feat: Update CONTRIBUTING.md with CI runner guidelines and desktop tray approval file management; enhance TASK.md with progress on Tauri integration and agent harness documentation; improve VS Code extension with new command for writing harness summaries; refine CLI with local HTTP fixture for integration testing

Author: HasanH47

.bench/README.md

@@ -0,0 +1,9 @@
+# Benchmark harness (placeholder)
+
+This directory is reserved for **SWE-bench**, **Terminal-Bench**, or other external task slices.
+
+- Local baseline: `./scripts/phase5-smoke.sh` (set `CANTRIK_BENCH_HARNESS=1` when wiring a runner).
+- CI: see [`.github/workflows/benchmark-harness.yml`](../.github/workflows/benchmark-harness.yml) (`workflow_dispatch`, does not gate the main Rust job).
+- Upstream SWE-bench: clone or submodule [https://github.com/princeton-nlp/SWE-bench](https://github.com/princeton-nlp/SWE-bench) into a subdirectory here in a follow-up iteration.
+
+Do not commit large datasets to this repo without an explicit maintainer decision.

.github/workflows/benchmark-harness.yml

@@ -17,11 +17,15 @@ jobs:
           echo "# Bench placeholder — replace with submodule or fetch of SWE-bench / Terminal-Bench slice." > .bench/minimal/README.md
           test -f .bench/minimal/README.md
 
+      - name: Bench policy (repo docs)
+        run: test -f .bench/README.md && sed -n '1,12p' .bench/README.md
+
       - name: Document local baseline
         run: |
           echo "Local baseline: ./scripts/phase5-smoke.sh"
           echo "Optional env when wiring an external runner: CANTRIK_BENCH_HARNESS=1"
           echo "Full cantrik build + bench execution belongs here in a follow-up iteration."
 
       - name: Success
-        run: echo "benchmark-harness: placeholder OK (exit 0)"
+        run: |
+          echo "benchmark-harness: placeholder OK (exit 0)"

.github/workflows/swe-e2e-smoke.yml

@@ -0,0 +1,26 @@
+# Regression smoke: `cantrik fix --approve --fetch` against a local HTTP fixture (no LLM).
+name: SWE E2E smoke
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - "crates/cantrik-cli/**"
+      - "crates/cantrik-core/**"
+      - ".github/workflows/swe-e2e-smoke.yml"
+
+jobs:
+  fix-fetch-fixture:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Install protoc + bubblewrap + ripgrep
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler bubblewrap ripgrep
+
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Run fix fetch integration test
+        run: cargo test -p cantrik-cli fetch_integration::fix_approve_fetch_reaches_local_http -- --exact --nocapture

CONTRIBUTING.md

@@ -81,6 +81,15 @@ Untuk menambah entri di [`apps/cantrik-site/static/registry/recipes.json`](apps/
 - Set `sandbox.level = "container"` **hanya** jika operator siap: butuh biner `runsc` dan kebijakan host.
 - Set env `CANTRIK_RUNSC_BIN` ke path `runsc`. Opsional: `CANTRIK_RUNSC_RUN_ARGS` — token dipisah spasi yang disisipkan setelah `runsc run` (contoh: `--network=none` jika didukung setup Anda).
 - Tanpa env tersebut, level `container` gagal dengan pesan jelas (lebih aman daripada mengeksekusi tanpa isolasi yang dimaksud).
+- **CI:** runner GitHub Actions default tidak menyediakan `runsc` atau izin privileged; gunakan runner self-hosted atau abaikan job khusus sampai kebijakan infra jelas. Validasi lokal dengan `CANTRIK_RUNSC_BIN` tetap menjadi tanggung jawab operator.
+
+### Desktop tray (Tauri) — file flag approval
+
+Companion [`apps/cantrik-tauri`](apps/cantrik-tauri/) memantau file yang sama dengan daemon/tray Rust:
+
+- Default: `data_local_dir()/cantrik/approval-pending.flag` (biasanya `~/.local/share/cantrik/approval-pending.flag` pada Linux).
+- Override penuh: env `CANTRIK_APPROVAL_FLAG_PATH` (path absolut atau relatif ke cwd proses tray).
+- Agar selaras dengan merge config CLI: set `CANTRIK_PROJECT_ROOT` ke root repo; Tauri membaca `~/.config/cantrik/config.toml` lalu `.cantrik/cantrik.toml` untuk field `[background].approval_flag_path` (proyek menimpa global).
 
