relay-flow 0.2.1-alpha → 0.2.3-alpha

package/internal/harness/opencode/repo_setup.go

@@ -0,0 +1,401 @@
+package opencode
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/rajpopat27/relay-flow/internal/config"
+)
+
+const relayFlowPlugin = "relay-flow-plugin@0.2.3-alpha"
+
+type jsoncToken struct {
+	kind       byte
+	start, end int
+	value      string
+}
+
+type jsoncValue struct {
+	kind       byte
+	startToken int
+	endToken   int
+	members    []jsoncMember
+	elements   []jsoncValue
+	closeToken int
+}
+
+type jsoncMember struct {
+	name  string
+	value jsoncValue
+}
+
+type jsoncParser struct {
+	tokens []jsoncToken
+	index  int
+}
+
+type textEdit struct {
+	start, end int
+	text       string
+}
+
+func setupRepo(repoPath string) error {
+	path, mode, err := openCodeConfigPath(repoPath)
+	if err != nil {
+		return err
+	}
+	if err := ensurePluginConfig(path, mode, ""); err != nil {
+		return err
+	}
+
+	tuiPath, tuiMode, err := openCodeTUIConfigPath(repoPath)
+	if err != nil {
+		return err
+	}
+	if err := os.MkdirAll(filepath.Dir(tuiPath), 0o755); err != nil {
+		return fmt.Errorf("opencode: create TUI config directory: %w", err)
+	}
+	if err := ensurePluginConfig(tuiPath, tuiMode, "https://opencode.ai/tui.json"); err != nil {
+		return fmt.Errorf("opencode: setup TUI config: %w", err)
+	}
+	return nil
+}
+
+func ensurePluginConfig(path string, mode os.FileMode, schema string) error {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		if !os.IsNotExist(err) {
+			return fmt.Errorf("opencode: read %s: %w", path, err)
+		}
+		if schema == "" {
+			data = []byte("{\n  \"plugin\": [\"" + relayFlowPlugin + "\"]\n}\n")
+		} else {
+			data = []byte("{\n  \"$schema\": \"" + schema + "\",\n  \"plugin\": [\"" + relayFlowPlugin + "\"]\n}\n")
+		}
+	} else {
+		data, err = updateOpenCodeConfig(data)
+		if err != nil {
+			return fmt.Errorf("opencode: update %s: %w", path, err)
+		}
+	}
+	if existing, readErr := os.ReadFile(path); readErr == nil && string(existing) == string(data) {
+		return nil
+	}
+	if err := config.WriteAtomic(path, data, mode); err != nil {
+		return fmt.Errorf("opencode: write config: %w", err)
+	}
+	return nil
+}
+
+func openCodeConfigPath(repoPath string) (string, os.FileMode, error) {
+	jsonPath := filepath.Join(repoPath, "opencode.json")
+	jsoncPath := filepath.Join(repoPath, "opencode.jsonc")
+	for _, path := range []string{jsonPath, jsoncPath} {
+		info, err := os.Stat(path)
+		if err == nil {
+			if !info.Mode().IsRegular() {
+				return "", 0, fmt.Errorf("opencode: config %s is not a regular file", path)
+			}
+			return path, info.Mode().Perm(), nil
+		}
+		if !os.IsNotExist(err) {
+			return "", 0, fmt.Errorf("opencode: inspect %s: %w", path, err)
+		}
+	}
+	return jsonPath, 0o644, nil
+}
+
+func openCodeTUIConfigPath(repoPath string) (string, os.FileMode, error) {
+	dir := filepath.Join(repoPath, ".opencode")
+	for _, name := range []string{"tui.json", "tui.jsonc"} {
+		path := filepath.Join(dir, name)
+		info, err := os.Stat(path)
+		if err == nil {
+			if !info.Mode().IsRegular() {
+				return "", 0, fmt.Errorf("opencode: TUI config %s is not a regular file", path)
+			}
+			return path, info.Mode().Perm(), nil
+		}
+		if !os.IsNotExist(err) {
+			return "", 0, fmt.Errorf("opencode: inspect TUI config %s: %w", path, err)
+		}
+	}
+	return filepath.Join(dir, "tui.json"), 0o644, nil
+}
+
+func updateOpenCodeConfig(data []byte) ([]byte, error) {
+	tokens, err := tokenizeJSONC(data)
+	if err != nil {
+		return nil, err
+	}
+	p := jsoncParser{tokens: tokens}
+	root, err := p.parseValue()
+	if err != nil {
+		return nil, err
+	}
+	if p.index != len(tokens) || root.kind != '{' {
+		return nil, fmt.Errorf("config root must be one JSON object")
