@harness-engineering/cli 1.9.0 → 1.11.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (86) hide show
  1. package/dist/agents/skills/claude-code/enforce-architecture/SKILL.md +4 -0
  2. package/dist/agents/skills/claude-code/harness-autopilot/SKILL.md +7 -2
  3. package/dist/agents/skills/claude-code/harness-brainstorming/SKILL.md +10 -1
  4. package/dist/agents/skills/claude-code/harness-execution/SKILL.md +2 -2
  5. package/dist/agents/skills/claude-code/harness-parallel-agents/SKILL.md +105 -20
  6. package/dist/agents/skills/claude-code/harness-pre-commit-review/SKILL.md +37 -0
  7. package/dist/agents/skills/gemini-cli/enforce-architecture/SKILL.md +4 -0
  8. package/dist/agents/skills/gemini-cli/harness-autopilot/SKILL.md +7 -2
  9. package/dist/agents/skills/gemini-cli/harness-brainstorming/SKILL.md +10 -1
  10. package/dist/agents/skills/gemini-cli/harness-execution/SKILL.md +2 -2
  11. package/dist/agents/skills/gemini-cli/harness-parallel-agents/SKILL.md +105 -20
  12. package/dist/agents/skills/gemini-cli/harness-pre-commit-review/SKILL.md +37 -0
  13. package/dist/agents-md-ZFV6RR5J.js +8 -0
  14. package/dist/architecture-EXNUMH5R.js +13 -0
  15. package/dist/bin/harness-mcp.d.ts +1 -0
  16. package/dist/bin/harness-mcp.js +28 -0
  17. package/dist/bin/harness.js +42 -8
  18. package/dist/check-phase-gate-VZFOY2PO.js +12 -0
  19. package/dist/chunk-2NCIKJES.js +470 -0
  20. package/dist/chunk-2YPZKGAG.js +62 -0
  21. package/dist/{chunk-CGSHUJES.js → chunk-2YSQOUHO.js} +4484 -2688
  22. package/dist/chunk-3WGJMBKH.js +45 -0
  23. package/dist/{chunk-ULSRSP53.js → chunk-6N4R6FVX.js} +11 -112
  24. package/dist/{chunk-6JIT7CEM.js → chunk-72GHBOL2.js} +1 -1
  25. package/dist/chunk-BM3PWGXQ.js +14 -0
  26. package/dist/chunk-C2ERUR3L.js +255 -0
  27. package/dist/chunk-EBJQ6N4M.js +39 -0
  28. package/dist/chunk-GNGELAXY.js +293 -0
  29. package/dist/chunk-GSIVNYVJ.js +187 -0
  30. package/dist/chunk-HD4IBGLA.js +80 -0
  31. package/dist/chunk-I6JZYEGT.js +4361 -0
  32. package/dist/chunk-IDZNPTYD.js +16 -0
  33. package/dist/chunk-JSTQ3AWB.js +31 -0
  34. package/dist/chunk-K6XAPGML.js +27 -0
  35. package/dist/chunk-KET4QQZB.js +8 -0
  36. package/dist/chunk-L2KLU56K.js +125 -0
  37. package/dist/chunk-MHBMTPW7.js +29 -0
  38. package/dist/chunk-NC6PXVWT.js +116 -0
  39. package/dist/chunk-NKDM3FMH.js +52 -0
  40. package/dist/chunk-PA2XHK75.js +248 -0
  41. package/dist/chunk-Q6AB7W5Z.js +135 -0
  42. package/dist/chunk-QPEH2QPG.js +347 -0
  43. package/dist/chunk-TEFCFC4H.js +15 -0
  44. package/dist/chunk-TI4TGEX6.js +85 -0
  45. package/dist/chunk-TRAPF4IX.js +185 -0
  46. package/dist/chunk-VRFZWGMS.js +68 -0
  47. package/dist/chunk-VUCPTQ6G.js +67 -0
  48. package/dist/chunk-W6Y7ZW3Y.js +13 -0
  49. package/dist/chunk-WJZDO6OY.js +103 -0
  50. package/dist/chunk-WUJTCNOU.js +122 -0
  51. package/dist/chunk-X3MN5UQJ.js +89 -0
  52. package/dist/chunk-Z75JC6I2.js +189 -0
  53. package/dist/chunk-ZOAWBDWU.js +72 -0
  54. package/dist/{chunk-RTPHUDZS.js → chunk-ZWC3MN5E.js} +1944 -2779
  55. package/dist/ci-workflow-K5RCRNYR.js +8 -0
  56. package/dist/constants-5JGUXPEK.js +6 -0
  57. package/dist/create-skill-WPXHSLX2.js +11 -0
  58. package/dist/dist-D4RYGUZE.js +14 -0
  59. package/dist/{dist-C5PYIQPF.js → dist-JVZ2MKBC.js} +108 -6
  60. package/dist/dist-L7LAAQAS.js +18 -0
  61. package/dist/{dist-I7DB5VKB.js → dist-M6BQODWC.js} +1145 -0
  62. package/dist/docs-PWCUVYWU.js +12 -0
  63. package/dist/engine-6XUP6GAK.js +8 -0
  64. package/dist/entropy-4I6JEYAC.js +12 -0
  65. package/dist/feedback-TNIW534S.js +18 -0
  66. package/dist/generate-agent-definitions-MWKEA5NU.js +15 -0
  67. package/dist/glob-helper-5OHBUQAI.js +52 -0
  68. package/dist/graph-loader-KO4GJ5N2.js +8 -0
  69. package/dist/index.d.ts +328 -12
  70. package/dist/index.js +93 -34
  71. package/dist/loader-4FIPIFII.js +10 -0
  72. package/dist/mcp-MOKLYNZL.js +34 -0
  73. package/dist/performance-BTOJCPXU.js +24 -0
  74. package/dist/review-pipeline-3YTW3463.js +9 -0
  75. package/dist/runner-VMYLHWOC.js +6 -0
  76. package/dist/runtime-GO7K2PJE.js +9 -0
  77. package/dist/security-4P2GGFF6.js +9 -0
  78. package/dist/skill-executor-RG45LUO5.js +8 -0
  79. package/dist/templates/orchestrator/WORKFLOW.md +48 -0
  80. package/dist/templates/orchestrator/template.json +6 -0
  81. package/dist/validate-JN44D2Q7.js +12 -0
  82. package/dist/validate-cross-check-DB7RIFFF.js +8 -0
  83. package/dist/version-KFFPOQAX.js +6 -0
  84. package/package.json +13 -7
  85. package/dist/create-skill-UZOHMXRU.js +0 -8
  86. package/dist/validate-cross-check-VG573VZO.js +0 -7
@@ -47,6 +47,8 @@ Graph queries show the complete violation scope (not just the first occurrence p
47
47
 
