@nurix/etna 0.15.7 → 0.16.0

package/data/harnesses/{re → discover}/CLAUDE.md

@@ -1,13 +1,13 @@
-# Product Reverse-Engineering — Orchestrator
+# Discover Harness — Orchestrator
 
-This is the **policy** half of the `re` harness. The plugin ships the capabilities (11
-dimension-dumper agents + 4 `re-*` rules, one per mode); this file drives them. Together they reverse-engineer a
-product across every surface it exposes and dump a structured, provenance-tracked corpus into
-`research/<target>/`.
+This is the **policy** half of the `discover` harness. The plugin ships the capabilities (11
+dimension-collector agents + 4 mode rules + a `tradecraft` keyboard reference);
+this file drives them. Together they discover a product across every surface it exposes and assemble a
+structured, provenance-tracked corpus in the resolved corpus root (default `research/<target>/`).
 
 A run is four modes, in order: **Discovery → Ingestion → Evaluation → Self-correction.** The main
-session drives all four — Ingestion and Evaluation fan out parallel sub-agents, and a sub-agent
-cannot spawn further sub-agents.
+session drives all four — Ingestion and Evaluation fan out parallel sub-agents (dispatch each via the
+Agent/Task tool with `model: opus`), and a sub-agent cannot spawn further sub-agents.
 
 ---
 
@@ -24,7 +24,7 @@ decides which dimensions are reachable and which extraction method each uses:
 | **presence** | rich · thin · none | docs, website, community | — |
 
 Targets light several axes at once. The full model + grade→method mapping is in
-`.claude/rules/re-discovery.md`.
+`.claude/rules/discovery.md`.
 
 ---
 
@@ -40,7 +40,7 @@ Targets light several axes at once. The full model + grade→method mapping is i
 | `community` | | |
 
 Agent name = dimension name. ⚠ = gated (needs user authorization before dispatch). The catalog —
-detection signals + strategy + per-dimension artifacts — is in `.claude/rules/re-discovery.md`.
+detection signals + strategy + per-dimension artifacts — is in `.claude/rules/discovery.md`.
 
 ---
 
@@ -48,55 +48,68 @@ detection signals + strategy + per-dimension artifacts — is in `.claude/rules/
 
 Cheap, read-only. Scope the target, grade its access, detect which dimensions it exposes.
 
-1. **Scope-feasibility gate** — run the `.claude/rules/re-discovery.md` Part A (scope gate) algorithm: resolve
+**0. Resolve the corpus root** — the folder this run writes into. The harness chooses it *intelligently* rather than hardcoding one: default `research/` at the repo root, but if the project already holds a discovery corpus (any folder with a prior run's `*/00-scope-verdict.md`) under another name (`recon/`, `discovery/`, `teardowns/`, `analysis/`, …) **reuse it**, and honor a folder the user names. **Confirm the chosen root in one line** before writing. Every `research/<target>/` path in this harness is the *default form* — read it as `<corpus>/<target>/`, relative to the resolved root.
+
+1. **Scope-feasibility gate** — run the `.claude/rules/discovery.md` Part A (scope gate) algorithm: resolve
    identity → ambiguity → ethics → suite-size → primitive → reachability. If the verdict isn't
    `accept`, **halt** (present the narrowing/redirect prompt, or refuse). Write
    `research/<target>/00-scope-verdict.md`.
-2. **Grade the access vector** (the four axes, with evidence) per `re-discovery` (Part B).
+2. **Grade the access vector** (the four axes, with evidence) per `discovery` (Part B).
 3. **Probe each of the 11 dimensions** (cheap signals only); mark ✅ available / ⚠️ partial /
    ❌ absent with evidence. An absent dimension is a finding.
 4. Write `research/<target>/00-recon-plan.md` — frontmatter carries `scope:` + the `access_grade`
-   vector; the body is the dimension-availability table + the per-dimension dump plan (warm entry
+   vector; the body is the dimension-availability table + the per-dimension collection plan (warm entry
    points) + the gating/ethics flags.
 
 ---
 
 ## Mode 2 — Ingestion
 
-Dispatch one dumper per available dimension; dump exhaustively before context is lost. Every dumper
+Dispatch one collector per available dimension; collect exhaustively before context is lost. Every collector
 writes `research/<target>/dimensions/<dim>/_summary.md` (with the **provenance frontmatter** —
-method · confidence · completeness · gaps) + `raw/`, obeying `.claude/rules/re-ingestion.md`.
+method · confidence · completeness · gaps) + `raw/`, obeying `.claude/rules/ingestion.md`.
 
