prism-mcp-server 7.3.1 → 7.3.3

package/dist/errors.js

@@ -0,0 +1,29 @@
+/**
+ * Thrown when a verification harness gate action evaluates to "abort".
+ * Indicates a strict security or operational policy failure that should halt
+ * downstream execution immediately.
+ */
+export class VerificationGateError extends Error {
+    result;
+    constructor(message, result) {
+        super(message);
+        this.name = "VerificationGateError";
+        this.result = result;
+        // Maintain V8 stack trace natively
+        if (Error.captureStackTrace) {
+            Error.captureStackTrace(this, VerificationGateError);
+        }
+    }
+    /**
+     * Helper to dump the JSON representation of the failure block for logs.
+     */
+    toJSON() {
+        return {
+            message: this.message,
+            project: this.result.project,
+            critical_failures: this.result.critical_failures,
+            pass_rate: this.result.pass_rate,
+            result_json: this.result.result_json,
+        };
+    }
+}

package/dist/storage/sqlite.js

@@ -574,6 +574,71 @@ export class SqliteStorage {
       )
     `);
         await this.db.execute(`CREATE INDEX IF NOT EXISTS idx_pipelines_status ON dark_factory_pipelines(user_id, project, status)`);
+        // ─── v7.2.0 Migration: Verification Harness ────────────────
+        await this.db.execute(`
+      CREATE TABLE IF NOT EXISTS verification_harnesses (
+        rubric_hash TEXT PRIMARY KEY,
+        project TEXT NOT NULL,
+        conversation_id TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        min_pass_rate REAL NOT NULL,
+        tests TEXT NOT NULL,
+        metadata TEXT,
+        user_id TEXT NOT NULL DEFAULT 'default'
+      )
+    `);
+        await this.db.execute(`
+      CREATE TABLE IF NOT EXISTS verification_runs (
+        id TEXT PRIMARY KEY,
+        rubric_hash TEXT NOT NULL,
+        project TEXT NOT NULL,
+        conversation_id TEXT NOT NULL,
+        run_at TEXT NOT NULL,
+        passed INTEGER NOT NULL,
+        pass_rate REAL NOT NULL,
+        critical_failures INTEGER NOT NULL,
+        coverage_score REAL NOT NULL,
+        result_json TEXT NOT NULL,
+        gate_action TEXT NOT NULL,
+        gate_override INTEGER,
+        override_reason TEXT,
+        user_id TEXT NOT NULL DEFAULT 'default',
+        FOREIGN KEY(rubric_hash) REFERENCES verification_harnesses(rubric_hash)
+      )
+    `);
+        await this.db.execute(`CREATE INDEX IF NOT EXISTS idx_verification_runs_project ON verification_runs(project, run_at DESC)`);
+        // ─── v7.3 Migration: Pipeline Orchestration Overrides ────────
+        try {
+            await this.db.execute(`ALTER TABLE verification_runs ADD COLUMN gate_override INTEGER`);
+        }
+        catch (e) {
+            if (!e.message?.includes('duplicate column name'))
+                console.warn('Migration warning:', e.message);
+        }
+        try {
+            await this.db.execute(`ALTER TABLE verification_runs ADD COLUMN override_reason TEXT`);
+        }
+        catch (e) {
+            if (!e.message?.includes('duplicate column name'))
+                console.warn('Migration warning:', e.message);
+        }
+        // ─── H7 Migration: Tenant isolation for verification tables ────────
+        try {
+            await this.db.execute(`ALTER TABLE verification_harnesses ADD COLUMN user_id TEXT NOT NULL DEFAULT 'default'`);
+        }
+        catch (e) {
+            if (!e.message?.includes('duplicate column name'))
+                console.warn('Migration warning:', e.message);
+        }
+        try {
+            await this.db.execute(`ALTER TABLE verification_runs ADD COLUMN user_id TEXT NOT NULL DEFAULT 'default'`);
+        }
+        catch (e) {
+            if (!e.message?.includes('duplicate column name'))
+                console.warn('Migration warning:', e.message);
+        }
