From eff4bf5f823a39bcb4e10c2ca352dea1a40c1758 Mon Sep 17 00:00:00 2001
From: Sage Hart <sagehart@MacBookAir.attlocal.net>
Date: Sun, 12 Jul 2026 20:19:30 -0500
Subject: [PATCH] feat(harness): two-tier verify contract and stub canary

Declare integration_cmd in profile.yaml, add check-stub-canary.sh,
and wire hermetic verify where applicable (stop hook unchanged).
---
 .harness/profile.yaml        |  5 +++++
 scripts/check-stub-canary.sh | 10 ++++++++++
 scripts/integration-e2e.sh   |  6 ++++++
 3 files changed, 21 insertions(+)
 create mode 100755 scripts/check-stub-canary.sh
 create mode 100755 scripts/integration-e2e.sh

diff --git a/.harness/profile.yaml b/.harness/profile.yaml
index 254cab9..05ebe4f 100644
--- a/.harness/profile.yaml
+++ b/.harness/profile.yaml
@@ -21,6 +21,7 @@ requires:
     stop: verify-on-stop
   commands:
     verify: ./scripts/verify.sh
+    integration: ./scripts/integration-e2e.sh
 bundles_applied:
 - cloud-guards
 - verify-on-stop
@@ -34,6 +35,10 @@ verify:
 extensions:
   fleet: null
   eval: null
+  compose:
+    deny_compose_from_worktree: true
+    integration_cmd: ./scripts/integration-e2e.sh
+    integration_ci_required: true
 harness_disclosure:
   schema: harness-disclosure/v1
   scope: repo
diff --git a/scripts/check-stub-canary.sh b/scripts/check-stub-canary.sh
new file mode 100755
index 0000000..47c4a01
--- /dev/null
+++ b/scripts/check-stub-canary.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# DO_NOT_DELETE_STUB_CANARY
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$ROOT"
+if [[ -f scripts/verify.sh ]] && grep -q 'TODO: add real test' scripts/verify.sh; then
+  echo "STUB_CANARY: placeholder verify.sh" >&2
+  exit 1
+fi
+echo "check-stub-canary: ok"
diff --git a/scripts/integration-e2e.sh b/scripts/integration-e2e.sh
new file mode 100755
index 0000000..ad52071
--- /dev/null
+++ b/scripts/integration-e2e.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+# Integration E2E — mirrors CI e2e-smoke job.
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$ROOT"
+npm run test:e2e:smoke