@apptoolkit/harness 1.0.0 → 1.0.1

package/dist/bun/npm/payload/harness/workflows/W23.md

@@ -1,21 +0,0 @@
-# W23 Verification and coverage
-
-**Trigger**. Verify this change, coverage or source policy.
-
-**Authority**. Run approved local checks. Launching remote jobs, changing policies and rewriting golden evidence require their own applicable permission.
-
-1. Identify the exact revision, source families, case denominator, applicable stack and established gates. Derive the denominator from the full relevant source inventory, including files no test loaded. For greenfield work, require measurable full coverage for every family and keep uninstrumented scope pending.
-2. Run the native format, lint, type and behavior checks through the project runner. Use the compatible personal style checks for authored TypeScript where the project lacks applicable Biome. Record actual selected, executed, failed, skipped and uncovered cases.
-3. Investigate failing tests and evidence before changing the test or implementation. Keep coverage distinct from deterministic style and independent factual audit and code review. Rerun affected checks after changes.
-
-**Result and recovery**. Return reproducible commands, measured scope and results. Flag empty runs, unresolved failures and unmeasured scope, with owner and resume condition.
-
-For LCOV evidence, independently inventory the applicable source files and write a scope file with workspace-relative paths and the required metrics. Use the metrics the project's tooling is expected to measure.
-
-```json
-{"files":["src/example.ts"],"metrics":["lines","functions","branches"]}
-```
-
-Run `rtk proxy bun --no-env-file llm/harness/runtime/harness.mjs verify coverage coverage/lcov.info --config llm/harness/coverage.json` from the installation root, substituting the actual report and scope file. The verifier requires one complete record per expected source, matches declared totals to measured entries, and reports the actual hit and found counts. A selected metric with no measurable entries stays pending. Record the run and source revision separately to establish that the report is fresh.
-
-Apply the [operating policy](../POLICY.md) and [project guide](../PROJECT.md). Record reusable decisions and improvements at the appropriate checkpoint.

package/dist/bun/npm/payload/harness/workflows/W24.md

@@ -1,13 +0,0 @@
-# W24 Design and visual evidence
-
-**Trigger**. Design or verify a visual change or export.
-
-**Authority**. Read the approved design and supplied visual evidence. Editing, propagating, replacing a golden artifact and publication are separately scoped.
-
-1. Resolve the design authority, exact saved revision, variants, states, accessibility needs and representative consumers. Locate the applicable native tool and permitted operations.
-2. Use a small canary when testing propagation across files or components. Capture before and after evidence, native properties, actual rendered behavior and relevant interactions or exports.
-3. Check affected consumers and verify the exact saved revision. Compare reproducible exports with accepted golden evidence where available. Keep a design proposal separate from an accepted or published design.
-
-**Result and recovery**. Return verified design state, visual evidence and affected scope. If the native tool cannot establish parity, preserve the gap and a reproducible checkpoint.
-
-Apply the [operating policy](../POLICY.md) and [project guide](../PROJECT.md). Record reusable decisions and improvements at the appropriate checkpoint.

package/dist/bun/npm/payload/harness/workflows/W25.md

@@ -1,13 +0,0 @@
-# W25 Test design and execution
-
-**Trigger**. Design, generate, count or run tests.
-
-**Authority**. Prepare and run approved cases in the specified environment. CI queueing, real data writes and policy changes need the corresponding authority.
-
-1. Map the accepted behavior to manual, API, browser or data-derived scenarios. Assign stable case IDs. For tabular inputs, parse and validate required fields and record skipped rows.
-2. Resolve the native runner, exact selection, environment, fixture scope and pinned dependencies. Use an authorized browser or device profile where required and preserve the case-to-requirement link.
-3. Run the scoped cases and reconcile discovery, executed, passed, failed, skipped and retry counts. Inspect a missing or empty result before making a coverage claim.
-
-**Result and recovery**. Return case identities, command, environment and measured results. Keep unexecuted cases distinct from passes and use W26 for a failure.
-
-Apply the [operating policy](../POLICY.md) and [project guide](../PROJECT.md). Record reusable decisions and improvements at the appropriate checkpoint.

