@damiangilgonzalez/harness 1.3.12 → 1.3.14

package/scripts/lib/onboarding.js

@@ -4,6 +4,7 @@ import { dirname, join, relative, resolve, sep } from 'node:path';
 import { TARGET_IDS } from '../../targets/index.js';
 import { resolveAgentNames } from '../../targets/agents.js';
 import { loadManifest, skillsForProfile } from './manifest.js';
+import { readManifest } from './manifest-file.js';
 import { managedPathsForInstall } from '../install-apply.js';
 
 export const ONBOARDING_SCHEMA_VERSION = 1;
@@ -68,7 +69,17 @@ export function scanProject(root = process.cwd()) {
   let markdownCount = 0;
   let sourceFileCount = 0;
   const visit = (dir) => {
-    for (const entry of readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+    // A directory we are not allowed to open is a fact about that directory, not a reason to abandon
+    // the install. Reported from a real Windows box: the global harness died walking `Temp\WinSAT`,
+    // which Windows protects, on 1.3.2 and again on 1.3.6 — so it had never worked there at all.
+    // The safe form already existed in `detect-repo.js` and was simply not reused here.
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
       if (ignored.has(entry.name) || entry.isSymbolicLink()) continue;
       const path = join(dir, entry.name);
       const rel = relative(absolute, path).split(sep).join('/');
@@ -169,11 +180,32 @@ export function buildOnboardingPlan(record, evidence) {
   const catalog = loadManifest();
   const catalogIds = new Set(catalog.skills.map((skill) => skill.id));
   const detectedSkills = (evidence.stacks || []).filter((stack) => catalogIds.has(stack));
-  const skills = [...new Set([...skillsForProfile(catalog, profile), ...detectedSkills])].sort();
+  // Skills the user asked for BY NAME are kept across an update; skills a profile handed out are not.
+  //
+  // Without this, an update recomputed the set from the profile and the detected stacks alone, and
+  // the install step then deleted from disk whatever was not in that fresh set — every `rsc add`,
+  // on every update. But choosing a narrower scope on purpose still has to be able to REMOVE what the
+  // wider one installed, so the difference comes from where the skill came from: a profile skill
+  // declares its profiles, and a skill you can only get by naming it declares none. What a profile
+  // gave you, a profile may take away; what you asked for by name, only you may. Filtered against the
+  // catalog on the way in, because preserving a declaration is not the same as trusting it.
+  //
+  // `readManifest` returns null on a first install, which is the most common path of all.
+  const inAnyProfile = new Set(catalog.skills.filter((s) => (s.profiles || []).length).map((s) => s.id));
+  const declared = (readManifest(evidence.root ?? process.cwd())?.skills ?? [])
+    .filter((id) => catalogIds.has(id) && !inAnyProfile.has(id));
+  const skills = [...new Set([...skillsForProfile(catalog, profile), ...detectedSkills, ...declared])].sort();
   const baseAgents = needsWorkflow;
   const hooks = needsWorkflow;
   const agents = baseAgents ? resolveAgentNames(skills, []).sort() : [];
   const gitmojiGuard = hooks && normalized.targets.includes('claude');
+  // The danger guard is NOT code machinery, and tying it to `hooks` was the mistake behind #273. The
+  // three guards above need a code project with git — a branch to protect, a commit to lint. This one
+  // stops recursive deletes, history-rewriting pushes and friends, which are exactly as irreversible
+  // in an invoicing workspace, and `init` promises it by technical level: non-technical and mixed get
+  // it, whatever the project is. The guard also decides at runtime from the profile, so the plan only
+  // chooses whether it is present, never whether it bites.
+  const dangerGuard = normalized.technicalLevel !== 'technical';
   const decisions = skills.map((id) => detectedSkills.includes(id)
     ? selected(id, 'skill', `Detected ${id} evidence inside the selected project root.`, 'workspace-evidence')
     : selected(id, 'skill', needsWorkflow
@@ -223,6 +255,7 @@ export function buildOnboardingPlan(record, evidence) {
     alwaysOn: true,
     codeHooks: needsWorkflow,
     gitmojiGuard,
+    dangerGuard,
     memory: true,
     context7: false,
     plugins: needsWorkflow ? ['superpowers@claude-plugins-official'] : [],

package/scripts/lib/repair.js

@@ -131,22 +131,26 @@ export async function repair({ cwd = process.cwd(), target, home = homedir(), dr
 
   const paths = targetPaths(target, home, cwd);
   const ids = [...new Set([...Object.keys(readState(paths.stateFile).skills || {}), ...(readManifest(cwd)?.skills || [])])];
+  // The accepted plan governs a repair exactly as it governs a sync. Without it, `wireHook` saw `{}`,
+  // read `codeHooks !== false` as true and wired every guard the plan had declined — and the next
+  // `sync`, which does pass the policy, took them away again (#274). Restoring is not deciding.
+  const policy = readManifest(cwd)?.onboarding?.plan?.policy;
   const backup = createBackup({
     cwd, operation: 'repair', target,
-    paths: managedPathsForInstall({ skillIds: ids, target, home, cwd }),
+    paths: managedPathsForInstall({ skillIds: ids, target, home, cwd, policy }),
   });
 