48
48
  1. **Run `harness check-deps`** to analyze all import statements against the constraint model. Capture the full JSON output.
49
49
 
50
+ 1b. **Optionally run `harness check-arch`** for comprehensive architecture analysis beyond dependency checking. This covers circular dependencies, complexity, coupling, module size, and dependency depth in addition to layer violations.
51
+
50
52
  2. **Parse the results.** Each violation includes:
51
53
  - The violating file and line number
52
54
  - The forbidden import target
@@ -162,6 +164,8 @@ Module A re-exports from Module B, and Module B imports from Module A. The circu
162
164
  - **`harness-design-system`** — Provides the design token source of truth (`tokens.json`) that constraints validate against.
163
165
  - **`harness-accessibility`** — Provides WCAG contrast validation used by DESIGN-003 constraints.
164
166
  - **Design constraint category** — Controlled by `design.strictness` in `harness.config.json`. Design violations surface alongside architectural violations in the same report.
167
+ - **`harness check-arch`** — Architecture assertion framework. Runs all 7 metric collectors against baseline and thresholds. Use for comprehensive structural health checks beyond layer dependencies. Supports `--update-baseline` to capture current state and `--json` for machine-readable output.
168
+ - **`harness check-arch --module <path>`** — Scoped architecture check for a single module. Use when validating a specific subsystem.
165
169
 
166
170
  ## Success Criteria
167
171
 
@@ -339,7 +339,9 @@ INIT → ASSESS → PLAN → APPROVE_PLAN → EXECUTE → VERIFY → REVIEW →
339
339
 
340
340
  3. **Mark phase as `complete`** in state.
341
341
 
342
- 4. **Check for next phase:**
342
+ 4. **Sync roadmap.** If `docs/roadmap.md` exists, call `manage_roadmap` with action `sync` and `apply: true`. This reflects the just-completed phase in the roadmap (e.g., updating the feature from `planned` to `in-progress`). If `manage_roadmap` is unavailable, fall back to direct file manipulation using `syncRoadmap()` from core. Skip silently if no roadmap exists. Do not use `force_sync: true` — the human-always-wins rule applies.
343
+
344
+ 5. **Check for next phase:**
343
345
  - If more phases remain: "Phase {N} complete. Next: Phase {N+1}: {name} (complexity: {level}). Continue? (yes / stop)"
344
346
  - **yes** — Increment `currentPhase`, reset `retryBudget`, transition to ASSESS.
345
347
  - **stop** — Save state and exit.
@@ -383,7 +385,9 @@ INIT → ASSESS → PLAN → APPROVE_PLAN → EXECUTE → VERIFY → REVIEW →
383
385
  - [skill:harness-autopilot] [outcome:observation] {any notable patterns from the run}
384
386
  ```
385
387
 
386
- 5. **Clean up state:** Set `currentState: "DONE"` in `{sessionDir}/autopilot-state.json`. Do not delete the file it serves as a record.
388
+ 5. **Update roadmap to done.** If `docs/roadmap.md` exists and the current spec maps to a roadmap feature, call `manage_roadmap` with action `update` to set the feature status to `done`. Derive the feature name from the spec title (H1 heading) or the session's `handoff.json` `summary` field. If `manage_roadmap` is unavailable, fall back to direct file manipulation using `updateFeature()` from core. Skip silently if no roadmap exists or if the feature is not found. Do not use `force_sync: true`.
389
+
390
+ 6. **Clean up state:** Set `currentState: "DONE"` in `{sessionDir}/autopilot-state.json`. Do not delete the file — it serves as a record.
387
391
 
388
392
  ## Harness Integration
389
393
 
@@ -394,6 +398,7 @@ INIT → ASSESS → PLAN → APPROVE_PLAN → EXECUTE → VERIFY → REVIEW →
394
398
  - **Handoff** — `.harness/sessions/<slug>/handoff.json` is written by each delegated skill and read by the next. Autopilot writes a final handoff on DONE.
395
399
  - **Learnings** — `.harness/learnings.md` (global) is appended by both delegated skills and autopilot itself.
396
400
  - **Roadmap context** — During INIT, reads `docs/roadmap.md` (if present) for project-level priorities, blockers, and milestone status. Provides broader context for phase execution decisions.
401
+ - **Roadmap sync** — During PHASE_COMPLETE, calls `manage_roadmap` with `sync` and `apply: true` to reflect phase progress. During DONE, calls `manage_roadmap` with `update` to set feature status to `done`. Both skip silently when no roadmap exists. Neither uses `force_sync: true`.
397
402
 
398
403
  ## Success Criteria
399
404
 
@@ -156,7 +156,15 @@ These keywords flow into the `handoff.json` `contextKeywords` field when the spe
156
156
 
157
157
  The human must explicitly approve before this skill is complete.
158
158
 
159
- 6. **Write handoff and suggest transition.** After the human approves the spec:
159
+ 6. **Add feature to roadmap.** If `docs/roadmap.md` exists:
160
+ - Derive the feature name from the spec title (the H1 heading of the proposal).
161
+ - Call `manage_roadmap` with action `add`, `status: "planned"`, `milestone: "Current Work"`, and the spec path. Include a one-line summary from the spec overview.
162
+ - If the feature already exists in the roadmap (duplicate name), skip silently — the feature was likely added manually or by a prior brainstorming session.
163
+ - Log: `"Added '<feature-name>' to roadmap as planned"` (informational, not a prompt).
164
+ - If `manage_roadmap` is unavailable, fall back to direct file manipulation using `addFeature()` from core.
165
+ - If no roadmap exists, skip this step silently.
166
+
167
+ 7. **Write handoff and suggest transition.** After the human approves the spec:
160
168
 
161
169
  Write `.harness/handoff.json`:
162
170
 
@@ -257,6 +265,7 @@ Converge on a recommendation that addresses all concerns before presenting the d
257
265
  - **`harness check-docs`** — Run to verify the spec does not conflict with existing documentation.
258
266
  - **Spec location** — Specs go to `docs/changes/<feature>/proposal.md`. Follow existing naming patterns.
259
267
  - **Handoff to harness-planning** — Once the spec is approved, invoke harness-planning to create the implementation plan from the spec.
268
+ - **Roadmap sync** — After spec approval, call `manage_roadmap` with action `add` to register the new feature as `planned` in `docs/roadmap.md`. Skip silently if no roadmap exists. Duplicates are silently ignored.
260
269
  - **`emit_interaction`** -- Call at the end of Phase 4 to suggest transitioning to harness-planning. Uses confirmed transition (waits for user approval).
261
270
 
262
271
  #### Requirement Phrasing
@@ -266,7 +266,7 @@ Skipping this step means subsequent graph queries (impact analysis, dependency h
266
266
  }
267
267
  ```
268
268
 
