@ahmed-g-gad/apothem 0.1.1

package/src/apothem/harnesses/claude_code/templates/settings.json

@@ -0,0 +1,351 @@
+{
+  "permissions": {
+    "allow": [
+      "Read",
+      "Glob",
+      "Grep",
+      "Bash(git log:*)"
+    ],
+    "deny": [
+      "Read(.env*)",
+      "Read(**/.env)",
+      "Read(**/.env.*)",
+      "Read(~/.ssh/**)",
+      "Read(**/.audit/**)",
+      "Read(**/__pycache__/**)",
+      "Read(**/.mypy_cache/**)",
+      "Read(**/.pytest_cache/**)",
+      "Read(**/.ruff_cache/**)",
+      "Read(**/.tox/**)",
+      "Read(**/.venv/**)",
+      "Read(**/node_modules/**)",
+      "Read(**/dist/**)",
+      "Read(**/build/**)",
+      "Read(**/site/dist/**)",
+      "Bash(rm -rf /:*)",
+      "Bash(rm -rf /*:*)",
+      "Bash(rm -rf ~:*)",
+      "Bash(rm -rf ~/:*)",
+      "Bash(sudo:*)",
+      "Bash(git push --force:*)",
+      "Bash(git push --force-with-lease:*)",
+      "Bash(git push -f:*)",
+      "Bash(eval:*)",
+      "Bash(exec:*)"
+    ]
+  },
+  "hooks": {
+    "SessionStart": [
+      {
+        "matcher": "*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${PYTHON_BIN}",
+            "timeout": 30,
+            "statusMessage": "Initializing session posture",
+            "args": [
+              "${HARNESS_ROOT}/apothem/hooks/dispatch.py",
+              "SessionStart"
+            ]
+          }
+        ]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${PYTHON_BIN}",
+            "timeout": 10,
+            "statusMessage": "Validating write target and content",
+            "args": [
+              "${HARNESS_ROOT}/apothem/hooks/dispatch.py",
+              "PreToolUse",
+              "pretooluse-write"
+            ]
+          },
+          {
+            "type": "command",
+            "command": "${PYTHON_BIN}",
+            "timeout": 10,
+            "statusMessage": "Injecting authorship header if missing",
+            "args": [
+              "${HARNESS_ROOT}/apothem/hooks/dispatch.py",
+              "PreToolUse",
+              "pretooluse-write-header-guard"
+            ]
+          },
+          {
+            "type": "command",
+            "command": "${PYTHON_BIN}",
+            "timeout": 10,
+            "statusMessage": "Enforcing plans locality on the target path",
+            "args": [
+              "${HARNESS_ROOT}/apothem/hooks/dispatch.py",
+              "PreToolUse",
+              "pretooluse-write-plan-guard"
+            ]
+          },
+          {
+            "type": "command",
+            "command": "${PYTHON_BIN}",
+            "timeout": 10,
+            "statusMessage": "Flagging unpinned or untrusted dependency additions",
+            "args": [
+              "${HARNESS_ROOT}/apothem/hooks/dispatch.py",
+              "PreToolUse",
+              "pretooluse-dependency-guard"
+            ]
+          },
+          {
+            "type": "command",
+            "command": "${PYTHON_BIN}",
+            "timeout": 10,
+            "statusMessage": "Flagging unsafe dynamic evaluation or deserialization",
+            "args": [
+              "${HARNESS_ROOT}/apothem/hooks/dispatch.py",
+              "PreToolUse",
+              "pretooluse-eval-guard"
+            ]
+          },
+          {
+            "type": "command",
+            "command": "${PYTHON_BIN}",
+            "timeout": 10,
+            "statusMessage": "Running conformity checks on proposed content",
+            "args": [
+              "${HARNESS_ROOT}/apothem/conformity/gate.py",
+              "--hook"
+            ]
+          }
+        ]
+      },
+      {
+        "matcher": "Edit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${PYTHON_BIN}",
+            "timeout": 10,
+            "statusMessage": "Validating edit target and content",
+            "args": [
+              "${HARNESS_ROOT}/apothem/hooks/dispatch.py",
+              "PreToolUse",
+              "pretooluse-edit"
+            ]
+          },
+          {
+            "type": "command",
+            "command": "${PYTHON_BIN}",
+            "timeout": 10,
+            "statusMessage": "Injecting authorship header on file creation",
+            "args": [
+              "${HARNESS_ROOT}/apothem/hooks/dispatch.py",
+              "PreToolUse",
+              "pretooluse-edit-header-guard"
+            ]
+          },
+          {
+            "type": "command",
+            "command": "${PYTHON_BIN}",
+            "timeout": 10,
+            "statusMessage": "Enforcing plans locality on the target path",
+            "args": [
+              "${HARNESS_ROOT}/apothem/hooks/dispatch.py",
+              "PreToolUse",
+              "pretooluse-write-plan-guard"
+            ]
+          },
+          {
+            "type": "command",
+            "command": "${PYTHON_BIN}",
+            "timeout": 10,
+            "statusMessage": "Flagging unpinned or untrusted dependency additions",
