@walwal-harness/cli 7.1.57 → 7.1.58

package/scripts/harness-company-complete.sh

@@ -2,11 +2,11 @@
 # harness-company-complete.sh — mark the current v7 company mission complete.
 #
 # Usage:
-#   bash scripts/harness-company-complete.sh <project-root> [reason]
+#   bash scripts/harness-company-complete.sh <project-root> [reason] [mission-rel]
 #
 # This is the explicit running -> idle/done transition used by dashboard,
 # runner, hooks, and final CEO handoff paths. It intentionally only updates
-# runtime state; it does not archive or rewrite mission documents.
+# runtime state and mission lifecycle; it does not archive mission documents.
 
 set -uo pipefail
 
@@ -26,44 +26,6 @@ command -v jq >/dev/null 2>&1 || {
   exit 1
 }
 
-# Lessons-before-plan gate (AGENTS.md Hard Rule 20). The Stop hook cannot see
-# this path: once this script sets conductor.state=completed, harness-stop.sh
-# short-circuits at the top, so a mission could complete having never read the
-# corpus simply by firing the transition. Refuse the terminal transition here —
-# this is the transition P6 names, and it is the last point at which refusing
-# still means anything.
-#
-# Safe against deadlock: the gate is scoped to the latest ACTIVE mission, so the
-# stop-hook backstop (which fires only when no mission is active) always passes.
-# Opt out per project with .harness/config.json behavior.lessons_gate=false, or
-# override a single call with HARNESS_SKIP_LESSONS_GATE=1.
-if [ "${HARNESS_SKIP_LESSONS_GATE:-0}" != "1" ] && [ -x "$SCRIPT_DIR/harness-lessons-gate.sh" ]; then
-  if ! gate_out="$(bash "$SCRIPT_DIR/harness-lessons-gate.sh" "$PROJECT_ROOT" text latest-active 2>/dev/null)"; then
-    {
-      echo "[company-complete] REFUSED: the active mission has not recorded what it read before planning."
-      echo "$gate_out"
-      echo "  Add the two sections to each role document, then re-run this transition."
-      echo "  (override: HARNESS_SKIP_LESSONS_GATE=1, or behavior.lessons_gate=false in .harness/config.json)"
-    } >&2
-    echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) | company-complete | refused | lessons-gate (Hard Rule 20)" >> "$PROJECT_ROOT/.harness/progress.log" 2>/dev/null || true
-    exit 1
-  fi
-fi
-
-# Corpus reachability (Hard Rule 11) and spec pins (Hard Rule 4) are re-checked
-# at the same point, for the same reason: both are promises that decay silently
-# between when they are made and when the mission claims to be done.
-if [ "${HARNESS_SKIP_LESSONS_GATE:-0}" != "1" ] && [ -x "$SCRIPT_DIR/harness-corpus-reachability.sh" ]; then
-  if ! reach_out="$(bash "$SCRIPT_DIR/harness-corpus-reachability.sh" "$PROJECT_ROOT" text 2>/dev/null)"; then
-    {
-      echo "[company-complete] REFUSED: corpus entries are unreachable by roles they name as an audience."
-      echo "$reach_out"
-    } >&2
-    echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) | company-complete | refused | corpus-reachability (Hard Rule 11)" >> "$PROJECT_ROOT/.harness/progress.log" 2>/dev/null || true
-    exit 1
-  fi
-fi
-
 state_mtime() {
   stat -f %m "$1" 2>/dev/null || stat -c %Y "$1" 2>/dev/null || echo 0
 }
@@ -87,24 +49,117 @@ pick_transition_mission_state() {
   [ -n "$best" ] && printf '%s\n' "$best"
 }
 
