@harness-engineering/cli 1.14.0 → 1.16.0

package/dist/agents/commands/cursor/harness/harness-execution.mdc

@@ -0,0 +1,518 @@
+---
+description: Execute a planned set of tasks with harness validation and state tracking
+alwaysApply: false
+---
+
+<!-- Generated by harness generate-slash-commands. Do not edit. -->
+
+# Harness Execution
+
+> Execute a plan task by task with atomic commits, checkpoint protocol, and persistent knowledge capture. Stop on blockers. Do not guess.
+
+## When to Use
+
+- When an approved plan exists (output of harness-planning) and implementation should begin
+- When resuming execution of a previously started plan after a context reset
+- When `on_new_feature` or `on_bug_fix` triggers fire and a plan is already in place
+- NOT when no plan exists (use harness-planning first)
+- NOT when the plan needs revision (update the plan first, then resume execution)
+- NOT when exploring or brainstorming (use harness-brainstorming)
+- NOT for ad-hoc single-task work that does not follow a plan
+
+## Process
+
+### Iron Law
+
+**Execute the plan as written. If the plan is wrong, stop and fix the plan — do not improvise.**
+
+Deviating from the plan mid-execution introduces untested assumptions, breaks task atomicity, and makes progress untraceable. If a task cannot be completed as written, that is a blocker. Record it and stop.
+
+---
+
+### Phase 1: PREPARE — Load State and Verify Prerequisites
+
+1. **Load the plan.** Read the plan document from `docs/plans/`. Identify the total task count and any checkpoints.
+
+2. **Gather context in one call.** Use the `gather_context` MCP tool to load all working context at once:
+
+   ```json
+   gather_context({
+     path: "<project-root>",
+     intent: "Execute plan tasks starting from current position",
+     skill: "harness-execution",
+     session: "<session-slug-if-known>",
+     include: ["state", "learnings", "handoff", "validation"]
+   })
+   ```
+
+   **Session resolution:** If a session directory is known (passed via autopilot dispatch or available from a previous handoff), include the `session` parameter. This scopes all state reads/writes to `.harness/sessions/<slug>/`. If no session is known, omit it — `gather_context` falls back to global files at `.harness/`.
+
+   This returns `state` (current position — if null, this is a fresh start at Task 1), `learnings` (hard-won insights from previous sessions — do not ignore them), `handoff` (structured context from the previous skill), and `validation` (current project health). If any constituent fails, its field is null and the error is reported in `meta.errors`.
+
+3. **Load session summary for cold start.** If resuming a session (session slug is known), read the session summary for quick orientation:
+   - Call `listActiveSessions()` to read the session index (~100 tokens).
+   - If the target session is known, call `loadSessionSummary()` for that session (~200 tokens).
+   - If ambiguous (multiple active sessions, no clear target), present the index to the user and ask which session to resume.
+   - The summary provides skill, phase, status, key context, and next step — enough to orient without re-reading full state + learnings + plan.
+
+4. **Check for known dead ends.** Review `learnings` entries tagged `[outcome:failure]`. If any match approaches in the current plan, surface warnings before proceeding.
+
+5. **Verify prerequisites.** For the current task:
+   - Are dependency tasks marked complete in state?
+   - Do the files referenced in the task exist as expected?
+   - Does the test suite pass? Run `harness validate` to confirm a clean baseline.
+
+6. **If prerequisites fail,** do not proceed. Report what is missing and which task is blocked.
+
+### Graph-Enhanced Context (when available)
+
+When a knowledge graph exists at `.harness/graph/`, use graph queries for faster, more accurate context:
+
+- `query_graph` — check file overlap between current and next task for conflict detection
+- `get_impact` — understand blast radius before executing a task
+
+Enables smarter execution ordering and blockage detection. Fall back to file-based commands if no graph is available.