+            "args": [
+              "${HARNESS_ROOT}/apothem/hooks/dispatch.py",
+              "PreToolUse",
+              "pretooluse-dependency-guard"
+            ]
+          },
+          {
+            "type": "command",
+            "command": "${PYTHON_BIN}",
+            "timeout": 10,
+            "statusMessage": "Flagging unsafe dynamic evaluation or deserialization",
+            "args": [
+              "${HARNESS_ROOT}/apothem/hooks/dispatch.py",
+              "PreToolUse",
+              "pretooluse-eval-guard"
+            ]
+          },
+          {
+            "type": "command",
+            "command": "${PYTHON_BIN}",
+            "timeout": 10,
+            "statusMessage": "Running conformity checks on proposed content",
+            "args": [
+              "${HARNESS_ROOT}/apothem/conformity/gate.py",
+              "--hook"
+            ]
+          }
+        ]
+      },
+      {
+        "matcher": "NotebookEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${PYTHON_BIN}",
+            "timeout": 10,
+            "statusMessage": "Validating notebook cell content",
+            "args": [
+              "${HARNESS_ROOT}/apothem/hooks/dispatch.py",
+              "PreToolUse",
+              "pretooluse-notebookedit"
+            ]
+          },
+          {
+            "type": "command",
+            "command": "${PYTHON_BIN}",
+            "timeout": 10,
+            "statusMessage": "Enforcing plans locality on the notebook path",
+            "args": [
+              "${HARNESS_ROOT}/apothem/hooks/dispatch.py",
+              "PreToolUse",
+              "pretooluse-write-plan-guard"
+            ]
+          }
+        ]
+      },
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${PYTHON_BIN}",
+            "timeout": 10,
+            "statusMessage": "Validating shell command safety and isolation",
+            "args": [
+              "${HARNESS_ROOT}/apothem/hooks/dispatch.py",
+              "PreToolUse",
+              "pretooluse-bash"
+            ]
+          },
+          {
+            "type": "command",
+            "command": "${PYTHON_BIN}",
+            "timeout": 10,
+            "statusMessage": "Enforcing plans locality on shell redirections",
+            "args": [
+              "${HARNESS_ROOT}/apothem/hooks/dispatch.py",
+              "PreToolUse",
+              "pretooluse-bash-plan-guard"
+            ]
+          },
+          {
+            "type": "command",
+            "command": "${PYTHON_BIN}",
+            "timeout": 10,
+            "statusMessage": "Flagging unsafe dynamic evaluation or deserialization",
+            "args": [
+              "${HARNESS_ROOT}/apothem/hooks/dispatch.py",
+              "PreToolUse",
+              "pretooluse-eval-guard"
+            ]
+          }
+        ]
+      },
+      {
+        "matcher": "AskUserQuestion",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${PYTHON_BIN}",
+            "timeout": 10,
+            "statusMessage": "Validating the (Recommended) option marker",
+            "args": [
+              "${HARNESS_ROOT}/apothem/hooks/dispatch.py",
+              "PreToolUse",
+              "pretooluse-askuserquestion-recommended"
+            ]
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${PYTHON_BIN}",
+            "timeout": 10,
+            "statusMessage": "Tracking activity for proactive-compaction advisory",
+            "args": [
+              "${HARNESS_ROOT}/apothem/hooks/dispatch.py",
+              "PostToolUse",
+              "posttooluse-proactive-compaction"
+            ]
+          }
+        ]
+      }
+    ],
+    "PreCompact": [
+      {
+        "matcher": "*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${PYTHON_BIN}",
+            "timeout": 30,
+            "statusMessage": "Externalizing state before context compression",
+            "args": [
+              "${HARNESS_ROOT}/apothem/hooks/dispatch.py",
+              "PreCompact",
+              "precompact"
+            ]
+          }
+        ]
+      }
+    ],
+    "PostCompact": [
+      {
+        "matcher": "*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${PYTHON_BIN}",
+            "timeout": 30,
+            "statusMessage": "Restoring state from durable files after compaction",
+            "args": [
+              "${HARNESS_ROOT}/apothem/hooks/dispatch.py",
+              "PostCompact",
+              "postcompact"
+            ]
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "matcher": "*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${PYTHON_BIN}",
+            "timeout": 60,
+            "statusMessage": "Finalizing session and externalizing state",
+            "args": [
+              "${HARNESS_ROOT}/apothem/hooks/dispatch.py",
+              "Stop",
+              "stop"
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}

