@nurix/etna 0.15.2 → 0.15.3

package/README.md

@@ -1,8 +1,8 @@
 # @nurix/etna
 
-CLI to bootstrap a project with a Nurix harness. Copies the harness's `CLAUDE.md`, skills, agents, rules, and scripts into the project so they live with the code — version-controllable, editable per project, and visible without leaving the repo.
+CLI to bootstrap a project with a Nurix harness. Copies the harness's `CLAUDE.md`, skills, agents, rules, and hooks (plus scripts, if the harness ships any) into the project so they live with the code — version-controllable, editable per project, and visible without leaving the repo.
 
-A second install path also exists and is fully supported: `/plugin install <plugin>@nurixlabs` from inside Claude Code, which installs the harness as a plugin from the `nurixlabs/skills` marketplace. The two paths are first-class equals — pick the one that matches how you want to manage the harness. See [`docs/architecture/harness-install-model.md`](../../docs/architecture/harness-install-model.md) for the comparison.
+A second install path also exists and is fully supported: `/plugin install <plugin>@nurixlabs` from inside Claude Code, which installs the harness as a plugin from the `nurixlabs/skills` marketplace. The two paths are first-class equals — pick the one that matches how you want to manage the harness. See [`docs/architecture/harness/install-model.md`](../../docs/architecture/harness/install-model.md) for the comparison.
 
 ## Usage
 
@@ -61,28 +61,31 @@ Listed by `npx @nurix/etna` (no args) using the bundled `data/harness-index.json
 
 | Plugin name | Source in etna | What it ships |
 |---|---|---|
-| `code` | [`plugins/code.md`](../../plugins/code.md) → top-level catalogs | Governance agents, baseline workflow skills, ownership/drift scripts |
-| `kb-agi` | [`plugins/kb-agi.md`](../../plugins/kb-agi.md) → top-level catalogs | Knowledge-vault scaffolding |
+| `code` | [`plugins/code/`](../../plugins/code/) | Governance + session agents, baseline workflow skills, knowledge-ledger hooks |
+| `kb-agi` | [`plugins/kb-agi/`](../../plugins/kb-agi/) | Knowledge-vault scaffolding |
 
 ## How it works
 
-Each harness has a folder under `etna/harness/<name>/` with:
-- `CLAUDE.md` — the project-root policy file
-- `index.md` — symlinked to `../../plugins/<plugin>.md` (the manifest)
+Each harness has two halves in the etna repo:
+- `plugins/<name>/` — the **plugin** (what a Claude Code plugin natively bundles): `definition.md` (manifest — identity + `skills:`/`rules:` lists), `agents/`, `hooks/`.
+- `harness/<name>/` — the **policy**: `CLAUDE.md` (pure policy, no frontmatter — installed as a verbatim copy) plus `index.md`, whose `plugin:` key names the plugin this harness pairs with. All harness-folder frontmatter lives in `index.md` alone.
 
-The plugin manifest's YAML frontmatter declares which top-level `agents/`, `skills/`, `rules/`, and `scripts/` belong to that plugin:
+Two kinds of membership:
+
+- **Shared, listed** — skills and rules live in the flat top-level `skills/`/`rules/` catalogs, reusable across plugins. The manifest names the ones it pulls in:
 
 ```yaml
+# plugins/code/definition.md
 ---
 name: code
-skills: [documentation, introspect, workflow-mapper]
-agents: [spec-mode, maintenance, contract-monitor, …]
-scripts: [build-ownership-index, check-doc-drift]
-rules: [general, nomenclature]
+skills: [boundary, brainstorm, distiller, documentation, workflow-mapper]
+rules:  [general, nomenclature]
 ---
 ```
 
-`scripts/build-data.js` (run by `prepack`) resolves each manifest against the catalogs and bundles the result into `data/harnesses/<folder>/`. The installer (`bin/etna.js`) reads from that bundle at install time. No GitHub fetch at runtime — the published npm package contains everything.
+- **Owned, by location** — agents and hooks live inside the plugin (`plugins/<name>/{agents,hooks}/`). No list — membership is presence in the folder, exactly how a Claude Code plugin ships them.
+
+`scripts/build-data.js` (run by `prepack`) resolves the listed skills/rules from the catalogs and copies the plugin's `agents/` + `hooks/` wholesale into `data/harnesses/<folder>/`; a listed skill/rule that doesn't exist is a hard error. The marketplace channel (`.github/scripts/publish.mjs`) reads the same plugin folder, so both channels resolve identical membership — and both ship the plugin's hooks. The installer (`bin/etna.js`) reads from the bundle at install time; no GitHub fetch at runtime.
 