+	}
+
+	var plugins *jsoncValue
+	for i := range root.members {
+		if root.members[i].name == "plugin" {
+			if plugins != nil {
+				return nil, fmt.Errorf("duplicate plugin property")
+			}
+			plugins = &root.members[i].value
+		}
+	}
+	quoted, _ := json.Marshal(relayFlowPlugin)
+	if plugins == nil {
+		return addPluginProperty(data, tokens, root, string(quoted)), nil
+	}
+	if plugins.kind != '[' {
+		return nil, fmt.Errorf("plugin property must be an array")
+	}
+
+	first := -1
+	duplicates := make([]int, 0)
+	for i, element := range plugins.elements {
+		tok := tokens[element.startToken]
+		if element.kind != 's' {
+			return nil, fmt.Errorf("plugin array element %d must be a string", i)
+		}
+		if tok.value == "relay-flow-plugin" || strings.HasPrefix(tok.value, "relay-flow-plugin@") {
+			if first < 0 {
+				first = i
+			} else {
+				duplicates = append(duplicates, i)
+			}
+		}
+	}
+
+	edits := make([]textEdit, 0, len(duplicates)+1)
+	if first < 0 {
+		edits = append(edits, addArrayElementEdit(tokens, *plugins, string(quoted)))
+	} else {
+		tok := tokens[plugins.elements[first].startToken]
+		edits = append(edits, textEdit{start: tok.start, end: tok.end, text: string(quoted)})
+		for _, index := range duplicates {
+			element := plugins.elements[index]
+			comma := commaBefore(tokens, plugins.elements[index-1].endToken, element.startToken)
+			edits = append(edits,
+				textEdit{start: tokens[comma].start, end: tokens[comma].end},
+				textEdit{start: tokens[element.startToken].start, end: tokens[element.endToken].end},
+			)
+		}
+	}
+	return applyTextEdits(data, edits), nil
+}
+
+func addPluginProperty(data []byte, tokens []jsoncToken, root jsoncValue, quoted string) []byte {
+	closeAt := tokens[root.closeToken].start
+	edits := []textEdit{{
+		start: closeAt,
+		end:   closeAt,
+		text:  "\n  \"plugin\": [" + quoted + "]\n",
+	}}
+	if len(root.members) > 0 {
+		last := root.members[len(root.members)-1].value.endToken
+		if commaBefore(tokens, last, root.closeToken) < 0 {
+			at := tokens[last].end
+			edits = append(edits, textEdit{start: at, end: at, text: ","})
+		}
+	}
+	return applyTextEdits(data, edits)
+}
+
+func addArrayElementEdit(tokens []jsoncToken, array jsoncValue, quoted string) textEdit {
+	if len(array.elements) == 0 {
+		at := tokens[array.closeToken].start
+		return textEdit{start: at, end: at, text: quoted}
+	}
+	last := array.elements[len(array.elements)-1]
+	if comma := commaBefore(tokens, last.endToken, array.closeToken); comma >= 0 {
+		at := tokens[comma].end
+		return textEdit{start: at, end: at, text: " " + quoted}
+	}
+	at := tokens[last.endToken].end
+	return textEdit{start: at, end: at, text: ", " + quoted}
+}
+
+func commaBefore(tokens []jsoncToken, after, before int) int {
+	for i := after + 1; i < before; i++ {
+		if tokens[i].kind == ',' {
+			return i
+		}
+	}
+	return -1
+}
+
+func applyTextEdits(data []byte, edits []textEdit) []byte {
+	for i := 0; i < len(edits); i++ {
+		for j := i + 1; j < len(edits); j++ {
+			if edits[j].start > edits[i].start {
+				edits[i], edits[j] = edits[j], edits[i]
+			}
+		}
+	}
+	out := append([]byte(nil), data...)
+	for _, edit := range edits {
+		out = append(out[:edit.start], append([]byte(edit.text), out[edit.end:]...)...)
+	}
+	return out
+}
+
+func tokenizeJSONC(data []byte) ([]jsoncToken, error) {
+	tokens := make([]jsoncToken, 0)
+	for i := 0; i < len(data); {
+		switch data[i] {
+		case ' ', '\t', '\r', '\n':
+			i++
+			continue
+		case '/':
+			if i+1 >= len(data) {
+				return nil, fmt.Errorf("unexpected slash at byte %d", i)
+			}
+			if data[i+1] == '/' {
+				i += 2
+				for i < len(data) && data[i] != '\n' {
+					i++
+				}
+				continue
+			}
+			if data[i+1] == '*' {
