@nurix/etna 0.15.3 → 0.15.5

package/bin/etna.js

@@ -186,32 +186,45 @@ async function main(args) {
     const targetDir = process.cwd();
     const claudeMdDest = join(targetDir, 'CLAUDE.md');
 
-    console.log(`\nInstalling ${pluginName} into ${targetDir}`);
+    // Read the bundled epoch marker up front so the install banner can name the
+    // harness version; the file itself is copied into the project further down.
+    const bundledHarnessJson = join(bundledHarnessDir, 'harness.json');
+    const harnessMeta = existsSync(bundledHarnessJson) ? readJson(bundledHarnessJson) : {};
+    const versionTag = harnessMeta.version ? ` v${harnessMeta.version}` : '';
+
+    console.log(`\nInstalling ${pluginName}${versionTag} into ${targetDir}`);
 
     const claudeBackup = backupIfExists(claudeMdDest);
     if (claudeBackup) console.log(`  backed up existing CLAUDE.md → ${claudeBackup}`);
 
     // CLAUDE.md ships frontmatter-free (the harness's metadata lives in its index.md and the
     // plugin's definition.md), so it installs as a verbatim copy — no stripping.
+    // Tracks the categories actually present in this harness, for the closing
+    // summary — so a harness that ships no skills or hooks reads as an explicit,
+    // honest list rather than a silently missing line.
+    const installed = [];
+
     cpSync(bundledClaudeMd, claudeMdDest, { force: true });
     console.log(`  installed CLAUDE.md → ${claudeMdDest}`);
+    installed.push('CLAUDE.md');
 
     for (const sub of PLUGIN_SUBDIRS) {
         const count = copyHarnessSubdir(
             join(bundledHarnessDir, sub),
             join(targetDir, '.claude', sub),
         );
-        if (count > 0) console.log(`  copied ${count} ${sub} → ${targetDir}/.claude/${sub}/`);
+        if (count > 0) {
+            console.log(`  copied ${count} ${sub} → ${targetDir}/.claude/${sub}/`);
+            installed.push(`${count} ${sub}`);
+        }
     }
 
     // Copy the epoch marker so harness-manager can resolve the installed epoch.
-    const bundledHarnessJson = join(bundledHarnessDir, 'harness.json');
     if (existsSync(bundledHarnessJson)) {
         const harnessJsonDest = join(targetDir, '.claude', 'harness.json');
         mkdirSync(dirname(harnessJsonDest), { recursive: true });
         cpSync(bundledHarnessJson, harnessJsonDest, { force: true });
-        const meta = readJson(harnessJsonDest);
-        const tag = [meta.version && `v${meta.version}`, meta.epoch && `epoch ${meta.epoch}`]
+        const tag = [harnessMeta.version && `v${harnessMeta.version}`, harnessMeta.epoch && `epoch ${harnessMeta.epoch}`]
             .filter(Boolean)
             .join(', ');
         console.log(`  installed harness.json → ${harnessJsonDest}${tag ? ` (${tag})` : ''}`);
@@ -226,8 +239,10 @@ async function main(args) {
     const migrated = migrateFromPluginInstall(targetDir, pluginName);
     for (const entry of migrated) console.log(`  removed stale ${entry}`);
 
-    console.log(`\nDone. Open Claude Code in ${targetDir}.`);
-    console.log(`Re-run \`npx @nurix/etna ${pluginName}\` anytime to refresh harness content.\n`);
+    console.log(`\nDone — ${pluginName}${versionTag} installed: ${installed.join(', ')}.`);
+    console.log(
+        `Open Claude Code in ${targetDir}. Re-run \`npx @nurix/etna ${pluginName}\` anytime to refresh harness content.\n`,
+    );
 }
 
 main(process.argv.slice(2)).catch((e) => {

package/data/harness-index.json

@@ -1,4 +1,5 @@
 {
+    "fingerprint": "fcd26215a41d",
     "plugins": {
         "code": "code",
         "kb-agi": "kb-agi",

package/data/harnesses/code/CLAUDE.md

@@ -20,7 +20,7 @@ This is the only step that runs **before** the harness exists; everything below
 
