@harness-engineering/cli 2.6.0 → 2.7.0

package/dist/agents/skills/cursor/security-craft/skill.yaml

@@ -0,0 +1,58 @@
+name: security-craft
+version: "0.1.0"
+description: LLM-judgment critique of security posture (TS/JS source). Threat-modeling-as-skill — critiques whether trust boundaries are respected, where implicit privilege escalation lurks, whether the code defends in depth, whether least authority is honored. AST-driven signal detection fires only on files with security-relevant constructs; conservative confidence defaults manage the FP risk inherent in judgment-based security. Sixth non-design craft-pipeline ceiling skill (the final sub-project, #10 of 10).
+stability: draft
+cognitive_mode: constructive-architect
+triggers:
+  - manual
+  - on_pr
+  - on_new_feature
+platforms:
+  - claude-code
+tools:
+  - Bash
+  - Read
+  - Glob
+  - Grep
+cli:
+  command: harness security-craft
+  args:
+    - name: path
+      description: Project root path
+      required: false
+    - name: files
+      description: Optional file scope (overrides discovery)
+      required: false
+    - name: packages
+      description: Restrict to specific packages under packages/
+      required: false
+    - name: max-files
+      description: Cap source-file count (default 100)
+      required: false
+    - name: max-signals-per-file
+      description: Cap per-file signal critique (default 10)
+      required: false
+mcp:
+  tool: security_craft
+  input:
+    path: string
+type: rigid
+tier: 2
+phases:
+  - name: discover
+    description: Walk packages/STAR/src/ recursively; exclude tests + build dirs
+    required: true
+  - name: signal
+    description: AST-driven security construct detection (http handlers, middleware, auth APIs, child_process/eval, fs writes, raw queries, network egress, secret handling)
+    required: true
+  - name: critique
+    description: LLM-rubric loop per (file, signal, rubric) with conservative-confidence bias
+    required: true
+  - name: report
+    description: Aggregate findings + cost telemetry + file/signal counts
+    required: true
+state:
+  persistent: false
+depends_on:
+  - harness-security-scan
+  - harness-security-review

package/dist/agents/skills/cursor/spec-craft/SKILL.md

@@ -0,0 +1,184 @@
+# Spec Craft
+
+> LLM-judgment critique of spec quality (proposals + ADRs) against a curated rubric catalog from the spec-quality canon. Per-section critique with rubric-to-section mapping. Second member of the craft-pipeline initiative; highest-leverage craft skill because spec quality compounds across the entire planning → implementation → review lifecycle below it. Emits 3-axis findings (tier × impact × confidence per ADR 0019).
+
+## When to Use
+
+- During PR review on a new or substantially-rewritten spec
+- After authoring a proposal, before circulating it for review
+- When onboarding a new contributor (audit specs they introduced)
+- Periodically (per-sprint or per-release) to catch spec drift
+- As the cross-cutting spec critic for harness-brainstorming (when newly-authored specs land)
+- NOT for spec-structure enforcement (use `harness-soundness-review` — that's the rule-based floor)
+- NOT for README / general-doc critique (use `docs-craft` #2)
+- NOT for autofix / spec rewriting (this is judgment-only; v1.x may add `align-spec` sibling)
+- NOT for source-code comment critique (use `code-craft` #4 or `docs-craft` #2)
+- NOT for RFCs in v1 (v1.x)
+
+## Process
+
+### Phase 1: DISCOVER — Find spec files
+
+1. **Read project configuration.** Check `harness.config.json` for:
+   - `craft.spec.enabled` — gate (default `true`)
+   - `craft.spec.maxFiles` — doc count cap (default 50)
+   - `craft.spec.maxSectionsPerFile` — per-doc section cap (default 10)
+
+2. **Discover spec files:**
+   - **proposals:** `docs/changes/*/proposal.md` and `docs/changes/*/<sub>/proposal.md` (one level of nesting, for initiatives with sub-projects)
+   - **ADRs:** `docs/knowledge/decisions/*.md` (excluding README)
+   - Restrict via `--kinds proposal` or `--kinds adr` for single-kind runs.
+
+### Phase 2: PARSE — Split into named sections
+
+For each spec file:
+
+1. **Strip YAML frontmatter** (`--- ... ---` block at top, if present).
