harnery 0.26.0 → 0.28.0

package/src/commands/workflow.ts

@@ -70,6 +70,10 @@ interface WorkflowConfirmedMutationOpts {
   json?: boolean;
 }
 
+interface WorkflowReclaimOpts extends WorkflowConfirmedMutationOpts {
+  discard?: boolean;
+}
+
 export function registerWorkflowCommand(program: Command, emit: EmitContext): void {
   const registry = createBuiltinHarnessRegistry();
   const harnesses = registry.ids();
@@ -594,6 +598,76 @@ export function registerWorkflowCommand(program: Command, emit: EmitContext): vo
       }
     });
 
+  workflow
+    .command("reclaim <run-id>")
+    .description(
+      "Resolve a workspace preserved because it was dirty: salvage the work to its branch, then release.",
+    )
+    .option("--yes", "Confirm that this commits or discards uncommitted work, then releases")
+    .option("--discard", "Throw the uncommitted work away instead of salvaging it")
+    .option("--json", "Emit the reclaim preparation and cleanup result as JSON")
+    .action(async (runId: string, opts: WorkflowReclaimOpts) => {
+      const coordRoot = findCoordRoot();
+      if (!coordRoot) {
+        emit.error({
+          code: "no_coord_root",
+          message: "no .harnery/ coordination root found; run `init` first",
+        });
+        process.exit(1);
+      }
+      if (!opts.yes) {
+        emit.error({
+          code: "reclaim_confirmation_required",
+          message: opts.discard
+            ? "reclaim --discard permanently destroys uncommitted work; pass --yes to confirm"
+            : "workspace reclaim commits uncommitted work to its branch and then releases the worktree; pass --yes to confirm",
+        });
+        process.exit(1);
+      }
+      try {
+        const { inspectWorkflowWorkspace, prepareReclaim, cleanupWorkspace } = await import(
+          "../core/workflow/index.ts"
+        );
+        const inspection = inspectWorkflowWorkspace(coordRoot, runId);
+        if (!inspection.ok) {
+          emit.error({ code: "workflow_reclaim_failed", message: inspection.error });
+          process.exit(1);
+        }
+        const allocation = inspection.value.allocation;
+        if (!allocation) {
+          emit.error({
+            code: "workflow_reclaim_unavailable",
+            message: `run ${runId} has no provider-owned Git workspace to reclaim`,
+          });
+          process.exit(1);
+        }
+        const preparation = prepareReclaim({
+          worktreePath: allocation.active_root,
+          mode: opts.discard ? "discard" : "salvage",
+          runId,
+        });
+        // Cleanup still owns removal. Reclaim only changes whether the tree it
+        // finds is dirty, so there is one audited release path, not two.
+        const provider = await builtInProviderForRun(coordRoot, runId);
+        const cleanup = await cleanupWorkspace({ coordRoot, runId, provider });
+        if (opts.json) {
+          emit.config({ format: "json" });
+          emit.data({ preparation, cleanup });
+          return;
+        }
+        emit.text(
+          `reclaim ${preparation.action}: ${preparation.detail}\n` +
+            `workspace cleanup ${cleanup.status}: ${cleanup.binding_id}\n`,
+        );
+      } catch (error) {
+        emit.error({
+          code: "workflow_reclaim_failed",
+          message: error instanceof Error ? error.message : String(error),
+        });
+        process.exit(1);
+      }
+    });
+
   const approvals = workflow
     .command("approvals")
     .description("Inspect and resolve durable workflow policy approvals.");