 ## Building / contributing
 

package/bin/etna.js

@@ -70,18 +70,6 @@ function backupIfExists(path) {
     return backup;
 }
 
-// Split a CLAUDE.md into its YAML frontmatter (authoring metadata: name, version,
-// plugin, keywords) and its body. The frontmatter is meaningful in the harness
-// source and the bundle, but a consuming project's root CLAUDE.md is a plain
-// router — it must not carry it. Returns { body, version } with leading blank
-// lines after the stripped block removed so the body opens on its first heading.
-function stripFrontmatter(text) {
-    const m = text.match(/^---\n([\s\S]*?)\n---\n?/);
-    if (!m) return { body: text, version: null };
-    const version = (m[1].match(/^version:\s*(\S+)/m) || [])[1] || null;
-    return { body: text.slice(m[0].length).replace(/^\n+/, ''), version };
-}
-
 function readJson(path) {
     if (!existsSync(path)) return {};
     try {
@@ -203,11 +191,10 @@ async function main(args) {
     const claudeBackup = backupIfExists(claudeMdDest);
     if (claudeBackup) console.log(`  backed up existing CLAUDE.md → ${claudeBackup}`);
 
-    const { body: claudeMdBody, version } = stripFrontmatter(readFileSync(bundledClaudeMd, 'utf8'));
-    writeFileSync(claudeMdDest, claudeMdBody);
-    console.log(
-        `  installed CLAUDE.md → ${claudeMdDest}${version ? ` (harness v${version})` : ''}`,
-    );
+    // CLAUDE.md ships frontmatter-free (the harness's metadata lives in its index.md and the
+    // plugin's definition.md), so it installs as a verbatim copy — no stripping.
+    cpSync(bundledClaudeMd, claudeMdDest, { force: true });
+    console.log(`  installed CLAUDE.md → ${claudeMdDest}`);
 
     for (const sub of PLUGIN_SUBDIRS) {
         const count = copyHarnessSubdir(
@@ -224,9 +211,10 @@ async function main(args) {
         mkdirSync(dirname(harnessJsonDest), { recursive: true });
         cpSync(bundledHarnessJson, harnessJsonDest, { force: true });
         const meta = readJson(harnessJsonDest);
-        console.log(
-            `  installed harness.json → ${harnessJsonDest}${meta.epoch ? ` (epoch ${meta.epoch})` : ''}`,
-        );
+        const tag = [meta.version && `v${meta.version}`, meta.epoch && `epoch ${meta.epoch}`]
+            .filter(Boolean)
+            .join(', ');
+        console.log(`  installed harness.json → ${harnessJsonDest}${tag ? ` (${tag})` : ''}`);
     }
 
     // Merge the bundle's hooks.json into the project's settings.json (idempotent).

package/data/harness-index.json

@@ -1,6 +1,7 @@
 {
     "plugins": {
         "code": "code",
-        "kb-agi": "kb-agi"
+        "kb-agi": "kb-agi",
+        "re": "re"
     }
 }

package/data/harnesses/code/CLAUDE.md

@@ -1,17 +1,3 @@
----
-name: code
-description: Canonical Nurix code-project harness (spec v12) — three peer authoring modes (Brainstorming / Spec / Plan), modules as bounded contexts, typed application boundaries via the unified `boundary` skill, a self-migrating harness-manager, ownership rules. The reference CLAUDE.md every Nurix codebase starts with.
-version: 0.15.2
-keywords:
-  - harness
-  - code
-  - workflow
-  - documentation
-  - boundaries
-  - nurix
-plugin: code
----
-
 # Agent Instructions
 
 This file defines how AI agents (Claude, GPT, etc.) should work on this project. **This file is the harness** — it orchestrates the skills and agents that do the work. There is no separate "harness skill."

package/data/harnesses/code/agents/brainstorm.md

@@ -3,7 +3,6 @@ name: brainstorm
 description: Brainstorming-mode facilitator — a thin orchestrator over the self-contained `brainstorm` skill, which owns every session mechanic (the constant distill→abstract→sync→record loop, the four modes, the basis entry gate, the background sync reconciler, the complexity-scaled pillar surface, harvest). Use to recognize when a conversation belongs at the 30k-foot strategic-design altitude and drive it in the skill's voice. Triggers on an explicit ask to brainstorm/design strategically, or on recognizing that a user utterance challenges a loaded pillar headline — which you OFFER a session for (suggest `/brainstorm start`), never silently enter.
 tools: Read, Glob, Grep, AskUserQuestion, Write
 model: inherit
-plugins: [code]
 ---
 