+2. **Split by H2** (`## ...`) into named sections. Each section captures:
+   - `heading` — original H2 text (e.g., `"Decisions"`, `"Out-of-scope (v1)"`)
+   - `canonical` — normalized form for rubric matching (`"decisions"`, `"out-of-scope-v1"`)
+   - `body` — content between this H2 and the next
+   - `line` / `endLine` — line range
+3. Subsections (H3) stay part of the parent H2's body. v1.x may add per-H3 critique for sections like Decisions that have one row per H3.
+
+### Phase 3: CRITIQUE — Per (file, section, rubric) loop
+
+7 seed rubrics:
+
+| Rubric      | Title                                    | Applies to                               |
+| ----------- | ---------------------------------------- | ---------------------------------------- |
+| `SPEC-R001` | Sharpness vs vagueness                   | `*` (all sections)                       |
+| `SPEC-R002` | Cuts at the joints                       | `decisions`, `scope`, `technical-design` |
+| `SPEC-R003` | Two readers, same understanding          | `decisions`, `success-criteria`          |
+| `SPEC-R004` | Load-bearing decision vs ambient context | `decisions`, `overview`                  |
+| `SPEC-R005` | Honest rationalizations                  | `rationalizations*` (regex)              |
+| `SPEC-R006` | Non-goals are non-goals                  | `out-of-scope*`, `non-goals*` (regex)    |
+| `SPEC-R007` | Stranger in 6 months                     | `*` (all sections)                       |
+
+For each eligible (section, rubric) pair:
+
+1. Build prompt with rubric description + spec file path + section heading + section body (truncated to 2000 chars if longer for cost control).
+2. LLM returns fenced JSON: `null` (rubric doesn't apply / section is fine) OR `{ tier, impact, confidence, message }`.
+3. On non-null: emit a `SpecFinding` with `cite.rubricId` populated for ADR 0020 traceability.
+
+### Phase 4: REPORT — Aggregate + cost telemetry
+
+Emit `SpecCraftOutput`:
+
+```ts
+{
+  findings: SpecFinding[];
+  summary: {
+    phaseRun: ['critique'];
+    durationMs: number;
+    llmCalls: { provider, model, count, costUsd };
+    catalog: { rubricsApplied: string[] };
+    docsScanned: number;
+    sectionsScanned: number;
+    runId: string;
+  }
+}
+```
+
+## Harness Integration
+
+- **`harness spec-craft`** — CLI entry. `--files <glob>` / `--kinds proposal,adr` / `--sections decisions,scope` / `--max-files <n>` / `--max-sections-per-file <n>` / `--json` / `--verbose`.
+- **`mcp__harness__spec_craft`** — MCP tool. Same input/output. Consumed by agents.
+- **Cross-cutting API:** `critiqueSpecFile(file, opts)` exported from `packages/cli/src/spec-craft/index.ts`. Future craft skills (or `harness-brainstorming`) can call this when they have a doc in hand without re-walking the project.
+- **Shared craft infrastructure (extracted on this PR):** `LlmProvider`, `MockLlmProvider`, `derivePriority`, 3-axis types all live in `packages/cli/src/shared/craft/`. design-craft + naming-craft + spec-craft import from there; design-craft + naming-craft keep their old import paths via re-export shims.
+
+## Success Criteria
+
+See `docs/changes/craft-pipeline/spec-craft/proposal.md` for the full 34 success criteria. Highlights:
+
+- 7 seed rubrics ship at `catalog/rubrics/<id>.ts` (file-per-rubric, matches naming-craft)
+- 3-axis output preserved (tier × impact × confidence, never collapsed)
+- `cite.rubricId` populated on every finding (ADR 0020)
+- Section parser strips frontmatter; splits by H2 only
+- Rubric-to-section mapping skips silently when rubric doesn't apply
+- `critiqueSpecFile` cross-cutting API works on a single file without project walk
+- All existing design-craft + naming-craft tests still pass after shared/craft extraction (zero behavior change)
+
+## Examples
+
+### Example: Vague Decisions section
+
+**Input:** A proposal's `## Decisions` section reads:
+
+```
+| Decision | Why |
+|----------|-----|
+| Use modern stack | scalable and clean |
+| Defer auth | not in scope |
+```
+
+**Output (mock LLM):**
+
+```
+SPEC-R001 [polish/medium/medium] ## Decisions:34
+  "Modern stack" and "scalable and clean" are vague — no concrete framework
+  named, no metric for "scalable", no operational definition of "clean".
+  Sharpen: name the framework, state the scale target (req/sec, team size),
+  define what "clean" means in observable terms.