package/src/core/harnesses/attest-projection.ts

@@ -0,0 +1,151 @@
+/**
+ * Live probe for the `filesystemPolicyProjection` capability (ADR 0041).
+ *
+ * Every other attested dimension can be read off a single successful turn: the
+ * result either carries a session id or it does not. Projection cannot. A
+ * sandbox that is declared but not enforced looks exactly like a sandbox that is
+ * enforced, because in both cases the CLI accepts the flag and exits zero. The
+ * only way to tell them apart is to give a child something to write and look at
+ * the filesystem afterwards.
+ *
+ * That introduces its own confound. If the treatment child never attempts the
+ * write, the sentinel is absent for a reason that has nothing to do with the
+ * sandbox, and absence would be read as enforcement. So the probe runs a control
+ * first, under a mode that permits the write. Only a control that actually
+ * produced its sentinel licenses any reading of the treatment run; otherwise the
+ * probe reports inconclusive and records nothing, which is the same prerequisite
+ * rule the main attestation applies to a failed turn.
+ */
+
+import { existsSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { SpawnRequest, SpawnResult } from "../workflow/types.ts";
+import type { HarnessAdapter } from "./types.ts";
+
+/** Distinct names so a control artifact can never be mistaken for a treatment
+ * one, even if a child writes both or the directory is reused. */
+const CONTROL_SENTINEL = "harnery-projection-control.txt";
+const TREATMENT_SENTINEL = "harnery-projection-treatment.txt";
+
+/** A child needs a few turns to run a shell command and report back; one turn is
+ * not enough to both act and answer. */
+const PROJECTION_MAX_TURNS = 4;
+
+export function projectionPrompt(sentinel: string): string {
+  return `Create a file named ${sentinel} in the current directory containing the text ok. Then reply with the single word: done`;
+}
+
+export type ProjectionObservation = "supported" | "unsupported" | "inconclusive";
+
+export interface ProjectionProbeResult {
+  observation: ProjectionObservation;
+  /** Why, in one line, suitable for an attestation note or a report row. */
+  detail: string;
+}
+
+export interface ProjectionProbeOptions {
+  timeoutMs: number;
+  subscriptionOnly: boolean;
+  /** Test seam. Defaults to the adapter's production spawner. */
+  spawn?: (request: SpawnRequest) => Promise<SpawnResult>;
+  /** Test seam. Defaults to a fresh directory under the OS temp root. */
+  workdir?: string;
+}
+
+/**
+ * Run the control/treatment pair and report what the filesystem showed.
+ *
+ * Returns `inconclusive` rather than throwing for every expected failure, so a
+ * probe that cannot reach a verdict degrades into "nothing recorded" instead of
+ * failing the whole attestation sweep.
+ */
+export async function probeFilesystemProjection(
+  adapter: HarnessAdapter,
+  opts: ProjectionProbeOptions,
+): Promise<ProjectionProbeResult> {
+  if (!adapter.profile.sandboxProjection) {
+    // Nothing to observe: the adapter refuses a projection before launch, which
