@donghyeonlee/jjamppong-harness 0.1.0

package/harness/permission/permission-decision.js

@@ -0,0 +1,377 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const CAPABILITY_EFFECT_ALIASES = {
+  'file.write.module': ['file.write.module', 'code', 'tests', 'fixtures'],
+  'file.write.folder_skeleton': ['file.write.folder_skeleton', 'folder_skeleton'],
+  'file.write.outside_modules': ['file.write.outside_modules', 'outside_modules_write'],
+  'file.write.harness_core': ['file.write.harness_core', 'harness_core_change'],
+  'network.live_target': ['network.live_target', 'live_access'],
+  'network.web_research': ['network.web_research'],
+  'package.install': ['package.install', 'package_install'],
+  'git.commit': ['git.commit', 'git_commit'],
+  'git.push': ['git.push', 'git_push'],
+  'installer.install': ['installer.install'],
+  'parallel.write': ['parallel.write'],
+};
+
+const SECRET_PATTERNS = [
+  /(^|[\\/])\.env(\.|$|[\\/])/i,
+  /(^|[\\/])credentials\.json$/i,
+  /(^|[\\/])service-account\.json$/i,
+  /(^|[\\/])cookies\.txt$/i,
+  /(^|[\\/])token\.txt$/i,
+  /private[-_ ]?key/i,
+];
+
+const EXECUTABLE_SKELETON_EXTENSIONS = new Set([
+  '.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs',
+  '.py', '.rb', '.go', '.rs', '.java', '.cs',
+  '.ps1', '.sh', '.bat', '.cmd',
+  '.json', '.toml', '.yaml', '.yml',
+]);
+
+function parseArgs(argv) {
+  const args = {};
+  for (let i = 0; i < argv.length; i += 1) {
+    const token = argv[i];
+    if (!token.startsWith('--')) continue;
+    const key = token.slice(2);
+    const next = argv[i + 1];
+    if (!next || next.startsWith('--')) {
+      args[key] = true;
+    } else {
+      args[key] = next;
+      i += 1;
+    }
+  }
+  return args;
+}
+
+function normalizeWindowsDriveShorthand(rawPath) {
+  if (/^[A-Za-z]:[^\\/]/.test(rawPath)) {
+    return `${rawPath.slice(0, 2)}${path.sep}${rawPath.slice(2)}`;
+  }
+  return rawPath;
+}
+
+function normalizeForCompare(value) {
+  return value.replace(/[\\/]+/g, path.sep).toLowerCase();
+}
+
+function readTextIfExists(filePath) {
+  if (!filePath || !fs.existsSync(filePath)) return '';
+  return fs.readFileSync(filePath, 'utf8');
+}
+
+function parseTaskYaml(text) {
+  const task = {};
+  for (const line of text.split(/\r?\n/)) {
+    const match = line.match(/^\s*([A-Za-z0-9_.-]+):\s*(.+?)\s*$/);
+    if (!match) continue;
+    task[match[1]] = match[2].replace(/^["']|["']$/g, '');
+  }
+  return task;
+}
+
+function readJsonl(filePath) {
+  if (!filePath || !fs.existsSync(filePath)) return [];
+  const text = fs.readFileSync(filePath, 'utf8');
+  return text
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean)
+    .map((line, index) => {
+      try {
+        return JSON.parse(line);
+      } catch (error) {
+        const err = new Error(`Invalid JSONL at ${filePath}:${index + 1}: ${error.message}`);
+        err.code = 'INVALID_JSONL';
+        throw err;
+      }
+    });
+}
+
+function classifyPath(rawPath, repoRoot) {
+  if (!rawPath) return null;
+
+  const normalizedInput = normalizeWindowsDriveShorthand(rawPath);
+  const absolutePath = path.resolve(repoRoot, normalizedInput);
+  const projectRoot = path.resolve(repoRoot);
+  const compareAbsolute = normalizeForCompare(absolutePath);
+  const compareRoot = normalizeForCompare(projectRoot);
+  const isWithinProjectRoot = compareAbsolute === compareRoot || compareAbsolute.startsWith(`${compareRoot}${path.sep}`);
+  const relative = path.relative(projectRoot, absolutePath);
+  const normalizedRelative = normalizeForCompare(relative);
+  const isWithinModules = isWithinProjectRoot && (normalizedRelative === 'modules' || normalizedRelative.startsWith(`modules${path.sep}`));
+
+  let realpath = absolutePath;
+  let escapeDetected = false;
+  let hasSymlinkOrJunction = false;
+  try {
+    realpath = fs.existsSync(absolutePath) ? fs.realpathSync.native(absolutePath) : absolutePath;
+    const compareRealpath = normalizeForCompare(realpath);
+    escapeDetected = !(compareRealpath === compareRoot || compareRealpath.startsWith(`${compareRoot}${path.sep}`));
+  } catch {
+    realpath = absolutePath;
+  }
+
+  const parts = absolutePath.split(/[\\/]+/);
+  let probe = path.parse(absolutePath).root;
+  for (const part of parts.slice(probe ? 1 : 0)) {
+    if (!part) continue;
+    probe = path.join(probe, part);
+    try {
+      if (fs.existsSync(probe) && fs.lstatSync(probe).isSymbolicLink()) {
+        hasSymlinkOrJunction = true;
+      }
+    } catch {
+      // Missing path segments are normal for planned writes.
