Adversarial harness gates (two-tier verify)

.harness/profile.yaml

@@ -21,6 +21,7 @@ requires:
     stop: verify-on-stop
   commands:
     verify: ./scripts/verify.sh
+    integration: ./scripts/integration-e2e.sh
 bundles_applied:
 - cloud-guards
 - verify-on-stop
@@ -34,6 +35,10 @@ verify:
 extensions:
   fleet: null
   eval: null
+  compose:
+    deny_compose_from_worktree: true
+    integration_cmd: ./scripts/integration-e2e.sh
+    integration_ci_required: true
 harness_disclosure:
   schema: harness-disclosure/v1
   scope: repo

scripts/check-stub-canary.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# DO_NOT_DELETE_STUB_CANARY
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$ROOT"
+if [[ -f scripts/verify.sh ]] && grep -q 'TODO: add real test' scripts/verify.sh; then
+  echo "STUB_CANARY: placeholder verify.sh" >&2
+  exit 1
+fi
+echo "check-stub-canary: ok"

scripts/integration-e2e.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+# Integration E2E — mirrors CI e2e-smoke job.
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$ROOT"
+npm run test:e2e:smoke