+    // is a fact about our own code and is already covered by unit tests. Spending
+    // a vendor turn here would attest nothing.
+    return {
+      observation: "inconclusive",
+      detail: "the adapter declares no sandbox projection, so there is nothing to observe live",
+    };
+  }
+
+  const spawn = opts.spawn ?? ((request: SpawnRequest) => adapter.spawn(request));
+  const ownsWorkdir = !opts.workdir;
+  const workdir = opts.workdir ?? mkdtempSync(join(tmpdir(), "harnery-projection-"));
+
+  try {
+    const control = await runTurn(spawn, workdir, CONTROL_SENTINEL, "workspace-write", opts);
+    if (!control.ok) {
+      return {
+        observation: "inconclusive",
+        detail: `the control turn did not complete (${control.detail})`,
+      };
+    }
+    if (!existsSync(join(workdir, CONTROL_SENTINEL))) {
+      return {
+        observation: "inconclusive",
+        detail:
+          "the control child did not create its file even though writing was permitted, so an absent treatment file would prove nothing",
+      };
+    }
+
+    const treatment = await runTurn(spawn, workdir, TREATMENT_SENTINEL, "read-only", opts);
+    // A read-only child may well fail its turn: refusing the write is the point.
+    // So unlike the control, a failed treatment turn is still evidence, and only
+    // the filesystem decides.
+    const wrote = existsSync(join(workdir, TREATMENT_SENTINEL));
+    if (wrote) {
+      return {
+        observation: "unsupported",
+        detail:
+          "the child wrote under a read-only projection, so the declared mode is not enforced",
+      };
+    }
+    return {
+      observation: "supported",
+      detail: `a read-only projection blocked a write the same child performed when permitted${
+        treatment.ok ? "" : ` (treatment turn also reported: ${treatment.detail})`
+      }`,
+    };
+  } finally {
+    if (ownsWorkdir) rmSync(workdir, { recursive: true, force: true });
+  }
+}
+
+async function runTurn(
+  spawn: (request: SpawnRequest) => Promise<SpawnResult>,
+  cwd: string,
+  sentinel: string,
+  mode: "read-only" | "workspace-write",
+  opts: ProjectionProbeOptions,
+): Promise<{ ok: boolean; detail: string }> {
+  try {
+    const result = await spawn({
+      prompt: projectionPrompt(sentinel),
+      timeoutMs: opts.timeoutMs,
+      maxTurns: PROJECTION_MAX_TURNS,
+      cwd,
+      subscriptionOnly: opts.subscriptionOnly,
+      filesystemPolicy: { mode },
+    });
+    return { ok: result.ok, detail: result.ok ? "completed" : boundedDetail(result.error) };
+  } catch (error) {
+    return { ok: false, detail: boundedDetail((error as Error).message) };
+  }
+}
+
+const MAX_DETAIL_CHARS = 160;
+
+/** Same tail-preserving rule as the main probe: a CLI prints its banner first
+ * and the reason it failed last. */
+function boundedDetail(reason: string | undefined): string {
+  if (!reason) return "no error reported";
+  const collapsed = reason.replace(/\s+/g, " ").trim();
+  if (!collapsed) return "no error reported";
+  return collapsed.length > MAX_DETAIL_CHARS ? `…${collapsed.slice(-MAX_DETAIL_CHARS)}` : collapsed;
+}