package/dist/bun/npm/payload/harness/workflows/W26.md

@@ -1,13 +0,0 @@
-# W26 Test failure diagnosis
-
-**Trigger**. Diagnose or fix this test failure.
-
-**Authority**. Start with read-only diagnosis and an approved reproduction. Fix only authorized local scope. Creating a bug or automation ticket is separate.
-
-1. Identify the exact case, attempt, retries, revision, environment and failure signal. Read relevant original traces, reports and fixtures with a bounded format-aware tool.
-2. Compare the assertions, setup and observed behavior with the accepted contract. Reproduce where authorized. Classify the cause as test, product, environment or insufficient evidence.
-3. Correct the verified cause within scope and add a regression check. Rerun the relevant case and affected integration checks. Keep bug, fixture and pipeline actions separate.
-
-**Result and recovery**. Return the cause, evidence, correction and measured rerun. For insufficient evidence, preserve failed attempts and the next discriminating check.
-
-Apply the [operating policy](../POLICY.md) and [project guide](../PROJECT.md). Record reusable decisions and improvements at the appropriate checkpoint.

package/dist/bun/npm/payload/harness/workflows/W27.md

@@ -1,13 +0,0 @@
-# W27 QA data, access and test framework
-
-**Trigger**. Prepare QA data, access or a shared test framework release.
-
-**Authority**. Treat fixture data, user roles, environments, publishing and consumer updates as distinct effects. Use approved test identities and isolated data.
-
-1. Resolve the exact target, identities, roles, runtime artifact and authorized test data recipe. Prefer disposable, scoped fixtures and inventory existing state before writing.
-2. Verify fixture state, roles and cleanup where applicable. For a framework release, inspect the exact artifact and its consumers, then record compatibility and the pins that need updating.
-3. Preview the permitted write or publication separately, execute only the approved operation and verify identity, version and behavior in the actual consumer.
-
-**Result and recovery**. Return verified fixture or artifact identities, exclusions and cleanup or rollback path. Keep any unresolved consumer or access gap visible.
-
-Apply the [operating policy](../POLICY.md) and [project guide](../PROJECT.md). Record reusable decisions and improvements at the appropriate checkpoint.

package/dist/bun/npm/payload/harness/workflows/W28.md

@@ -1,13 +0,0 @@
-# W28 Environment, migration and recovery
-
-**Trigger**. Start or recover a local environment, migration or backup.
-
-**Authority**. Identify user-owned processes and mutable state before acting. Starting services, migrating, backing up and restoring each use the exact applicable permission.
-
-1. Resolve the checkout, service versions, resource owners, actual listeners, data store and target environment with finite read-only probes. Isolate temporary state and test credentials.
-2. Plan the approved operation and its recovery. For migrations, inspect applied history and target schema. For recovery, verify backup identity, byte integrity, format and destination before replay.
-3. Apply only the exact covered operation. Verify application readiness, migration state or restored data independently with the native tool. Preserve original evidence and failure causes.
-
-**Result and recovery**. Return actual state, verified recovery or the precise blocker. Continue independent work if the target or owner remains uncertain.
-
-Apply the [operating policy](../POLICY.md) and [project guide](../PROJECT.md). Record reusable decisions and improvements at the appropriate checkpoint.

