test: extend automated coding standards enforcement

[cursor]

Summary

Audits the codebase against docs/coding-standards.md and strengthens automated guardrails so architecture rules are enforced in CI via pnpm standards:check.

What was already compliant

The registry-driven model is in good shape:

• 11 consolidated MCP tools only (harness_list … harness_schema) — no stray server.registerTool() calls
• Pure-data toolsets — no HarnessClient / MCP SDK / Registry imports in toolset files
• Stdio safety — no console.log() in src/
• Singleton HTTP client — HarnessClient constructed only in src/index.ts
• Documented fetch() exceptions — log blob CDN URLs and audit webhooks only
• Registry contract — valid scope, identifierFields, and operationPolicy on all CRUD operations
• Zod v4 imports in tool handlers and config

Changes in this PR

New automated checks (tests/coding-standards/tool-handlers.test.ts)

• Every inputSchema field has .describe() (including shared schemas like resourceScopeSchema)
• Write/execute handlers wire confirmViaElicitation and expose confirm param
• Standard isUserError → errorResult → throw toMcpError catch pattern on API-facing handlers
• harness_list pagination defaults (page=0, size=20, max 100)
• Read-only vs destructive MCP annotation hints

Extended registry contract tests

• executeActions now verified for operationPolicy.risk + retryPolicy

Code fix

• harness-schema.ts outer catch now follows the standard error mapping pattern instead of always returning errorResult

Docs alignment

• Updated docs/coding-standards.md to reference confirm / elicitation (was stale confirmation: true)

Verification

pnpm standards:check  # 23 tests
pnpm build && pnpm typecheck && pnpm test  # 2153 tests

Known gaps (documented but not yet automated)

These remain manual review items for future guardrails:

• Inline response extractors in some toolsets (e.g. knowledge-graph.ts, semantic-layer.ts)
• listFilterFields on 15 get-only resources (should move to paramsSchema per standards)
• passthrough usage volume (~200+) — acceptable only when API shape is already agent-facing
• Toolset purity beyond forbidden imports (yaml, preflight HTTP in ccm.ts/scs.ts)

  

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ thisrohangupta
❌ cursoragent
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[thisrohangupta]

Closing as stale: merge conflicts with main and work superseded by merged PRs (#447, #446, #449, #469, #440, #398, etc.) or duplicate agent-generated attempts. Reopen from a fresh branch if still needed.