+        // H7: Create index after the column exists (post-migration)
+        await this.db.execute(`CREATE INDEX IF NOT EXISTS idx_verification_runs_user ON verification_runs(user_id, project)`);
         // ─── v6.1 Migration: Integrity Check ──────────────────────
         //
         // REVIEWER NOTE: PRAGMA integrity_check scans the B-tree structure of
@@ -2874,4 +2939,94 @@ export class SqliteStorage {
         const result = await this.db.execute({ sql, args });
         return result.rows;
     }
+    // ─── Verification Harness (v7.2.0) ───────────────────────────
+    async saveVerificationHarness(harness, userId) {
+        await this.db.execute({
+            sql: `
+        INSERT INTO verification_harnesses (rubric_hash, project, conversation_id, created_at, min_pass_rate, tests, metadata, user_id)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+        ON CONFLICT(rubric_hash) DO UPDATE SET
+          metadata = excluded.metadata
+      `,
+            args: [
+                harness.rubric_hash,
+                harness.project,
+                harness.conversation_id,
+                harness.created_at,
+                harness.min_pass_rate,
+                JSON.stringify(harness.tests),
+                harness.metadata ? JSON.stringify(harness.metadata) : null,
+                userId
+            ]
+        });
+    }
+    async getVerificationHarness(rubric_hash, userId) {
+        const result = await this.db.execute({
+            sql: `SELECT * FROM verification_harnesses WHERE rubric_hash = ? AND user_id = ?`,
+            args: [rubric_hash, userId]
+        });
+        if (result.rows.length === 0)
+            return null;
+        const row = result.rows[0];
+        return {
+            ...row,
+            tests: JSON.parse(row.tests),
+            metadata: row.metadata ? JSON.parse(row.metadata) : undefined
+        };
+    }
+    async saveVerificationRun(result, userId) {
+        await this.db.execute({
+            sql: `
+        INSERT INTO verification_runs (
+          id, rubric_hash, project, conversation_id, run_at, 
+          passed, pass_rate, critical_failures, coverage_score, result_json, gate_action, gate_override, override_reason, user_id
+        )
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        ON CONFLICT(id) DO NOTHING
+      `,
+            args: [
+                result.id,
+                result.rubric_hash,
+                result.project,
+                result.conversation_id,
+                result.run_at,
+                result.passed ? 1 : 0,
+                result.pass_rate,
+                result.critical_failures,
+                result.coverage_score,
+                result.result_json,
+                result.gate_action,
+                result.gate_override ? 1 : 0,
+                result.override_reason || null,
+                userId
+            ]
+        });
+    }
+    async listVerificationRuns(project, userId) {
+        const result = await this.db.execute({
+            sql: `SELECT * FROM verification_runs WHERE project = ? AND user_id = ? ORDER BY run_at DESC`,
+            args: [project, userId]
+        });
+        return result.rows.map(row => ({
+            ...row,
+            passed: Boolean(row.passed),
+            gate_override: row.gate_override === 1,
+            override_reason: row.override_reason || undefined
+        }));
+    }
+    async getVerificationRun(id, userId) {
+        const result = await this.db.execute({
+            sql: `SELECT * FROM verification_runs WHERE id = ? AND user_id = ?`,
+            args: [id, userId]
+        });
+        if (result.rows.length === 0)
+            return null;
+        const row = result.rows[0];
+        return {
+            ...row,
+            passed: Boolean(row.passed),
+            gate_override: row.gate_override === 1,
+            override_reason: row.override_reason || undefined
+        };
+    }
 }