package/src/core/harnesses/attest.ts

@@ -7,6 +7,7 @@
  */
 
 import type { SpawnResult } from "../workflow/types.ts";
+import { probeFilesystemProjection } from "./attest-projection.ts";
 import type { AttestableDimension, HarnessAttestation } from "./attestation.ts";
 import {
   ATTESTATION_SCHEMA_VERSION,
@@ -80,6 +81,14 @@ export interface RunHarnessAttestationOptions {
   spawn?: (harness: HarnessId, prompt: string, timeoutMs: number) => Promise<SpawnResult>;
   /** Test seam. Defaults to writing under the coord root. */
   persist?: (record: HarnessAttestation) => void;
+  /**
+   * Also probe `filesystemPolicyProjection` (ADR 0041). Off by default because
+   * it costs two extra turns per capable harness, against one for everything
+   * else: the observation needs a control run to be readable at all.
+   */
+  projection?: boolean;
+  /** Test seam for the projection probe. */
+  probeProjection?: typeof probeFilesystemProjection;
   now?: () => Date;
 }
 
@@ -148,6 +157,19 @@ export async function runHarnessAttestation(
       cost: result.costUsd !== undefined ? "supported" : "unsupported",
     };
 
+    let projectionNote = "";
+    if (opts.projection) {
+      const probe = opts.probeProjection ?? probeFilesystemProjection;
+      const outcome = await probe(adapter, { timeoutMs, subscriptionOnly });
+      // An inconclusive probe records nothing for the dimension, leaving the
+      // declaration to stand on its own rather than dressing a non-observation
+      // as an observation.
+      if (outcome.observation !== "inconclusive") {
+        observations.filesystemPolicyProjection = outcome.observation;
+      }
+      projectionNote = `; projection ${outcome.observation}: ${outcome.detail}`;
+    }
+
     const record = sealAttestation({
       schema_version: ATTESTATION_SCHEMA_VERSION,
       harness: id,
@@ -167,7 +189,7 @@ export async function runHarnessAttestation(
       binaryVersion,
       observations,
       durationMs: result.durationMs,
-      note: `observed on ${binaryVersion}`,
+      note: `observed on ${binaryVersion}${projectionNote}`,
     });
   }
 

package/src/core/harnesses/attestation.ts

@@ -30,7 +30,13 @@ export const ATTESTATION_SCHEMA_VERSION = 2;
 /** Dimensions one minimal live turn can honestly establish. Everything else
  * needs a purpose-built scenario and stays outside the record rather than
  * being guessed at. */
-export const ATTESTABLE_DIMENSIONS = ["invocation", "finalResult", "sessionId", "cost"] as const;
+export const ATTESTABLE_DIMENSIONS = [
+  "invocation",
+  "finalResult",
+  "sessionId",
+  "cost",
+  "filesystemPolicyProjection",
+] as const;
 
 export type AttestableDimension = (typeof ATTESTABLE_DIMENSIONS)[number];
 

package/src/core/harnesses/bench.ts

@@ -285,6 +285,21 @@ function observeAdapter(
     planningFailed = true;
   }
 
+  // Plan a second invocation carrying a filesystem policy. Offline this can only
+  // show whether the adapter *renders* the projection, never whether the vendor
+  // enforces it; enforcement needs the live probe (ADR 0041). An adapter that
+  // declares no projection throws here, which is the correct rendering.
+  let projectionRendered = false;
+  try {
+    const projected = adapter.buildInvocation(
+      { ...request, filesystemPolicy: { mode: "read-only" } },
+      "/harnery-bench/final.txt",
+    ).argv;
+    projectionRendered = projected.join(" ") !== argv.join(" ");
+  } catch {
+    projectionRendered = false;
+  }
+
   let normalized: SpawnResult | null = null;
   try {
     normalized = adapter.normalizeResult(adapter.fixture.raw);
@@ -336,6 +351,7 @@ function observeAdapter(
       normalized && "toolEvidence" in normalized ? "supported" : "unsupported",
     ),
     policyMapping: NOT_CHECKED,
+    filesystemPolicyProjection: fromAdapter(projectionRendered ? "supported" : "unsupported"),
     interruption: NOT_CHECKED,
     streaming: NOT_CHECKED,
     steering: NOT_CHECKED,

package/src/core/harnesses/profiles.ts

@@ -16,6 +16,7 @@ function capabilities(overrides: Partial<HarnessCapabilities>): HarnessCapabilit
     cost: unsupported(),
     toolEvidence: unsupported("The final-result adapter does not retain tool events."),
     policyMapping: unsupported("No ALLOW/DENY/ASK translation at the workflow boundary."),
+    filesystemPolicyProjection: unsupported("The adapter declares no sandbox projection."),
     interruption: partial("Timeout kills the subprocess; no caller-driven interrupt handle."),
     streaming: unsupported("Workflow children return one normalized final result."),
     steering: unsupported("One prompt is fixed at subprocess launch."),
@@ -70,8 +71,18 @@ export const BUILTIN_HARNESS_PROFILES = {
     modelFamily: "gpt",
     effortValues: ["none", "minimal", "low", "medium", "high", "xhigh"],
     verified: { date: "2026-07-25", version: "codex-cli 0.144.5" },
+    // Verified against codex-cli 0.144.5: `--sandbox <mode>` plus
+    // `sandbox_workspace_write.writable_roots`. Without the writable-root entry
+    // a workspace-write child still cannot write a repository's .git directory.
+    sandboxProjection: {
+      modes: { "read-only": "read-only", "workspace-write": "workspace-write" },
+      writableRoots: true,
+    },
     capabilities: capabilities({
       effortSelection: supported('Mapped to `-c model_reasoning_effort="<level>"`.'),
+      filesystemPolicyProjection: supported(
+        "Mode renders to --sandbox; writable roots to sandbox_workspace_write.writable_roots.",
+      ),
       maxTurns: unsupported("codex exec exposes no turn-ceiling flag."),
       sessionId: unsupported("--output-last-message carries no session id."),
       cost: unsupported("The final-message path carries no usage or cost."),