 - **Run independents in parallel** — dispatch `docs`, `packages`, `api`, `website`, `community`,
   `deployed-client-bundle`, `infra-backend-fingerprint`, `distribution-artifacts` together
-  (`subagent_type='<dimension>'`, one message, multiple Agent calls). Seed each dumper with **warm
-  entry points (URLs / repos / hosts), not claimed facts** — any fact carried from Discovery (a price,
-  a tier name, a version) is tagged `verify:may-be-stale` so the dumper re-derives it instead of
-  anchoring on a possibly-stale value. Only one dimension may drive the browser at a time (see
-  `re-ingestion` §7 rule 9): the parallel dumpers use WebFetch/curl, leaving Chrome to `session`.
+  (`subagent_type='<dimension>'`, one message, multiple Agent calls). Seed each collector with **warm
+  entry points (URLs / repos / hosts), not claimed facts** — any fact **or inference** carried from
+  Discovery (a price, a tier name, a version — **or a derived hypothesis like "localStorage-key X ⇒
+  backend is Y"**) is tagged `verify:may-be-stale` so the collector **re-derives it instead of anchoring**
+  on a possibly-stale (or possibly-wrong) value. A Discovery *inference* is never seeded as a plan fact:
+  label it a hypothesis in `00-recon-plan.md` and tag it `verify:` in the seed, so a collector that
+  inherits it reports it hedged rather than echoing it as observed (a real run seeded an
+  `apolloAnonId ⇒ GraphQL backend` guess that two captures then repeated before the session refuted it).
+  Only one dimension may drive the browser at a time (see
+  `ingestion` §7 rule 9): the parallel collectors use WebFetch/curl, leaving Chrome to `session`.
 - **Codebase fan-out** — dispatch `codebase`; it clones + maps + returns a per-package work-list;
   then the main session fans out one reader per substantial package.
 - **Gated dimensions** — `session` and `wire-capture` (rung ≥2) need explicit user authorization
-  first (see `re-ingestion` §7). `session` follows `.claude/rules/re-ingestion.md` §9. When `session`
-  is authorized, **dispatch the non-browser dumpers in the background (`run_in_background`) and drive
+  first (see `ingestion` §7). `session` follows `.claude/rules/ingestion.md` §9. When `session`
+  is authorized, **dispatch the non-browser collectors in the background (`run_in_background`) and drive
   the gated browser session in the main session concurrently** — they don't contend (Chrome belongs to
-  the main session; the dumpers use WebFetch/curl), so the whole of Ingestion runs in parallel.
+  the main session; the collectors use WebFetch/curl), so the whole of Ingestion runs in parallel.
 - **Shared seam** — **seed the two shared files `dimensions/_shared/{api-path-catalog.md,
-  feature-flags.md}` (empty, with a header) once, before the dumper fan-out**; bundle/session/wire/
+  feature-flags.md}` (empty, with a header) once, before the collector fan-out**; bundle/session/wire/
   distribution then each *append* a `source:`-tagged section to the same physical file (never their own
   copy). One owner dimension per static asset; a second mine of the same asset is one source, not
-  corroboration (`re-ingestion` §6).
+  corroboration (`ingestion` §6).
 
 Validate each return (`_summary.md` + provenance present). A `blocked`/`partial` return is recorded,
 not blindly re-run.
 
+- **Capability gap = a checkpoint, not a silent fallback** (`ingestion` §8). If a *preferred* capture
+  capability is found unavailable mid-run (CDP/debugging port closed, browser MCP unreachable, a gated
+  proxy can't be stood up) and only a **materially weaker** method remains, **pause and confirm** with
+  the user before continuing on the fallback — naming what's unavailable and the coverage lost. (Distinct
+  from a planned method pre-grade, which is recorded, not confirmed.)
+
 ---
 
 ## Mode 3 — Evaluation
 
-Reconcile the dumps into four cross-dimension rollups under `research/<target>/evaluation/`, plus
+Reconcile the collected dimensions into four cross-dimension rollups under `research/<target>/evaluation/`, plus
 the run `README.md`, **weighting every claim by how it was obtained**. Follow
-`.claude/rules/re-evaluation.md`: read each dimension's provenance frontmatter first; anchor +
+`.claude/rules/evaluation.md`: read each dimension's provenance frontmatter first; anchor +
 provenance-tag every claim `(api: raw/endpoint-catalog.md · openapi-verbatim · high)`; weight
 (max-of-sources, promote one band only on ≥2 *independent* dimensions, never average); present
 high→fact, low/single-source→tentative, conflict→flagged. The four rollups: `technology-architecture`,
@@ -106,7 +119,7 @@ high→fact, low/single-source→tentative, conflict→flagged. The four rollups
 
 ## Mode 4 — Self-correction (the run corrects itself; the harness improves only on approval)
 
-Mode 4 is a loop, not a one-shot. Follow `.claude/rules/re-self-correction.md` — it carries the
+Mode 4 is a loop, not a one-shot. Follow `.claude/rules/self-correction.md` — it carries the
 **defect checklist** (A), the **measurement rubric** (B), and the **iterate-or-propose loop** (C).
 Three stages, driven by the **main session** (not a sub-agent):
 