+				start := i
+				i += 2
+				for i+1 < len(data) && !(data[i] == '*' && data[i+1] == '/') {
+					i++
+				}
+				if i+1 >= len(data) {
+					return nil, fmt.Errorf("unterminated comment at byte %d", start)
+				}
+				i += 2
+				continue
+			}
+			return nil, fmt.Errorf("unexpected slash at byte %d", i)
+		case '{', '}', '[', ']', ':', ',':
+			tokens = append(tokens, jsoncToken{kind: data[i], start: i, end: i + 1})
+			i++
+		case '"':
+			start := i
+			i++
+			for i < len(data) {
+				if data[i] == '\\' {
+					i += 2
+					continue
+				}
+				if data[i] == '"' {
+					i++
+					break
+				}
+				i++
+			}
+			if i > len(data) || data[i-1] != '"' {
+				return nil, fmt.Errorf("unterminated string at byte %d", start)
+			}
+			var value string
+			if err := json.Unmarshal(data[start:i], &value); err != nil {
+				return nil, fmt.Errorf("invalid string at byte %d: %w", start, err)
+			}
+			tokens = append(tokens, jsoncToken{kind: 's', start: start, end: i, value: value})
+		default:
+			start := i
+			for i < len(data) && !strings.ContainsRune(" \t\r\n{}[]:,/", rune(data[i])) {
+				i++
+			}
+			if start == i || !json.Valid(data[start:i]) {
+				return nil, fmt.Errorf("invalid value at byte %d", start)
+			}
+			tokens = append(tokens, jsoncToken{kind: 'v', start: start, end: i})
+		}
+	}
+	return tokens, nil
+}
+
+func (p *jsoncParser) parseValue() (jsoncValue, error) {
+	if p.index >= len(p.tokens) {
+		return jsoncValue{}, fmt.Errorf("expected value")
+	}
+	start := p.index
+	tok := p.tokens[p.index]
+	switch tok.kind {
+	case 's', 'v':
+		p.index++
+		return jsoncValue{kind: tok.kind, startToken: start, endToken: start}, nil
+	case '{':
+		return p.parseObject()
+	case '[':
+		return p.parseArray()
+	default:
+		return jsoncValue{}, fmt.Errorf("unexpected token %q at byte %d", tok.kind, tok.start)
+	}
+}
+
+func (p *jsoncParser) parseObject() (jsoncValue, error) {
+	value := jsoncValue{kind: '{', startToken: p.index}
+	p.index++
+	for {
+		if p.index >= len(p.tokens) {
+			return jsoncValue{}, fmt.Errorf("unterminated object")
+		}
+		if p.tokens[p.index].kind == '}' {
+			value.closeToken = p.index
+			value.endToken = p.index
+			p.index++
+			return value, nil
+		}
+		key := p.tokens[p.index]
+		if key.kind != 's' {
+			return jsoncValue{}, fmt.Errorf("object key at byte %d must be a string", key.start)
+		}
+		p.index++
+		if p.index >= len(p.tokens) || p.tokens[p.index].kind != ':' {
+			return jsoncValue{}, fmt.Errorf("object key %q is missing a colon", key.value)
+		}
+		p.index++
+		memberValue, err := p.parseValue()
+		if err != nil {
+			return jsoncValue{}, err
+		}
+		value.members = append(value.members, jsoncMember{name: key.value, value: memberValue})
+		if p.index < len(p.tokens) && p.tokens[p.index].kind == ',' {
+			p.index++
+			continue
+		}
+		if p.index >= len(p.tokens) || p.tokens[p.index].kind != '}' {
+			return jsoncValue{}, fmt.Errorf("object member %q is missing a comma", key.value)
+		}
+	}
+}
+
+func (p *jsoncParser) parseArray() (jsoncValue, error) {
+	value := jsoncValue{kind: '[', startToken: p.index}
+	p.index++
+	for {
+		if p.index >= len(p.tokens) {
+			return jsoncValue{}, fmt.Errorf("unterminated array")
+		}
+		if p.tokens[p.index].kind == ']' {
+			value.closeToken = p.index
+			value.endToken = p.index
+			p.index++
+			return value, nil
+		}
+		element, err := p.parseValue()
+		if err != nil {
+			return jsoncValue{}, err
+		}
+		value.elements = append(value.elements, element)
+		if p.index < len(p.tokens) && p.tokens[p.index].kind == ',' {
+			p.index++
+			continue
+		}
+		if p.index >= len(p.tokens) || p.tokens[p.index].kind != ']' {
+			return jsoncValue{}, fmt.Errorf("array element is missing a comma")
+		}
+	}
+}