+
+---
+
+### Phase 2: EXECUTE — Implement Tasks Atomically
+
+When reporting task progress, use progress markers:
+
+```
+**[Phase N/M]** Task N — <task description>
+```
+
+For each task, starting from the current position:
+
+1. **Read the task instructions completely** before writing any code. Understand what files to touch, what tests to write, what the expected outcome is.
+
+2. **Follow the task instructions exactly.** The plan contains exact file paths, exact code, and exact commands. Execute them as written.
+
+3. **TDD rhythm within each task:**
+   - Write the test as specified in the task
+   - Run the test — observe it fail (for the right reason)
+   - Write the implementation as specified in the task
+   - Run the test — observe it pass
+   - Run `harness validate`
+
+4. **Commit atomically.** Each task produces exactly one commit. Use the commit message specified in the plan. If no message is specified, write a descriptive message in the project's convention.
+
+5. **Run mechanical gate.** After each task commit, run the full gate check. Use `assess_project` to run harness checks (including lint) in parallel, then run the test suite:
+
+   ```json
+   assess_project({
+     path: "<project-root>",
+     checks: ["validate", "deps", "lint"],
+     mode: "summary"
+   })
+   ```
+
+   Then run the project's test suite (`npx turbo run test` or equivalent). This is binary pass/fail.
+   - **All pass →** proceed to the next task.
+   - **Any fail →** retry with error context (max 2 attempts).
+   - **Still failing after retries →** record the failure in `.harness/failures.md`, escalate, and stop.
+
+6. **Update state after each task.** Write to `.harness/state.json`:
+
+   ```json
+   {
+     "schemaVersion": 1,
+     "position": { "phase": "execute", "task": "Task N" },
+     "progress": { "Task 1": "complete", "Task 2": "complete", "Task 3": "in_progress" },
+     "lastSession": { "date": "YYYY-MM-DD", "summary": "Completed Tasks 1-2, starting Task 3" }
+   }
+   ```
+
+7. **Handle checkpoints** according to the checkpoint protocol (see below).
+
+---
+
+### Checkpoint Protocol
+
+Plans contain three types of checkpoints. Each requires pausing execution.
+
+**`[checkpoint:human-verify]` — Show and Confirm**
+
+1. Stop execution.
+2. Use `emit_interaction` to present the checkpoint:
+   ```json
+   emit_interaction({
+     path: "<project-root>",
+     type: "confirmation",
+     confirmation: {
+       text: "Task N complete. Output: <summary>. Continue to Task N+1?",
+       context: "<test output or file diff summary>",
+       impact: "Continuing proceeds to the next task. Declining pauses execution for review.",
+       risk: "low"
+     }
+   })
+   ```
+3. Wait for the human to confirm before proceeding.
+
+**`[checkpoint:decision]` — Present Options and Wait**
+
+1. Stop execution.
+2. Use `emit_interaction` to present the decision:
+   ```json
+   emit_interaction({
+     path: "<project-root>",
+     type: "question",
+     question: {
+       text: "Task N requires a decision: <description>",
+       options: [
+         {
+           label: "<option A>",
+           pros: ["<pro 1>", "<pro 2>"],
+           cons: ["<con 1>"],
+           risk: "low",
+           effort: "low"
+         },
+         {
+           label: "<option B>",
+           pros: ["<pro 1>"],
+           cons: ["<con 1>", "<con 2>"],
+           risk: "medium",
+           effort: "medium"
+         }
+       ],
+       recommendation: {
+         optionIndex: 0,
+         reason: "<why this option is recommended>",
+         confidence: "medium"
+       }
+     }
+   })
+   ```
+3. Wait for the human to choose.
+
+**`[checkpoint:human-action]` — Instruct and Wait**
+
+1. Stop execution.
+2. Tell the human exactly what they need to do (e.g., "Create an API key at [URL] and paste it here").
+3. State: "Task N requires your action: [instructions]. Let me know when done."
+4. Wait for the human to complete the action and confirm.
+
+---
+
+### Phase 3: VERIFY — Two-Tier Validation
+
+**Quick gate (default):** The mechanical gate in Phase 2 Step 5 IS the standard verification. Every task commit must pass it before proceeding. No additional verification step is needed for normal execution.