 ## Getting Started
 
-- Read **[`docs/README.md`](docs/README.md)** for documentation root (architecture, features, operations)
+- Read **[`docs/structure.md`](docs/structure.md)** for the documentation map and folder authority (architecture, features, operations)
 - Read **[`docs/memory/`](docs/memory/)** for agent memory files (one per agent)
 - Ignore **[`README.md`](README.md)** – it's for human reference only
 - Check **[`package.json`](package.json)** for available scripts. Detect the package manager from the lockfile (`pnpm-lock.yaml` → pnpm, `yarn.lock` → yarn, `package-lock.json` → npm) and use the matching command. Don't hardcode a specific manager.
@@ -134,9 +134,9 @@ Unless explicitly requested:
 
 ## Documentation
 
-`docs/structure.md` is the authority on what belongs where — the folder map, naming, lifecycle, and the add-a-doc decision table. Read it before adding or moving a doc; don't restate it here. Start from `docs/README.md`. One canonical source per topic — link, don't copy. Only `CLAUDE.md`, `AGENTS.md`, and `README.md` live at the repo root.
+`docs/structure.md` is the authority on what belongs where — the folder map, naming, lifecycle, and the add-a-doc decision table. Read it before adding or moving a doc; don't restate it here. One canonical source per topic — link, don't copy. Only `CLAUDE.md`, `AGENTS.md`, and `README.md` live at the repo root.
 
 Maintenance triggers (act on these without re-reading `structure.md`):
 
 - After plan completion: add a `docs/history/changelog/` entry + update `docs/history/CHANGELOG.md` (no confirmation; include `Commits:` if multi-commit). Non-plan changes (refactors, fixes, API changes): prompt first.
-- When you add, move, or delete a doc: update `docs/routing.md` and `docs/README.md` to match. When you move or rename source files: fix the `owns`/`touches` frontmatter in the owning doc; new docs that own code need `owns`/`touches`/`depends_on`.
+- When you add, move, or delete a doc: update `docs/routing.md` to match. When you move or rename source files: fix the `owns`/`touches` frontmatter in the owning doc; new docs that own code need `owns`/`touches`/`depends_on`.

package/data/harnesses/code/agents/harness-manager.md

@@ -104,7 +104,7 @@ Table: `| File | Action | From | To | Reason |` (actions: `Move`, `Merge into {t
 
 Create the folder structure; move/fold/merge/delete per the plan; add `Status:` to plan files; add ownership frontmatter to feature docs (call the `documentation` skill's **frontmatter derivation** for `owns`/`touches`/`depends_on`); merge scattered backlogs into `docs/history/backlog.md`; fix links broken by moves. Scaffold missing mandated files **by calling the `documentation` skill for each template** — you orchestrate, the skill supplies templates:
 
-- `docs/README.md`, `docs/structure.md` (with `harness-version`), `docs/history/CHANGELOG.md`, `docs/history/backlog.md`, `docs/memory/index.md`, `docs/memory/main.md`, `docs/memory/facts/.digest-state.md` (placeholder, "no entries digested yet"), and the repo-root `README.md` (filled from the real lockfile/scripts/layout — **never overwrite an existing root README**).
+- `docs/structure.md` (with `harness-version`), `docs/history/CHANGELOG.md`, `docs/history/backlog.md`, `docs/memory/index.md`, `docs/memory/main.md`, `docs/memory/facts/.digest-state.md` (placeholder, "no entries digested yet"), and the repo-root `README.md` (filled from the real lockfile/scripts/layout — **never overwrite an existing root README**).
 
 Scaffold `docs/memory/facts/` so the distilled tier has a home from day one: hooks write the raw ledger to `docs/memory/ledger/` (not a scaffold — created mechanically on first event), and the `distiller` digests it down into fact-cards under `docs/memory/facts/`. Without the facts dir + its `.digest-state.md` high-water mark, a freshly-baselined consumer accrues a ledger firehose the distiller has nowhere to land — so seed the empty distilled tier alongside the hook-written ledger tier.
 
@@ -160,7 +160,7 @@ If the user **declines** the advisory rather than running the follow-up, record
 
 ### Step 7 — Verify
 
-Confirm all mandated files exist; `structure.md` carries the current `harness-version`; no dead links in `docs/README.md`; every plan has a `Status:`; feature docs have ownership frontmatter; no dissolved-version artifacts remain; no docs outside the canonical structure.
+Confirm all mandated files exist; `structure.md` carries the current `harness-version`; no dead links in `docs/structure.md`; every plan has a `Status:`; feature docs have ownership frontmatter; no dissolved-version artifacts remain; no docs outside the canonical structure.
 
