@dombaras/agent-harness 0.1.10 → 0.1.11

package/README.md

@@ -108,6 +108,11 @@ warns but does not block; the guarantee only applies to registered flows.
   `deepseek/deepseek-v4-pro` (default, direct API key), `zen`/`opencode` →
   `opencode/deepseek-v4-pro` (gateway), `pickle` → `opencode/big-pickle`, or any
   explicit `provider/model`. Restart opencode after switching (config reads once).
+- **`/board` command** — every deploy ships an opencode command
+  (`.opencode/command/board.md`) that refreshes the canonical `BACKLOG.md` board:
+  `git pull --ff-only` (safe, never forces), then renders Open (by priority),
+  Frozen, the last few shipped rows, and the newest `.agents/memory/handoff.md`
+  delta. Read-only — it never edits the board.
 
 ## QA gates
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dombaras/agent-harness",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "description": "Reusable multi-agent harness for AI-assisted development: personas, skills, operating rules, model routing, and QA gates. Deploy into any project with `npx @dombaras/agent-harness init`.",
   "bin": {
     "agent-harness": "bin/agent-harness.js"

package/templates/.agents/AGENTS.md

@@ -103,9 +103,11 @@ The canonical rulebook. The always-loaded summary is `.agents/rules/00-operating
 
 ## 7. Definition of Done & Continuous Backup
 
-Every completed task passes this gate, in order:
+Every completed task closes with this gate. **QA gates dev work only:** steps 0-2
+run when the session touched code paths — a backlog-only (or docs-only) change skips
+them. Steps 3-5 are the unconditional session close; they are NOT gated by QA.
 
-0. **Feature Completeness Gate**:
+0. **Feature Completeness Gate** (code changes only):
    - [ ] 5 UI states handled on every affected screen (list them).
    - [ ] No `catch` blocks that only `console.warn` without user-facing feedback.
    - [ ] Haptic/feedback consistency for every user-initiated action.
@@ -113,10 +115,11 @@ Every completed task passes this gate, in order:
    - [ ] Cross-screen audit if a new UX pattern was introduced.
    - [ ] No modified file over ~500 lines without extracting components.
    - [ ] No blanket file-level `eslint-disable`/`@ts-nocheck`/`@ts-ignore` suppressions (line-level only, each with a reason).
-1. **QA tier** — `qa-architect` inspects the diff, picks the tier BY COVERAGE (not path-label), records the coverage map in `.agents/memory/qa-plan.md`, and authors progression tests for any GAP; if `qa-architect` is not dispatched the orchestrator plans in its place. `qa-runner` executes and makes it pass (§6). A change is not verified until `npm run test:qa-plan` passes: every changed code path covered or waivered, **and** every touched flow (`.agents/memory/flow-map.md`) has every sibling surface and declared variant addressed in the plan's `## Parallel-surface & variant audit`, **AND** the executed tier exercised the modified path.
-2. **Security check** — apply `security-engineer` when the change touches data/auth/input/secrets/deps.
-3. **Commit** — concise `feat:` / `fix:` / `refactor:` message.
-4. **Push** — `git push origin main`.
+1. **QA tier** (code changes only) — `qa-architect` inspects the diff, picks the tier BY COVERAGE (not path-label), records the coverage map in `.agents/memory/qa-plan.md`, and authors progression tests for any GAP; if `qa-architect` is not dispatched the orchestrator plans in its place. `qa-runner` executes and makes it pass (§6). A change is not verified until `npm run test:qa-plan` passes: every changed code path covered or waivered, **and** every touched flow (`.agents/memory/flow-map.md`) has every sibling surface and declared variant addressed in the plan's `## Parallel-surface & variant audit`, **AND** the executed tier exercised the modified path.
+2. **Security check** (code changes only) — apply `security-engineer` when the change touches data/auth/input/secrets/deps.
+3. **Backlog write-back** (always) — move every task this session shipped from `Open` to `Archive (shipped · done)` in `BACKLOG.md` (with date/commit), then stage it explicitly: `git add BACKLOG.md` (it starts untracked — `git commit -am` / `git commit` without `add` will NOT pick it up). The board syncs across sessions only through git, so this delta is committed with the code, never left uncommitted.
+4. **Commit** (always) — concise `feat:` / `fix:` / `refactor:` message, including the `BACKLOG.md` delta.
+5. **Push** (always) — `git push origin main`.
 - **Mechanical floor**: a pre-push hook should run `npm run test:quick` (project-provided; the harness does not install git hooks).
 - **Lean permissions**: grant only the narrowest `git`/`gh` action needed; escalate only after a command has actually failed.
 - Git may not be on PATH in the default shell — use the full path (`.agents/memory/locations.md`).

package/templates/.agents/rules/00-operating.md

@@ -23,12 +23,12 @@ Before reading or editing any file for a task, dispatch the relevant personas vi
 4. **Verify stack versions** before writing framework code (`.agents/memory/stack-versions.md`).
 5. **Token discipline** — search before read, targeted reads, batch reads, don't re-read unchanged files, right-size QA.
 6. **Static ≠ runtime** — never declare verified from `tsc` alone; execute a real runtime/API path that exercises the MODIFIED code — a tier label never proves coverage. `test:qa-plan` gates every changed code path to a covering assertion or waiver, and every touched flow's sibling surfaces / variants to an audit entry (`.agents/memory/flow-map.md` — "fix one, fix all").
-7. **Commit** with `feat:`/`fix:`/`refactor:` then push to main.
+7. **Commit** with `feat:`/`fix:`/`refactor:` then push to main — including any `BACKLOG.md` delta.
 