+    }
+  }
+
+  const windowsAds = /^[A-Za-z]:/.test(rawPath)
+    ? /(^|[\\/])[^\\/]+:[^\\/]+$/.test(rawPath.slice(2))
+    : /(^|[\\/])[^\\/]+:[^\\/]+$/.test(rawPath);
+
+  return {
+    raw_path: rawPath,
+    normalized_path: normalizedInput,
+    absolute_path: absolutePath,
+    realpath,
+    project_root: projectRoot,
+    relative_path: relative,
+    is_within_project_root: isWithinProjectRoot,
+    is_within_modules: isWithinModules,
+    has_symlink_or_junction: hasSymlinkOrJunction,
+    escape_detected: escapeDetected,
+    has_alternate_data_stream: windowsAds,
+  };
+}
+
+function isSecretPath(rawPath) {
+  if (!rawPath) return false;
+  return SECRET_PATTERNS.some((pattern) => pattern.test(rawPath));
+}
+
+function eventPayload(event) {
+  return event && typeof event.payload === 'object' && event.payload !== null ? event.payload : {};
+}
+
+function gateStatus(events, gateId) {
+  for (let i = events.length - 1; i >= 0; i -= 1) {
+    const event = events[i];
+    const payload = eventPayload(event);
+    if (event.event_type === 'gate_status_change' && payload.gate_id === gateId) {
+      return payload.status || null;
+    }
+    if (event.event_type === 'approval_decision' && payload.gate_id === gateId) {
+      return payload.status || null;
+    }
+  }
+  return null;
+}
+
+function capabilityAliases(capability) {
+  return CAPABILITY_EFFECT_ALIASES[capability] || [capability];
+}
+
+function hasCapabilityInApproval(approval, capability) {
+  const payload = eventPayload(approval);
+  const aliases = capabilityAliases(capability);
+  const effects = payload.effects || {};
+  const capabilities = Array.isArray(payload.capabilities) ? payload.capabilities : [];
+  return aliases.some((alias) => effects[alias] === true || capabilities.includes(alias));
+}
+
+function targetPathCovered(approval, pathInfo) {
+  if (!pathInfo) return true;
+  const payload = eventPayload(approval);
+  const targetPaths = payload.target_paths || {};
+  const allowed = Array.isArray(targetPaths.allowed) ? targetPaths.allowed : [];
+  if (allowed.length === 0) return false;
+
+  const relative = normalizeForCompare(pathInfo.relative_path);
+  return allowed.some((pattern) => {
+    const normalizedPattern = normalizeForCompare(pattern);
+    if (normalizedPattern.endsWith(`${path.sep}**`)) {
+      const prefix = normalizedPattern.slice(0, -3);
+      return relative === prefix || relative.startsWith(`${prefix}${path.sep}`);
+    }
+    if (normalizedPattern.endsWith('/**')) {
+      const prefix = normalizedPattern.slice(0, -3).replace(/\//g, path.sep);
+      return relative === prefix || relative.startsWith(`${prefix}${path.sep}`);
+    }
+    return relative === normalizedPattern;
+  });
+}
+
+function invalidatedApprovalIds(events) {
+  const ids = new Set();
+  for (const event of events) {
+    if (event.event_type !== 'invalidation') continue;
+    const payload = eventPayload(event);
+    if (payload.approval_event_id) ids.add(payload.approval_event_id);
+    if (payload.approval_id) ids.add(payload.approval_id);
+  }
+  return ids;
+}
+
+function findApproval(events, capability, pathInfo) {
+  const invalidated = invalidatedApprovalIds(events);
+  return events.find((event) => {
+    if (event.event_type !== 'approval_decision') return false;
+    const payload = eventPayload(event);
+    if (payload.status !== 'approved') return false;