   for (const f of todo) {
     if (f.id === 'nested-layout') rmSync(join(paths.root, 'rsc'), { recursive: true, force: true });
-    if (f.id === 'duplicate-hooks') { unwireHook(target, paths); await applyInstall({ skillIds: ids, target, home, cwd, operation: 'repair' }); }
-    if (f.id === 'dangling-links') await applyInstall({ skillIds: ids, target, home, cwd, operation: 'repair' });
+    if (f.id === 'duplicate-hooks') { unwireHook(target, paths); await applyInstall({ skillIds: ids, target, home, cwd, operation: 'repair', policy }); }
+    if (f.id === 'dangling-links') await applyInstall({ skillIds: ids, target, home, cwd, operation: 'repair', policy });
     if (f.id === 'no-manifest') recordInManifest({ cwd, target, skillIds: ids });
     if (f.id === 'wrong-target') {
       // Install where the project actually points, THEN take the old wiring down — in that
       // order, so a failure halfway leaves a working harness rather than none. Taking the
       // block out of the old file gives it back byte-identical: in #249 that file was the
       // project's hand-written constitution, and it had already been written into once.
-      await applyInstall({ skillIds: ids, target: f.to, home, cwd, operation: 'repair' });
+      await applyInstall({ skillIds: ids, target: f.to, home, cwd, operation: 'repair', policy });
       unwireHook(target, paths);
       removeManagedSkills(paths);
       recordInManifest({ cwd, target: f.to, skillIds: ids, dropTarget: target });