 # Brainstorm Agent

package/data/harnesses/code/agents/change-review.md

@@ -3,7 +3,6 @@ name: change-review
 description: Velocity + change-risk analysis. First classifies recent commits into a pipe-delimited velocity/severity CSV by dispatching parallel haiku sub-agents (module, feature, impact, severity, churn), then derives a commit heatmap, risk zones (high churn + low boundary coverage), stabilization signals, and team/bus-factor distribution. Self-contained — produces its own CSV, no separate git-history step. Use when planning where to invest in better boundaries or rules.
 tools: Bash, Read, Write, Glob, Grep, Task
 model: inherit
-plugins: [code]
 ---
 
 # Change-Review Agent

package/data/harnesses/code/agents/harness-manager.md

@@ -3,7 +3,6 @@ name: harness-manager
 description: The harness's own migrator and structural-health auditor. Reconciles a repo's docs/ governance tree to the installed harness version — baseline is just reconcile-from-nothing; upgrade is reconcile-across-a-version-gap. Declarative (converge to the current shape, not an ordered migration ladder), idempotent, driven by the harness-version marker in docs/structure.md. Owns the Bootstrap. On demand, audits structural conformance to the harness spec. Triggers on "baseline this repo", "reconcile the harness", "upgrade the harness", "harness health", "is this repo on the current harness", "/harness-manager".
 tools: Read, Glob, Grep, Bash, Write, Edit
 model: inherit
-plugins: [code]
 ---
 
 # Harness-Manager Agent

package/data/harnesses/code/agents/maintenance.md

@@ -3,7 +3,6 @@ name: maintenance
 description: Docs-vs-code coherence audit. Detects and fixes docs drifting from code — stale docs, broken ownership, routing table drift, unowned source paths. Run weekly or after major changes. Contract violations (code drifting from docs) are handled by the `boundary` skill (`init` mode); pre-implementation impact checks by its `check` mode.
 tools: Read, Glob, Grep, Edit, Write, Bash
 model: inherit
-plugins: [code]
 ---
 
 # Maintenance Agent

package/data/harnesses/code/agents/performance-review.md

@@ -3,7 +3,6 @@ name: performance-review
 description: Combined dependency + code health audit. Part A audits the dependency supply chain — security CVEs, outdated packages, license compliance, abandoned packages, unwanted transitive dependencies, install size. Part B audits code-level health — bundle size, tree-shaking issues, performance anti-patterns, code-quality flags. Run weekly or before releases. Merges the former `dep-health` and `review` agents so the package tree and the code that uses it are audited together.
 tools: Read, Glob, Grep, Bash
 model: inherit
-plugins: [code]
 ---
 
 # Performance-Review Agent

package/data/harnesses/code/agents/spec-mode.md

@@ -5,7 +5,6 @@ tools: Read, Glob, Grep, WebSearch, WebFetch
 model: inherit
 skills:
   - documentation
-plugins: [code]
 ---
 
 # Spec Mode Agent

package/data/harnesses/code/harness.json

@@ -2,5 +2,5 @@
   "name": "code",
   "version": "0.15.2",
   "epoch": 12,
-  "digest": "911060693b53"
+  "digest": "ac5de718b94b"
 }

package/data/harnesses/code/rules/general.md

@@ -1,6 +1,5 @@
 ---
 applyTo: "**"
-plugins: [code]
 ---
 
 # Technology Choices & Standards

package/data/harnesses/code/rules/nomenclature.md

@@ -1,6 +1,5 @@
 ---
 applyTo: "**"
-plugins: [code]
 ---
 
 # Nomenclature Guidelines

package/data/harnesses/code/skills/boundary/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: boundary
 description: The single home for a repo's typed application boundaries — the cross-cutting contracts (db-schema, wire envelope, store shape, auth, tenancy, event schemas, edge bindings, …) where editing one module silently breaks another. One skill, four modes — `generate` (baseline all boundaries from the detected stack + IA), `create` (add/update one boundary), `check` (pre-implementation: does this plan touch a boundary? severity-ranked impact), `init` (reconcile: ensure files exist, scan live code for violations + drift, backfill new catalog types). All four read one shared knowledge root, `references/boundary-taxonomy.md`, so they can never drift apart. Triggers on "application boundary", "baseline boundaries", "map boundaries", "generate boundaries", "create a boundary", "introspect", "check this plan", "impact analysis", "what could break", "scan for boundary violations", "boundary drift", "/boundary".
-plugins: [code]
 ---
 