+    if (invalidated.has(event.event_id) || invalidated.has(payload.approval_id)) return false;
+    return hasCapabilityInApproval(event, capability) && targetPathCovered(event, pathInfo);
+  });
+}
+
+function decision(decisionValue, reason, extras = {}) {
+  return {
+    decision_id: `decision-${Date.now()}`,
+    schema_version: '0.1.0',
+    decision: decisionValue,
+    reason,
+    required_next_action: extras.required_next_action || { type: decisionValue === 'allow' ? 'run_verify' : 'ask_user' },
+    matched_events: extras.matched_events || [],
+    path_policy_result: extras.path_policy_result || null,
+    capabilities: extras.capabilities || {},
+  };
+}
+
+function decide(input) {
+  const repoRoot = path.resolve(input.repoRoot || process.cwd());
+  const taskDir = input.taskDir ? path.resolve(repoRoot, input.taskDir) : null;
+  const eventsPath = input.eventsPath || (taskDir ? path.join(taskDir, 'events.jsonl') : null);
+  const taskYamlPath = input.taskYamlPath || (taskDir ? path.join(taskDir, 'task.yaml') : null);
+  const capabilityCatalogPath = input.capabilityCatalogPath || path.join(repoRoot, 'harness', 'contracts', 'capability-catalog.yaml');
+  const capabilityCatalog = readTextIfExists(capabilityCatalogPath);
+
+  const task = parseTaskYaml(readTextIfExists(taskYamlPath));
+  const events = readJsonl(eventsPath);
+  const capability = input.capability;
+  const pathInfo = classifyPath(input.path, repoRoot);
+
+  const base = {
+    requested_action: input.action || null,
+    capability,
+    task_type: task.task_type || task.type || null,
+    path_policy_result: pathInfo,
+  };
+
+  if (!capability) {
+    return { ...base, ...decision('block', 'Missing capability.') };
+  }
+
+  if (!capabilityCatalog.includes(`${capability}:`) && !capabilityCatalog.includes(capability)) {
+    return { ...base, ...decision('deny', `Unknown capability: ${capability}`) };
+  }
+
+  if (capability === 'file.read.secret' || isSecretPath(input.path)) {
+    return { ...base, ...decision('deny', 'Secrets are deny-by-default.', { path_policy_result: pathInfo }) };
+  }
+
+  if (pathInfo) {
+    if (!pathInfo.is_within_project_root || pathInfo.escape_detected) {
+      return { ...base, ...decision('deny', 'Path escapes project root.', { path_policy_result: pathInfo }) };
+    }
+    if (pathInfo.has_alternate_data_stream) {
+      return { ...base, ...decision('deny', 'Windows alternate data stream paths are denied.', { path_policy_result: pathInfo }) };
+    }
+    if (pathInfo.has_symlink_or_junction) {
+      return { ...base, ...decision('deny', 'Symlink or junction path requires explicit safe handling.', { path_policy_result: pathInfo }) };
+    }
+  }
+
+  if (capability === 'file.read.project') {
+    const researchStatus = gateStatus(events, 'research');
+    if (researchStatus === 'open' || researchStatus === 'completed' || researchStatus === 'approved') {
+      return { ...base, ...decision('allow', 'Project read is allowed during research after grill.', { path_policy_result: pathInfo }) };
+    }
+    return { ...base, ...decision('deny', 'Project read before grill/research is denied.', { path_policy_result: pathInfo }) };
+  }
+
+  if (capability === 'network.web_research') {
+    const researchStatus = gateStatus(events, 'research');
