@harness-engineering/cli 2.6.1 → 2.7.0

package/dist/agents/skills/claude-code/audit-component-anatomy/skill.yaml

@@ -0,0 +1,51 @@
+name: audit-component-anatomy
+version: "0.1.0"
+description: Audit component definitions for missing required anatomy parts (slots, states, sizes) and detect missing-anatomy-component patterns (data without empty states, async without loading boundaries). First programmatic enforcer of component-anatomy rules.
+stability: draft
+cognitive_mode: constructive-architect
+triggers:
+  - manual
+  - on_new_feature
+platforms:
+  - claude-code
+tools:
+  - Bash
+  - Read
+  - Write
+  - Edit
+  - Glob
+  - Grep
+cli:
+  command: harness skill run audit-component-anatomy
+  args:
+    - name: path
+      description: Project root path
+      required: false
+    - name: mode
+      description: "fast (definition findings only) or full (definitions + patterns)"
+      required: false
+    - name: files
+      description: Optional glob/path scoping
+      required: false
+mcp:
+  tool: run_skill
+  input:
+    skill: audit-component-anatomy
+    path: string
+type: rigid
+tier: 2
+phases:
+  - name: scan
+    description: Identify component types and run convention/pattern audits
+    required: true
+  - name: evaluate
+    description: Apply severity model based on design.strictness
+    required: true
+  - name: report
+    description: Format findings as report + graph edges
+    required: true
+state:
+  persistent: false
+depends_on:
+  - design-component-anatomy
+  - harness-accessibility