package/scripts/lib/review-findings.js

@@ -0,0 +1,175 @@
+// Consolidation of the refuter panel's findings — the deterministic half of `review`.
+//
+// Three fresh-context lenses attack the same diff, so they often report the SAME defect in three
+// different sentences, and the author spends triage time discovering that eleven findings are four.
+// Grouping them is an algorithm, not a judgement (P1), so it lives here and not in the skill's prose.
+// What survives grouping and is serious enough to block goes to `finding-verifier` — that half IS
+// judgement, and stays in the agent.
+//
+// Input: what the lenses emit — fenced ```json findings blocks inside their reports, or plain JSON.
+// Output: unique findings, highest severity first, each with the lenses that reported it and a
+// `verify` flag on the ones the verifier must try to refute before they may block.
+
+export const SEVERITIES = ['blocker', 'should-fix', 'nit', 'question'];
+const ALIASES = {
+  critical: 'blocker', high: 'blocker', blocking: 'blocker',
+  medium: 'should-fix', shouldfix: 'should-fix', 'should_fix': 'should-fix', major: 'should-fix',
+  low: 'nit', info: 'nit', minor: 'nit',
+};
+const rank = (s) => SEVERITIES.indexOf(s);
+export const DEFAULT_WINDOW = 3;
+
+export function normalizeSeverity(raw) {
+  const s = String(raw || '').trim().toLowerCase();
+  if (SEVERITIES.includes(s)) return s;
+  return ALIASES[s] || ALIASES[s.replace(/[-\s]/g, '')] || null;
+}
+
+const text = (v) => (typeof v === 'string' ? v.trim() : '');
+const normFile = (f) => text(f).replace(/\\/g, '/').replace(/^\.\//, '');
+const normEvidence = (e) => text(e).replace(/\s+/g, ' ').toLowerCase();
+
+// Pull every finding out of one source. A source is a lens report (markdown with fenced blocks) or a
+// JSON file. Anything unparseable is reported, never silently dropped: a lost finding is the one
+// failure a consolidation step must not add.
+export function parseFindings(raw, source = 'stdin') {
+  const findings = [];
+  const errors = [];
+  const take = (value, where) => {
+    const list = Array.isArray(value) ? value : (Array.isArray(value?.findings) ? value.findings : [value]);
+    for (const item of list) {
+      if (!item || typeof item !== 'object') { errors.push(`${where}: a finding must be an object`); continue; }
+      findings.push({ ...item, source });
+    }
+  };
+  const blocks = [...String(raw).matchAll(/```json[ \t]+findings[^\n]*\n([\s\S]*?)```/g)];
+  if (blocks.length) {
+    blocks.forEach((m, i) => {
+      try { take(JSON.parse(m[1]), `${source} block ${i + 1}`); }
+      catch (e) { errors.push(`${source} block ${i + 1}: not valid JSON (${e.message})`); }
+    });
+    return { findings, errors };
+  }
+  const trimmed = String(raw).trim();
+  if (!trimmed) return { findings, errors };
+  try { take(JSON.parse(trimmed), source); }
+  catch { errors.push(`${source}: no \`\`\`json findings block and not plain JSON`); }
+  return { findings, errors };
+}
+
+// The pre-report gate, checked instead of trusted: a blocker or should-fix with no location or no
+// concrete failure scenario is a suspicion, and a suspicion is a question. The downgrade is visible.
+export function normalizeFinding(f) {
+  const out = {
+    lens: text(f.lens) || text(f.source) || 'unknown',
+    severity: normalizeSeverity(f.severity),
+    file: normFile(f.file),
+    line: Number.isInteger(Number(f.line)) && Number(f.line) > 0 ? Number(f.line) : null,
+    claim: text(f.claim) || text(f.title) || text(f.summary),
+    failure_scenario: text(f.failure_scenario) || text(f.repro),
+    evidence: text(f.evidence),
+    notes: [],
+  };
+  if (!out.severity) {
+    out.notes.push(`severity "${f.severity ?? ''}" unknown → question`);
+    out.severity = 'question';
+  }
+  if (rank(out.severity) <= rank('should-fix')) {
+    const missing = [];
+    if (!out.file || !out.line) missing.push('file:line');
+    if (!out.failure_scenario) missing.push('failure_scenario');
+    if (missing.length) {
+      out.notes.push(`${out.severity} without ${missing.join(' and ')} → question`);
+      out.severity = 'question';
+    }
+  }
+  return out;
+}
+
+// Two findings are the same defect when they quote the same evidence, or when they point at the same
+// place (same file, lines within the window) AND say the same thing. Place alone is not enough: the
+// first real panel run put two different defects on adjacent lines (a discount applied to one unit,
+// and a missing 0..100 check), and merging them buried the second one where no verifier looked.
+// A missed merge costs one extra verification; a wrong merge hides a defect — so the bar is
+// conservative. "Say the same thing" is word overlap (Jaccard) of claim, or claim + failure scenario.
+const STOP = new Set('the and for with not that this its are was from any only one but has have into than then when which will can its'.split(' '));
+const words = (s) => new Set(String(s || '').toLowerCase().split(/[^a-z0-9]+/).filter((w) => w.length > 2 && !STOP.has(w)));
+function overlap(a, b) {
+  const A = words(a); const B = words(b);
+  let shared = 0;
+  for (const w of A) if (B.has(w)) shared += 1;
+  const union = A.size + B.size - shared;
+  return union ? shared / union : 0;
+}
+export const SAME_CLAIM = 0.2;
+export function similarity(a, b) {
+  return Math.max(overlap(a.claim, b.claim),
+    overlap(`${a.claim} ${a.failure_scenario}`, `${b.claim} ${b.failure_scenario}`));
+}
+function sameDefect(a, b, window) {
+  const ea = normEvidence(a.evidence);
+  if (ea.length >= 12 && ea === normEvidence(b.evidence)) return true;
+  const near = a.file && a.file === b.file && a.line && b.line && Math.abs(a.line - b.line) <= window;
+  return Boolean(near) && similarity(a, b) >= SAME_CLAIM;
+}
+
+export function consolidate(rawFindings, { window = DEFAULT_WINDOW } = {}) {
+  const items = rawFindings.map(normalizeFinding);
+  const parent = items.map((_, i) => i);
+  const find = (i) => (parent[i] === i ? i : (parent[i] = find(parent[i])));
+  for (let i = 0; i < items.length; i += 1) {
+    for (let j = i + 1; j < items.length; j += 1) {
+      if (sameDefect(items[i], items[j], window)) parent[find(j)] = find(i);
+    }
+  }
+  const groups = new Map();
+  items.forEach((it, i) => {
+    const root = find(i);
+    if (!groups.has(root)) groups.set(root, []);
+    groups.get(root).push(it);
+  });
+  const uniq = (xs) => [...new Set(xs.filter(Boolean))];
+  const merged = [...groups.values()].map((members) => {
+    const severity = SEVERITIES[Math.min(...members.map((m) => rank(m.severity)))];
+    const lines = members.map((m) => m.line).filter(Boolean);
+    return {
+      severity,
+      file: uniq(members.map((m) => m.file))[0] || '',
+      lines: lines.length ? [Math.min(...lines), Math.max(...lines)] : [],
+      lenses: uniq(members.map((m) => m.lens)).sort(),
+      claims: uniq(members.map((m) => m.claim)),
+      failure_scenarios: uniq(members.map((m) => m.failure_scenario)),
+      evidence: uniq(members.map((m) => m.evidence)),
+      notes: uniq(members.flatMap((m) => m.notes)),
+      reported: members.length,
+      verify: rank(severity) <= rank('should-fix'),
+    };
+  });
+  merged.sort((a, b) => rank(a.severity) - rank(b.severity)
+    || a.file.localeCompare(b.file) || (a.lines[0] || 0) - (b.lines[0] || 0));
+  merged.forEach((m, i) => { m.id = `F${i + 1}`; });
+  return {
+    reported: items.length,
+    unique: merged.length,
+    toVerify: merged.filter((m) => m.verify).length,
+    findings: merged,
+  };
+}
+
+const where = (f) => (f.file ? `${f.file}${f.lines.length ? `:${f.lines[0]}${f.lines[1] !== f.lines[0] ? `-${f.lines[1]}` : ''}` : ''}` : '(no location)');
+
+export function renderConsolidation(result, errors = []) {
+  const out = [
+    `${result.reported} finding(s) reported → ${result.unique} unique · ${result.toVerify} go to finding-verifier`,
+  ];
+  for (const f of result.findings) {
+    out.push('', `${f.id} [${f.severity}] ${where(f)} — ${f.claims[0] || '(no claim)'}`);
+    out.push(`   lenses: ${f.lenses.join(', ')}${f.reported > 1 ? ` (${f.reported} reports merged)` : ''}`);
+    for (const c of f.claims.slice(1)) out.push(`   also: ${c}`);
+    for (const s of f.failure_scenarios) out.push(`   failure: ${s}`);
+    for (const n of f.notes) out.push(`   note: ${n}`);
+    if (f.verify) out.push('   → verify: dispatch finding-verifier; it blocks only if CONFIRMED');
+  }
+  for (const e of errors) out.push('', `⚠️  ${e}`);
+  return out.join('\n');
+}