269
- 5. **Sync roadmap (if present).** If `docs/roadmap.md` exists, trigger a roadmap sync to update linked feature statuses based on the just-completed execution state. Use the `manage_roadmap` MCP tool with `sync` action if available, or invoke `/harness:roadmap --sync`. This keeps the roadmap current as plans are executed. If no roadmap exists, skip this step silently.
269
+ 5. **Sync roadmap (mandatory when present).** If `docs/roadmap.md` exists, call `manage_roadmap` with action `sync` and `apply: true` to update linked feature statuses from the just-completed execution state. Do not use `force_sync: true` the human-always-wins rule applies. If `manage_roadmap` is unavailable, fall back to direct file manipulation using `syncRoadmap()` from core. If no roadmap exists, skip silently.
270
270
 
271
271
  6. **Learnings are append-only.** Never edit or delete previous learnings. They are a chronological record.
272
272
 
@@ -327,7 +327,7 @@ These are non-negotiable. When any condition is met, stop immediately.
327
327
  - **`harness state learn "<message>"`** — Append a learning from the command line.
328
328
  - **`.harness/state.json`** — Read at session start to resume position. Updated after every task.
329
329
  - **`.harness/learnings.md`** — Append-only knowledge capture. Read at session start for prior context.
330
- - **Roadmap sync** — After completing plan execution, sync roadmap status via `manage_roadmap sync` if `docs/roadmap.md` exists. Keeps roadmap current with execution progress.
330
+ - **Roadmap sync** — After completing plan execution, call `manage_roadmap` with action `sync` and `apply: true` to update roadmap status. Mandatory when `docs/roadmap.md` exists. Do not use `force_sync: true`. Falls back to `syncRoadmap()` from core if MCP tool is unavailable.
331
331
  - **`emit_interaction`** -- Call at plan completion to auto-transition to harness-verification. Uses auto-transition (proceeds immediately without user confirmation).
332
332
 
333
333
  ## Success Criteria
@@ -16,28 +16,78 @@
16
16
 
17
17
  ## Process
18
18
 
19
- ### Step 1: Identify Independent Problem Domains
19
+ ### Step 1: Verify Task Independence
20
20
 
21
- Before dispatching anything in parallel, rigorously verify independence:
21
+ Before dispatching anything in parallel, predict conflicts using `predict_conflicts` (preferred) or `check_task_independence` (fallback):
22
22
 
23
- 1. **List the candidate tasks.** Pull from the plan, or identify from the current work.
23
+ 1. **List the candidate tasks.** Pull from the plan, or identify from the current work. For each task, identify the files it will read and write.
24
24
 
25
- 2. **Check file overlap.** For each pair of tasks, compare the files they will read and write. Any overlap in WRITE targets means they are NOT independent. Overlap in READ targets is acceptable only if neither task writes to those files.
25
+ 2. **Call `check_task_independence`.** Pass the tasks with their file lists:
26
26
 
27
- 3. **Check state overlap.** Do any tasks share database tables, configuration files, environment variables, or in-memory state? If yes, they are NOT independent.
27
+ ```json
28
+ {
29
+ "path": "<project-root>",
30
+ "tasks": [
31
+ { "id": "task-a", "files": ["src/module-a/index.ts", "src/module-a/index.test.ts"] },
32
+ { "id": "task-b", "files": ["src/module-b/index.ts", "src/module-b/index.test.ts"] }
33
+ ],
34
+ "depth": 1
35
+ }
36
+ ```
28
37
 