 ---
 

package/data/harnesses/code/agents/spec-mode.md

@@ -17,7 +17,7 @@ You do NOT write the spec — you return structured research that the main agent
 
 First, understand the documentation landscape:
 
-1. Read `./docs/README.md` to understand the documentation structure
+1. Read `./docs/structure.md` to understand the documentation structure
 2. If `./docs/features/README.md` exists, read it to see existing feature specs and where the new spec fits; otherwise glob the feature docs directly
 3. If `./docs/memory/spec-mode.md` exists, read it for feature doc inventory, ownership conflict zones, and lessons from previous research
 4. Read 1-2 existing specs in `./docs/features/` to calibrate format and depth

package/data/harnesses/code/harness.json

@@ -1,6 +1,6 @@
 {
   "name": "code",
-  "version": "0.15.2",
+  "version": "0.15.3",
   "epoch": 12,
-  "digest": "ac5de718b94b"
+  "digest": "8bd2f1540f40"
 }

package/data/harnesses/kb-agi/harness.json

@@ -1,6 +1,6 @@
 {
   "name": "kb-agi",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "epoch": null,
   "digest": "856a9f4e297a"
 }

package/data/harnesses/re/CLAUDE.md

@@ -69,11 +69,18 @@ method · confidence · completeness · gaps) + `raw/`, obeying `.claude/rules/r
 
 - **Run independents in parallel** — dispatch `docs`, `packages`, `api`, `website`, `community`,
   `deployed-client-bundle`, `infra-backend-fingerprint`, `distribution-artifacts` together
-  (`subagent_type='<dimension>'`, one message, multiple Agent calls).
+  (`subagent_type='<dimension>'`, one message, multiple Agent calls). Seed each dumper with **warm
+  entry points (URLs / repos / hosts), not claimed facts** — any fact carried from Discovery (a price,
+  a tier name, a version) is tagged `verify:may-be-stale` so the dumper re-derives it instead of
+  anchoring on a possibly-stale value. Only one dimension may drive the browser at a time (see
+  `re-ingestion` §7 rule 9): the parallel dumpers use WebFetch/curl, leaving Chrome to `session`.
 - **Codebase fan-out** — dispatch `codebase`; it clones + maps + returns a per-package work-list;
   then the main session fans out one reader per substantial package.
 - **Gated dimensions** — `session` and `wire-capture` (rung ≥2) need explicit user authorization
-  first (see `re-ingestion` §7). `session` follows `.claude/rules/re-ingestion.md` §9.
+  first (see `re-ingestion` §7). `session` follows `.claude/rules/re-ingestion.md` §9. When `session`
+  is authorized, **dispatch the non-browser dumpers in the background (`run_in_background`) and drive
+  the gated browser session in the main session concurrently** — they don't contend (Chrome belongs to
+  the main session; the dumpers use WebFetch/curl), so the whole of Ingestion runs in parallel.
 - **Shared seam** — bundle/session/wire each contribute to the canonical `raw/api-path-catalog.md`
   with a `source:` column; don't triplicate.
 

package/data/harnesses/re/agents/infra-backend-fingerprint.md

@@ -95,3 +95,12 @@ any CT-leaked host worth a `wire-capture` or `deployed-client-bundle` follow-up.
 crt.sh/WHOIS rate limits and back off; redact any credential-shaped value before writing (contract
 §7 rule 3 — DSNs, verification tokens, embedded keys surfaced in headers/TXT). An unresolvable host or a
 missing sub-processor page is an Open question, not a guess.
+
+**Verify an absence before asserting it (contract §7 rule 10).** Before reporting any host as
+**NXDOMAIN / absent** — especially `api.<target>` or any host a sibling dimension (bundle / session /
+wire) reports actually hitting — re-resolve via a **second resolver** (`dig @1.1.1.1 <host>`,
+`dig @8.8.8.8 <host>`) **and** a direct `curl -sI https://<host>`. An HTTP 4xx/5xx response means the
+host **resolves** → report it **present**, not absent. A single negative resolver result is recorded as
+*tentative*, never stated as fact and never used to instruct sibling dimensions. Likewise, an *inferred*
+backend engine (e.g. "looks like Hasura/Supabase from the CNAME") is phrased as an inference and yields to
+a runtime-observing dimension (`session`/`deployed-client-bundle`) that names the engine directly.

