harnery 0.23.0 → 0.25.0

package/src/commands/supervisor.ts

@@ -3,7 +3,11 @@ import { dirname, isAbsolute, resolve } from "node:path";
 import type { Command } from "commander";
 import type { EmitContext } from "../commander.ts";
 import { workflowSubscriptionOnly } from "../core/config.ts";
-import { createBuiltinHarnessRegistry } from "../core/harnesses/index.ts";
+import {
+  createBuiltinHarnessRegistry,
+  harnessProofInputs,
+  probeBinaryVersion,
+} from "../core/harnesses/index.ts";
 import { findCoordRoot } from "../core/hooks/resolve/coord-root.ts";
 import type { PolicyIsolation } from "../core/policy/index.ts";
 import { loadPolicyFile } from "../core/policy/index.ts";
@@ -470,13 +474,9 @@ function serviceEngine(
     cwd: config.engine.cwd,
     subscriptionOnly: config.engine.subscription_only,
     allowApiBilling: config.engine.allow_api_billing,
-    harnessEvidence: Object.fromEntries(
-      registry
-        .list()
-        .map((adapter) => [
-          adapter.profile.id,
-          { toolEvidence: adapter.profile.capabilities.toolEvidence },
-        ]),
+    ...harnessProofInputs(
+      registry.list().map((adapter) => adapter.profile),
+      { versionProbe: probeBinaryVersion },
     ),
     policy: config.engine.policy,
     approvalMode: "park" as const,
@@ -566,13 +566,9 @@ function registerRunCommand(
             subscriptionOnly:
               opts.subscriptionOnly === true ? true : workflowSubscriptionOnly(coordRoot),
             allowApiBilling: opts.allowApiBilling,
-            harnessEvidence: Object.fromEntries(
-              registry
-                .list()
-                .map((adapter) => [
-                  adapter.profile.id,
-                  { toolEvidence: adapter.profile.capabilities.toolEvidence },
-                ]),
+            ...harnessProofInputs(
+              registry.list().map((adapter) => adapter.profile),
+              { versionProbe: probeBinaryVersion },
             ),
             policy: opts.policy ? loadPolicyFile(opts.policy) : undefined,
             approvalMode: "park",

package/src/commands/work.ts

@@ -1,7 +1,11 @@
 import type { Command } from "commander";
 import type { EmitContext } from "../commander.ts";
 import { workflowSubscriptionOnly } from "../core/config.ts";
-import { createBuiltinHarnessRegistry } from "../core/harnesses/index.ts";
+import {
+  createBuiltinHarnessRegistry,
+  harnessProofInputs,
+  probeBinaryVersion,
+} from "../core/harnesses/index.ts";
 import { findCoordRoot } from "../core/hooks/resolve/coord-root.ts";
 import type { PolicyIsolation } from "../core/policy/index.ts";
 import { loadPolicyFile } from "../core/policy/index.ts";
@@ -192,13 +196,9 @@ function registerRunCommand(
               subscriptionOnly:
                 opts.subscriptionOnly === true ? true : workflowSubscriptionOnly(coordRoot),
               allowApiBilling: opts.allowApiBilling,
-              harnessEvidence: Object.fromEntries(
-                registry
-                  .list()
-                  .map((adapter) => [
-                    adapter.profile.id,
-                    { toolEvidence: adapter.profile.capabilities.toolEvidence },
-                  ]),
+              ...harnessProofInputs(
+                registry.list().map((adapter) => adapter.profile),
+                { versionProbe: probeBinaryVersion },
               ),
               policy: opts.policy ? loadPolicyFile(opts.policy) : undefined,
               approvalMode: "park",