 # Application Boundary Skill

package/data/harnesses/code/skills/brainstorm/SKILL.md

@@ -2,7 +2,6 @@
 name: brainstorm
 description: Thinking-partner session for designing software. Invoked ONLY by explicit slash commands `/brainstorm start` and `/brainstorm stop` — never auto-invoke on natural-language phrases like "let's plan", "let's design", or "let's think through X". Entry requires a basis (a reference document or a one-shot brain dump); drip-fed action items are rejected as too small. Runs one constant loop (distill → abstract → sync → record) across four modes (dump / interview / probe / converge). Coherence = zero open questions after a fresh pillar sync. Pillar count scales with a complexity dial; refuses production code outside the session folder while open.
 argument-hint: "start | stop"
-plugins: [code]
 ---
 
 # Brainstorm

package/data/harnesses/code/skills/distiller/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: distiller
 description: The one place the raw event ledger is distilled into colder, higher-signal knowledge. One skill, two modes — `facts` (ledger → atomic provenance-linked fact-cards in `docs/memory/facts/`) and `docs` (fact-cards → proposed, human-approved doc deltas). Both modes read one shared algorithm spec, `references/method.md` (surprisal filter, EDU fact-cards, reconciliation, bi-temporal supersession — all stolen, all cited), so they can never drift apart. NEVER edits the ledger (append-only audit substrate); NEVER auto-runs (invoked by the user, or by accepting the maintenance agent's threshold proposal). Triggers on "distill the ledger", "distill facts", "run the distiller", "distill into fact-cards", "facts from the ledger", "distill docs", "draft doc deltas", "distiller docs", "/distiller".
-plugins: [code]
 ---
 
 # Distiller Skill

package/data/harnesses/code/skills/documentation/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: documentation
 description: Template & generator library for technical docs — the skill agents call to produce a doc from a template. Use to (1) document a feature or module, (2) create or update a changelog entry, (3) document data flows or Redux state, (4) add to protected files, (5) provide the generic boundary-file template (typed-boundary *generation* is the `boundary` skill), (6) record an architecture decision (ADR), (7) create or update the project root README, (8) create or update a plan, (9) derive ownership frontmatter (`owns`/`touches`/`depends_on`) from code, (10) scaffold a standard doc (README, structure.md, CHANGELOG, backlog, memory) from its template, or (11) co-author any technical doc. Baselining / reconciling a repo's docs to the installed harness version is the **`harness-manager` agent** (which calls this skill for each template) — this skill does not orchestrate baseline. Triggers on "document this", "create docs", "update changelog", "add to protected files", "ADR", "architecture decision", "root README", "plan", "feature doc".
-plugins: [code]
 ---
 
 # Technical Documentation Skill

package/data/harnesses/code/skills/workflow-mapper/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: workflow-mapper
 description: Discover and document all major workflows in a codebase by tracing call chains from user action to database/external system. Produces mermaid sequence diagrams and markdown documentation. Use when the user asks to map workflows, trace flows, document sequences, understand how features work end-to-end, or generate architecture diagrams. Triggers on "map workflows", "trace workflows", "workflow diagram", "sequence diagram", "how does X work end-to-end", "document flows", "codebase workflows", "how does this feature work", "trace the request flow", "show me the call chain", "what happens when a user does X", "end-to-end flow".
-plugins: [code]
 ---
 
 # Workflow Mapper Skill

package/data/harnesses/kb-agi/CLAUDE.md

@@ -1,18 +1,3 @@
----
-name: kb-agi
-description: Self-improving knowledge-base harness — a CLAUDE.md router (interview → ask/contribute) over a flat Obsidian note-vault, with single-intent upkeep agents that keep the vault trustworthy and grow it from its own query logs.
-version: 0.10.0
-keywords:
-  - harness
-  - knowledge-base
-  - obsidian
-  - vault
-  - self-improving
-  - kb
-  - nurix
-plugin: kb-agi
----
-
 # NuStack Knowledge Hub — router
 
 This repo is a flat Obsidian vault that you read on the user's behalf. It's the bridge from the front (positioning, claims) to the back (product and service specs); detailed execution lives downstream in the service repos.

package/data/harnesses/kb-agi/agents/kb-agi-init.md

@@ -3,7 +3,6 @@ name: kb-agi-init
 description: Initializes a kb-agi vault by scaffolding the meta/ control plane — the contract (guidance.md), the seed genre templates, the intent-index, and the sessions/ folder — from templates carried inline in this agent. Use on a fresh vault, or when the router reports that meta/guidance.md is missing. Triggers on "initialize kb-agi", "init the vault", "scaffold meta", "set up the control plane".
 tools: Read, Glob, Bash, Write
 model: inherit
-plugins: [kb-agi]
 ---
 
 You are the **kb-agi-init** agent. One job: stand up the `meta/` control plane a kb-agi vault needs to operate, then get out of the way. You run once per vault, and you are fully self-contained — every file you create is carried inline below, so you need no external templates.