package/data/harnesses/re/agents/session.md

@@ -1,7 +1,7 @@
 ---
 name: session
 description: Dimension dumper for the LOGGED-IN APP SESSION dimension of the Product Recon Harness — the authenticated runtime behind login. Delegates to the copied-in browser-session playbook (three-pass, P0–P6) to instrument the live product via Chrome MCP and capture its wire protocol, auth, and state model. The deepest and most sensitive dimension; opt-in, user-gated, read-only-by-default. Dispatched during Ingestion (Mode 2) only after the user has a session ready and authorizes it.
-tools: Read, Write, Bash, Glob, Grep
+tools: Read, Write, Bash, Glob, Grep, mcp__claude-in-chrome__tabs_context_mcp, mcp__claude-in-chrome__tabs_create_mcp, mcp__claude-in-chrome__navigate, mcp__claude-in-chrome__read_network_requests, mcp__claude-in-chrome__read_console_messages, mcp__claude-in-chrome__javascript_tool, mcp__claude-in-chrome__get_page_text
 model: inherit
 ---
 
@@ -27,11 +27,13 @@ It is **interactive and gated**, unlike the other six:
   the main session with the exact proposed action + estimated cost so the *user* authorizes it
   in chat. Browser instrumentation that changes state must go through that confirmation loop.
 
-Because of the interactivity and confirmations, the live Chrome instrumentation is typically
-driven by the **main session** (which holds the browser tools and the user dialogue). Your
-role: apply the playbook, do read-only capture authoring, and produce the contract files. If
-you have Chrome MCP access in your tool set, you may run read-only Pass 1 mining yourself;
-otherwise coordinate the mined data into the capture files.
+You now hold **read-only Chrome tools**, so you run **Pass 1 (read-only mining) directly** — verify
+the §9.1 preconditions with `mcp__claude-in-chrome__tabs_context_mcp` (live tabs + stable IDs prove
+the extension and CDP are connected), then mine the authenticated surface yourself with
+`read_network_requests` + an in-page `javascript_tool` interceptor. **Pass 2 (any state-changing /
+cost-incurring action) is NOT yours to trigger** — return to the **main session** with the proposed
+action + estimated cost so the *user* authorizes it in chat (the confirmation loop above). The main
+session still owns the user dialogue and any state-changing instrumentation.
 
 ## Output (the playbook's own contract — richer than the standard dump)
 

package/data/harnesses/re/agents/website.md

@@ -1,7 +1,7 @@
 ---
 name: website
 description: Dimension dumper for the MARKETING WEBSITE dimension of the Product Recon Harness — homepage, product/feature pages, pricing, customers, integrations, blog index. Extracts positioning, feature claims, pricing tiers/limits, target market, and the integration list. Dispatched during Ingestion (Mode 2).
-tools: Read, Write, Bash, WebFetch, WebSearch
+tools: Read, Write, Bash, WebFetch, WebSearch, mcp__claude-in-chrome__tabs_create_mcp, mcp__claude-in-chrome__navigate, mcp__claude-in-chrome__get_page_text
 model: inherit
 skills:
   - fetch

package/data/harnesses/re/agents/wire-capture.md

@@ -1,7 +1,7 @@
 ---
 name: wire-capture
 description: Dimension dumper for the GATED WIRE-CAPTURE dimension of the Product Recon Harness. Climbs the 3-rung lowest-privilege-first ladder (browser tap → HAR → user-run mitmproxy) to record what a non-browser/no-source client *actually* calls, redacting every body before disk. Dispatched during Ingestion (Mode 2) — not invoked directly by users.
-tools: Read, Write, Bash
+tools: Read, Write, Bash, mcp__claude-in-chrome__tabs_context_mcp, mcp__claude-in-chrome__tabs_create_mcp, mcp__claude-in-chrome__navigate, mcp__claude-in-chrome__read_network_requests, mcp__claude-in-chrome__read_console_messages, mcp__claude-in-chrome__javascript_tool, mcp__claude-in-chrome__get_page_text
 model: inherit
 ---
 
@@ -13,10 +13,12 @@ first — especially **§7.1** (the 3-rung ladder), §6 (the shared api-path-cat
 redaction rules. You obey it absolutely. This is the **runtime complement** to
 `distribution-artifacts`: the binary says what hosts it *might* call; you record what it *does*.
 