package/scripts/lib/versions.js

@@ -0,0 +1,31 @@
+import { readFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// Which rsc is running, and which rsc this project was last built with. Two different numbers, and
+// the gap between them is where a published fix fails to arrive: hooks are materialized as copies
+// under `.rsc/`, so a release changes nothing in a project until someone syncs it. Nobody could see
+// that gap before — there was no `--version`, and bug reports arrived without one.
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
+export const CLI_VERSION = JSON.parse(readFileSync(join(ROOT, 'package.json'), 'utf8')).version;
+
+/** `.rsc/.version` is written at install and at every sync — the version this project's hooks came from. */
+export function installedVersion(root) {
+  try { return readFileSync(join(root, '.rsc', '.version'), 'utf8').trim() || null; } catch { return null; }
+}
+
+export function isNewer(a, b) {
+  const pa = String(a).split('.').map(Number);
+  const pb = String(b).split('.').map(Number);
+  for (let i = 0; i < 3; i++) {
+    if ((pa[i] || 0) > (pb[i] || 0)) return true;
+    if ((pa[i] || 0) < (pb[i] || 0)) return false;
+  }
+  return false;
+}
+
+export function versionReport(root) {
+  const installed = installedVersion(root);
+  return { cli: CLI_VERSION, installed, behind: Boolean(installed && isNewer(CLI_VERSION, installed)) };
+}

package/scripts/rsc.js

@@ -4,18 +4,19 @@ import { detectTarget, installedTargets, resolveTargets, TARGETS } from '../targ
 import { detectRepo } from './detect-repo.js';
 import { rank } from './consult.js';
 import { expandRecommends, toOutcomes, hasOutcome } from './lib/recommend.js';
-import { applyInstall, listInstalled, listInstalledAgents, listInstalledCommands, uninstall, syncInstalled, purge, collisions } from './install-apply.js';
+import { applyInstall, listInstalled, listInstalledAgents, listInstalledCommands, uninstall, syncInstalled, purge, collisions, ownSkillPaths } from './install-apply.js';
 import { stackAgentNames } from '../targets/agents.js';
 import { doctor } from './doctor.js';
 import { ask, say, select, pickFrom, banner, confirm, isInteractive } from './lib/ui.js';
 import { refreshRegistry, registryStatus } from './lib/registry.js';
 import { audit, writeAuditReport } from './audit.js';
 import { DOMAINS } from './lib/domains.js';
-import { listBackups, restoreBackup } from './lib/backups.js';
+import { listBackups, restoreBackup, whereKept } from './lib/backups.js';
 import { runUpgrade } from './lib/upgrade.js';
 import { diagnose, repair } from './lib/repair.js';
 import { DEFAULT_SKILL_FLOOR, withDefaultSkillFloor } from './lib/default-skill-floor.js';
 import { readManifest, writeManifest } from './lib/manifest-file.js';
+import { versionReport } from './lib/versions.js';
 import {
   normalizeOnboarding, missingOnboardingFields, scanProject,
   buildOnboardingPlan, decodeGoal, encodeGoal, identifyPlan, recommendDeferredComponents,
@@ -23,10 +24,24 @@ import {
 import { applyAcceptedOnboarding, verifyOnboarding, ensureHarnessSkeleton, harnessReadiness } from './lib/onboarding-apply.js';
 