@@ -115,7 +128,7 @@ Three stages, driven by the **main session** (not a sub-agent):
    steps (mode · defect · severity · evidence anchor · within-run|harness-changing).
 2. **Measure** the run against the **rubric** → a `/100` score + vibe band. Always — every iteration,
    including the final one; the self-correcting step ALWAYS evaluates the current run.
-3. **Iterate-or-propose**, splitting each defect by one test — *does the fix require editing a `re-*`
+3. **Iterate-or-propose**, splitting each defect by one test — *does the fix require editing a
    rule or an agent?*
    - **No → within-run:** the main session **auto-iterates** (no approval), re-running the cheapest
      affected Mode 1–3 steps on THIS target and re-measuring each round. The loop is **capable of ≥5
@@ -124,7 +137,7 @@ Three stages, driven by the **main session** (not a sub-agent):
      needing a Pass-2 / credit-spend / state-change / credential action goes through the
      explicit-confirmation gate, never the auto-loop.
    - **Yes → harness-changing:** accumulate into `research/<target>/04-self-correction-proposal.md`
-     (the shape is in `re-self-correction.md`: run measurement · iteration ledger · defect list ·
+     (the shape is in `self-correction.md`: run measurement · iteration ledger · defect list ·
      within-run fixes applied · the approval-gated harness-change table).
 
 **Approval gate (unchanged):** present the harness-change table + the iteration ledger and STOP —
@@ -139,7 +152,7 @@ promotes only patterns ≥2 *independent* targets hit — a homogeneous batch's
 ## Ethics (non-negotiable)
 
 For spec-writing, integration planning, and competitive analysis — **not** credential theft,
-rate-limit bypass, or scraping. Full rules: `.claude/rules/re-ingestion.md` §7.
+rate-limit bypass, or scraping. Full rules: `.claude/rules/ingestion.md` §7.
 
 - **Never enter credentials.** The user logs in; `session` and `wire-capture` rung 3 are opt-in.
 - **Redact every secret before writing `raw/`.** Cookies/tokens/JWT-signatures/API-keys never hit disk.
@@ -151,8 +164,10 @@ rate-limit bypass, or scraping. Full rules: `.claude/rules/re-ingestion.md` §7.
 
 ## Output contract
 
+Output lives under the **resolved corpus root** (default `research/`; chosen per Mode 1 step 0):
+
 ```
-research/<target>/
+<corpus>/<target>/                  ← default corpus root: research/
 ├── 00-scope-verdict.md            ← Discovery: accept/narrow/redirect/refuse
 ├── 00-recon-plan.md               ← Discovery: access_grade + scope + dimension plan
 ├── dimensions/<dim>/{_summary.md, raw/}   ← Ingestion (session & wire-capture also: captures/, curls.md)
@@ -161,5 +176,5 @@ research/<target>/
 └── 04-self-correction-proposal.md ← Self-correction: proposed harness fixes (approval-gated)
 ```
 
-Cloned repos live in `source/<target>/`. Provenance is the "self-aware" layer: each dump records
-*how* it was obtained; Evaluation weights claims by it. Detailed shapes live in the `re-*` rules.
+Cloned repos live in `source/<target>/`. Provenance is the "self-aware" layer: each collector records
+*how* it was obtained; Evaluation weights claims by it. Detailed shapes live in the rules.

package/data/harnesses/{re → discover}/agents/api.md

@@ -1,14 +1,14 @@
 ---
 name: api
-description: Dimension dumper for the PUBLIC API / wire-contract dimension of the Product Recon Harness — OpenAPI/Swagger specs, GraphQL schemas, REST reference, webhooks. Fetches the spec verbatim and builds an endpoint & schema catalog with auth, pagination, and error-envelope notes. Dispatched during Ingestion (Mode 2).
+description: Dimension collector for the PUBLIC API / wire-contract dimension of the Discover Harness — OpenAPI/Swagger specs, GraphQL schemas, REST reference, webhooks. Fetches the spec verbatim and builds an endpoint & schema catalog with auth, pagination, and error-envelope notes. Dispatched during Ingestion (Mode 2).
 tools: Bash, Read, Glob, Grep, Write, WebFetch
 model: inherit
 ---
 
 # api — the public API / wire-contract dimension
 
-You dump a target's documented machine interface into `research/<target>/dimensions/api/`.
-Read `.claude/rules/re-ingestion.md` (repo root) first and obey it.
+You collect a target's documented machine interface into `research/<target>/dimensions/api/`.
+Read `.claude/rules/ingestion.md` (repo root) first and obey it.
 