-This dimension is **GATED**. Like `session`, the *live* capture is interactive and
-main-session-driven — the user routes their own client and you ingest exported flows. You apply
-the playbook, author the captures from what's already been collected, and **flag higher rungs for
-user authorization** rather than escalating on your own.
+This dimension is **GATED at rungs 2–3**. You now hold read-only Chrome tools, so **rung 1 — the
+public, unauth browser tap — you run directly**: open the public surface in a tab and tap it with
+`mcp__claude-in-chrome__read_network_requests` + an in-page `mcp__claude-in-chrome__javascript_tool`
+interceptor. **Rungs 2–3 stay interactive and user-run** — the user routes their own client and you
+ingest the exported HAR / flows. Author the captures, and **flag higher rungs for user
+authorization** rather than escalating on your own.
 
 ## Inputs (from the dispatch prompt)
 - target slug + the output dir `research/<target>/dimensions/wire-capture/`,

package/data/harnesses/re/harness.json

@@ -1,6 +1,6 @@
 {
   "name": "re",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "epoch": null,
-  "digest": "04de463436b5"
+  "digest": "790ded87e841"
 }

package/data/harnesses/re/rules/re-evaluation.md

@@ -11,7 +11,11 @@ coherent picture, **weighted by how each claim was obtained**, with disagreement
    `_summary.md` frontmatter.
 2. **Weight, don't average.** A claim's confidence = the **max** of its sources' confidence,
    **promoted one band only if corroborated by ≥2 *independent* dimensions**, capped at source
-   confidence when single-source. Conflicts are **flagged, never averaged**.
+   confidence when single-source. Conflicts are **flagged, never averaged**. **Tiebreaker — direct
+   observation outranks inference.** When two sources conflict on the *same* fact, a directly-observed
+   value beats an inferred one regardless of dimension or stated confidence (a session-observed backend
+   engine beats a DNS-inferred one; a live HTTP probe beats a single NXDOMAIN result). The inferred
+   side is rendered tentative and never used to override the observation or to issue cross-dimension directives.
 3. **Cross-check, don't concatenate.** Agree → state as fact. Disagree / single-source / low-conf →
    render hedged ("observed but unverified…") and flag in the doc's reconciliation section.
 