29
- 4. **Check import graph overlap.** If Task A modifies module X and Task B imports module X, they are NOT independent — Task B's tests may be affected by Task A's changes.
38
+ The tool checks direct file overlap AND transitive dependency overlap (via the knowledge graph when available). It returns:
39
+ - **`pairs`**: Pairwise independence results with overlap details
40
+ - **`groups`**: Safe parallel dispatch groups (connected components of the conflict graph)
41
+ - **`verdict`**: Human-readable summary (e.g., "3 of 4 tasks can run in parallel in 2 groups")
42
+ - **`analysisLevel`**: `"graph-expanded"` (full analysis) or `"file-only"` (graph unavailable)
30
43
 
31
- 5. **When in doubt, run serially.** The cost of a false parallel dispatch (merge conflicts, subtle bugs, wasted work) far exceeds the cost of running serially.
44
+ **Preferred: Use `predict_conflicts`** for severity-aware analysis with automatic regrouping:
45
+
46
+ ```json
47
+ {
48
+ "path": "<project-root>",
49
+ "tasks": [
50
+ { "id": "task-a", "files": ["src/module-a/index.ts", "src/module-a/index.test.ts"] },
51
+ { "id": "task-b", "files": ["src/module-b/index.ts", "src/module-b/index.test.ts"] }
52
+ ],
53
+ "depth": 1
54
+ }
55
+ ```
56
+
57
+ The `predict_conflicts` tool extends independence checking with:
58
+ - **`conflicts`**: Severity-classified conflict details with human-readable reasoning
59
+ - **`groups`**: Revised parallel dispatch groups (high-severity conflicts force serialization)
60
+ - **`summary`**: Conflict counts by severity and whether regrouping occurred
61
+ - **`verdict`**: Human-readable summary including severity breakdown
62
+
63
+ If `predict_conflicts` is unavailable, fall back to `check_task_independence`.
64
+
65
+ 3. **Act on the result.** Use the returned `groups` for dispatch. Flag any medium-severity conflicts to the coordinator. If high-severity conflicts forced regrouping (`summary.regrouped === true`), log which tasks were serialized and why. If all tasks are in one group, dispatch them all in parallel. If tasks are split across groups, dispatch each group as a separate parallel wave.
66
+
67
+ 4. **When in doubt, run serially.** The cost of a false parallel dispatch (merge conflicts, subtle bugs, wasted work) far exceeds the cost of running serially.
68
+
69
+ #### Manual Fallback (when MCP tool is unavailable)
70
+
71
+ If `check_task_independence` is not available, verify independence manually:
72
+
73
+ 1. **Check file overlap.** For each pair of tasks, compare the files they will read and write. Any overlap in WRITE targets means they are NOT independent. Overlap in READ targets is acceptable only if neither task writes to those files.
74
+
75
+ 2. **Check state overlap.** Do any tasks share database tables, configuration files, environment variables, or in-memory state? If yes, they are NOT independent.
76
+
77
+ 3. **Check import graph overlap.** If Task A modifies module X and Task B imports module X, they are NOT independent — Task B's tests may be affected by Task A's changes.
78
+
79
+ 4. **When in doubt, run serially.** Same principle as above.
32
80
 
33
81
  ### Graph-Enhanced Context (when available)
34
82
 
35
- When a knowledge graph exists at `.harness/graph/`, use graph queries for faster, more accurate independence verification:
83
+ When a knowledge graph exists at `.harness/graph/`, `check_task_independence` automatically uses it for transitive dependency analysis (this is the `"graph-expanded"` analysis level). No manual graph queries are needed for independence checking.
84
+
85
+ For custom queries beyond independence checking, these tools remain available:
36
86
 
37
- - `query_graph` — get the dependency subgraph per candidate task and check for node overlap between tasks
38
- - `get_impact` — verify tasks do not write to overlapping files or share transitive dependencies
87
+ - `query_graph` — get the dependency subgraph for a specific module or file
88
+ - `get_impact` — assess the impact radius of changes to a specific module
39
89
 
40
- Automated graph-based independence verification replaces manual import grep and catches transitive overlaps that file-level checks miss. Fall back to file-based commands if no graph is available.
90
+ When no graph is available, `check_task_independence` falls back to file-only overlap detection and flags `analysisLevel: "file-only"` so you know transitive dependencies were not checked.
41
91
 
42
92
  ### Step 2: Create Focused Agent Tasks
43
93
 
@@ -101,7 +151,7 @@ For each independent task, write a focused agent brief:
101
151
 
102
152
  ## Success Criteria
103
153
 
104
- - Independence was verified before dispatch (file overlap, state overlap, import graph)
154
+ - Independence was verified before dispatch via `check_task_independence` (or manual fallback if tool unavailable)
105
155
  - Each agent had a focused brief with explicit scope, goal, constraints, and expected output
106
156
  - All agents completed successfully (or blockers were reported)
107
157
  - Integration produced no merge conflicts (or conflicts were resolved)
@@ -117,17 +167,52 @@ For each independent task, write a focused agent brief:
117
167
 