package/data/harnesses/kb-agi/agents/kb-catch-stale.md

@@ -3,7 +3,6 @@ name: kb-catch-stale
 description: Finds notes that have drifted out of date — a canonical note superseded by a newer one but never demoted, or a summary whose linked-down sources changed after it. Use to audit freshness. Reports by default; demotes/flags only when explicitly asked.
 tools: Read, Grep, Glob, Bash
 model: inherit
-plugins: [kb-agi]
 ---
 
 You are the **kb-catch-stale** goal-agent for the NuStack knowledge hub. One job: surface notes that have drifted out of date.

package/data/harnesses/kb-agi/agents/kb-find-gaps.md

@@ -3,7 +3,6 @@ name: kb-find-gaps
 description: Audits the NuStack vault for missing notes — diffs each folder's metadata.md and the session gap-logs against the note graph to find coverage holes. Use when asked to find gaps, check coverage, or "what's missing". Proposes a ranked gap list by default; writes notes ONLY when the invocation explicitly asks it to.
 tools: Read, Grep, Glob, Bash
 model: inherit
-plugins: [kb-agi]
 ---
 
 You are the **kb-find-gaps** goal-agent for the NuStack knowledge hub. You have exactly one job: find what the vault should hold but doesn't, and surface it.

package/data/harnesses/kb-agi/agents/kb-fix-links.md

@@ -3,7 +3,6 @@ name: kb-fix-links
 description: Audits the note graph for dead wikilinks (targets that don't resolve) and orphan notes (no inbound links). Use to check graph integrity. Reports by default; repairs unambiguous dead links and links orphans only when explicitly asked.
 tools: Read, Grep, Glob
 model: inherit
-plugins: [kb-agi]
 ---
 
 You are the **kb-fix-links** goal-agent for the NuStack knowledge hub. One job: keep the note graph sound — no dead links, no orphans.

package/data/harnesses/kb-agi/agents/kb-refresh-frontdoor.md

@@ -3,7 +3,6 @@ name: kb-refresh-frontdoor
 description: Keeps the entry points current — checks meta/intent-index.md lanes and the genre templates' "start from" lists against the notes that actually exist. Use after content lands. Reports a diff by default; updates the front-door files only when explicitly asked.
 tools: Read, Grep, Glob, Edit
 model: inherit
-plugins: [kb-agi]
 ---
 
 You are the **kb-refresh-frontdoor** goal-agent for the NuStack knowledge hub. One job: keep the entry points pointing at the right notes.

package/data/harnesses/kb-agi/agents/kb-refresh-summaries.md

@@ -3,7 +3,6 @@ name: kb-refresh-summaries
 description: Finds synthesized/published notes that have fallen behind the raw sources they link down to, and (on request) folds the new material in. Use after raw captures or a migration batch land. Reports by default; writes the refresh only when explicitly asked.
 tools: Read, Grep, Glob, Bash, Edit
 model: inherit
-plugins: [kb-agi]
 ---
 
 You are the **kb-refresh-summaries** goal-agent for the NuStack knowledge hub. One job: keep summary notes current with the raw material beneath them.

package/data/harnesses/kb-agi/agents/kb-sync-metadata.md

@@ -3,7 +3,6 @@ name: kb-sync-metadata
 description: Keeps each content folder's metadata.md accurate to what the folder actually holds — checks Entry notes, Neighbours, and About against reality. Use before kb-find-gaps so it reads honest descriptions. Reports drift by default; updates metadata.md only when explicitly asked.
 tools: Read, Grep, Glob, Edit
 model: inherit
-plugins: [kb-agi]
 ---
 
 You are the **kb-sync-metadata** goal-agent for the NuStack knowledge hub. One job: keep folder `metadata.md` files honest.

package/data/harnesses/kb-agi/harness.json

@@ -2,5 +2,5 @@
   "name": "kb-agi",
   "version": "0.10.0",
   "epoch": null,
-  "digest": "8973cf3a762d"
+  "digest": "856a9f4e297a"
 }

package/data/harnesses/kb-agi/rules/kb.md

@@ -1,7 +1,3 @@
----
-plugins: [kb-agi]
----
-
 # kb.md — Patterns for Obsidian-like Folders
 
 Conventions for any folder that is majority markdown — `docs/`, `research/`, an Obsidian vault, or any knowledge base. Rules grow over time; append new ones below.

