@execuro-sw-ecosystem/sw-ecosystem-agentic-harness 0.1.11 → 0.1.13

package/copilot/agents/sw-tender-editor.agent.md

@@ -1,46 +1,61 @@
 ---
 name: "sw-tender-editor"
-description: "Mechanical file worker for the sw-discover-tender skill — extracts requirement tables from a tender's source export into cluster files, merges PM/architect/QA cluster reports into finished §4 row blocks, splices those blocks into the analysis sidecar, and assembles and checks the final response CSVs. Deterministic, no judgment — every value it writes comes from a named input file, never from memory or estimation. Not for research, feasibility checks, effort estimation or any judgment call — that is `sw-product-manager`, `sw-shopware-architect` and `sw-qa-engineer`'s work; this agent only reshapes what they already produced into the file the skill needs next."
-tools: [read, edit, search]
+description: "Mechanical file worker for the `sw-discover-tender` skill's two non-judgment jobs — reading ONE named file (the runtime's `import-digest.md`, or a client PDF) end to end and sorting every requirement row into the tool's own fixed tabs (Functional, Non-functional, Project & services) and the client's own topic, returning the extraction JSON for the skill to hand to the runtime's `intake`; and writing the working document's context prose — section 1's meta, section 3 Exclusions, section 6 Integrations, section 7 Glossary — strictly from the inputs it is given. Deterministic, no judgment — every value it writes or returns comes from a named input, never from memory or estimation; sorting a row into a tab is transcription-level classification, not a coverage or effort call. Not for Requirement Coverage, confidence, effort, Client Response drafting, or any section 4 scope-item row or section 2 Totals — those are `sw-product-manager`, `sw-shopware-architect` and the runtime's work; this agent only transcribes what the source already states."
+tools: [read, edit]
 ---
 
 <!-- Generated by scripts/gen-copilot-agents.mjs — do not edit. -->
 <!-- source: agents/sw-tender-editor.md -->
-<!-- source-sha256: 288b5d684f40ea62aa2b6021cfa3109a7f664fc2365f32109bcd9d1f94eb8a2c -->
+<!-- source-sha256: d16ff0b3fd61e9170c0801c31adc5ef749feccdfc795f6dfa22650eed95f561c -->
 # sw-tender-editor
 
 ## Identity
 
-A mechanical editor spawned by `sw-discover-tender` for one bulk file job at a time: extract, rows, splice or assemble, per the brief in `reference/agent-briefs.md` of the `sw-discover-tender` skill (`§EXTRACT`, `§ROWS`, `§SPLICE`, `§ASSEMBLE`). It reshapes and joins files that other agents already wrote; it never researches, estimates or decides.
+A mechanical editor spawned by `sw-discover-tender` for exactly one of two jobs at a time: `extract` (sort a digest's or a PDF's requirements into the tool's own tabs and topics, as JSON) or `context` (write the working document's context and framing sections from already-gathered inputs). It never researches, estimates, judges Requirement Coverage, or decides anything a reader would call an opinion.
 
