@guilz-dev/sdlc-gh 0.1.0

package/sample/ts/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "harness-sample-ts",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "lint": "biome check src tests",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^1.9.0",
+    "typescript": "^5.7.0",
+    "vitest": "^3.0.0"
+  }
+}

package/sample/ts/src/add.ts

@@ -0,0 +1,3 @@
+export function add(a: number, b: number): number {
+	return a + b;
+}

package/sample/ts/tests/add.test.ts

@@ -0,0 +1,8 @@
+import { describe, expect, it } from "vitest";
+import { add } from "../src/add.js";
+
+describe("add", () => {
+	it("sums two numbers", () => {
+		expect(add(2, 3)).toBe(5);
+	});
+});

package/sample/ts/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "noEmit": true,
+    "rootDir": ".",
+    "skipLibCheck": true
+  },
+  "include": ["src/**/*", "tests/**/*"]
+}

package/scripts/aggregate-harness-review.mjs

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+/**
+ * Aggregate telemetry artifacts and emit nightly harness review summary.
+ */
+import { appendFileSync, mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+import {
+  buildHarnessReviewSummary,
+  formatHarnessReviewMarkdown,
+  REVIEW_OUT_DIR,
+} from "./lib/harness-review.mjs";
+import { DEFAULT_COLLECT_DIR, loadTelemetryJsonFiles } from "./fetch-telemetry-artifacts.mjs";
+
+function main() {
+  const inputDir = process.env.TELEMETRY_COLLECT_DIR || DEFAULT_COLLECT_DIR;
+  const outDir = process.env.HARNESS_REVIEW_OUT_DIR || REVIEW_OUT_DIR;
+  const windowHours = Number(process.env.WINDOW_HOURS || 24);
+  const repo = process.env.GITHUB_REPOSITORY || "unknown/unknown";
+
+  const records = loadTelemetryJsonFiles(inputDir);
+  const summary = buildHarnessReviewSummary(records, {
+    repo,
+    windowHours,
+  });
+  const markdown = formatHarnessReviewMarkdown(summary);
+
+  mkdirSync(outDir, { recursive: true });
+  const jsonPath = join(outDir, "harness-review-summary.json");
+  const mdPath = join(outDir, "harness-review-summary.md");
+  writeFileSync(jsonPath, `${JSON.stringify(summary, null, 2)}\n`, "utf8");
+  writeFileSync(mdPath, markdown, "utf8");
+
+  console.log(`Wrote ${jsonPath}`);
+  console.log(`Wrote ${mdPath}`);
+  console.log(
+    `::notice::classified_failure_groups=${summary.rollup.failure_groups} telemetry_records=${summary.rollup.telemetry_records}`,
+  );
+
+  const stepSummaryPath = process.env.GITHUB_STEP_SUMMARY;
+  if (stepSummaryPath) {
+    appendFileSync(stepSummaryPath, `${markdown}\n`, "utf8");
+  }
+}
+
+const isMain =
+  process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href;
+if (isMain) main();