package/data/harnesses/re/CLAUDE.md

@@ -0,0 +1,139 @@
+# Product Reverse-Engineering — Orchestrator
+
+This is the **policy** half of the `re` harness. The plugin ships the capabilities (11
+dimension-dumper agents + 3 `re-*` rules, one per pipeline phase); this file drives them. Together they reverse-engineer a
+product across every surface it exposes and dump a structured, provenance-tracked corpus into
+`research/<target>/`.
+
+A run is four modes, in order: **Discovery → Ingestion → Evaluation → Self-correction.** The main
+session drives all four — Ingestion and Evaluation fan out parallel sub-agents, and a sub-agent
+cannot spawn further sub-agents.
+
+---
+
+## Access is a capability vector (the front gate)
+
+A target's access is four orthogonal axes, each `{value, confidence, evidence}` — and the vector
+decides which dimensions are reachable and which extraction method each uses:
+
+| Axis | Values | Unlocks | Case |
+|------|--------|---------|------|
+| **source** | full · partial · none | codebase, packages | open-source repo |
+| **runtime** | reachable · gated · none | deployed-client-bundle, api, infra-backend-fingerprint, wire-capture | deployed, no source |
+| **auth** | have-login · none | session | logged-in SaaS |
+| **presence** | rich · thin · none | docs, website, community | — |
+
+Targets light several axes at once. The full model + grade→method mapping is in
+`.claude/rules/re-discovery.md`.
+
+---
+
+## The eleven dimensions → agents
+
+| Dimension / agent | | Dimension / agent |
+|---|--|---|
+| `codebase` | | `session` ⚠ |
+| `docs` | | `deployed-client-bundle` |
+| `packages` | | `infra-backend-fingerprint` |
+| `api` (+MCP) | | `wire-capture` ⚠ |
+| `website` | | `distribution-artifacts` |
+| `community` | | |
+
+Agent name = dimension name. ⚠ = gated (needs user authorization before dispatch). The catalog —
+detection signals + strategy + per-dimension artifacts — is in `.claude/rules/re-discovery.md`.
+
+---
+
+## Mode 1 — Discovery
+
+Cheap, read-only. Scope the target, grade its access, detect which dimensions it exposes.
+
+1. **Scope-feasibility gate** — run the `.claude/rules/re-discovery.md` Part A (scope gate) algorithm: resolve
+   identity → ambiguity → ethics → suite-size → primitive → reachability. If the verdict isn't
+   `accept`, **halt** (present the narrowing/redirect prompt, or refuse). Write
+   `research/<target>/00-scope-verdict.md`.
+2. **Grade the access vector** (the four axes, with evidence) per `re-discovery` (Part B).
+3. **Probe each of the 11 dimensions** (cheap signals only); mark ✅ available / ⚠️ partial /
+   ❌ absent with evidence. An absent dimension is a finding.
+4. Write `research/<target>/00-recon-plan.md` — frontmatter carries `scope:` + the `access_grade`
+   vector; the body is the dimension-availability table + the per-dimension dump plan (warm entry
+   points) + the gating/ethics flags.
+
+---
+
+## Mode 2 — Ingestion
+
+Dispatch one dumper per available dimension; dump exhaustively before context is lost. Every dumper
+writes `research/<target>/dimensions/<dim>/_summary.md` (with the **provenance frontmatter** —
+method · confidence · completeness · gaps) + `raw/`, obeying `.claude/rules/re-ingestion.md`.
+
+- **Run independents in parallel** — dispatch `docs`, `packages`, `api`, `website`, `community`,
+  `deployed-client-bundle`, `infra-backend-fingerprint`, `distribution-artifacts` together
+  (`subagent_type='<dimension>'`, one message, multiple Agent calls).
+- **Codebase fan-out** — dispatch `codebase`; it clones + maps + returns a per-package work-list;
+  then the main session fans out one reader per substantial package.
+- **Gated dimensions** — `session` and `wire-capture` (rung ≥2) need explicit user authorization
+  first (see `re-ingestion` §7). `session` follows `.claude/rules/re-ingestion.md` §9.
+- **Shared seam** — bundle/session/wire each contribute to the canonical `raw/api-path-catalog.md`
+  with a `source:` column; don't triplicate.
+
+Validate each return (`_summary.md` + provenance present). A `blocked`/`partial` return is recorded,
+not blindly re-run.
+
+---
+
+## Mode 3 — Evaluation
+
+Reconcile the dumps into four cross-dimension rollups under `research/<target>/evaluation/`, plus
+the run `README.md`, **weighting every claim by how it was obtained**. Follow
+`.claude/rules/re-evaluation.md`: read each dimension's provenance frontmatter first; anchor +
+provenance-tag every claim `(api: raw/endpoint-catalog.md · openapi-verbatim · high)`; weight
+(max-of-sources, promote one band only on ≥2 *independent* dimensions, never average); present
+high→fact, low/single-source→tentative, conflict→flagged. The four rollups: `technology-architecture`,
+`product-features`, `data-model-api-surface`, `competitive-positioning`.
+
+---
+
+## Mode 4 — Self-correction (the harness improves itself, never silently)
+
+Read the finished run (scope verdict, plan, every dimension `_summary.md`, the rollups) and detect
+where the harness under-delivered (method ≠ planned, missing artifacts, low completeness, blocked
+where predicted available). Write **one** file — `research/<target>/04-self-correction-proposal.md`
+— an ordered table of proposed fixes, each routed to its target file (`re-discovery` /
+`re-ingestion` / `re-evaluation` / an agent), with severity, an
+additive/structural flag, and a `research/<target>/…` evidence anchor.
+
+**Approval gate:** present the table and STOP — nothing is applied. The user accepts / rejects /
+defers per item. Then the **main session** (not a sub-agent) applies accepted items, flips each row
+to APPLIED, and logs the change. Promote only what the *next, different* target would also hit;
+prefer additive edits; structural edits are flagged, never auto-applied.
+
+---
+
+## Ethics (non-negotiable)
+
+For spec-writing, integration planning, and competitive analysis — **not** credential theft,
+rate-limit bypass, or scraping. Full rules: `.claude/rules/re-ingestion.md` §7.
+
+- **Never enter credentials.** The user logs in; `session` and `wire-capture` rung 3 are opt-in.
+- **Redact every secret before writing `raw/`.** Cookies/tokens/JWT-signatures/API-keys never hit disk.
+- **wire-capture** climbs the 3-rung ladder (browser-tap → HAR → mitmproxy); rung 3 is user-run,
+  first-party traffic only. Wireshark is not used (TLS ciphertext).
+- **Confirm before any state change or cost.** **No destructive actions, no exfiltration.** Respect TOS/robots.
+
+---
+
+## Output contract
+
+```
+research/<target>/
+├── 00-scope-verdict.md            ← Discovery: accept/narrow/redirect/refuse
+├── 00-recon-plan.md               ← Discovery: access_grade + scope + dimension plan
+├── dimensions/<dim>/{_summary.md, raw/}   ← Ingestion (session & wire-capture also: captures/, curls.md)
+├── evaluation/{technology-architecture, product-features, data-model-api-surface, competitive-positioning}.md
+├── README.md                      ← Evaluation: run story + headline findings
+└── 04-self-correction-proposal.md ← Self-correction: proposed harness fixes (approval-gated)
+```
+
+Cloned repos live in `source/<target>/`. Provenance is the "self-aware" layer: each dump records
+*how* it was obtained; Evaluation weights claims by it. Detailed shapes live in the `re-*` rules.