 ### Self-improvement (safe profile)
 
@@ -90,6 +99,7 @@ Menjalankan Cantrik pada **repo Cantrik sendiri** untuk saran perbaikan:
 - Anggap biaya API dan risiko prompt injection dari konten repo; dokumentasikan asumsi di issue/PR.
 - Otomatisasi penuh “self-rewrite” tetap di backlog hingga ada gate produk (tes, approval, rollback).
 - **Dry-run skrip:** [`scripts/self-improve-dry-run.sh`](scripts/self-improve-dry-run.sh) menjalankan satu `cantrik ask` read-only pada repo (tanpa `--approve`); gunakan sebagai langkah manual sebelum otomasi patch.
+- **Gate sebelum otomasi patch (MVP):** wajibkan dry-run + review manusia pada diff; batasi konteks/token di config; otomasi PR hanya dari **fork** atau branch eksperimen; tidak ada loop tanpa henti tanpa human-in-the-loop.
 
 ### SWE constrained workflow (manual checklist)
 
@@ -100,15 +110,15 @@ Alur terbatas untuk satu issue publik + satu repo lokal:
 3. Opsional: `--experiment` — masih membutuhkan `--approve`; menjalankan mode experiment (writes + tes + revert) — review diff sebelum commit.
 4. `cantrik pr create --approve` atau alur Git manual; tidak ada jaminan “high reliability” sampai ada tes integrasi produk.
 
-**Kebijakan / QA produk (rantai `fix`):** flag `--run-agents` / `--run-experiment` wajib dipasangkan dengan `--approve` dan `--fetch`; invariant ini dites di unit test (`fix_cmd::validate_fix_flags`). Tes integrasi jaringan penuh tetap manual / backlog hingga ada fixture otomatis.
+**Kebijakan / QA produk (rantai `fix`):** flag `--run-agents` / `--run-experiment` wajib dipasangkan dengan `--approve` dan `--fetch`; invariant ini dites di unit test (`fix_cmd::validate_fix_flags`). Tes integrasi **tanpa LLM**: `fix_cmd::fetch_integration::fix_approve_fetch_reaches_local_http` (wiremock) + workflow [`.github/workflows/swe-e2e-smoke.yml`](.github/workflows/swe-e2e-smoke.yml).
 
 **Definisi “high reliability” (SWE otonom penuh):** lihat template issue [SWE E2E reliability](.github/ISSUE_TEMPLATE/swe_e2e_reliability.md) — minimal satu skenario E2E terotomatisasi sebelum mengklaim item backlog terkait selesai.
 