@@ -52,8 +56,10 @@ prose, not via a separate `claims.yaml`.)
 ## 3. `evaluation/data-model-api-surface.md`
 ```markdown
 # <Target> — Data Model & API / SDK Surface
-## Core entities          (domain objects + relations; ER-style)
-## Integration surface    (SDK/packages public API · REST/HTTP catalog · realtime/wire protocol)
+## Core entities          (domain objects + relations; ER-style — when the runtime exposes an RBAC verb
+                           taxonomy, derive the entity set from it: `X_CREATE/VIEW/EDIT/DELETE` ⇒ entity X)
+## Integration surface    (SDK/packages public API · REST/HTTP catalog · realtime/wire protocol — flag
+                           where the app's OWN API differs from the published/developer API; that split is common)
 ## Auth & tenancy model   (token type, where it lives, scope expression)
 ## Three-way API-path diff (the seam rule: bundle-declared vs session-observed vs wire-observed —
                             dormant/unshipped routes are findings)

package/data/harnesses/re/rules/re-ingestion.md

@@ -123,6 +123,12 @@ flags**. To keep them consumable instead of triplicated:
   in `data-model-api-surface.md`. A path that appears in `bundle` but never in `session`/`wire` is a
   dormant/unshipped route — a finding, not noise.
 
+> **Published API ≠ the app's own API.** A product's developer/REST/MCP surface (`api`/`docs`/`packages`
+> dims) is frequently *not* the API its own app runs on (`session`/`bundle` dims) — different protocol,
+> host, and operation set. Always diff the two: operations the app uses but the public API omits, **and**
+> public operations the app never calls, are both findings. The published surface is the integration
+> story; the runtime surface is the real architecture.
+
 ---
 
 ## 7. Ethics & redaction (non-negotiable — binds EVERY dimension)
@@ -137,6 +143,9 @@ Carried from the source playbook (`setup.md` §6). Violating them voids the work
 6. **No bypassing safety harnesses** — redact, never evade.
 7. **No exfiltration.** Captures stay local under `research/<target>/`.
 8. **Respect TOS & robots.** For spec-writing / integration / competitive analysis — not credential theft, rate-limit bypass, or scraping.
+9. **One browser-driving dimension at a time.** Chrome MCP is a shared singleton. Only the gated `session`/`wire-capture` dimensions drive the browser; parallel non-browser dumpers use WebFetch/curl, or — if a page genuinely needs a real browser — create their **own** tab and never touch the session tab. Never run two browser-driving dumpers concurrently.
+10. **Verify an absence before asserting it.** A "host is NXDOMAIN / dimension is absent / endpoint 404s everywhere" claim that would *contradict another dimension* must be re-checked by a **second method** (alternate resolver, direct HTTP probe, second source) before it is written as fact. A single-resolver/single-probe negative is recorded as *tentative*, never as a cross-dimension directive. (An HTTP 4xx/5xx means the host **resolves** — present, not absent.)
+11. **Bounded live-token use (read-only, in-page only).** To fill a Pass-1 capture gap you MAY read the live token from its store and replay a **read-only** request with it — *only* if the token is used **in-page / in-process only**, is **never written to `raw/`, never returned, never logged**, and the replay changes no state. This is the single permitted touch of a live credential; rules 2–3 (shape-not-values, never-save-secrets) still bind everything written to disk.
 
 ### 7.1 wire-capture & active-interception ethics (the strictest tier)
 
@@ -201,7 +210,11 @@ project, conversation, account, order), mine it first. Hit every list/state/hist
 the existing token; capture verbatim bodies. This yields ~70% of the spec for free. Mine, by role:
 identity (`/me`, `/account`, `/workspaces`), list (the canonical taxonomy), single-resource state
 (server-injected vs client-sent fields), history/event-log (a whole trajectory in one call),
-runtime/preview state, per-resource billing, account billing, feature flags/cohort, integration
+runtime/preview state, per-resource billing, account billing, feature flags/cohort, **the account's
+`entitlements`/`permissions` arrays** (the single richest data-model artifact — `entitlements`/`features`
+enumerate every gated feature *including ones your plan hides*; `permissions` are CRUD-verbs-per-entity,
+so the verb set enumerates the domain entity set — `X_CREATE/VIEW/EDIT/DELETE` ⇒ entity `X`; mine these
+first), integration
 catalog (`/mcp/`, `/integrations/`), and schema/capabilities (`/openapi.json`, `/.well-known/*`,
 `/page-metadata`).
 
@@ -222,24 +235,59 @@ The same phases apply whether the target is an AI builder, analytics dashboard,
 
 | Phase | Focus |
 |-------|-------|
-| **P0 Surface** | routes, bundles, storage shape, the API host(s), the auth tell |
-| **P1 Auth** | token type + issuer + storage location + refresh path; tenancy model |
+| **P0 Surface** | routes, bundles, storage shape, the API host(s), the auth tell; build the **coverage checklist** from any route/op catalog a sibling declared (§9.4) |
+| **P1 Auth** | token type + issuer + storage location + refresh path; tenancy model; **disambiguate the transport by omission** (replay one authed read with each credential mechanism dropped) — and never test auth with a schema-only field |
 | **P2 Core action** | the primary write — the submit/create body and its server resolution |
-| **P3 Streaming** | the realtime transport (WS / SSE / WebChannel / Pusher / none) + event catalog |
+| **P3 Streaming** | the realtime transport (WS / SSE / WebChannel / Pusher / none) + event catalog; **fingerprint binary frames by signature, never log them as opaque** (§9.4) |