package/scripts/bootstrap-harness.sh

@@ -0,0 +1,411 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REPO=""
+STACK=""
+MODE=""
+CODEOWNERS_TEAM=""
+YES=0
+TEMPLATE_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+
+stack_field() {
+  node --input-type=module -e "
+    import { getStack } from 'file://${TEMPLATE_ROOT}/scripts/lib/stacks.mjs';
+    const s = getStack(process.argv[1]);
+    console.log(s[process.argv[2]]);
+  " "$STACK" "$1"
+}
+
+stack_ids() {
+  node --input-type=module -e "
+    import { stackIds } from 'file://${TEMPLATE_ROOT}/scripts/lib/stacks.mjs';
+    console.log(stackIds().join(' '));
+  "
+}
+
+usage() {
+  local ids
+  ids="$(stack_ids | tr ' ' '|')"
+  cat <<EOF
+Usage: $0 [--repo <path>] [--stack <${ids}>] [--mode new|existing] [--codeowners-team @org/team] [--yes]
+EOF
+  exit 1
+}
+
+validate_stack() {
+  node --input-type=module -e "
+    import { getStack } from 'file://${TEMPLATE_ROOT}/scripts/lib/stacks.mjs';
+    getStack(process.argv[1]);
+  " "$1" >/dev/null 2>&1
+}
+
+detect_repo() {
+  if [[ -n "$REPO" ]]; then
+    return
+  fi
+
+  local git_root=""
+  git_root="$(git rev-parse --show-toplevel 2>/dev/null || true)"
+  if [[ -n "$git_root" ]] && [[ "$(cd "$git_root" && pwd)" != "$TEMPLATE_ROOT" ]]; then
+    REPO="$git_root"
+  else
+    REPO="$PWD"
+  fi
+}
+
+detect_stack_json() {
+  node --input-type=module -e "
+    import { detectStackCandidates } from 'file://${TEMPLATE_ROOT}/scripts/lib/stacks.mjs';
+    console.log(JSON.stringify(detectStackCandidates(process.argv[1])));
+  " "$REPO"
+}
+
+stack_suggested() {
+  node --input-type=module -e "
+    const input = JSON.parse(process.argv[1]);
+    console.log(input.suggested ?? '');
+  " "$1"
+}
+
+stack_candidates() {
+  node --input-type=module -e "
+    const input = JSON.parse(process.argv[1]);
+    const ids = [...new Set([...input.rootMatches, ...input.nestedMatches].map((m) => m.stackId))];
+    console.log(ids.join(' '));
+  " "$1"
+}
+
+stack_summary() {
+  node --input-type=module -e "
+    const input = JSON.parse(process.argv[1]);
+    for (const match of input.rootMatches) console.log(\`root:\${match.stackId}:\${match.path}\`);
+    for (const match of input.nestedMatches) console.log(\`nested:\${match.stackId}:\${match.path}\`);
+  " "$1"
+}
+
+prompt_stack() {
+  local detected_json suggested candidates answer
+  detected_json="$(detect_stack_json)"
+  suggested="$(stack_suggested "$detected_json")"
+  candidates="$(stack_candidates "$detected_json")"
+
+  if [[ -n "$suggested" ]]; then
+    STACK="$suggested"
+    echo "Detected stack: $STACK"
+    return
+  fi
+
+  if [[ -n "$candidates" ]]; then
+    echo "Detected stack candidates:"
+    stack_summary "$detected_json"
+    if [[ "$YES" -eq 1 ]]; then
+      echo "Unable to infer a single stack. Re-run with --stack." >&2
+      exit 1
+    fi
+    read -r -p "Choose stack [${candidates// /, }]: " answer
+  else
+    if [[ "$YES" -eq 1 ]]; then
+      echo "Unable to detect a stack. Re-run with --stack." >&2
+      exit 1
+    fi
+    read -r -p "Stack not detected. Choose stack [$(stack_ids | tr ' ' ', ')]: " answer
+  fi
+
+  if ! validate_stack "$answer"; then
+    echo "Unknown stack: $answer" >&2
+    exit 1
+  fi
+  STACK="$answer"
+}
+
+detect_mode_json() {
+  node --input-type=module -e "
+    import { inspectRepoMode } from 'file://${TEMPLATE_ROOT}/scripts/lib/stacks.mjs';
+    console.log(JSON.stringify(inspectRepoMode(process.argv[1])));
+  " "$REPO"
+}
+
+mode_field() {
+  node --input-type=module -e "
+    const input = JSON.parse(process.argv[1]);
+    console.log(input[process.argv[2]] ?? '');
+  " "$1" "$2"
+}
+
+prompt_mode() {
+  local detected_json suggested ambiguous reason answer
+  detected_json="$(detect_mode_json)"
+  suggested="$(mode_field "$detected_json" suggested)"
+  ambiguous="$(mode_field "$detected_json" ambiguous)"