 ### Phase 5 triage (contributors)
 
 - **Tree-sitter:** lihat [`docs/tree-sitter-language-extensions.md`](docs/tree-sitter-language-extensions.md) (kompatibilitas grammar vs versi `tree-sitter` workspace); satu bahasa per PR.
 - **Sandbox enterprise (gVisor / Firecracker):** titik masuk ada di `crates/cantrik-core/src/tool_system/sandbox.rs`; butuh desain admin + CI khusus.
-- **Hybrid SSH / cloud executor:** RFC [`docs/rfc-hybrid-ssh-executor.md`](docs/rfc-hybrid-ssh-executor.md); implementasi setelah threat model disetujui.
+- **Hybrid SSH / cloud executor:** RFC [`docs/rfc-hybrid-ssh-executor.md`](docs/rfc-hybrid-ssh-executor.md); MVP CLI: `cantrik exec --remote` + `[remote_exec]`. **Sync workspace (manual dulu):** gunakan `rsync`/`scp` dengan `--dry-run` lalu review; setelah tree remote cocok, jalankan `cantrik exec --remote --approve -- …` di host tujuan. Otomatisasi sync dengan `--approve` = backlog terpisah (RFC).
 - **Benchmark SWE-bench / Terminal-Bench:** skrip baseline [`scripts/phase5-smoke.sh`](scripts/phase5-smoke.sh) (quality gates + hook `CANTRIK_BENCH_HARNESS=1`); demo alur terbatas [`scripts/swe-fix-demo.sh`](scripts/swe-fix-demo.sh) dengan `ISSUE_URL=…`.
 - **`cantrik fix` / agents:** `cantrik fix URL --approve --fetch --run-agents` (+ timeout `CANTRIK_FIX_AGENT_TIMEOUT_SEC`); `--run-experiment` merantai mode experiment; `cantrik agents "…" --reflect` = satu putaran reviewer LLM.
 - **Agent harness artefak:** `cantrik status --write-harness-summary` menulis `.cantrik/session-harness-summary.json` (payload job + `generated_at_unix`) untuk di-attach ke CI atau dashboard eksternal.

TASK.md

@@ -371,42 +371,49 @@ default_model = "llama-3.3-70b-versatile"
 - [x] **Enterprise / air-gap audit** — checklist di [CONTRIBUTING.md](CONTRIBUTING.md) § *Enterprise release checklist* + template issue [`.github/ISSUE_TEMPLATE/release_audit.md`](.github/ISSUE_TEMPLATE/release_audit.md).
 - [x] **Distribusi matang** (MVP proses) — instruksi maintainer per tag: PKGBUILD / winget di [CONTRIBUTING.md](CONTRIBUTING.md) § *Distribusi*; `winget validate` di CI; **Nix** = DoD devShell-only ([`packaging/nix/README.md`](packaging/nix/README.md), tanpa derivasi `nix build` penuh sampai iterasi flake).
 - [x] **VS Code polish** — perintah *Run in workspace* (`cantrik.runInWorkspace` → `doctor` dengan cwd folder); `cantrik.executablePath` dipakai untuk status bar + perintah palette.
-- [x] **Tauri + approval UX** — polling `approval-pending.flag` di `data_local_dir/cantrik/` sama dengan [`cantrik-tray`](apps/cantrik-tray/) ([`apps/cantrik-tauri`](apps/cantrik-tauri/)). **Follow-up:** baca `[background].approval_flag_path` dari config di companion (bukan hanya default path).
+- [x] **Tauri + approval UX** — polling flag; baca `CANTRIK_APPROVAL_FLAG_PATH`, lalu `[background].approval_flag_path` dari `~/.config/cantrik/config.toml` + opsional `CANTRIK_PROJECT_ROOT` → `.cantrik/cantrik.toml` ([`apps/cantrik-tauri`](apps/cantrik-tauri/)); fallback share dir sama [`cantrik-tray`](apps/cantrik-tray/).
 - [x] **Health mendalam** — `cantrik health --sarif` (keluaran SARIF 2.1.0 ke stdout); gate CI terpisah tidak wajib (opsional bila tim butuh).
 
