@harness-engineering/cli 1.13.1 → 1.15.0

package/dist/agents/skills/gemini-cli/harness-planning/SKILL.md

@@ -312,6 +312,45 @@ One sentence.
 
 ````
 
+## Session State
+
+This skill reads and writes to the following session sections via `manage_state`:
+
+| Section | Read | Write | Purpose |
+|---------|------|-------|---------|
+| terminology | yes | no | Reads domain terms to use consistent language in plan |
+| decisions | yes | yes | Reads brainstorming decisions; records planning-phase decisions |
+| constraints | yes | yes | Reads existing constraints; adds constraints discovered during decomposition |
+| risks | yes | yes | Reads existing risks; adds implementation risks identified during task design |
+| openQuestions | yes | yes | Reads unresolved questions; adds new questions, resolves answered ones |
+| evidence | yes | yes | Reads prior evidence from brainstorming; writes file:line citations for task specifications |
+
+**When to write:** During Phase 1 (SCOPE) write newly discovered constraints and risks. During Phase 2 (DECOMPOSE) write decisions about task structure and sequencing. Mark resolved questions during Phase 4 (VALIDATE).
+
+**When to read:** At the start of Phase 1 (SCOPE), read all sections via `gather_context` with `include: ["sessions"]` to inherit context from brainstorming. Use terminology for consistent naming in task descriptions.
+
+## Evidence Requirements
+
+When this skill makes claims about existing code structure, file locations, or implementation patterns in task specifications, it MUST cite evidence using one of:
+
+1. **File reference:** `file:line` format (e.g., `src/services/index.ts:15` -- "barrel export exists, will add new export here")
+2. **Code pattern reference:** `file:line` format with pattern description (e.g., `src/services/user-service.ts:1-30` -- "existing service follows constructor injection pattern, new service will match")
+3. **Test output:** Include the command and its observed output when referencing current test state
+4. **Session evidence:** Write to the `evidence` session section:
+   ```json
+   manage_state({
+     action: "append_entry",
+     session: "<current-session>",
+     section: "evidence",
+     authorSkill: "harness-planning",
+     content: "src/services/index.ts:15 -- barrel export pattern confirmed for new service integration"
+   })
+   ```
+
+**When to cite:** During Phase 1 (SCOPE) when referencing existing files for observable truths. During Phase 2 (DECOMPOSE) when specifying exact file paths and code patterns in task instructions. When the file map references existing files for modification.
+
+**Uncited claims:** Technical assertions about existing code without citations MUST be prefixed with `[UNVERIFIED]`. Example: `[UNVERIFIED] The service barrel exports all services`. Uncited claims are flagged during review (Wave 2.2).
+
 ## Harness Integration
 
 - **`harness validate`** — Run during Phase 4 (before writing the plan) and included as a step in every task.

package/dist/agents/skills/gemini-cli/harness-product-spec/SKILL.md

@@ -43,7 +43,7 @@
    ```
 
 5. **Load project context.** Scan the project for existing specs, user stories, or PRDs to maintain consistency in format and terminology:
-   - Check `docs/specs/`, `docs/requirements/`, `docs/prd/` for existing documents
+   - Check `docs/changes/`, `docs/requirements/`, `docs/prd/` for existing documents
    - Check `.github/ISSUE_TEMPLATE/` for the project's preferred issue format
    - Identify domain terminology used in existing specs
 
@@ -133,7 +133,7 @@
    REQ-003 -> US-004, US-005 (could-have)
    ```
 
-5. **Write the PRD to file.** Save to the project's spec directory (detected in Phase 1 or defaulting to `docs/specs/`). Use a filename pattern: `YYYY-MM-DD-feature-name-prd.md`.
+5. **Write the PRD to file.** Save to the project's spec directory (detected in Phase 1 or defaulting to `docs/changes/`). Use a filename pattern: `YYYY-MM-DD-feature-name-prd.md`.