+refuse() {
+  echo "[company-complete] REFUSED: $1" >&2
+  echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) | company-complete | refused | $1" >> "$PROJECT_ROOT/.harness/progress.log"
+  if [ -n "${target_state:-}" ] && jq -e '.lifecycle == "complete" or .lifecycle == "completed"' "$target_state" >/dev/null; then
+    echo 'Restore active:true and lifecycle:active, then retry.' >&2
+  fi
+  exit 1
+}
+
+target_state=""
+if [ "$#" -ge 3 ]; then
+  mission_rel="$3"
+  case "$mission_rel" in ""|/*|*..*) refuse invalid-mission-path ;; esac
+  target_dir="$(cd "$DOCS/$mission_rel" 2>/dev/null && pwd -P)" || refuse invalid-mission-path
+  case "$target_dir/" in "$(cd "$DOCS" && pwd -P)/"*) ;; *) refuse invalid-mission-path ;; esac
+  target_state="$target_dir/mission-state.json"
+  [ -f "$target_state" ] || refuse missing-mission-state
+else
+  target_state="$(pick_transition_mission_state)"
+fi
+ended=false
+tiered=false
+gate_scope=latest-active
+# Explicit targets scope the existing lessons gate even for legacy missions.
+if [ "$#" -ge 3 ]; then gate_scope="mission:$3"; fi
+if [ -n "$target_state" ]; then
+  lifecycle=$(jq -r '.lifecycle // .status // "unknown"' "$target_state") || refuse invalid-mission-state
+  case "$lifecycle" in cancelled|superseded|closed) ended=true ;; esac
+  if jq -e 'has("tier")' "$target_state" >/dev/null; then
+    tiered=true
+    mission_rel="${target_state#"$DOCS"/}"
+    # Explicit targets were canonicalized; retain the caller's relative path.
+    if [ "$#" -ge 3 ]; then mission_rel="$3/mission-state.json"; fi
+    mission_rel="${mission_rel%/mission-state.json}"
+    gate_scope="mission:$mission_rel"
+  fi
+fi
+
+if [ "$ended" = false ]; then
+  if [ "${HARNESS_SKIP_LESSONS_GATE:-0}" != 1 ] && [ -x "$SCRIPT_DIR/harness-lessons-gate.sh" ]; then
+    gate_out=$(bash "$SCRIPT_DIR/harness-lessons-gate.sh" "$PROJECT_ROOT" text "$gate_scope") || refuse "lessons-gate: $gate_out"
+  fi
+  if [ "$tiered" = true ]; then
+    evidence=$(bash "$SCRIPT_DIR/harness-worker-evidence-validate.sh" "$PROJECT_ROOT" text "$gate_scope") || refuse "worker-evidence: $evidence"
+    mission_dir="$(dirname "$target_state")"
+    [ -f "$mission_dir/cqo.md" ] || refuse missing-verdict
+    verdict=$(awk '
+      /^[[:space:]]*>?[[:space:]]*##[[:space:]]+CQO Verdict([[:space:]]+\([^)]*\))?[[:space:]]*$/ { inb=1; next }
+      /^[[:space:]]*>?[[:space:]]*#{1,2}[[:space:]]/ { inb=0 }
+      inb { candidate=$0; sub(/^[[:space:]>*_-]*/, "", candidate)
+        if (tolower(candidate) ~ /^verdict[*_[:space:]]*:/) last=$0 }
+      END {
+        if (last == "") print "missing"
+        else if (last ~ /^[[:space:]]*>?[[:space:]]*Verdict:[[:space:]]*(PASS|ACCEPTED|FAIL|REJECTED|BLOCKED)[[:space:]]*$/) {
+          sub(/^[[:space:]]*>?[[:space:]]*Verdict:[[:space:]]*/, "", last)
+          sub(/[[:space:]]*$/, "", last); print last
+        } else print "invalid"
+      }
+    ' "$mission_dir/cqo.md") || refuse invalid-final-verdict
+    case "$verdict" in
+      PASS|ACCEPTED) ;;
+      missing) refuse missing-verdict ;;
+      invalid) refuse invalid-final-verdict ;;
+      *) refuse verdict-not-pass ;;
+    esac
+    tier=$(jq -r 'def r: if . == "S" then 0 elif . == "M" then 1 else 2 end;
+      [.tier, (.tier_history[]? | .from, .to)] | map(r) | max' "$target_state") || refuse invalid-tier-state
+    if [ -f "$PROJECT_ROOT/.harness/config.json" ]; then
+      enabled=$(jq -r 'if .behavior.mission_tiers == null then true else .behavior.mission_tiers end' "$PROJECT_ROOT/.harness/config.json") || refuse invalid-config
+      [ "$enabled" != false ] || tier=2
+    fi
+    if [ "$tier" -eq 0 ]; then
+      grep -Eq '^[[:space:]]*>?[[:space:]]*##[[:space:]]+Direct Work[[:space:]]*$' "$mission_dir/cto.md" || refuse missing-direct-work
+      grep -Eq '^[[:space:]]*>?[[:space:]]*##[[:space:]]+Verification Commands[[:space:]]*$' "$mission_dir/cqo.md" || refuse missing-verification-commands
+      session=$(sed -nE 's/^[[:space:]]*Verification Session: (separate|same-session)[[:space:]]*$/\1/p' "$mission_dir/cqo.md" | tail -1)
+      [ -n "$session" ] || refuse missing-verification-session
+      if [ "$session" = same-session ]; then
+        echo '[company-complete] WARNING: same-session-verification; disclose to Owner.' >&2
+        echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) | company-complete | warn | same-session-verification" >> "$PROJECT_ROOT/.harness/progress.log"
+      fi
+    fi
+  fi
+fi
+
+# Corpus reachability (Hard Rule 11) and spec pins (Hard Rule 4) are re-checked
+# at the same point, for the same reason: both are promises that decay silently
+# between when they are made and when the mission claims to be done.
+if [ "${HARNESS_SKIP_LESSONS_GATE:-0}" != "1" ] && [ -x "$SCRIPT_DIR/harness-corpus-reachability.sh" ]; then
+  if ! reach_out="$(bash "$SCRIPT_DIR/harness-corpus-reachability.sh" "$PROJECT_ROOT" text 2>/dev/null)"; then
+    refuse "corpus-reachability: $reach_out"
+  fi
+fi
+
 # Spec pins are verified against the mission this transition would close. This
 # sits BEFORE the runtime transition on purpose: a refusal that runs after
 # progress.json is already `completed` has refused nothing.
-if [ "${HARNESS_SKIP_LESSONS_GATE:-0}" != "1" ] && [ -x "$SCRIPT_DIR/harness-spec-pin.sh" ] && [ -d "$DOCS" ]; then
-  pin_target="$(pick_transition_mission_state)"
+if [ "$ended" = false ] && [ "${HARNESS_SKIP_LESSONS_GATE:-0}" != "1" ] && [ -x "$SCRIPT_DIR/harness-spec-pin.sh" ] && [ -d "$DOCS" ]; then
+  pin_target="$target_state"
   if [ -n "$pin_target" ]; then
     mission_rel="${pin_target#"$DOCS"/}"; mission_rel="${mission_rel%/mission-state.json}"
+    if [ "$#" -ge 3 ]; then mission_rel="$3"; fi
     if ! pin_out="$(bash "$SCRIPT_DIR/harness-spec-pin.sh" "$PROJECT_ROOT" "$mission_rel" verify text 2>/dev/null)"; then
-      {
-        echo "[company-complete] REFUSED: this mission was built against a spec that has since moved."
-        echo "$pin_out"
-      } >&2
-      echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) | company-complete | refused | spec-pin drift (Hard Rule 4)" >> "$PROJECT_ROOT/.harness/progress.log" 2>/dev/null || true
-      exit 1
+      refuse "spec-pin drift: $pin_out"
     fi
   fi
 fi
 