118
168
  **Step 1: Verify independence**
119
169
 
170
+ Call `check_task_independence`:
171
+
172
+ ```json
173
+ {
174
+ "path": ".",
175
+ "tasks": [
176
+ {
177
+ "id": "task-4-user",
178
+ "files": [
179
+ "src/services/user/service.ts",
180
+ "src/services/user/service.test.ts",
181
+ "src/types/user.ts"
182
+ ]
183
+ },
184
+ {
185
+ "id": "task-5-product",
186
+ "files": [
187
+ "src/services/product/service.ts",
188
+ "src/services/product/service.test.ts",
189
+ "src/types/product.ts"
190
+ ]
191
+ },
192
+ {
193
+ "id": "task-6-notification",
194
+ "files": [
195
+ "src/services/notification/service.ts",
196
+ "src/services/notification/service.test.ts",
197
+ "src/types/notification.ts"
198
+ ]
199
+ }
200
+ ]
201
+ }
120
202
  ```
121
- Task 4 (UserService): writes src/services/user/*, reads src/types/user.ts
122
- Task 5 (ProductService): writes src/services/product/*, reads src/types/product.ts
123
- Task 6 (NotificationService): writes src/services/notification/*, reads src/types/notification.ts
124
-
125
- File overlap: NONE (different directories, different type files)
126
- State overlap: NONE (different DB tables, no shared config)
127
- Import graph: NONE (no cross-service imports)
128
- Verdict: INDEPENDENT safe to parallelize
203
+
204
+ Result:
205
+
206
+ ```json
207
+ {
208
+ "analysisLevel": "graph-expanded",
209
+ "groups": [["task-4-user", "task-5-product", "task-6-notification"]],
210
+ "verdict": "3 of 3 tasks can run in parallel in 1 group"
211
+ }
129
212
  ```
130
213
 
214
+ All tasks are independent — safe to parallelize.
215
+
131
216
  **Step 2: Create agent briefs**
132
217
 
133
218
  ```
@@ -81,6 +81,26 @@ If a knowledge graph exists at `.harness/graph/` and code files have changed sin
81
81
 
82
82
  If no graph exists, skip this step — the tools fall back to non-graph behavior.
83
83
 
84
+ ### Impact Preview
85
+
86
+ After mechanical checks pass, run `harness impact-preview` to surface the blast radius of staged changes. This is informational only — it never blocks the commit.
87
+
88
+ ```bash
89
+ harness impact-preview
90
+ ```
91
+
92
+ Include the output in the report between the mechanical checks section and the AI review section:
93
+
94
+ ```
95
+ Impact Preview (3 staged files)
96
+ Code: 12 files (routes/login.ts, middleware/verify.ts, +10)
97
+ Tests: 3 tests (auth.test.ts, integration.test.ts, +1)
98
+ Docs: 2 docs (auth-guide.md, api-reference.md)
99
+ Total: 17 affected
100
+ ```
101
+
102
+ If no graph exists, the command prints a nudge message and returns — no action needed. If no files are staged, it says so. Neither case blocks the workflow.
103
+
84
104
  ### Phase 2: Classify Changes
85
105
 
86
106
  Determine whether AI review is needed based on what changed.
@@ -192,6 +212,12 @@ Mechanical Checks:
192
212
  - Tests: PASS (12/12)
193
213
  - Security Scan: PASS (0 errors, 0 warnings)
194
214
 
215
+ Impact Preview (3 staged files)
216
+ Code: 12 files (routes/login.ts, middleware/verify.ts, +10)
217
+ Tests: 3 tests (auth.test.ts, integration.test.ts, +1)
218
+ Docs: 2 docs (auth-guide.md, api-reference.md)
219
+ Total: 17 affected
220
+
195
221
  AI Review: PASS (no issues found)
196
222
  ```
197
223
 
@@ -207,6 +233,11 @@ Mechanical Checks:
207
233
  - Security Scan: WARN (0 errors, 1 warning)
208
234
  - [SEC-NET-001] src/cors.ts:5 — CORS wildcard origin
209
235
 
236
+ Impact Preview (2 staged files)
237
+ Code: 8 files (cors.ts, server.ts, +6)
238
+ Tests: 2 tests (cors.test.ts, server.test.ts)
239
+ Total: 10 affected
240
+
210
241
  AI Review: 2 observations
211
242
  1. [file:line] Possible null dereference — `user.email` accessed without null check after `findUser()` which can return null.
212
243
  2. [file:line] Debug artifact — `console.log('debug:', payload)` appears to be left from debugging.
@@ -244,6 +275,7 @@ fi
244
275
  - Complements harness-code-review (full review) — use pre-commit for quick checks, code-review for thorough analysis
245
276
  - **`assess_project`** — Used in Phase 1 for harness-specific health checks (validate + deps) in a single call.
246
277
  - **`review_changes`** — Used in Phase 4 with `depth: 'quick'` for fast pre-commit diff analysis.
278
+ - **`harness impact-preview`** — Run after mechanical checks pass to show blast radius of staged changes. Informational only — never blocks.
247
279
 
248
280
  ## Success Criteria
249
281
 
@@ -264,6 +296,11 @@ Mechanical Checks:
264
296
  - Types: PASS
265
297
  - Tests: PASS (12/12)
266
298
 