 
 ---
 
@@ -171,7 +171,7 @@
    Coverage: all actors covered, all constraints addressed
    Open questions: N remaining
 
-   Generated: docs/specs/2026-03-27-notifications-prd.md
+   Generated: docs/changes/2026-03-27-notifications-prd.md
    ```
 
 ---
@@ -227,7 +227,7 @@ Phase 2: CRAFT
               And their other preferences remain unchanged.
 
 Phase 3: GENERATE
-  Written: docs/specs/2026-03-27-team-notifications-prd.md
+  Written: docs/changes/2026-03-27-team-notifications-prd.md
   Sections: problem statement, 4 user stories, 12 acceptance criteria, 8 BDD scenarios
   Traceability: REQ-001 -> US-001, US-002 | REQ-002 -> US-003, US-004
 
@@ -260,7 +260,7 @@ Phase 2: CRAFT
             return 400 and log a security warning.
 
 Phase 3: GENERATE
-  Written: docs/specs/2026-03-27-stripe-webhooks-prd.md
+  Written: docs/changes/2026-03-27-stripe-webhooks-prd.md
   Technical constraints section includes: idempotency keys, signature verification,
     5-second response SLA, Stripe retry behavior documentation
 

package/dist/agents/skills/gemini-cli/harness-release-readiness/SKILL.md

@@ -111,14 +111,14 @@ Run every check below. Record each as **pass**, **warn**, or **fail**:
 | `test` script exists in root `package.json`                     | fail                |
 | `lint` script exists in root `package.json`                     | fail                |
 | `typecheck` or `tsc` script exists in root `package.json`       | fail                |
-| `assess_project` passes (harness health + lint gate)            | fail                |
+| `assess_project` passes (full harness CI gate)                  | fail                |
 
 For the `assess_project` check, run it with all harness-specific checks including lint:
 
 ```json
 assess_project({
   path: "<project-root>",
-  checks: ["validate", "deps", "docs", "lint"],
+  checks: ["validate", "deps", "docs", "lint", "perf", "security", "entropy", "arch"],
   mode: "detailed"
 })
 ```
@@ -519,7 +519,7 @@ This framing is informational — it does not block anything. It gives the team
 
 ## Harness Integration
 
-- **`assess_project`** — Used in AUDIT Phase 1 (CI/CD section) to run harness validation, dependency checks, doc coverage, and lint in a single parallel call. Also run after auto-fixes in Phase 3 to verify project health. Automatically inherits new checks added to `assess_project`.
+- **`assess_project`** — Used in AUDIT Phase 1 (CI/CD section) to run the full harness CI gate (validation, dependencies, docs, lint, performance/complexity, security, entropy, and architecture) in a single parallel call. Also run after auto-fixes in Phase 3 to verify project health. Automatically inherits new checks added to `assess_project`.
 - **Sub-skill invocations** — Phase 2 dispatches `detect-doc-drift`, `cleanup-dead-code`, `enforce-architecture`, and `diagnostics` as parallel agents. Phase 3 delegates fixes to `align-documentation` and `cleanup-dead-code`.
 - **State file** — `.harness/release-readiness.json` enables session resumption and progress tracking. This file is read at the start of each invocation and written at the end.
 - **Report file** — `release-readiness-report.md` is written to the project root. It is a snapshot, not a tracked artifact — regenerate it on each run.

package/dist/agents/skills/gemini-cli/harness-verification/SKILL.md

@@ -291,6 +291,41 @@ When verifying a bug fix, apply this extended protocol:
 
 If step 4 passes (test does not fail without the fix), the test is not a valid regression test. It does not catch the bug. Rewrite it.
 
+## Evidence Requirements
+
+This skill is the primary evidence producer in the workflow. Every pass/fail assertion in the verification report MUST include concrete evidence. The words "should", "probably", and "seems to" are already forbidden by the Iron Law -- this section defines HOW to cite evidence.