 ## Inputs (from the dispatch prompt)
 - target slug; the spec location(s): an OpenAPI/Swagger URL or in-repo path (e.g.

package/data/harnesses/{re → discover}/agents/codebase.md

@@ -1,14 +1,14 @@
 ---
 name: codebase
-description: Dimension dumper for the open-source CODEBASE dimension of the Product Recon Harness. Clones the target repo, maps its structure, and returns a per-package/module work-list (the main session fans out from there). Dispatched during Ingestion (Mode 2) — not invoked directly by users.
+description: Dimension collector for the open-source CODEBASE dimension of the Discover Harness. Clones the target repo, maps its structure, and returns a per-package/module work-list (the main session fans out from there). Dispatched during Ingestion (Mode 2) — not invoked directly by users.
 tools: Bash, Read, Glob, Grep, Write
 model: inherit
 ---
 
 # codebase — the open-source codebase dimension
 
-You dump the **source** of a target into `research/<target>/dimensions/codebase/`. Read
-`.claude/rules/re-ingestion.md` (repo root) first — it defines the `_summary.md` + `raw/` shape,
+You collect the **source** of a target into `research/<target>/dimensions/codebase/`. Read
+`.claude/rules/ingestion.md` (repo root) first — it defines the `_summary.md` + `raw/` shape,
 the size discipline, and the redaction rules. You obey it.
 
 You **cannot spawn sub-agents.** Your job is the top-level map *plus* a per-package work-list

package/data/harnesses/{re → discover}/agents/community.md

@@ -1,6 +1,6 @@
 ---
 name: community
-description: Dimension dumper for the COMMUNITY & CHANGELOG dimension of the Product Recon Harness — public changelog, GitHub issues/discussions, Discord, blog, status page. Signal-mines release cadence/direction, most-requested features, known gaps, and pain points — themes, not raw threads. Dispatched during Ingestion (Mode 2).
+description: Dimension collector for the COMMUNITY & CHANGELOG dimension of the Discover Harness — public changelog, GitHub issues/discussions, Discord, blog, status page. Signal-mines release cadence/direction, most-requested features, known gaps, and pain points — themes, not raw threads. Dispatched during Ingestion (Mode 2).
 tools: Read, Write, Bash, Glob, Grep, WebFetch, WebSearch
 model: inherit
 skills:
@@ -9,8 +9,8 @@ skills:
 
 # community — the community & changelog dimension
 
-You dump a target's living signal into `research/<target>/dimensions/community/`. Read
-`.claude/rules/re-ingestion.md` (repo root) first and obey it. Be respectful and read-only —
+You collect a target's living signal into `research/<target>/dimensions/community/`. Read
+`.claude/rules/ingestion.md` (repo root) first and obey it. Be respectful and read-only —
 themes and clusters, never bulk-scraping every thread.
 
 ## Inputs (from the dispatch prompt)

package/data/harnesses/{re → discover}/agents/deployed-client-bundle.md

@@ -1,14 +1,14 @@
 ---
 name: deployed-client-bundle
-description: Dimension dumper for the DEPLOYED-CLIENT-BUNDLE dimension of the Product Recon Harness. Fetches the unauthenticated SPA's JS bundle(s), string-mines the route table, API-path catalog, feature flags, and embedded env config, and reassembles source maps when shipped. Dispatched during Ingestion (Mode 2) — not invoked directly by users.
+description: Dimension collector for the DEPLOYED-CLIENT-BUNDLE dimension of the Discover Harness. Fetches the unauthenticated SPA's JS bundle(s), string-mines the route table, API-path catalog, feature flags, and embedded env config, and reassembles source maps when shipped. Dispatched during Ingestion (Mode 2) — not invoked directly by users.
 tools: Read, Write, Bash, Glob, Grep, WebFetch
 model: inherit
 ---
 
 # deployed-client-bundle — the unauthenticated app-shell dimension
 
-You dump the **static, unauthenticated SPA** of a target into
-`research/<target>/dimensions/deployed-client-bundle/`. Read `.claude/rules/re-ingestion.md`
+You collect the **static, unauthenticated SPA** of a target into
+`research/<target>/dimensions/deployed-client-bundle/`. Read `.claude/rules/ingestion.md`
 (repo root) first — it defines the `_summary.md` + `raw/` shape, the size discipline, the
 shared-surface seam rule (§6), and the redaction rules (§7). You obey it.
 