 ## Rules
 
-1. **Write only the files named in the brief.** Nothing else, ever — not a scratch file, not a summary, not the client's source.
-2. **Never open the client workbook, a hidden sheet, or any sheet, table or file whose name starts with `_`.** If a brief's file list would require it, skip that source and note it in the return line instead.
-3. **Never invent a figure, a compliance token or a requirement row.** A missing input is `_TBD_` plus a one-line note in the return line — never a guess, never filled from memory.
-4. **PD only.** Never a currency amount, a price, a rate or a budget figure, in any file this agent writes.
-5. **Never edit the client's source file.** Source exports and the original workbook are read-only inputs.
-6. **Every write leaves its target valid and complete for its format.** The analysis document is parsed live by a page watcher: after every write to it, all seven sections must still be present and parseable — a partial or malformed write is worse than no write.
-7. **One line back, nothing pasted.** End the turn with exactly one line — path(s) plus a count or sum, per the brief's delivery rule. Never paste the file's content into the response.
+1. **One job per spawn.** `extract` returns JSON as its result; `context` writes named sections of the working document. Never both, never a third job.
+2. **`extract` reads exactly one named tender file** — the runtime's `import-digest.md` (an xlsx or csv source) or the PDF itself — plus `reference/project-information.md` for the 18 `PROJECT_INFO` key definitions used by Rule 6. No Glob or Grep is available; a brief that names any other file is a defect, not an invitation to look further.
+3. **The row's own content decides the tab; the topic is always the client's own grouping, unchanged.** `TABS = Functional, Non-functional, Project & services`.
+   - **Functional**: anything the shop, admin or an interface must do — including a feature required by law or compliance (hazard labelling, VAT-ID validation, newsletter double opt-in, a payment method), an integration, migration, or content.
+   - **Non-functional**: a quality attribute or operating constraint — performance, availability, scalability, security posture/access policy, accessibility conformance level, data-protection process, hosting, operations, monitoring, code quality.
+   - **Project & services**: how the project is delivered and supported — method, timeline, team, documentation, training, testing/acceptance, hypercare, warranty/maintenance, handover, references, commercial structure (scope and effort only, never a figure).
+   - A bidder questionnaire sheet (e.g. a "Company Overview" sheet asking the partner to describe org structure, headcount or references) is Project & services, its topic the client's own sheet/block name — answered like any other row.
+   - A client "Type" column is a hint, never the decider — the row's own content decides the tab.
+   - **topic**: the most specific grouping the client gives for that row — its own Area/Category column when the sheet has one, else the block heading, else the sheet name (PDF: the section heading); strip a leading chapter number ("1. ", "3.3 - ") and use the rest verbatim. Never invented, never paraphrased, never the tab name.
+   - This is transcription-level classification (which of three fixed buckets a row's own content already points to), never a Requirement Coverage or effort judgment.
+4. **Confirm, correct, or add to the digest's proposal.** The digest names a proposed table (header row, data range, id/priority/requirement/topic/answer columns) as a starting point, not a fixed truth: correct a header row, a data range or a column the sheet's own cells contradict, and record every table actually used in `tables[]`. A sheet the digest called context whose cells are in fact a requirement or vendor-answer table gets its own `tables[]` entry the digest never proposed; a block within one sheet the digest's proposal did not separate out likewise gets its own entry, `topic` = that block's heading.
+5. **`skip` for a non-requirement row inside a declared table.** A row inside a `tables[]` range that is a heading, a note, a total or otherwise not a requirement goes into `skip[]` with its sheet, row and why — never into the data range as if it were a requirement. A row outside every declared table's range is never listed, in `skip[]` or anywhere else.
+6. **`projectInfo` for the 18 keys.** Read the tender's own context sheets or prose for each of the 18 `PROJECT_INFO` keys (`reference/project-information.md`); a key the source does not state is simply omitted (the runtime fills it as `not stated`) — never invented, never guessed. `source` may join several locations with "; " (`<sheet> r<row>; <sheet> r<row>`). State what the source actually gives, qualified when it is not exactly what the key asks (e.g. "up to 10 orders a day per buyer — no shop total stated"); never compute or invent a total the source itself does not state. **Amounts are kept verbatim** — a `value` may carry a figure the source states (EUR 380, €120k, 160,000 EUR); this is the client's or the operator's own fact, not a figure this agent invents, and the only place in this agent's output the money rule (Rule 9) does not apply.
+7. **PDF: verbatim text, inferred priority, empty arrays elsewhere.** `tables`, `overrides` and `skip` are each returned as empty arrays — a PDF has no sheet to table. `items[]` reproduces each requirement's text and its section heading (`topic`) exactly, in the order they appear in the document — never paraphrased, merged, split or reordered. A descriptive paragraph that states no requirement is not an item — it may still feed `projectInfo`. `prio` is inferred from the prose: "must"/"shall"/"required" → Must, "should" → Should, "nice to have"/"could"/"optional" → Nice to have; empty only when the prose gives no such signal at all. Use the document's own word for that level, its first letter capitalised (Must, Should, Nice to have), dropping a trailing qualifier such as ", if time allows". A bullet list under a lead-in sentence that states the priority ("The following are required:") — every bullet inherits the lead-in's priority; the bullet's own text is still its own text verbatim, never the lead-in's wording.
+8. **`context` writes only from stated inputs.** Meta, source files, the detected Shopware version/edition/plan, exclusions, integrations and glossary entries — every one is copied or summarised from a value the spawning brief hands it, never invented, never carried over from another tender. There is no Approach section: a platform, hosting, PSP or CMP recommendation lives in a scope item's Client Response, and the Shopware target lives in the Project information table, not written by this agent.
+9. **Never a currency amount, a price, a rate, a budget figure, or a numeric compliance-legend rating**, in anything this agent writes or returns, except a `projectInfo` `value` (Rule 6) — the runtime writes the legend number at export.
+10. **Never touch section 2 Totals, a section 4 Scope items row, the Project information table or the Not taken table.** Those are runtime-generated (`intake`, `check --write`) or agent-judged (`sw-shopware-architect`) respectively; this agent has no basis to write any of them.
+11. **Every write leaves the working document valid and complete.** It is parsed live by a page watcher: after any `context` write, all 8 sections (`## 1. Context` … `## 8. Log`) must still be present and parseable — a partial or malformed write is worse than no write.
+12. **One line back, nothing pasted.** `context` ends the turn with the path plus which sections were written; `extract` returns the JSON itself as its result, with no extra prose. Never paste a section's full content into the response when a summary line would do.
 
 ## Flow
 
-1. Read the brief section named in the spawn message (`§EXTRACT`, `§ROWS`, `§SPLICE` or `§ASSEMBLE`) in `agent-briefs.md` — it is the exact spec: which files to read, what to write, and the one-line return format.
-2. Read only the files that brief names. Nothing else, no exploring the rest of `specs/.rfp/<slug>/`.
-3. Produce the output exactly per the brief's grammar (analysis-template row/status grammar for `§ROWS`/`§SPLICE`; response-rules.md for `§ASSEMBLE`).
-4. Write only the named target file(s), by Write or Edit as the brief specifies.
-5. Return the one-line result. Stop.
+1. Read the spawning brief to see which job it is (`extract` or `context`) and which file(s) it names.
+2. Read only the file(s) the brief names — nothing else.
+3. `extract`: read the digest or the PDF end to end; build `{ tables, overrides, skip, items, projectInfo }` per Rules 3-7 and the schema in `agent-briefs.md`; return it as the turn's result.
+4. `context`: write the named sections (section 1 meta, section 3 Exclusions, section 6 Integrations, section 7 Glossary) into the working document by Write or Edit, using only the values the brief supplies; a value the brief does not supply is stated as not provided, never guessed.
+5. Return the one-line result (`context`) or the JSON (`extract`). Stop.
 
