refactor(harnessx-removal): retire the HarnessX scan paths (task 5)

The standard scan now runs run_hunter_pool, verify_findings and the
deterministic fuse_findings directly; the HarnessX hunter orchestrator,
the LLM judge dispatcher (verify_judge.py, deleted with its test) and the
LLM fusion panels are gone, and so are their extra-absent degradations.
host_under_harnessx is dropped from stage_processors.

config: [models] verifier and [fusion] panel_model/decider_model raise
RetiredConfigError naming the plane replacement (the CLI prints it and
exits 2); a [harnessx] section loads with one warning and is otherwise
ignored. harness.json keeps "verifier": null. Tests that asserted the
fallback are renamed to the behaviour they assert; the module-audit
manifest drops verify_judge. Nothing outside the two modules deleted in
task 6 imports harness_ext or hunter_harness.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

src/openultrasast/cli.py

@@ -36,14 +36,12 @@ from .calibration import (
 )
 from .complexity import map as complexity_map
 from .complexity.ledger import persist_verdicts
-from .config import ModelLayerConfig, ObligationsConfig, ResolvedConfig, load_config, load_dotenv
+from .config import ModelLayerConfig, ObligationsConfig, ResolvedConfig, RetiredConfigError, load_config, load_dotenv
 from .findings import StaticFinding, quick_scan_findings, write_findings
-from .fusion import FusionDecision, fuse_findings_dispatch
+from .fusion import FusionDecision, fuse_findings
 from .gate import FALSE_POSITIVE_CEILING, RECALL_FLOOR
 from .harness import HarnessRuntime, HarnessTraceWriter, write_harness_config
-from .harness_ext import has_harnessx
 from .hunter import run_hunter_pool, write_hunter_trajectories
-from .hunter_harness import HxScanOrchestrator
 from .improve import RoundOutcome, run_improvement
 from .index import build_code_chunks
 from .mapping import analyze_entry_points, attach_reachability_hints, ingest_sarif, write_entry_points, write_static_hints
@@ -91,7 +89,6 @@ from .semantic import (
 from .semantic.facts import FactLoadError, SemanticFacts
 from .stages import Stage, plan_for_mode, record_completed, record_skip, skip_as_degradation, stages_payload
 from .verification import VerificationResult, verify_findings, write_verification_results
-from .verify_judge import verify_findings_dispatch
 
 CALIBRATION_DIR = ".openultrasast/calibration"
 
@@ -125,6 +122,14 @@ def _configure_logging() -> None:
 
 
 def main(argv: list[str] | None = None) -> int:
+    try:
+        return _main(argv)
+    except RetiredConfigError as exc:  # a retired key is an error that names its replacement, exit 2
+        print(f"ousast: {exc}", file=sys.stderr)
+        return 2
+
+
+def _main(argv: list[str] | None) -> int:
     if (argv if argv is not None else sys.argv[1:])[:1] != ["pre-push"]:
         load_dotenv()
     parser = argparse.ArgumentParser(prog="ousast")
@@ -431,13 +436,7 @@ def _run_scan(path: Path, config_path: Path, mode: str, fail_on: str) -> ScanOut
 
