From 381df75dbd89fe5d061aff3db5ae7c84aad19d35 Mon Sep 17 00:00:00 2001
From: Sage Hart <sagehart@MacBookAir.attlocal.net>
Date: Sun, 12 Jul 2026 20:29:10 -0500
Subject: [PATCH] feat(harness): two-tier verify contract and stub canary

Wire check-stub-canary into verify.sh and declare integration: null
with hermetic_stop_only in profile disclosure.
---
 .harness/profile.yaml        |  3 +++
 scripts/check-stub-canary.sh | 10 ++++++++++
 scripts/verify.sh            |  4 ++++
 3 files changed, 17 insertions(+)
 create mode 100755 scripts/check-stub-canary.sh

diff --git a/.harness/profile.yaml b/.harness/profile.yaml
index 0a1b5d1..b86474e 100644
--- a/.harness/profile.yaml
+++ b/.harness/profile.yaml
@@ -21,6 +21,7 @@ requires:
     stop: verify-on-stop
   commands:
     verify: ./scripts/verify.sh
+    integration: null
 bundles_applied:
   - cloud-guards
   - verify-on-stop
@@ -42,6 +43,8 @@ harness_disclosure:
     bundles_applied: []
     verify:
       cmd: ./scripts/verify.sh
+      integration_cmd: null
+      hermetic_stop_only: true
       stop_verify: project-verify-on-stop
       cloud_verify: null
     agents_md_lines: null
diff --git a/scripts/check-stub-canary.sh b/scripts/check-stub-canary.sh
new file mode 100755
index 0000000..47c4a01
--- /dev/null
+++ b/scripts/check-stub-canary.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# DO_NOT_DELETE_STUB_CANARY
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$ROOT"
+if [[ -f scripts/verify.sh ]] && grep -q 'TODO: add real test' scripts/verify.sh; then
+  echo "STUB_CANARY: placeholder verify.sh" >&2
+  exit 1
+fi
+echo "check-stub-canary: ok"
diff --git a/scripts/verify.sh b/scripts/verify.sh
index 70f3d34..e2cbaa7 100755
--- a/scripts/verify.sh
+++ b/scripts/verify.sh
@@ -4,6 +4,10 @@ set -euo pipefail
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 cd "$ROOT"
 
+if [[ -x ./scripts/check-stub-canary.sh ]]; then
+  ./scripts/check-stub-canary.sh
+fi
+
 if command -v corepack >/dev/null 2>&1; then
   corepack enable >/dev/null 2>&1 || true
   corepack prepare npm@10.9.2 --activate >/dev/null 2>&1 || true