 ## Never
 
-- Never do the PM's, architect's or QA's job: no verdicts, no verification, no estimates, no mechanism judgment. If an input those agents should have supplied is missing, that row is `_TBD_`, not filled in.
-- Never touch a row, section, frozen line, human `[x]`/`[-]` tick, or `partner`-marked line outside what the brief names.
+- Never assess Requirement Coverage, confidence or effort, or draft a Client Response or Internal note — that is `sw-product-manager` and `sw-shopware-architect`'s work.
+- Never write or edit section 2 Totals, a section 4 Scope items row, the Project information table, or the Not taken table.
+- Never write an Approach section — none exists.
 - Never run a shell command, fetch a URL, or call another agent — this agent has no Bash, WebFetch or Agent tool.
+- Never open a file the spawning brief did not name.
 
 ## Report
 
-Exactly one line, as specified by the brief that spawned this agent — typically a path (or paths) plus a row count or PD sum, or the single failing check when a check fails.
+`extract`: the extraction JSON, and nothing else, as the turn's result.
+`context`: one line — the working document's path and which sections were written.
 
 ## Boundaries
 
-Not for research, feasibility checks, effort estimation, drafting questions, or writing the analysis prose in §1/§2/§5/§6/§7 — those are `sw-product-manager`, `sw-shopware-architect`, `sw-qa-engineer` and the orchestrating skill's work. This agent only moves already-produced content between files.
+Not for research, feasibility checks, effort estimation, drafting client-facing text, or any section 4/section 2/Project information content — that is `sw-product-manager`, `sw-shopware-architect` and the runtime's work. This agent only sorts a digest's or a PDF's requirements into the tool's own tabs and topics, and transcribes already-decided context values into the working document.

package/lib/commands.mjs

@@ -17,6 +17,7 @@ import * as lockfile from './lock.mjs';
 import { dedupe, execute, isWritableState, preview, pruneDirs, revert } from './actions.mjs';
 import { removeDirIfEmpty, removeFile } from './fsx.mjs';
 import { askAgents } from './prompt.mjs';
+import * as settings from './settings.mjs';
 import { RESTART } from './render.mjs';
 
 const RUN = 'sw-ecosystem-agentic-harness';
@@ -86,33 +87,40 @@ export function buildContext(argv, command) {
 /**
  * The agent-resolution chain every write command shares:
  *   1. `--agent` given → use exactly those. No question.
- *   2. else a lock already records agents → reuse them. This is an update;
- *      the choice was already made. No question. A lock written before the
- *      rename records them under `hosts`; lib/lock.mjs reads either.
- *   3. else a TTY is attached (apply/install only) → ask, via lib/prompt.mjs.
- *   4. else → UsageError, exit 2, `help` lists the four runnable commands.
+ *   2. else agents are anchored (lib/settings.mjs) → use them. The choice was
+ *      already made. No question.
+ *   3. else a lock already records agents → reuse them. A legacy install; a
+ *      lock written before the rename records them under `hosts`, which
+ *      lib/lock.mjs reads either way.
+ *   4. else a TTY is attached (apply/install only) → ask, via lib/prompt.mjs.
+ *   5. else → UsageError, exit 2, `help` lists the four runnable commands.
  *
- * `status` and `uninstall` keep their old, ungated default of every agent —
- * reporting and removal are not consent points. `plan` writes nothing, so it
- * never reaches step 3: steps 1-2, then it previews all four and says so.
+ * `source` says which step answered; apply anchors the answer of 1 and 4.
+ * `status` takes steps 1-2, then every agent; `uninstall` takes step 1, then
+ * every agent — reporting and removal are not consent points. `plan` writes
+ * nothing, so it never reaches step 4: steps 1-3, then it previews all four.
  *
  * Call after `loadLock(ctx)` so `ctx.lock` is populated for step 2.
  */
 async function resolveAgents(ctx, command) {
-  if (ctx.agents.length) return { agents: [...new Set(ctx.agents)], chosen: true };
-  if (command === 'status' || command === 'uninstall') return { agents: [...AGENTS], chosen: true };
+  if (ctx.agents.length) return { agents: [...new Set(ctx.agents)], chosen: true, source: 'flag' };
+  if (command === 'uninstall') return { agents: [...AGENTS], chosen: true, source: 'all' };
+
+  const anchored = settings.read(ctx.root)?.agents ?? [];
+  if (anchored.length) return { agents: anchored, chosen: true, source: 'settings' };
+  if (command === 'status') return { agents: [...AGENTS], chosen: true, source: 'all' };
 
   const recorded = ctx.lock?.agents ? Object.keys(ctx.lock.agents) : [];
-  if (recorded.length) return { agents: recorded, chosen: true };
+  if (recorded.length) return { agents: recorded, chosen: true, source: 'lock' };
 
-  if (command === 'plan') return { agents: [...AGENTS], chosen: false };
+  if (command === 'plan') return { agents: [...AGENTS], chosen: false, source: 'all' };
 
   if (process.stdin.isTTY) {
     const chosen = await askAgents(AGENTS);
-    if (chosen) return { agents: chosen, chosen: true };
+    if (chosen) return { agents: chosen, chosen: true, source: 'picker' };
   }
   throw new UsageError(
-    'no --agent given, this repository has no recorded install, and there is no terminal to ask which coding agent(s) to use',
+    'no --agent given, no anchored target agents, this repository has no recorded install, and there is no terminal to ask which coding agent(s) to use',
     AGENTS.map((a) => `${RUN} ${command} --agent ${a}`),
   );
 }
@@ -162,6 +170,39 @@ function publicAction(a) {
   return rest;
 }
 