+
+**Deep audit (on-demand):** When `--deep` is passed or at milestone boundaries (e.g., end of a phase, final task), invoke the full `harness-verification` skill for 3-level audit:
+
+1. **EXISTS** — Do the artifacts the task claims to produce actually exist?
+2. **SUBSTANTIVE** — Do those artifacts contain meaningful, correct content (not stubs or placeholders)?
+3. **WIRED** — Are those artifacts integrated into the system (imported, routed, tested, reachable)?
+
+If the deep audit fails at any level, treat it as a blocker. Record it and stop.
+
+After all tasks pass verification:
+
+```json
+emit_interaction({
+  path: "<project-root>",
+  type: "transition",
+  transition: {
+    completedPhase: "execution",
+    suggestedNext: "verification",
+    reason: "All plan tasks executed and verified",
+    artifacts: ["<list of created/modified files>"],
+    qualityGate: {
+      checks: [
+        { name: "all-tasks-complete", passed: true, detail: "<N>/<N> tasks" },
+        { name: "harness-validate", passed: true },
+        { name: "tests-pass", passed: true }
+      ],
+      allPassed: true
+    }
+  }
+})
+```
+
+---
+
+### Phase 4: PERSIST — Save Progress and Learnings
+
+Between tasks (especially between sessions):
+
+1. **Update state (session-scoped `{sessionDir}/state.json` if session is known, otherwise `.harness/state.json`)** with current position, progress, and `lastSession` context:
+
+   ```json
+   {
+     "lastSession": {
+       "lastSkill": "harness-execution",
+       "pendingTasks": ["Task 4", "Task 5"]
+     }
+   }
+   ```
+
+### Graph Refresh
+
+If a knowledge graph exists at `.harness/graph/`, refresh it after code changes to keep graph queries accurate:
+
+```
+harness scan [path]
+```
+
+Skipping this step means subsequent graph queries (impact analysis, dependency health, test advisor) may return stale results.
+
+2. **Append tagged learnings to the session-scoped learnings file (`{sessionDir}/learnings.md` if session is known, otherwise `.harness/learnings.md`).** Tag every entry with skill and outcome:
+
+   ```markdown
+   ## YYYY-MM-DD — Task N: <task name>
+
+   - [skill:harness-execution] [outcome:success] What was accomplished
+   - [skill:harness-execution] [outcome:gotcha] What was surprising or non-obvious
+   - [skill:harness-execution] [outcome:decision] What was decided and why
+   ```
+
+3. **Record failures in the session-scoped failures file (`{sessionDir}/failures.md` if session is known, otherwise `.harness/failures.md`)** if any task was escalated after retry exhaustion (from Phase 2 Step 5). Include the approach attempted and why it failed, so future sessions avoid the same dead end.
+
+4. **Write the session-scoped handoff (`{sessionDir}/handoff.json` if session is known, otherwise `.harness/handoff.json`)** with structured context for the next skill or session:
+
+   ```json
+   {
+     "fromSkill": "harness-execution",
+     "timestamp": "YYYY-MM-DDTHH:MM:SSZ",
+     "summary": "Completed Tasks 1-3. Task 4 blocked on missing API endpoint.",
+     "pendingTasks": ["Task 4", "Task 5"],
+     "blockers": ["Task 4: /api/notifications endpoint not implemented"],
+     "learnings": ["Date comparison needs UTC normalization"]
+   }
+   ```
+
+5. **Write session summary.** Write/update the session summary for cold-start context restoration:
+
+   ```json
+   writeSessionSummary(projectPath, sessionSlug, {
+     session: "<session-slug>",
+     lastActive: "<ISO timestamp>",
+     skill: "harness-execution",
+     phase: "<current phase of plan>",
+     status: "<e.g., Task 4/6 complete, paused at CHECKPOINT>",
+     spec: "<spec path if known>",
+     plan: "<plan path>",
+     keyContext: "<1-2 sentences: what was accomplished, key decisions made>",
+     nextStep: "<what to do next when resuming>"
+   })
+   ```
+
+   This overwrites any previous summary for this session. The index.md is updated automatically.