+  reason="$(mode_field "$detected_json" reason)"
+
+  if [[ -n "$suggested" ]] && [[ "$ambiguous" != "true" ]]; then
+    MODE="$suggested"
+    echo "Detected mode: $MODE ($reason)"
+    return
+  fi
+
+  if [[ "$YES" -eq 1 ]]; then
+    echo "Unable to infer mode safely ($reason). Re-run with --mode." >&2
+    exit 1
+  fi
+
+  echo "Mode requires confirmation: $reason"
+  read -r -p "Choose mode [new/existing]: " answer
+  case "$answer" in
+    new|existing) MODE="$answer" ;;
+    *) echo "Unknown mode: $answer" >&2; exit 1 ;;
+  esac
+}
+
+prompt_codeowners_team() {
+  local answer
+  if [[ -n "$CODEOWNERS_TEAM" ]]; then
+    return
+  fi
+
+  if [[ "$YES" -eq 1 ]]; then
+    echo "--codeowners-team is required with --yes." >&2
+    exit 1
+  fi
+
+  read -r -p "CODEOWNERS team [@org/team or @username]: " answer
+  if [[ ! "$answer" =~ ^@[^/]+/[^/]+$ ]] && [[ ! "$answer" =~ ^@[A-Za-z0-9_.-]+$ ]]; then
+    echo "Expected @org/team or @username format." >&2
+    exit 1
+  fi
+  CODEOWNERS_TEAM="$answer"
+}
+
+confirm_summary() {
+  [[ "$YES" -eq 1 ]] && return
+
+  local profile product_ci sample_dir
+  profile="$(stack_field profile)"
+  product_ci="$(stack_field workflow)"
+  sample_dir="$(stack_field sampleDir)"
+
+  cat <<EOF
+Bootstrap summary
+  repo: $REPO
+  stack: $STACK
+  mode: $MODE
+  CODEOWNERS team: $CODEOWNERS_TEAM
+  profile: $profile
+  workflow: $product_ci
+  sample copy: $([[ "$MODE" == "new" ]] && echo "sample/$sample_dir -> repo root" || echo "disabled")
+EOF
+  read -r -p "Proceed? [y/N]: " answer
+  case "$answer" in
+    y|Y|yes|YES) ;;
+    *) echo "Cancelled."; exit 1 ;;
+  esac
+}
+
+resolve_github_repo_name() {
+  if ! command -v gh >/dev/null 2>&1; then
+    return 1
+  fi
+  gh repo view --json nameWithOwner 2>/dev/null \
+    | node --input-type=module -e "
+      const chunks = [];
+      for await (const chunk of process.stdin) chunks.push(chunk);
+      const text = chunks.join('').trim();
+      if (!text) process.exit(1);
+      const parsed = JSON.parse(text);
+      if (!parsed.nameWithOwner) process.exit(1);
+      console.log(parsed.nameWithOwner);
+    " 2>/dev/null
+}
+
+print_next_step() {
+  local setup_cmd
+  if [[ -d "$REPO/.git" ]] || git -C "$REPO" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+    if (cd "$REPO" && resolve_github_repo_name >/dev/null); then
+      setup_cmd="./scripts/setup-wizard.mjs --yes --stack $STACK --codeowners $CODEOWNERS_TEAM"
+    else
+      setup_cmd="./scripts/setup-wizard.mjs --yes --stack $STACK --codeowners $CODEOWNERS_TEAM --github-repo OWNER/REPO"
+    fi
+  else
+    setup_cmd="./scripts/setup-wizard.mjs --yes --stack $STACK --codeowners $CODEOWNERS_TEAM --github-repo OWNER/REPO"
+  fi
+
+  echo "Next: npx @guilz-dev/sdlc-gh --yes --stack $STACK --codeowners $CODEOWNERS_TEAM"
+  echo "      Or: $setup_cmd"
+  echo "      Or: ./scripts/setup-github.sh --yes (after reviewing CODEOWNERS and .harness-stack)"
+  echo "      Replace OWNER/REPO with your GitHub repository if auto-detection is unavailable."
+}
+
+replace_codeowners_placeholder() {
+  node --input-type=module -e "
+    import { readFileSync, writeFileSync } from 'node:fs';
+    const path = process.argv[1];
+    const team = process.argv[2];
+    const current = readFileSync(path, 'utf8');
+    writeFileSync(path, current.replaceAll('@your-org/harness-engineers', team));
+  " "$1" "$CODEOWNERS_TEAM"
+}
+
+copy_tree() {
+  local src="$1" dst="$2"
+  mkdir -p "$dst"
+  if command -v rsync &>/dev/null; then
+    rsync -a \
+      --exclude 'node_modules' \
+      --exclude '__pycache__' \
+      --exclude '.pytest_cache' \
+      --exclude '.vite' \
+      --exclude 'vendor' \
+      --exclude '.bundle' \
+      "$src/" "$dst/"
+  else
+    local item base
+    shopt -s dotglob nullglob
+    for item in "$src"/*; do
+      base="$(basename "$item")"