package/dist/agents/skills/claude-code/copy-craft/SKILL.md

@@ -0,0 +1,192 @@
+# Copy Craft
+
+> LLM-judgment critique of prose-in-code across six surfaces: error messages, log lines, CLI output strings, commit subjects, PR descriptions, and code comments. Primary domain is error messages (universally bad in most codebases). Third member of the craft-pipeline initiative. NO rule-based floor exists — pure ceiling. Emits 3-axis findings (tier × impact × confidence per ADR 0019).
+
+## When to Use
+
+- During PR review on code that adds or changes error messages, log lines, or CLI output
+- After a feature ships, to audit error-message quality across the changed surfaces
+- Periodically (per-release) to catch accumulated noise in log lines + comment rot
+- As the user-facing-copy critic alongside design-craft (which owns UI copy)
+- NOT for UI copy in components (use design-craft)
+- NOT for prose documentation in `docs/` (use docs-craft #2 when it ships)
+- NOT for autofix / rewriting (this is judgment-only; v2 may ship `align-copy`)
+- NOT for JSDoc / TSDoc structured API docs (docs-craft territory)
+- NOT for non-TS/JS languages in v1 (v1.x)
+
+## Process
+
+### Phase 1: EXTRACT — Six surfaces, three infrastructures
+
+1. **Read project configuration.** Check `harness.config.json` for:
+   - `craft.copy.enabled` — gate (default `true`)
+   - `craft.copy.surfaces` — restrict to specific surfaces (default: all 6)
+   - `craft.copy.maxFiles` (default 100), `craft.copy.maxItemsPerFile` (default 20)
+   - `craft.copy.commitsSince` (default `'1 month ago'`), `craft.copy.prLimit` (default 20)
+
+2. **Source-side surfaces** (errors / logs / CLI output / comments): single TS Compiler API walk per source file. Amortizes parse cost across surfaces.
+   - **errors:** `throw new <X>Error("...")` where the constructor name ends in `Error`; also `Err({ message: "..." })` for Result-style returns
+   - **logs:** `console.log/info/warn/error/debug` and `logger.X` / `log.X` / `pino.X` / `winston.X` where X is a known level
+   - **cli-output:** strings inside files under `packages/*/src/commands/` (configurable via `cliOutputPaths`); takes precedence over `log` for files matching the glob
+   - **comments:** `ts.getLeadingCommentRanges()` + `getTrailingCommentRanges()`; excludes JSDoc and license banners
+
+3. **Git surface** (commits): shell-out to `git log --pretty=format:'%H%x09%s' --since=...`. Skip silently when not in a git repo.
+
+4. **GitHub surface** (PR descriptions): shell-out to `gh pr list --json number,title,body`. Skip silently when `gh` binary missing or `gh auth status` fails.
+
+5. **Skipped surfaces** recorded in `summary.skippedSurfaces` with the reason — visible in the report, not a failure.
+
+### Phase 2: CRITIQUE — Per (item, rubric) loop, surface-filtered
+
+8 seed rubrics, each declares which surfaces it applies to:
+
+| Rubric                                | Surfaces                        |
+| ------------------------------------- | ------------------------------- |
+| `COPY-R001` WHAT/WHY/HOW-TO-FIX       | error                           |
+| `COPY-R002` calm-not-panicky          | error, log                      |
+| `COPY-R003` specific-not-generic      | error, log, cli-output          |
+| `COPY-R004` signal-not-noise          | log                             |
+| `COPY-R005` grep-survives             | log, cli-output                 |
+| `COPY-R006` describes-change-not-work | commit, pr-description          |
+| `COPY-R007` stranger-in-6-months      | commit, pr-description, comment |
+| `COPY-R008` WHY-not-WHAT              | comment                         |
+
+For each (item, rubric) where the rubric applies to the item's surface:
+
+1. Build prompt with rubric description + surface + context (errorType / logLevel / ref) + snippet (truncated to 1500 chars).
+2. LLM returns fenced JSON: `null` (rubric doesn't apply / copy is fine) OR `{ tier, impact, confidence, message }`.
+3. On non-null: emit `CopyFinding` with `cite.rubricId` for ADR 0020 traceability.
+
+### Phase 3: REPORT — Aggregate + cost telemetry
+
+Emit `CopyCraftOutput`:
+
+```ts
+{
+  findings: CopyFinding[];
+  summary: {
+    phaseRun: ['critique'];
+    durationMs: number;
+    llmCalls: { provider, model, count, costUsd };
+    catalog: { rubricsApplied: string[]; surfacesScanned: CopySurface[] };
+    counts: Record<CopySurface, number>;
+    skippedSurfaces: Array<{ surface, reason }>;
+    runId: string;
+  }
+}
+```
+
