@ahmed-g-gad/apothem 0.1.1

package/src/apothem/skills/document-authoring/SKILL.md

@@ -0,0 +1,118 @@
+---
+name: "document-authoring"
+version: "0.1.0"
+updated: "2026-06-14"
+description: "Long-form structured-document authoring — matched when the operator asks to 'write a thesis / dissertation / paper / report', 'author a LaTeX document', 'build a document from an outline', 'compile this to PDF', 'manage citations / bibliography', or otherwise needs a long, citation-bearing, typeset document produced. Drives an approval-gated hierarchical pipeline (outline → operator-approve → draft → review), verifies every citation against a real retrievable source (never fabricated — unresolvable references land in an unverified-citations ledger), and compiles through a deterministic detect→route pipeline that inspects the source, selects engine / bibliography tool / index passes by rule, and self-corrects one recoverable build error before surfacing failure. Figures route to diagram-authoring. Not for: a short prose snippet or single-paragraph rewrite (ordinary prose authoring, below threshold); fabricating a citation to fill a gap; rendering figures. Harness-agnostic; deterministic output."
+archetype: "authoring-template"
+userInvocable: true
+argument-hint: "[document subject] [--kind thesis|paper|report|book] [--format latex|markdown]"
+disable-model-invocation: true
+allowed-tools: "Read, Write, Edit, Glob, Grep, Bash, WebSearch, WebFetch, TodoWrite"
+---
+
+<!-- SPDX-License-Identifier: MIT -->
+
+## Purpose
+
+Produce a long-form, citation-bearing, typeset document — a thesis, dissertation, paper, report, or book — through an approval-gated hierarchical pipeline (outline → operator-approve → draft → review) under two invariants:
+
+- **Honest citation** — every reference resolves to a real, retrievable source, or it lands in the unverified-citations ledger; none is invented.
+- **Deterministic compile** — the compile step inspects the source, *detects* which engine / bibliography tool / index passes the source requires, and *routes* them by rule, not by guess.
+
+Figures are authored and embedded through `diagram-authoring`. The result is robust by construction: the document compiles cleanly because the pipeline detected and satisfied its build requirements, and it cites honestly because every reference was verified.
+
+## Detection Signal
+
+The operator asks to write a thesis / dissertation / paper / report / book, author a LaTeX (or Markdown) document, build a document from an outline, compile a document to PDF, or manage a citation / bibliography surface. A short prose snippet or a single-paragraph rewrite is below this skill's threshold — that is ordinary prose authoring, not the long-form structured-document pipeline.
+
+## Non-Goals
+
+- **Not a citation fabricator.** Every reference is verified against a real, retrievable source (a supplied bibliography, a discovered citation database, or a resolvable DOI / URL). A reference that cannot be verified is surfaced as unverified — never invented to fill a gap.
+- **Not a blind compiler.** The compile step detects the source's build requirements (engine, bibliography tool, index, special packages) and routes them deterministically; it does not run one fixed toolchain blindly and hope.
+- **Not an unapproved drafter.** At thesis / dissertation scale, the outline is approved before prose is drafted (approval-gated), so the operator's structure governs — the skill does not draft a 200-page document off an unconfirmed outline.
+- **Not a figure renderer.** Figures route to `diagram-authoring`; this skill composes them into the document, it does not reimplement diagram rendering.
+
+## Conformity Posture
+
+- **Discover-don't-assume preamble (M1).** Discover the host's document toolchain (typesetting engine, bibliography tool, citation database) and its invocation per `rules/host-discovery.md`, plus the host's document conventions (citation style, template layout). Record each with provenance. The toolchain is discovered, not assumed; where absent, the gap is surfaced.
+- **Authority-inquiry surface (M5).** Citations are authoritative data — discovered or supplied, never invented, per `rules/authority-inquiry.md`.
+
+## Procedure
+
+### 1. Frame & Outline (approval-gated)
+
+Read the subject and document kind. Author a hierarchical outline (document → chapter / section → subsection) and **surface it for approval** through the structured-inquiry channel before drafting prose. The approved outline is the contract every drafted section traces back to — plan-compliance is checked at review.
+
+### 2. Discover Toolchain & Citation Source
+
+Discover the typesetting engine, bibliography tool, citation style, and citation source the document requires (and the host provides). Record with provenance. The compile requirements are derived from the source's features, not assumed.
+
+### 3. Draft Against the Outline
+
+Draft each section against the approved outline. Bind every claim that needs support to a **verified citation** — resolve each reference to a real source (supplied bibliography, discovered database, resolvable DOI / URL); an unresolvable reference is marked unverified, never fabricated. Author figures through `diagram-authoring` and compose them into the document.
+
+### 4. Deterministic Compile (detect → route)
+
+Compile through a detect-then-route pipeline that routes the build *by rule*:
+
+- select the **engine** from the source's typesetting features;
+- select the **bibliography tool** from the reference-declaration form;
+- run an **index pass** where the source declares an index;
+- inject the **corrective package** where a known layout warning is detected;
+- run the **multi-pass build** with cross-reference validation.
+
+On a recoverable build error (a missing label, an undefined reference, a layout overflow), apply **one** corrective pass (fix the construct → re-validate → re-compile) before surfacing failure — a bounded detect→correct→recompile loop, never unbounded retry.
+
+### 5. Review & Self-Check
+
+Review the compiled document against the approved outline (plan-compliance), verify cross-references resolve, verify every citation is verified-or-flagged, and run the fifteen-bar pre-emission gate per `rules/pre-emission-gate.md`. Emit the document source, the bibliography, the compiled artifact, the unverified-citations ledger (if any), and the single recommended next move.
+
+## Arguments
+
+- `[document subject]` — the document's subject / thesis statement in natural language.
+- `--kind thesis|paper|report|book` — the document kind (default: inferred from subject, confirmed via inquiry).
+- `--format latex|markdown` — the source format (default: `latex` for typeset output; `markdown` for lightweight).
+
+## Return Contract
+
+- the document **source**;
+- the **bibliography**;
+- the compiled **artifact** (PDF where typeset);
+- the **unverified-citations ledger** (every reference that cannot be verified, with the gap);
+- the **compile-route record** (detected engine / bib-tool / passes, with provenance);
+- the fifteen-bar gate attestation;
+- a single `## Recommended Next Step`.
+
+Deterministic per `rules/determinism.md`: the same outline + content + toolchain produces byte-stable source. The compiled binary's exact bytes may vary with the discovered engine version — the declared non-deterministic element, stamped with the engine + version.
+
+## Foundational Stanzas
+
+The four standing surfaces every operator inherits per the canonical project voice at `AGENTS.md` plus the active harness mirror.
+
+### Refusal & Escalation
+
+REFUSE any request beyond authoring a structured document — name what was refused, name the boundary crossed, surface an escalation option through the structured-inquiry channel per `rules/interactive-questions.md`. REFUSE asserting a citation as verified when its source cannot be retrieved — it lands in the unverified-citations ledger with both the claim and the gap. REFUSE drafting full prose at thesis scale before the outline is approved.