     plan = plan_for_mode(mode)
     config = load_config(config_path if config_path.exists() else None)
-    # Capability gates for the optional HarnessX agentic plane. When the extra is
-    # absent (default/CI), both stay False and the deterministic path runs unchanged.
     hunter_model = config.models.hunter
-    verifier_model = config.models.verifier
-    harnessx_present = has_harnessx()
-    hx_hunter = mode == "standard" and bool(hunter_model) and harnessx_present
-    hx_verify = mode == "standard" and bool(verifier_model) and harnessx_present
     run = create_scan_run(path, config)
     runtime = HarnessRuntime(
         scan_id=run.scan_id,
@@ -469,28 +468,10 @@ def _run_scan(path: Path, config_path: Path, mode: str, fail_on: str) -> ScanOut
     write_rankings(rankings, run.root / "rank" / "ranking.json")
     write_ranking_calibrations(calibrations, run.root / "calibration" / "applied_calibrations.json")
     if mode == "standard":
-        if hx_hunter and hunter_model:
-            orchestrator = HxScanOrchestrator(
-                provider_model=hunter_model,
-                provider=config.harnessx.provider,
-                max_cost_usd=config.harnessx.max_cost_usd,
-                token_threshold=config.harnessx.token_threshold,
-            )
-            hunter_result = runtime.run_stage(
-                "hunter_pool",
-                lambda: orchestrator.run_pool(
-                    run.target, targets, rankings, scan_id=run.scan_id, ruleset=ruleset, policy=policy, emit=runtime.emit
-                ),
-            )
-        else:
-            if bool(hunter_model) and not harnessx_present:
-                runtime.state["degradations"].append(
-                    {"stage": "hunter_pool", "requested": "harnessx", "reason": "harnessx_extra_unavailable", "fallback": "run_hunter_pool"}
-                )
-            hunter_result = runtime.run_stage(
-                "hunter_pool",
-                lambda: run_hunter_pool(run.target, targets, rankings, scan_id=run.scan_id, ruleset=ruleset, policy=policy),
-            )
+        hunter_result = runtime.run_stage(
+            "hunter_pool",
+            lambda: run_hunter_pool(run.target, targets, rankings, scan_id=run.scan_id, ruleset=ruleset, policy=policy),
+        )
         findings = hunter_result.findings
         trajectories = hunter_result.trajectories
     else:
@@ -530,46 +511,19 @@ def _run_scan(path: Path, config_path: Path, mode: str, fail_on: str) -> ScanOut
     write_findings(findings, findings_path)
     if trajectories:
         write_hunter_trajectories(trajectories, trajectories_path)
-    if mode == "standard" and bool(verifier_model) and not harnessx_present:
-        runtime.state["degradations"].append(
-            {"stage": "verify", "requested": "harnessx", "reason": "harnessx_extra_unavailable", "fallback": "structural_verifier"}
-        )
-    verifications = runtime.run_stage(
-        "verify",
-        lambda: verify_findings_dispatch(
-            findings,
-            verifier_model=verifier_model,
-            verifier_provider=config.harnessx.provider,
-            use_harnessx=hx_verify,
-        ),
-    )
+    verifications = runtime.run_stage("verify", lambda: verify_findings(findings))
     write_verification_results(verifications, verification_path)
     runtime.run_stage(
         "record_calibration",
         lambda: _persist_calibration_feedback(run, ledger_path, prior_learnings, findings, verifications),
     )
-    # Fusion: two-panel adjudication for triggered findings (standard mode). Runs
-    # deterministically by default; routes panels through the configured provider when
-    # a panel model is set and the extra is present, else falls back + records a degradation.
+    # Fusion: deterministic two-panel adjudication for triggered findings (standard mode).
     fusion_decisions: list[FusionDecision] = []
     fusion_path = run.root / "fusion.json"
     if mode == "standard" and config.fusion.enabled:
-        hx_fusion = bool(config.fusion.panel_model) and harnessx_present
-        if bool(config.fusion.panel_model) and not harnessx_present:
-            runtime.state["degradations"].append(
-                {"stage": "fusion", "requested": "harnessx", "reason": "harnessx_extra_unavailable", "fallback": "deterministic_panels"}
-            )
         fusion_decisions = runtime.run_stage(
             "fusion",
-            lambda: fuse_findings_dispatch(
-                findings,
-                verifications,
-                panel_model=config.fusion.panel_model,
-                decider_model=config.fusion.decider_model,
-                provider=config.harnessx.provider,
-                use_harnessx=hx_fusion,
-                high_assurance=config.fusion.high_assurance,
-            ),
+            lambda: fuse_findings(findings, verifications, high_assurance=config.fusion.high_assurance),
         )
         if fusion_decisions:
             fusion_path.write_text(json.dumps([decision.to_dict() for decision in fusion_decisions], indent=2, sort_keys=True) + "\n")