299
+ Impact Preview (2 staged files)
300
+ Code: 5 files (auth.ts, login.ts, +3)
301
+ Tests: 2 tests (auth.test.ts, login.test.ts)
302
+ Total: 7 affected
303
+
267
304
  AI Review: PASS (no issues found)
268
305
  ```
269
306
 
@@ -47,6 +47,8 @@ Graph queries show the complete violation scope (not just the first occurrence p
47
47
 
48
48
  1. **Run `harness check-deps`** to analyze all import statements against the constraint model. Capture the full JSON output.
49
49
 
50
+ 1b. **Optionally run `harness check-arch`** for comprehensive architecture analysis beyond dependency checking. This covers circular dependencies, complexity, coupling, module size, and dependency depth in addition to layer violations.
51
+
50
52
  2. **Parse the results.** Each violation includes:
51
53
  - The violating file and line number
52
54
  - The forbidden import target
@@ -162,6 +164,8 @@ Module A re-exports from Module B, and Module B imports from Module A. The circu
162
164
  - **`harness-design-system`** — Provides the design token source of truth (`tokens.json`) that constraints validate against.
163
165
  - **`harness-accessibility`** — Provides WCAG contrast validation used by DESIGN-003 constraints.
164
166
  - **Design constraint category** — Controlled by `design.strictness` in `harness.config.json`. Design violations surface alongside architectural violations in the same report.
167
+ - **`harness check-arch`** — Architecture assertion framework. Runs all 7 metric collectors against baseline and thresholds. Use for comprehensive structural health checks beyond layer dependencies. Supports `--update-baseline` to capture current state and `--json` for machine-readable output.
168
+ - **`harness check-arch --module <path>`** — Scoped architecture check for a single module. Use when validating a specific subsystem.
165
169
 
166
170
  ## Success Criteria
167
171
 
@@ -339,7 +339,9 @@ INIT → ASSESS → PLAN → APPROVE_PLAN → EXECUTE → VERIFY → REVIEW →
339
339
 
340
340
  3. **Mark phase as `complete`** in state.
341
341
 
342
- 4. **Check for next phase:**
342
+ 4. **Sync roadmap.** If `docs/roadmap.md` exists, call `manage_roadmap` with action `sync` and `apply: true`. This reflects the just-completed phase in the roadmap (e.g., updating the feature from `planned` to `in-progress`). If `manage_roadmap` is unavailable, fall back to direct file manipulation using `syncRoadmap()` from core. Skip silently if no roadmap exists. Do not use `force_sync: true` — the human-always-wins rule applies.
343
+
344
+ 5. **Check for next phase:**
343
345
  - If more phases remain: "Phase {N} complete. Next: Phase {N+1}: {name} (complexity: {level}). Continue? (yes / stop)"
344
346
  - **yes** — Increment `currentPhase`, reset `retryBudget`, transition to ASSESS.
345
347
  - **stop** — Save state and exit.
@@ -383,7 +385,9 @@ INIT → ASSESS → PLAN → APPROVE_PLAN → EXECUTE → VERIFY → REVIEW →
383
385
  - [skill:harness-autopilot] [outcome:observation] {any notable patterns from the run}
384
386
  ```
385
387
 
386
- 5. **Clean up state:** Set `currentState: "DONE"` in `{sessionDir}/autopilot-state.json`. Do not delete the file it serves as a record.
388
+ 5. **Update roadmap to done.** If `docs/roadmap.md` exists and the current spec maps to a roadmap feature, call `manage_roadmap` with action `update` to set the feature status to `done`. Derive the feature name from the spec title (H1 heading) or the session's `handoff.json` `summary` field. If `manage_roadmap` is unavailable, fall back to direct file manipulation using `updateFeature()` from core. Skip silently if no roadmap exists or if the feature is not found. Do not use `force_sync: true`.
389
+
390
+ 6. **Clean up state:** Set `currentState: "DONE"` in `{sessionDir}/autopilot-state.json`. Do not delete the file — it serves as a record.
387
391
 
388
392
  ## Harness Integration
389
393
 
@@ -394,6 +398,7 @@ INIT → ASSESS → PLAN → APPROVE_PLAN → EXECUTE → VERIFY → REVIEW →
394
398
  - **Handoff** — `.harness/sessions/<slug>/handoff.json` is written by each delegated skill and read by the next. Autopilot writes a final handoff on DONE.
395
399
  - **Learnings** — `.harness/learnings.md` (global) is appended by both delegated skills and autopilot itself.
396
400
  - **Roadmap context** — During INIT, reads `docs/roadmap.md` (if present) for project-level priorities, blockers, and milestone status. Provides broader context for phase execution decisions.
401
+ - **Roadmap sync** — During PHASE_COMPLETE, calls `manage_roadmap` with `sync` and `apply: true` to reflect phase progress. During DONE, calls `manage_roadmap` with `update` to set feature status to `done`. Both skip silently when no roadmap exists. Neither uses `force_sync: true`.
397
402
 
398
403
  ## Success Criteria
399
404
 
@@ -156,7 +156,15 @@ These keywords flow into the `handoff.json` `contextKeywords` field when the spe
156
156
 
157
157
  The human must explicitly approve before this skill is complete.
158
158
 
159
- 6. **Write handoff and suggest transition.** After the human approves the spec:
159
+ 6. **Add feature to roadmap.** If `docs/roadmap.md` exists:
160
+ - Derive the feature name from the spec title (the H1 heading of the proposal).
161
+ - Call `manage_roadmap` with action `add`, `status: "planned"`, `milestone: "Current Work"`, and the spec path. Include a one-line summary from the spec overview.
162
+ - If the feature already exists in the roadmap (duplicate name), skip silently — the feature was likely added manually or by a prior brainstorming session.
163
+ - Log: `"Added '<feature-name>' to roadmap as planned"` (informational, not a prompt).
164
+ - If `manage_roadmap` is unavailable, fall back to direct file manipulation using `addFeature()` from core.
165
+ - If no roadmap exists, skip this step silently.
166
+
167
+ 7. **Write handoff and suggest transition.** After the human approves the spec:
160
168
 