+
+### Output Surface
+
+The document source, its bibliography, and the compiled artifact land at the operator's chosen location per host-discovery and the suite-locality invariant at `rules/context-management.md` §2.6.1. Document source carries natural domain language describing its subject (CM-7) — zero apothem-internal scaffolding.
+
+### File-Authoring Contract
+
+Document-source files authored as host-project artifacts (`.tex` / `.md` / `.bib`) route through `scripts/inject-header.{sh,py}` where the filetype carries a header variant; compiled binary artifacts (`.pdf`) are header-exempt per `src/apothem/schemas/header-exceptions.txt`. Edits preserve any existing banner; the header-inject-guard hook enforces the contract.
+
+### Structured Inquiry on Ambiguity
+
+When the document kind, the target structure, the citation style, the bibliography source, or the compile toolchain is ambiguous, route the resolution through the structured-inquiry channel with the three-segment option annotation per `rules/interactive-questions.md` §3 (rationale / recommendation / default-pointer). The outline-approval gate is itself an inquiry. NEVER fabricate a citation or a domain fact.
+
+## Recommended Next Step
+
+**Invoke the `document-authoring` skill via the Skill tool** with `<subject> --kind <thesis|paper|report|book>` — approve the hierarchical outline when surfaced, then review the compiled artifact and resolve every entry in the unverified-citations ledger before circulating the document. Re-run after outline edits to re-derive only the affected sections.
+
+## Bindings (§0.j five-direction)
+
+- **Drives →** ● Every long-form structured document authored across the host. ● The verified-citation contract that gates every reference. ● The deterministic detect→route compile pipeline. ◐ Embedded figures, delegated to `diagram-authoring`.
+- **Satisfies →** ● `CLAUDE.md` Source Layout row "document-authoring" (skills/ class). ● The elevation dimension **robustness** (detection-signal-driven compile pipeline + citation verification — failure modes handled by rule, not retry-and-hope). ● `rules/authority-inquiry.md` (citations verified, never invented).
+- **Established by ↑** ● `CLAUDE.md` Source Layout (skills/ folder-with-`SKILL.md` class). ● `CLAUDE.md` Ambiguity Handling (structured inquiry over fabrication). ● `rules/own-voice-reimplementation.md` (zero-verbatim; `reference-token-grep` = 0). ● `rules/agnostic-posture.md` (17-harness agnostic floor).
+- **Gated by ←** ● A discovered document toolchain (the gap is surfaced where absent). ● The outline-approval gate (no full draft before approval). ● The host's structured-inquiry + Edit + Write + Bash tool surface.
+- **Cross-bound with ↔** ↔ `skills/diagram-authoring/SKILL.md` (figures are authored + rendered there and composed here). ↔ `rules/own-voice-reimplementation.md` + `rules/agnostic-posture.md` (own-voice + agnostic floors). ↔ `rules/authority-inquiry.md` (citation verification). ↔ `rules/determinism.md` (deterministic pipeline). ↔ `skills/dev-toolkit/SKILL.md` + `skills/surgical-guard/SKILL.md` (sibling own-voice engineering skills).

package/src/apothem/skills/ecosystem-audit/SKILL.md

@@ -0,0 +1,108 @@
+---
+name: "ecosystem-audit"
+version: "0.1.0"
+updated: "2026-06-17"
+description: "Blind audit of the apothem ecosystem — matched when the user asks to 'double check', 'audit', 'verify ecosystem', 'sweep', 'validate ecosystem', 'review configuration', 'check the apothem tree', or any phrasing requesting a comprehensive validation of the apothem configuration tree as a whole. Five-phase cadence (census → parallel cross-reference audit → synthesis → report → optional --fix) detects drift, staleness, orphans, dangling references, conflicting directives, frontmatter invalidity, registry-vs-disk count mismatches, and secret exposure. Findings classify FIX / ENHANCE / CONSIDER / DEFER; only FIX auto-applies under --fix, and only after a per-file destructive-op confirmation — ENHANCE / CONSIDER / DEFER surface for operator decision via the structured-inquiry channel. User-invocable directly; also dispatchable from /plan-execute discovery contexts."
+archetype: "audit-template"
+userInvocable: true
+argument-hint: "[--focus area] [--fix]"
+disable-model-invocation: true
+allowed-tools: "Read, Write, Edit, Glob, Grep, Bash, Agent, TodoWrite"
+---
+
+<!-- SPDX-License-Identifier: MIT -->
+
+## Purpose
+
+Execute a blind, fresh audit of the apothem ecosystem — verifying cross-references, registry accuracy, file counts, frontmatter validity, hook alignment, and content quality — and optionally apply FIX-classified findings under `--fix`. "Blind" is the discipline: each sweep anchors to the host's actual on-disk state, never to a prior sweep's conclusions, so structural gaps a prior pass anchored past are surfaced fresh.
+
+## Detection Signal
+
+The user requests "double check", "audit", "verify ecosystem", "sweep", "validate ecosystem", "review configuration", or "check the apothem tree" — any phrasing requesting a comprehensive validation of the apothem configuration tree as a whole.
+
+## Non-Goals
+
+A deliberately narrow surface — each boundary routes the out-of-scope work to its rightful owner:
+
+- **Not a fix tool beyond the FIX classification.** Only mechanically-verifiable defects (false claims, broken cross-references, missing files, invalid frontmatter) auto-apply under `--fix`. ENHANCE / CONSIDER / DEFER NEVER auto-apply — each requires operator judgment solicited via the structured-inquiry channel.
+- **Not a refactoring pipeline.** Structural reorganization (renames, moves, registry restructures, taxonomy changes) is OUT of scope. The audit reports the smell; refactoring lands as a separate, operator-driven workstream.
+- **Not a content generator.** The audit generates no new rules, skills, agents, commands, or hooks. Gap detection (a missing skill / hook / rule) is reported as DEFER; authoring is the operator's decision and lands under a separate plan-suite per `rules/persistent-conventions-vigilance.md` §4.
+- **Not a security scanner replacement.** Secret-exposure detection is a coarse banner-vs-real-secret heuristic surfaced for operator triage; full secret-scanning is `gitleaks` / `trufflehog` territory under `conformity/secret_leak_grep.py` and the host's CI.
+- **Not a build / test runner.** The audit verifies frontmatter and cross-references; it runs no `pytest`, `ruff`, or `mypy`. Quality-gate execution is `apothem.conformity.gate` and the consuming command's responsibility.