+    if (researchStatus === 'open' || researchStatus === 'completed' || researchStatus === 'approved') {
+      return { ...base, ...decision('allow', 'General web research is allowed during research.', { path_policy_result: pathInfo }) };
+    }
+    return { ...base, ...decision('deny', 'Web research requires the research gate.', { path_policy_result: pathInfo }) };
+  }
+
+  if (capability === 'file.write.folder_skeleton') {
+    if (pathInfo && !pathInfo.is_within_modules) {
+      return { ...base, ...decision('deny', 'Folder skeleton writes must stay under modules/.', { path_policy_result: pathInfo }) };
+    }
+    const extension = path.extname(input.path || '').toLowerCase();
+    if (EXECUTABLE_SKELETON_EXTENSIONS.has(extension)) {
+      return { ...base, ...decision('deny', 'folder_skeleton cannot create executable source, runtime config, tests, or fixtures.', { path_policy_result: pathInfo }) };
+    }
+  }
+
+  if (capability === 'file.write.module' && pathInfo && !pathInfo.is_within_modules) {
+    return { ...base, ...decision('deny', 'Product module writes must stay under modules/ unless outside_modules_write is approved.', { path_policy_result: pathInfo }) };
+  }
+
+  if (capability === 'file.write.harness_core') {
+    const taskType = task.task_type || task.type;
+    if (taskType !== 'template_maintenance' && taskType !== 'harness_update') {
+      return { ...base, ...decision('proposal_required', 'Harness-core writes require template_maintenance or harness_update; product tasks must create proposals.', { path_policy_result: pathInfo }) };
+    }
+  }
+
+  const approval = findApproval(events, capability, pathInfo);
+  if (!approval) {
+    return {
+      ...base,
+      ...decision('deny', `No exact-scope approval found for ${capability}.`, {
+        path_policy_result: pathInfo,
+        required_next_action: { type: 'ask_user', gate_id: 'implementation', missing_capabilities: [capability] },
+      }),
+    };
+  }
+
+  return {
+    ...base,
+    ...decision('allow', `Allowed by approval event ${approval.event_id}.`, {
+      matched_events: [approval.event_id],
+      path_policy_result: pathInfo,
+      capabilities: { [capability]: 'approved' },
+    }),
+  };
+}
+
+function main() {
+  const args = parseArgs(process.argv.slice(2));
+  if (args.help) {
+    process.stdout.write('Usage: node permission-decision.js --repo-root <path> --task <task-dir> --capability <capability> [--path <path>] [--action <action>]\n');
+    return;
+  }
+  const result = decide({
+    repoRoot: args['repo-root'] || process.cwd(),
+    taskDir: args.task,
+    eventsPath: args.events,
+    taskYamlPath: args['task-yaml'],
+    capability: args.capability,
+    path: args.path,
+    action: args.action,
+  });
+  process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+  process.exitCode = result.decision === 'allow' ? 0 : 2;
+}
+
+if (require.main === module) {
+  main();
+}
+
+module.exports = {
+  decide,
+  classifyPath,
+  parseTaskYaml,
+  readJsonl,
+};

package/harness/release/CHECKSUMS.sha256

@@ -0,0 +1,84 @@
+b75c124a428acc599b3df9199ff9a7561fd3e8f4cfa798ac2e2abbe52deab91b  .gitignore
+ecb31bd77b238338a71f127d5c61debdd945cc3183531f82e17e3c1c06eb98b0  AGENTS.md
+0c4e9616d43c4c22700e342ac257cbf56206c9a4128f8804a92e527c0ff6d293  bin/jjamppong.js
+dd42041866d0a2dbe3b04855460869b3933eda8dab6195fa14847854198a66bd  CONTEXT.md