+## Harness Integration
+
+- **`harness copy-craft`** — CLI entry. `--files` / `--surfaces` / `--max-files` / `--max-items-per-file` / `--commits-since` / `--pr-limit` / `--json` / `--verbose`.
+- **`mcp__harness__copy_craft`** — MCP tool. Same input/output. Consumed by agents.
+- **Cross-cutting API:** `critiqueCopyInFile(file, opts)` exported. Source-side surfaces only; git surfaces are project-scoped.
+- **Shared craft infrastructure:** imports `LlmProvider` + 3-axis types + `derivePriority` from `packages/cli/src/shared/craft/` (extracted by spec-craft).
+
+## Success Criteria
+
+See `docs/changes/craft-pipeline/copy-craft/proposal.md` for the full 39 success criteria. Highlights:
+
+- 8 seed rubrics ship in `catalog/rubrics/<id>.ts` (file-per-rubric, matches naming/spec-craft)
+- 3-axis output preserved (tier × impact × confidence, never collapsed)
+- `cite.rubricId` populated on every finding (ADR 0020)
+- Single TS AST walk amortizes parse cost across 4 source surfaces
+- Graceful degradation: `summary.skippedSurfaces` records when git/gh surfaces couldn't run
+- Cross-cutting `critiqueCopyInFile` exported (source surfaces only)
+
+## Examples
+
+### Example: Generic error message
+
+**Input:** `src/parse.ts`:
+
+```ts
+throw new Error('parse error');
+```
+
+**Output (mock LLM):**
+
+```
+[error]
+  COPY-R001 [foundational/large/medium] src/parse.ts:14 error
+    "parse error"
+    Doesn't tell WHAT was being parsed, WHY it failed, or HOW the user can
+    recover. Try: "Failed to parse design-system/tokens.json at line 12: ..."
+  COPY-R003 [polish/medium/high] src/parse.ts:14 error
+    "parse error"
+    Generic — no operation, no artifact. Name the file being parsed and the
+    specific failure mode.
+```
+
+### Example: Noisy log line
+
+**Input:**
+
+```ts
+console.log('entered function');
+```
+
+**Output:**
+
+```
+[log]
+  COPY-R004 [foundational/medium/high] src/handler.ts:23 log
+    "entered function"
+    Pure noise — fires on every invocation; carries no state or decision.
+    Either remove or replace with a state-transition log at the relevant
+    boundary.
+```
+
+### Example: Work-not-change commit subject
+
+**Input:** A commit with subject `"update tests"`.
+
+**Output:**
+
+```
+[commit]
+  COPY-R006 [polish/medium/medium] git:abc1234 commit
+    "update tests"
+    Describes the work, not the change. A reader six months from now needs
+    to know what behaviour changed. Try: "ratchet drift threshold to 0.5%
+    after Hermes Phase 4 baseline reset" or similar.
+```
+
+### Example: Missing prerequisites — graceful skip
+
+When not in a git repo OR `gh` is missing/unauthenticated, those surfaces silently skip and the report shows:
+
+```
+Skipped surfaces:
+  - commit: not a git repo
+  - pr-description: gh binary not found
+```
+
+## Gates
+
+- **No autofix.** v2's `align-copy` may add safe rewrites.
+- **No JSDoc / TSDoc.** docs-craft #2 territory.
+- **No PR / review comments.** v1.x.
+- **No commit BODY critique.** Subjects only in v1.
+- **No B' bootstrap.** Same posture as naming/spec-craft.
+- **No graph persistence.** Phase 1 MVP.
+- **No non-TS/JS language support.** v1.x.
+- **No author-attributed signals.** v1.x telemetry.
+
+## Escalation
+
+- **When LLM cost is too high:** drop `maxItemsPerFile` (default 20) or scope to specific surfaces with `--surfaces error`. Cost ≈ items × applicable rubrics × per-call.
+- **When intentionally-bad test fixtures get flagged:** scope via `--files` to exclude fixtures. v1.x adds `<!-- copy-craft:skip -->` annotation + JSDoc tag.
+- **When git surface skips though you ARE in a repo:** the walk goes up 10 levels looking for `.git`. If you're deeper than that, run from a closer cwd.
+- **When PR surface skips with `gh auth status` failing:** run `gh auth login` first. Or scope away with `--surfaces error,log,comment`.
+- **When `console.log` in a CLI file gets surface='log' instead of 'cli-output':** verify the file path contains `packages/cli/src/commands/` (or a similar default substring). Override with `craft.copy.cliOutputGlobs` config in v1.x.
+
+## Status
+
+**v1 — in implementation.** See:
+
+- Spec: `docs/changes/craft-pipeline/copy-craft/proposal.md`
+- Roadmap entry: `craft-pipeline sub-project #5`
+- Sibling craft skills: `naming-craft` (#1), `spec-craft` (#6)
+- Shared infrastructure: `packages/cli/src/shared/craft/` (extracted by spec-craft)
+- Future: `align-copy` (FIX side, v2), docs-craft (#2, prose docs), test-craft (#3), code-craft (#4)