package/internal/harness/plugin_selection_test.go

@@ -20,9 +20,9 @@ import (
 // panics.
 
 func TestHarnessRegistryUnknownNameListsRegistered(t *testing.T) {
-	harness.Register("fakeharness-unknown", func(config.RawValues) (harness.Harness, error) {
+	harness.Register("fakeharness-unknown", harness.Factory{New: func(config.RawValues) (harness.Harness, error) {
 		return newFakeHarness(), nil
-	})
+	}})
 	_, err := harness.New("does-not-exist", config.RawValues{})
 	if err == nil {
 		t.Fatal("unknown harness name accepted")
@@ -75,9 +75,9 @@ func TestDuplicateRegistrationPanics(t *testing.T) {
 		fn()
 	}
 
-	harness.Register("dup-harness-x", func(config.RawValues) (harness.Harness, error) { return nil, nil })
+	harness.Register("dup-harness-x", harness.Factory{New: func(config.RawValues) (harness.Harness, error) { return nil, nil }})
 	assertPanic("harness", func() {
-		harness.Register("dup-harness-x", func(config.RawValues) (harness.Harness, error) { return nil, nil })
+		harness.Register("dup-harness-x", harness.Factory{New: func(config.RawValues) (harness.Harness, error) { return nil, nil }})
 	})
 
 	runner.Register("dup-runner-x", func(config.RawValues) (runner.Runner, error) { return nil, nil })
@@ -97,7 +97,7 @@ func TestDuplicateRegistrationPanics(t *testing.T) {
 func TestNamesListsRegistered(t *testing.T) {
 	// Self-contained: register fixtures within this test rather than relying
 	// on earlier tests in the binary.
-	harness.Register("names-harness-x", func(config.RawValues) (harness.Harness, error) { return nil, nil })
+	harness.Register("names-harness-x", harness.Factory{New: func(config.RawValues) (harness.Harness, error) { return nil, nil }})
 	runner.Register("names-runner-x", func(config.RawValues) (runner.Runner, error) { return nil, nil })
 	task.Register("names-task-x", task.Factory{
 		RequiredRepoKeys: func() []string { return nil },

package/internal/identity/identity.go

@@ -6,12 +6,18 @@ import (
 	"crypto/rand"
 	"encoding/hex"
 	"net/url"
+	"strconv"
 	"strings"
 )
 
-// RunID identifies one durable run. Opaque to consumers.
+// RunID identifies one durable execution attempt. Opaque to consumers.
 type RunID string
 
+// AttemptID identifies an execution generation for one logical
+// repo/workflow/ticket run. Attempt numbers are durably allocated by the Run
+// Manager and are intentionally simple numeric values.
+type AttemptID uint64
+
 // NodeVisitID identifies one entry into a workflow node. Opaque to consumers.
 type NodeVisitID string
 
@@ -25,6 +31,27 @@ func NewRunID(repo, workflow, ticket string) RunID {
 	}, "/"))
 }
 