+
+## Invoking Surfaces
+
+| Surface | Invocation point | What's run |
+|---------|------------------|------------|
+| Operator (direct) | User triggers the **ecosystem-audit** skill via a detection phrase (e.g. "verify ecosystem", "audit the apothem tree") | Full audit; `--focus` narrows; `--fix` enables FIX-class auto-apply |
+| `/plan-execute` discovery context | Discovery sub-phase of an active plan-execution engagement | The audit runs as the codebase-discovery pass; findings feed the plan's audit gate |
+
+The skill is user-invocable per `CLAUDE.md` Source Layout; the `/plan-execute` dispatch path is documented at `rules/persistent-conventions-vigilance.md` §3.
+
+## Conformity Posture
+
+- **Discover-don't-assume preamble (M1).** Before authoring any finding or applying any `--fix` change, walk the host's ratified source-of-truth files for the surface under audit per `rules/host-discovery.md`. Verdicts anchor to the host's *actual* state — the on-disk filesystem, the live `CLAUDE.md` registries, the actual frontmatter fields, the actual hook configuration in `settings.json` — never to assumed conventions or training-time memory. Discovered conventions are recorded with provenance (source file path, value, discovery date) per `rules/host-discovery.md` §4.
+- **Authority-inquiry surface (M5).** Per the Structured Inquiry on Ambiguity stanza below; this anchor binds the M5 discipline to the seven-category inquiry catalog at `rules/authority-inquiry.md` §10.
+
+## Procedure
+
+A fixed five-phase cadence — **Census → Cross-Reference Audit (parallel
+three-agent team) → Synthesis → Report → Apply (under `--fix`)**, sequential at
+the phase level and parallelizable at the dimensional level when an audit team
+is deployed, closing with a Phase-6 fifteen-bar pre-emission self-check.
+Improvement findings classify **FIX / ENHANCE / CONSIDER / DEFER** (only FIX
+auto-applies under `--fix`). The full per-phase procedure, the
+improvement-classification taxonomy, the failure-recovery table, the cadence
+guidance, and the phase-thread diagram are at
+[`references/procedure.md`](references/procedure.md).
+
+## Arguments
+
+- `--focus [area]` — Narrow to a specific area: `rules`, `commands`, `hooks`, `memory`, `agents`, `skills`.
+- `--fix` — Apply discovered FIX-class fixes (default: report only).
+
+## Audit-Fortress Phase Skeleton
+
+The decision-tree skeleton shared by the eleven audit-fortress commands (`/code-review`, `/code-audit`, `/security-audit`, `/perf-audit`, `/architecture-review`, `/ux-review`, `/a11y-audit`, `/docs-review`, `/dependency-audit`, `/supply-chain-audit`, `/threat-model-audit`) is the canonical flowchart plus the per-command parameter table at [`references/audit-fortress.md`](references/audit-fortress.md). Each command's `## Decision Tree` section cites that skeleton and supplies its row (`tools-probed`, `borderline-classes`, `focus-semantics`, `pipeline-tail-handoff`). The reference loads selectively beside this entry point so it consumes context only when a fortress command resolves it.
+
+## Foundational Stanzas
+
+The four standing surfaces every operator inherits per the canonical project voice at `AGENTS.md` plus the active harness mirror — adapted to this skill's user-invocable audit role with optional `--fix`, so the operator's destructive-op floor is preserved across the audit surface.
+
+### Refusal & Escalation
+
+REFUSE any request that asks the audit to act outside its stated mission — refactoring, content generation, taxonomy redesign, structural reorganization, full secret-scanning, build / test execution, ENHANCE / CONSIDER / DEFER auto-application. Refusal is explicit: name what was refused, name the mission boundary crossed, and surface an escalation option through the structured-inquiry channel per `rules/interactive-questions.md` (canonical channel; three-segment option annotation; never free-form prose as primary input). When `--fix` is set and the FIX-classified set is empty, REFUSE the no-op auto-apply and surface the empty-set finding instead — `--fix` against zero defects is a misuse signal worth flagging. When two parallel Step-2 agents produce contradictory findings on the same dimension, REFUSE silent reconciliation and surface BOTH findings to the operator with evidence per the Failure Recovery result-conflict clause.
+
+### Output Surface
+
+The primary output is the structured audit report (markdown; max 2000 tokens without `--fix`, unlimited with `--fix` per the Return Contract). The report writes to STDOUT for direct invocation; when dispatched from `/plan-execute`, it lands at the phase's working-evidence directory `.audit/AUDIT.md` per the suite-locality invariant. Under `--fix`, the audit applies FIX-class edits to live files at their canonical locations under the active harness's config root — these land at the host's ratified paths per `rules/host-discovery.md`, and per `rules/operational-mandates.md` CM-7 every edit preserves natural domain language (zero plan-internal references in protected codebase artifacts). Audit-internal working state (intermediate JSON dumps, scratch tables) lands under `.audit/` (gitignored-class per the canonical `.gitignore` snippet). NEVER write audit working state outside the harness's config root, and NEVER write to a downstream project's `.apothem/plans/` from the audit context.
+
+### File-Authoring Contract
+
+When the audit emits a NEW file (rare; the FIX path edits existing files in place), it routes through `scripts/inject-header.{sh,py}` so the canonical authorship-header banner is injected at the head; the injector is idempotent and detects the filetype variant automatically from the byte-exact fixture at `src/apothem/schemas/authorship-header.txt` (the project's canonical authorship-header source of truth per `CLAUDE.md` §File Headers). Exempt classes (LICENSE, JSON configuration files, lockfiles, generated assets, vendored trees, `.audit/` ephemera, `<project-root>/.apothem/plans/` ephemera, `.keep` / `.gitkeep` markers, binary files) are enumerated at `src/apothem/schemas/header-exceptions.txt`; audit reports emitted to STDOUT or `.audit/` are banner-exempt under the `.audit/**` exception class. Edits to existing files (the typical FIX path) preserve any existing banner; the header-inject-guard hook at `hooks/messages/pretooluse-{write,edit}-header-guard.md` enforces the contract at every Write / Edit invocation.
+
+### Structured Inquiry on Ambiguity
+
+When the audit reaches a decision in any of the seven authoritative-data categories per `rules/authority-inquiry.md` — identity, scope direction, preference (formatter / linter / test framework / CI provider), security (deny rules, secret rotation), naming of public surfaces, infrastructure endpoints, version pins — and the host is silent, route the resolution through the structured-inquiry channel with the three-segment option annotation per `rules/interactive-questions.md` §3 (rationale / recommendation / default-pointer). Free-form prose questions as primary input are forbidden. NEVER fabricate authoritative data. Every ENHANCE / CONSIDER classification surfaces as a structured-inquiry invocation per the Improvement Classification section; the audit never silently applies an ENHANCE finding.
+
+**Per-file destructive-op floor.** Every delete / rename / move / overwrite-without-retention operation the audit performs under `--fix` against an existing file routes through the structured-inquiry channel on a per-file basis per `rules/interactive-questions.md` §6 — one invocation per file, every time, no `multiSelect` batching across files, every option's `default-pointer:` carrying the verbatim `no-default: user decision required` marker. The §6.4 Delete / §6.5 Rename / §6.6 Move canonical option sets are the floor. Confirmation fatigue is an accepted cost; silent destruction is not. In-place edits via Edit (no path change, no deletion) follow the standard FIX-class flow without per-file destructive-op invocations.