+      case "$base" in
+        node_modules|__pycache__|.pytest_cache|.vite|vendor|.bundle) continue ;;
+      esac
+      cp -R "$item" "$dst/"
+    done
+    shopt -u dotglob nullglob
+  fi
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --repo) REPO="$2"; shift 2 ;;
+    --stack) STACK="$2"; shift 2 ;;
+    --mode) MODE="$2"; shift 2 ;;
+    --codeowners-team) CODEOWNERS_TEAM="$2"; shift 2 ;;
+    --yes) YES=1; shift ;;
+    *) usage ;;
+  esac
+done
+
+detect_repo
+
+if [[ -n "$STACK" ]] && ! validate_stack "$STACK"; then
+  echo "Unknown stack: $STACK" >&2
+  usage
+fi
+
+[[ -n "$STACK" ]] || prompt_stack
+
+case "$MODE" in
+  "" ) prompt_mode ;;
+  new|existing) ;;
+  * ) echo "Unknown mode: $MODE" >&2; usage ;;
+esac
+
+prompt_codeowners_team
+confirm_summary
+
+[[ ! -d "$REPO" ]] && mkdir -p "$REPO"
+
+PROFILE="$(stack_field profile)"
+PRODUCT_CI="$(stack_field workflow)"
+SAMPLE_DIR="$(stack_field sampleDir)"
+
+echo "Bootstrapping harness into $REPO (stack=$STACK, mode=$MODE)"
+
+# Core docs
+mkdir -p "$REPO/docs" "$REPO/docs/exceptions"
+for f in operations.md adoption.md auth-boundaries.md failure-taxonomy.md telemetry-schema.md telemetry-artifacts.md nightly-harness-review.md gh-aw-dogfood.md \
+  shared-config.md coding-agent-l1.md kpi-baseline.md revert-playbook.md; do
+  cp "$TEMPLATE_ROOT/docs/$f" "$REPO/docs/" 2>/dev/null || true
+done
+cp "$TEMPLATE_ROOT/docs/exceptions/README.md" "$REPO/docs/exceptions/" 2>/dev/null || true
+cp "$TEMPLATE_ROOT/docs/exceptions/TEMPLATE.md" "$REPO/docs/exceptions/" 2>/dev/null || true
+cp "$TEMPLATE_ROOT/docs/arch.md" "$REPO/docs/" 2>/dev/null || true
+cp "$TEMPLATE_ROOT/AGENTS.md" "$REPO/"
+cp "$TEMPLATE_ROOT/README.md" "$REPO/HARNESS_README.md" 2>/dev/null || true
+mkdir -p "$REPO/config"
+cp "$TEMPLATE_ROOT/config/stacks.json" "$REPO/config/"
+
+# .github harness assets
+mkdir -p "$REPO/.github"
+copy_tree "$TEMPLATE_ROOT/.github/agents" "$REPO/.github/agents"
+copy_tree "$TEMPLATE_ROOT/.github/hooks" "$REPO/.github/hooks"
+copy_tree "$TEMPLATE_ROOT/.github/ISSUE_TEMPLATE" "$REPO/.github/ISSUE_TEMPLATE"
+copy_tree "$TEMPLATE_ROOT/.github/skills" "$REPO/.github/skills"
+cp "$TEMPLATE_ROOT/.github/copilot-instructions.md" "$REPO/.github/"
+cp "$TEMPLATE_ROOT/.github/labels.yml" "$REPO/.github/"
+cp "$TEMPLATE_ROOT/.github/pull_request_template.md" "$REPO/.github/"
+cp "$TEMPLATE_ROOT/.github/CODEOWNERS" "$REPO/.github/"
+replace_codeowners_placeholder "$REPO/.github/CODEOWNERS"
+cp "$TEMPLATE_ROOT/.github/ruleset.example.json" "$REPO/.github/" 2>/dev/null || true
+
+mkdir -p "$REPO/.github/instructions/profiles"
+cp "$TEMPLATE_ROOT/.github/instructions/core.instructions.md" "$REPO/.github/instructions/"
+cp "$TEMPLATE_ROOT/.github/instructions/profiles/$PROFILE" "$REPO/.github/instructions/profiles/"
+
+# Workflows — core + selected stack product CI + phase 2–4
+mkdir -p "$REPO/.github/workflows"
+for wf in harness-ci.yml copilot-setup-steps.yml l1-readiness-check.yml pr-context-comment.yml eval-ci.yml eval-drift.yml \
+  agent-retry-orchestrator.yml harness-sync.yml labels-sync.yml nightly-harness-review.yml gh-aw-dogfood-ci.yml; do
+  cp "$TEMPLATE_ROOT/.github/workflows/$wf" "$REPO/.github/workflows/"
+done
+cp "$TEMPLATE_ROOT/.github/workflows/$PRODUCT_CI" "$REPO/.github/workflows/"
+node "$TEMPLATE_ROOT/scripts/trim-harness-ci.mjs" "$STACK" "$REPO/.github/workflows/harness-ci.yml"
+for aw in nightly-harness-review.md weekly-redteam.md nightly-harness-review.lock.yml weekly-redteam.lock.yml; do
+  cp "$TEMPLATE_ROOT/.github/workflows/$aw" "$REPO/.github/workflows/" 2>/dev/null || true
+done
+cp "$TEMPLATE_ROOT/.github/ruleset.harness-eval.example.json" "$REPO/.github/" 2>/dev/null || true
+
+# Scripts
+mkdir -p "$REPO/scripts/lib"
+for s in validate-harness.mjs check-diff-size.mjs check-issue-spec.mjs select-eval-jobs.mjs \