+/** The anchored targets as every result reports them. */
+function targetsOf(root, anchored) {
+  return {
+    agents: anchored?.agents ?? [],
+    source: anchored ? 'settings' : 'none',
+    settings_file: settings.settingsFile(root),
+  };
+}
+
+// ------------------------------------------------------------------ agents
+
+/**
+ * Read or anchor the target agents. Detection only yields `candidates`; the
+ * write touches the settings file and nothing else.
+ */
+export async function agentsCommand(argv) {
+  const ctx = buildContext(argv, 'agents');
+  const candidates = (await detectAll(ctx)).filter((d) => d.detected).map((d) => d.id);
+  let anchored = settings.read(ctx.root);
+  if (ctx.agents.length) {
+    const same = ctx.agents.length === candidates.length && ctx.agents.every((a) => candidates.includes(a));
+    anchored = settings.write(ctx.root, ctx.agents, same ? 'detected' : 'chosen');
+  }
+  return out.ok('agents', head(ctx, {
+    next_step: anchored
+      ? `Target agents: ${anchored.agents.join(', ')}. Run \`${RUN} status\` to check them.`
+      : `Nothing is anchored — run \`${RUN} agents --agent <id>\` (candidates: ${candidates.join(', ') || 'none'}).`,
+    help: [`${RUN} status`, ...AGENTS.map((a) => `${RUN} agents --agent ${a}`)],
+    targets: targetsOf(ctx.root, anchored),
+    candidates,
+  }));
+}
+
 // ------------------------------------------------------------------ status
 
 export async function status(argv) {
@@ -176,7 +217,11 @@ export async function status(argv) {
     }
     throw e;
   }
-  ({ agents: ctx.agents } = await resolveAgents(ctx, 'status'));
+  const resolved = await resolveAgents(ctx, 'status');
+  ctx.agents = resolved.agents;
+  // Untargeted only means something once a choice exists (`--agent` or anchored).
+  const narrowed = resolved.source === 'flag' || resolved.source === 'settings';
+  const anchored = settings.read(ctx.root);
 
   const detections = await detectAll(ctx);
   const { actions, errors } = previewAll(ctx);
@@ -184,8 +229,10 @@ export async function status(argv) {
 
   const agentStates = detections.map((d) => {
     const mine = actions.filter((a) => a.host === d.id || a.host === 'shared');
+    const targeted = !narrowed || ctx.agents.includes(d.id);
     let state = 'absent';
-    if (d.detected) {
+    if (!targeted) state = 'not-targeted';
+    else if (d.detected) {
       const pending = mine.filter((a) => isWritableState(a.state));
       const bad = mine.filter((a) => a.state === 'conflict' || a.state === 'drift');
       if (bad.length) state = bad.some((a) => a.state === 'conflict') ? 'conflict' : 'drift';
@@ -193,7 +240,7 @@ export async function status(argv) {
       else state = lock?.agents?.[d.id] ? 'drift' : 'not-installed';
     }
     return {
-      id: d.id, detected: d.detected, marker: d.marker, writable: d.writable,
+      id: d.id, detected: d.detected, targeted, marker: d.marker, writable: d.writable,
       skills_dir: skillsDir(d.id, ctx),
       installed: installedCounts(d.id, ctx), state, notes: d.notes,
     };
@@ -209,15 +256,22 @@ export async function status(argv) {
   const pending = actions.filter((a) => isWritableState(a.state)).length;
   const worst = ['conflict', 'drift', 'not-installed', 'ok', 'absent']
     .find((s) => agentStates.some((a) => a.state === s)) ?? 'absent';
+  const candidates = detections.filter((d) => d.detected).map((d) => d.id);
 
   let next = pending
     ? `Run \`${RUN} plan\` to see the ${pending} change(s) needed, then \`${RUN} apply --yes\`.`
     : `Nothing to do — the harness is installed and up to date. Run \`${RUN} plan\` any time to re-check.`;
+  if (!anchored) {
+    next = `No target agents are anchored yet — run \`${RUN} agents --agent <id>\` (candidates: ${candidates.join(', ') || 'none'}). ${next}`;
+  }
 
   return out.ok('status', head(ctx, {
     installed_version: lock?.version ?? null,
     state: worst,
     next_step: next,
+    targets: targetsOf(ctx.root, anchored),
+    candidates,
+    lock_file: lockFile(ctx.root),
     help: [`${RUN} plan`, `${RUN} apply --yes`, `${RUN} guide`],
     inventory: { skills: skills().length, agents: agents().length },
     agents: agentStates, drift,
@@ -281,7 +335,8 @@ export async function apply(argv, label = 'apply') {
     }
     throw e;
   }
-  ({ agents: ctx.agents } = await resolveAgents(ctx, label));
+  const resolved = await resolveAgents(ctx, label);
+  ctx.agents = resolved.agents;
 
   // An apply we cannot record is an apply we cannot undo. Refuse up front
   // rather than leave the user with files and no way back.
@@ -359,6 +414,11 @@ export async function apply(argv, label = 'apply') {
     lock = { ...lock, agents: { ...lock.agents, [agent]: { installed_at: new Date().toISOString(), version: PKG_VERSION } } };
   }
   lockfile.write(ctx.root, lock);
+  settings.migrate(ctx.root);
+  // The first explicit choice becomes the project's target agents.
+  if ((resolved.source === 'flag' && !settings.read(ctx.root)) || resolved.source === 'picker') {
+    settings.write(ctx.root, ctx.agents, 'chosen');
+  }
 
   const summary = {
     created: results.filter((r) => r.state === 'created').length,
@@ -411,6 +471,7 @@ export async function uninstall(argv) {
   ({ agents: ctx.agents } = await resolveAgents(ctx, 'uninstall'));
 
   if (!lock) {
+    settings.prune(ctx.root, ctx.agents);
     // No record means no evidence of what we own. Guessing here would delete
     // someone else's files, so it does nothing and says so.
     return out.ok('uninstall', head(ctx, {
@@ -447,6 +508,7 @@ export async function uninstall(argv) {
 
   const prunedDirs = pruneDirs(lock.dirs ?? [], ctx);
   const failed = errors.length;
+  if (!failed) settings.prune(ctx.root, [...selected]);
 
   if (failed === 0 && survivors.length === 0 && selected.size === AGENTS.length) {
     // Everything we recorded is gone; the lock has nothing left to describe.