 const rawArgv = process.argv.slice(2);
+
+// `rsc --version` — answered before anything else runs, offline, and in a shape a bug report can
+// paste. Two numbers because there are two things: the CLI you just ran, and the harness this
+// project was built with. When they differ the project is running old hooks, and a fix that was
+// published may simply not be here yet.
+if (['--version', '-v', 'version'].includes(rawArgv[0])) {
+  const v = versionReport(process.cwd());
+  const lines = [`rsc ${v.cli}`];
+  if (v.installed) lines.push(`installed in this project: ${v.installed}${v.behind ? ' (behind)' : ''}`);
+  else lines.push('installed in this project: none');
+  if (v.behind) lines.push('This project runs older hooks than this CLI. To catch up, run here:', '  npx @damiangilgonzalez/harness@latest');
+  process.stdout.write(`${lines.join('\n')}\n`);
+  process.exit(0);
+}
 const GLOBAL_VALUE_FLAGS = new Set([
   '--target', '--technical-level', '--accompaniment', '--project-kind', '--goal', '--goal-base64', '--software-scope', '--accept-plan',
 ]);
-const COMMANDS = new Set(['onboard', 'reassess', 'add', 'install', 'consult', 'catalog', 'audit', 'list', 'doctor', 'memory', 'sync', 'backups', 'restore', 'upgrade', 'registry', 'worktrees', 'capabilities', 'sello', 'repair', 'uninstall', 'purge']);
+const COMMANDS = new Set(['onboard', 'reassess', 'add', 'install', 'consult', 'catalog', 'audit', 'list', 'doctor', 'memory', 'sync', 'backups', 'restore', 'upgrade', 'registry', 'worktrees', 'capabilities', 'review', 'sello', 'repair', 'uninstall', 'purge']);
 function positionalTokens(input) {
   const out = [];
   for (let i = 0; i < input.length; i++) {
@@ -127,6 +142,12 @@ function renderPlan(plan, planId) {
   for (const decision of plan.decisions.filter((d) => d.state === 'excluded')) say(`  × ${decision.kind}/${decision.id} — ${decision.reason}`);
   say('Managed paths:');
   for (const path of plan.governedPaths) say(`  ${path}`);
+  if (plan.replacesUserSkills?.length) {
+    say('Your own skills this plan replaces:');
+    for (const path of plan.replacesUserSkills) say(`  ! ${path} — already here and not put by rsc; the catalog skill of the same name takes its place, and yours is kept in .rsc/backups/`);
+    say('  To keep yours, rename its folder (for example review → review-own) and generate the plan again.');
+    say('  AGENT: name each of these to the user before accepting, and ask whether to replace or rename.');
+  }
   if (plan.evidence.parentHarness) say(`Parent harness detected at ${plan.evidence.parentHarness}; it is not inherited by this plan.`);
   const pieces = [
     'npx @damiangilgonzalez/harness@latest onboard',
@@ -186,6 +207,11 @@ async function runOnboarding(targets) {
     return;
   }
   const plan = buildOnboardingPlan(record, scanProject(process.cwd()));
+  // #275 — a folder where a catalog skill goes that rsc did not put is the user's own work. It goes
+  // INTO the plan, so the id they accept names it: an id made before that folder existed no longer
+  // applies, and accepting is never consent to something the plan did not show.
+  const replacesUserSkills = ownSkillPaths({ cwd: process.cwd(), targets: plan.policy.targets, skillIds: plan.policy.skills });
+  if (replacesUserSkills.length) plan.replacesUserSkills = replacesUserSkills;
   const planId = identifyPlan(plan);
   const accepted = flag('accept-plan');
   if (!accepted) {
@@ -214,6 +240,10 @@ async function runOnboarding(targets) {
   } catch (error) {
     say(`RSC_SKELETON_FAILED ${error.message}`);
   }
+  for (const path of plan.replacesUserSkills || []) {
+    const kept = whereKept({ cwd: process.cwd(), relPath: path });
+    if (kept) say(`Your previous ${path} is kept in ${kept}`);
+  }
   emitHarnessReadiness(plan, planId);
 }
 
@@ -486,7 +516,18 @@ function printContextBudget(b) {
   say('════════════════════════════════════════════════\n');
 }
 