+if [ "$ended" = true ]; then
+  echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) | company-complete | ended-without-acceptance | $lifecycle" >> "$PROJECT_ROOT/.harness/progress.log"
+fi
+
 if ! bash "$SCRIPT_DIR/harness-progress-set.sh" "$PROJECT_ROOT" \
   '.company_state.state = "idle" |
    .company_state.active_workers = 0 |
@@ -143,11 +198,10 @@ if [ -f "$TODOS" ]; then
 fi
 
 if [ -d "$DOCS" ]; then
-  target_state="$(pick_transition_mission_state)"
   if [ -n "$target_state" ]; then
     lifecycle="$(jq -r '.lifecycle // .status // "unknown"' "$target_state" 2>/dev/null || echo unknown)"
     case "$lifecycle" in
-      closed|cancelled|superseded|complete|completed) ;;
+      closed|cancelled|superseded) ;;
       *)
         tmp="$(mktemp)"
         jq '.lifecycle = "complete" | .active = false | .completed_at = (now | todate) | del(.blocked_reason) | del(.blocked_at)' "$target_state" > "$tmp" && mv "$tmp" "$target_state"

package/scripts/harness-lessons-gate.sh

@@ -11,17 +11,19 @@
 #   ## Lessons Preflight   — which convention/gotcha items apply, and why
 #   ## Lessons Tally       — one line: which of them actually fired ("0 fired" is valid)
 #
-# Usage: harness-lessons-gate.sh <project-root> [text|json] [all|latest-active]
+# Usage: harness-lessons-gate.sh <project-root> [text|json] [all|latest-active|mission:<rel>]
 set -euo pipefail
 
 PROJECT_ROOT="${1:-.}"
 DOC_ROOT="$PROJECT_ROOT/.harness/documents"
 CONFIG="$PROJECT_ROOT/.harness/config.json"
 