+
+Every verification claim MUST use one of:
+
+1. **File reference:** `file:line` format with observed content (e.g., `src/services/user-service.ts:42` -- "create method validates email format before insert")
+2. **Test output:** Include the actual test command and its complete output:
+   ```
+   $ npx vitest run src/services/user-service.test.ts
+   PASS  src/services/user-service.test.ts
+     UserService
+       create (4 tests)
+       list (3 tests)
+       expiry (2 tests)
+   Tests: 9 passed, 9 total
+   ```
+3. **Harness output:** Include full `harness validate` and `harness check-deps` output
+4. **Anti-pattern scan output:** Include the actual grep/search command and results (or absence of results)
+5. **Import chain evidence:** Include the actual import statements found when verifying WIRED level
+6. **Session evidence:** Write to the `evidence` session section for each verification level:
+   ```json
+   manage_state({
+     action: "append_entry",
+     session: "<current-session>",
+     section: "evidence",
+     authorSkill: "harness-verification",
+     content: "[EXISTS:PASS] src/services/user-service.ts (189 lines) -- verified via direct file read"
+   })
+   ```
+
+**When to cite:** At every verification level. Level 1 (EXISTS) cites file reads. Level 2 (SUBSTANTIVE) cites specific line content. Level 3 (WIRED) cites import statements, test execution output, and harness check output. The verification report format already requires `[PASS]`/`[FAIL]` markers -- each marker must be accompanied by the evidence that produced it.
+
+**Uncited claims:** ANY verification assertion without direct evidence is a verification failure, not merely an uncited claim. This skill does not use `[UNVERIFIED]` -- if evidence cannot be produced, the verdict is FAIL or INCOMPLETE.
+
 ## Harness Integration
 
 - **`harness validate`** — Run in Level 3 WIRED check. Verifies project-wide health and constraint compliance.

package/dist/agents/skills/gemini-cli/initialize-harness-project/SKILL.md

@@ -20,6 +20,8 @@
 
 2. **For new projects:** Gather project context — language, framework, test runner, build tool. Ask the human if any of these are undecided. Do not assume defaults.
 
+2b. **For existing projects with detectable frameworks:** Run `harness init` without flags first. The command auto-detects frameworks (FastAPI, Django, Gin, Axum, Spring Boot, Next.js, React+Vite, Vue, Express, NestJS) by scanning project files. Present the detection result to the human and ask for confirmation before proceeding. If detection fails, ask the human to specify `--framework` manually.
+
 3. **For existing projects:** Run `harness validate` to see what is already configured and what is missing. Read `AGENTS.md` if it exists. Identify the current adoption level:
    - **Basic:** Has `AGENTS.md` and `harness.yaml` with project metadata. No layers, no skills, no dependency constraints.
    - **Intermediate:** Has layers defined, dependency constraints between layers, at least one custom skill. `harness check-deps` runs and passes.
@@ -30,11 +32,17 @@
 ### Phase 2: SCAFFOLD — Generate Project Structure
 
 1. **Run `harness init` with the appropriate flags:**
-   - New basic project: `harness init --level basic --framework <framework>`
-   - New intermediate project: `harness init --level intermediate --framework <framework>`
+   - New basic JS/TS project: `harness init --level basic`
+   - With framework: `harness init --level basic --framework <framework>`
+   - Non-JS language: `harness init --language <python|go|rust|java>`
+   - Non-JS with framework: `harness init --framework <fastapi|django|gin|axum|spring-boot>`
+   - Existing project (auto-detect): `harness init` (no flags -- auto-detection runs)
    - Migration to intermediate: `harness init --level intermediate --migrate`
    - Migration to advanced: `harness init --level advanced --migrate`
 
+   **Supported frameworks:** nextjs, react-vite, vue, express, nestjs, fastapi, django, gin, axum, spring-boot
+   **Supported languages:** typescript, python, go, rust, java
+
 2. **Review generated files.** `harness init` creates:
    - `harness.yaml` — Project configuration (name, stack, adoption level)
    - `.harness/` directory — State and learnings storage
@@ -93,7 +101,7 @@ This creates the `.harness/graph/` directory and populates it with the project's
 
 ## Harness Integration
 
-- **`harness init --level <level> --framework <framework>`** — Scaffold a new project at the specified adoption level.
+- **`harness init --level <level> [--framework <framework>] [--language <language>]`** — Scaffold a new project. `--framework` infers language automatically. `--language` without `--framework` gives a bare language scaffold. Running without flags on an existing project directory triggers auto-detection.