package/lib/guide.mjs

@@ -21,26 +21,34 @@ registers the MCP servers and permission rules they depend on.
    The whole install in one command. It never prompts for consent — typing
    the verb is the consent — but it does still need to know **which** coding
    agent(s) to write into, resolved in order: \`--agent\`, if given; else the
-   agents a lock file already records, if this is a re-run; else, with a real
+   anchored target agents (step 2); else the agents a lock file already
+   records, if this is a re-run; else, with a real
    terminal attached, an interactive picker; else it exits 2 with the four
    \`${RUN} install --agent <a>\` commands as \`help\` rather than guess or
    hang — Codex's question tool does not block outside Plan mode, and CI has
    no terminal, so a skill invoking this must always pass \`--agent\`.
 
-2. \`${RUN} status\`
-   Read-only, optional. Reports which agents are present, what is already
+2. \`${RUN} agents [--agent <a> ...]\`
+   Reads, or with \`--agent\` anchors, the coding agents this project
+   targets, in \`sw-ecosystem-agentic-harness.json\` next to the lock file.
+   Marker directories only produce \`candidates\`; an explicit first
+   \`--agent\` choice on \`install\` is anchored too. Once anchored, \`status\`
+   judges only those agents and \`install\` needs no \`--agent\`.
+
+3. \`${RUN} status\`
+   Read-only, optional. Reports the target agents, what is already
    installed, and anything that has drifted since it was installed. Always safe.
 
-3. \`${RUN} plan\`
+4. \`${RUN} plan\`
    Prints the exact set of changes and writes nothing. Every entry says what it
    would do and why. Show this to the user before applying.
 
-4. \`${RUN} apply --yes\`
+5. \`${RUN} apply --yes\`
    The scriptable name for the same write \`install\` performs — use it for
    re-runs and repairs. It refuses without \`--yes\`, and resolves which
    agent(s) to touch the same way \`install\` does (see step 1).
 
-5. \`${RUN} uninstall --yes\`
+6. \`${RUN} uninstall --yes\`
    Removes what the lock file records and reverts the managed config blocks.
 
 ## Flags

package/lib/settings.mjs

@@ -0,0 +1,77 @@
+// The anchored target agents: `sw-ecosystem-agentic-harness.json`, next to the lock (see
+// `lockDir()` in content.mjs).
+//
+// The lock records what was *installed*; this records what the project
+// *targets*. Marker directories only ever produce candidates — a stray empty
+// `.vscode/` must not make Copilot a target — so every command that has to
+// pick agents reads this file first. Only the CLI writes it, per checkout: it
+// lives in the ignored state directory, so each machine anchors once.
+
+import { dirname } from 'node:path';
+import { LOCK_DIR, lockDir } from './content.mjs';
+import {
+  abs, ensureDir, exists, readTextMaybe, removeDirIfEmpty, removeFile, writeAtomic,
+} from './fsx.mjs';
+import { AGENTS } from './hosts.mjs';
+
+const NAME = 'sw-ecosystem-agentic-harness.json';
+
+export function settingsFile(root) {
+  return `${lockDir(root)}/${NAME}`;
+}
+
+/** The pre-`var/` location; read only so an anchored project survives the move. */
+function legacyPath(root) {
+  return abs(root, `${LOCK_DIR}/${NAME}`);
+}
+
+/** The anchored agents, or null when nothing is anchored (or the file is unusable). */
+export function read(root) {
+  const found = readTextMaybe(abs(root, settingsFile(root))) ?? readTextMaybe(legacyPath(root));
+  if (found === null) return null;
+  let parsed;
+  try { parsed = JSON.parse(found.text); } catch { return null; }
+  const agents = (Array.isArray(parsed?.agents) ? parsed.agents : []).filter((a) => AGENTS.includes(a));
+  return agents.length ? { ...parsed, agents: [...new Set(agents)] } : null;
+}
+
+export function write(root, agents, source) {
+  const settings = {
+    schema: 1, agents: [...new Set(agents)], anchored_at: new Date().toISOString(), source,
+  };
+  const target = abs(root, settingsFile(root));
+  ensureDir(dirname(target));
+  writeAtomic(target, `${JSON.stringify(settings, null, 2)}\n`);
+  dropLegacy(root, target);
+  return settings;
+}
+
+function dropLegacy(root, target) {
+  const legacy = legacyPath(root);
+  if (legacy !== target && exists(legacy)) {
+    removeFile(legacy);
+    removeDirIfEmpty(dirname(legacy));
+  }
+}
+
+/** Move a settings file left at the old path to the current one. */
+export function migrate(root) {
+  const current = read(root);
+  if (current && legacyPath(root) !== abs(root, settingsFile(root)) && exists(legacyPath(root))) write(root, current.agents, current.source ?? 'chosen');
+}
+
+/** Drop agents from the targets; the file goes when none are left. */
+export function prune(root, removed) {
+  const current = read(root);
+  if (!current) return;
+  const left = current.agents.filter((a) => !removed.includes(a));
+  if (left.length === current.agents.length) return;
+  if (left.length) {
+    write(root, left, current.source ?? 'chosen');
+    return;
+  }
+  const target = abs(root, settingsFile(root));
+  removeFile(target);
+  removeDirIfEmpty(dirname(target));
+  dropLegacy(root, target);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@execuro-sw-ecosystem/sw-ecosystem-agentic-harness",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "Shopware 6 agentic harness: sw-* skills and sub-agents, plus an installer that writes them into Claude Code, Codex, GitHub Copilot and Cursor.",
   "license": "MIT",
   "author": "Execuro UG (haftungsbeschränkt)",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "sw-ecosystem-agentic-harness",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "Shopware 6 agentic harness: sw-* skills and sub-agents for requirements, specs, implementation, verification and documentation, with an installer CLI that writes them into Claude Code, Codex, GitHub Copilot and Cursor. The knowledge-base MCP and the editor tools are separate npm packages.",
   "author": {
     "name": "Execuro UG (haftungsbeschränkt)",