package/src/commands/workflow.ts

@@ -1,13 +1,19 @@
-import { resolve } from "node:path";
+import { existsSync } from "node:fs";
+import { join, resolve } from "node:path";
 import type { Command } from "commander";
 import type { EmitContext } from "../commander.ts";
-import { workflowSubscriptionOnly } from "../core/config.ts";
-import { createBuiltinHarnessRegistry } from "../core/harnesses/index.ts";
+import { resolveBinName, workflowSubscriptionOnly } from "../core/config.ts";
+import {
+  createBuiltinHarnessRegistry,
+  harnessProofInputs,
+  probeBinaryVersion,
+} from "../core/harnesses/index.ts";
 import { findCoordRoot } from "../core/hooks/resolve/coord-root.ts";
 import type { PolicyIsolation } from "../core/policy/index.ts";
 import { loadPolicyFile } from "../core/policy/index.ts";
-import type { WorkflowApprovalStatus } from "../core/workflow/approvals.ts";
+import type { WorkflowApproval, WorkflowApprovalStatus } from "../core/workflow/approvals.ts";
 import { WorkflowParkedError } from "../core/workflow/engine.ts";
+import type { WorkspaceProvider } from "../core/workflow/index.ts";
 
 /**
  * `workflow run <script>`: execute a workflow script — bounded, schema-gated,
@@ -49,6 +55,21 @@ interface WorkflowApprovalDecisionOpts {
   json?: boolean;
 }
 
+interface WorkflowIntegrationPrepareOpts {
+  policy?: string;
+  reviewer?: string;
+  reason?: string;
+  targetRoot?: string;
+  acceptUnknown?: string[];
+  approvalTo?: string;
+  json?: boolean;
+}
+
+interface WorkflowConfirmedMutationOpts {
+  yes?: boolean;
+  json?: boolean;
+}
+
 export function registerWorkflowCommand(program: Command, emit: EmitContext): void {
   const registry = createBuiltinHarnessRegistry();
   const harnesses = registry.ids();
@@ -161,13 +182,9 @@ export function registerWorkflowCommand(program: Command, emit: EmitContext): vo
           maxAgents: opts.maxAgents ? Number.parseInt(opts.maxAgents, 10) : undefined,
           concurrency: opts.concurrency ? Number.parseInt(opts.concurrency, 10) : undefined,
           cwd: opts.cwd,
-          harnessEvidence: Object.fromEntries(
-            registry
-              .list()
-              .map((adapter) => [
-                adapter.profile.id,
-                { toolEvidence: adapter.profile.capabilities.toolEvidence },
-              ]),
+          ...harnessProofInputs(
+            registry.list().map((adapter) => adapter.profile),
+            { versionProbe: probeBinaryVersion },
           ),
           policy: opts.policy ? loadPolicyFile(opts.policy) : undefined,
           approvalMode: "park",
@@ -211,7 +228,7 @@ export function registerWorkflowCommand(program: Command, emit: EmitContext): vo
             emit.text(
               `run ${err.runId} parked\napproval: ${err.approvalId}\n` +
                 `journal: ${err.journalPath}\n` +
-                `resume after resolution: harn workflow resume ${err.runId}\n`,
+                `resume after resolution: ${resolveBinName()} workflow resume ${err.runId}\n`,
             );
           }
           return;
@@ -261,13 +278,9 @@ export function registerWorkflowCommand(program: Command, emit: EmitContext): vo
                 writableRoots: [binding.writable_root.configured],
               }
             : undefined,
-          harnessEvidence: Object.fromEntries(
-            registry
-              .list()
-              .map((adapter) => [
-                adapter.profile.id,
-                { toolEvidence: adapter.profile.capabilities.toolEvidence },
-              ]),
+          ...harnessProofInputs(
+            registry.list().map((adapter) => adapter.profile),
+            { versionProbe: probeBinaryVersion },
           ),
         });
         if (opts.json) {
@@ -387,6 +400,200 @@ export function registerWorkflowCommand(program: Command, emit: EmitContext): vo
       );
     });
 