package/dist/storage/supabase.js

@@ -1271,4 +1271,120 @@ export class SupabaseStorage {
             throw e;
         }
     }
+    // ─── Verification Harness (v7.2.0) ───────────────────────────
+    async saveVerificationHarness(harness, userId) {
+        try {
+            await supabasePost("verification_harnesses", {
+                rubric_hash: harness.rubric_hash,
+                project: harness.project,
+                conversation_id: harness.conversation_id,
+                created_at: harness.created_at,
+                min_pass_rate: harness.min_pass_rate,
+                tests: JSON.stringify(harness.tests),
+                metadata: harness.metadata ? JSON.stringify(harness.metadata) : null,
+                user_id: userId
+            }, { on_conflict: "rubric_hash" }, { Prefer: "return=representation,resolution=merge-duplicates" });
+        }
+        catch (e) {
+            if (e.message?.includes("PGRST116") || e.message?.includes("duplicate key")) {
+                return;
+            }
+            throw e;
+        }
+    }
+    async getVerificationHarness(rubric_hash, userId) {
+        try {
+            const rows = await supabaseGet("verification_harnesses", {
+                "rubric_hash": `eq.${rubric_hash}`,
+                "user_id": `eq.${userId}`
+            });
+            if (!Array.isArray(rows) || rows.length === 0)
+                return null;
+            const row = rows[0];
+            return {
+                ...row,
+                tests: JSON.parse(row.tests),
+                metadata: row.metadata ? JSON.parse(row.metadata) : undefined
+            };
+        }
+        catch (e) {
+            if (e.message?.includes("PGRST202") || e.message?.includes("Could not find the relation"))
+                return null;
+            throw e;
+        }
+    }
+    async saveVerificationRun(result, userId) {
+        try {
+            await supabasePost("verification_runs", {
+                id: result.id,
+                rubric_hash: result.rubric_hash,
+                project: result.project,
+                conversation_id: result.conversation_id,
+                run_at: result.run_at,
+                // H2 fix: Use native booleans for Supabase/PostgreSQL (not 0/1 integers)
+                passed: result.passed,
+                pass_rate: result.pass_rate,
+                critical_failures: result.critical_failures,
+                coverage_score: result.coverage_score,
+                result_json: result.result_json,
+                gate_action: result.gate_action,
+                gate_override: result.gate_override ?? false,
+                override_reason: result.override_reason || null,
+                user_id: userId
+            }, { on_conflict: "id" }, { Prefer: "return=representation,resolution=ignore-duplicates" });
+        }
+        catch (e) {
+            if (e.message?.includes("PGRST116") || e.message?.includes("duplicate key")) {
+                return;
+            }
+            throw e;
+        }
+    }
+    async listVerificationRuns(project, userId) {
+        try {
+            const query = {
+                project: `eq.${project}`,
+                user_id: `eq.${userId}`,
+                order: "run_at.desc"
+            };
+            const rows = await supabaseGet("verification_runs", query);
+            if (!Array.isArray(rows))
+                return [];
+            return rows.map((row) => ({
+                ...row,
+                passed: Boolean(row.passed),
+                // H2 fix: Use Boolean() consistently (native booleans from Supabase)
+                gate_override: Boolean(row.gate_override),
+                override_reason: row.override_reason || undefined
+            }));
+        }
+        catch (e) {
+            if (e.message?.includes("PGRST202") || e.message?.includes("Could not find the relation"))
+                return [];
+            throw e;
+        }
+    }
+    async getVerificationRun(id, userId) {
+        try {
+            const rows = await supabaseGet("verification_runs", {
+                id: `eq.${id}`,
+                user_id: `eq.${userId}`
+            });
+            if (!Array.isArray(rows) || rows.length === 0)
+                return null;
+            const row = rows[0];
+            return {
+                ...row,
+                passed: Boolean(row.passed),
+                // H2 fix: Use Boolean() consistently (native booleans from Supabase)
+                gate_override: Boolean(row.gate_override),
+                override_reason: row.override_reason || undefined
+            };
+        }
+        catch (e) {
+            if (e.message?.includes("PGRST202") || e.message?.includes("Could not find the relation"))
+                return null;
+            throw e;
+        }
+    }
 }

package/dist/tools/routerExperience.js

@@ -54,6 +54,20 @@ export async function getExperienceBias(project, taskKeywords, storageBackend) {
                     relevantCount++;
                 }
             }
+            // GAP-1 fix: Ingest validation_result events into ML routing bias.
+            // The v7.2 spec requires that "Router learning ingests raw verification
+            // signals (pass_rate, critical_failures, coverage_score, rubric_hash)."
+            // confidence_score >= 80 indicates a passing verification suite.
+            if (eventType === "validation_result") {
+                const confidence = raw.confidence_score || 50;
+                if (confidence >= 80) {
+                    successCount++;
+                }
+                else {
+                    failureCount++;
+                }
+                relevantCount++;
+            }
         }
         if (relevantCount < MIN_SAMPLES) {
             return {

package/dist/verification/clawValidator.js

@@ -17,6 +17,7 @@
  *  - claw-code-agent MCP server must be available
  *  - PRISM_VERIFICATION_HARNESS_ENABLED=true
  */
+import { createHash } from "crypto";
 import { TestSuiteSchema } from "./schema.js";
 /**
  * Build the prompt for Claw validation.
@@ -213,7 +214,7 @@ export function mergeSuggestedAssertions(suite, suggestions) {
                 ...suite.tests,
                 ...suggestions.map((s) => ({
                     ...s,
-                    id: s.id || `claw-suggestion-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`,
+                    id: s.id || `claw-suggestion-${createHash("sha256").update(JSON.stringify(s)).digest("hex").slice(0, 12)}`,
                     severity: s.severity || "warn",
                 })),
             ],