161
169
  Write `.harness/handoff.json`:
162
170
 
@@ -257,6 +265,7 @@ Converge on a recommendation that addresses all concerns before presenting the d
257
265
  - **`harness check-docs`** — Run to verify the spec does not conflict with existing documentation.
258
266
  - **Spec location** — Specs go to `docs/changes/<feature>/proposal.md`. Follow existing naming patterns.
259
267
  - **Handoff to harness-planning** — Once the spec is approved, invoke harness-planning to create the implementation plan from the spec.
268
+ - **Roadmap sync** — After spec approval, call `manage_roadmap` with action `add` to register the new feature as `planned` in `docs/roadmap.md`. Skip silently if no roadmap exists. Duplicates are silently ignored.
260
269
  - **`emit_interaction`** -- Call at the end of Phase 4 to suggest transitioning to harness-planning. Uses confirmed transition (waits for user approval).
261
270
 
262
271
  #### Requirement Phrasing
@@ -266,7 +266,7 @@ Skipping this step means subsequent graph queries (impact analysis, dependency h
266
266
  }
267
267
  ```
268
268
 
269
- 5. **Sync roadmap (if present).** If `docs/roadmap.md` exists, trigger a roadmap sync to update linked feature statuses based on the just-completed execution state. Use the `manage_roadmap` MCP tool with `sync` action if available, or invoke `/harness:roadmap --sync`. This keeps the roadmap current as plans are executed. If no roadmap exists, skip this step silently.
269
+ 5. **Sync roadmap (mandatory when present).** If `docs/roadmap.md` exists, call `manage_roadmap` with action `sync` and `apply: true` to update linked feature statuses from the just-completed execution state. Do not use `force_sync: true` the human-always-wins rule applies. If `manage_roadmap` is unavailable, fall back to direct file manipulation using `syncRoadmap()` from core. If no roadmap exists, skip silently.
270
270
 
271
271
  6. **Learnings are append-only.** Never edit or delete previous learnings. They are a chronological record.
272
272
 
@@ -327,7 +327,7 @@ These are non-negotiable. When any condition is met, stop immediately.
327
327
  - **`harness state learn "<message>"`** — Append a learning from the command line.
328
328
  - **`.harness/state.json`** — Read at session start to resume position. Updated after every task.
329
329
  - **`.harness/learnings.md`** — Append-only knowledge capture. Read at session start for prior context.
330
- - **Roadmap sync** — After completing plan execution, sync roadmap status via `manage_roadmap sync` if `docs/roadmap.md` exists. Keeps roadmap current with execution progress.
330
+ - **Roadmap sync** — After completing plan execution, call `manage_roadmap` with action `sync` and `apply: true` to update roadmap status. Mandatory when `docs/roadmap.md` exists. Do not use `force_sync: true`. Falls back to `syncRoadmap()` from core if MCP tool is unavailable.
331
331
  - **`emit_interaction`** -- Call at plan completion to auto-transition to harness-verification. Uses auto-transition (proceeds immediately without user confirmation).
332
332
 
333
333
  ## Success Criteria
@@ -16,28 +16,78 @@
16
16
 
17
17
  ## Process
18
18
 
19
- ### Step 1: Identify Independent Problem Domains
19
+ ### Step 1: Verify Task Independence
20
20
 
21
- Before dispatching anything in parallel, rigorously verify independence:
21
+ Before dispatching anything in parallel, predict conflicts using `predict_conflicts` (preferred) or `check_task_independence` (fallback):
22
22
 
23
- 1. **List the candidate tasks.** Pull from the plan, or identify from the current work.
23
+ 1. **List the candidate tasks.** Pull from the plan, or identify from the current work. For each task, identify the files it will read and write.
24
24
 
25
- 2. **Check file overlap.** For each pair of tasks, compare the files they will read and write. Any overlap in WRITE targets means they are NOT independent. Overlap in READ targets is acceptable only if neither task writes to those files.
25
+ 2. **Call `check_task_independence`.** Pass the tasks with their file lists:
26
26
 
27
- 3. **Check state overlap.** Do any tasks share database tables, configuration files, environment variables, or in-memory state? If yes, they are NOT independent.
27
+ ```json
28
+ {
29
+ "path": "<project-root>",
30
+ "tasks": [
31
+ { "id": "task-a", "files": ["src/module-a/index.ts", "src/module-a/index.test.ts"] },
32
+ { "id": "task-b", "files": ["src/module-b/index.ts", "src/module-b/index.test.ts"] }
33
+ ],
34
+ "depth": 1
35
+ }
36
+ ```
28
37
 
29
- 4. **Check import graph overlap.** If Task A modifies module X and Task B imports module X, they are NOT independent — Task B's tests may be affected by Task A's changes.
38
+ The tool checks direct file overlap AND transitive dependency overlap (via the knowledge graph when available). It returns:
39
+ - **`pairs`**: Pairwise independence results with overlap details
40
+ - **`groups`**: Safe parallel dispatch groups (connected components of the conflict graph)
41
+ - **`verdict`**: Human-readable summary (e.g., "3 of 4 tasks can run in parallel in 2 groups")
42
+ - **`analysisLevel`**: `"graph-expanded"` (full analysis) or `"file-only"` (graph unavailable)
30
43
 
31
- 5. **When in doubt, run serially.** The cost of a false parallel dispatch (merge conflicts, subtle bugs, wasted work) far exceeds the cost of running serially.
44
+ **Preferred: Use `predict_conflicts`** for severity-aware analysis with automatic regrouping:
45
+
46
+ ```json
47
+ {
48
+ "path": "<project-root>",
49
+ "tasks": [
50
+ { "id": "task-a", "files": ["src/module-a/index.ts", "src/module-a/index.test.ts"] },
51