+  const integration = workflow
+    .command("integration")
+    .description("Prepare and apply proof-gated isolated-workspace integration.");
+
+  integration
+    .command("prepare <run-id>")
+    .description("Preview integration and write exact review and policy authority.")
+    .option("--policy <file>", "Current host policy JSON/JSONC for the Git mutation")
+    .option("--reviewer <name>", "Explicit reviewer for a standalone workflow")
+    .option("--reason <text>", "Reason recorded with the standalone review")
+    .option("--target-root <dir>", "Explicit target checkout (default: frozen source checkout)")
+    .option(
+      "--accept-unknown <code>",
+      "Accept one verification unknown by code (repeatable)",
+      collectOption,
+      [],
+    )
+    .option("--approval-to <address>", "Address a durable policy ASK request")
+    .option("--json", "Emit the durable integration plan as JSON")
+    .action(async (runId: string, opts: WorkflowIntegrationPrepareOpts) => {
+      const coordRoot = findCoordRoot();
+      if (!coordRoot) {
+        emit.error({
+          code: "no_coord_root",
+          message: "no .harnery/ coordination root found; run `init` first",
+        });
+        process.exit(1);
+      }
+      if (!opts.policy) {
+        emit.error({
+          code: "integration_policy_required",
+          message: "integration prepare requires --policy <file>",
+        });
+        process.exit(1);
+      }
+      if (opts.reason && !opts.reviewer) {
+        emit.error({
+          code: "integration_reviewer_required",
+          message: "--reason requires --reviewer <name>",
+        });
+        process.exit(1);
+      }
+      try {
+        const provider = await builtInProviderForRun(coordRoot, runId);
+        const { IntegrationPrepareParkedError, prepareIntegration } = await import(
+          "../core/workflow/index.ts"
+        );
+        try {
+          const plan = await prepareIntegration({
+            coordRoot,
+            runId,
+            provider,
+            policy: loadPolicyFile(opts.policy),
+            targetRoot: opts.targetRoot,
+            review: opts.reviewer ? { actor: opts.reviewer, reason: opts.reason } : undefined,
+            acceptedUnknowns: opts.acceptUnknown,
+            approvalAddressee: opts.approvalTo,
+          });
+          if (opts.json) {
+            emit.config({ format: "json" });
+            emit.data(plan);
+            return;
+          }
+          emit.text(
+            `integration plan ${plan.plan_id} authorized\n` +
+              `source: ${plan.provider_preview.source_commit}\n` +
+              `target: ${plan.provider_preview.target_ref} at ${plan.provider_preview.target_commit}\n` +
+              `changes: ${plan.provider_preview.changed_paths.length}\n` +
+              `apply: ${resolveBinName()} workflow integration apply ${runId} --yes\n`,
+          );
+        } catch (error) {
+          if (error instanceof IntegrationPrepareParkedError) {
+            if (opts.json) {
+              emit.config({ format: "json" });
+              emit.data({
+                status: "parked",
+                runId: error.runId,
+                planId: error.planId,
+                approvalId: error.approvalId,
+              });
+            } else {
+              emit.text(
+                `integration preparation parked\n` +
+                  `run: ${error.runId}\n` +
+                  `plan: ${error.planId}\n` +
+                  `approval: ${error.approvalId}\n` +
+                  `approve: ${resolveBinName()} workflow approvals approve ${error.approvalId}\n`,
+              );
+            }
+            return;
+          }
+          throw error;
+        }
+      } catch (error) {
+        emit.error({
+          code: "workflow_integration_prepare_failed",
+          message: error instanceof Error ? error.message : String(error),
+        });
+        process.exit(1);
+      }
+    });
+
+  integration
+    .command("apply <run-id>")
+    .description("Apply an authorized durable integration plan.")
+    .option("--yes", "Confirm the target-branch mutation")
+    .option("--json", "Emit the durable integration receipt as JSON")
+    .action(async (runId: string, opts: WorkflowConfirmedMutationOpts) => {
+      const coordRoot = findCoordRoot();
+      if (!coordRoot) {
+        emit.error({
+          code: "no_coord_root",
+          message: "no .harnery/ coordination root found; run `init` first",
+        });
+        process.exit(1);
+      }
+      if (!opts.yes) {
+        emit.error({
+          code: "integration_confirmation_required",
+          message: "integration apply changes the target branch; pass --yes to confirm",
+        });
+        process.exit(1);
+      }
+      try {
+        const provider = await builtInProviderForRun(coordRoot, runId);