@@ -30,7 +30,7 @@ the endpoints it will call, and the flags it gates behind.
    **Bound this — do NOT exhaustively fetch every lazy chunk.** The route table and the GraphQL/op
    registry live in the entry + `_app` + a registry chunk; grab those plus the largest few vendor
    chunks (cap ~40 chunks / ~5 MB / 90 s), and record the rest as a `gap`. Fetching all lazy chunks
-   (often 90+, multi-MB) can run 3–4× a sibling dumper and read as hung. **Per §8, write a
+   (often 90+, multi-MB) can run 3–4× a sibling collector and read as hung. **Per §8, write a
    `status: partial` `_summary.md` from the entry/manifest chunks BEFORE the wider fetch loop**, then
    enrich and flip to `complete`.
 2. **Check for source maps FIRST.** Grep each chunk for `//# sourceMappingURL=`. If present,
@@ -45,7 +45,7 @@ the endpoints it will call, and the flags it gates behind.
    shared file** `research/<target>/dimensions/_shared/api-path-catalog.md` with a `source: bundle`
    column — do NOT create a copy under your own `raw/`; `session`/`wire`/`distribution` append to the
    *same* file so evaluation runs its adaptive diff. A path here that `session`/`wire` never hit is a
-   dormant/unshipped route (a finding). **You OWN the app-API bundle mine** (re-ingestion §6): when
+   dormant/unshipped route (a finding). **You OWN the app-API bundle mine** (ingestion §6): when
    `source:none` and no machine spec is served, other dimensions cite your catalog by path and do not
    re-mine the same bundle (a second mine is one source, never corroboration).
 5. **Feature flags (SHARED).** Find flag SDK keys and flag literals (LaunchDarkly `client-side-id`,

package/data/harnesses/{re → discover}/agents/distribution-artifacts.md

@@ -1,20 +1,20 @@
 ---
 name: distribution-artifacts
-description: Dimension dumper for the DISTRIBUTION-ARTIFACTS dimension of the Product Recon Harness. Decodes a downloadable non-web client (extension CRX, Electron .asar, mobile binary, CLI) into a capability map + shared API-path catalog — often the closest thing to source for a closed product. Dispatched during Ingestion (Mode 2) — not invoked directly by users.
+description: Dimension collector for the DISTRIBUTION-ARTIFACTS dimension of the Discover Harness. Decodes a downloadable non-web client (extension CRX, Electron .asar, mobile binary, CLI) into a capability map + shared API-path catalog — often the closest thing to source for a closed product. Dispatched during Ingestion (Mode 2) — not invoked directly by users.
 tools: Read, Write, Bash, WebFetch
 model: inherit
 ---
 
 # distribution-artifacts — the downloadable-client dimension
 
-You dump a target's **shipped binary client** into `research/<target>/dimensions/distribution-artifacts/`.
-Read `.claude/rules/re-ingestion.md` (repo root) first — it defines the `_summary.md` + `raw/` shape,
+You collect a target's **shipped binary client** into `research/<target>/dimensions/distribution-artifacts/`.
+Read `.claude/rules/ingestion.md` (repo root) first — it defines the `_summary.md` + `raw/` shape,
 the size discipline (§5), the shared-surface seam rule (§6), and the redaction + EULA rules (§7,
 §7.2). You obey it.
 
 A downloadable client is unlocked by `runtime` (a non-web client exists) and is often **the closest
 thing to source for a closed product**: the binary already declares its hosts, permissions, route
-table, and feature flags. Your job is to decode what ships, not to reverse-engineer protected logic.
+table, and feature flags. Your job is to decode what ships, not to decompile protected logic.
 
 ## Inputs (from the dispatch prompt)
 - target slug; the artifact type(s) detected by discovery (extension / electron / mobile / cli) and

package/data/harnesses/{re → discover}/agents/docs.md

@@ -1,6 +1,6 @@
 ---
 name: docs
-description: Dimension dumper for the DOCUMENTATION dimension of the Product Recon Harness — docs sites, guides, tutorials, concept docs, API-reference prose. Prefers in-repo docs and llms.txt, else crawls/clips the docs site to markdown, organized by section. Dispatched during Ingestion (Mode 2).
+description: Dimension collector for the DOCUMENTATION dimension of the Discover Harness — docs sites, guides, tutorials, concept docs, API-reference prose. Prefers in-repo docs and llms.txt, else crawls/clips the docs site to markdown, organized by section. Dispatched during Ingestion (Mode 2).
 tools: Read, Glob, Grep, Bash, Write, WebFetch, WebSearch
 model: inherit
 skills:
@@ -9,8 +9,8 @@ skills:
 
 # docs — the documentation dimension
 
-You dump a target's docs into `research/<target>/dimensions/docs/`. Read
-`.claude/rules/re-ingestion.md` (repo root) first and obey its shape + redaction rules.
+You collect a target's docs into `research/<target>/dimensions/docs/`. Read
+`.claude/rules/ingestion.md` (repo root) first and obey its shape + redaction rules.
 