package/dist/agents/skills/claude-code/copy-craft/skill.yaml

@@ -0,0 +1,52 @@
+name: copy-craft
+version: "0.1.0"
+description: LLM-judgment critique of prose-in-code across six surfaces (error messages, log lines, CLI output, commit subjects, PR descriptions, code comments). Third craft-pipeline ceiling skill; primary domain is error messages (universally bad). Graceful degradation when git/gh prerequisites are absent.
+stability: draft
+cognitive_mode: constructive-architect
+triggers:
+  - manual
+  - on_pr
+  - on_new_feature
+platforms:
+  - claude-code
+tools:
+  - Bash
+  - Read
+  - Glob
+  - Grep
+cli:
+  command: harness copy-craft
+  args:
+    - name: path
+      description: Project root path
+      required: false
+    - name: files
+      description: Optional source file/glob scope
+      required: false
+    - name: surfaces
+      description: Restrict to error/log/cli-output/commit/pr-description/comment
+      required: false
+    - name: commits-since
+      description: Commit window (default 1 month ago)
+      required: false
+mcp:
+  tool: copy_craft
+  input:
+    path: string
+type: rigid
+tier: 2
+phases:
+  - name: extract
+    description: TS Compiler API for source surfaces; git/gh shell-out for commits + PRs
+    required: true
+  - name: critique
+    description: LLM-rubric loop per (item, rubric) where rubric applies to that surface
+    required: true
+  - name: report
+    description: Aggregate findings + per-surface counts + cost telemetry + skipped surfaces
+    required: true
+state:
+  persistent: false
+depends_on:
+  - harness-design-craft
+  - naming-craft