+
+## Return Contract
+
+Structured markdown report. Maximum 2000 tokens without `--fix`; unlimited with `--fix` (includes edit confirmations).
+
+**Required fields.** The report carries pass / fail per check with evidence (the `## Report` step at Procedure §4), the improvement classification per finding (`## Improvement Classification`), and — under `--fix` — per-edit confirmation. A check without locatable evidence is downgraded to a watch item, never asserted.
+
+**Failure behavior.** When a sub-agent fails or returns partial coverage, the orchestrator records the coverage gap and never silently drops the dimension, and resolves contradictory findings per the result-conflict clause (`## Failure Recovery`) by surfacing BOTH findings to the operator with evidence — never silently picking one. A `--fix` run against a zero-defect FIX set surfaces the empty-set finding instead of a no-op auto-apply.
+
+## Recommended Next Step
+
+**Re-trigger the ecosystem-audit skill with `--fix`** to auto-apply the FIX-classified findings the report surfaced, then route each ENHANCE / CONSIDER / DEFER finding through the structured-inquiry channel per `rules/interactive-questions.md` for operator decision. The report-only pass leaves FIX defects unremediated; `--fix` closes the mechanically-verifiable set before the next sweep.
+
+## Bindings (§0.j five-direction)
+
+- **Drives →** ● Every operator-invoked blind audit of the apothem ecosystem (the skill is user-invocable). ● Every `--fix` run that materializes FIX-class edit-confirmations into the live ecosystem. ● Every `/plan-execute` discovery context that consumes the audit as its codebase-discovery pass. ◐ The ecosystem-coherence enforcement loop alongside `rules/persistent-conventions-vigilance.md`.
+- **Satisfies →** ● `CLAUDE.md` Source Layout row "ecosystem-audit". ● `rules/persistent-conventions-vigilance.md` §3 Ecosystem Coherence (the audit-template archetype materializes the coherence-verification surface).
+- **Established by ↑** ● `CLAUDE.md` Source Layout. ● `CLAUDE.md` Source Layout (skills/ class declaration with the folder-with-`SKILL.md` convention).
+- **Gated by ←** ● The harness's Skill tool surface and the operator's explicit invocation. ● The ecosystem's mandatory-file presence (rules/, commands/, skills/, agents/, hooks/, CLAUDE.md, settings*.json).
+- **Cross-bound with ↔** ↔ `skills/ecosystem-audit/references/audit-fortress.md` (the bundled reference surface housing the Audit-Fortress Phase Skeleton this skill points to). ↔ `skills/ecosystem-audit/references/procedure.md` (the bundled reference surface housing the five-phase procedure, classification, recovery, cadence, and phase-thread diagram this skill points to). ↔ `rules/persistent-conventions-vigilance.md` (the convention-coherence specification this audit consumes). ↔ `scripts/dev/validate_ecosystem.py` (the verifier suite the audit cross-references). ↔ `agents/convention-auditor.md` + `agents/memory-auditor.md` (sibling audit-class artifacts that may dispatch within this skill's protocol). ↔ `skills/plan-suite/SKILL.md` (sibling skill under the same registry section). ↔ `commands/code-review.md` + `commands/code-audit.md` + `commands/security-audit.md` + `commands/perf-audit.md` + `commands/architecture-review.md` + `commands/ux-review.md` + `commands/a11y-audit.md` + `commands/docs-review.md` + `commands/dependency-audit.md` + `commands/supply-chain-audit.md` + `commands/threat-model-audit.md` (the 11 audit-fortress commands whose Decision Tree sections cite the `references/audit-fortress.md` Audit-Fortress Phase Skeleton + per-command parameter-table row).

package/src/apothem/skills/ecosystem-audit/references/audit-fortress.md

@@ -0,0 +1,85 @@
+<!-- SPDX-License-Identifier: MIT -->
+
+# Ecosystem-Audit References — Audit-Fortress Phase Skeleton
+
+Reference surface for the [`ecosystem-audit`](../SKILL.md) skill. This file is the
+canonical home for the decision-tree skeleton shared by the eleven
+audit-fortress commands (`/code-review`, `/code-audit`, `/security-audit`,
+`/perf-audit`, `/architecture-review`, `/ux-review`, `/a11y-audit`,
+`/docs-review`, `/dependency-audit`, `/supply-chain-audit`,
+`/threat-model-audit`). Each command's `## Decision Tree` section cites this
+skeleton and supplies its row from the parameter table below; the per-command
+delta is captured by `tools-probed`, `borderline-classes`, `focus-semantics`,
+and `pipeline-tail-handoff`.
+
+The skeleton lives here, under the skill's bundled `references/` directory, so
+it loads selectively when a consuming command resolves it — keeping the skill's
+entry-point procedure tight.
+
+## Canonical Flowchart
+
+```mermaid
+%%{ init: { "theme": "neutral" } }%%
+%% verified: 2026-05-11 %%
+%% provenance: skills/ecosystem-audit/references/audit-fortress.md (Audit-Fortress Phase Skeleton) %%
+%% cross-reference: skills/ecosystem-audit/SKILL.md (the audit skill this skeleton extends) %%
+flowchart TD
+    Start[/audit-or-review invoked/] --> Input{Input surface resolvable?}
+    Input -->|no| Abort[STOP — surface structured inquiry for correct input]
+    Input -->|yes| Prereq{Per-command prerequisites met?}
+    Prereq -->|no| AskPrereq[structured inquiry: ratify alternate scope · abort]
+    Prereq -->|yes| Focus{<command-focus-semantics> flag set?}
+    Focus -->|yes| Narrow[Restrict walk per focus semantics]
+    Focus -->|no| Full[Walk full default scope]
+    Narrow --> P0[Phase 0: Input Ingest]
+    Full --> P0
+    P0 --> Tools{<command-tools> available?}
+    Tools -->|no| AskTools[structured inquiry: ratify tool subset · abort]
+    Tools -->|yes| P1[Phase 1: Per-Item Walk]
+    AskTools --> P1
+    P1 --> P2[Phase 2: Per-Finding Triage]
+    P2 --> Border{<command-borderline-classes> calls?}
+    Border -->|yes| AskSev[structured inquiry: surface each borderline call]
+    AskSev --> P2
+    Border -->|no| P3[Phase 3: Findings Emission]
+    P3 --> P4[Phase 4: Validation Gate]
+    P4 --> Bar{All fifteen bars pass?}
+    Bar -->|no| Revise[Revise on failing bar · re-run gate]
+    Revise --> P4
+    Bar -->|yes| Promote[Promote findings artifact]
+    Promote --> Done[<pipeline-tail-handoff>]
+```
+
+The tree distinguishes three fork classes: **deterministic forks**
+(input-surface resolution, prerequisite presence, flag presence,
+tool-availability, gate-bar verdicts), **structured-inquiry forks**
+(alternate-scope ratification, prerequisite-disposition ratification,
+tool-subset ratification, borderline severity calls), and **iteration forks**
+(the Phase 2 borderline-triage loop, the Phase 4 gate-bar loop). Commands may
+add command-specific intermediate phases between Phase 1 and the final emission
+phase; the parameter table's `tools-probed` and `borderline-classes` rows name
+each command's substantive deltas, and the `pipeline-tail-handoff` row names the
+terminal node that replaces the generic `<pipeline-tail-handoff>` placeholder.