-async function wizard(flagTargets) {
+async function syncDeclared(targets, dry = false) {
+  for (const t of targets) {
+    const result = await syncInstalled({ target: t, dryRun: dry });
+    const verb = dry ? 'Would sync' : 'Synced';
+    say(`${verb} ${t}: ${result.synced.length ? result.synced.join(', ') : '(nothing to sync)'}`);
+    if (dry && result.paths?.length) {
+      for (const p of result.paths) say(`  ${p}`);
+    }
+  }
+}
+
+async function wizard(flagTargets, declaredTargets = []) {
   const m = loadManifest();
   await banner(m.counts.skills);
   say('  the skill catalog for your assistant (Claude Code · Codex · Cursor · Gemini · Antigravity)\n');
@@ -496,12 +537,16 @@ async function wizard(flagTargets) {
   const baseIds = skillsForProfile(m, 'minimal');
   // Navigable loop: esc / "← Back" / "no" all return here instead of quitting.
   for (;;) {
+    const declared = readManifest();
     const choice = await select('What do you want to do?', [
+      // First, because it is what someone who already has a harness came here for nine times in ten.
+      ...(declared ? [{ key: 'update', label: `Update this project — keeps its ${declared.skills.length} skills, refreshes hooks and content` }] : []),
       { key: 'base', label: `Base install — the essentials (${baseIds.length} skills)` },
       { key: 'workflow', label: 'Base + tu flujo de trabajo — grill-with-docs → to-spec → plan o tickets' },
       { key: 'manual', label: 'Pick skills by hand, by area' },
     ]);
     if (choice === null) { say('\nOK — nothing installed. Anytime: npx @damiangilgonzalez/harness'); return; }
+    if (choice === 'update') return syncDeclared(declaredTargets);
 
     let ids;
     if (choice === 'base') ids = baseIds;
@@ -560,6 +605,27 @@ async function guardCollisions(targets, ids) {
   return confirm('Replace them anyway?');
 }
 