package/dist/agents/skills/claude-code/detect-design-drift/SKILL.md

@@ -0,0 +1,139 @@
+# Detect Design Drift
+
+> Detect design-system drift — hardcoded values where tokens exist, and raw HTML primitives where registered components exist. The rule-based floor of design-pipeline #1 (detect half). Reports findings; never modifies source. Pairs with a separate align-design-system fixer skill (deferred to a sibling sub-project).
+
+## When to Use
+
+- Reviewing a PR that touches UI code, when you want to catch divergence from the design system before it ships
+- After adding a new design token, to surface places in the codebase that still use the hardcoded equivalent
+- After registering a new primitive (e.g. Button) in DESIGN.md `## Component Registry`, to find existing raw-HTML usages that should adopt it
+- As part of `harness validate` so drift surfaces continuously, not only on demand
+- As one of three verifiers composed by `harness check-design` (alongside audit-component-anatomy and harness-design-craft)
+- NOT for component-anatomy gaps (use audit-component-anatomy)
+- NOT for aesthetic critique (use harness-design-craft)
+- NOT for fixing drift — this skill detects only; the matching fixer (align-design-system) is a separate sub-project
+
+## Process
+
+### Phase 1: SCAN — Load resolvers + walk files
+
+1. **Read project configuration.** Check `harness.config.json` for:
+   - `design.strictness` — `strict` / `standard` / `permissive` (default `standard`)
+   - `design.audit.driftDetection.enabled` — gate for the verifier (default `true`)
+   - `design.audit.driftDetection.rules.{tokenBypass,primitiveAdoption}` — per-rule toggles
+   - `design.audit.driftDetection.fastMode.maxFiles` — validate-time scope cap
+
+2. **Load resolvers (soft-dependency — silent skip when absent):**
+   - `design-system/tokens.json` (W3C DTCG format) — parsed by `loadTokenSet`. Extracts colors, font families, spacing scale, and deprecated token paths. Returns `null` when the file doesn't exist; token-bypass rules then skip silently.
+   - `design-system/DESIGN.md` `## Component Registry` — parsed by `loadComponentRegistry`. Maps registered component types (Button/Input/Textarea/Link/Anchor) to their HTML primitive tag. Returns `null` when DESIGN.md or the section is absent; primitive-adoption rules then skip silently.
+
+3. **Collect candidate files.** Walk the project root (or honor an explicit `files` arg from the caller). Skip `node_modules`, `dist`, `build`, `coverage`, and any dotfile directory. Honor only these extensions: `.ts`, `.tsx`, `.js`, `.jsx`, `.css`, `.scss`.
+
+### Phase 2: APPLY RULES — Two rule families
+
+1. **Token bypass rules (DRIFT-T\*) — regex-based detection.** For each file when tokens were loaded:
+   - **DRIFT-T001** — Hex color literal (`#abc`, `#aabbcc`, etc.) NOT present in the loaded palette. Case-insensitive palette match. Deduplicated per `line:value`.
+   - **DRIFT-T002** — Font-family string literal NOT present in the typography palette. System fallbacks (`sans-serif`, `serif`, `monospace`, `system-ui`, `inherit`) are always allowed.
+   - **DRIFT-T003** — Pixel margin/padding/gap/positioning value NOT present in the spacing scale. Skipped entirely when no spacing tokens exist.
+   - **DRIFT-T004** — Reference to a token flagged `$deprecated: true` (or `$extensions.harness.deprecated: true`) in tokens.json. Matched in both `'token.path.form'` and CSS-var kebab form (`--token-path-form`).
+
+2. **Primitive adoption rules (DRIFT-P\*) — TS Compiler API JSX parsing.** For each `.jsx`/`.tsx` file when the registry was loaded:
+   - **DRIFT-P001** — `<button>` JSX where `Button` is registered
+   - **DRIFT-P002** — `<input>` JSX where `Input` is registered
+   - **DRIFT-P003** — `<a>` JSX where `Link` or `Anchor` is registered
+   - **DRIFT-P004** — `<textarea>` JSX where `Textarea` is registered
+   - Lowercase JSX = HTML primitive (JSX semantics). Uppercase identifiers are skipped — they're already components. Member expressions (`<Foo.Bar>`) are skipped.
+
+### Phase 3: REPORT — Severity, aggregate, persist
+
+1. **Severity from `design.strictness`:**
+   - `strict` — every finding `error` (CI blocks)
+   - `standard` — DRIFT-T001/T002/P001 → `error`; everything else → `warn`
+   - `permissive` — everything → `info`
+
+2. **Aggregate the run summary.** `bySeverity`, `byCode`, `totalFiles`, `durationMs`. Also report `catalog.rulesApplied` (which rule families fired) and `meta.{tokensLoaded, registryLoaded, mode}` so callers can see what was active.
+
+3. **Persist findings to the graph (when composed by check-design).** The check-design orchestrator passes drift findings to `DesignConstraintAdapter.recordFindings()` alongside anatomy and craft findings. Each finding becomes an idempotent `VIOLATES_design` edge keyed by `(file, code, line)` — re-runs do not double-write.
+
+## Harness Integration
+
+- **`harness validate`** — Fast-mode hook runs the detect-drift verifier. Findings respect `design.strictness`. Failures degrade gracefully: if the verifier throws, validate logs a warning and continues with other checks.
+- **`harness check-design`** — One of three composed verifiers. The orchestrator aggregates findings across audit-anatomy, design-craft, and detect-drift; persists all three to the graph; and surfaces a unified report.
+- **`mcp__harness__detect_drift`** — Programmatic API. Input: `{ path, mode, files?, designStrictness?, rules? }`. Output: `{ findings, summary, catalog, meta }`. Consumed by the design-pipeline orchestrator (sub-project #5).