+
+6. **Sync roadmap (mandatory when present).** If `docs/roadmap.md` exists, call `manage_roadmap` with action `sync` and `apply: true` to update linked feature statuses from the just-completed execution state. Do not use `force_sync: true` — the human-always-wins rule applies. If `manage_roadmap` is unavailable, fall back to direct file manipulation using `syncRoadmap()` from core. If no roadmap exists, skip silently.
+
+7. **Learnings are append-only.** Never edit or delete previous learnings. They are a chronological record.
+
+8. **Auto-transition to verification.** When ALL tasks in the plan are complete (not when stopping mid-plan):
+
+   Call `emit_interaction`:
+
+   ```json
+   {
+     "type": "transition",
+     "transition": {
+       "completedPhase": "execution",
+       "suggestedNext": "verification",
+       "reason": "All tasks complete",
+       "artifacts": ["<list of created/modified files>"],
+       "requiresConfirmation": false,
+       "summary": "Completed <N> tasks. <N> files created, <N> modified. All quick gates passed.",
+       "qualityGate": {
+         "checks": [
+           { "name": "all-tasks-complete", "passed": true, "detail": "<N>/<N> tasks" },
+           { "name": "harness-validate", "passed": true },
+           { "name": "tests-pass", "passed": true },
+           { "name": "no-blockers", "passed": true }
+         ],
+         "allPassed": true
+       }
+     }
+   }
+   ```
+
+   The response will include `nextAction: "Invoke harness-verification skill now"`.
+   Immediately invoke harness-verification without waiting for user input.
+
+   **Important:** Only emit this transition when all tasks are complete. If execution stopped due to a blocker, checkpoint, or partial completion, do NOT emit a transition -- write the handoff and stop.
+
+---
+
+### Stopping Conditions
+
+These are non-negotiable. When any condition is met, stop immediately.
+
+- **Hit a blocker.** The task cannot be completed as written. Something is missing, broken, or wrong. Do not guess at a fix. Do not improvise. Record the blocker in state and report it: "Blocked on Task N: [specific issue]. The plan needs to be updated."
+
+- **Test failure after implementation.** The test was supposed to pass but does not. Do not retry blindly. Read the failure. Diagnose the root cause. If the fix is within the current task scope, fix it. If not, stop — the plan may be wrong.
+
+- **Unclear instruction.** The task says something ambiguous or contradictory. Do not interpret it. Ask: "Task N says [quote]. I interpret this as [interpretation]. Is that correct?"
+
+- **Harness validation failure.** `harness validate` fails after a task. Do not proceed. The task introduced an architectural violation or constraint breach. Fix it before moving on.
+
+- **Three consecutive failures on the same task.** After 3 attempts, the task design is likely wrong. Stop. Report: "Task N has failed 3 times. Root cause: [analysis]. The plan may need revision."
+
+## Session State
+
+This skill reads and writes to the following session sections via `manage_state`:
+
+| Section       | Read | Write | Purpose                                                                               |
+| ------------- | ---- | ----- | ------------------------------------------------------------------------------------- |
+| terminology   | yes  | yes   | Reads domain terms for consistent naming; adds terms discovered during implementation |
+| decisions     | yes  | yes   | Reads planning decisions for context; records implementation decisions                |
+| constraints   | yes  | yes   | Reads constraints to respect boundaries; adds constraints discovered during coding    |
+| risks         | yes  | yes   | Reads risks for awareness; updates risk status as mitigated or realized               |
+| openQuestions | yes  | yes   | Reads questions for context; resolves questions answered by implementation            |
+| evidence      | yes  | yes   | Reads prior evidence; writes file:line citations, test outputs, and diff references   |
+
+**When to write:** After each task completion, append relevant entries. Evidence entries should be written for every significant technical assertion (test result, file reference, performance measurement). Mark openQuestions as resolved when implementation answers them.