 | **P4 Runtime/state** | sandbox/preview/build/deploy state; the live result surface |
 | **P5 Iteration** | the follow-up/edit endpoint (often surprisingly named) + any auto-iteration loop |
 | **P6 Synthesis** | reconcile into the dimension's `_summary.md` + `captures/` + `curls.md` |
 
 ### 9.4 Runtime taps (Pass-1 instrumentation, run in-page)
 
+> **Install the in-page interceptor FIRST, then move section-to-section WITHOUT a full reload.**
+> CDP `read_network_requests` is unreliable for an already-loaded single-page app: it starts tracking
+> only when first called and silently misses requests already in flight or served from cache (seen on a
+> real run where only a third-party analytics beacon was captured while the app's own API calls went
+> unseen). Treat it as a *supplement*; the in-page interceptor is the primary capture. A full-page
+> `navigate` wipes the interceptor, so traverse the app using whatever it exposes — **clicking in-app
+> nav works on any stack**; or call the client router if one is reachable (`history.pushState`+`popstate`,
+> React Router / Vue Router / Angular Router, or a globally-exposed router such as `window.next.router`
+> on Next.js). The principle is framework-agnostic; the specific call is just whatever that app ships.
+
 - **WebSocket / EventSource / fetch+XHR interceptors** — wrap the constructors/methods to log
   URLs, frames, and bodies (shapes, not secrets — redact in the wrapper before anything reaches
   disk). Add a `SCRUB(value)` step inside the fetch wrapper so credentials never reach the harness.
+  **Never log a binary frame as opaque `<binary>`.** Any realtime/streaming/collab layer (token
+  streams, CRDT/OT edits, presence, telemetry, game or market state) may ship `ArrayBuffer`/`Blob`
+  frames; for each *distinct* frame capture its **byte-length + a hex dump of the first ~16 bytes** —
+  enough to fingerprint the wire format (protobuf, MessagePack, CBOR, Yjs/CRDT, gRPC-web, or a
+  text/topic-prefixed channel protocol) without recording content. **Decode the signature as ASCII
+  first** — many "binary" protocols are framed text (STOMP, Phoenix, Centrifugo, a `+topic` channel
+  prefix), so a legible prefix names the protocol in one step before a binary-codec guess. The frame
+  *signature* is the finding; the payload is not.
 - **Storage shape inspector** — enumerate localStorage / sessionStorage / cookies / IndexedDB
   **key names + lengths**, never raw values.
 - **JWT decoder** — decode the token *structure* (alg, claim names, exp) with identity claims
   (`sub`, `email`, `phone`, `user_id`, `uid`, `sid`) redacted.
-- If a Pusher/realtime SDK is loaded, bind a global listener to capture the event catalog.
+- **Auth-channel disambiguation.** Token *location* is itself a tell: not in localStorage ⇒ an httpOnly
+  cookie **or** an SDK store (IndexedDB — Firebase/Auth0/Supabase/Cognito keep tokens there, which is why
+  a "no JWT in localStorage" result is a finding, not a dead end). Determine the *required* transport by
+  **omission**: replay one harmless authed read — using a field that needs the authed context (`viewer`/
+  `me`), **never** a schema-only field (GraphQL `__typename`, a health route) that resolves
+  unauthenticated — with each candidate credential dropped (cookie-only, then header-only); whichever
+  response comes back unauthorized names the channel the app actually requires.
+- If a realtime SDK is loaded (Pusher, Ably, Socket.IO, Centrifugo, Phoenix, …), bind a global listener
+  to capture the event/channel catalog.
+- **Third-party-SDK fingerprint** (cross-checks `infra-backend-fingerprint`). Storage key names + the
+  network host list name the embedded vendor stack — auth (Firebase/Auth0), flags (LaunchDarkly/Statsig),
+  support (Intercom/Zendesk/Ada), analytics (Segment/Amplitude/Datadog), payments (Stripe). Record them;
+  they corroborate the sub-processor list *independently* (a different dimension → promotes confidence).
+- **Drive op coverage from any catalog a sibling declared.** If `deployed-client-bundle` (or `api`/`docs`)
+  recovered a declared **route / endpoint / operation catalog** — a REST path table, a GraphQL operation
+  set, an RPC/tool method list — consume it as a **coverage checklist**: walk the routes/actions that
+  trigger the un-observed entries so the declared-vs-observed diff (§6) reflects a real walk, not just the
+  landing page.
 
 ### 9.5 The capture contract (richer than a standard dimension dump)
 
@@ -254,6 +302,10 @@ Under `research/<target>/dimensions/session/`:
   redacted) + `_decoded_fields`. Digest bodies > 50 KB into a structured summary.
 - **`curls.md`** — reproducible curl per endpoint, the auth model documented, a variables block,
   and an endpoint-catalog table.
+- **`captures/screens/`** (recommended) — one annotated screenshot per primary surface (each major nav
+  section), plus a short tour recording if useful. The fastest "what does it actually do" artifact for a
+  human reader, complementing the wire teardown — and the place the visual product map lives. Redact any
+  visible PII before saving.
 - **`_summary.md`** — the standard dimension bridge file (provenance frontmatter per §2) pointing
   into the above, so Evaluation treats session like any other dimension. `method: session-playbook`,
   `confidence: low` for Pass-1-only/inferred.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@nurix/etna",
-    "version": "0.15.3",
+    "version": "0.15.5",
     "description": "Bootstrap a project with a Nurix harness — copies the harness's CLAUDE.md, skills, agents, rules, and hooks directly into the project from a bundled payload (no marketplace fetch, no network).",
     "type": "module",
     "bin": {