+- **`DesignConstraintAdapter.recordFindings()`** — Generic graph persistence entry point shipped in PR #390. Drift findings reuse the adapter; no extra graph plumbing.
+- **Future align-design-system skill** — Separate sub-project. Reads the same finding codes (DRIFT-T\*, DRIFT-P\*) and applies fixes. Decoupling detect from align keeps each skill testable in isolation and lets the detect side ship first.
+
+## Success Criteria
+
+See `docs/changes/design-pipeline/detect-design-drift/proposal.md` for the full 34 success criteria. Highlights:
+
+- Zero false positives when tokens.json/DESIGN.md are absent (rules skip silently — no speculative findings)
+- Token-bypass detection runs in &lt; 1s on a 500-file repo (fast-mode budget)
+- Primitive-adoption parses JSX correctly across multi-line / fragmented opening tags (TS Compiler API, not regex)
+- Idempotent graph persistence — re-running produces zero duplicate edges
+- `harness validate` runtime budget &lt; 3s on a 500-file repo with both rule families enabled
+- Both rule families gated independently via config (a project can disable primitive-adoption without disabling token-bypass)
+
+## Examples
+
+### Example: Hardcoded brand color outside the palette
+
+**Input:** `src/Card.tsx` contains `const styles = { color: "#ff0000" };`, and `design-system/tokens.json` defines `color.brand.primary` as `#0066cc` (but no `#ff0000`).
+
+**Output:**
+
+```
+DRIFT-T001 [error] src/Card.tsx:14 — Hardcoded color "#ff0000" is not in the design token palette
+  Fix: Replace "#ff0000" with a token reference (e.g. var(--color-...) or a token-system lookup).
+       If the color is intentionally one-off, add it to tokens.json first.
+```
+
+Severity is `error` under `standard` because brand-color drift is high-impact.
+
+### Example: Raw `<button>` where Button is registered
+
+**Input:** `src/SaveButton.tsx` contains `<button onClick={...}>Save</button>`, and `design-system/DESIGN.md` `## Component Registry` lists `Button` mapped to `packages/ui/src/Button.tsx`.
+
+**Output:**
+
+```
+DRIFT-P001 [error] src/SaveButton.tsx:8 — Raw <button> element where the registered component "Button" should be used
+  Fix: Import Button from your component library and replace <button> with <Button>.
+       If this raw primitive is intentional (e.g. inside the Button component's own implementation),
+       add a JSDoc `@allow-raw-primitive` annotation on the file.
+```
+
+### Example: Reference to a deprecated token
+
+**Input:** `src/legacy.css` contains `.x { color: var(--color-brand-500); }`, and `tokens.json` flags `color.brand.500` as `$deprecated: true` with `$description: "Use color.brand.primary instead"`.
+
+**Output:**
+
+```
+DRIFT-T004 [warn] src/legacy.css:3 — Token "color.brand.500" is deprecated and should be migrated
+  Fix: Migrate references to "color.brand.500" to the replacement token noted in tokens.json $description,
+       or remove the deprecation if the token is still load-bearing.
+```
+
+## Gates
+
+- **No findings without resolved inputs.** If `tokens.json` is absent, all T\* rules silently skip. If `DESIGN.md ## Component Registry` is absent, all P\* rules silently skip. Either resolver failing is not a verifier failure — the project simply hasn't opted in.
+- **No autofix.** Findings include codemod-todo descriptions. The matching fixer (align-design-system) is a separate skill.
+- **No usage-side primitive findings beyond the four registered tags.** Other tags (`<select>`, `<details>`, etc.) are not in scope for v1 — even if the project registers a component for them. Subsumption ships in v1.x.
+- **Strictness from config, not assumed.** Read `design.strictness` from `harness.config.json`; default to `standard` if absent.
+
+## Escalation
+
+- **When token-bypass false positives appear in a third-party-shaped value.** E.g. a vendor color brought in via a CSS variable that legitimately doesn't match the palette. Either add the value to `tokens.json` (preferred — makes the palette authoritative) or scope the file via `design.audit.driftDetection.rules.tokenBypass: false` for a narrow path-overrides block (v1.x).
+- **When primitive-adoption fires inside the Button component's own implementation.** That's a true positive that the rule can't tell apart from the usage form. Two paths: (1) add `@allow-raw-primitive` JSDoc on the file (v1.x — annotation honored by the rule), or (2) extract the raw `<button>` into a private internal component until the annotation lands.
+- **When `harness validate` runtime exceeds 3 seconds.** Set `design.audit.driftDetection.fastMode.maxFiles` to cap the scope. The MCP tool ignores the cap (`fast`/`full` are equivalent in v1 — the cap is validate-side only).
+- **When the graph persistence fails.** Skip graph integration for that run; findings still appear in the report. The graph is a consumer, not a gate.
+- **When a project ships its own design-system convention (not tokens.json, not DESIGN.md registry).** v1 reads only the two declared input formats. Either (1) generate a tokens.json adapter that mirrors the existing convention (one-shot script), or (2) wait for v1.x's pluggable resolver interface.
+
+## Status
+
+**v1 — in implementation.** See:
+
+- Spec: `docs/changes/design-pipeline/detect-design-drift/proposal.md`
+- Roadmap entry: `design-pipeline sub-project #1` (detect half) in `docs/roadmap.md`
+- Sibling: `align-design-system` (fix half — deferred to a separate sub-project)