package/src/apothem/harnesses/claude_code/uninstall.py

@@ -0,0 +1,23 @@
+# SPDX-License-Identifier: MIT
+
+"""Uninstall logic for the claude-code harness adapter."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from apothem.harnesses._shared import install_driver
+
+_HARNESS_NAME: str = "claude_code"
+
+
+def uninstall(output_path: Path) -> None:
+    """Remove Apothem-managed Claude Code targets surgically.
+
+    ``settings.json`` is an operator-owned ``write_text`` manifest target, so the
+    shared driver removes only Apothem's keys and hook handlers (operator-added
+    permissions, keys, and non-Apothem hooks survive) and deletes the file only
+    when nothing operator-authored remains. The pre-mutation file is copied into
+    the Apothem backup root — no whole-file ``.bak`` sibling is left beside it.
+    """
+    install_driver.run_uninstall(_HARNESS_NAME, harness_root=output_path.parent)

package/src/apothem/harnesses/claude_code/update.py

@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: MIT
+
+"""Update logic for the claude-code harness adapter."""
+
+from __future__ import annotations
+
+from apothem.harnesses._shared.wrapper_factories import make_update
+from apothem.harnesses.claude_code.install import install
+
+update = make_update(install)

package/src/apothem/harnesses/claude_code/verify.py

@@ -0,0 +1,11 @@
+# SPDX-License-Identifier: MIT
+
+"""Verify logic for the claude_code harness adapter."""
+
+from __future__ import annotations
+
+from apothem.harnesses._shared.wrapper_factories import make_verify_harness_root
+
+_HARNESS_NAME: str = "claude_code"
+
+verify = make_verify_harness_root(_HARNESS_NAME)