+d72f8bf2dd6a12b2fbd770717de9a8b47f688d4b62c64b6226fea5eb736ad6c3  handoff.md
+9581d97900a5f8632b696132f11c2e65009c74eca5e76923350d076aaf714de9  harness/contracts/capability-catalog.yaml
+039108a852bbb2655491cc3db301939fc8e76a90b455a4b052940f2469fb7ea5  harness/contracts/gate-contract-matrix.yaml
+ca6de7e2ca1d64180098423a93abca089e5375632af200dccf8aff6be120e6ae  harness/contracts/installer-contract.yaml
+0c6fb5a1ba1c23605cac383f71bd875d3f9c40508d454fd38f700fb0e5331dd7  harness/contracts/ledger-event.schema.yaml
+94601bc3d6ab2f401bc2b457719f03cad6af7f3199ed205ff2f39a0484ca8d36  harness/contracts/path-policy.schema.yaml
+2a51483b3c30ea81635b08941c9bb48732b0243bb17968f8b7ad1d26ee4b4ed6  harness/contracts/permission-decision.schema.yaml
+fa7cab6e4eda0e68a3319dea5a8c8c20067f1ee644ec95705239ab495a24e799  harness/contracts/task.schema.yaml
+1f1aeeea426e55fde36e7df1bdaef4230d4a7a77275f626e999a7a940c55b5bd  harness/docs/adr/.gitkeep
+ef1241c93309ad939963abc2f18907dae500747eb694efbc23b5d849f9ba1f0b  harness/docs/adr/2026-06-02-jjamppong-planning-gate.md
+42d7fe25380a09024478c164aa1ff80b331f24d71a993f156f3687a26729f506  harness/docs/agents/domain.md
+07ce308c98c497ca8e2f5f03daac033762234dca20174e1aa976ba088defe2e1  harness/docs/agents/issue-tracker.md
+c1eb34b679d817f7dbf4e6a9a799c2c76667e8eebf4decf2e07515e6a1ae34cf  harness/docs/agents/matt-pocock-skills.md
+2d46304ad140ea4b688c157c274f44d40680b2131e583c92b3aea9964a043ab0  harness/docs/agents/triage-labels.md
+1f1aeeea426e55fde36e7df1bdaef4230d4a7a77275f626e999a7a940c55b5bd  harness/docs/solutions/.gitkeep
+1f1aeeea426e55fde36e7df1bdaef4230d4a7a77275f626e999a7a940c55b5bd  harness/docs/tasks/archive/.gitkeep
+f9f3d984f71af625e6797569201fde1b6457842e1273084558cc437289d6d05a  harness/docs/tasks/archive/index.md
+1f50310ee56eb4013a134da9553f2fe7abd1963bec94189d9415d7d899a094e8  harness/docs/tasks/index.md
+c256f559b57cf3b16fcff2e3052f400e57c5a40cd2b2ed435e4960f1b6dc2d81  harness/doctor/doctor.js
+a79fc4899f0a8411089b9a0d53ee01ff9bcc344f334c671eff1e9caa690af49b  harness/installer/install.js
+df387cf8e7dc5434c42bf3e24cb63367f552a7c0d30298fea0ef5962401fd34c  harness/lifecycle/lifecycle.js
+8c78570ebe4fff482dde6f579e42218514fd4491cd599be57a6e12d2b69a0d80  harness/permission/permission-decision.js
+5da9b3f5c900f1ef364acdf02f7e05d666aeae5a362b01161f3c1fcca916552c  harness/release/RELEASE-NOTES.md
+1060a7637db11382e5d93802b68a0cf7b801a6c66de2fc9325e876cc20cf669a  harness/release/SOURCE-MANIFEST.md
+78c889ea476f2990a8c11e80e4e13c32807d8bc32866552b796846f41e08899f  harness/rules/module-types.md
+5fff69c7bf8a351da7b92110dd3f4551611e67d23842d92edd2ef2df79b6b2d5  harness/rules/rules.md
+a88f8bc9f9cd5e7bbe5f22da06183536e589e55d0498c5dd407b62b757b7ad27  harness/rules/workflow.md
+918e058ceab9f5541901696b9cf42ba3a42e6c73634eb4805933f49e859a8b0f  harness/state/compound.md
+7b640f33fbc098d6b53d5e5cb46e11de8ecffc9058e47c1bb28e21b3ecaaf422  harness/state/intake.md
+057e196e889d59ef2d9da2a4aab58ab4db7835027b35e0f9365be95172e714d5  harness/state/module-structure.md
+9c3396e20c7f357a21221855426c655f2a3fa1243e9efd079106c549b5b2eef1  harness/state/planning.md
+e8cf6147a5c1a9356a5e951c9fcb560b2bbd3f1e8b94dea8f197ca1849c12fd5  harness/templates/module/module-state.md
+206655c7bcfbe478a99f540b3a2f0296abbbc6d92bbd6b2bf30d93b1139ab984  harness/templates/task/archive-summary.md