 ## Definition of Done
 
-Right-sized QA tier → security lens (if the change touches data/auth/input/secrets) → commit → push.
+QA tier + security lens gate **code changes only** (a backlog-only change skips them). Every session closes with **move shipped `BACKLOG.md` rows to `Archive` → commit → push** — the backlog write-back is never QA-gated.
 
 ## Session checklist
 
-Start: read `.agents/memory/locations.md` + `.agents/memory/model-routing.md` + `BACKLOG.md`. End: record the dispatch log and update the handoff memory.
+Start: read `.agents/memory/locations.md` + `.agents/memory/model-routing.md` + `BACKLOG.md`. End: move shipped `BACKLOG.md` rows to `Archive`, record the dispatch log, and update the handoff memory.

package/templates/.agents/skills/handoff/SKILL.md

@@ -48,3 +48,4 @@ Date: <YYYY-MM-DD>
 - Update this at session end even if the user doesn't ask, per the DoD in `.agents/AGENTS.md` §8.
 - Keep it under ~40 lines. Code is the source of truth; the handoff is a pointer, not a spec.
 - Keeping `.agents/memory/locations.md` current is part of this skill. Read it first, update it last.
+- **You only touch handoff memory.** The board write-back — moving shipped `BACKLOG.md` rows to `Archive (shipped · done)` and committing them — is the orchestrator's DoD §7 step, not yours. If it hasn't been done, call it out in your output; never edit `BACKLOG.md` or run git yourself.

package/templates/.opencode/command/board.md

@@ -0,0 +1,23 @@
+---
+description: Refresh the task board — pull the latest, then show BACKLOG.md open/frozen/shipped plus the newest handoff delta.
+---
+
+Refresh the canonical task board. Run these steps read-only, then report terse.
+
+1. Sync the workspace (never rewrite history, never force):
+   - `git fetch --all --prune`
+   - `git pull --ff-only`
+   - If the pull fails (uncommitted local changes / conflict), do NOT force — report the failure and show the board from the current on-disk state, flagged "possibly stale".
+
+2. Read `BACKLOG.md` (repo root) and `.agents/memory/handoff.md`.
+
+3. Render a compact board:
+   - `Active / next` picks (if any).
+   - `Open` grouped by priority P1 → P4, each row as `ID — task (evidence)`.
+   - `Frozen` rows with their reopen condition (one line each).
+   - `Archive` — only the last ~5 shipped rows (date/commit).
+   - Latest handoff delta (planned → shipped → deferred) from `.agents/memory/handoff.md`, plus any new `git log` commits from other sessions since the last refresh.
+
+Rules:
+- Read-only: never edit `BACKLOG.md`, `.agents/memory/*`, or any code here.
+- This is a status snapshot, not a report. If a field is unknown write `?` — never invent.

package/templates/scripts/qa/check-backlog.js

@@ -16,9 +16,12 @@
  *   5. No duplicate IDs across the whole file.
  *   6. `INDEX.md` / `todo.md`, if present, are pointers (content referencing
  *      BACKLOG.md), not live row lists.
+ *   7. `BACKLOG.md` is git-tracked (committed), not untracked — the board syncs
+ *      across sessions only through git. Skipped outside a git repo.
  */
 const fs = require("fs");
 const path = require("path");
+const { execFileSync } = require("child_process");
 
 const root = path.resolve(__dirname, "..", "..");
 
@@ -41,6 +44,40 @@ if (!fs.existsSync(canonical)) {
 }
 check(true, "canonical BACKLOG.md present at repo root");
 
+// ---- 7. BACKLOG.md must be git-tracked (committed), not untracked ----------
+// The board syncs across sessions only through git; an untracked BACKLOG.md
+// never reaches the shared board. Skipped outside a git repo.
+function insideGitRepo() {
+  try {
+    const r = execFileSync("git", ["rev-parse", "--is-inside-work-tree"], {
+      cwd: root,
+      stdio: "pipe",
+    });
+    return (r.toString() || "").trim() === "true";
+  } catch (_) {
+    return false;
+  }
+}
+function gitTracked(rel) {
+  try {
+    const r = execFileSync("git", ["ls-files", "--error-unmatch", rel], {
+      cwd: root,
+      stdio: "pipe",
+    });
+    return (r.toString() || "").trim().length > 0;
+  } catch (_) {
+    return false;
+  }
+}
+if (insideGitRepo()) {
+  check(
+    gitTracked("BACKLOG.md"),
+    "BACKLOG.md is git-tracked (run `git add BACKLOG.md` then commit — an untracked board never syncs)"
+  );
+} else {
+  check(true, "not a git repo \u2014 skipping BACKLOG.md tracking check");
+}
+
 const src = fs.readFileSync(canonical, "utf8");
 const lines = src.split(/\r?\n/);