package/src/apothem/harnesses/codebuddy/STANDARD-CONVENTION-PIN.md

@@ -0,0 +1,74 @@
+<!-- SPDX-License-Identifier: MIT -->
+
+# CodeBuddy Standard Convention Pin
+
+## Snapshot
+
+- Snapshot date: 2026-06-25
+- Snapshot note: live re-verification against `www.codebuddy.ai/docs` surfaced a STALENESS CORRECTION — the vendor DOES document a fuller CodeBuddy Code CLI surface (Skills `/docs/cli/skills`, Sub-Agents `/docs/cli/sub-agents`, Slash Commands `/docs/cli/slash-commands`, Plugins `/docs/cli/plugins-reference`); the prior pin called these "undocumented". The adapter's rules-only delivery remains a DELIBERATE preserve-first posture, not an absence-of-surface claim. Rules (`.codebuddy/rules/*.md` auto-loaded as project memory; `alwaysApply` / `paths` frontmatter), `CODEBUDDY.md` (`/init`), and `.codebuddy/settings.json` (permissions + JSONC MCP) all confirmed current. Previous 2026-06-09.
+- Adapter source: `src/apothem/harnesses/codebuddy/`
+- Evidence level: adapter-local projection; no vendor-native UI claim is made here.
+
+## Official Surface Refresh
+
+- Refreshed live 2026-06-09 against the current CodeBuddy documentation
+  (`www.codebuddy.ai/docs`). No authority-host move; no immutable version pin
+  is exposed (mutable docs site), so every captured convention carries a
+  no-immutable-source exception.
+- Canonical filename: `.codebuddy/rules/apothem-rules.md`. CodeBuddy reads
+  project rules from `.codebuddy/rules/*.md` (Markdown with optional YAML
+  frontmatter: `alwaysApply`, `paths`, `enabled`) per
+  https://www.codebuddy.ai/docs/ide/Rules. The adapter is project-scope and
+  writes only `<project>/.codebuddy/rules/apothem-rules.md`, a dedicated file
+  that never clobbers operator-authored rules.
+- Memory file: `CODEBUDDY.md` at the project root is the operator-owned memory
+  surface (https://www.codebuddy.ai/docs/cli/memory); the adapter does not
+  author it.
+- MCP and permissions: `.codebuddy/settings.json` is the project-scope
+  settings surface (https://www.codebuddy.ai/docs/cli/settings) where MCP
+  servers and permissions are declared. It is operator-owned; the adapter
+  recognizes it but does not author entries. `capabilities.yml` `mcp_servers`
+  and the shared capability matrix were refreshed accordingly.
+- The vendor documents project rules, a project memory file, a settings
+  surface, and a fuller CodeBuddy Code CLI surface (Skills, Sub-Agents, Slash
+  Commands, Plugins — see the `/docs/cli/*` references above). The adapter
+  delivers only the project rules file and authors none of those other surfaces:
+  this is a DELIBERATE rules-only / preserve-first posture, not a claim that the
+  surfaces are absent. Status-lines remain undocumented as an adapter-owned file
+  surface.
+
+## Recommended Postfix Rendering
+
+- Status: supported as plain text.
+- Mechanism: Apothem emits the literal ` (Recommended)` suffix in the option label. CodeBuddy rule templates preserve that suffix as authored.
+- Boundary: this pin does not claim a harness-native recommended-option widget. It only pins the text-rendered convention used by `rules/interactive-questions.md`.
+
+## Long Context and Compaction
+
+- Status: profile-managed.
+- Mechanism: Apothem keeps full-suite `/plan-execute` runs continuous by externalizing state to `.apothem/plans/`, compacting or restarting the harness session at phase boundaries as needed, and restoring via the Blind Bootstrap sequence.
+- Boundary: this pin does not claim vendor-native autocompaction or a long-context size. It pins the adapter-local state handoff and compaction-restoration convention used by `rules/context-management.md`.
+
+## Large-Codebase Practice Projection
+
+- Layered context: declared in `capabilities.yml` under `layered_context_surface`; no vendor-native hierarchy is claimed beyond the adapter's documented file/template surface.
+- LSP symbol navigation: `tracked-gap` until a vendor-ratified plugin or tool surface is pinned.
+- Hook learning capture: routed through the `persistent-conventions-vigilance` artifact-evolution cycle; pass-class hooks stay silent and recurring findings become rule, skill, hook, or documentation updates.
+
+## Plugin-alone Persistence
+
+CodeBuddy exposes **no vendor plugin or extension install surface** that Apothem
+ships. The adapter is project-scope rules-only: it writes a single merged rules
+file at `<project>/.codebuddy/rules/apothem-rules.md` and authors no other
+cohort. There is no standalone-installable bundle; every artifact requires the
+full `apothem install --harness codebuddy --project <path>` engine run.
+
+| Artifact class | Persists standalone? | Mechanism / limit |
+|---|---|---|
+| Rules | No — requires `apothem install` | The merged `apothem-rules.md` (carrying the embedded behavioral mandates) is written only by the engine into the vendor-native `.codebuddy/rules/` directory. Nothing persists before that run. |
+| Commands / Skills / Agents | No — deliberate rules-only posture | CodeBuddy DOES document CLI Skills / Sub-Agents / Slash Commands / Plugins, but the adapter authors none of them (preserve-first rules-only delivery); these cohorts are not materialized for this harness by design. |
+| Hooks / MCP / Tools / Settings | No — operator-owned / platform limit | `.codebuddy/settings.json` (MCP + permissions) and `CODEBUDDY.md` memory are operator-owned; the adapter authors no entries. |
+
+Platform limit: CodeBuddy ships no marketplace/extension channel, so a
+plugin-alone story does not exist for this harness — the merged rules file via
+`apothem install` is the sole persistence surface.