package/dist/verification/cliHandler.js

@@ -0,0 +1,325 @@
+import * as fs from 'fs/promises';
+import { computeRubricHash } from './schema.js';
+// ─── Constants ────────────────────────────────────────────────────────────────
+/** H5 fix: Centralize the harness file path as a constant */
+const DEFAULT_HARNESS_PATH = './verification_harness.json';
+// ─── Utilities ────────────────────────────────────────────────────────────────
+/** M11 fix: Extract CI environment detection into a reusable utility */
+export function isStrictVerificationEnv() {
+    return (process.env.CI === 'true' ||
+        process.env.CI === '1' ||
+        process.env.GITHUB_ACTIONS === 'true' ||
+        process.env.GITLAB_CI === 'true' ||
+        process.env.PRISM_STRICT_VERIFICATION === 'true');
+}
+// ─── Renderers ────────────────────────────────────────────────────────────────
+/** Render a VerifyStatusResult as human-readable console output */
+function renderVerifyStatus(result, jsonMode) {
+    if (jsonMode) {
+        process.stdout.write(JSON.stringify(result, null, 2) + '\n');
+        return;
+    }
+    console.log(`\n🔍 Checking verification status for project: ${result.project}...`);
+    if (result.no_runs) {
+        console.log('⚠️  No previous verification runs found.');
+        return;
+    }
+    const r = result.last_run;
+    const overrideBadge = r.gate_override
+        ? `[OVERRIDDEN${r.override_reason ? `: ${r.override_reason}` : ''}] `
+        : '';
+    const passText = r.passed ? 'YES' : 'NO';
+    console.log(`✅ Last Run: ${r.run_at} | Passed: ${overrideBadge}${passText}`);
+    console.log(`   Pass Rate: ${(r.pass_rate * 100).toFixed(1)}% | Critical Failures: ${r.critical_failures}`);
+    console.log(`   Coverage Score: ${(r.coverage_score * 100).toFixed(1)}% | Gate Action: ${r.gate_action}`);
+    if (result.harness_missing) {
+        console.log('\nℹ️  No local verification_harness.json found to check against.');
+        return;
+    }
+    if (result.harness_invalid_json) {
+        console.error(`\n❌ Invalid JSON in ${DEFAULT_HARNESS_PATH}.`);
+        return;
+    }
+    if (result.synchronized) {
+        console.log('\n✨ Harness is synchronized.');
+        return;
+    }
+    // Drift output — phrasing differs only by policy outcome, not unrelated wording
+    const d = result.drift;
+    const hashLine = `   Stored Hash: ${d.stored_hash.slice(0, 8)}...  Local Hash: ${d.local_hash.slice(0, 8)}...`;
+    if (d.policy === 'bypassed') {
+        console.warn('\n🚨 [BYPASSED] Configuration drift detected.');
+        console.warn(hashLine);
+        console.warn(`   Drift block bypassed via --force. Recommended: run 'prism verify generate' to realign.`);
+    }
+    else if (d.policy === 'blocked') {
+        console.error('\n🚫 [BLOCKED] Configuration drift detected — CI environment enforces strict policy.');
+        console.error(hashLine);
+        console.error(`   Action: run 'prism verify generate' before merging to update your harness.`);
+    }
+    else {
+        // 'warn' — local dev
+        console.warn('\n⚠️  [DRIFT] Configuration drift detected.');
+        console.warn(hashLine);
+        console.warn(`   Recommended: run 'prism verify generate' to update your harness.`);
+    }
+    // Render Diff if available
+    if (d.diff_counts) {
+        console.log(`\n   Diff Summary: +${d.diff_counts.added} added, ~${d.diff_counts.modified} modified, -${d.diff_counts.removed} removed`);
+    }
+    if (d.diff) {
+        console.log('\n   Changes Detected:');
+        for (const add of d.diff.added)
+            console.log(`   + ${add.id}: ${add.description}`);
+        for (const mod of d.diff.modified) {
+            const keys = mod.changed_keys;
+            const keySuffix = keys?.length ? ` [${keys.join(', ')}]` : '';
+            console.log(`   ~ ${mod.id}: ${mod.description}${keySuffix}`);
+        }
+        for (const rem of d.diff.removed)
+            console.log(`   - ${rem.id}: ${rem.description}`);
+    }
+}
+/** Render a GenerateHarnessResult as human-readable console output */
+function renderGenerateHarness(result, jsonMode) {
+    if (jsonMode) {
+        process.stdout.write(JSON.stringify(result, null, 2) + '\n');
+        return;
+    }
+    console.log(`\n🛠  Generating/Refreshing harness for project: ${result.project}...`);
+    if (result.file_missing) {