+
+**When to read:** During Phase 1 (PREPARE), read all sections via `gather_context` with `include: ["sessions"]` to inherit full accumulated context from brainstorming and planning.
+
+## Evidence Requirements
+
+When this skill makes claims about task completion, test results, or code behavior, it MUST cite evidence using one of:
+
+1. **File reference:** `file:line` format (e.g., `src/services/notification-service.ts:42` -- "create method implemented with validation")
+2. **Test output:** Include the actual test command and its output:
+   ```
+   $ npx vitest run src/services/notification-service.test.ts
+   PASS  src/services/notification-service.test.ts (8 tests)
+   ```
+3. **Diff evidence:** Before/after with file path for modifications to existing files
+4. **Harness output:** Include `harness validate` output as evidence of project health
+5. **Session evidence:** Write to the `evidence` session section after each task:
+   ```json
+   manage_state({
+     action: "append_entry",
+     session: "<current-session>",
+     section: "evidence",
+     authorSkill: "harness-execution",
+     content: "src/services/notification-service.ts:42 -- create method returns Notification with all required fields"
+   })
+   ```
+
+**When to cite:** After every task completion in Phase 2 (EXECUTE). Every commit message claim ("added X", "fixed Y") must be backed by test output or file reference. During Phase 4 (PERSIST) when writing learnings that reference specific code behavior.
+
+**Uncited claims:** Technical assertions without citations MUST be prefixed with `[UNVERIFIED]`. Example: `[UNVERIFIED] The notification service handles duplicate entries`. Uncited claims are flagged during review (Wave 2.2).
+
+## Harness Integration
+
+- **`harness validate`** — Run after every task completion. Mandatory. No task is complete without a passing validation.
+- **`gather_context`** — Used in PREPARE phase to load state, learnings, handoff, and validation in a single call instead of 4+ separate reads.
+- **`harness check-deps`** — Run when tasks add new imports or modules. Catches boundary violations early.
+- **`harness state show`** — View current execution position and progress.
+- **`harness state learn "<message>"`** — Append a learning from the command line.
+- **State file** — Session-scoped at `{sessionDir}/state.json` when session is known, otherwise `.harness/state.json`. Read at session start to resume position. Updated after every task.
+- **Learnings file** — Session-scoped at `{sessionDir}/learnings.md` when session is known, otherwise `.harness/learnings.md`. Append-only knowledge capture. Read at session start for prior context.
+- **Roadmap sync** — After completing plan execution, call `manage_roadmap` with action `sync` and `apply: true` to update roadmap status. Mandatory when `docs/roadmap.md` exists. Do not use `force_sync: true`. Falls back to `syncRoadmap()` from core if MCP tool is unavailable.
+- **`emit_interaction`** -- Call at plan completion to auto-transition to harness-verification. Uses auto-transition (proceeds immediately without user confirmation).
+
+## Success Criteria
+
+- Every task in the plan is executed in order, atomically, with one commit per task
+- `.harness/state.json` accurately reflects current position and progress
+- `.harness/learnings.md` contains entries for every session with non-trivial discoveries
+- `harness validate` passes after every task
+- Checkpoints were honored: execution paused at every `[checkpoint:*]` marker
+- No improvisation: tasks were executed as written, or execution was stopped and the blocker was reported
+- All stopping conditions were respected (no guessing past blockers, no blind retries)
+
+## Examples
+
+### Example: Executing a 5-Task Notification Plan
+
+**Session Start (fresh):**
+
+```
+Read plan: docs/plans/2026-03-14-notifications-plan.md (5 tasks)
+Read state: .harness/state.json — file not found (fresh start, position: Task 1)
+Read learnings: .harness/learnings.md — file not found (no prior context)
+Run: harness validate — passes. Clean baseline confirmed.