 - **`harness init --level <level> --migrate`** — Migrate an existing project to the next adoption level, preserving existing configuration.
 - **`harness persona generate`** — Generate persona definitions based on project stack and team structure.
 - **`harness validate`** — Verify the full project configuration is valid and complete.

package/dist/agents/skills/package.json

@@ -9,6 +9,7 @@
     "test:coverage": "vitest run --coverage"
   },
   "devDependencies": {
+    "@vitest/coverage-v8": "^4.0.18",
     "glob": "^10.3.0",
     "vitest": "^4.0.18",
     "yaml": "^2.3.0",

package/dist/agents/skills/vitest.config.mts

@@ -5,5 +5,10 @@ export default defineConfig({
     globals: true,
     environment: 'node',
     include: ['tests/**/*.test.ts'],
+    coverage: {
+      provider: 'v8',
+      reporter: ['text', 'json', 'json-summary', 'html'],
+      include: ['src/**/*.ts'],
+    },
   },
 });

package/dist/agents-md-ZGNIDWAF.js

@@ -0,0 +1,8 @@
+import {
+  generateAgentsMd
+} from "./chunk-OD3S2NHN.js";
+import "./chunk-Z2OOPXJO.js";
+import "./chunk-ERS5EVUZ.js";
+export {
+  generateAgentsMd
+};

package/dist/{architecture-2R5Z4ZAF.js → architecture-ZLIH5533.js}

@@ -1,12 +1,12 @@
 import {
   checkDependenciesDefinition,
   handleCheckDependencies
-} from "./chunk-QY4T6YAZ.js";
-import "./chunk-K6XAPGML.js";
+} from "./chunk-N25INEIX.js";
+import "./chunk-H7Y5CKTM.js";
 import "./chunk-IDZNPTYD.js";
 import "./chunk-W6Y7ZW3Y.js";
-import "./chunk-PQ5YK4AY.js";
-import "./chunk-MHBMTPW7.js";
+import "./chunk-Z2OOPXJO.js";
+import "./chunk-ERS5EVUZ.js";
 export {
   checkDependenciesDefinition,
   handleCheckDependencies

package/dist/bin/harness-mcp.js

@@ -1,26 +1,26 @@
 #!/usr/bin/env node
 import {
   startServer
-} from "../chunk-NERR4TAO.js";
-import "../chunk-DZS7CJKL.js";
-import "../chunk-TKJZKICB.js";
-import "../chunk-IM32EEDM.js";
-import "../chunk-65FRIL4D.js";
-import "../chunk-4ZMOCPYO.js";
+} from "../chunk-NNHDDXYT.js";
+import "../chunk-VEPAJXBW.js";
+import "../chunk-EDXIVMAP.js";
+import "../chunk-YLXFKVJE.js";
+import "../chunk-3ZZKVN62.js";
+import "../chunk-ND2ENWDM.js";
 import "../chunk-ZOAWBDWU.js";
-import "../chunk-NOPU4RZ4.js";
-import "../chunk-IMFVFNJE.js";
-import "../chunk-QY4T6YAZ.js";
-import "../chunk-K6XAPGML.js";
-import "../chunk-ND6PNADU.js";
-import "../chunk-Z77YQRQT.js";
+import "../chunk-OFXQSFOW.js";
+import "../chunk-FTMXDOR6.js";
+import "../chunk-N25INEIX.js";
+import "../chunk-H7Y5CKTM.js";
+import "../chunk-2BKLWLY6.js";
+import "../chunk-B2HKP423.js";
 import "../chunk-IDZNPTYD.js";
 import "../chunk-W6Y7ZW3Y.js";
 import "../chunk-N5G5QMS3.js";
 import "../chunk-3WGJMBKH.js";
 import "../chunk-XYLGHKG6.js";
-import "../chunk-PQ5YK4AY.js";
-import "../chunk-MHBMTPW7.js";
+import "../chunk-Z2OOPXJO.js";
+import "../chunk-ERS5EVUZ.js";
 
 // src/bin/harness-mcp.ts
 startServer().catch((error) => {

package/dist/bin/harness.js

@@ -1,36 +1,37 @@