package/skills/sw-discover-tender/SKILL.md

@@ -1,68 +1,64 @@
 ---
 name: sw-discover-tender
-description: Analyse a client tender (RFP, RFI or RFQ) for a Shopware 6 project into one markdown sidecar, <source basename>-analysis.md. Every requirement row gets a class against the installed Shopware version (stock / config / plugin / custom), a three-point person-day estimate, one line of mechanism and proposed scope-lock assumptions the partner accepts by ticking checkboxes — in the file or on the Tender Discovery Tool page (`--editor`); the next run reconciles the ticks, dissolves answered questions and re-estimates. At Ready to submit it exports one CSV per client table with compliance, comment and effort filled in the client's columns. Scope and PD only — never costs, prices, licence fees or budgets. Never designs the solution — that's sw-design-solution.
-when_to_use: Trigger phrases — "scope this RFP", "analyse the tender", "answer the RFI", "discover RFP 0001", "continue RFP 0001", "reconcile RFP 0001", "export the response for RFP 0001", "is RFP 0001 ready to submit", "open RFP 0001 in the browser", "open the tender tool", "sw-discover-tender specs/rfp-0001-x-analysis.md --editor".
-argument-hint: '[tender file or folder of exports (.xlsx|.md|.txt|.csv|.pdf) | specs/rfp-NNNN-slug-analysis.md to continue] [--editor] [--batch <n|all>] [--export]'
+description: Turn a client's RFI/RFP/RFQ or project plan into confirmed Shopware scope in one working document, `specs/rfp-NNNN-slug-analysis.md`. An agent extracts every requirement into the tool's own three fixed tabs — Functional, Non-functional, Project & services — and 18-row Project information table; intake confirms itself and analysis starts automatically, corrected any time via row notes (move, skip, restore); each scope item gets a Requirement Coverage (OOTB, Configuration, Extension, ISV, Custom, or `—`), a confidence, a T-shirt-size or partner-profile effort figure, assumptions the operator accepts, and a Client Response — without an engineer. Runs on the runtime's own CLI and page (`--editor`); confirm, answer and export happen anytime, and the document reaches Ready when every scope item is confirmed. Exports as XLSX only — a surgical fit-back into the client's own workbook, or the tool's own multi-tab workbook for a CSV or PDF source. Scope and effort only — never costs, prices, licence fees or budgets. Never designs the solution — that's sw-design-solution.
+when_to_use: Trigger phrases — "scope this RFP", "analyse the tender", "answer the RFI", "discover RFP 0001", "continue RFP 0001", "export the response for RFP 0001", "is RFP 0001 ready", "open RFP 0001 in the browser", "open the tender tool", "sw-discover-tender specs/rfp-0001-x-analysis.md --editor".
+argument-hint: '[tender file (.xlsx|.csv|.pdf) | specs/rfp-NNNN-slug-analysis.md to continue] [--editor] [--export]'
 allowed-tools: Read Write Edit Glob Grep Agent AskUserQuestion Bash(ls *) Bash(mkdir -p specs) Bash(mkdir -p specs/.rfp *) Bash(shasum -a 256 *) Bash(npx -y @execuro-sw-ecosystem/sw-tender-discovery-tool@latest *) Bash(open *) Bash(xdg-open *) Bash(tail *) Bash(grep *) Bash(printf *) mcp__ShopwareDevKnowledgeBase__list_docs mcp__ShopwareDevKnowledgeBase__grep_docs mcp__ShopwareDevKnowledgeBase__read_doc mcp__ShopwareDevKnowledgeBase__kb_status
 ---
 
 # sw-discover-tender
 
-One markdown sidecar per tender, `<source basename>-analysis.md`: class, three-point PD, mechanism and proposed assumptions per requirement row. The partner ticks, the next run reconciles. At Ready to submit: one response CSV per client table.
+One working document per tender: Requirement Coverage, confidence, effort, assumptions and a Client Response per scope item. The operator confirms; the next run reconciles. Export to XLSX anytime.
+
+Requires the runtime at `sw-tender-discovery-tool` >= 0.2.0 — the working-document grammar below is a 0.2.0 contract; `sw-setup` keeps it current with `@latest`, so a project on an older runtime should re-run `sw-setup` first.
 