+        console.error(`❌ Failed to read ${DEFAULT_HARNESS_PATH}. Does the file exist?`);
+        return;
+    }
+    if (result.invalid_json) {
+        console.error(`❌ Invalid JSON in ${DEFAULT_HARNESS_PATH}.`);
+        return;
+    }
+    if (result.already_exists) {
+        console.warn(`\n⚠️  A harness with rubric hash ${result.rubric_hash?.slice(0, 12)}... already exists.`);
+        console.warn('   Use --force to re-register anyway.');
+        return;
+    }
+    if (result.success) {
+        console.log('✅ Harness registered successfully.');
+        console.log(`   Hash: ${result.rubric_hash?.slice(0, 12)}...`);
+        console.log(`   Tests: ${result.test_count} assertions.`);
+    }
+}
+// ─── Handlers ─────────────────────────────────────────────────────────────────
+/**
+ * Core logic for `verify status`.
+ * Returns a typed VerifyStatusResult — callers decide how to render/exit.
+ */
+export async function computeVerifyStatus(storage, project, force = false, userId = 'default') {
+    const base = {
+        schema_version: 1,
+        project,
+        no_runs: false,
+        harness_missing: false,
+        harness_invalid_json: false,
+        synchronized: null,
+        recommended_action: null,
+        exit_code: 0,
+    };
+    // 1. Get latest run
+    const runs = await storage.listVerificationRuns(project, userId);
+    const lastRun = runs[0];
+    if (!lastRun) {
+        return { ...base, no_runs: true, recommended_action: 'run prism verify generate' };
+    }
+    base.last_run = {
+        run_at: lastRun.run_at,
+        passed: lastRun.passed,
+        pass_rate: lastRun.pass_rate,
+        critical_failures: lastRun.critical_failures,
+        coverage_score: lastRun.coverage_score,
+        gate_action: lastRun.gate_action,
+        gate_override: lastRun.gate_override ?? false,
+        override_reason: lastRun.override_reason,
+    };
+    // 2. Drift detection — C5 fix: separate readFile and JSON.parse error paths
+    let harnessRaw;
+    try {
+        harnessRaw = await fs.readFile(DEFAULT_HARNESS_PATH, 'utf-8');
+    }
+    catch {
+        return { ...base, harness_missing: true };
+    }
+    let localHarness;
+    try {
+        localHarness = JSON.parse(harnessRaw);
+    }
+    catch {
+        return { ...base, harness_invalid_json: true, exit_code: 1 };
+    }
+    const localHash = computeRubricHash(localHarness.tests);
+    const storedHash = lastRun.rubric_hash;
+    if (localHash === storedHash) {
+        return { ...base, synchronized: true };
+    }
+    // Drift detected
+    const strictEnv = isStrictVerificationEnv();
+    // Phase 2 Diagnostics: Compute Structured Diff
+    let diff;
+    let diffCounts;
+    try {
+        const historicalHarness = await storage.getVerificationHarness?.(storedHash, userId);
+        if (historicalHarness) {
+            diff = { added: [], removed: [], modified: [] };
+            const dbTests = historicalHarness.tests;
+            const localTests = localHarness.tests;
+            const storedMap = new Map(dbTests.map(t => [t.id, t]));
+            const localMap = new Map(localTests.map(t => [t.id, t]));
+            for (const [id, localTest] of localMap.entries()) {
+                const storedTest = storedMap.get(id);
+                if (!storedTest) {
+                    diff.added.push(localTest);
+                }
+                else {
+                    // Compare JSON stringification for deep equality
+                    const storedStr = JSON.stringify(storedTest);
+                    const localStr = JSON.stringify(localTest);
+                    if (storedStr !== localStr) {
+                        // Diagnostics v2: Compute changed_keys — top-level fields that differ
+                        const allKeys = new Set([...Object.keys(storedTest), ...Object.keys(localTest)]);
+                        const changedKeys = [];
+                        for (const key of allKeys) {
+                            if (JSON.stringify(storedTest[key]) !== JSON.stringify(localTest[key])) {
+                                changedKeys.push(key);
+                            }
+                        }
+                        changedKeys.sort();
+                        diff.modified.push({ ...localTest, changed_keys: changedKeys });
+                    }
+                }
+            }
+            for (const [id, storedTest] of storedMap.entries()) {