+// The governed list that `sync` reads lives INSIDE the onboarding receipt, not in `manifest.skills`.
+// Updating one without the other is what deleted users' skills: `add` installed a skill and recorded
+// it in `manifest.skills`, `sync` then read a governed list that predated the install, and pruned
+// everything absent from it — recursively. Reported by a user, reproduced 2026-09-17: nine declared
+// skills against eight governed, visible in the manifest before sync was even run.
+//
+// So the two travel together, always. Any command that changes what is installed carries both, and
+// `applyInstall` persists the receipt rather than conserving the stale one.
+function governedBy(receipt, skills) {
+  // The receipt is hash-checked against the plan the user accepted, so its policy is NOT a place to
+  // record what happened afterwards: rewriting `plan.policy.skills` made every install report "the
+  // receipt does not match its accepted plan id", which is the integrity check doing its job.
+  //
+  // An earlier fix for the reported data loss did exactly that, and it was wrong — the right place
+  // was never `add`, it was `sync`, which treated the accepted plan as the only declaration and
+  // pruned everything absent from it. The policy still travels for hooks and agents; what must not
+  // travel is a rewritten receipt.
+  if (!receipt) return { policy: undefined, onboarding: undefined };
+  return { policy: { ...receipt.plan.policy, skills }, onboarding: undefined };
+}
+
 async function main() {
   // One resolution for every command, doctor included: `doctor` used to resolve on its
   // own and could report a different assistant than the one just installed into.
@@ -589,7 +655,16 @@ async function main() {
   const target = targets[0];
   switch (cmd) {
     case undefined:
-      return hasDeclaredHarness() ? wizard(f ? targets : null) : runOnboarding(f ? targets : []);
+      if (!hasDeclaredHarness()) return runOnboarding(f ? targets : []);
+      // A project that already has a harness: the bare command means "bring it up to date". It is
+      // what every update notice, the README and our own replies to users tell people to run, with
+      // the promise "that reinstalls and refreshes". It used to open the install wizard instead, and
+      // with no terminal — which is how an agent runs it when it obeys the notice — it did nothing.
+      // Restoring what the project already declared is not a decision, so there is nothing to ask.
+      // RSC_FORCE_WIZARD opens the wizard anyway, answering from piped stdin: that is how its
+      // choices are tested end to end, since a test has no terminal to offer.
+      if (!isInteractive() && !process.env.RSC_FORCE_WIZARD) return syncDeclared(targets);
+      return wizard(f ? targets : null, targets);
     case 'onboard':
       return runOnboarding(f ? targets : []);
     case 'reassess':
@@ -604,8 +679,8 @@ async function main() {
       const currentManifest = readManifest();
       const receipt = currentManifest?.onboarding;
       const maintainedIds = receipt ? [...new Set([...(currentManifest.skills || []), ...(receipt.plan.policy.skills || []), ...ids])].sort() : ids;
-      const policy = receipt ? { ...receipt.plan.policy, skills: maintainedIds } : undefined;
-      for (const t of targets) await applyInstall({ skillIds: maintainedIds, agentIds: selected.agents, target: t, policy });
+      const { policy, onboarding } = governedBy(receipt, maintainedIds);
+      for (const t of targets) await applyInstall({ skillIds: maintainedIds, agentIds: selected.agents, target: t, policy, onboarding });
       markMaintenanceDrift(`add ${requested.join(',')}`);
       say(`✅ Installed for ${targets.join(', ')}: ${requested.join(', ')}`);
       return void say('   ↻ Reload/restart your assistant so the new skill activates.');
@@ -675,6 +750,8 @@ async function main() {
     }
     case 'doctor': {
       const report = doctor({ target });
+      // #277 — an automation on top of rsc reads the exit code, not the prose.
+      if (!report.healthy) process.exitCode = 1;
       if (argv.includes('--json')) return void say(JSON.stringify(report, null, 2));
       printContextBudget(report.contextBudget);
       return void say(JSON.stringify({ ...report, contextBudget: undefined }, null, 2));
@@ -727,18 +804,8 @@ async function main() {
       process.exitCode = 1;
       return;
     }
-    case 'sync': {
-      const dry = argv.includes('--dry-run');
-      for (const t of targets) {
-        const result = await syncInstalled({ target: t, dryRun: dry });
-        const verb = dry ? 'Would sync' : 'Synced';
-        say(`${verb} ${t}: ${result.synced.length ? result.synced.join(', ') : '(nothing to sync)'}`);
-        if (dry && result.paths?.length) {
-          for (const p of result.paths) say(`  ${p}`);
-        }
-      }
-      return;
-    }
+    case 'sync':
+      return syncDeclared(targets, argv.includes('--dry-run'));
     case 'backups': {
       const backups = listBackups();
       if (!backups.length) return void say('(no backups)');
@@ -778,6 +845,37 @@ async function main() {
       say('Use: npx @damiangilgonzalez/harness registry refresh | registry status');
       return;
     }
+    case 'review': {
+      // `review consolidate` — the deterministic half of the refuter panel (P1): the three lenses
+      // often report one defect three ways, so grouping happens here, by location and evidence, and
+      // only the unique serious findings go on to `finding-verifier`, which is judgement.
+      const USE = 'Use: npx @damiangilgonzalez/harness review consolidate [report.md|findings.json ...] [--json] [--window <lines>]\n  Without files it reads stdin. Each lens report carries its findings in ```json findings blocks.';
+      if (argv[1] !== 'consolidate') { say(USE); if (argv[1]) process.exitCode = 1; return; }
+      const { readFileSync } = await import('node:fs');
+      const R = await import('./lib/review-findings.js');
+      const w = flag('window');
+      const window = w === undefined ? R.DEFAULT_WINDOW : Number(w);
+      if (!Number.isInteger(window) || window < 0) { say(`rsc: --window takes a whole number of lines, got '${w}'.\n${USE}`); process.exitCode = 1; return; }
+      const rest = argv.slice(2);
+      const files = rest.filter((a, i) => !a.startsWith('--') && rest[i - 1] !== '--window');
+      const sources = [];
+      try {
+        if (files.length) for (const f of files) sources.push([readFileSync(f, 'utf8'), f]);
+        else if (!process.stdin.isTTY) sources.push([readFileSync(0, 'utf8'), 'stdin']);
+      } catch (e) { say(`rsc: cannot read ${e.path || 'stdin'} (${e.code || e.message}).`); process.exitCode = 1; return; }
+      if (!sources.length) { say(USE); process.exitCode = 1; return; }
+      const all = []; const errors = [];
+      for (const [raw, src] of sources) {
+        const parsed = R.parseFindings(raw, src);
+        all.push(...parsed.findings); errors.push(...parsed.errors);
+      }
+      const result = R.consolidate(all, { window });
+      if (argv.includes('--json')) say(JSON.stringify({ ...result, errors }, null, 2));
+      else say(R.renderConsolidation(result, errors));
+      // An unreadable block is a finding that may have been lost: say it with the exit code too.
+      if (errors.length) process.exitCode = 1;
+      return;
+    }
     case 'worktrees': {
       // The deterministic half of "the cleanup is the default". `ship` and the `worktrees` skill call
       // this instead of judging by eye, which is what turns a rule that was only ever written down

package/skills/animar/SKILL.md

@@ -3,6 +3,7 @@ name: animar
 description: "Use when asked to animate something, add motion, make a component feel alive, or build a transition. Builds the animation from scratch, making the decisions in the order that determines whether it feels right — whether it should animate at all, for what purpose, with which tool, which properties, which curve and duration, how it is interrupted, and how it exits. Writes the implementation. For critiquing existing motion use revisar-animaciones."
 tags: ["animation", "motion", "transitions"]
 profiles: [ui, full]
+origin: damiangil
 ---
 
 # Construir animaciones

package/skills/claude-project-setup/SKILL.md

@@ -3,6 +3,7 @@ name: claude-project-setup
 description: "Use when starting a new project, initializing a repository for Claude Code, or when the user asks to configure CLAUDE.md, rules, commands, skills, or agents for a project."
 tags: ["setup", "claude-code", "project-init"]
 profiles: [core, ui, full]
+origin: damiangil
 ---
 