-[ -d "$DOC_ROOT" ] || exit 0
-
 mode="${2:-text}"
 scope="${3:-all}"
+if [ ! -d "$DOC_ROOT" ]; then
+  [[ "$scope" != mission:* && "$mode" != direct-work-sha ]] || exit 1
+  exit 0
+fi
 
 # Opt-out for projects that have not adopted the sections yet.
 if command -v jq >/dev/null 2>&1 && [ -f "$CONFIG" ]; then
@@ -57,7 +59,10 @@ mission_mtime() {
   stat -f '%m' "$1" 2>/dev/null || stat -c '%Y' "$1" 2>/dev/null || echo 0
 }
 
-mission_dirs=$(find "$DOC_ROOT" -type f \( -name 'ceo.md' -o -name 'coo.md' -o -name 'cdo.md' -o -name 'cto.md' -o -name 'cqo.md' -o -name 'ops.md' \) -exec dirname {} \; 2>/dev/null | sort -u)
+mission_dirs=""
+if [[ "$scope" != mission:* ]]; then
+  mission_dirs=$(find "$DOC_ROOT" -type f \( -name 'ceo.md' -o -name 'coo.md' -o -name 'cdo.md' -o -name 'cto.md' -o -name 'cqo.md' -o -name 'ops.md' \) -exec dirname {} \; 2>/dev/null | sort -u)
+fi
 
 if [ "$scope" = "latest-active" ]; then
   latest_active_mission=""
@@ -83,14 +88,37 @@ EOF
   mission_dirs="$latest_active_mission"
 fi
 
+if [[ "$scope" == mission:* ]]; then
+  mission_rel="${scope#mission:}"
+  case "$mission_rel" in ""|/*|*..*) echo "invalid mission path" >&2; exit 1 ;; esac
+  mission_dirs="$(cd "$DOC_ROOT/$mission_rel" 2>/dev/null && pwd -P)" || exit 1
+  case "$mission_dirs/" in "$(cd "$DOC_ROOT" && pwd -P)/"*) ;; *) exit 1 ;; esac
+  [ -f "$mission_dirs/mission-state.json" ] || exit 1
+fi
+
 while IFS= read -r mission_dir; do
   [ -n "$mission_dir" ] || continue
   [ -d "$mission_dir" ] || continue
   mission_name="${mission_dir#"$DOC_ROOT"/}"
+  tier=2
+  if [ -f "$mission_dir/mission-state.json" ]; then
+    tier=$(jq -r 'def r: if . == "S" then 0 elif . == "M" then 1 else 2 end;
+      [.tier, (.tier_history[]? | .from, .to)] | map(r) | max' "$mission_dir/mission-state.json")
+  fi
+  if [ -f "$PROJECT_ROOT/.harness/config.json" ]; then
+    enabled=$(jq -r 'if .behavior.mission_tiers == null then true else .behavior.mission_tiers end' "$PROJECT_ROOT/.harness/config.json")
+    [ "$enabled" != false ] || tier=2
+  fi
 
   for role in ceo coo cdo cto cqo ops; do
     role_path="$mission_dir/$role.md"
     [ -s "$role_path" ] || continue
+    if [[ "$role" == coo || "$role" == cdo || "$role" == ops ]] && has_section "$role_path" "Not Applicable"; then
+      continue
+    fi
+    if [ "$tier" -lt 2 ] && has_section "$role_path" "Lessons"; then
+      continue
+    fi
     if ! has_section "$role_path" "Lessons Preflight"; then
       violations+=("$mission_name:$role.md-missing-lessons-preflight")
     fi
@@ -116,12 +144,13 @@ if [ "$mode" = "json" ]; then
     | {ok:false, violations:.}
   '
 else
-  echo "Lessons-before-plan violation (AGENTS.md Hard Rule 20):"
+  echo "Lessons-before-plan violation (AGENTS.md Hard Rule 20; unknown tier → L):"
   for violation in "${violations[@]}"; do
     mission="${violation%%:*}"
     docs="${violation#*:}"
     echo "- mission: $mission"
     echo "  issue: $docs"
+    echo "  S/M role documents may instead use ## Lessons (Preflight/Fired)."
     echo "  required: '## Lessons Preflight' (which convention/gotcha items apply, and why)"
     echo "            '## Lessons Tally' (one line: which fired; '0 fired' is valid and must be stated)"
   done