+SPEC-R004 [polish/medium/medium] ## Decisions:34
+  The Decisions section pads load-bearing choices with vague qualifiers
+  rather than naming the trade-off chosen and the rejected alternative.
+```
+
+### Example: Strawmanned Rationalizations
+
+**Input:** A `## Rationalizations to reject` section reads:
+
+```
+| "Use a different framework" | Other frameworks are worse |
+```
+
+**Output:**
+
+```
+SPEC-R005 [foundational/large/high] ## Rationalizations to reject:88
+  "Other frameworks are worse" is a strawman — not stated charitably, not
+  paired with a specific reason. Steelman the rejected position: name the
+  competing framework, name its strongest feature, then explain the specific
+  trade-off that made it unsuitable here.
+```
+
+### Example: Empty project — no specs
+
+**Input:** Project has no `docs/changes/` or `docs/knowledge/decisions/` directory.
+
+**Output:**
+
+```
+No spec findings.
+
+Summary: 0 findings across 0 docs (0 sections, 7 rubrics, 0 LLM calls, $0.0000, 3ms)
+```
+
+## Gates
+
+- **No autofix.** Sibling `align-spec` deferred until signal warrants safe-to-apply rewrites.
+- **No README / general doc critique.** docs-craft (#2) territory.
+- **No source-code comment critique.** code-craft / docs-craft territory.
+- **No B' bootstrap.** Same posture as naming-craft v1.
+- **No graph persistence.** Phase 1 MVP.
+- **No vision/deep mode.** Specs are text.
+- **No structural floor enforcement.** harness-soundness-review checks the floor; spec-craft assumes the floor is satisfied and critiques the ceiling.
+
+## Escalation
+
+- **When LLM cost is too high:** drop `maxSectionsPerFile` to 5 or `maxFiles` to 25. Per-doc cost = sections × rubrics × per-call. Rubric-to-section mapping already prunes most calls; further: use `--sections decisions` to target the highest-value section.
+- **When a rubric produces high false-positive rate:** v1 has no per-rubric disable; v1.x adds `craft.spec.disabledRubrics: ['SPEC-R007']`. Until then: filter findings by `cite.rubricId` in your consumer.
+- **When a spec has intentionally aspirational vagueness (e.g., a manifesto-style Overview):** SPEC-R001 will flag it; low-confidence findings are de-emphasized per ADR 0019. v1.x adds per-section opt-out via `<!-- spec-craft:skip -->` HTML comment.
+- **When you want a doc-level summary instead of per-section findings:** v1 is per-section only; v1.x adds a `--mode doc` opt-in for whole-doc critique.
+- **When you want to critique RFCs:** v1.x. For now, point `--files <rfc.md>` at a single file — the section parser works on any markdown.
+
+## Status
+
+**v1 — in implementation.** See:
+
+- Spec: `docs/changes/craft-pipeline/spec-craft/proposal.md`
+- Roadmap entry: `craft-pipeline sub-project #6` (the highest-leverage craft skill)
+- Sibling craft skills: `harness-design-craft` (design-pipeline #6), `naming-craft` (craft-pipeline #1)
+- Shared infrastructure: `packages/cli/src/shared/craft/` (extracted on this PR)
+- Future: `align-spec` (FIX side), docs-craft (#2), test-craft (#3), code-craft (#4) — each can call `critiqueSpecFile` if they want spec-level critique for a doc they're already processing.

package/dist/agents/skills/cursor/spec-craft/skill.yaml

@@ -0,0 +1,55 @@
+name: spec-craft
+version: "0.1.0"
+description: LLM-judgment critique of spec quality (proposals + ADRs) against a curated rubric catalog. Per-section critique with rubric-to-section mapping. Second craft-pipeline ceiling skill; highest-leverage because spec quality compounds across the lifecycle below it. Triggered the shared craft infrastructure extraction.