+5249985ede496c7aa57c4d7a84f9982a279cbf18ed2b12bf6738a8cba3e55d66  harness/templates/task/events.jsonl.template
+0fcfef0b70e77153bfd88703df66c549841eae85018bd3c40c85444fbfa62f05  harness/templates/task/gate-ledger.md
+2425b79a3bc0f6c4737b1fc5ea1d86740b39d66dfd44232b75f7f6ddb1f0a7f4  harness/templates/task/implementation-approval.md
+ce9f74f4ea7134c596217cb45c8a080cedde5112e7605c059575526682490d5b  harness/templates/task/planning-pack.md
+72f61e4160171f8b9c555cb3a93b5dbb5bb16acb50a898a45810cc9a2c7c2a6c  harness/templates/task/planning/00-current-planning-context.md
+deaae829ebe6512a4fc26a258fa3e0c91d943d599bf3c5b7cfb3d02edd382841  harness/templates/task/planning/01-grill-summary.md
+17dd7a3dabcfc8b5a60cf63547ac80c871d8b49260724c0d7b2bc2dd6ed1ffb1  harness/templates/task/planning/02-research-summary.md
+b901c62d779f99d9fddaf9eb6d9a20ebe9e0c2b6442a4d2585b4def34684c7a9  harness/templates/task/planning/02b-compound-lookup.md
+8ad2250f678a9c6bc446a28b91c29847839ed37fd40c73b0584152af1fed34f6  harness/templates/task/planning/02c-architecture-orientation.md
+1d055cd7e742091175811e2dbaf92db665001a47f53d522f20caa55ac11dfb0d  harness/templates/task/planning/03-prd.md
+3141444e80168e0b4ab994da8d9d7cf20dcda14e3054eeb828d6bd19a7b6de75  harness/templates/task/planning/04-issues.md
+53ed4bc8d63213b040d4149c675fc0f4c74853f298da1194d0d2b6bd9b97942a  harness/templates/task/planning/05-module-structure.md
+836019cf4fd420f0b55ff8ce9ea45af7ae94ea60f77a6a429c0227c8daa1475c  harness/templates/task/planning/06-writing-plan.md
+402a08e86223ec7763b7a6dc7a98fe26ca302c9b51252e5942bf7ebfa9e78939  harness/templates/task/planning/07-plan-review.md
+f098147d0d1bb082398aa71f41b1f9abed0065e84ab8c246cc9e16e5b1241484  harness/templates/task/task.yaml
+b63627c8f9ff29f9156eab08a4e301ddc63593dd520973e3b39423457406de42  harness/templates/task/verification.md
+aaf542c6904d52a428a7f57330ac623ec742baf6dfc098ea27ae4d8bb0386eb6  harness/verify/verify.js
+8c73f3983c33100122c46f77bd2d1c578efa0d8daa4e8afde7a1a145320223d8  module-template/MODULE.md
+93dc8a396d0c0235225fc576d8f11efdb6be8d21b0496f5cbfb951a82d3fefbc  module-template/README.md
+e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  modules/.gitkeep
+4b10dbbf1569206d9c5d8163558fde1053fd8d272c4d92aea16920be1a66f82d  package.json
+993d437fa79d30975560b816d5e9cca1a335374ff2dd1ea2d639d38e34cd0bbb  plugins/agents-md-management/.codex-plugin/plugin.json
+29591d56d518ecc5523bc39b0785590e5dc46b766c6b53575706d8f9483dea50  plugins/agents-md-management/scripts/discover_agents_chain.py
+74745a5c8e8c4ed32eb13dc0d8023f0f43a7dd09aa40cc823018d4958381843f  plugins/agents-md-management/scripts/score_agents_md.py
+23a95a18e7517a748fc2b181ec49829ad4125ca6a3b89ad242e39e3225e5e30d  plugins/agents-md-management/skills/agents-md-chain-audit/references/codex-instruction-chain.md
+5109b6b26a9767046fc38b7dfacff7474c956f1a004d8f20f83ef787f721c48e  plugins/agents-md-management/skills/agents-md-chain-audit/SKILL.md
+72557216d0e3f68f012309aa872f87470785b8f08eae7ddb46c8d0224b386023  plugins/agents-md-management/skills/agents-md-improver/references/quality-criteria.md
+8f9bf0ddeb95287e5de51cccf8372c99786c9a3887ea90797a9dbe82438fb3a3  plugins/agents-md-management/skills/agents-md-improver/SKILL.md
+10c0e7a0f94cf745f2e1e664ff7dde6cd9c47240c33885737bfe69aee9dbe13c  plugins/agents-md-management/skills/revise-agents-md/references/routing-rules.md