 ### Phase 5 — Maturity & Excellence
 
 - [ ] **Full autonomous SWE-agent** — end-to-end fix GitHub issues dengan reliabilitas tinggi  
   - [x] Alur terbatas: `cantrik fix URL --approve --fetch --run-agents` + timeout agents (`CANTRIK_FIX_AGENT_TIMEOUT_SEC`); demo [`scripts/swe-fix-demo.sh`](scripts/swe-fix-demo.sh); checklist manual [CONTRIBUTING.md](CONTRIBUTING.md) § *SWE constrained workflow*.  
-  - [ ] Otomatisasi penuh + tes regresi produk — template lintasan: [`.github/ISSUE_TEMPLATE/swe_e2e_reliability.md`](.github/ISSUE_TEMPLATE/swe_e2e_reliability.md).
+  - [x] Regresi otomatis tanpa LLM: tes `fix_cmd::fetch_integration::fix_approve_fetch_reaches_local_http` + workflow [`.github/workflows/swe-e2e-smoke.yml`](.github/workflows/swe-e2e-smoke.yml). **Ditunda:** otomasi penuh “high reliability” + fixture skala produk (template [`.github/ISSUE_TEMPLATE/swe_e2e_reliability.md`](.github/ISSUE_TEMPLATE/swe_e2e_reliability.md)).
 - [ ] **Agent harness** (refleksi, re-plan, dashboard)  
   - [x] Refleksi: `cantrik agents … --reflect`.  
   - [x] Dashboard statis: [`/dashboard`](apps/cantrik-site/src/routes/dashboard/+page.svelte); `cantrik status --json`.  
   - [x] Re-plan terkonfigurasi: `[planning] max_replan_cycles` / `stuck_threshold_attempts`; ringkasan `plan --run` → `.cantrik/plan-run-summary.json`.  
-  - [x] Agregat multi-sesi (MVP): `cantrik status --write-harness-summary` → `.cantrik/session-harness-summary.json`. **Ditunda:** UI kaya di luar JSON statis.
+  - [x] Agregat multi-sesi (MVP): `cantrik status --write-harness-summary` → `.cantrik/session-harness-summary.json`.
+  - [x] Dokumentasi hub: [`/docs/agent-harness`](apps/cantrik-site/src/routes/docs/agent-harness/+page.svelte); VS Code: `cantrik.writeHarnessSummary`. **Ditunda:** UI kaya interaktif di luar JSON statis.
 - [ ] **Self-improvement pada repo Cantrik**  
   - [x] MVP dokumen: profil aman + etika/biaya ([CONTRIBUTING.md](CONTRIBUTING.md) § *Self-improvement (safe profile)*).  
-  - [x] Skrip dry-run read-only: [`scripts/self-improve-dry-run.sh`](scripts/self-improve-dry-run.sh). **Ditunda:** otomatisasi saran patch dengan gate produk penuh.
+  - [x] Skrip dry-run read-only: [`scripts/self-improve-dry-run.sh`](scripts/self-improve-dry-run.sh).
+  - [x] Gate dokumentasi (fork / review / batas token): [CONTRIBUTING.md](CONTRIBUTING.md) § *Self-improvement*. **Ditunda:** otomatisasi saran patch dengan gate produk penuh di CI.
 - [ ] **Benchmark formal** (SWE-bench / Terminal-Bench)  
   - [x] Baseline: [`scripts/phase5-smoke.sh`](scripts/phase5-smoke.sh); hook `CANTRIK_BENCH_HARNESS=1`.  
-  - [x] Job workflow_dispatch + langkah placeholder + dataset mini ([`.github/workflows/benchmark-harness.yml`](.github/workflows/benchmark-harness.yml)); sambungan repo harness eksternal = follow-up.
-- [ ] **Recipes & templates di cantrik.dev**  
+  - [x] Job workflow_dispatch + langkah placeholder + dataset mini + kebijakan [.bench/README.md](.bench/README.md) ([`.github/workflows/benchmark-harness.yml`](.github/workflows/benchmark-harness.yml)). **Ditunda:** submodule / clone SWE-bench slice + runner terukur.
+- [x] **Recipes & templates di cantrik.dev** (MVP registry)  
   - [x] JSON [`static/registry/recipes.json`](apps/cantrik-site/static/registry/recipes.json).  
   - [x] Halaman [`/registry/recipes`](apps/cantrik-site/src/routes/registry/recipes/+page.svelte).  