+
+## Per-Command Parameter Table
+
+| Command | `tools-probed` | `borderline-classes` | `focus-semantics` | `pipeline-tail-handoff` |
+|---------|----------------|----------------------|-------------------|-------------------------|
+| `/code-review` | host manifests (`pyproject.toml` / `package.json` / sibling) for convention defaults | borderline severity calls on per-file craft findings | `--focus` restricts walk to focus subtree (default: `src/` + `scripts/` + `tools/`) | Pipeline terminates — findings ready for remediation |
+| `/code-audit` | `mypy --strict` · `vulture` · `pylint --disable=all --enable=duplicate-code` · coverage report | public-API dead-code disambiguation · open layer-assignment questions · gate-bar `n/a` rationales | `--focus AREA` ∈ `{type-hints, coverage, dead-code, duplicates, architecture, all}` skips irrelevant phases | Terminal — review-fortress consumer reads |
+| `/security-audit` | secrets sweep · injection-surface walk · deserialization / path-traversal / RCE detectors · CodeQL · CVE feeds | false-positive vs. accepted-risk triage | `--focus` restricts to a single category (secrets / permissions / input-validation / injection / deserialization / RCE / CVE) | Audit handoff to operator / fortress-phase triage |
+| `/perf-audit` | per-class benchmark drivers under `src/apothem/benchmarks/` · USE-method hot-path identifier | operator-override ratification (per-class budget amendments) | `--focus CLASS` scopes to a single performance class (hooks · validate-ecosystem · tests · agents · shell) | Audit complete · handoff to performance remediation |
+| `/architecture-review` | `_inputs/design.md` upstream artifact · layer-traceability walker · cycle detector | undesigned-component vs. design-gap vs. code-undiscipline vs. future-delivery classification | `--focus LAYER` restricts audit to a single layer (Domain / Application / Infrastructure / Presentation) | Pipeline handoff to remediation phases |
+| `/ux-review` | CLI-ergonomics walker · installation flow probe · error-recovery harness · documentation discoverability sweep | surface-gap disposition (inventory completeness) | `--focus SURFACE` restricts walk to a single named surface (CLI / install / errors / docs) | Pipeline handoff to fortress review |
+| `/a11y-audit` | ax-core · Pa11y · Lighthouse | borderline a11y severity calls (WCAG level interpretation, AT-impact disambiguation) | `--focus` restricts crawl to focus subtree (default: all reachable pages up to host ceiling) | Pipeline terminates — findings ready for remediation |
+| `/docs-review` | host's docs-site generator (Fumadocs / Docusaurus / Sphinx / sibling) for convention defaults | borderline severity calls on per-page documentation findings | `--focus` restricts walk to focus subtree (default: `docs/` + root singletons) | Pipeline terminates — findings ready for remediation |
+| `/dependency-audit` | `pip-audit` · `safety` · `osv-scanner` · lockfile resolvers | borderline CVE severity calls · lockfile-generation ratification | `--focus` restricts walk to a single manifest or package (default: full dependency graph) | Pipeline terminates — findings ready for remediation |
+| `/supply-chain-audit` | host-ratified targets across seven release-engineering axs (signing · provenance · SBOM · pinning · CI permissions · publish flow · attestation) | borderline severity calls on per-axis findings | `--focus AXIS` restricts walk to a single axis (default: all seven axs) | Pipeline terminates — findings ready for remediation |
+| `/threat-model-audit` | STRIDE per-element walker · PASTA per-tier walker · threat-actor taxonomy · upstream architecture and security artifacts | boundary-set ratification · upstream-first vs. proceed-without ratification · borderline severity / actor calls | `--focus` restricts walk to a single trust boundary or threat actor (default: full architectural surface) | TIER 3 convergence attestation ready |
+
+## Bindings (§0.j five-direction)
+
+- **Drives →** ● The `## Decision Tree` section of each of the eleven audit-fortress commands (each cites this canonical skeleton + supplies its parameter-table row).
+- **Satisfies →** ● The [`ecosystem-audit`](../SKILL.md) skill's reference-surface obligation (the skeleton loads selectively, beside the skill's entry-point procedure).
+- **Established by ↑** ● [`ecosystem-audit/SKILL.md`](../SKILL.md) (the audit skill this reference extends).
+- **Cross-bound with ↔** ↔ `commands/code-review.md` + `commands/code-audit.md` + `commands/security-audit.md` + `commands/perf-audit.md` + `commands/architecture-review.md` + `commands/ux-review.md` + `commands/a11y-audit.md` + `commands/docs-review.md` + `commands/dependency-audit.md` + `commands/supply-chain-audit.md` + `commands/threat-model-audit.md` (the eleven consuming audit-fortress commands).

package/src/apothem/skills/ecosystem-audit/references/procedure.md

@@ -0,0 +1,162 @@
+<!-- SPDX-License-Identifier: MIT -->
+
+# Ecosystem-Audit Procedure, Classification, Recovery & Cadence
+
+Reference surface for the [`ecosystem-audit`](../SKILL.md) skill. Houses the
+fixed five-phase audit procedure, the improvement-classification taxonomy, the
+failure-recovery table, the cadence guidance, and the phase-thread diagram —
+the operational detail a consuming context loads when it executes the audit,
+kept out of the skill's entry-point router so the router stays tight.
+
+## Procedure
+
+A fixed five-phase cadence — sequential at the phase level, parallelizable at
+the dimensional level when an audit team is deployed.
+
+### 1. Census
+
+Glob all ecosystem files. Count rules, commands, skills, agents, hooks. Verify counts match `CLAUDE.md` registries and `MEMORY.md` claims.
+
+### 2. Cross-Reference Audit (parallel)
+
+Deploy three parallel agents (use the persistent agent definitions from `agents/` where available: `convention-auditor.md` for Agent A, `memory-auditor.md` for Agent C):
+
+- **Agent A (Structure)** — Verify `CLAUDE.md` registries: every listed file exists, every file on disk is listed. Check scope labels against actual frontmatter. Verify the Rule-Delegated Mandates table against rule file contents. Check CM-N / TM-N / CP-N reference integrity.