+// NewAttemptRunID derives an execution ID that is fenced from the stable
+// logical run ID. Attempt 1 retains the original deterministic ID for the
+// first execution; explicit restarts use numeric attempt suffixes.
+func NewAttemptRunID(logical RunID, attempt AttemptID) RunID {
+	if attempt <= 1 {
+		return logical
+	}
+	return RunID(string(logical) + "~attempt~" + strconv.FormatUint(uint64(attempt), 10))
+}
+
+// LogicalRunID returns the stable logical ID embedded in an execution ID.
+// First attempts are already logical IDs; explicit attempts use the
+// `~attempt~<number>` suffix generated by NewAttemptRunID.
+func LogicalRunID(execution RunID) RunID {
+	const marker = "~attempt~"
+	if index := strings.LastIndex(string(execution), marker); index >= 0 {
+		return RunID(string(execution)[:index])
+	}
+	return execution
+}
+
 // NewNodeVisitID returns a fresh random node-visit ID. Generation happens
 // once per node entry as a durable replay-safe side effect; this function
 // only produces the random value.

package/internal/identity/identity_test.go

@@ -0,0 +1,40 @@
+package identity_test
+
+import (
+	"testing"
+
+	"github.com/rajpopat27/relay-flow/internal/identity"
+)
+
+func TestAttemptRunIDUsesNumericAttemptSuffix(t *testing.T) {
+	logical := identity.NewRunID("payments", "basicFlow", "PAY-101")
+
+	if got := identity.NewAttemptRunID(logical, 1); got != logical {
+		t.Fatalf("initial attempt ID = %q, want logical ID %q", got, logical)
+	}
+	if got := identity.NewAttemptRunID(logical, 2); got != logical+"~attempt~2" {
+		t.Fatalf("restart attempt ID = %q, want numeric suffix", got)
+	}
+	if got := identity.NewAttemptRunID(logical, 3); got == identity.NewAttemptRunID(logical, 2) {
+		t.Fatalf("attempt IDs are not fenced: attempt 2 and 3 both use %q", got)
+	}
+}
+
+func TestAttemptIDsAreNumeric(t *testing.T) {
+	var first identity.AttemptID = 1
+	var second identity.AttemptID = 2
+	if first != 1 || second != 2 {
+		t.Fatalf("attempt IDs are not numeric: %d, %d", first, second)
+	}
+}
+
+func TestLogicalRunIDStripsAttemptSuffix(t *testing.T) {
+	logical := identity.NewRunID("payments", "basicFlow", "PAY-101")
+	execution := identity.NewAttemptRunID(logical, 4)
+	if got := identity.LogicalRunID(execution); got != logical {
+		t.Fatalf("logical ID = %q, want %q", got, logical)
+	}
+	if got := identity.LogicalRunID(logical); got != logical {
+		t.Fatalf("first-attempt logical ID = %q, want %q", got, logical)
+	}
+}

package/internal/recover/recover.go

@@ -37,11 +37,10 @@ import (
 	"github.com/rajpopat27/relay-flow/internal/workflow"
 )
 
-// MailboxSpecFor builds one spec per agent/HITL work node for a ticket. The
-// engine's MailboxSpecs supplies the production description content; this
+// MailboxSpecFor builds and task-system-renders one spec per work node. This
 // indirection keeps recover decoupled from the engine package (which imports
 // internal/run and would otherwise form a cycle).
-type MailboxSpecFor func(wf *workflow.Workflow, ticketKey string) []task.MailboxSpec
+type MailboxSpecFor func(task.System, run.Work, *workflow.Workflow) ([]task.MailboxSpec, error)
 
 // FromTaskSystem is the `serve --recover` composition. Explicit flag only;
 // never automatic; database loss is never inferred.
@@ -84,9 +83,15 @@ func FromTaskSystem(ctx context.Context, repoReg *repo.Registry, rnr runner.Runn
 			}); err != nil {
 				return fmt.Errorf("repo %q ticket %s close terminals: %w", rp.Name, ticket.Key, err)
 			}
-			// EnsureMailboxes: find existing, create only missing. Specs are
-			// built by the caller (the engine supplies production content).
-			mailboxes, err := rp.TaskSystem.EnsureMailboxes(ctx, ticket.Ref(), wf.Name, specsFor(wf, ticket.Key))
+			// EnsureMailboxes: find existing, create only missing. The selected
+			// task system renders its customizable description before the fixed
+			// report contract and legal routes are supplied.
+			work := run.Work{RunID: runID, Repo: rp.Name, Workflow: wf.Name, Parent: ticket.Ref(), WorkflowTaskConfig: wf.TaskConfig}
+			specs, err := specsFor(rp.TaskSystem, work, wf)
+			if err != nil {
+				return fmt.Errorf("repo %q ticket %s render mailboxes: %w", rp.Name, ticket.Key, err)
+			}
+			mailboxes, err := rp.TaskSystem.EnsureMailboxes(ctx, ticket.Ref(), wf.Name, specs)
 			if err != nil {
 				return fmt.Errorf("repo %q ticket %s ensure mailboxes: %w", rp.Name, ticket.Key, err)
 			}