 #!/usr/bin/env node
 import {
-  createProgram
-} from "../chunk-SSKDAOX5.js";
-import "../chunk-VUCPTQ6G.js";
-import "../chunk-UAX4I5ZE.js";
-import "../chunk-TS3XWPW5.js";
-import "../chunk-Q6AB7W5Z.js";
+  createProgram,
+  printFirstRunWelcome
+} from "../chunk-J4RAX7YB.js";
+import "../chunk-SD3SQOZ2.js";
+import "../chunk-LGYBN7Y6.js";
+import "../chunk-RCWZBSK5.js";
+import "../chunk-YQ6KC6TE.js";
 import "../chunk-TRAPF4IX.js";
 import "../chunk-AOZRDOIP.js";
 import "../chunk-TEFCFC4H.js";
 import "../chunk-YBJ262QL.js";
 import "../chunk-EBJQ6N4M.js";
-import "../chunk-QPEH2QPG.js";
-import "../chunk-JSTQ3AWB.js";
+import "../chunk-DBSOCI3G.js";
+import "../chunk-FIAPHX37.js";
 import "../chunk-KET4QQZB.js";
-import "../chunk-NKDM3FMH.js";
-import "../chunk-NERR4TAO.js";
-import "../chunk-DZS7CJKL.js";
-import "../chunk-TKJZKICB.js";
-import "../chunk-IM32EEDM.js";
-import "../chunk-65FRIL4D.js";
-import "../chunk-4ZMOCPYO.js";
+import "../chunk-OD3S2NHN.js";
+import "../chunk-NNHDDXYT.js";
+import "../chunk-VEPAJXBW.js";
+import "../chunk-EDXIVMAP.js";
+import "../chunk-YLXFKVJE.js";
+import "../chunk-3ZZKVN62.js";
+import "../chunk-ND2ENWDM.js";
 import "../chunk-ZOAWBDWU.js";
-import "../chunk-NOPU4RZ4.js";
-import "../chunk-IMFVFNJE.js";
-import "../chunk-QY4T6YAZ.js";
-import "../chunk-K6XAPGML.js";
-import "../chunk-ND6PNADU.js";
+import "../chunk-OFXQSFOW.js";
+import "../chunk-FTMXDOR6.js";
+import "../chunk-N25INEIX.js";
+import "../chunk-H7Y5CKTM.js";
+import "../chunk-2BKLWLY6.js";
 import {
   findConfigFile,
   loadConfig
-} from "../chunk-Z77YQRQT.js";
+} from "../chunk-B2HKP423.js";
 import "../chunk-IDZNPTYD.js";
 import "../chunk-W6Y7ZW3Y.js";
 import "../chunk-N5G5QMS3.js";
@@ -41,16 +42,16 @@ import "../chunk-XYLGHKG6.js";
 import {
   CLI_VERSION
 } from "../chunk-BM3PWGXQ.js";
-import "../chunk-72GHBOL2.js";
-import "../chunk-C2ERUR3L.js";
+import "../chunk-GZKSBLQL.js";
+import "../chunk-7MJAPE3Z.js";
 import {
   getUpdateNotification,
   isUpdateCheckEnabled,
   readCheckState,
   shouldRunCheck,
   spawnBackgroundCheck
-} from "../chunk-PQ5YK4AY.js";
-import "../chunk-MHBMTPW7.js";
+} from "../chunk-Z2OOPXJO.js";
+import "../chunk-ERS5EVUZ.js";
 
 // src/bin/update-check-hooks.ts
 var DEFAULT_INTERVAL_MS = 864e5;
@@ -103,6 +104,7 @@ ${message}
 
 // src/bin/harness.ts
 async function main() {
+  printFirstRunWelcome();
   runUpdateCheckAtStartup();
   const program = createProgram();
   try {

package/dist/{check-phase-gate-2OFZ7OWW.js → check-phase-gate-ZOXVBDCN.js}

@@ -1,12 +1,12 @@
 import {
   createCheckPhaseGateCommand,
   runCheckPhaseGate
-} from "./chunk-UAX4I5ZE.js";
+} from "./chunk-LGYBN7Y6.js";
 import "./chunk-EBJQ6N4M.js";
-import "./chunk-Z77YQRQT.js";
+import "./chunk-B2HKP423.js";
 import "./chunk-3WGJMBKH.js";
-import "./chunk-PQ5YK4AY.js";
-import "./chunk-MHBMTPW7.js";
+import "./chunk-Z2OOPXJO.js";
+import "./chunk-ERS5EVUZ.js";
 export {
   createCheckPhaseGateCommand,