package/data/harnesses/re/agents/api.md

@@ -0,0 +1,52 @@
+---
+name: api
+description: Dimension dumper for the PUBLIC API / wire-contract dimension of the Product Recon Harness — OpenAPI/Swagger specs, GraphQL schemas, REST reference, webhooks. Fetches the spec verbatim and builds an endpoint & schema catalog with auth, pagination, and error-envelope notes. Dispatched during Ingestion (Mode 2).
+tools: Bash, Read, Glob, Grep, Write, WebFetch
+model: inherit
+---
+
+# api — the public API / wire-contract dimension
+
+You dump a target's documented machine interface into `research/<target>/dimensions/api/`.
+Read `.claude/rules/re-ingestion.md` (repo root) first and obey it.
+
+## Inputs (from the dispatch prompt)
+- target slug; the spec location(s): an OpenAPI/Swagger URL or in-repo path (e.g.
+  `source/<target>/docs/references/*.openapi.json`), a GraphQL endpoint, or a REST-reference
+  docs section; the output dir `research/<target>/dimensions/api/`.
+
+## Strategy
+
+1. **OpenAPI / Swagger** — fetch the spec verbatim into `raw/openapi.json` (digest if multi-MB:
+   keep `info`, `servers`, the full paths list, the component schema *names* + key schemas, drop
+   redundant examples). Build an **endpoint catalog**: every path × method, summary, auth, the
+   request/response schema names, pagination style, rate-limit headers.
+2. **GraphQL** — if introspection is on or a schema is published, capture types, queries,
+   mutations, subscriptions. Note if introspection is disabled (a finding).
+3. **REST-reference prose** (no machine spec) — reconstruct the catalog from the docs section.
+4. Note the **auth model** (token type + header), the **response envelope** shape, the **error
+   format**, **versioning**, and **webhooks** (event types + payload shapes) if documented.
+5. **MCP / tool-catalog fold-in** — probe for an MCP server manifest (`/.well-known/mcp`, an MCP
+   config), a function-calling tool schema, or an LLM "actions"/tools file. An MCP tool list *is*
+   an API catalog, so it lives here (not as its own dimension) → `raw/tool-catalog.md`. Increasingly
+   common in 2026; an absent one is fine, a present one is high-signal.
+
+## Output
+
+- `research/<target>/dimensions/api/_summary.md` (per contract — incl. the provenance
+  frontmatter: method/confidence/completeness/gaps): Method, Findings (auth model, envelope,
+  pagination, the endpoint-family overview as a table, webhook events, any tool-catalog),
+  Inferences (API generation/style — REST/GraphQL/RPC; maturity; versioning posture), Open
+  questions, Artifacts.
+- `raw/openapi.json` (or `raw/graphql-schema.md`) — the spec, verbatim or digested.
+- `raw/endpoint-catalog.md` — the full path × method × auth × schema table.
+- `raw/tool-catalog.md` — the MCP/tool-schema surface, if present.
+
+## Return value
+A one-paragraph headline (the API surface in a sentence) + endpoint-family counts + the auth
+model. Flag overlap with the packages/docs dimensions (the published SDK often wraps this API)
+and especially any drift vs. the session dimension's *observed* wire surface, for synthesis.
+
+**Discipline:** the spec is the load-bearing artifact — capture it accurately, digest if huge.
+Redact any embedded keys/example tokens. A disabled-introspection or undocumented API is a
+finding, recorded as an Open question, not a guess.