+1dc59fb7578e0d8a224bd6a07840bbb3d1399b0a243df449ed5b4a5cebccc073  plugins/agents-md-management/skills/revise-agents-md/SKILL.md
+0b8771cf56a4cff9bd1e014886c8b26706272efc812fe1ff3dd2b8ab3c81b2e9  plugins/agents-md-management/tests/test_discover_agents_chain.py
+802a5a5808aa976da3a531b33db354afb65885c452bed7797b391a4b01745c72  plugins/agents-md-management/tests/test_score_agents_md.py
+3c3a99a59412ac89fb08e272c8a922a3bbf139db7309cce03e53017718a07ca5  proposals/README.md
+24eb211a753d08817e9e4fbc7587e787009e73c21cbea89fb5d27608ab62eaee  README.md
+d393d4be478abe78ee792efa25dcdbb42ddb114d4e95048aa394e39a9c7a07b8  scripts/install-jjamppong-harness.ps1
+68ec4952f3989fe8d5e0c44a77a701de1e4d1cc7d6ad4ab27480a26b11c2effc  tests/contracts/regression-catalog.yaml
+fdd103d46ca579c41b98c8f551ae012ac5ce2f72a6881d2f3d0e03a28163bf26  tests/contracts/run-all.ps1
+c885ac843bc23134c6d2abb4672bdeb03628f8d65be76189bfe64eaa274f1575  tests/contracts/run-contract-regression.ps1
+98d9a4151052a3b570d0cf37dbb632ccab4eaeb736622a108f7a81a5b90a10f9  tests/contracts/test-agents-readme.ps1
+a4d992330cae87f6491473fb2c1791e76850b7fc82592713e22bbcd1e55cfe6c  tests/contracts/test-installer-package.ps1
+b54f09f6eeca88f7d9f62b9132742c956bda8acd8420edab908d2588a9e09b46  tests/contracts/test-lifecycle-templates.ps1
+b3e4d8587ddf83e63244694c9a2920f67a91281e6d3c1b18416c68ef6d7a1cde  tests/contracts/test-permission-decision.ps1
+68d8b391a0c4b2931f1c583a3d72d43bb578ca142c75f0bd5ac72ad9dbed3a7f  tests/contracts/test-release-candidate.ps1
+a7c26a1c8fd6c6cedcb0c0eb881f3d163f488796b62671db45045bf3a5ce07ec  tests/contracts/test-verify-doctor.ps1
+a8bb7e23ccafd8d9aa6e9204dc07671c507e56228c17db3667bf6dd6770ce23e  tests/contracts/test-workflow-rules.ps1
+d94fbcb64f6c8e1067c4735161d04b9e2c54ab8e0c5e517498ac56abbd1fedf0  tests/contracts/verify-coverage-map.yaml
+e8e1dab1fc27e76a303cc65291188a61f9d6ffb75381f2aefa2ec51038c70294  tests/fixtures/contracts/required-p0-regressions.txt

package/harness/release/RELEASE-NOTES.md

@@ -0,0 +1,33 @@
+# Release Notes
+
+## 0.1.0 Release Candidate
+
+This release candidate rebuilds the harness around executable contracts instead of prose-only rules.
+
+Included:
+
+- Contract schemas and regression catalog.
+- PermissionDecision MVP for capability and path decisions.
+- Verify/doctor commands for installed projects.
+- npm/npx installer with install-only stop behavior and `harness.lock.yaml`.
+- Task templates based on `events.jsonl` as canonical state.
+- Short `AGENTS.md` and Korean README.
+- Empty `harness/docs/tasks/active/` template state.
+
+Important behavior:
+
+- Installation stops after install and verify.
+- `grill` happens before project reads for product planning.
+- `research` is canonical; `evidence_check` is only a legacy alias.
+- `plan_review completed` does not approve implementation.
+- `module_structure` does not create folders.
+- `folder_skeleton` does not create code, tests, fixtures, runtime config, package files, live access, commits, or pushes.
+- Package install, live target access, commit, and push each require separate explicit approval.
+
+Not included:
+
+- Active product tasks.
+- Product code.
+- GitHub repository creation.
+- Automatic commit or push.
+- OuroSuper as an active workflow.

package/harness/release/SOURCE-MANIFEST.md

@@ -0,0 +1,31 @@
+# Source Manifest
+
+This manifest describes the release candidate source surfaces for Jjamppong Harness.