+        const { applyIntegration } = await import("../core/workflow/index.ts");
+        const receipt = await applyIntegration({ coordRoot, runId, provider });
+        if (opts.json) {
+          emit.config({ format: "json" });
+          emit.data(receipt);
+          return;
+        }
+        emit.text(
+          `integration ${receipt.status}: ${receipt.target_ref} at ${receipt.target_commit}\n` +
+            `receipt: ${receipt.receipt_id}\n` +
+            `cleanup: ${resolveBinName()} workflow cleanup ${runId} --yes\n`,
+        );
+      } catch (error) {
+        emit.error({
+          code: "workflow_integration_apply_failed",
+          message: error instanceof Error ? error.message : String(error),
+        });
+        process.exit(1);
+      }
+    });
+
+  workflow
+    .command("cleanup <run-id>")
+    .description("Conservatively release a provider-owned isolated workspace.")
+    .option("--yes", "Confirm the worktree and provider-branch removal attempt")
+    .option("--json", "Emit the cleanup attempt or receipt as JSON")
+    .action(async (runId: string, opts: WorkflowConfirmedMutationOpts) => {
+      const coordRoot = findCoordRoot();
+      if (!coordRoot) {
+        emit.error({
+          code: "no_coord_root",
+          message: "no .harnery/ coordination root found; run `init` first",
+        });
+        process.exit(1);
+      }
+      if (!opts.yes) {
+        emit.error({
+          code: "cleanup_confirmation_required",
+          message: "workspace cleanup may remove a worktree and branch; pass --yes to confirm",
+        });
+        process.exit(1);
+      }
+      try {
+        const provider = await builtInProviderForRun(coordRoot, runId);
+        const { cleanupWorkspace } = await import("../core/workflow/index.ts");
+        const result = await cleanupWorkspace({ coordRoot, runId, provider });
+        if (opts.json) {
+          emit.config({ format: "json" });
+          emit.data(result);
+          return;
+        }
+        const receipt =
+          "receipt_id" in result && typeof result.receipt_id === "string"
+            ? `\nreceipt: ${result.receipt_id}`
+            : "";
+        const reason =
+          "reason" in result && typeof result.reason === "string"
+            ? `\nreason: ${result.reason}`
+            : "";
+        emit.text(`workspace cleanup ${result.status}: ${result.binding_id}${receipt}${reason}\n`);
+      } catch (error) {
+        emit.error({
+          code: "workflow_cleanup_failed",
+          message: error instanceof Error ? error.message : String(error),
+        });
+        process.exit(1);
+      }
+    });
+
   const approvals = workflow
     .command("approvals")
     .description("Inspect and resolve durable workflow policy approvals.");
@@ -488,7 +695,7 @@ export function registerWorkflowCommand(program: Command, emit: EmitContext): vo
             emit.text(
               `${renderWorkflowApproval(resolved.approval)}` +
                 `${resolved.applied ? "decision recorded" : "decision already recorded"}\n` +
-                `resume: harn workflow resume ${resolved.approval.request.run_id}\n`,
+                approvalNextActionHint(coordRoot, resolved.approval),
             );
           }
         } catch (err) {
@@ -533,3 +740,44 @@ export function registerWorkflowCommand(program: Command, emit: EmitContext): vo
       }
     });
 }
+
+async function builtInProviderForRun(coordRoot: string, runId: string): Promise<WorkspaceProvider> {
+  const { createLocalGitWorktreeProvider, readWorkflowRunManifest } = await import(
+    "../core/workflow/index.ts"
+  );
+  const manifest = readWorkflowRunManifest(coordRoot, runId);
+  const binding = manifest.execution.workspace_binding;
+  if (!binding) {
+    throw new Error(`workflow run ${runId} has no isolated workspace binding`);
+  }
+  if (binding.provider.id !== "local-git-worktree") {
+    throw new Error(
+      `workflow run ${runId} requires unavailable workspace provider ${binding.provider.id}`,
+    );
+  }
+  return createLocalGitWorktreeProvider({ coordRoot });
+}
+
+function collectOption(value: string, previous: string[]): string[] {
+  return [...previous, value];
+}
+
+/** Next operator command after resolving an approval. Mid-run parks resume the
+ * workflow; integration prepare parks after the run is already terminal, so
+ * the durable plan is authorized by re-running prepare (resume would fail). */
+function approvalNextActionHint(coordRoot: string, approval: WorkflowApproval): string {
+  const bin = resolveBinName();
+  const runId = approval.request.run_id;
+  const integrationPlanPath = join(
+    coordRoot,
+    ".harnery",
+    "workflows",
+    runId,
+    "integration",
+    "plan.json",
+  );
+  if (existsSync(integrationPlanPath)) {
+    return `prepare: ${bin} workflow integration prepare ${runId}\n`;
+  }
+  return `resume: ${bin} workflow resume ${runId}\n`;
+}