 # Claude Project Setup

package/skills/code-review/SKILL.md

@@ -3,6 +3,7 @@ name: code-review
 description: "Reviews changes from a fixed point (commit, branch, tag, or merge-base) along two axes — Standards (does the code follow the repo's documented coding standards?) and Spec (does the code match what the source issue/PRD asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use when the user wants to review a branch, a PR, work in progress, or asks to \\"review from X\\"."
 tags: ["code-review", "standards", "spec-compliance"]
 profiles: [core, ui, full]
+origin: damiangil
 ---
 
 Revisión en dos ejes del diff entre `HEAD` y un punto fijo que proporciona el usuario:
@@ -75,7 +76,23 @@ Envía un único mensaje con dos llamadas a la herramienta `Agent`. Usa el subag
 
 Si falta el spec, sáltate el sub-agente de Spec y anótalo en el reporte final.
 
-### 5. Agregar
+### 5. Verificar los graves antes de presentarlos
+
+Un sub-agente que busca problemas puede exagerar uno. Antes de agregar, **dentro de cada eje
+por separado** (nunca mezclando Estándares con Spec):
+
+1. **Agrupar.** Pide a cada sub-agente que termine con un bloque ` ```json findings ` (`lens`, `severity`
+   blocker|should-fix|nit|question, `file`, `line`, `claim`, `failure_scenario`, `evidence`). Guarda
+   cada reporte y ejecuta `npx @damiangilgonzalez/harness review consolidate <reporte>`. Junta los
+   duplicados y baja a pregunta un blocker o should-fix sin `file:line` o sin escenario de fallo.
+2. **Verificar.** Cada hallazgo que marque `verify` va al agente **`finding-verifier`** (si el
+   proyecto no lo tiene, a un `general-purpose` con esa misma postura): contexto limpio, parte de que
+   el hallazgo es falso y devuelve **CONFIRMED** (con la prueba), **REFUTED** (cita lo que lo hace
+   imposible) o **UNPROVEN** (pasa a pregunta). Solo CONFIRMED se presenta como grave.
+
+Di la cuenta con honestidad ("7 reportados → 5 únicos → 2 confirmados") y lista lo refutado y por qué.
+
+### 6. Agregar
 
 Presenta los dos reportes bajo los encabezados `## Estándares` y `## Spec`, verbatim o ligeramente limpiados. **No** fusiones ni reordenes los hallazgos — los dos ejes son deliberadamente separados (ver _Por qué dos ejes_).
 

package/skills/diseno-apple/SKILL.md

@@ -3,6 +3,7 @@ name: diseno-apple
 description: "Apple's approach to interface design and fluid, physical motion, translated to the web. Use when building or reviewing gesture-driven UI, spring animations, drag/swipe/sheet interactions, inertia and interruptible transitions, translucent materials and depth, typography (optical size, tracking, line height), reduced motion, or the design fundamentals (feedback, spatial consistency, containment) behind Apple-style interfaces."
 tags: ["design", "apple", "motion", "interface"]
 profiles: [ui, full]
+origin: damiangil
 ---
 
 # Diseno Apple

package/skills/diseno-landing/SKILL.md

@@ -3,6 +3,7 @@ name: diseno-landing
 description: "Complete system for building high-conversion landing pages: intake questions, page structure, layout choice, conversion copy, SEO, plus strict visual rules for typography, spacing, radii, backgrounds, hero, icons, and motion. Use whenever building, editing, styling, reviewing, or writing copy for ANY landing page, marketing site, web UI, page section, component, or prototype, even if the user does not mention design, conversion, tokens, or a design system. Always consult it before choosing sections, headlines, CTAs, fonts, text sizes, spacing values, radii, background colors, icons, or transitions."
 tags: ["landing-page", "conversion", "design-system", "copywriting"]
 profiles: [ui, full]
+origin: damiangil
 ---
 
 # Diseno de landing page

package/skills/domain-modeling/SKILL.md

@@ -3,6 +3,7 @@ name: domain-modeling
 description: "Build and refine the project's domain model. Use when the user wants to pin down domain terminology or a ubiquitous language, record an architectural decision, or when another skill needs to keep the domain model up to date."
 tags: ["domain-modeling", "glossary", "architecture"]
 profiles: [core, ui, full]
+origin: damiangil
 ---
 
 # Modelado de Dominio

package/skills/flujo-interfaz/SKILL.md

@@ -4,6 +4,7 @@ description: "Use when work touches a screen — building or reshaping a landing
 tags: ["ui-design", "routing", "workflow"]
 profiles: [ui, full]
 recommends: [ingeniero-diseno-web, diseno-landing, revision-interfaz]
+origin: damiangil
 ---
 
 # Flujo de interfaz — quien manda en cada paso