-  - [x] Panduan PR + skema minimal + validasi CI ([CONTRIBUTING.md](CONTRIBUTING.md) § *Registry recipes*, [`scripts/validate-recipes-registry.py`](scripts/validate-recipes-registry.py)).
+  - [x] Panduan PR + skema minimal + validasi CI ([CONTRIBUTING.md](CONTRIBUTING.md) § *Registry recipes*, [`scripts/validate-recipes-registry.py`](scripts/validate-recipes-registry.py)).  
+  - [ ] Kurasi editorial / moderasi komunitas skala besar (di luar validasi skema).
 - [ ] **Hybrid SSH / cloud executor**  
   - [x] RFC desain: [`docs/rfc-hybrid-ssh-executor.md`](docs/rfc-hybrid-ssh-executor.md).  
-  - [x] MVP CLI: `[remote_exec]` + `cantrik exec --remote` (dry-run) / `--approve` menjalankan `ssh` ([RFC](docs/rfc-hybrid-ssh-executor.md)). **Ditunda:** sync workspace, approval UI khusus, sandbox di sisi remote.
+  - [x] MVP CLI: `[remote_exec]` + `cantrik exec --remote` (dry-run) / `--approve` menjalankan `ssh` ([RFC](docs/rfc-hybrid-ssh-executor.md)).  
+  - [x] Dokumentasi sync manual (`rsync`/`scp` + dry-run) di [CONTRIBUTING.md](CONTRIBUTING.md) § Phase 5 triage. **Ditunda:** sync terotomatisasi dengan `--approve`, approval UI khusus, sandbox di sisi remote.
 - [ ] **Tree-sitter tambahan** (Kotlin, Swift, …)  
   - [x] Catatan kompatibilitas grammar vs `tree-sitter` workspace: [`docs/tree-sitter-language-extensions.md`](docs/tree-sitter-language-extensions.md).  
-  - [x] Bash / shell: `tree-sitter-bash` + indeks `.sh`/`.bash` ([`chunk.rs`](crates/cantrik-core/src/indexing/chunk.rs)). **Ditunda:** Kotlin, Swift, … per PR terpisah.
+  - [x] Bash / shell: `tree-sitter-bash` + indeks `.sh`/`.bash` ([`chunk.rs`](crates/cantrik-core/src/indexing/chunk.rs)).  
+  - [x] CSS: `tree-sitter-css` + indeks `.css`. **Ditunda:** Kotlin, Swift, … per PR terpisah (grammar harus kompatibel TS 0.26+).
 - [x] **TUI split pane** — selesai Sprint 18 (`[ui] tui_split_pane`, TASK § Sprint 18). **Ditunda:** panel semantic diff / approval penuh (§6 Enhancement PRD).  
 - [ ] **`cantrik fix` penuh**  
   - [x] `--approve --fetch`, `--run-agents`, `--experiment` (rantai eksperimental, approval eksplisit).  
-  - [x] Kebijakan + invariant flag di [CONTRIBUTING.md](CONTRIBUTING.md) + unit test `fix_cmd::validate_fix_flags` / `is_github_issue_url`. **Ditunda:** integrasi jaringan otomatis tanpa LLM fixture.
+  - [x] Kebijakan + invariant flag di [CONTRIBUTING.md](CONTRIBUTING.md) + unit test `fix_cmd::validate_fix_flags` / `is_github_issue_url`.  
+  - [x] Integrasi HTTP lokal tanpa LLM: `fix_cmd::fetch_integration` (wiremock). **Ditunda:** skenario fetch terhadap host nyata terpantau / katalog fixture besar.
 - [ ] **Sandbox enterprise** (gVisor / Firecracker)  
   - [x] Dokumentasi + arah di [`sandbox.rs`](crates/cantrik-core/src/tool_system/sandbox.rs); level `container` = placeholder.  
-  - [x] Hook `CANTRIK_RUNSC_BIN` / opsional `CANTRIK_RUNSC_RUN_ARGS` untuk `sandbox.level = "container"` + dokumentasi admin ([CONTRIBUTING.md](CONTRIBUTING.md)). **Ditunda:** CI dengan runsc, micro-VM penuh.
+  - [x] Hook `CANTRIK_RUNSC_BIN` / opsional `CANTRIK_RUNSC_RUN_ARGS` untuk `sandbox.level = "container"` + dokumentasi admin ([CONTRIBUTING.md](CONTRIBUTING.md)).  
+  - [x] Catatan CI GitHub Actions vs runsc (self-hosted) di CONTRIBUTING. **Ditunda:** job CI runsc otomatis, micro-VM penuh.
 