package/src/apothem/harnesses/codebuddy/__init__.py

@@ -0,0 +1,49 @@
+# SPDX-License-Identifier: MIT
+
+"""Apothem harness adapter for codebuddy — project-scope install.
+
+Materializes the apothem rules surface into the operator-supplied
+project root at ``<project>/.codebuddy/rules/apothem-rules.md`` — the
+canonical CodeBuddy rules surface per
+https://www.codebuddy.ai/docs/ide/Rules. The adapter writes a dedicated
+``apothem-rules.md`` file inside CodeBuddy's documented rules directory so
+the operator's own rules files are never clobbered. The ``CODEBUDDY.md``
+memory file and ``.codebuddy/settings.json`` permissions/MCP surface are
+operator-owned and out of apothem's adapter scope.
+
+The adapter opts into the project-scope contract via
+``requires_project = True``; the CLI rejects an install / update /
+uninstall / verify invocation that omits ``--project <path>``. Delegates
+install logic to :mod:`apothem.harnesses.codebuddy.install`, which
+consumes the canonical propagation manifest at
+``src/apothem/lib/propagation-manifest.yaml``.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from apothem.harnesses._shared.wrapper_factories import make_project_scope_adapter
+from apothem.harnesses.codebuddy.install import install as _install
+from apothem.harnesses.codebuddy.install import plan as _plan
+from apothem.harnesses.codebuddy.uninstall import uninstall as _uninstall
+from apothem.harnesses.codebuddy.update import update as _update
+from apothem.harnesses.codebuddy.verify import verify as _verify
+
+# Sentinel relative path used by ``output_path`` for display purposes
+# only. The real target is resolved per-install via
+# ``resolve_output_path(project)`` once the operator supplies
+# ``--project <path>``.
+_SENTINEL_RELATIVE: Path = Path(".codebuddy") / "rules" / "apothem-rules.md"
+
+CodeBuddyAdapter = make_project_scope_adapter(
+    "codebuddy",
+    error_label="codebuddy",
+    relative_target=_SENTINEL_RELATIVE,
+    install_fn=_install,
+    plan_fn=_plan,
+    uninstall_fn=_uninstall,
+    update_fn=_update,
+    verify_fn=_verify,
+    class_name="CodeBuddyAdapter",
+)