+  check-e2e-manifest.mjs validate-telemetry.mjs emit-telemetry-artifact.mjs fetch-telemetry-artifacts.mjs \
+  aggregate-harness-review.mjs route-harness-review.mjs check-l1-readiness.mjs check-gh-aw-dogfood-scope.mjs validate-gh-aw-compile.mjs \
+  emit-gh-aw-dogfood-report.mjs check-open-pr-limit.mjs merge-harness-package.mjs test-hooks-scenarios.mjs test-issue-spec-scenarios.mjs \
+  test-diff-size-scenarios.mjs test-e2e-manifest-scenarios.mjs test-setup-github-scenarios.mjs test-doctor-scenarios.mjs \
+  test-telemetry-artifact-scenarios.mjs test-harness-review-scenarios.mjs test-harness-review-routing-scenarios.mjs test-gh-aw-dogfood-scenarios.mjs \
+  test-bootstrap-guidance-scenarios.mjs test-merge-harness-package-scenarios.mjs test-l1-readiness-scenarios.mjs test-setup-wizard-scenarios.mjs \
+  harness-drift-report.mjs check-eval-score-drift.mjs run-e2e-bench.mjs doctor.mjs setup-github.mjs setup-wizard.mjs sdlc-gh-cli.mjs test-npm-package-scenarios.mjs; do
+  cp "$TEMPLATE_ROOT/scripts/$s" "$REPO/scripts/" 2>/dev/null || true
+done
+for s in bootstrap-harness.sh setup-github.sh verify-bootstrap-stacks.sh; do
+  cp "$TEMPLATE_ROOT/scripts/$s" "$REPO/scripts/" 2>/dev/null || true
+done
+for s in stacks.mjs harness-ci-fragments.mjs ccsd-contract.mjs github-config.mjs diff-size.mjs e2e-manifest.mjs \
+  doctor-local.mjs bootstrap-copy.mjs l1-readiness.mjs merge-harness-package.mjs telemetry-artifact.mjs harness-review.mjs harness-review-routing.mjs gh-aw-dogfood.mjs setup-wizard.mjs template-root.mjs npm-package.mjs; do
+  cp "$TEMPLATE_ROOT/scripts/lib/$s" "$REPO/scripts/lib/" 2>/dev/null || true
+done
+cp "$TEMPLATE_ROOT/scripts/trim-harness-ci.mjs" "$REPO/scripts/" 2>/dev/null || true
+node "$TEMPLATE_ROOT/scripts/merge-harness-package.mjs" "$TEMPLATE_ROOT/package.json" "$REPO/package.json"
+chmod +x "$REPO/scripts/"*.mjs "$REPO/scripts/"*.sh 2>/dev/null || true
+
+# Sample for new projects
+if [[ "$MODE" == "new" ]]; then
+  copy_tree "$TEMPLATE_ROOT/sample/$SAMPLE_DIR" "$REPO/"
+fi
+
+# Evals and prompts
+mkdir -p "$REPO/evals/trajectories" "$REPO/evals/e2e-bench" "$REPO/prompts"
+cp "$TEMPLATE_ROOT/evals/e2e-bench/manifest.json" "$REPO/evals/e2e-bench/" 2>/dev/null || true
+cp "$TEMPLATE_ROOT/evals/e2e-bench/README.md" "$REPO/evals/e2e-bench/" 2>/dev/null || true
+mkdir -p "$REPO/evals/e2e-bench/tasks"
+cp "$TEMPLATE_ROOT/evals/e2e-bench/tasks/"*.yml "$REPO/evals/e2e-bench/tasks/" 2>/dev/null || true
+cp "$TEMPLATE_ROOT/evals/trajectories/test_harness_conventions.py" "$REPO/evals/trajectories/" 2>/dev/null || true
+cp "$TEMPLATE_ROOT/evals/trajectories/rubric.md" "$REPO/evals/trajectories/" 2>/dev/null || true
+cp "$TEMPLATE_ROOT/evals/.score-baseline.json" "$REPO/evals/" 2>/dev/null || true
+cp "$TEMPLATE_ROOT/prompts/"*.prompt.yml "$REPO/prompts/" 2>/dev/null || true
+
+# Stack marker for documentation
+echo "$STACK" > "$REPO/.harness-stack"
+
+# Infra optional copy
+mkdir -p "$REPO/infra/langfuse" "$REPO/infra/otel" "$REPO/infra/samples"
+cp "$TEMPLATE_ROOT/infra/langfuse/docker-compose.yml" "$REPO/infra/langfuse/" 2>/dev/null || true
+cp "$TEMPLATE_ROOT/infra/otel/collector-config.yml" "$REPO/infra/otel/" 2>/dev/null || true
+cp "$TEMPLATE_ROOT/infra/README.md" "$REPO/infra/" 2>/dev/null || true
+cp "$TEMPLATE_ROOT/infra/samples/telemetry-payload.json" "$REPO/infra/samples/" 2>/dev/null || true
+cp "$TEMPLATE_ROOT/infra/samples/telemetry-artifact.json" "$REPO/infra/samples/" 2>/dev/null || true
+cp "$TEMPLATE_ROOT/infra/samples/gh-aw-dogfood-report.json" "$REPO/infra/samples/" 2>/dev/null || true
+cp "$TEMPLATE_ROOT/infra/samples/harness-review-summary.json" "$REPO/infra/samples/" 2>/dev/null || true
+cp "$TEMPLATE_ROOT/infra/samples/harness-review-routing-plan.json" "$REPO/infra/samples/" 2>/dev/null || true
+
+echo "Done. Stack=$STACK mode=$MODE"
+print_next_step
+echo "Then: ./scripts/doctor.mjs --strict"