 ---
 

apps/cantrik-site/src/routes/+layout.svelte

@@ -28,6 +28,7 @@
 			<a class="text-ash hover:text-gold" href={resolve('/registry')}>Plugin registry</a>
 			<a class="text-ash hover:text-gold" href={resolve('/registry/recipes')}>Recipes</a>
 			<a class="text-ash hover:text-gold" href={resolve('/dashboard')}>Dashboard</a>
+			<a class="text-ash hover:text-gold" href={resolve('/docs/agent-harness')}>Harness</a>
 			<a
 				class="text-ash hover:text-gold"
 				href="https://github.com/sangkan-dev/cantrik"

apps/cantrik-site/src/routes/docs/+page.svelte

@@ -30,6 +30,11 @@
 				rel="noreferrer">Contributing</a
 			>
 		</li>
+		<li>
+			<a class="text-gold hover:text-gold-bright" href={resolve('/docs/agent-harness')}
+				>Agent harness (JSON / CI)</a
+			>
+		</li>
 	</ul>
 	<p class="mt-10 font-mono text-sm">
 		<a class="text-gold hover:text-gold-bright" href={resolve('/')}>Back home</a>

apps/cantrik-site/src/routes/docs/agent-harness/+page.svelte

@@ -0,0 +1,35 @@
+<script lang="ts">
+	import { resolve } from '$app/paths';
+</script>
+
+<main class="mx-auto max-w-3xl px-6 py-16">
+	<h1 class="font-heading text-3xl font-semibold text-gold-bright">Agent harness (CI artefak)</h1>
+	<p class="mt-4 font-mono text-sm text-ash">
+		Gunakan keluaran JSON Cantrik untuk dashboard eksternal atau job CI — tanpa backend dinamis di site ini.
+	</p>
+
+	<h2 class="mt-10 font-heading text-xl font-semibold text-gold-bright">1. Status job lokal</h2>
+	<pre class="mt-3 overflow-x-auto rounded bg-andesite-lighter p-4 font-mono text-xs text-ash">cantrik status --json</pre>
+	<p class="mt-2 font-mono text-sm text-ash">
+		Di VS Code, panel webview memanggil perintah ini pada root workspace (lihat extension Cantrik).
+	</p>
+
+	<h2 class="mt-10 font-heading text-xl font-semibold text-gold-bright">2. Ringkasan berkas untuk CI</h2>
+	<pre class="mt-3 overflow-x-auto rounded bg-andesite-lighter p-4 font-mono text-xs text-ash">cantrik status --write-harness-summary</pre>
+	<p class="mt-2 font-mono text-sm text-ash">
+		Menulis <code class="text-gold">.cantrik/session-harness-summary.json</code> (daftar job + timestamp Unix). Unggah artefak
+		ini dari workflow GitHub Actions dengan <code class="text-gold">actions/upload-artifact</code>.
+	</p>
+
+	<h2 class="mt-10 font-heading text-xl font-semibold text-gold-bright">3. Plan run summary</h2>
+	<p class="mt-2 font-mono text-sm text-ash">
+		Alur <code class="text-gold">cantrik plan --run</code> menghasilkan
+		<code class="text-gold">.cantrik/plan-run-summary.json</code> — cocok untuk metrik re-plan di pipeline terpisah.
+	</p>
+
+	<p class="mt-12 font-mono text-sm">
+		<a class="text-gold hover:text-gold-bright" href={resolve('/docs')}>← Docs</a>
+		·
+		<a class="text-gold hover:text-gold-bright" href={resolve('/dashboard')}>Dashboard</a>
+	</p>
+</main>

apps/cantrik-tauri/src-tauri/Cargo.toml

@@ -16,3 +16,5 @@ tauri-build = { version = "2", features = [] }
 tauri = { version = "2", features = ["tray-icon"] }
 dirs = "6.0.0"
 notify-rust = "4.11"
+serde = { version = "1.0", features = ["derive"] }
+toml = "0.8"