+stability: draft
+cognitive_mode: constructive-architect
+triggers:
+  - manual
+  - on_pr
+  - on_new_feature
+platforms:
+  - claude-code
+tools:
+  - Bash
+  - Read
+  - Glob
+  - Grep
+cli:
+  command: harness spec-craft
+  args:
+    - name: path
+      description: Project root path
+      required: false
+    - name: files
+      description: Optional spec file/glob scope
+      required: false
+    - name: kinds
+      description: Restrict to proposal / adr
+      required: false
+    - name: sections
+      description: Restrict to canonical section names
+      required: false
+mcp:
+  tool: spec_craft
+  input:
+    path: string
+type: rigid
+tier: 2
+phases:
+  - name: discover
+    description: Glob docs/changes/*/proposal.md + docs/knowledge/decisions/*.md
+    required: true
+  - name: parse
+    description: Markdown H2 section splitter (frontmatter-aware)
+    required: true
+  - name: critique
+    description: LLM-rubric loop per (file, section, rubric) where rubric applies
+    required: true
+  - name: report
+    description: Aggregate findings + cost telemetry + doc/section counts
+    required: true
+state:
+  persistent: false
+depends_on:
+  - harness-soundness-review
+  - harness-design-craft

package/dist/agents/skills/cursor/test-craft/SKILL.md

@@ -0,0 +1,212 @@
+# Test Craft
+
+> LLM-judgment critique of test quality across vitest / jest / mocha / playwright. Fourth member of the craft-pipeline initiative. Per-`it`/`test` block critique with best-effort source pairing for contract-vs-implementation rubrics. Tests are often the worst-written code in a codebase precisely because the rule-based floor (coverage threshold) is so easy to clear. Emits 3-axis findings (tier × impact × confidence per ADR 0019).
+
+## When to Use
+
+- During PR review on code that adds or changes tests
+- After ramping up coverage to audit whether new tests actually add signal
+- When onboarding a contributor — audit tests they introduced
+- Periodically to catch accumulated low-signal tests + redundant fixtures
+- NOT for coverage analysis (use `vitest --coverage` or harness-tdd — that's the floor)
+- NOT for autofix / rewriting (v2's `align-test` may add safe renames)
+- NOT for `.test-d.ts` type tests in v1 (v1.x — different rubric vocabulary)
+- NOT for fixture / helper / mock files in v1 (v1.x)
+- NOT for snapshot tests in v1 (different correctness criteria; v1.x)
+- NOT for non-TS/JS languages in v1 (v1.x)
+
+## Process
+
+### Phase 1: DISCOVER — Test files + framework
+
+1. **Read project configuration.** Check `harness.config.json` for:
+   - `craft.test.enabled` — gate (default `true`)
+   - `craft.test.maxFiles` (default 100), `craft.test.maxTestsPerFile` (default 20)
+   - `craft.test.frameworks` — restrict to subset (default: all four)
+   - `craft.test.sourcePair` — toggle source-pairing (default true)
+
+2. **Glob test files** under project root: `**/*.{test,spec}.{ts,tsx,js,jsx}`. Skip `node_modules`, `dist`, `build`, `coverage`, dotdirs.
+
+3. **Detect framework per file** via import signatures (order matters; most-specific first):
+   - `@playwright/test` → playwright
+   - `@jest/globals` → jest
+   - `vitest` → vitest
+   - `import 'mocha'` → mocha
+   - Fallback: vitest (most common; jest-with-globals projects still extract correctly because the AST shape matches)
+
+### Phase 2: EXTRACT — Per-test AST walk
+
+Single TS Compiler API walk per file. For each `CallExpression`:
+
+- **describe** — push name onto nesting stack, recurse, pop
+- **it / test** — extract `testName` (first string-literal arg), capture current nesting, capture callback body text (truncated to 1500 chars in prompt)
+- Modifiers handled: `.skip`, `.only`, `.todo` (todo excluded from critique — no body to critique)
+- Non-string-literal test names (computed / templates) skip silently
+
+### Phase 3: PAIR — Best-effort source resolution
+
+For each test file, try in order:
+
+1. **Sibling** — `foo.test.ts` → `foo.ts` (same dir)
+2. **Co-located in src** — `tests/foo.test.ts` → `../src/foo.ts`
+3. **Monorepo-style** — `tests/foo.test.ts` → `../../src/foo.ts`
+
+When source resolves, content (truncated to 2000 chars) is added to the LLM prompt under `Source under test:`. This enables `TEST-R007` (contract-not-implementation) to actually compare assertions against the function's public surface. When no source resolves, test-file-only rubrics still fire.