+                if (!localMap.has(id)) {
+                    diff.removed.push(storedTest);
+                }
+            }
+            // Ensure stable ordering by ID
+            diff.added.sort((a, b) => a.id.localeCompare(b.id));
+            diff.removed.sort((a, b) => a.id.localeCompare(b.id));
+            diff.modified.sort((a, b) => a.id.localeCompare(b.id));
+            // Diagnostics v2: Compute summary counts
+            diffCounts = {
+                added: diff.added.length,
+                removed: diff.removed.length,
+                modified: diff.modified.length,
+            };
+        }
+    }
+    catch {
+        // Failure to load historical harness skips structured diff output (safe default)
+        // Downstream consumers parse JSON and know `diff`/`diff_counts` are optional per schema constraints.
+    }
+    const driftBase = (diff && diffCounts)
+        ? { stored_hash: storedHash, local_hash: localHash, strict_env: strictEnv, diff, diff_counts: diffCounts }
+        : { stored_hash: storedHash, local_hash: localHash, strict_env: strictEnv };
+    const action = "run 'prism verify generate' to update your harness";
+    if (force) {
+        return {
+            ...base,
+            synchronized: false,
+            drift: { ...driftBase, policy: 'bypassed' },
+            recommended_action: action,
+            exit_code: 0,
+        };
+    }
+    if (strictEnv) {
+        return {
+            ...base,
+            synchronized: false,
+            drift: { ...driftBase, policy: 'blocked' },
+            recommended_action: action,
+            exit_code: 1,
+        };
+    }
+    return {
+        ...base,
+        synchronized: false,
+        drift: { ...driftBase, policy: 'warn' },
+        recommended_action: action,
+        exit_code: 0,
+    };
+}
+/**
+ * CLI entry-point for `verify status`.
+ * Computes the result, renders it (human or JSON), then sets process.exitCode.
+ */
+export async function handleVerifyStatus(storage, project, force = false, userId = 'default', jsonMode = false) {
+    const result = await computeVerifyStatus(storage, project, force, userId);
+    renderVerifyStatus(result, jsonMode);
+    // Use process.exitCode rather than process.exit() for cleaner test teardown
+    if (result.exit_code !== 0) {
+        process.exitCode = result.exit_code;
+    }
+}
+/**
+ * Core logic for `verify generate`.
+ * Returns a typed GenerateHarnessResult.
+ */
+export async function computeGenerateHarness(storage, project, force = false, userId = 'default') {
+    const base = {
+        schema_version: 1,
+        project,
+        success: false,
+        already_exists: false,
+        file_missing: false,
+        invalid_json: false,
+        exit_code: 0,
+    };
+    let raw;
+    try {
+        raw = await fs.readFile(DEFAULT_HARNESS_PATH, 'utf-8');
+    }
+    catch {
+        return { ...base, file_missing: true, exit_code: 1 };
+    }
+    let harnessData;
+    try {
+        harnessData = JSON.parse(raw);
+    }
+    catch {
+        return { ...base, invalid_json: true, exit_code: 1 };
+    }
+    const rubric_hash = computeRubricHash(harnessData.tests);
+    // H3 fix: If not --force, check if a harness already exists for this hash
+    if (!force) {
+        try {
+            const existing = await storage.getVerificationHarness?.(rubric_hash, userId);
+            if (existing) {
+                return { ...base, already_exists: true, rubric_hash, exit_code: 0 };
+            }
+        }
+        catch {
+            // getVerificationHarness may not exist on all backends; proceed
+        }
+    }
+    const harness = {
+        ...harnessData,
+        project,
+        created_at: new Date().toISOString(),
+        rubric_hash,
+    };
+    await storage.saveVerificationHarness(harness, userId);
+    return {
+        ...base,
+        success: true,
+        rubric_hash,
+        test_count: harness.tests.length,
+        exit_code: 0,
+    };
+}
+/**
+ * CLI entry-point for `verify generate`.
+ */
+export async function handleGenerateHarness(storage, project, force = false, userId = 'default', jsonMode = false) {
+    const result = await computeGenerateHarness(storage, project, force, userId);
+    renderGenerateHarness(result, jsonMode);
+    if (result.exit_code !== 0) {
+        process.exitCode = result.exit_code;
+    }
+}