package/src/core/harnesses/attest.ts

@@ -0,0 +1,162 @@
+/**
+ * The opt-in live probe that produces an attestation (ADR 0038).
+ *
+ * One bounded turn per harness, through the same `spawn` the workflow engine
+ * uses, so what gets attested is the path production takes rather than a
+ * parallel test rig.
+ */
+
+import type { SpawnResult } from "../workflow/types.ts";
+import type { AttestableDimension, HarnessAttestation } from "./attestation.ts";
+import { profileDigest, sealAttestation, writeAttestation } from "./attestation.ts";
+import { probeBinaryVersion } from "./bench.ts";
+import type { HarnessRegistry } from "./registry.ts";
+import type { CapabilitySupport, HarnessId } from "./types.ts";
+
+/** Fixed and content-free, so nothing user-supplied can reach the record and
+ * the turn stays as cheap as a turn can be. */
+export const ATTESTATION_PROMPT = "Reply with the single word: ok";
+
+export const DEFAULT_ATTESTATION_TIMEOUT_MS = 120_000;
+
+/** Vendor failures arrive as whole console transcripts, banner and prompt echo
+ * included. Reports are bounded evidence, so the reason is collapsed to one
+ * short line and the echoed prompt is removed. */
+const MAX_NOTE_REASON_CHARS = 200;
+
+function boundedReason(reason: string | undefined): string {
+  if (!reason) return "no error reported";
+  const collapsed = reason.split(ATTESTATION_PROMPT).join("<prompt>").replace(/\s+/g, " ").trim();
+  return collapsed.length > MAX_NOTE_REASON_CHARS
+    ? `${collapsed.slice(0, MAX_NOTE_REASON_CHARS)}…`
+    : collapsed;
+}
+
+export type AttestationOutcome = "recorded" | "skipped" | "unreachable" | "failed";
+
+export interface HarnessAttestationResult {
+  harness: HarnessId;
+  outcome: AttestationOutcome;
+  binaryVersion?: string;
+  observations?: Partial<Record<AttestableDimension, CapabilitySupport>>;
+  durationMs?: number;
+  note: string;
+}
+
+export interface HarnessAttestationReport {
+  generatedAt: string;
+  harnesses: HarnessId[];
+  results: HarnessAttestationResult[];
+  recorded: number;
+  /** True when at least one selected harness could not be attested, so a
+   * caller can tell a partial sweep from a complete one. */
+  incomplete: boolean;
+}
+
+export interface RunHarnessAttestationOptions {
+  harnesses?: readonly string[];
+  timeoutMs?: number;
+  cwd?: string;
+  coordRoot?: string;
+  /** Test seam and alternate host probe. A null version means unavailable. */
+  versionProbe?: (binary: string) => string | null;
+  /** Test seam. Defaults to the adapter's production spawner. */
+  spawn?: (harness: HarnessId, prompt: string, timeoutMs: number) => Promise<SpawnResult>;
+  /** Test seam. Defaults to writing under the coord root. */
+  persist?: (record: HarnessAttestation) => void;
+  now?: () => Date;
+}
+
+export async function runHarnessAttestation(
+  registry: HarnessRegistry,
+  opts: RunHarnessAttestationOptions = {},