+- **Agent B (Artifacts)** — Verify commands, skills, agents, hooks: frontmatter validity, internal cross-references, pipeline-ordering consistency, hook CM-N alignment with CM-14. Apply the Harness-Component Alignment Dimension below to every shipped harness component (skill, command, agent, hook, MCP surface).
+- **Agent C (Memory + Quality)** — Verify `MEMORY.md` accuracy against filesystem state. Spot-check rules for required sections. Identify stale references. Brainstorm improvement opportunities classified FIX / ENHANCE / CONSIDER / DEFER.
+
+### 3. Synthesis
+
+Collect agent results. Verify mutual consistency. Resolve contradictions per the result-conflict clause in Failure Recovery.
+
+### 4. Report
+
+Emit the structured audit report:
+
+- pass / fail per check with evidence;
+- fixes needed (exact file, location, old / new text);
+- enhancement opportunities with classification.
+
+### 5. Apply (if `--fix`)
+
+Apply FIX-classified items **only**. Report changes with before / after line counts. ENHANCE / CONSIDER / DEFER are reported but never auto-applied — each requires operator judgment, solicited via the structured-inquiry channel per `rules/interactive-questions.md`.
+
+### 6. Pre-Emission Self-Check
+
+Before emitting the report (and before applying any `--fix` change), run the fifteen-bar pre-emission gate per `rules/pre-emission-gate.md` against the audit's own outputs as the artifact under review. Each bar is marked `pass` or `n/a` (with reason); the attestation is recorded in the report's closing section. Mechanical-fraction bars (M2 disclosure, M5 authority placeholders, M7 option annotation, M8 hedging vocabulary, M10 binding reciprocity, M13 code craft, M15 production readiness) are operationalized by the per-bar matchers at `conformity/*-grep.py`; reasoned bars (M1 host agnosticism, M3 ten dimensions, M6 expertise, M9 visual leverage, M11 agile sprints, M12 phase layout, M14 systemicity) are evaluated inline. A failing bar blocks emission until the defect is corrected — the audit's own emission honors the discipline it audits in the host.
+
+## Improvement Classification
+
+Every improvement opportunity surfaced by Agent C is assigned exactly one of four classes:
+
+- **FIX** — Defect: a claim is false, a cross-reference is broken, a file is missing, a frontmatter field is invalid. Mechanically applicable; auto-applied under `--fix`.
+- **ENHANCE** — Missing-but-valuable addition: a rule lacks a section other rules carry; an agent lacks a token-budget override note. Requires operator approval via the structured-inquiry channel; small change, high value.
+- **CONSIDER** — Trade-off pending: two valid designs exist (e.g., split a 200-line topic file vs. keep it). Surface the trade-off; the operator decides.
+- **DEFER** — Out of current scope: requires a separate workstream (new skill, new rule, ecosystem restructure). Logged for the future, not actioned now.
+
+## Harness-Component Alignment Dimension
+
+Every shipped harness component — skill, command, agent, hook, MCP surface —
+is audited against this dimension during Step 2 (Agent B). The dimension owns
+no rule content of its own; it verifies the component against the disciplines
+already ratified upstream, and routes each finding through the FIX / ENHANCE /
+CONSIDER / DEFER classification. Four facets, each anchored to its governing
+rule:
+
+- **Per-harness contemporary alignment.** Each component stays aligned with its
+  per-harness latest official documentation and best-practices, surfaced
+  through the adapter's `STANDARD-CONVENTION-PIN.md` discovery walk per
+  `rules/harness-adapter-shape.md`. A pin whose snapshot has gone stale, or a
+  component built against a superseded vendor surface, is a finding.
+  Re-verification sweeps each vendor's FULL current doc surface
+  vendor-by-vendor — not only the single page the pin cited — because a pin
+  commonly under-documents surfaces the vendor has since added (e.g. a
+  rules-only pin that frames the vendor's skill / sub-agent / command surface as
+  "absent" when the vendor documents it); a pin that frames a present vendor
+  surface as absent is a staleness finding distinct from date-staleness, and the
+  correction reframes the adapter's narrow delivery as a deliberate posture
+  rather than an absence-of-surface claim. Pins authored in one batch from a
+  shared doc-reading tend to share the same staleness, so re-verification groups
+  pins by authoring batch and re-checks the cohort-batch together. Per-harness
+  agentic-capability coverage (MCP support, sub-agent dispatch, tool-surface
+  restriction, hooks pipeline, skills directory) is verified against the
+  matrix per `rules/agent-capability-discipline.md`; an advertised capability
+  with no covering evidence is a finding.
+- **Durable structure, cross-linking, reusability.** Each component carries
+  intact reciprocal cross-references (no half-edge bindings, no dead paths),
+  belongs to the reference graph with a consumer and an index entry (no orphan),
+  and is shaped for reuse rather than duplicated across the cohort — verified
+  against `rules/systemic-participation.md` and `rules/propagation.md`. Recurring
+  near-duplicate logic across three or more components is a consolidation finding.
+- **MAXIMAL agnosticism.** No shipped component presets a model tier, an effort
+  level, or a permission mode, and none privileges a single harness by tailored
+  default, brand phrasing, or assumed runtime — verified against
+  `rules/agnostic-posture.md`. A component that renders differently across the
+  registered cohort without a declared, justified divergence is a finding.
+- **Determinism across all harnesses.** Each component's output / message
+  structure is expected and stable across any session, and that stability
+  generalizes across the whole registered harness cohort rather than being
+  claude-code-specific — verified against `rules/determinism.md`. A
+  signature that drifts between identical reads, or a structure that holds for
+  one harness but not its siblings, is a finding.
+
+The dimension is the canonical home for the harness-component-alignment audit;
+`/elevate` and `/freshify` reference it rather than re-derive it.
+
+## Failure Recovery
+
+- **Agent failure** (one of the three Step-2 agents cannot complete): record which dimensions are unaudited; proceed to Step 3 with partial coverage flagged in the report. At PUBLIC_LAUNCH, a single-agent failure blocks `--fix` (auto-application requires complete coverage); at lower seriousness, surface the gap and continue.
+- **MEMORY.md missing or corrupt** (Agent C cannot start): treat as a FIX-classified finding. Reconstruct `MEMORY.md` as a minimal index of any topic files found on disk; if none exist, create an empty index. Notify the user explicitly — Agent C's audit is reduced to "MEMORY.md was missing; reconstructed empty".
+- **CLAUDE.md missing or corrupt** (Agents A and B both depend on it): STOP. Without `CLAUDE.md` the registry has no source of truth; auto-recovery is unsafe. Recommend version-control restoration via the structured-inquiry channel.
+- **Result conflict** (two agents produce contradictory findings on the same dimension): surface BOTH findings to the operator with evidence; never silently pick one. This is a Critical finding by definition.