 ## Inputs (from the dispatch prompt)
 - target slug; the docs entry point(s): an in-repo `docs/` path, an `llms.txt` URL, a docs

package/data/harnesses/{re → discover}/agents/infra-backend-fingerprint.md

@@ -1,6 +1,6 @@
 ---
 name: infra-backend-fingerprint
-description: Dimension dumper for the INFRA-BACKEND-FINGERPRINT dimension of the Product Recon Harness. Reconstructs the backend you can't see in the repo from DNS, cert-transparency subdomains, CDN/cloud fingerprint, security headers, and the sub-processor/trust pages that name the vendor stack. Dispatched during Ingestion (Mode 2) — not invoked directly by users.
+description: Dimension collector for the INFRA-BACKEND-FINGERPRINT dimension of the Discover Harness. Reconstructs the backend you can't see in the repo from DNS, cert-transparency subdomains, CDN/cloud fingerprint, security headers, and the sub-processor/trust pages that name the vendor stack. Dispatched during Ingestion (Mode 2) — not invoked directly by users.
 tools: Read, Write, Bash, WebFetch, WebSearch
 model: inherit
 ---
@@ -9,7 +9,7 @@ model: inherit
 
 You reconstruct the **backend a target runs on** — the part you can't see in the repo or the
 bundle — into `research/<target>/dimensions/infra-backend-fingerprint/`. Read
-`.claude/rules/re-ingestion.md` (repo root) first: it defines the `_summary.md` + `raw/` shape, the
+`.claude/rules/ingestion.md` (repo root) first: it defines the `_summary.md` + `raw/` shape, the
 provenance frontmatter evaluation weights on, the size discipline, and the ethics (§7) that bind
 every dimension. You obey it. **Read-only public recon only** — DNS lookups, cert-transparency
 queries, header probes, and public legal/trust pages. No login, no scanning, no state changes.

package/data/harnesses/{re → discover}/agents/packages.md

@@ -1,14 +1,14 @@
 ---
 name: packages
-description: Dimension dumper for the PUBLISHED PACKAGES dimension of the Product Recon Harness — npm / PyPI / crates / Maven / NuGet artifacts. Captures registry metadata, the exports map + type surface (the real public API), dependencies, and health signals per public package. Dispatched during Ingestion (Mode 2).
+description: Dimension collector for the PUBLISHED PACKAGES dimension of the Discover Harness — npm / PyPI / crates / Maven / NuGet artifacts. Captures registry metadata, the exports map + type surface (the real public API), dependencies, and health signals per public package. Dispatched during Ingestion (Mode 2).
 tools: Bash, Read, Glob, Grep, Write, WebFetch
 model: inherit
 ---
 
 # packages — the published packages dimension
 
-You dump a target's installable artifacts into `research/<target>/dimensions/packages/`. Read
-`.claude/rules/re-ingestion.md` (repo root) first and obey it.
+You collect a target's installable artifacts into `research/<target>/dimensions/packages/`. Read
+`.claude/rules/ingestion.md` (repo root) first and obey it.
 
 ## Inputs (from the dispatch prompt)
 - target slug; the package list (names + registry); the output dir

package/data/harnesses/{re → discover}/agents/session.md

@@ -1,28 +1,36 @@
 ---
 name: session
-description: Dimension dumper for the LOGGED-IN APP SESSION dimension of the Product Recon Harness — the authenticated runtime behind login. Delegates to the copied-in browser-session playbook (three-pass, P0–P6) to instrument the live product via Chrome MCP and capture its wire protocol, auth, and state model. The deepest and most sensitive dimension; opt-in, user-gated, read-only-by-default. Dispatched during Ingestion (Mode 2) only after the user has a session ready and authorizes it.
+description: Dimension collector for the LOGGED-IN APP SESSION dimension of the Discover Harness — the authenticated runtime behind login. Delegates to the copied-in browser-session playbook (three-pass, P0–P6) to instrument the live product via Chrome MCP and capture its wire protocol, auth, and state model. The deepest and most sensitive dimension; opt-in, user-gated, read-only-by-default. Dispatched during Ingestion (Mode 2) only after the user has a session ready and authorizes it.
 tools: Read, Write, Bash, Glob, Grep, mcp__claude-in-chrome__tabs_context_mcp, mcp__claude-in-chrome__tabs_create_mcp, mcp__claude-in-chrome__navigate, mcp__claude-in-chrome__read_network_requests, mcp__claude-in-chrome__read_console_messages, mcp__claude-in-chrome__javascript_tool, mcp__claude-in-chrome__get_page_text
 model: inherit
 ---
 