+): Promise<HarnessAttestationReport> {
+  const ids = opts.harnesses?.length ? [...opts.harnesses] : registry.ids();
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_ATTESTATION_TIMEOUT_MS;
+  const cwd = opts.cwd ?? process.cwd();
+  const versionProbe = opts.versionProbe ?? probeBinaryVersion;
+  const now = opts.now ?? (() => new Date());
+  const results: HarnessAttestationResult[] = [];
+
+  for (const id of ids) {
+    const adapter = registry.require(id);
+    const binaryVersion = versionProbe(adapter.profile.binary);
+    if (!binaryVersion) {
+      results.push({
+        harness: id,
+        outcome: "skipped",
+        note: `${adapter.profile.binary} not found on PATH`,
+      });
+      continue;
+    }
+
+    let result: SpawnResult;
+    try {
+      result = opts.spawn
+        ? await opts.spawn(id, ATTESTATION_PROMPT, timeoutMs)
+        : await adapter.spawn({
+            prompt: ATTESTATION_PROMPT,
+            timeoutMs,
+            maxTurns: 1,
+            cwd,
+          });
+    } catch (error) {
+      results.push({
+        harness: id,
+        outcome: "failed",
+        binaryVersion,
+        note: `probe threw: ${boundedReason((error as Error).message)}`,
+      });
+      continue;
+    }
+
+    // Prerequisite rule: an unreachable subject cannot evidence anything, so a
+    // failed turn records nothing at all rather than a page of `unsupported`.
+    if (!result.ok) {
+      results.push({
+        harness: id,
+        outcome: "unreachable",
+        binaryVersion,
+        durationMs: result.durationMs,
+        note: `the probe turn did not complete (${boundedReason(result.error)}); nothing recorded`,
+      });
+      continue;
+    }
+
+    const observations: Partial<Record<AttestableDimension, CapabilitySupport>> = {
+      invocation: "supported",
+      finalResult: result.text.trim().length > 0 ? "supported" : "unsupported",
+      sessionId: result.sessionId ? "supported" : "unsupported",
+      cost: result.costUsd !== undefined ? "supported" : "unsupported",
+    };
+
+    const record = sealAttestation({
+      schema_version: 1,
+      harness: id,
+      binary_version: binaryVersion,
+      profile_digest: profileDigest(adapter.profile),
+      observed_at: now().toISOString(),
+      observations,
+    });
+
+    if (opts.persist) opts.persist(record);
+    else writeAttestation(record, { coordRoot: opts.coordRoot });
+
+    results.push({
+      harness: id,
+      outcome: "recorded",
+      binaryVersion,
+      observations,
+      durationMs: result.durationMs,
+      note: `observed on ${binaryVersion}`,
+    });
+  }
+
+  return {
+    generatedAt: now().toISOString(),
+    harnesses: ids,
+    results,
+    recorded: results.filter((row) => row.outcome === "recorded").length,
+    incomplete: results.some((row) => row.outcome !== "recorded"),
+  };
+}