+
+### Phase 4: CRITIQUE — Per (test, rubric) loop
+
+8 seed rubrics:
+
+| Rubric                                  | Description                                                                 |
+| --------------------------------------- | --------------------------------------------------------------------------- |
+| `TEST-R001` contract-not-narrative-name | Test name describes the contract ("returns null when empty"), not narrative |
+| `TEST-R002` meaningful-assertion        | Assertion proves something the implementation could plausibly violate       |
+| `TEST-R003` arrange-act-assert          | Three visually distinct phases, not interleaved                             |
+| `TEST-R004` fixture-earns-setup-cost    | Heavy beforeEach must be justified by what's asserted                       |
+| `TEST-R005` single-responsibility       | One assertion target per `it`; multiple unrelated assertions split poorly   |
+| `TEST-R006` deleting-loses-something    | Would removing this test lose specific coverage, or is it redundant?        |
+| `TEST-R007` contract-not-implementation | Tests the documented behaviour, not the internal structure                  |
+| `TEST-R008` explicit-failure-mode       | Failure message narrates what went wrong without reading the test           |
+
+For each (test, rubric) pair:
+
+1. Build prompt with rubric + test (name + nesting + body) + optional source + framework label.
+2. LLM returns fenced JSON: `null` (rubric doesn't apply / test is fine) OR `{ tier, impact, confidence, message }`.
+3. On non-null: emit `TestFinding` with `cite.rubricId` for ADR 0020 traceability.
+
+### Phase 5: REPORT — Aggregate + cost telemetry
+
+Emit `TestCraftOutput`:
+
+```ts
+{
+  findings: TestFinding[];
+  summary: {
+    phaseRun: ['critique'];
+    durationMs: number;
+    llmCalls: { provider, model, count, costUsd };
+    catalog: { rubricsApplied: string[] };
+    counts: { filesScanned, testsExtracted, testsSkippedOrTodo, sourcePaired };
+    frameworksDetected: Record<TestFramework, number>;
+    runId: string;
+  }
+}
+```
+
+## Harness Integration
+
+- **`harness test-craft`** — CLI entry. `--files` / `--frameworks` / `--max-files` / `--max-tests-per-file` / `--no-source-pair` / `--json` / `--verbose`.
+- **`mcp__harness__test_craft`** — MCP tool. Same input/output. Consumed by agents.
+- **Cross-cutting API:** `critiqueTestsInFile(file, opts)` exported. Works on a single test file without project walk; honours framework filter and source-pairing toggle.
+- **Shared craft infrastructure:** imports `LlmProvider` + 3-axis types + `derivePriority` from `packages/cli/src/shared/craft/`.
+
+## Success Criteria
+
+See `docs/changes/craft-pipeline/test-craft/proposal.md` for the full 36 success criteria. Highlights:
+
+- 8 seed rubrics ship in `catalog/rubrics/<id>.ts` (file-per-rubric, matches naming/spec/copy-craft)
+- 3-axis output preserved (tier × impact × confidence)
+- `cite.rubricId` populated on every finding (ADR 0020)
+- Framework detection: `@playwright/test` / `@jest/globals` / `vitest` / `mocha` import signatures; vitest fallback
+- Per-test extraction handles `.skip` / `.only` / `.todo` with metadata; describe-chain nesting captured
+- Source pairing best-effort with silent skip when no match
+- Plugin slash-commands pre-generated (avoids CI drift failure pattern)
+
+## Examples
+
+### Example: Narrative test name
+
+**Input:** `src/parse.test.ts`:
+
+```ts
+describe('parseTokens', () => {
+  it('works correctly', () => {
+    expect(parseTokens('a,b,c')).toEqual(['a', 'b', 'c']);
+  });
+});
+```
+
+**Output (mock LLM):**
+
+```
+src/parse.test.ts
+  TEST-R001 [polish/medium/high] vitest:2
+    parseTokens > works correctly
+    "works correctly" narrates the test without naming the contract. Try
+    "splits comma-separated input into trimmed segments" or "preserves
+    order across the split".
+```
+
+### Example: Tautological assertion
+
+**Input:**
+
+```ts
+it('returns a user', () => {
+  const user = createUser({ name: 'a' });
+  expect(user).toBeDefined();
+});
+```
+
+**Output:**
+
+```
+TEST-R002 [foundational/medium/high] vitest:8
+  createUser > returns a user
+  `toBeDefined()` after `createUser(...)` cannot fail — the return is
+  always defined by the function's signature. Assert the contract:
+  `expect(user.name).toBe('a')` or `expect(user).toMatchObject({...})`.
