev/null && pwd -P)" || exit 1
+  case "$mission_dirs/" in "$(cd "$DOC_ROOT" && pwd -P)/"*) ;; *) exit 1 ;; esac
+  [ -f "$mission_dirs/mission-state.json" ] || exit 1
+fi
+
+if [ "$mode" = direct-work-sha ]; then
+  [[ "$scope" == mission:* ]] || exit 1
+  direct_work_sha "$mission_dirs/cto.md"
+  exit $?
+fi
+
 while IFS= read -r mission_dir; do
   [ -n "$mission_dir" ] || continue
   [ -d "$mission_dir" ] || continue
   mission_name="${mission_dir#$DOC_ROOT/}"
+  tier=2
+  if [ -f "$mission_dir/mission-state.json" ]; then
+    tier=$(jq -r 'def r: if . == "S" then 0 elif . == "M" then 1 else 2 end;
+      [.tier, (.tier_history[]? | .from, .to)] | map(r) | max' "$mission_dir/mission-state.json")
+  fi
+  if [ -f "$PROJECT_ROOT/.harness/config.json" ]; then
+    enabled=$(jq -r 'if .behavior.mission_tiers == null then true else .behavior.mission_tiers end' "$PROJECT_ROOT/.harness/config.json")
+    [ "$enabled" != false ] || tier=2
+  fi
 
   ceo_path="$mission_dir/ceo.md"
-  if [ -s "$ceo_path" ] && ! has_implementation_notes "$ceo_path"; then
+  if [ -s "$ceo_path" ] && ! has_role_notes "$ceo_path"; then
     violations+=("$mission_name:ceo.md-missing-implementation-notes")
   fi
 
@@ -96,10 +148,41 @@ while IFS= read -r mission_dir; do
   for cxx in coo cdo cto cqo ops; do
     cxx_path="$mission_dir/$cxx.md"
     [ -s "$cxx_path" ] || continue
-    if ! has_implementation_notes "$cxx_path"; then
+    # Summoned but nothing to do: a one-reason N/A report completes the role.
+    if [[ "$cxx" == coo || "$cxx" == cdo || "$cxx" == ops ]] && grep -Eq "${HEADING2}Not Applicable[[:space:]]*$" "$cxx_path"; then
+      continue
+    fi
+    if ! has_role_notes "$cxx_path"; then
       violations+=("$mission_name:$cxx.md-missing-implementation-notes")
     fi
-    if ! has_worker_report "$mission_dir" "$cxx"; then
+    exempt=false
+    if [ "$tier" -eq 0 ] && [[ "$cxx" == cto || "$cxx" == cqo ]]; then
+      exempt=true
+    elif [ "$tier" -lt 2 ] && [ "$cxx" = ops ]; then
+      # S/M OPS observes directly; workers only for recovery or monitoring setup.
+      exempt=true
+    elif [ "$cxx" = cto ] && [ -f "$mission_dir/mission-state.json" ] && jq -e 'any(.tier_history[]?; .from == "S" and (.to == "M" or .to == "L"))' "$mission_dir/mission-state.json" >/dev/null; then
+      frozen=$(jq -r '[.tier_history[]? | select(.from == "S" and (.to == "M" or .to == "L"))][0].direct_work_sha256 // empty' "$mission_dir/mission-state.json")
+      if [ -n "$frozen" ]; then
+        current=$(direct_work_sha "$cxx_path") || current=""
+        if [ "$current" != "$frozen" ]; then
+          violations+=("$mission_name:cto-direct-work-modified-after-upgrade")
+        else
+          post=$(awk '
+            /^[[:space:]]*>?[[:space:]]*##[[:space:]]+Post-Upgrade Work[[:space:]]*$/ { inb=1; next }
+            inb && /^[[:space:]]*>?[[:space:]]*#/ { exit }
+            inb && /[^[:space:]]/ { sub(/^[[:space:]]*/, ""); print; exit }
+          ' "$cxx_path")
+          # ponytail: trust the declaration; add git-diff enforcement if abuse is observed.
+          if [[ "$post" == none* ]] || { [ -n "$post" ] && has_worker_report "$mission_dir" cto; }; then
+            exempt=true
+          else
+            violations+=("$mission_name:cto-post-upgrade-work-without-worker")
+          fi
+        fi
+      fi
+    fi
+    if [ "$exempt" != true ] && ! has_worker_report "$mission_dir" "$cxx"; then
       violations+=("$mission_name:$cxx.md")
     fi
     workers_dir="$mission_dir/$cxx/workers"
@@ -113,13 +196,43 @@ while IFS= read -r mission_dir; do
   done
 
   cqo_path="$mission_dir/cqo.md"
-  if [ -s "$cqo_path" ] && grep -Eq '\b(ACCEPTED|REJECTED|PASS|FAIL)\b' "$cqo_path" && ! has_worker_report "$mission_dir" "cqo"; then
+  if [ "$tier" -ne 0 ] && [ -s "$cqo_path" ] && grep -Eq '\b(ACCEPTED|REJECTED|PASS|FAIL)\b' "$cqo_path" && ! has_worker_report "$mission_dir" "cqo"; then
     violations+=("$mission_name:cqo-verdict-without-evaluator")
   fi
 done <<EOF
 $mission_dirs
 EOF
 
+# Record drift (AGENTS.md Hard Rule 12): a conclusion the session holds but has
+# not written into the state file is not held by the company. Measured cost of
+# the unreconciled case: a finished step the orchestration loop went on trying
+# to spawn 70 times, because only the report knew it was done.
+PROGRESS_FILE="$PROJECT_ROOT/.harness/progress.json"
+if [ -f "$PROGRESS_FILE" ]; then
+  while IFS=$'\t' read -r wname wreport; do
+    [ -n "$wname" ] && [ -n "$wreport" ] || continue
+    report_abs="$wreport"
+    case "$wreport" in /*) ;; *) report_abs="$PROJECT_ROOT/$wreport" ;; esac
+    [ -f "$report_abs" ] || continue
+    if [[ "$scope" == mission:* ]]; then
+      report_abs="$(cd "$(dirname "$report_abs")" && pwd -P)/$(basename "$report_abs")"
+      case "$report_abs" in "$mission_dirs/"*) ;; *) continue ;; esac
+    fi
+    # Section-scoped reading: the Status body may be quoted or indented.
+    if awk '
+      /^[[:space:]]*>?[[:space:]]*##[[:space:]]+Status[[:space:]]*$/ { inb=1; next }
+      inb && /^[[:space:]]*>?[[:space:]]*#/ { inb=0 }
+      inb && /COMPLETE/ { found=1 }
+      END { exit(found ? 0 : 1) }
+    ' "$report_abs" 2>/dev/null; then
+      violations+=("state-file:worker-$wname-reported-COMPLETE-but-progress.json-still-running")
+    fi
+  done < <(jq -r '
+    [.company_state.workers[]? | select((.status // "") | test("running|busy"))
+     | [(.name // .worker // .feature // "unknown"), (.report // .report_path // .path // "")]]
+    | .[] | @tsv' "$PROGRESS_FILE" 2>/dev/null)
+fi
+
 if [ "${#violations[@]}" -eq 0 ]; then
   if [ "$mode" = "json" ]; then
     jq -nc '{ok:true, violations:[]}'
@@ -134,7 +247,7 @@ if [ "$mode" = "json" ]; then
     | {ok:false, violations:.}
   '
 else
-  echo "CXX worker evidence violation:"
+  echo "CXX worker evidence violation (unknown tier → L):"
   for violation in "${violations[@]}"; do
     mission="${violation%%:*}"
     docs="${violation#*:}"