package/src/apothem/harnesses/codebuddy/capabilities.yml

@@ -0,0 +1,34 @@
+# SPDX-License-Identifier: MIT
+
+# Per rules/agent-capability-discipline.md §1 / §3 / §7. CodeBuddy
+# ratifies MCP via .codebuddy/settings.json (project-scope; operator-owned;
+# the adapter recognizes it but does not author entries). The adapter
+# delivers a single project rules file under .codebuddy/rules/ and does
+# not dispatch sub-agents or author command/skill/hook cohorts.
+
+mcp_servers:
+  - project-scope-.codebuddy/settings.json-mcp
+# Operator-owned MCP surface: the adapter recognizes it but authors no entries.
+mcp_servers_authored: false
+sub_agent_dispatch: false
+custom_command_support: "no"
+recommended_postfix_rendering: "plain-text"
+long_context_compaction: "profile-managed"
+context_ignore_surface: "not-documented-in-current-pin"
+layered_context_surface: ".codebuddy/rules/*.md directory"
+lsp_symbol_navigation: "tracked-gap-no-adapter-owned-LSP-surface"
+hook_learning_capture: "artifact-evolution-cycle"
+standard_convention_pin: "STANDARD-CONVENTION-PIN.md"
+# web-fetch / browser-retrieval surface — the backing capability dimension for
+# rules/source-accessibility.md step 1 ("retrieve through the host's browser /
+# fetch capability"). The pinned snapshot catalogs config-materialization
+# surfaces, not the vendor tool surface, so the web-fetch tool is not yet
+# discovered against the pin — discovery-pending per
+# rules/agent-capability-discipline-matrix.md §1.
+web_fetch: "discovery-pending"
+tool_surface_restrictions:
+  - secrets-paths
+  - destructive-shell-ops
+  - network-write-unsigned
+system_prompt_template_path: "templates/apothem-rules.md"
+agent_memory_surface: "CODEBUDDY.md project memory file (operator-owned)"

package/src/apothem/harnesses/codebuddy/install.py

@@ -0,0 +1,40 @@
+# SPDX-License-Identifier: MIT
+
+"""Install logic for the codebuddy harness adapter.
+
+Materializes the apothem CodeBuddy rules surface into the operator-supplied
+project root. CodeBuddy's canonical rules surface is the project-scope
+multi-file format at ``<project>/.codebuddy/rules/*.md`` (per
+https://www.codebuddy.ai/docs/ide/Rules). The adapter writes a dedicated
+``apothem-rules.md`` file so the operator's own rules files are never
+clobbered. The ``CODEBUDDY.md`` memory file and ``.codebuddy/settings.json``
+permissions/MCP surface are operator-owned and out of apothem's adapter
+scope.
+
+The propagation contract is declared in the canonical manifest at
+``src/apothem/lib/propagation-manifest.yaml`` under the ``codebuddy`` key
+(a single operator-owned ``sentinel_merge`` operation targeting
+``${PROJECT_ROOT}/.codebuddy/rules/apothem-rules.md``) and applied by the
+shared driver at ``apothem.harnesses._shared.install_driver``. The
+``${PROJECT_ROOT}`` placeholder is substituted with the operator-supplied
+``--project <path>`` value the CLI threads through; absence of
+``--project`` is rejected upstream at ``apothem.cli._materialize`` via the
+``requires_project`` opt-in.
+"""
+
+from __future__ import annotations
+
+from apothem.harnesses._shared.wrapper_factories import (
+    make_project_scope_install,
+    make_project_scope_plan,
+)
+
+# Manifest harness key for this adapter.
+_HARNESS_NAME: str = "codebuddy"
+
+install = make_project_scope_install(
+    _HARNESS_NAME,
+    error_message="codebuddy adapter requires --project <path>; CLI must thread it through",
+)
+
+plan = make_project_scope_plan(_HARNESS_NAME)