+
+## Cadence Guidance
+
+Sequential sweeps exhibit diminishing returns as the ecosystem converges. Signal maturity when findings drop below 3 actionable fixes per sweep for 2+ consecutive sweeps. Once mature:
+
+- **Event-triggered sweeps** after significant changes (new rules, template refinements, command additions, hook restructuring).
+- **Periodic sweeps** at most monthly, or when `MEMORY.md`'s last-sweep date exceeds 30 days.
+- **Focus sweeps** (via `--focus`) for targeted verification after localized edits, in place of a full-ecosystem re-audit.
+
+Each sweep introduces at least one novel audit dimension (a new agent prompt angle, a different cross-reference path, an unexplored edge case) to avoid pattern-blindness from repeated identical audits.
+
+## Phase Thread
+
+The audit's internal execution thread proceeds as a fixed cadence — discovery, dimensional analysis, consistency check, fix application (when `--fix` is set), and report emission. The thread is sequential at the phase level and parallelizable at the dimensional level when an audit team is deployed.
+
+```mermaid
+%%{ init: { "theme": "neutral" } }%%
+%% verified: 2026-05-04 %%
+%% provenance: skills/ecosystem-audit/references/procedure.md (audit cadence guidance) %%
+%% cross-reference: rules/agent-orchestration.md §1 (Audit Team pattern) %%
+flowchart TD
+    Start[Audit invoked · optional --focus or --fix] --> Discover[Phase 1 · Discover ecosystem surface]
+    Discover --> Scope{--focus narrowing?}
+    Scope -->|yes| Narrow[Restrict to focus dimensions]
+    Scope -->|no| Full[Full ecosystem in scope]
+    Narrow --> Dims[Phase 2 · Dimensional analysis]
+    Full --> Dims
+    Dims --> Naming[Naming and frontmatter]
+    Dims --> CrossRef[Cross-references and registries]
+    Dims --> Coherence[Conventions and coherence]
+    Dims --> Drift[Staleness and drift]
+    Naming --> Findings[Phase 3 · Compile findings]
+    CrossRef --> Findings
+    Coherence --> Findings
+    Drift --> Findings
+    Findings --> Fix{--fix flag set?}
+    Fix -->|yes| Apply[Phase 4 · Apply fixes per finding]
+    Fix -->|no| Skip[Phase 4 · Skip fix application]
+    Apply --> Report[Phase 5 · Emit structured report]
+    Skip --> Report
+    Report --> Mat{Maturity threshold met?}
+    Mat -->|yes · 2+ sweeps under 3 actionable fixes| Cadence[Switch to event-triggered or periodic cadence]
+    Mat -->|no| Continue[Sequential sweeps continue]
+```
+
+## Bindings (§0.j five-direction)
+
+- **Drives →** ● Every blind-audit execution's five-phase cadence + classification + recovery routing (this reference is the operational procedure).
+- **Satisfies →** ● The [`ecosystem-audit`](../SKILL.md) skill's reference-surface obligation (the procedure loads selectively, beside the router).
+- **Established by ↑** ● [`ecosystem-audit/SKILL.md`](../SKILL.md) (the audit skill this reference extends).
+- **Cross-bound with ↔** ↔ `rules/agent-orchestration.md` §1 (the Audit Team pattern the Step-2 parallel agents dispatch under). ↔ `rules/pre-emission-gate.md` (the fifteen-bar gate the Step-6 self-check runs). ↔ `agents/convention-auditor.md` + `agents/memory-auditor.md` (the persistent agents Step-2 dispatches). ↔ `rules/harness-adapter-shape.md` + `rules/agent-capability-discipline.md` + `rules/agnostic-posture.md` + `rules/determinism.md` (the four disciplines the Harness-Component Alignment Dimension verifies against, never re-derives). ↔ `rules/systemic-participation.md` + `rules/propagation.md` (the cross-linking / reusability / anti-orphanism surface the dimension's second facet checks). ↔ `commands/elevate.md` + `commands/freshify.md` (the two surfaces that reference this dimension rather than re-derive it).

package/src/apothem/skills/eval-harness/SKILL.md

@@ -0,0 +1,88 @@
+---
+name: "eval-harness"
+version: "0.1.0"
+updated: "2026-06-09"
+description: "Build and run a reproducible LLM evaluation harness — matched when the operator asks to 'build an eval', 'measure the model', set up an 'evaluation harness', 'score outputs', benchmark a prompt or model variant, regression-test generation quality, or compare candidate models on a labeled task. Defines four artifacts: a versioned labeled dataset, a scorer (exact-match / rubric / LLM-judge) with an explicit pass criterion, a candidate runner, and an aggregated metrics report carrying pass-rate with a Wilson confidence interval, per-category breakdowns, and regression/improvement lists against a prior run. Reproducibility is the contract — every run stamps the dataset version, the scorer definition, the candidate identifier, and the seed so two runs over identical inputs return an identical verdict. Harness- and model-agnostic: drives any provider through its native invocation surface, discovered or inquired per rules/host-discovery.md. NOT for fine-tuning or training pipelines, authoring the prompt under test, live-monitoring dashboards, one-shot un-versioned benchmarks, or scoring against an undefined pass criterion. User-invocable directly."
+archetype: "ai-template"
+userInvocable: true
+argument-hint: "[--dataset PATH] [--scorer NAME]"
+disable-model-invocation: true
+allowed-tools: "Read, Write, Edit, Glob, Grep, Bash"
+---
+
+<!-- SPDX-License-Identifier: MIT -->
+
+## Purpose
+
+Build and run a reproducible evaluation harness that measures an LLM candidate against a labeled dataset under an explicit scorer. The harness emits a metrics report — pass-rate, per-category breakdown, confidence interval, regression list — that any reader reproduces by re-running the same dataset and scorer over the same candidate.
+
+Reproducibility is the load-bearing discipline. Every run records four reproducibility coordinates — **dataset version · scorer definition · candidate identifier · random seed** — so two runs over identical inputs return an identical verdict. An eval that cannot be re-run to the same number is a sample, not a measurement.
+
+## Detection Signal
+
+Triggers when the operator asks to "build an eval", "measure the model", set up an "evaluation harness", "score outputs", benchmark a prompt or model variant, regression-test generation quality, or compare two candidate models on a labeled task. The signal is the demand to *measure* a candidate against labeled ground truth under a stated pass bar — not to author the prompt, tune weights, or watch production traffic.
+
+## Non-Goals
+
+This skill carries a deliberately narrow surface. It is NOT:
+
+- **Not provider-coupled.** The harness drives any candidate through its native invocation surface — HTTP endpoint, SDK call, local runtime, or CLI. It never assumes a vendor, API shape, or model identifier; the candidate is a parameter, discovered or inquired per `rules/host-discovery.md`.
+- **Not a training or fine-tuning pipeline.** The harness measures behavior; it does not adjust weights, curate training data, or run gradient steps.
+- **Not a prompt-authoring tool.** The harness scores outputs against a dataset. Authoring the prompt under test is the operator's upstream responsibility.