package/scripts/harness-secret-scan.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+# Pass variable names, never secret values, on the command line. Do not use bash -x.
+set -o pipefail
+fail() { echo "[secret-scan] $*" >&2; exit 2; }
+VALS=()
+while [ "$#" -gt 0 ] && [ "$1" != -- ]; do
+  [[ "$1" =~ ^[a-zA-Z_][a-zA-Z0-9_]*$ ]] || fail "invalid variable name"
+  [ -n "${!1}" ] || fail "unset or empty variable: $1"
+  VALS+=("${!1}")
+  shift
+done
+[ "${#VALS[@]}" -gt 0 ] && [ "${1:-}" = -- ] || fail "expected VAR_NAME... -- PATH..."
+shift
+[ "$#" -gt 0 ] || fail "no paths"
+for path in "$@"; do [ -e "$path" ] || fail "missing path"; done
+OUT=$(grep -rlF -f <(printf '%s\n' "${VALS[@]}") -- "$@")
+RC=$?
+COUNT=0
+if [ -n "$OUT" ]; then
+  while IFS= read -r path; do
+    printf 'leak: %s\n' "$path"
+    COUNT=$((COUNT+1))
+  done <<< "$OUT"
+fi
+case "$RC" in
+  0) printf 'leaks=%s\n' "$COUNT"; exit 1 ;;
+  1) echo 'leaks=0'; exit 0 ;;
+  *) echo "scan incomplete (grep rc=$RC)" >&2; exit 2 ;;
+esac

package/scripts/harness-stop.sh

@@ -160,10 +160,10 @@ if [ -x "$SCRIPT_DIR/harness-worker-evidence-validate.sh" ]; then
   WORKER_EVIDENCE_OK=$(echo "$WORKER_EVIDENCE_JSON" | jq -r 'if has("ok") then .ok else true end' 2>/dev/null || echo true)
   if [ "$WORKER_EVIDENCE_OK" != "true" ]; then
     REASON=$(echo "$WORKER_EVIDENCE_JSON" | jq -r '
-      "CXX 직접 실행 차단: " +
-      ([.violations[] | "\(.mission) has CXX docs without worker reports: \(.docs | join(","))"] | join("; ")) +
-      ". harness-hiring/resource-manager로 전문 worker를 고용 또는 배정하고 .harness/documents/{goal-or-child-mission}/{owning-cxx}/workers/{worker-name}.md 를 남긴 뒤 계속하라."
-    ' 2>/dev/null || echo "CXX 직접 실행 차단: worker report가 없는 active mission이 있습니다. hired worker 보고서를 먼저 생성하세요.")
+      "등급별 worker/문서 증거 차단: " +
+      ([.violations[] | "\(.mission) has evidence violations: \(.docs | join(","))"] | join("; ")) +
+      ". S의 CTO/CQO만 worker 면제이며 S/M 역할 Notes는 축약 가능하다. 나머지는 harness-hiring/resource-manager로 전문 worker를 고용 또는 배정하고 .harness/documents/{goal-or-child-mission}/{owning-cxx}/workers/{worker-name}.md 를 남긴 뒤 계속하라."
+    ' 2>/dev/null || echo "등급별 worker/문서 증거 차단: worker report가 없는 active mission이 있습니다. hired worker 보고서를 먼저 생성하세요.")
     jq -nc --arg reason "$REASON" '{decision:"block", reason:$reason}'
     exit 0
   fi
@@ -184,7 +184,7 @@ if [ -x "$SCRIPT_DIR/harness-lessons-gate.sh" ]; then
       ([.violations[] | "\(.mission) → \(.docs | join(","))"] | join("; ")) +
       ". 각 role 문서에 `## Lessons Preflight`(이 미션에 적용되는 conventions/gotchas 항목과 이유)와 " +
       "그 아래 `## Implementation Notes` 바로 앞에 한 줄짜리 `## Lessons Tally`(실제로 발동한 항목; `0 fired` 도 유효하며 생략은 불가)를 " +
-      "추가한 뒤 계속하라. 코퍼스를 다시 요약한 별도 체크리스트 파일을 만들지 말 것 — 읽는 순서를 고치는 규칙이다."
+      "추가한 뒤 계속하라. S/M 역할 문서는 ## Lessons (Preflight/Fired) 한 섹션으로 대체 가능하다. 코퍼스를 다시 요약한 별도 체크리스트 파일을 만들지 말 것 — 읽는 순서를 고치는 규칙이다."
     ' 2>/dev/null || echo "교훈 선행 게이트(Hard Rule 20): active mission 의 role 문서에 ## Lessons Preflight / ## Lessons Tally 가 없습니다. 먼저 추가하세요.")
     jq -nc --arg reason "$REASON" '{decision:"block", reason:$reason}'
     exit 0