 ## Boundaries
 
-- PD only. No costs, prices, rates, licence, hosting, PSP or CMP fees, no budget comparison. A stated budget is quoted in §1.1 as context.
-- Never edit the client's file. Never read a hidden sheet or anything whose name starts with `_`; name it in §1.3 as ignored. Pass this to every agent.
-- Assumption lines are written as `[ ]` only. `accepted` exists solely as the result of a human `[x]`.
-- A vague row gets a client question (`CQ-n`) or a proposed assumption, never a silent guess.
-- One line of mechanism per row. Design belongs to `sw-design-solution`.
-- Markdown and CSV out, plus the response workbook the tender tool writes as a **copy** of the client's file. The skill owns no executable: the workbook is read and written by the tender tool's own zero-dependency reader. The client's original is never touched, no docx is written, nothing is sent.
+- Scope and effort only. The tool never produces a figure of its own — no cost, price, rate, licence, hosting or PSP fee, no budget — `reference/estimation-model.md`'s money rule. A client's or the operator's own figure in Project information is kept verbatim; a coverage choice with a cost consequence gets a one-line `cost:` reference, no amount. Elsewhere a client-stated budget is never recorded, not even as quoted context.
+- Never edit the client's file. A hidden sheet or one whose name starts with `_` is never read and never mentioned anywhere — not in section 1, not in Not taken, not in the digest.
+- Assumptions are proposed by agents, accepted or rejected only by the operator. A rejected proposal is never proposed again.
+- A requirement too vague to assess gets a client question (`CQ-n`), never a silent guess.
+- No QA agent anywhere in the flow. Three agents only: `sw-tender-editor`, `sw-product-manager`, `sw-shopware-architect`.
+- XLSX out only, via the runtime's own writer: a surgical fit-back into the client's own workbook, or a multi-tab working-sheet export for csv/pdf. The client's original is never touched, nothing is sent. No per-requirement CSV of any kind is written.
 
 ## Inputs
 
 | Argument | Behaviour |
 | --- | --- |
-| `.md` / `.txt` / `.csv` / `.pdf`, or a folder of such exports | New tender: extract, analyse, write `<basename>-analysis.md` next to the source |
-| `.xlsx` | Import first, per `reference/procedure.md` step 1 ".xlsx import": `npx -y @execuro-sw-ecosystem/sw-tender-discovery-tool@latest import` proposes a mapping (install gate: `reference/editor-session.md` §0), confirmed via `--editor` or a one-line yes/no, before the normalised source and the analysis are set. A refusal (encrypted, `.xls`, `.xlsb`) is relayed verbatim and the run stops |
-| `.docx` | Stop. One line: export every requirement table as CSV UTF-8 (or paste it as markdown tables, header row kept) and rerun with that file or folder |
-| `*-analysis.md` | Continue: reconcile, advance, rewrite in place |
-| `--export`, or "export the response for RFP NNNN" | Continue, then run step 9 if the gate holds |
-| `--editor` | Hand off to `reference/editor-session.md` in this skill's directory as the very first action and stop when it returns; nothing is read, reconciled or analysed before the page is open |
-| `--editor-session <url> --batch-file <file>` / `--analyze` | Editor mode (section below), spawned by the editor session |
-| `--batch <n>` / `--batch all` | How many requirement rows one estimate run covers. Default 50. `all` = the whole document in a single run (no estimate groups). Stored in the frontmatter as `batch:` and reused by every later run on that analysis until the flag is given again |
-| nothing | Ask for the path in one line and end |
+| `.xlsx` / `.csv` | Import first (`reference/procedure.md` step 1): `npx -y @execuro-sw-ecosystem/sw-tender-discovery-tool@latest import --source <file>` writes `import-digest.md` (install gate: `reference/editor-session.md` §0). `sw-tender-editor` runs its `extract` job on the digest and returns the extraction JSON; the skill saves it and runs `intake <doc> --source <file> --extraction <json>`. Every source runs the same extract-then-intake flow — xlsx, csv and pdf alike. A refusal (encrypted, `.xls`, `.xlsb`) is relayed verbatim and the run stops. |
+| `.pdf` | New tender: `sw-tender-editor` runs its `extract` job on the PDF directly; the skill saves the JSON and runs `intake <doc> --source <pdf> --extraction <json>`. |
+| `.docx` or another format | Stop. One line: export the requirement table as CSV/xlsx or the prose as PDF, and rerun with that file. |
+| `*-analysis.md` | Intake already confirmed itself and queued analysis: work the chunks until none are left (`reference/procedure.md` step 2), then `check --write`, `report`. An old document still at `intake: review` needs `intake-confirm` first, on the operator's go; no separate Analyze step ever exists. |
+| `--export`, or "export the response for RFP NNNN" | Continue, then `export`. |
+| `--editor` | Hand off to `reference/editor-session.md` as the very first action and stop when it returns; nothing is read or assessed before the page is open. |
+| `--editor-session <url> --batch-file <file>` / `--intake` | Editor mode, spawned by the editor session (`reference/editor-session.md`). |
+| nothing | Ask for the path in one line and end. |
 