package/internal/repo/service.go

@@ -6,6 +6,7 @@ import (
 	"path/filepath"
 
 	"github.com/rajpopat27/relay-flow/internal/config"
+	"github.com/rajpopat27/relay-flow/internal/harness"
 	"github.com/rajpopat27/relay-flow/internal/runner"
 	"github.com/rajpopat27/relay-flow/internal/task"
 )
@@ -26,6 +27,7 @@ type ServiceConfig struct {
 	ConfigPath string
 	TaskPlugin string
 	Runner     runner.Runner
+	Harness    harness.Harness
 	Active     ActiveRuns
 	Workflows  WorkflowRefs
 }
@@ -34,6 +36,7 @@ type Service struct {
 	cfgPath    string
 	taskPlugin string
 	runner     runner.Runner
+	harness    harness.Harness
 	active     ActiveRuns
 	workflows  WorkflowRefs
 	reg        *Registry
@@ -51,6 +54,7 @@ func NewServiceWithRegistry(cfg ServiceConfig, reg *Registry) *Service {
 		cfgPath:    cfg.ConfigPath,
 		taskPlugin: cfg.TaskPlugin,
 		runner:     cfg.Runner,
+		harness:    cfg.Harness,
 		active:     cfg.Active,
 		workflows:  cfg.Workflows,
 		reg:        reg,
@@ -141,6 +145,12 @@ func (s *Service) Register(ctx context.Context, input RegisterInput) (Info, erro
 	if err != nil {
 		return Info{}, fmt.Errorf("repo %q: task system connectivity: %w", input.Name, err)
 	}
+	if s.harness == nil {
+		return Info{}, fmt.Errorf("repo %q: harness is not configured", input.Name)
+	}
+	if err := s.harness.SetupRepo(ctx, input.Path); err != nil {
+		return Info{}, fmt.Errorf("repo %q: harness setup: %w", input.Name, err)
+	}
 	// Persist atomically, then update the in-memory registry.
 	r := config.Repo{Path: input.Path, TaskConfig: input.TaskConfig}
 	if cfg.Repos == nil {

package/internal/repo/service_test.go

@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	"github.com/rajpopat27/relay-flow/internal/config"
+	"github.com/rajpopat27/relay-flow/internal/harness"
 	"github.com/rajpopat27/relay-flow/internal/repo"
 	"github.com/rajpopat27/relay-flow/internal/runner"
 	"github.com/rajpopat27/relay-flow/internal/task"
@@ -48,6 +49,26 @@ func (f *fakeRunnerDiscovery) EnsureTerminal(context.Context, runner.Environment
 func (f *fakeRunnerDiscovery) CloseTerminals(context.Context, runner.RunSpec) error { return nil }
 func (f *fakeRunnerDiscovery) CleanupRun(context.Context, runner.RunSpec) error     { return nil }
 
+type fakeHarness struct {
+	setupPaths []string
+	setupErr   error
+}
+
+func (f *fakeHarness) SetupRepo(_ context.Context, path string) error {
+	f.setupPaths = append(f.setupPaths, path)
+	return f.setupErr
+}
+func (*fakeHarness) ValidateAgent(context.Context, string, string) error { return nil }
+func (*fakeHarness) FindSession(context.Context, string, string) (harness.Session, bool, error) {
+	return harness.Session{}, false, nil
+}
+func (*fakeHarness) RenderPrompt(harness.PromptKind, harness.PromptData, string) (string, error) {
+	return "", nil
+}
+func (*fakeHarness) BuildCommand(harness.LaunchSpec) (runner.Command, error) {
+	return runner.Command{}, nil
+}
+
 // fakeActiveRuns / fakeWorkflowRefs implement the consumer interfaces.
 type fakeActiveRuns struct{ repos map[string]bool }
 