+ { "id": "task-b", "files": ["src/module-b/index.ts", "src/module-b/index.test.ts"] }
52
+ ],
53
+ "depth": 1
54
+ }
55
+ ```
56
+
57
+ The `predict_conflicts` tool extends independence checking with:
58
+ - **`conflicts`**: Severity-classified conflict details with human-readable reasoning
59
+ - **`groups`**: Revised parallel dispatch groups (high-severity conflicts force serialization)
60
+ - **`summary`**: Conflict counts by severity and whether regrouping occurred
61
+ - **`verdict`**: Human-readable summary including severity breakdown
62
+
63
+ If `predict_conflicts` is unavailable, fall back to `check_task_independence`.
64
+
65
+ 3. **Act on the result.** Use the returned `groups` for dispatch. Flag any medium-severity conflicts to the coordinator. If high-severity conflicts forced regrouping (`summary.regrouped === true`), log which tasks were serialized and why. If all tasks are in one group, dispatch them all in parallel. If tasks are split across groups, dispatch each group as a separate parallel wave.
66
+
67
+ 4. **When in doubt, run serially.** The cost of a false parallel dispatch (merge conflicts, subtle bugs, wasted work) far exceeds the cost of running serially.
68
+
69
+ #### Manual Fallback (when MCP tool is unavailable)
70
+
71
+ If `check_task_independence` is not available, verify independence manually:
72
+
73
+ 1. **Check file overlap.** For each pair of tasks, compare the files they will read and write. Any overlap in WRITE targets means they are NOT independent. Overlap in READ targets is acceptable only if neither task writes to those files.
74
+
75
+ 2. **Check state overlap.** Do any tasks share database tables, configuration files, environment variables, or in-memory state? If yes, they are NOT independent.
76
+
77
+ 3. **Check import graph overlap.** If Task A modifies module X and Task B imports module X, they are NOT independent — Task B's tests may be affected by Task A's changes.
78
+
79
+ 4. **When in doubt, run serially.** Same principle as above.
32
80
 
33
81
  ### Graph-Enhanced Context (when available)
34
82
 
35
- When a knowledge graph exists at `.harness/graph/`, use graph queries for faster, more accurate independence verification:
83
+ When a knowledge graph exists at `.harness/graph/`, `check_task_independence` automatically uses it for transitive dependency analysis (this is the `"graph-expanded"` analysis level). No manual graph queries are needed for independence checking.
84
+
85
+ For custom queries beyond independence checking, these tools remain available:
36
86
 
37
- - `query_graph` — get the dependency subgraph per candidate task and check for node overlap between tasks
38
- - `get_impact` — verify tasks do not write to overlapping files or share transitive dependencies
87
+ - `query_graph` — get the dependency subgraph for a specific module or file
88
+ - `get_impact` — assess the impact radius of changes to a specific module
39
89
 
40
- Automated graph-based independence verification replaces manual import grep and catches transitive overlaps that file-level checks miss. Fall back to file-based commands if no graph is available.
90
+ When no graph is available, `check_task_independence` falls back to file-only overlap detection and flags `analysisLevel: "file-only"` so you know transitive dependencies were not checked.
41
91
 
42
92
  ### Step 2: Create Focused Agent Tasks
43
93
 
@@ -101,7 +151,7 @@ For each independent task, write a focused agent brief:
101
151
 
102
152
  ## Success Criteria
103
153
 
104
- - Independence was verified before dispatch (file overlap, state overlap, import graph)
154
+ - Independence was verified before dispatch via `check_task_independence` (or manual fallback if tool unavailable)
105
155
  - Each agent had a focused brief with explicit scope, goal, constraints, and expected output
106
156
  - All agents completed successfully (or blockers were reported)
107
157
  - Integration produced no merge conflicts (or conflicts were resolved)
@@ -117,17 +167,52 @@ For each independent task, write a focused agent brief:
117
167
 
118
168
  **Step 1: Verify independence**
119
169
 
170
+ Call `check_task_independence`:
171
+
172
+ ```json
173
+ {
174
+ "path": ".",
175
+ "tasks": [
176
+ {
177
+ "id": "task-4-user",
178
+ "files": [
179
+ "src/services/user/service.ts",
180
+ "src/services/user/service.test.ts",
181
+ "src/types/user.ts"
182
+ ]
183
+ },
184
+ {
185
+ "id": "task-5-product",
186
+ "files": [
187
+ "src/services/product/service.ts",
188
+ "src/services/product/service.test.ts",
189
+ "src/types/product.ts"
190
+ ]
191
+ },
192
+ {
193
+ "id": "task-6-notification",
194
+ "files": [
195
+ "src/services/notification/service.ts",
196
+ "src/services/notification/service.test.ts",
197
+ "src/types/notification.ts"
198
+ ]
199
+ }
200
+ ]
201
+ }
120
202
  ```
121
- Task 4 (UserService): writes src/services/user/*, reads src/types/user.ts
122
- Task 5 (ProductService): writes src/services/product/*, reads src/types/product.ts
123
- Task 6 (NotificationService): writes src/services/notification/*, reads src/types/notification.ts
124
-
125
- File overlap: NONE (different directories, different type files)
126
- State overlap: NONE (different DB tables, no shared config)
127
- Import graph: NONE (no cross-service imports)
128
- Verdict: INDEPENDENT safe to parallelize
203
+
204
+ Result:
205
+
206
+ ```json
207
+ {
208
+ "analysisLevel": "graph-expanded",
209
+ "groups": [["task-4-user", "task-5-product", "task-6-notification"]],
210
+ "verdict": "3 of 3 tasks can run in parallel in 1 group"
211
+ }
129
212
  ```
130
213
 
214
+ All tasks are independent — safe to parallelize.
215
+
131
216
  **Step 2: Create agent briefs**
132
217
 
133
218
  ```