+```
+
+**Task 1: Define notification types**
+
+```
+1. Create src/types/notification.ts with Notification interface
+2. Run: harness validate — passes
+3. Commit: "feat(notifications): define Notification type"
+4. Update state: { position: Task 2, progress: { "Task 1": "complete" } }
+```
+
+**Task 2: Create notification service (TDD)**
+
+```
+1. Write test: src/services/notification-service.test.ts
+2. Run test: FAIL — NotificationService is not defined (correct failure)
+3. Implement: src/services/notification-service.ts
+4. Run test: PASS
+5. Run: harness validate — passes
+6. Commit: "feat(notifications): add NotificationService.create"
+7. Update state: { position: Task 3, progress: { "Task 1": "complete", "Task 2": "complete" } }
+```
+
+**Task 3: Add list and expiry (TDD) — has checkpoint**
+
+```
+[checkpoint:human-verify] — "Tasks 1-2 complete. NotificationService can create
+notifications. Tests pass. Continue to Task 3 (list and expiry methods)?"
+Human: "Continue."
+
+1. Write tests: list by userId, filter expired
+2. Run tests: FAIL (methods not implemented)
+3. Implement list() and isExpired()
+4. Run tests: PASS
+5. Run: harness validate — passes
+6. Commit: "feat(notifications): add list and expiry to NotificationService"
+7. Update state, append learning:
+   "## 2026-03-14 — Task 3: list and expiry
+   - [gotcha]: Date comparison needed UTC normalization — used Date.now() not new Date()"
+```
+
+**Context reset mid-plan (resume at Task 4):**
+
+```
+Read plan: docs/plans/2026-03-14-notifications-plan.md
+Read state: .harness/state.json — position: Task 4, Tasks 1-3 complete
+Read learnings: .harness/learnings.md — "Date comparison needed UTC normalization"
+Run: harness validate — passes. Resume from Task 4.
+```
+
+## Gates
+
+These are hard stops. Violating any gate means the process has broken down.
+
+- **No execution without a plan.** If no plan document exists, do not start. Use harness-planning to create one.
+- **No improvisation.** Execute the plan as written. If the plan says "create file X with code Y," create file X with code Y. Do not add "improvements" or "optimizations" that are not in the plan.
+- **No skipping tasks.** Tasks are ordered by dependency. Skipping a task means later tasks may fail. Execute in order.
+- **No skipping validation.** `harness validate` runs after every task. No exceptions. A task that passes its tests but fails validation is not complete.
+- **No ignoring checkpoints.** If a task has a `[checkpoint:*]` marker, execution must pause. Do not auto-continue past checkpoints.
+- **No guessing past blockers.** If a task cannot be completed as written, stop. Report the blocker. Do not invent a workaround.
+- **State must be updated.** After every task, `.harness/state.json` must reflect the new position. Skipping state updates makes resume impossible.
+
+## Escalation
+
+- **When a task fails and the fix is outside task scope:** Report: "Task N failed because [reason]. The fix requires changes to [files/tasks outside scope]. The plan needs to be updated at Tasks [X, Y] before I can continue."
+- **When the plan references files that do not exist:** The plan is out of date or was written against a different branch. Report: "Task N references [file] which does not exist. Plan may need regeneration."
+- **When tests pass but behavior seems wrong:** Do not ignore your instinct, but also do not act on it unilaterally. Report: "Task N passes all tests, but I notice [observation]. Should I investigate before proceeding?"
+- **When state is corrupted or inconsistent:** If `.harness/state.json` says Task 5 is complete but the code for Task 5 does not exist, the state is wrong. Report the inconsistency. Do not trust corrupted state — re-verify from Task 1 if needed.
+- **When the human wants to skip ahead:** Explain the risk: "Skipping Task N means Tasks [X, Y] that depend on it may fail. If you want to skip, we should update the plan to remove the dependency." Get explicit approval before skipping.
+
+## Trace Output (Optional)
+
+When `.harness/gate.json` has `"trace": true` or `--verbose` is passed, append one-sentence reasoning at each phase boundary to `.harness/trace.md`.