package/dist/bun/npm/payload/harness/workflows/W29.md

@@ -1,13 +0,0 @@
-# W29 Incident, security and performance triage
-
-**Trigger**. Triage a live incident, security issue or performance problem.
-
-**Authority**. Collect scoped evidence from authorized live or supplied sources. Remediation, traffic changes and outward notices require their own authority.
-
-1. Establish actual serving revision, service, environment, time window and affected behavior. Preserve source locators and state when evidence is sampled, delayed or incomplete.
-2. Use targeted logs, traces or metrics. Define baseline, comparison inputs and measurement method. Verify a claimed vulnerability or cause against representative evidence and applicable versions.
-3. Separate diagnosis, mitigation and durable correction. Propose the smallest next action with verification and rollback. Independently review material technical claims.
-
-**Result and recovery**. Return current impact, evidence, gaps and authorized next steps. Keep a hypothesis pending until a discriminating check confirms it.
-
-Apply the [operating policy](../POLICY.md) and [project guide](../PROJECT.md). Record reusable decisions and improvements at the appropriate checkpoint.

package/dist/bun/npm/payload/harness/workflows/W30.md

@@ -1,13 +0,0 @@
-# W30 Release, deployment and rollback
-
-**Trigger**. Prepare, verify or roll back a release.
-
-**Authority**. Resolve preparation, artifact publication, deployment, activation and rollback as separate effects. Obtain the exact applicable grant.
-
-1. Pin the artifact hash, version, target environment, configuration and expected state. Verify applicable checks, signing or provenance and rollback prerequisites.
-2. Preview the exact operation and impact. Run the authorized native route once, then verify actual saved artifact or serving revision and downstream readiness. Distinguish queued from completed work.
-3. If verification fails, preserve observed state and use the approved rollback plan only where its scope covers the exact target. Verify actual recovered state before reporting completion.
-
-**Result and recovery**. Return exact artifact, activation or rollback evidence. Keep preparation and unresolved live state explicit.
-
-Apply the [operating policy](../POLICY.md) and [project guide](../PROJECT.md). Record reusable decisions and improvements at the appropriate checkpoint.

package/dist/bun/npm/payload/harness/workflows/W31.md

@@ -1,13 +0,0 @@
-# W31 Cost, context and model qualification
-
-**Trigger**. Check cost, tune context or qualify a model.
-
-**Authority**. Use approved telemetry, profiles and budget. Provider calls, paid evaluations and configuration changes require applicable scope.
-
-1. Resolve the model, runtime, tools, task, budget, data set and measurement method. Fix comparable inputs, versions and criteria before comparing results.
-2. Collect measured input, output, cache, workers and reserve accounting with deterministic tools where available. Separate provider-reported values, offline estimates and unavailable values.
-3. Compare quality, cost and latency against the accepted criteria. Verify source dates, units and inference boundaries independently. Keep budget and provider effects explicit.
-
-**Result and recovery**. Return comparable results with denominators and coverage. If telemetry or a provider route is unavailable, label the estimate and keep qualification pending.
-
-Apply the [operating policy](../POLICY.md) and [project guide](../PROJECT.md). Record reusable decisions and improvements at the appropriate checkpoint.

package/dist/bun/npm/payload/harness/workflows/W32.md

@@ -1,13 +0,0 @@
-# W32 Application-agent workflow and learning
-
-**Trigger**. Build an application-agent workflow or learn from review corrections.
-
-**Authority**. Use the accepted implementation definition and permission model. Changes to stored state, prompts, provider configuration and outward effects require their corresponding authority.
-
-1. Define input, tool permissions, expected output, durable state and authorization boundaries. Combine scoped policy and task instructions with deterministic preparation and explicit effect previews.
-2. Implement recovery with exact checkpoints, correlation, failure handling and readback. Keep private tool payloads in the approved store and verify who owns human edits and review decisions.
-3. Capture confirmed corrections with provenance, scope, supersession and retirement rules. Route accepted actions to an authorized local list. Test repeat, retry and scope isolation and update discovery.
-
-**Result and recovery**. Return working behavior and evidence for each state transition, or a design clearly marked pending. Preserve verified lessons and distinct human decisions.
-
-Apply the [operating policy](../POLICY.md) and [project guide](../PROJECT.md). Record reusable decisions and improvements at the appropriate checkpoint.