 ## Files
 
-- **Analysis** `<source basename>-analysis.md`, next to the source. Recommended: `specs/rfp-NNNN-slug.<ext>` → `specs/rfp-NNNN-slug-analysis.md`. Committed. Structure: `reference/analysis-template.md` in this skill's directory; the nine section numbers, the four §1 subsection numbers and every title are fixed.
-- **Source export** `<source dir>/<basename>/<pos>-<sheet-slug>.csv` plus `import-map.json`, written by the tender tool's `import` from the confirmed mapping. Committed; they are what the analysis reads, hashes and exports from.
-- **Response** `<source basename>-response-<n>-<table-slug>.csv`, one per client table. Committed, generated, never hand-edited.
-- **Work** `specs/.rfp/<slug>/`: `map-<t>.md`, `context-<t>.md`, `context.md`, `meta.md`, `params.md`, `migration.md`, `integrations.md`, `glossary.md`, `C<n>.md`, `pm-C<n>.md`, `arch-common.md`, `arch-C<n>.md`, `qa.md`, `rows-C<n>.md`, `tail-C<n>.md`, `resp-common.md`, `resp-C<n>.csv`. Gitignored.
-- **Editor session** `specs/.editor/<slug>/`, written by the Tender Discovery Tool. Gitignored; never hand-edited.
-- **Profile** `specs/rfp-partner-profile.md`. Missing: write the template from `estimation-model.md` with `_TBD_` and add a `high` `Q-n` to fill it. `_TBD_` overhead or buffer: PD final is stated before both, §2 says so.
-
-## Procedure
-
-**0. Mode.** `--editor` → `reference/editor-session.md`, per the Inputs row above, and stop there. `--editor-session` → work through `reference/procedure.md` under `reference/editor-session.md`'s *Editor mode* rules.
+- **Working document** `specs/rfp-NNNN-slug-analysis.md`, next to the source. Committed. Grammar: `reference/analysis-template.md` — 8 fixed sections, section 4 header, cell lists, frontmatter.
+- **Fit-back map** (xlsx sources only) `<srcdir>/<base>/import-map.json`, written by `intake`. Committed. No per-table CSVs are written.
+- **Response** `<source basename>-response-v<n>.xlsx` (never overwritten). Committed, generated, never hand-edited.
+- **Work** `specs/.rfp/<slug>/`: `extraction.json` (the `extract` job's result), `proposals.json`, `reestimate.json`, `last-run.json`, `reports/*.json` (saved architect reports before `apply`). Gitignored.
+- **Editor session** `specs/.editor/<slug>/`: `import-snapshot.json`, `import-map.proposed.json`, `import-digest.md`, written by the Tender Discovery Tool. Gitignored.
+- **Partner profile** `specs/rfp-partner-profile.md`. Missing: the page offers the wizard (skippable); without it the document runs in T-shirt regime (`reference/estimation-model.md`).
 
 ## Reference files
 
-All under `reference/` in this skill's directory. Work through them, in order, for a run:
+All under `reference/` in this skill's directory:
 
 | File | When | What it decides |
 | --- | --- | --- |
-| `procedure.md` | every run | steps 1–9: target/source, reconcile, extract, ground truth, fan out, questions, estimate/score/write, the 8-line report, export; delegation, batch size, staged writes |
-| `agent-briefs.md` | step 5 (fan out), step 9 (export) | PM, architect, QA, extract, rows, splice, response, assemble briefs; parallelism, caps, delivery rules |
-| `editor-session.md` | `--editor` / `--editor-session` in the arguments | the session loop; its "Editor mode" section: batch kinds, tick grammar, notes handling, preserve rules |
-| `analysis-template.md` | writing or reading the analysis file | frontmatter, the nine sections, row and status grammar |
-| `context-parameters.md` | steps 4 and 6, §1.2 | the P-01…P-50 key-parameter template, estimate-driving flags, missing-parameter question stubs |
-| `confidence-rubric.md` | step 7 | dimensions, bands, status rule, honesty rules |
-| `estimation-model.md` | steps 2, 5, 7 | three-point, levels, assumption deltas, folding, partner-profile template |
-| `client-question-rules.md` | step 6 | vague-row detectors, blocking, wording, cap, answers |
-| `assumption-catalogue.md` | step 5 (architect brief) | reusable scope-lock statements by theme |
-| `coverage-mapping.md` | step 5 (architect brief), step 9 | class → client token, synonyms, edition tiers |
-| `response-rules.md` | step 9 (export) | the response CSV rules (`RSP-1` … `RSP-7`), verbatim for the sub agent brief |
-| `editor-mode.md` | harness maintenance only | pending harness edits for this skill; not part of a run |
+| `procedure.md` | every run | the seven steps: intake (extract + intake), assess, propose, estimate, confirm, answer, export; the three agents, applying a report, the run close |
+| `agent-briefs.md` | steps 2-4 | one brief per agent, its tools, its delivery |
+| `editor-session.md` | `--editor` / `--editor-session` in the arguments | the session loop, batch kinds, the subagent brief, close report |
+| `analysis-template.md` | writing or reading the working document | frontmatter, the 8 sections, section 4 grammar, section 5 blocks |
+| `project-information.md` | step 1, section 1 | the 18 Project information keys, what each captures, which estimate it informs |
+| `context-parameters.md` | steps 1-2, section 1 | version/edition/plan detection from the Dev Knowledge Base only, what every agent receives |
+| `coverage-mapping.md` | step 2 | the six Requirement Coverage values, the client-token map, ISV research |
+| `estimation-model.md` | steps 3-4 | the two regimes, default scale, size-up drivers, not-decomposed rule, totals, money rule, the profile file |
+| `client-question-rules.md` | step 3, step 6 | when a scope item gets a `CQ-n`, wording, answering |
+| `assumption-catalogue.md` | step 3 (architect brief) | reusable assumption statements by key, with the effort each saves |
+| `response-rules.md` | step 7 (export) | X-1…X-7, what the runtime's `export` writes |
 
-No scripts: the skill ships no executable. The tender tool's `import --source <file>` and `export --xlsx --source <file>` commands read and write the workbook.
+The skill ships no executable of its own: the runtime's `import`, `intake`, `intake-confirm`, `move`, `skip`, `restore`, `info`, `apply`, `confirm`/`accept`/`reject`/`assume`/`unassume`/`answer`/`patch`/`profile`, `check`, `report` and `export` commands read and write the working document and the workbook.