+
+**Format:** `**[PHASE HH:MM:SS]** summary`
+
+Example:
+
+```markdown
+**[PREPARE 14:32:07]** Loaded plan with 5 tasks, resuming from Task 3 per state.json.
+**[EXECUTE 14:32:15]** Task 3 committed; mechanical gate passed on first attempt.
+**[VERIFY 14:35:42]** Deep audit requested at milestone; all 3 levels passed.
+**[PERSIST 14:35:50]** State updated, handoff.json written with 2 pending tasks.
+```
+
+This is for human debugging only. Not required for normal execution.
+

package/dist/agents/commands/cursor/harness/harness-hotspot-detector.mdc

@@ -0,0 +1,169 @@
+---
+description: Identify structural risk hotspots via co-change and churn analysis
+alwaysApply: false
+---
+
+<!-- Generated by harness generate-slash-commands. Do not edit. -->
+
+# Harness Hotspot Detector
+
+> Identify modules that represent structural risk via co-change and churn analysis.
+
+## When to Use
+
+- Weekly scheduled analysis to track codebase risk
+- Before major refactoring — find the riskiest areas
+- When investigating why changes keep breaking unrelated features
+- NOT for finding dead code (use cleanup-dead-code)
+- NOT for checking architecture rules (use enforce-architecture)
+
+## Prerequisites
+
+A knowledge graph at `.harness/graph/` with git history enables full analysis. If no graph exists,
+the skill uses static analysis fallbacks (see Graph Availability section).
+Run `harness scan` to enable graph-enhanced analysis.
+
+### Graph Availability
+
+Before starting, check if `.harness/graph/graph.json` exists.
+
+**If graph exists:** Use graph tools as primary strategy. (Staleness sensitivity: **Low** — never auto-refresh.
+Git-based churn data in the graph remains useful even when slightly stale.)
+
+**If graph exists and is fresh (or refreshed):** Use graph tools as primary strategy.
+
+**If no graph exists:** Output "Running without graph (run `harness scan` to
+enable full analysis)" and use fallback strategies for all subsequent steps.
+
+## Process
+
+### Phase 1: CO-CHANGE — Analyze Co-Change Patterns
+
+Query the graph for `co_changes_with` edges (created by GitIngestor):
+
+```
+query_graph(rootNodeIds=[all file nodes], includeEdges=["co_changes_with"])
+```
+
+Identify file pairs that frequently change together:
+
+- **Co-located pairs** (same directory): Normal — they share a concern.
+- **Distant pairs** (different modules): Suspicious — may indicate hidden coupling.
+
+Flag distant co-change pairs as potential hotspots.
+
+### Phase 2: CHURN — Identify High-Churn Files
+
+Query commit nodes to find files with the highest change frequency:
+
+```
+query_graph(rootNodeIds=[commit nodes], includeTypes=["commit", "file"], includeEdges=["co_changes_with"])
+```
+
+Rank files by:
+
+- Total commit count touching the file
+- Recent velocity (commits in last 30 days vs prior 30 days)
+- Change size (total lines added + deleted)
+
+High churn in shared utilities or core modules = high risk.
+
+#### Fallback (without graph)
+
+When no graph is available, git log provides nearly all the data needed (~90% completeness):
+
+1. **Per-file churn**: `git log --format="%H" -- <file>` for each source file (use glob to enumerate). Count commits per file. Sort descending to rank by churn.
+2. **Recent velocity**: `git log --since="30 days ago" --format="%H" -- <file>` vs `git log --since="60 days ago" --until="30 days ago" --format="%H" -- <file>` to compare recent vs prior 30-day windows.
+3. **Co-change detection**: `git log --format="%H %n" --name-only` to build a map of which files changed together in the same commit. File pairs that appear together in >3 commits are co-change candidates.
+4. **Distant co-change identification**: For co-change pairs, check if they share a parent directory (co-located = normal) or are in different modules (distant = suspicious).
+5. **Complexity proxy**: Use line count (`wc -l`) as a rough proxy for complexity when graph complexity metrics are unavailable.