+```
+
+### Example: Heavy fixture, trivial assertion
+
+**Input:**
+
+```ts
+it('handles input', () => {
+  // 47 lines of beforeEach setup that mocks 6 collaborators
+  const result = handler.handle({});
+  expect(result).toBeTruthy();
+});
+```
+
+**Output:**
+
+```
+TEST-R004 [polish/large/medium] vitest:142
+  handler > handles input
+  47-line beforeEach + 6 mocks produce a result that's asserted with
+  `toBeTruthy`. The fixture's complexity exceeds the test's signal —
+  either drop the fixture and use a simpler stub, or assert the
+  specific outcome that justified the setup (e.g., which collaborator
+  was called with what arguments).
+```
+
+## Gates
+
+- **No autofix.** v2's `align-test`.
+- **No coverage analysis.** That's the floor (`vitest --coverage`).
+- **No `.test-d.ts` type tests** (v1.x).
+- **No fixture / helper / mock file critique** (v1.x).
+- **No snapshot rubrics** (v1.x).
+- **No non-TS/JS language support** (v1.x).
+- **No B' bootstrap.** Same posture as naming/spec/copy-craft.
+- **No graph persistence.** Phase 1 MVP.
+
+## Escalation
+
+- **When LLM cost is too high:** drop `maxTestsPerFile` (default 20) or scope to specific frameworks with `--frameworks vitest`. Disable source-pairing with `--no-source-pair` to halve prompt size on every test.
+- **When intentionally narrative test names get flagged (e.g., learning tests, examples):** scope via `--files` to exclude. v1.x adds `// test-craft:skip` annotation.
+- **When source-pairing finds the wrong source for ambiguous names:** the LLM gets misleading context for `TEST-R007`. Use `--no-source-pair` to fall back to test-file-only rubrics, or v1.x's `harness.config.json` test→source mapping.
+- **When jest-with-globals tests aren't detected:** the framework defaults to vitest (AST is compatible); critique still runs. If you need jest tagging specifically, add `import { describe, it } from '@jest/globals'` to make the signature explicit.
+- **When `it.each` / `test.each` blocks get critiqued as a single test:** v1 captures the `each` invocation as one item with a generic name pattern. v1.x adds per-iteration critique.
+
+## Status
+
+**v1 — in implementation.** See:
+
+- Spec: `docs/changes/craft-pipeline/test-craft/proposal.md`
+- Roadmap entry: `craft-pipeline sub-project #3`
+- Sibling craft skills: `naming-craft` (#1), `spec-craft` (#6), `copy-craft` (#5)
+- Shared infrastructure: `packages/cli/src/shared/craft/`
+- Future: `align-test` (FIX side, v2), docs-craft (#2), code-craft (#4)

package/dist/agents/skills/cursor/test-craft/skill.yaml

@@ -0,0 +1,58 @@
+name: test-craft
+version: "0.1.0"
+description: LLM-judgment critique of test quality across vitest / jest / mocha / playwright. Fourth craft-pipeline ceiling skill. Per-test critique with best-effort source pairing for contract-vs-implementation rubrics. Tests are often the worst-written code in a codebase precisely because the rule-based floor is so easy to clear.
+stability: draft
+cognitive_mode: constructive-architect
+triggers:
+  - manual
+  - on_pr
+  - on_new_feature
+platforms:
+  - claude-code
+tools:
+  - Bash
+  - Read
+  - Glob
+  - Grep
+cli:
+  command: harness test-craft
+  args:
+    - name: path
+      description: Project root path
+      required: false
+    - name: files
+      description: Optional test file/glob scope
+      required: false
+    - name: frameworks
+      description: Restrict to vitest/jest/mocha/playwright
+      required: false
+    - name: no-source-pair
+      description: Skip source-pairing resolution
+      required: false
+mcp:
+  tool: test_craft
+  input:
+    path: string
+type: rigid
+tier: 2
+phases:
+  - name: discover
+    description: Glob test files; detect framework per-file via import signatures
+    required: true
+  - name: extract
+    description: Walk TS AST for per-it/test block with nesting, skip/todo/only flags
+    required: true
+  - name: pair
+    description: Best-effort resolve source file under test (sibling / ../src / monorepo)
+    required: false
+  - name: critique
+    description: LLM-rubric loop per (test, rubric); 8 seed rubrics
+    required: true
+  - name: report
+    description: Aggregate findings + frameworks-detected counts + cost telemetry
+    required: true
+state:
+  persistent: false
+depends_on:
+  - harness-tdd
+  - harness-design-craft