+
+## Canonical Surfaces
+
+- `harness/contracts/`: machine-readable gate, permission, path, installer, and task contracts.
+- `tests/contracts/`: regression tests that prove the contracts stay enforced.
+- `harness/permission/`: PermissionDecision MVP.
+- `harness/verify/`: installed-project verifier.
+- `harness/doctor/`: read-only diagnosis and proposal generator.
+- `harness/installer/` and `bin/`: npm/npx installer and CLI entry points.
+- `harness/templates/`: task and module artifact templates.
+- `harness/rules/`: human-readable projections of the contracts.
+- `AGENTS.md`: short runtime instruction entry point.
+- `README.md`: Korean human guide.
+
+## Non-Canonical Or Isolated Surfaces
+
+- `harness/docs/tasks/active/` must be empty except `.gitkeep` in the template release candidate.
+- `harness/docs/tasks/archive/` is cold storage and should be read through summaries/indexes first.
+- `source-history/` is audit trail only if present. It must not outrank `FINAL-PLAN.md`, contracts, or tests.
+- Historical references to OuroSuper may appear only as rationale or invalid nested-install examples, never as an active route.
+
+## Alias Rule
+
+`research` is the canonical gate id. `evidence_check` is a legacy alias only.
+
+## Release Surface
+
+Release checksums are recorded in `harness/release/CHECKSUMS.sha256`.

package/harness/rules/module-types.md

@@ -0,0 +1,98 @@
+# Module Types
+
+## Principle
+
+This harness does not ship fixed module type names.
+
+Each project defines its own module types and folder standards through the Full Workflow.
+
+Module structure design is a substantive planning decision inside the Full Workflow.
+
+It is handled by the Module Structure Gate, not by an ad hoc side flow.
+
+When a project has no approved module structure, the first product request uses the Module Structure Gate before product PRD, issue decomposition, writing plans, module folders, or product code.
+
+## When To Use This Rule
+
+Read this file when:
+
+- Starting module structure design
+- Creating a new module
+- Changing module folders
+- Changing module type names
+- Deciding whether a folder is standard or project-specific
+
+## Required Process
+
+Module type and folder standards are substantive work.
+
+They must follow:
+
+```text
+Request Intake
+-> setup-matt-pocock-skills Readiness Check
+-> Grill Routing And Completion Gate
+-> Grill Result Record
+-> Module Structure Gate
+-> to-prd
+-> User PRD Approval
+-> to-issues
+-> User Issue Approval
+-> Task Brief
+-> Superpowers Writing Plans
+-> Mandatory Plan Review Question
+-> Implementation / Apply
+-> Verification
+-> ce-compound
+-> Archive Task Artifacts
+-> Learning Update Question
+```
+
+## Output Location
+
+Record approved module type and folder standards in:
+
+```text
+harness/state/module-structure.md
+```
+
+If the request cannot create or change product module folders or product code, record `Module Structure Gate: not applicable` in `harness/docs/tasks/active/<slug>/grill.md` and do not ask module-structure questions.
+
+## Ledger Requirement
+
+Module structure approval must be traceable to the active task gate ledger.
+
+For the task that creates or changes module structure, the task gate ledger must contain `Gate id: module_structure` with `Status: approved` before `harness/state/module-structure.md` is treated as approved.
+
+Future tasks may rely on `harness/state/module-structure.md` as the long-lived module structure record, but they must record one of these task-local entries before product PRD drafting:
+
+- `Gate id: module_structure` with `Status: existing-approved`: existing approved structure applies.
+- `Gate id: module_structure` with `Status: approved`: this task approved a new or changed structure.
+- `Gate id: module_structure` with `Status: not-applicable`: this task cannot create or change product module folders or product code.
+
+The state file records the approved structure. The task ledger records the user response that opened the gate.
+
+## Required Content
+
+`harness/state/module-structure.md` must record:
+
+- Project module types
+- Folder set for each module type
+- Active modules
+- Deferred modules
+- Any extra folder and the reason it exists
+
+## Creation Rule
+
+Do not create a module under `modules/` unless its module type and folder set are recorded in `harness/state/module-structure.md`.
+
+## Template Rule
+
+Every module starts from:
+
+```text
+module-template/MODULE.md
+module-template/README.md
+```
+
+Then the approved folder set from `harness/state/module-structure.md` is added.