 # session — the logged-in app session dimension
 
-You dump the **authenticated runtime** into `research/<target>/dimensions/session/`. This is
-the deepest, most sensitive dimension. Read `.claude/rules/re-ingestion.md` (repo root):
+You collect the **authenticated runtime** into `research/<target>/dimensions/session/`. This is
+the deepest, most sensitive dimension. Read `.claude/rules/ingestion.md` (repo root):
 - **§7** — the ethics that bind you hardest here (credentials, redaction, state-change confirmation).
 - **§9** — the session playbook for this one dimension: prerequisites (§9.1), the three-pass
   strategy (§9.2), the P0→P6 phases (§9.3), runtime taps + the credential-scrub wrapper (§9.4),
   and the capture contract (§9.5).
+- **§7.0** — the **runnable redaction layer** (`SCRUB` / `redactSecrets` / `ULTRA`): install it
+  inside the tap wrapper so no secret reaches `raw/`.
+
+Also read `.claude/rules/tradecraft.md` — the **keyboard-level reference** for this
+dimension: copy-paste fetch/XHR/WebSocket/EventSource/Pusher taps (install them *first*, before
+navigating), the ~27-entry Chrome-MCP gotcha catalogue, the dead-end recovery table, the Apollo-cache
+read-side recipe, and the storage/auth/envelope/realtime fingerprint tables. Don't re-derive a tap
+you can paste.
 
 ## This dimension is special
 
 It is **interactive and gated**, unlike the other six:
-- **Preconditions** (verify first, per `re-ingestion` §9.1): the user is pre-logged-in to the
+- **Preconditions** (verify first, per `ingestion` §9.1): the user is pre-logged-in to the
   target in Chrome; the Claude Chrome extension is installed; Chrome CDP is connected. If any
   fails, return `blocked` with which precondition is missing — do not proceed.
 - **You never enter credentials.** The user signs in beforehand.
 - **Read-only by default (Pass 1).** Storage *shape* not values; redact every credential
-  inside the fetch wrapper so secrets never reach disk (`re-ingestion` §7 redaction patterns + §9.4 in-wrapper scrub).
+  inside the fetch wrapper so secrets never reach disk (`ingestion` §7 redaction patterns + §9.4 in-wrapper scrub).
 - **Pass 2 (any state-changing / cost-incurring action) is NOT yours to trigger.** Return to
   the main session with the exact proposed action + estimated cost so the *user* authorizes it
   in chat. Browser instrumentation that changes state must go through that confirmation loop.
@@ -35,22 +43,22 @@ cost-incurring action) is NOT yours to trigger** — return to the **main sessio
 action + estimated cost so the *user* authorizes it in chat (the confirmation loop above). The main
 session still owns the user dialogue and any state-changing instrumentation.
 
-## Output (the playbook's own contract — richer than the standard dump)
+## Output (the playbook's own contract — richer than the standard capture)
 
 Under `research/<target>/dimensions/session/`:
 - `captures/p0-surface.md`, `p1-auth.md`, and per-phase narratives (P2 core action, P3
-  streaming, P4 runtime/state, P5 iteration) — decoded, opinionated, per `re-ingestion` §9.5.
+  streaming, P4 runtime/state, P5 iteration) — decoded, opinionated, per `ingestion` §9.5.
 - `raw/*.json` — verbatim endpoint captures with `_meta` + `_decoded_fields`, **all secrets
-  redacted** (`re-ingestion` §9.5). Digest bodies >50KB. App API paths + flags you observe **append
+  redacted** (`ingestion` §9.5). Digest bodies >50KB. App API paths + flags you observe **append
   to the shared `dimensions/_shared/{api-path-catalog.md, feature-flags.md}` with `source: session`**
-  (re-ingestion §6) — and the folded rung-1 wire tap appends there as `source: wire`.
-- `curls.md` — reproducible commands per endpoint, auth model documented (`re-ingestion` §9.5).
+  (ingestion §6) — and the folded rung-1 wire tap appends there as `source: wire`.
+- `curls.md` — reproducible commands per endpoint, auth model documented (`ingestion` §9.5).
 - **Visual / surface map** — `captures/screens/` is preferred *when screenshots are available*; when
   they are **not** (no image tool, or the app holds a persistent connection that never reaches
   page-idle), a textual `captures/surface-map.md` is the **accepted substitute** that satisfies the
   §9.5 visual-map requirement — and you record the visual-coverage gap in the `_summary.md` `gaps:`
   frontmatter (a known constraint, not a silent miss).
-- `_summary.md` — a short bridge file in the standard dump shape pointing into the above, so
+- `_summary.md` — a short bridge file in the standard capture shape pointing into the above, so
   the synthesis step can treat session like any other dimension. Its frontmatter additionally carries
   **`write_side_observed: <true|false>`** and **`pass2: <not-applicable | offered-pending |
   declined-by-user | deferred | done>`** (§9.2) so Evaluation renders the write-side gap once,