package/scripts/harness-verify-fingerprint.sh

@@ -0,0 +1,71 @@
+#!/bin/bash
+# Source identity is necessary, not sufficient: see CQO Evidence Reuse.
+set -o pipefail
+fail() { echo "[verify-fingerprint] $*" >&2; exit 2; }
+CMD=fingerprint
+ROOT=.
+LOG=
+INCLUDES=()
+[ "${1:-}" != run ] || { CMD=run; shift; }
+SEPARATOR=false
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --root|--include|--log)
+      [ "$#" -ge 2 ] && [ -n "$2" ] || fail "missing option value"
+      case "$1" in
+        --root) ROOT=$2 ;;
+        --include) INCLUDES+=("$2") ;;
+        --log) LOG=$2 ;;
+      esac
+      shift 2 ;;
+    --) SEPARATOR=true; shift; break ;;
+    *) fail "unknown option" ;;
+  esac
+done
+if [ "$CMD" = run ]; then
+  [ -n "$LOG" ] && [ "$SEPARATOR" = true ] && [ "$#" -gt 0 ] || fail "run requires --log PATH and -- CMD..."
+else
+  [ "$SEPARATOR" = false ] && [ -z "$LOG" ] || fail "unexpected run options"
+fi
+cd -- "$ROOT" 2>/dev/null || fail "invalid root"
+ROOT=$(git rev-parse --show-toplevel 2>/dev/null) || fail "not a git repository"
+cd -- "$ROOT" || fail "invalid repository root"
+if command -v shasum >/dev/null 2>&1; then HASH=(shasum -a 256)
+elif command -v sha256sum >/dev/null 2>&1; then HASH=(sha256sum)
+else fail "SHA-256 tool required"; fi
+hash() { "${HASH[@]}" | awk '{print $1}'; }
+PATHS=(. ':(top,exclude).harness' ':(top,exclude).myterm')
+file_input() {
+  printf '%s\0' "$1"
+  if [ -e "$1" ] || [ -L "$1" ]; then
+    [ -f "$1" ] || return 2
+    hash < "$1" || return 2
+  else printf 'MISSING\n'; fi
+}
+fingerprint() {
+  {
+    git rev-parse --verify HEAD || return 2
+    git diff HEAD --binary --no-ext-diff --no-textconv -- "${PATHS[@]}" || return 2
+    git ls-files --others --exclude-standard -z -- "${PATHS[@]}" |
+      while IFS= read -r -d '' file; do file_input "$file" || exit 2; done || return 2
+    for file in "${INCLUDES[@]}"; do file_input "$file" || return 2; done
+  } | hash
+}
+BEFORE=$(fingerprint) || fail "cannot fingerprint inputs"
+case "$CMD" in
+  fingerprint) printf '%s\n' "$BEFORE" ;;
+  run)
+    # ponytail: before/after misses ABA edits; wait for editors or use a fixed worktree.
+    # Relative log/include paths and the command are resolved from the repository root.
+    (umask 077; : > "$LOG") || fail "cannot open log"
+    "$@" > "$LOG" 2>&1
+    RC=$?
+    AFTER=$(fingerprint) || fail "cannot fingerprint inputs after run"
+    [ "$BEFORE" = "$AFTER" ] || { echo 'tree changed during run' >&2; exit 3; }
+    printf 'Baseline: cmd='
+    printf '%q ' "$@"
+    printf 'exit=%s log=%q fingerprint=%s includes=' "$RC" "$LOG" "$BEFORE"
+    printf '%q ' "${INCLUDES[@]}"
+    printf '\n'
+    exit "$RC" ;;
+esac

package/scripts/harness-worker-evidence-validate.sh

@@ -1,14 +1,17 @@
 #!/bin/bash
-# harness-worker-evidence-validate.sh — block CXX direct execution without worker reports
+# harness-worker-evidence-validate.sh — enforce tier-scoped role and worker evidence
+# Usage: <root> [text|json|direct-work-sha] [all|latest-active|mission:<rel>]
 set -euo pipefail
 
 PROJECT_ROOT="${1:-.}"
 DOC_ROOT="$PROJECT_ROOT/.harness/documents"
 
-[ -d "$DOC_ROOT" ] || exit 0
-
 mode="${2:-text}"
 scope="${3:-all}"
+if [ ! -d "$DOC_ROOT" ]; then
+  [[ "$scope" != mission:* && "$mode" != direct-work-sha ]] || exit 1
+  exit 0
+fi
 violations=()
 
 # Section-scoped reading (conventions/shared.md): match `^>?\s*#{1,6}` and take
@@ -28,6 +31,29 @@ has_implementation_notes() {
     grep -Eq "${HEADING3}Open Questions[[:space:]]*$" "$file"
 }
 