package/dist/bun/npm/payload/harness/workflows/W33.md

@@ -1,13 +0,0 @@
-# W33 Reusable prompt forms
-
-**Trigger**. Choose or design a reusable prompt.
-
-**Authority**. Prepare a prompt and bounded inputs for the current task. Running tools, delegating and external effects still follow their own permissions.
-
-1. Choose the request form that best fits the task. Use examples for input and output behavior, plan-first for unresolved requirements, constrained-source for bounded evidence, and compare-and-decide for explicit tradeoffs.
-2. State the target, output, authority, allowed sources and tools, constraints, evidence and completion checks. Mark unresolved choices and required capabilities explicitly.
-3. Test the prompt on a representative case, inspect where it overreaches or leaves gaps, and catalog a verified improvement with the intended trigger and limits.
-
-**Result and recovery**. Return the reusable prompt and a concrete example. If inputs or permissions are missing, preserve the form and leave dependent execution pending.
-
-Apply the [operating policy](../POLICY.md) and [project guide](../PROJECT.md). Record reusable decisions and improvements at the appropriate checkpoint.

package/dist/bun/npm/payload/harness/workflows/W34.md

@@ -1,13 +0,0 @@
-# W34 Application changes and integrations
-
-**Trigger**. Implement a route, API field, component or external integration.
-
-**Authority**. Use the accepted W16 scope. Discover uncertain external contracts read-only. Live mutations, schema changes and release effects need the appropriate grant.
-
-1. Locate current architecture, authoritative contract, generated boundaries and exact application path. Follow data, authentication and authorization through each applicable layer.
-2. Inspect local examples and native interfaces. Verify required external fields, capabilities, environments and failure modes before coding. Resolve material discrepancies through W16.
-3. Implement within the approved boundary. Exercise the relevant interface, domain, persistence and consumer behavior, including failure paths. Run W23 and preserve any migration or release prerequisites.
-
-**Result and recovery**. Return exact code, contract and verification evidence. Keep deployment, unresolved integration behavior and out-of-scope layers visible.
-
-Apply the [operating policy](../POLICY.md) and [project guide](../PROJECT.md). Record reusable decisions and improvements at the appropriate checkpoint.

package/dist/bun/npm/payload/harness/workflows/W35.md

@@ -1,13 +0,0 @@
-# W35 Test traceability and QA documentation
-
-**Trigger**. Update test traceability or sync QA documentation.
-
-**Authority**. Read the approved test and documentation sources and prepare a scoped diff. Tracker field edits, document creation and posting have separate effects.
-
-1. Resolve the canonical test and issue IDs, document section and version. Verify the project's artifact routing, native fields and update rules.
-2. Prepare the smallest exact patch. Validate identifiers, links, required fields, headings and current content and avoid overwriting unrelated edits.
-3. Preview each requested effect and apply only the approved changes. Read back exact persisted fields or section text and verify related links or index entries.
-
-**Result and recovery**. Return the approved diff or exact verified revision. Report version conflicts and destinations that transformed or rejected a submitted payload.
-
-Apply the [operating policy](../POLICY.md) and [project guide](../PROJECT.md). Record reusable decisions and improvements at the appropriate checkpoint.

package/dist/bun/npm/payload/harness/workflows/W36.md

@@ -1,13 +0,0 @@
-# W36 Service identity and shared evidence
-
-**Trigger**. Verify a service identity, change a shared file or manage an evidence store.
-
-**Authority**. Resolve identity and capability read-only. Shared edits, resets, repository registration and cache changes have separate scope and permission.
-
-1. Verify the service, account, exact resource, environment, expected revision and allowed operation. Confirm credential references without reading or exposing secrets unnecessarily.
-2. Prepare exact changes and confirm concurrency and recovery controls such as conditional writes or supported history. Present payload, target and expected result before a write.
-3. Apply the authorized operation with the native protection and read back the exact result. Reconcile unexpected state or partial failure before any retry. Preserve earlier versions and audit evidence where applicable.
-
-**Result and recovery**. Return identity and revision-bound proof. If the route cannot guard concurrent changes or verify the required outcome, keep the effect pending and offer a local draft.
-
-Apply the [operating policy](../POLICY.md) and [project guide](../PROJECT.md). Record reusable decisions and improvements at the appropriate checkpoint.