package/scripts/check-diff-size.mjs

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+/**
+ * Diff size and autonomy gate for PRs.
+ */
+import { execSync } from "node:child_process";
+import { evaluateDiffSize, parseLabelInput } from "./lib/diff-size.mjs";
+
+const labels = parseLabelInput(process.env.PR_LABELS || process.argv[2] || "");
+const l1HardFail = process.env.DIFF_SIZE_L1_HARD_FAIL === "1";
+
+const base = process.env.BASE_SHA || "origin/main";
+const diffRange = `${base}...HEAD`;
+
+function git(cmd) {
+  return execSync(cmd, { encoding: "utf8" }).trim();
+}
+
+let numstat;
+try {
+  numstat = git(`git diff --numstat ${diffRange}`);
+} catch {
+  numstat = git("git diff --numstat HEAD~1...HEAD");
+}
+
+let diffFiles;
+try {
+  diffFiles = git(`git diff --name-only ${diffRange}`).split("\n").filter(Boolean);
+} catch {
+  diffFiles = git("git diff --name-only HEAD~1...HEAD").split("\n").filter(Boolean);
+}
+
+const result = evaluateDiffSize({ labels, numstatText: numstat, diffFiles, l1HardFail });
+
+console.log(result.summary);
+
+if (result.overLimit && result.overLimitMessage) {
+  if (result.mode === "hard-fail") {
+    console.error(`::error::${result.overLimitMessage}`);
+    process.exit(1);
+  }
+  console.warn(`::warning::${result.overLimitMessage} — split recommended`);
+}
+
+for (const warning of result.sensitiveWarnings) {
+  console.warn(`::warning::${warning}`);
+}