   runCheckPhaseGate

package/dist/{chunk-ND6PNADU.js → chunk-2BKLWLY6.js}

@@ -1,7 +1,7 @@
 import {
   findConfigFile,
   loadConfig
-} from "./chunk-Z77YQRQT.js";
+} from "./chunk-B2HKP423.js";
 import {
   resultToMcpResponse
 } from "./chunk-IDZNPTYD.js";
@@ -10,7 +10,7 @@ import {
 } from "./chunk-W6Y7ZW3Y.js";
 import {
   Ok
-} from "./chunk-MHBMTPW7.js";
+} from "./chunk-ERS5EVUZ.js";
 
 // src/mcp/tools/docs.ts
 import * as path from "path";
@@ -46,18 +46,18 @@ async function handleCheckDocs(input) {
     const projectPath = sanitizePath(input.path);
     const scope = input.scope ?? "coverage";
     if (scope === "integrity") {
-      const { validateKnowledgeMap } = await import("./dist-2B363XUH.js");
+      const { validateKnowledgeMap } = await import("./dist-ALQDD67R.js");
       const result2 = await validateKnowledgeMap(projectPath);
       return resultToMcpResponse(result2);
     }
     if (scope === "all") {
-      const { checkDocCoverage: checkDocCoverage2, validateKnowledgeMap } = await import("./dist-2B363XUH.js");
+      const { checkDocCoverage: checkDocCoverage2, validateKnowledgeMap } = await import("./dist-ALQDD67R.js");
       const domain2 = input.domain ?? "src";
-      const { loadGraphStore: loadGraphStore2 } = await import("./graph-loader-GJZ4FN4Y.js");
+      const { loadGraphStore: loadGraphStore2 } = await import("./graph-loader-2M2HXDQI.js");
       const store2 = await loadGraphStore2(projectPath);
       let graphCoverage2;
       if (store2) {
-        const { Assembler } = await import("./dist-HXHWB7SV.js");
+        const { Assembler } = await import("./dist-B26DFXMP.js");
         const assembler = new Assembler(store2);
         const report = assembler.checkCoverage();
         graphCoverage2 = {
@@ -90,13 +90,13 @@ async function handleCheckDocs(input) {
       }
       return resultToMcpResponse(Ok({ coverage, integrity }));
     }
-    const { checkDocCoverage } = await import("./dist-2B363XUH.js");
+    const { checkDocCoverage } = await import("./dist-ALQDD67R.js");
     const domain = input.domain ?? "src";
-    const { loadGraphStore } = await import("./graph-loader-GJZ4FN4Y.js");
+    const { loadGraphStore } = await import("./graph-loader-2M2HXDQI.js");
     const store = await loadGraphStore(projectPath);
     let graphCoverage;
     if (store) {
-      const { Assembler } = await import("./dist-HXHWB7SV.js");
+      const { Assembler } = await import("./dist-B26DFXMP.js");
       const assembler = new Assembler(store);
       const report = assembler.checkCoverage();
       graphCoverage = {

package/dist/{chunk-65FRIL4D.js → chunk-3ZZKVN62.js}

@@ -26,7 +26,7 @@ var runSecurityScanDefinition = {
 };
 async function handleRunSecurityScan(input) {
   try {
-    const core = await import("./dist-2B363XUH.js");
+    const core = await import("./dist-ALQDD67R.js");
     const projectRoot = sanitizePath(input.path);
     let configData = {};
     try {