+6. **Hidden dependency detection**: Cross-reference co-change pairs against import parsing (grep for import statements). Co-change pairs with no import relationship indicate hidden dependencies.
+
+> Fallback completeness: ~90% — git log provides nearly all the data the graph stores for this use case.
+
+### Phase 3: COUPLING — Detect Hidden Dependencies
+
+Cross-reference co-change data with structural data:
+
+1. **High logical coupling, low structural coupling**: Files that always change together but have no `imports` edge between them. This indicates a hidden dependency — changing one requires changing the other, but the code doesn't express this relationship.
+
+2. **High structural coupling, low logical coupling**: Files with `imports` edges but that rarely change together. This may indicate over-coupling — the import exists but the relationship is weak.
+
+Use `get_relationships` to check structural edges between co-change pairs.
+
+### Phase 4: REPORT — Generate Ranked Hotspot Report
+
+```
+## Hotspot Analysis Report
+
+### Risk Hotspots (ranked by risk score)
+
+1. **src/services/billing.ts** — Risk: HIGH
+   - Churn: 23 commits (last 30 days: 8)
+   - Co-changes with: src/types/invoice.ts (distant, 15 co-changes)
+   - Hidden dependency: no imports edge to invoice.ts
+   - Recommendation: Extract shared billing types or add explicit dependency
+
+2. **src/utils/helpers.ts** — Risk: HIGH
+   - Churn: 45 commits (highest in codebase)
+   - Co-changes with: 12 different files across 4 modules
+   - Recommendation: Split into domain-specific utilities to reduce blast radius
+
+3. **src/middleware/auth.ts** — Risk: MEDIUM
+   - Churn: 15 commits
+   - Co-changes with: src/routes/login.ts (co-located, expected)
+   - No hidden dependencies detected
+
+### Summary
+- Total hotspots detected: 5
+- High risk: 2
+- Medium risk: 3
+- Hidden dependencies: 1
+```
+
+## Harness Integration
+
+- **`harness scan`** — Recommended before this skill for full graph-enhanced analysis. If graph is missing, skill uses git log fallbacks.
+- **`harness validate`** — Run after acting on findings to verify project health.
+- **Graph tools** — This skill uses `query_graph`, `get_impact`, and `get_relationships` MCP tools.
+
+## Success Criteria
+
+- Hotspots ranked by composite risk score (churn + coupling)
+- Hidden dependencies identified (high co-change, no structural edge)
+- Co-change patterns detected and classified (co-located vs distant)
+- Report follows the structured output format
+- All findings are backed by graph query evidence (with graph) or git log analysis (without graph)
+
+## Examples
+
+### Example: Detecting Hotspots in a Growing Codebase
+
+```
+Input: Scheduled weekly analysis on project root
+
+1. CO-CHANGE — query_graph for co_changes_with edges
+               Found 4 distant co-change pairs
+2. CHURN     — Ranked files by commit frequency
+               billing.ts: 23 commits, helpers.ts: 45 commits
+3. COUPLING  — Cross-referenced co-change vs imports edges
+               billing.ts <-> invoice.ts: 15 co-changes, no imports edge
+               (hidden dependency detected)
+4. REPORT    — Ranked hotspots by risk score
+
+Output:
+  Hotspots: 5 total (2 high, 3 medium)
+  Hidden dependencies: 1 (billing.ts <-> invoice.ts)
+  Top recommendation: Extract shared billing types
+```
+
+## Gates
+
+- **Graph preferred, fallback available.** If no graph exists, use git log for churn and co-change analysis. Do not stop — git log provides ~90% of the data needed.
+- **Systematic analysis required.** Use graph `co_changes_with` edges when available; use `git log` commit analysis when not. Do not guess — parse actual git history.
+
+## Escalation
+
+- **When hidden dependencies found**: Recommend making the dependency explicit (add import) or extracting shared code.
+- **When a single file has >30 commits**: Flag as critical hotspot requiring architectural attention.
+