package/data/harnesses/re/agents/codebase.md

@@ -0,0 +1,63 @@
+---
+name: codebase
+description: Dimension dumper for the open-source CODEBASE dimension of the Product Recon Harness. Clones the target repo, maps its structure, and returns a per-package/module work-list (the main session fans out from there). Dispatched during Ingestion (Mode 2) — not invoked directly by users.
+tools: Bash, Read, Glob, Grep, Write
+model: inherit
+---
+
+# codebase — the open-source codebase dimension
+
+You dump the **source** of a target into `research/<target>/dimensions/codebase/`. Read
+`.claude/rules/re-ingestion.md` (repo root) first — it defines the `_summary.md` + `raw/` shape,
+the size discipline, and the redaction rules. You obey it.
+
+You **cannot spawn sub-agents.** Your job is the top-level map *plus* a per-package work-list
+that the main session uses to fan out deep per-package readers. Don't try to read every line
+of every package yourself — map breadth, flag depth.
+
+## Inputs (from the dispatch prompt)
+- target slug, the repo clone URL (or a path if already cloned in `source/<target>/`),
+- the output dir `research/<target>/dimensions/codebase/`.
+
+## Steps
+
+1. **Clone** (if not already): `git clone --depth 1 <url> source/<target>/`. Capture the
+   HEAD commit. If huge, still shallow-clone; you'll digest, not read everything.
+2. **Orientation read:** root `README.md`, `AGENTS.md`/`CLAUDE.md`, `CONTRIBUTING`, the root
+   manifest (`package.json` / `pyproject.toml` / `Cargo.toml` / `go.mod`), and the workspace
+   manifest (`pnpm-workspace.yaml` / `turbo.json` / `lerna.json` / Cargo workspace).
+3. **Structural map:** top-level layout; every package/app/module with a one-line purpose
+   (from its own README / manifest `description`); the **internal dependency hierarchy**
+   (which package depends on which); the build system, language(s), test setup; license posture
+   (look for a `licenses/` dir or per-package `license` fields).
+4. **Identify the substantial units** — the packages/modules worth a deep read (public SDKs,
+   the core engine, anything large or load-bearing). These become the work-list.
+
+## Output
+
+Write `research/<target>/dimensions/codebase/_summary.md` (per the contract): Method,
+Findings (the structural map + dep hierarchy + build system, as tables), Inferences
+(architecture, public vs private packages, runtime model), Open questions, Artifacts.
+
+Write `research/<target>/dimensions/codebase/raw/structure-map.md` — the full layout + a
+table of every package: name · path · purpose · public/private · key deps. And
+`raw/dependency-graph.md` — the internal dependency hierarchy.
+
+## Return value (critical — this drives the fan-out)
+
+Return a **per-unit work-list** as a compact table so the main session can dispatch one reader
+per unit:
+
+```
+| unit | path | why it matters | suggested output file |
+|------|------|----------------|-----------------------|
+| @scope/client | packages/x-client | core SDK, public | raw/client.md |
+| ... | ... | ... | ... |
+```
+
+Plus a one-paragraph headline of what the codebase reveals. The main session will dispatch
+readers that each write `raw/<unit>.md` (install/exports/key-files/architecture for that unit).
+
+**Discipline:** breadth over depth; digest large trees; never read or write secrets (scan
+`.env*`, config, fixtures for credentials and redact before quoting). An empty/over-large
+area is an Open question, not a guess.