package/dist/agents/skills/claude-code/detect-design-drift/skill.yaml

@@ -0,0 +1,50 @@
+name: detect-design-drift
+version: "0.1.0"
+description: Detect design-system drift — hardcoded values where tokens exist and raw HTML primitives where registered components exist. Reports only; never modifies source. Floor-layer rule-based verifier composed by harness check-design.
+stability: draft
+cognitive_mode: constructive-architect
+triggers:
+  - manual
+  - on_pr
+  - on_new_feature
+platforms:
+  - claude-code
+tools:
+  - Bash
+  - Read
+  - Glob
+  - Grep
+cli:
+  command: harness skill run detect-design-drift
+  args:
+    - name: path
+      description: Project root path
+      required: false
+    - name: mode
+      description: "fast or full (equivalent in v1 — reserved for future scope expansion)"
+      required: false
+    - name: files
+      description: Optional list of files to scope the run
+      required: false
+mcp:
+  tool: run_skill
+  input:
+    skill: detect-design-drift
+    path: string
+type: rigid
+tier: 2
+phases:
+  - name: scan
+    description: Load tokens.json and DESIGN.md registry; walk candidate files
+    required: true
+  - name: apply_rules
+    description: Run DRIFT-T* and DRIFT-P* rules per file
+    required: true
+  - name: report
+    description: Aggregate severity, format findings, persist to graph
+    required: true
+state:
+  persistent: false
+depends_on:
+  - audit-component-anatomy
+  - harness-design-craft

package/dist/agents/skills/claude-code/harness-accessibility/SKILL.md

@@ -31,6 +31,15 @@
 - If `i18n.enabled` is false or absent, scan for `lang`/`dir` as normal (these remain part of the accessibility audit).
 - This deduplication prevents the same finding from appearing in both the accessibility report and the i18n report.
 
+  2.6. **Check for component-anatomy audit overlap.** Read `harness.config.json` for `design.audit.componentAnatomy.enabled` (default `true` when absent):
+
+- If `enabled: true`, **defer** `A11Y-010` (interactive elements without accessible labels) and `A11Y-050` (`<input>`/`<select>`/`<textarea>` without associated `<label>`) findings for components whose identified type is in the anatomy catalog. Load the catalog component-type set via `getCatalogTypes()` from `audit-component-anatomy`'s public export so this skill has zero rule-content duplication.
+- Identify each scanned JSX element's component type using the same 3-layer resolver `audit-component-anatomy` uses: (1) JSDoc `@component-type X` tag, (2) `design-system/DESIGN.md` `## Component Registry` mapping, (3) top-level export-name catalog match.
+- For components in the catalog: `audit-component-anatomy` owns the label-slot finding as `ANAT-D*` (definition-side in v1, `ANAT-U*` in v2). Do not emit `A11Y-010` / `A11Y-050` for them.
+- For raw HTML elements (`<button>`, `<input>`, `<select>`, `<textarea>`) and unidentified components: scan for `A11Y-010` / `A11Y-050` as normal.
+- If `enabled: false` or absent: scan for `A11Y-010` / `A11Y-050` as normal (no deferral).
+- Same i18n-style deduplication pattern as step 2.5 — prevents one root cause from appearing in both the accessibility report and the anatomy report.
+
 3. **Scan component files.** Search all files matching `.tsx`, `.jsx`, `.vue`, `.svelte`, `.html` for the following violations:
 
    **Images and media:**
@@ -183,6 +192,7 @@ This phase is optional. It applies fixes only for **mechanical issues** -- viola
 - **`harness-impact-analysis`** -- When tokens change (palette update, new colors), impact analysis traces affected components. The accessibility skill uses this to determine which components need re-scanning.
 - **`harness-design-system`** -- Dependency. When contrast failures originate from token definitions (not component code), escalate to harness-design-system to fix at the source.
 - **`harness-i18n` deduplication** -- When `i18n.enabled: true` in config, `lang` and `dir` attribute checks are deferred to the i18n skill. This prevents duplicate findings across the accessibility and i18n reports. When i18n is not enabled, these checks remain part of the accessibility scan.
+- **`audit-component-anatomy` deduplication** -- When `design.audit.componentAnatomy.enabled: true` in config (default), `A11Y-010` and `A11Y-050` are deferred to `audit-component-anatomy` for components in its catalog (Button, Input, Select, Modal, Card, Tabs, etc.). The anatomy audit owns the label-slot finding for those components; this skill still scans raw HTML and unidentified components. Same i18n-style deduplication pattern.
 
 ## Success Criteria