@@ -102,6 +123,7 @@ type serviceFixture struct {
 	cfgPath string
 	active  *fakeActiveRuns
 	wfRefs  *fakeWorkflowRefs
+	harness *fakeHarness
 }
 
 func newServiceFixture(t *testing.T, rn runner.Runner) serviceFixture {
@@ -118,14 +140,16 @@ func newServiceFixture(t *testing.T, rn runner.Runner) serviceFixture {
 	}
 	active := &fakeActiveRuns{repos: map[string]bool{}}
 	wfRefs := &fakeWorkflowRefs{refs: map[string]bool{}}
+	hrn := &fakeHarness{}
 	svc := repo.NewService(repo.ServiceConfig{
 		ConfigPath: cfgPath,
 		TaskPlugin: "testjira",
 		Runner:     rn,
+		Harness:    hrn,
 		Active:     active,
 		Workflows:  wfRefs,
 	})
-	return serviceFixture{svc: svc, cfgPath: cfgPath, active: active, wfRefs: wfRefs}
+	return serviceFixture{svc: svc, cfgPath: cfgPath, active: active, wfRefs: wfRefs, harness: hrn}
 }
 
 func TestDiscoverDelegatesToRunner(t *testing.T) {
@@ -222,7 +246,7 @@ func TestRegisterValidatesTaskConnectivity(t *testing.T) {
 	}
 	svc := repo.NewService(repo.ServiceConfig{
 		ConfigPath: cfgPath, TaskPlugin: "failingtask",
-		Runner: &fakeRunnerDiscovery{}, Active: &fakeActiveRuns{repos: map[string]bool{}}, Workflows: &fakeWorkflowRefs{refs: map[string]bool{}},
+		Runner: &fakeRunnerDiscovery{}, Harness: &fakeHarness{}, Active: &fakeActiveRuns{repos: map[string]bool{}}, Workflows: &fakeWorkflowRefs{refs: map[string]bool{}},
 	})
 	_, err := svc.Register(context.Background(), repo.RegisterInput{Name: "payments", Path: "/srv/payments", TaskConfig: config.RawValues{"project": "PAY"}})
 	if err == nil {
@@ -256,6 +280,31 @@ func TestRegisterAtomicallyPersists(t *testing.T) {
 	}
 }
 
+func TestRegisterSetsUpHarnessRepo(t *testing.T) {
+	fx := newServiceFixture(t, &fakeRunnerDiscovery{})
+	if _, err := fx.svc.Register(context.Background(), repo.RegisterInput{Name: "payments", Path: "/srv/payments", TaskConfig: config.RawValues{"project": "PAY", "component": "api"}}); err != nil {
+		t.Fatal(err)
+	}
+	if len(fx.harness.setupPaths) != 1 || fx.harness.setupPaths[0] != "/srv/payments" {
+		t.Fatalf("SetupRepo paths = %v", fx.harness.setupPaths)
+	}
+}
+
+func TestRegisterHarnessSetupFailureDoesNotPersist(t *testing.T) {
+	fx := newServiceFixture(t, &fakeRunnerDiscovery{})
+	fx.harness.setupErr = errors.New("setup failed")
+	if _, err := fx.svc.Register(context.Background(), repo.RegisterInput{Name: "payments", Path: "/srv/payments", TaskConfig: config.RawValues{"project": "PAY", "component": "api"}}); err == nil {
+		t.Fatal("registration succeeded despite harness setup failure")
+	}
+	cfg, err := config.LoadMachine(fx.cfgPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(cfg.Repos) != 0 {
+		t.Fatalf("repos persisted after setup failure: %v", cfg.Repos)
+	}
+}
+
 func TestRemoveStopsPollerAndRemoves(t *testing.T) {
 	fx := newServiceFixture(t, &fakeRunnerDiscovery{})
 	if _, err := fx.svc.Register(context.Background(), repo.RegisterInput{Name: "payments", Path: "/srv/payments", TaskConfig: config.RawValues{"project": "PAY", "component": "api"}}); err != nil {