package/dist/bun/npm/payload/harness/workflows/W37.md

@@ -1,13 +0,0 @@
-# W37 Scheduler and queue work
-
-**Trigger**. Add or diagnose a scheduled job or queue worker.
-
-**Authority**. Inspect scoped scheduler, producer and consumer evidence first. Registration, replay and downstream writes each require their own authority.
-
-1. Resolve schedule, tenant, producer, queue, consumer, payload references and actual serving revision. Collect bounded structured evidence for timing, delivery, attempts and results.
-2. Distinguish scheduler registration, enqueue, delivery, processing and downstream effects. Verify retry, deduplication and isolation behavior before considering a replay or local fix.
-3. Implement or replay only the authorized scope. Verify the actual event and resulting state separately at each applicable boundary. Preserve correlation and failure evidence.
-
-**Result and recovery**. Return the exact job or event, observed states and next step. If an effect remains uncertain, preserve the checkpoint before retrying to avoid duplicates.
-
-Apply the [operating policy](../POLICY.md) and [project guide](../PROJECT.md). Record reusable decisions and improvements at the appropriate checkpoint.

package/dist/npm/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 AppToolkit contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/dist/npm/README.md

@@ -1,30 +0,0 @@
-# AppToolkit Harness
-
-AppToolkit Harness installs project guidance, deterministic verification tools and 37 reusable engineering workflows for Codex, Claude Code and OpenCode. It supports new projects, existing repositories and a shared harness for related repositories.
-
-Use macOS or Linux with Bun, Node.js 24 or later, Git for versioned projects and RTK for project tooling. Run the installer from the target directory.
-
-```sh
-rtk proxy bunx @apptoolkit/harness install
-```
-
-Review the proposed files, then select which agents, repositories and optional services to configure. Open the same directory in your agent and run `$apptoolkit init` in Codex or `/apptoolkit init` in Claude Code or OpenCode. The installed `llm/HARNESS.md` is the shared entry point.
-
-In a directory of related repositories, start the agent in the parent directory. The central harness keeps shared decisions and scoped repository context. Use `$apptoolkit add repo <path>` or `/apptoolkit add repo <path>` after cloning another repository. Repositories can keep their own guidance and toolchain.
-
-To preview an installation in a noninteractive session, inspect the target and supply the explicit choices.
-
-```sh
-rtk proxy bunx @apptoolkit/harness inspect --root /absolute/workspace --json
-rtk proxy bunx @apptoolkit/harness install --root /absolute/workspace --hosts codex,claude,opencode --local --repo-mode .=local --plan --json
-```
-
-Use `--yes` in place of `--plan` to apply a reviewed noninteractive plan. Select the workspace mode separately from each Git repository's generated files. Local mode uses the repository's `info/exclude` metadata for the planned files. Use `--repo-mode <path>=local|versioned` for each selected Git repository.
-
-Use `rtk proxy bunx @apptoolkit/harness@latest update --plan --json` to preview a release update. The updater checks managed files against the installation receipt. Resolve reported conflicts before applying the update. Keep project decisions in the installed local profile, and review the affected paths and version before applying.
-
-Plane and Penpot are separate opt-ins. To make a provider available after installation, preview an update with `--enable-service plane` or `--enable-service penpot`, apply it, and complete the project connection through `init`. The installed runbooks explain instance setup, private credentials, authorization and readiness checks. Snapshot verification requires a versioned harness and project-level opt-in. The default author style profile includes its own Biome dependency and requires its isolated install before first use.
-
-The installed local CLI reads the workflow index, retrieves one workflow at a time and checks Markdown against a local document policy. See `llm/HARNESS.md` for the exact commands. The agent records which operations are configured and which were verified in the current environment.
-
-Distributed under the MIT license.