+- **Not a one-shot benchmark.** A single un-versioned run is a sample, not an eval. The harness stamps the four reproducibility coordinates so runs are comparable across time.
+- **Not a live-monitoring dashboard.** The harness emits a point-in-time report; continuous production telemetry is the host's observability surface, not this skill's.
+
+## Workflow
+
+1. **Define the eval dataset.** Author a versioned set of labeled cases — each case carries an input, an expected label (or rubric reference), and a category tag that drives the per-category breakdown. Discover the host's existing dataset format and location per `rules/host-discovery.md` and honor it. A dataset below the host's ratified floor (default: 20 cases) surfaces as a confidence-coverage finding — too few cases yield a confidence interval too wide to act on.
+2. **Define a scorer with a pass criterion.** Choose exactly one scorer class per metric from the closed set:
+   - **exact-match** — string or structured equality against the expected label.
+   - **rubric** — named criteria, each with a per-criterion threshold.
+   - **LLM-judge** — a judge prompt emitting a deterministic verdict schema; the judge candidate and seed are pinned so judge verdicts are themselves reproducible.
+
+   State the pass criterion explicitly: a case passes iff the scorer's verdict meets the named threshold. A scorer requested without a pass criterion is REFUSED per the Refusal & Escalation stanza — an eval without a threshold measures nothing.
+3. **Run candidates over the dataset.** Invoke the candidate over every case, recording the raw output, the case identifier, and the run seed. Re-running the same dataset and seed over the same candidate returns identical raw outputs where the candidate is deterministic; any non-determinism is recorded with the sampling parameters (temperature, top-p, seed) that drive it.
+4. **Aggregate metrics.** Compute pass-rate over the full dataset, the per-category pass-rate breakdown, and the passing/failing case counts per category. Aggregation is deterministic — identical raw outputs under an identical scorer return identical metrics.
+5. **Report with confidence and regressions.** Emit the metrics report naming pass-rate with its Wilson-score confidence interval (at the host's ratified level; default 95%), the per-category breakdown, and — when a prior run's report is supplied — the **regression list** (cases that passed in the prior run and fail in this one) and the **improvement list** (the inverse).
+
+## Return Contract
+
+The harness returns three artifacts:
+
+- **Dataset** — the versioned labeled-case set at the host's ratified location, carrying a version stamp and a case count.
+- **Scorer** — the scorer definition (class · criteria · pass threshold · judge pin where applicable) as a re-runnable specification.
+- **Metrics report** — pass-rate with its Wilson confidence interval, the per-category breakdown, and the regression/improvement lists against any supplied prior report.
+
+The report is reproducible: a reader re-running the recorded dataset version and scorer over the recorded candidate and seed reaches the same metrics. A report omitting the confidence interval, or presenting a sub-floor dataset's pass-rate without the coverage caveat, is non-conformant.
+
+## Foundational Stanzas
+
+The four standing surfaces every invocation inherits.
+
+### Refusal & Escalation
+
+REFUSE any request that asks the harness to act outside its mission — fine-tuning, prompt authoring, production monitoring, or scoring against an undefined pass criterion. Refusal is explicit: name what was refused, name the mission boundary crossed, and route the operator to the appropriate surface through the structured-inquiry channel per `rules/interactive-questions.md` (canonical channel; three-segment option annotation; free-form prose as primary input is forbidden). A scorer requested without a pass criterion is REFUSED as underspecified, and the criterion is surfaced as a required inquiry before any run.
+
+### Output Surface
+
+The harness emits the dataset and scorer at the host's ratified eval location (discovered per `rules/host-discovery.md`; never assumed) and the metrics report to STDOUT or the host's report surface. Candidate outputs and run logs are run-scoped working state under the host's ratified eval-run directory. NEVER write eval artifacts to a global-ecosystem location; NEVER couple an artifact to a specific provider's identifier where the host expects a parameter.
+
+### File-Authoring Contract
+
+Every NEW file the harness creates routes through `scripts/inject-header.py` so the canonical `SPDX-License-Identifier` `MIT` header is injected in the comment family matching the filetype; the injector is idempotent and detects the variant from the byte-exact fixture at `src/apothem/schemas/authorship-header.txt`. Exempt classes — LICENSE, JSON configuration files, lockfiles, generated assets, vendored trees, `.audit/` ephemera, `.apothem/plans/` ephemera, `.keep` / `.gitkeep` markers, binaries — are enumerated at `src/apothem/schemas/header-exceptions.txt`. Generated run logs and metrics reports are banner-exempt under the generated-asset class.
+
+### Structured Inquiry on Ambiguity
+
+When the harness reaches a decision in any of the seven authoritative-data categories per `rules/host-discovery.md` and `rules/interactive-questions.md` — identity; scope direction; preference (dataset format, scorer class, confidence level); security (judge-candidate credentials, allowed network egress); naming of public surfaces (dataset name, scorer name); infrastructure endpoints (candidate invocation surface); version pins (candidate identifier, judge pin) — and the host is silent, it routes the resolution through the structured-inquiry channel with the three-segment option annotation per `rules/interactive-questions.md` §3 (rationale / recommendation / default-pointer). Free-form prose questions as primary input are forbidden. NEVER fabricate authoritative data — a guessed candidate identifier or invented endpoint corrupts every downstream metric.
+
+## Recommended Next Step
+
+**Run the harness over the defined dataset and scorer**, then supply the resulting report as the prior-run baseline on the next invocation to activate regression detection.
+
+## Bindings (§0.j five-direction)
+
+- **Drives →** ● Every eval-dataset definition under the host's ratified eval location. ● Every scorer specification (exact-match / rubric / LLM-judge) with its pass criterion. ● Every metrics report's reproducibility stamp (dataset version, scorer, candidate, seed).
+- **Satisfies →** ● `CLAUDE.md` Source Layout row "eval-harness" (skills/ class). ● The ai-engineering cohort's reproducible-LLM-evaluation mission.
+- **Established by ↑** ● `CLAUDE.md` Source Layout (skills/ class declaration with the folder-with-`SKILL.md` convention). ● `CLAUDE.md` Ambiguity Handling (structured inquiry over fabrication).
+- **Gated by ←** ● The harness's tool surface (Read / Write / Edit / Glob / Grep / Bash). ● The host's ratified eval-dataset format and candidate-invocation surface, discovered per `rules/host-discovery.md`.
+- **Cross-bound with ↔** ↔ `rules/host-discovery.md` (M1 — dataset format, candidate surface, confidence level discovered, never invented). ↔ `rules/interactive-questions.md` (M5 — undefined pass criteria and authoritative-data gaps route through the structured-inquiry channel). ↔ `rules/definitiveness.md` (M8 — the pass criterion is a stated threshold, never a hedged expectation). ↔ `skills/ecosystem-audit/SKILL.md` (sibling skill under the same registry section).