snapsynapse/Harnessie Verify

Verify a PR's claims, not its word: sandboxed checks plus an independent verifier model; fail-closed exit codes gate merges.

Trust Signals

name	description	required	default
criteria	Path to a claims file, or "auto" to derive claims from the PR body (boilerplate stripped, provenance-stamped; auto is convenience, not authority).	no	auto
checks	Deterministic check commands, one per line. Each runs sandboxed in the workspace; exit 0 is the only accepted pass.	no	""
models	Path to a Harnessie models.yaml in the repo. Mutually exclusive with models-endpoint.	no	""
models-endpoint	OpenAI-compatible base URL for the verifier model (e.g. a self-hosted endpoint). Used when models is not set. API key must arrive as the HARNESSIE_MODEL_API_KEY env var from the workflow, never as an input.	no	""
models-model	Model id at models-endpoint (required with models-endpoint).	no	""
allow-network	Let check commands use the network (checks are network-denied by default; the verifier agent stays denied regardless).	no	false
stage-diff	Stage the PR diff into the workspace as PR.diff so change-surface claims are checkable. Requires actions/checkout with fetch-depth: 0.	no	true
fail-on-cannot-verify	Map exit 2 (cannot verify: no sandbox backend, provider error, missing config) to a failing job. Fail-closed is the default and the recommendation; set false for advisory mode.	no	true
report-artifact	Upload report.md and proofs as a workflow artifact.	no	true
harnessie-version	harnessie version to install (the action pins its tested default).	no	0.7.1
max-steps	Verifier agent step ceiling.	no	20

name	description
verdict	VERIFIED, FAILED, or CANNOT_VERIFY
exit-code	Raw harnessie verify exit code (0/1/2)
report-path	Path to the generated report.md