package/src/apothem/harnesses/codebuddy/templates/apothem-rules.md

@@ -0,0 +1,37 @@
+---
+alwaysApply: true
+description: "Apothem governance and convention surface for the CodeBuddy harness — applied every session to honour project-wide engineering discipline."
+---
+
+<!-- SPDX-License-Identifier: MIT -->
+
+# Apothem — CodeBuddy Bootstrap
+
+This file is materialised by `apothem install --harness codebuddy --project <path>` and lands at `<project>/.codebuddy/rules/apothem-rules.md`, the current CodeBuddy project rules surface per https://www.codebuddy.ai/docs/ide/Rules. It is a dedicated apothem rules file: it never clobbers operator-authored rules in the same directory.
+
+## What Apothem governs in this project
+
+Apothem propagates a shared governance and convention surface across every supported AI harness in this project's host environment. Inside CodeBuddy, the surface manifests as this always-applied rule file:
+
+- **Rules** — engineering rules applied on every interaction (`alwaysApply: true`). The full rule cohort lives at the apothem source repository under `src/apothem/rules/`; this CodeBuddy-facing anchor names the disciplines the operator may consult in detail.
+- **Skills, commands, agents** — reusable techniques, slash-style workflows, and persistent sub-agent definitions. Apothem's canonical-master cohort at the apothem source repository defines them; CodeBuddy does not auto-discover them as separate surfaces, so they manifest here as referenced discipline.
+- **Memory** — CodeBuddy's project memory file (`CODEBUDDY.md`) is operator-owned, not apothem-managed.
+- **Settings** — CodeBuddy's permissions and MCP surface (`.codebuddy/settings.json`) is operator-owned, not apothem-managed.
+
+## Engineering disciplines in force
+
+Apothem's foundational mandates apply uniformly across every harness, including CodeBuddy:
+
+- **Plans-Locality.** Plan-suite artefacts (PROGRESS.md, PLAN-NOTES.md, PHASE.md, REPORT.md) live under `<project>/.apothem/plans/{suite}/` — the sole canonical home; a legacy `<project>/.plans/` tree upgrades via `apothem migrate-workspace`. They never land in a global plans directory or any other global-ecosystem location.
+- **Authority hygiene.** Never fabricate identity, scope, security posture, or version-pin data. Surface ambiguity through a question instead of inventing a plausible-looking value.
+- **Definitiveness.** Hedging vocabulary (`maybe`, `might`, `usually`, `generally`, `typically`, `probably`) is eliminated where binding prescription is possible. Pre / post / failure conditions are stated on every contract.
+- **Production-ready discipline.** Every change ships in production-ready form — tests, docs, CHANGELOG entry, conformant commit message, CI green — in the same change-set.
+- **Plain-language.** Codebase artefacts and user-facing prose read as natural domain language with zero trace of internal planning structure.
+- **Human-only authorship.** Git commit messages, PR descriptions, branch names, and tag annotations carry human contributors only — never the underlying language model, runtime, IDE extension, or any automated tool as a co-author.
+- **Lean-context delegation.** Where the host provides delegated-worker dispatch, broad reads and heavy workloads route to a spawned worker by default so the main working context stays lean. The heavy parallel apparatus stays opt-in; routing delegable work away from the main thread is the standing posture once dispatch is available.
+- **Observe-decide-act discipline.** Tool use runs as a loop — observe the current state, decide the next move from what was observed, then act — never an edit before a read or a result asserted before a check. Independent reads and searches run together in one pass, not one per turn; the loop closes on a verifiable condition (a gate green, a read confirmed), never a fixed number of tries. Advisory, never an auto-applied behavior.
+- **Source accessibility.** When the authoritative source for a claim, convention, or version pin is closed, paywalled, login-gated, or otherwise unreachable, ask the operator for it in full rather than substituting a lower-trust open page. Trust outranks reachability.
+
+## Refreshing the file
+
+Re-run `apothem install --harness codebuddy --project <this-project-root>` to overwrite this file with the latest apothem template. The operation is idempotent. `apothem uninstall --harness codebuddy --project <this-project-root>` renames the file to a timestamped backup; `apothem verify --harness codebuddy --project <this-project-root>` checks the file is present and non-empty.

package/src/apothem/harnesses/codebuddy/uninstall.py

@@ -0,0 +1,25 @@
+# SPDX-License-Identifier: MIT
+
+"""Uninstall logic for the codebuddy harness adapter."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from apothem.harnesses._shared import install_driver
+
+_HARNESS_NAME: str = "codebuddy"
+
+
+def uninstall(output_path: Path, *, project: Path | None = None) -> None:
+    """Remove Apothem-managed CodeBuddy targets surgically.
+
+    The apothem-rules ``sentinel_merge`` anchor is cleaned by the shared driver,
+    which strips only Apothem's managed block (operator prose survives), deletes
+    an Apothem-only file, and backs the file up under the Apothem backup root —
+    no whole-file ``.bak`` sibling is left beside the operator's file.
+    """
+    install_driver.run_uninstall(
+        _HARNESS_NAME,
+        project_root=project or output_path.parents[2],
+    )