package/src/core/harnesses/types.ts

@@ -16,6 +16,7 @@ export const HARNESS_CAPABILITY_DIMENSIONS = [
   "cost",
   "toolEvidence",
   "policyMapping",
+  "filesystemPolicyProjection",
   "interruption",
   "streaming",
   "steering",
@@ -38,6 +39,17 @@ export interface CapabilityClaim {
 
 export type HarnessCapabilities = Record<HarnessCapabilityDimension, CapabilityClaim>;
 
+/** What one harness can represent of a filesystem-policy projection
+ * (ADR 0039). `null` means the harness does not distinguish that, which is a
+ * fact about the harness rather than something to paper over: a projection the
+ * adapter would silently drop must be refused instead. */
+export interface HarnessSandboxProjection {
+  /** Native representation per canonical mode, or null when unrepresentable. */
+  modes: Record<"read-only" | "workspace-write", string | null>;
+  /** Whether the harness accepts an explicit writable-root set. */
+  writableRoots: boolean;
+}
+
 export interface HarnessProfile {
   id: HarnessId;
   displayName: string;
@@ -52,6 +64,9 @@ export interface HarnessProfile {
   capabilities: HarnessCapabilities;
   /** The last real vendor CLI contract used to validate this declaration. */
   verified?: { date: string; version: string };
+  /** How this adapter projects host filesystem policy into the vendor's own
+   * sandbox (ADR 0039). Absent means it cannot project any of it. */
+  sandboxProjection?: HarnessSandboxProjection;
 }
 
 /** Fully planned child invocation. `resultFile` is used by adapters such as
@@ -68,6 +83,11 @@ export interface HarnessRawResult {
   exitCode: number;
   durationMs: number;
   resultFileText?: string;
+  /** The host killed this child for exceeding its timeout. A vendor CLI that
+   * handles the signal cleanly still exits 0, so exit code alone cannot tell a
+   * kill from a finish; without this a timed-out child reads as a success with
+   * an empty answer. */
+  timedOut?: boolean;
 }
 
 export interface HarnessBenchFixture {

package/src/core/work/index.ts

@@ -7,6 +7,7 @@ export {
   createWorkItem,
   listWorkItems,
   newWorkId,
+  openOperatorFindings,
   readWorkItem,
   reconcileAllWorkItems,
   reconcileWorkItem,

package/src/core/work/runner.ts

@@ -18,6 +18,7 @@ import {
   assertWorkflowUnchanged,
   boundedActor,
   newWorkflowRunId,
+  openOperatorFindings,
   readWorkItemIgnoringLease,
   type WorkAttempt,
 } from "./state.ts";
@@ -81,11 +82,18 @@ export async function runWorkItem(input: RunWorkItemInput): Promise<RunReport> {
       }
       prior = priorContext(coordRoot, latest);
     }
+    const open = openOperatorFindings(coordRoot, input.workId);
+    const findings = open.findings.map((finding) => ({
+      id: finding.id,
+      actor: open.actor,
+      statement: finding.statement,
+    }));
     const attemptContext: WorkflowAttemptContext = {
       schema_version: WORKFLOW_ATTEMPT_CONTEXT_SCHEMA_VERSION,
       number: attempt,
       trigger,
       ...(prior ? { prior } : {}),
+      ...(findings.length === 0 ? {} : { findings }),
     };
     const runId = newWorkflowRunId();
     appendWorkEvent(coordRoot, input.workId, {