package/data/harnesses/{re → discover}/agents/website.md

@@ -1,6 +1,6 @@
 ---
 name: website
-description: Dimension dumper for the MARKETING WEBSITE dimension of the Product Recon Harness — homepage, product/feature pages, pricing, customers, integrations, blog index. Extracts positioning, feature claims, pricing tiers/limits, target market, and the integration list. Dispatched during Ingestion (Mode 2).
+description: Dimension collector for the MARKETING WEBSITE dimension of the Discover Harness — homepage, product/feature pages, pricing, customers, integrations, blog index. Extracts positioning, feature claims, pricing tiers/limits, target market, and the integration list. Dispatched during Ingestion (Mode 2).
 tools: Read, Write, Bash, WebFetch, WebSearch, mcp__claude-in-chrome__tabs_create_mcp, mcp__claude-in-chrome__navigate, mcp__claude-in-chrome__get_page_text
 model: inherit
 skills:
@@ -9,8 +9,8 @@ skills:
 
 # website — the marketing website dimension
 
-You dump a target's public-facing site into `research/<target>/dimensions/website/`. Read
-`.claude/rules/re-ingestion.md` (repo root) first and obey it. Keep marketing pages distinct
+You collect a target's public-facing site into `research/<target>/dimensions/website/`. Read
+`.claude/rules/ingestion.md` (repo root) first and obey it. Keep marketing pages distinct
 from docs (docs are the `docs` dimension).
 
 ## Inputs (from the dispatch prompt)

package/data/harnesses/{re → discover}/agents/wire-capture.md

@@ -1,17 +1,19 @@
 ---
 name: wire-capture
-description: Dimension dumper for the GATED WIRE-CAPTURE dimension of the Product Recon Harness. Climbs the 3-rung lowest-privilege-first ladder (browser tap → HAR → user-run mitmproxy) to record what a non-browser/no-source client *actually* calls, redacting every body before disk. Dispatched during Ingestion (Mode 2) — not invoked directly by users.
+description: Dimension collector for the GATED WIRE-CAPTURE dimension of the Discover Harness. Climbs the 3-rung lowest-privilege-first ladder (browser tap → HAR → user-run mitmproxy) to record what a non-browser/no-source client *actually* calls, redacting every body before disk. Dispatched during Ingestion (Mode 2) — not invoked directly by users.
 tools: Read, Write, Bash, mcp__claude-in-chrome__tabs_context_mcp, mcp__claude-in-chrome__tabs_create_mcp, mcp__claude-in-chrome__navigate, mcp__claude-in-chrome__read_network_requests, mcp__claude-in-chrome__read_console_messages, mcp__claude-in-chrome__javascript_tool, mcp__claude-in-chrome__get_page_text
 model: inherit
 ---
 
 # wire-capture — the gated runtime wire dimension
 
-You dump what a target's client **actually puts on the wire** into
-`research/<target>/dimensions/wire-capture/`. Read `.claude/rules/re-ingestion.md` (repo root)
-first — especially **§7.1** (the 3-rung ladder), §6 (the shared api-path-catalog seam), and the
-redaction rules. You obey it absolutely. This is the **runtime complement** to
-`distribution-artifacts`: the binary says what hosts it *might* call; you record what it *does*.
+You collect what a target's client **actually puts on the wire** into
+`research/<target>/dimensions/wire-capture/`. Read `.claude/rules/ingestion.md` (repo root)
+first — especially **§7.1** (the 3-rung ladder), **§7.0** (the runnable redaction layer), §6 (the
+shared api-path-catalog seam), and the redaction rules. You obey it absolutely. This is the
+**runtime complement** to `distribution-artifacts`: the binary says what hosts it *might* call; you
+record what it *does*. For the rung-1 browser tap, paste the interceptors + scrubbers from
+`.claude/rules/tradecraft.md` (the keyboard-level reference) rather than re-deriving them.
 
 This dimension is **GATED at rungs 2–3**. You now hold read-only Chrome tools, so **rung 1 — the
 public, unauth browser tap — you run directly**: open the public surface in a tab and tap it with
@@ -67,7 +69,7 @@ frontmatter** (`dimension: wire-capture`, `target`, `status`, `access_grade_used
 **Inferences** (mark inference vs. fact — e.g. a host implies a vendor), **Open questions**,
 **Artifacts**.
 
-Then the captures + raw artifacts (per `re-discovery` Part C (wire-capture)):
+Then the captures + raw artifacts (per `discovery` Part C (wire-capture)):
 - `captures/wire-narrative.md` — the decoded story: what the client does on the wire, in order.
 - `raw/flows.json` — verbatim-but-**redacted and digested** flows, each with the `_meta` header
   (incl. `kind`, `byte_length`, `redactions[]`, and the **chosen rung + authorization**), `body`,

package/data/harnesses/discover/harness.json

@@ -0,0 +1,7 @@
+{
+  "harness": "discover",
+  "name": "discover",
+  "version": "0.1.7",
+  "epoch": null,
+  "digest": "9617ebd1d5c1"
+}