package/scripts/check-e2e-manifest.mjs

@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+/** Verify e2e-bench manifest freshness and structural integrity */
+import { readdirSync, readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { validateManifest } from "./lib/e2e-manifest.mjs";
+
+const manifestPath = join(process.cwd(), "evals/e2e-bench/manifest.json");
+const tasksDir = join(process.cwd(), "evals/e2e-bench/tasks");
+
+if (!existsSync(manifestPath)) {
+  console.error("Missing evals/e2e-bench/manifest.json");
+  process.exit(1);
+}
+
+const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+const taskFileIds = existsSync(tasksDir)
+  ? readdirSync(tasksDir)
+      .filter((name) => name.endsWith(".yml"))
+      .map((name) => name.replace(/\.yml$/, ""))
+  : [];
+
+const { errors, warnings, taskCount, minTasks } = validateManifest(manifest, taskFileIds);
+
+console.log(`E2E tasks: ${taskCount} (min ${minTasks})`);
+
+for (const warning of warnings) {
+  console.warn(`::warning::${warning}`);
+}
+
+if (errors.length > 0) {
+  for (const error of errors) {
+    console.error(`::error::${error}`);
+  }
+  process.exit(1);
+}

package/scripts/check-eval-score-drift.mjs

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+/**
+ * Phase 4: if eval pass rate exceeds production acceptance by DRIFT_PT, flag drift.
+ * Reads evals/.score-baseline.json (optional) or uses defaults for template CI.
+ */
+import { readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+
+const DRIFT_PT = Number(process.env.HARNESS_EVAL_DRIFT_PT || 15);
+const baselinePath = join(process.cwd(), "evals/.score-baseline.json");
+
+let evalPass = 85;
+let prodAccept = 70;
+
+if (existsSync(baselinePath)) {
+  const b = JSON.parse(readFileSync(baselinePath, "utf8"));
+  evalPass = Number(b.eval_pass_rate ?? evalPass);
+  prodAccept = Number(b.production_acceptance_rate ?? prodAccept);
+}
+
+const gap = evalPass - prodAccept;
+console.log(`Eval pass ${evalPass}% vs production acceptance ${prodAccept}% (gap ${gap}pt, threshold ${DRIFT_PT}pt)`);
+
+if (gap > DRIFT_PT) {
+  console.warn(
+    `::warning::Eval/production gap ${gap}pt exceeds ${DRIFT_PT}pt — open bench review issue`,
+  );
+  process.exit(2);
+}
+
+console.log("Eval score drift check passed");

package/scripts/check-gh-aw-dogfood-scope.mjs

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+/**
+ * Enforce narrow file scope for task:gh-aw-dogfood PRs.
+ */
+import { execSync } from "node:child_process";
+import {
+  DOGFOOD_TASK_LABEL,
+  evaluateDogfoodScope,
+  isDogfoodAllowedPath,
+  parseDogfoodLabels,
+} from "./lib/gh-aw-dogfood.mjs";
+
+function changedFiles() {
+  const base = process.env.BASE_SHA || "origin/main";
+  try {
+    const out = execSync(`git diff --name-only ${base}...HEAD`, { encoding: "utf8" });
+    return out.split("\n").filter(Boolean);
+  } catch {
+    return execSync("git diff --name-only HEAD~1...HEAD", { encoding: "utf8" })
+      .split("\n")
+      .filter(Boolean);
+  }
+}
+
+function main() {
+  const labels = parseDogfoodLabels(process.env.PR_LABELS);
+  const files = changedFiles();
+  const touchesDogfood = files.some((file) => isDogfoodAllowedPath(file));
+  const scope = evaluateDogfoodScope(files, labels);
+
+  if (!scope.enforced) {
+    if (touchesDogfood) {
+      console.warn(
+        `::warning::Dogfood paths changed without ${DOGFOOD_TASK_LABEL}; add label for scoped validation`,
+      );
+    }
+    console.log("Not a gh-aw dogfood task; scope enforcement skipped");
+    return;
+  }
+
+  if (!scope.ok) {
+    console.error(`::error::Out-of-scope paths for ${DOGFOOD_TASK_LABEL}:`);
+    for (const issue of scope.issues) console.error(`  - ${issue}`);
+    console.error("Allowed paths: docs/gh-aw-dogfood.md#allowed-path-scope");
+    process.exit(1);
+  }
+
+  console.log(`Dogfood scope check passed (${files.length} file(s))`);
+}
+
+main();