+has_role_notes() {
+  if [ "$tier" -lt 2 ]; then
+    grep -Eq "${HEADING2}Implementation Notes[[:space:]]*$" "$1"
+  else
+    has_implementation_notes "$1"
+  fi
+}
+
+# Preserve the exact body bytes, including trailing spaces and final newline.
+direct_work_sha() {
+  node - "$1" <<'JS'
+const fs = require('fs'), crypto = require('crypto');
+const text = fs.readFileSync(process.argv[2], 'utf8');
+const heading = /^[ \t]*>?[ \t]*##[ \t]+Direct Work[ \t]*\r?$/m.exec(text);
+if (!heading) process.exit(1);
+let start = heading.index + heading[0].length;
+if (text[start] === '\n') start++;
+const rest = text.slice(start);
+const next = /^[ \t]*>?[ \t]*#/m.exec(rest);
+process.stdout.write(crypto.createHash('sha256').update(rest.slice(0, next ? next.index : rest.length)).digest('hex') + '\n');
+JS
+}
+
 has_worker_report() {
   local mission_dir="$1"
   local owner="${2:-}"
@@ -43,7 +69,10 @@ has_legacy_flat_worker_report() {
   find "$mission_dir/workers" -maxdepth 1 -type f -name '*.md' 2>/dev/null | grep -q .
 }
 
-mission_dirs=$(find "$DOC_ROOT" -type f \( -name 'ceo.md' -o -name 'coo.md' -o -name 'cdo.md' -o -name 'cto.md' -o -name 'cqo.md' -o -name 'ops.md' \) -exec dirname {} \; 2>/dev/null | sort -u)
+mission_dirs=""
+if [[ "$scope" != mission:* ]]; then
+  mission_dirs=$(find "$DOC_ROOT" -type f \( -name 'ceo.md' -o -name 'coo.md' -o -name 'cdo.md' -o -name 'cto.md' -o -name 'cqo.md' -o -name 'ops.md' \) -exec dirname {} \; 2>/dev/null | sort -u)
+fi
 
 mission_mtime() {
   stat -f '%m' "$1" 2>/dev/null || stat -c '%Y' "$1" 2>/dev/null || echo 0
@@ -79,13 +108,36 @@ EOF
   mission_dirs="$latest_active_mission"
 fi
 
+if [[ "$scope" == mission:* ]]; then
+  mission_rel="${scope#mission:}"
+  case "$mission_rel" in ""|/*|*..*) echo "invalid mission path" >&2; exit 1 ;; esac
+  mission_dirs="$(cd "$DOC_ROOT/$mission_rel" 2>/dev/null && pwd -P)" || exit 1
+  case "$mission_dirs/" in "$(cd "$DOC_ROOT" && pwd -P)/"*) ;; *) exit 1 ;; esac
+  [ -f "$mission_dirs/mission-state.json" ] || exit 1
+fi
+
+if [ "$mode" = direct-work-sha ]; then
+  [[ "$scope" == mission:* ]] || exit 1
+  direct_work_sha "$mission_dirs/cto.md"
+  exit $?
+fi
+
 while IFS= read -r mission_dir; do
   [ -n "$mission_dir" ] || continue
   [ -d "$mission_dir" ] || continue
   mission_name="${mission_dir#$DOC_ROOT/}"
+  tier=2
+  if [ -f "$mission_dir/mission-state.json" ]; then
+    tier=$(jq -r 'def r: if . == "S" then 0 elif . == "M" then 1 else 2 end;
+      [.tier, (.tier_history[]? | .from, .to)] | map(r) | max' "$mission_dir/mission-state.json")
+  fi
+  if [ -f "$PROJECT_ROOT/.harness/config.json" ]; then
+    enabled=$(jq -r 'if .behavior.mission_tiers == null then true else .behavior.mission_tiers end' "$PROJECT_ROOT/.harness/config.json")
+    [ "$enabled" != false ] || tier=2
+  fi
 
   ceo_path="$mission_dir/ceo.md"
-  if [ -s "$ceo_path" ] && ! has_implementation_notes "$ceo_path"; then
+  if [ -s "$ceo_path" ] && ! has_role_notes "$ceo_path"; then
     violations+=("$mission_name:ceo.md-missing-implementation-notes")
   fi
 
@@ -96,10 +148,41 @@ while IFS= read -r mission_dir; do
   for cxx in coo cdo cto cqo ops; do
     cxx_path="$mission_dir/$cxx.md"
     [ -s "$cxx_path" ] || continue
-    if ! has_implementation_notes "$cxx_path"; then
+    # Summoned but nothing to do: a one-reason N/A report completes the role.
+    if [[ "$cxx" == coo || "$cxx" == cdo || "$cxx" == ops ]] && grep -Eq "${HEADING2}Not Applicable[[:space:]]*$" "$cxx_path"; then
+      continue
+    fi
+    if ! has_role_notes "$cxx_path"; then
       violations+=("$mission_name:$cxx.md-missing-implementation-notes")
     fi
-    if ! has_worker_report "$mission_dir" "$cxx"; then
+    exempt=false
+    if [ "$tier" -eq 0 ] && [[ "$cxx" == cto || "$cxx" == cqo ]]; then
+      exempt=true
+    elif [ "$tier" -lt 2 ] && [ "$cxx" = ops ]; then
+      # S/M OPS observes directly; workers only for recovery or monitoring setup.
+      exempt=true
+    elif [ "$cxx" = cto ] && [ -f "$mission_dir/mission-state.json" ] && jq -e 'any(.tier_history[]?; .from == "S" and (.to == "M" or .to == "L"))' "$mission_dir/mission-state.json" >/dev/null; then
+      frozen=$(jq -r '[.tier_history[]? | select(.from == "S" and (.to == "M" or .to == "L"))][0].direct_work_sha256 // empty' "$mission_dir/mission-state.json")
+      if [ -n "$frozen" ]; then
+        current=$(direct_work_sha "$cxx_path") || current=""
+        if [ "$current" != "$frozen" ]; then
+          violations+=("$mission_name:cto-direct-work-modified-after-upgrade")
+        else
+          post=$(awk '
+            /^[[:space:]]*>?[[:space:]]*##[[:space:]]+Post-Upgrade Work[[:space:]]*$/ { inb=1; next }
+            inb && /^[[:space:]]*>?[[:space:]]*#/ { exit }
+            inb && /[^[:space:]]/ { sub(/^[[:space:]]*/, ""); print; exit }
+          ' "$cxx_path")
+          # ponytail: trust the declaration; add git-diff enforcement if abuse is observed.
+          if [[ "$post" == none* ]] || { [ -n "$post" ] && has_worker_report "$mission_dir" cto; }; then
+            exempt=true
+          else
+            violations+=("$mission_name:cto-post-upgrade-work-without-worker")
+          fi
+        fi
+      fi
+    fi
+    if [ "$exempt" != true ] && ! has_worker_report "$mission_dir" "$cxx"; then
       violations+=("$mission_name:$cxx.md")
     fi
     workers_dir="$mission_dir/$cxx/workers"
@@ -113,7 +196,7 @@ while IFS= read -r mission_dir; do
   done
 
   cqo_path="$mission_dir/cqo.md"
-  if [ -s "$cqo_path" ] && grep -Eq '\b(ACCEPTED|REJECTED|PASS|FAIL)\b' "$cqo_path" && ! has_worker_report "$mission_dir" "cqo"; then
+  if [ "$tier" -ne 0 ] && [ -s "$cqo_path" ] && grep -Eq '\b(ACCEPTED|REJECTED|PASS|FAIL)\b' "$cqo_path" && ! has_worker_report "$mission_dir" "cqo"; then
     violations+=("$mission_name:cqo-verdict-without-evaluator")
   fi
 done <<EOF
@@ -131,6 +214,10 @@ if [ -f "$PROGRESS_FILE" ]; then
     report_abs="$wreport"
     case "$wreport" in /*) ;; *) report_abs="$PROJECT_ROOT/$wreport" ;; esac
     [ -f "$report_abs" ] || continue
+    if [[ "$scope" == mission:* ]]; then
+      report_abs="$(cd "$(dirname "$report_abs")" && pwd -P)/$(basename "$report_abs")"
+      case "$report_abs" in "$mission_dirs/"*) ;; *) continue ;; esac
+    fi
     # Section-scoped reading: the Status body may be quoted or indented.
     if awk '
       /^[[:space:]]*>?[[:space:]]*##[[:space:]]+Status[[:space:]]*$/ { inb=1; next }
@@ -160,7 +247,7 @@ if [ "$mode" = "json" ]; then
     | {ok:false, violations:.}
   '
 else
-  echo "CXX worker evidence violation:"
+  echo "CXX worker evidence violation (unknown tier → L):"
   for violation in "${violations[@]}"; do
     mission="${violation%%:*}"
     docs="${violation#*:}"