@nurix/etna 0.18.0 → 0.18.1

package/data/harnesses/discover/agents/api.md

@@ -7,46 +7,29 @@ model: inherit
 
 # api — the public API / wire-contract dimension
 
-You collect a target's documented machine interface into `research/<target>/dimensions/api/`.
-Read `.claude/rules/ingestion.md` (repo root) first and obey it.
+You collect a target's documented machine interface into `research/<target>/dimensions/api/`. Read `.claude/rules/ingestion.md` (repo root) first and obey it.
 
 ## Inputs (from the dispatch prompt)
-- target slug; the spec location(s): an OpenAPI/Swagger URL or in-repo path (e.g.
-  `source/<target>/docs/references/*.openapi.json`), a GraphQL endpoint, or a REST-reference
-  docs section; the output dir `research/<target>/dimensions/api/`.
+
+- target slug; the spec location(s): an OpenAPI/Swagger URL or in-repo path (e.g. `source/<target>/docs/references/*.openapi.json`), a GraphQL endpoint, or a REST-reference docs section; the output dir `research/<target>/dimensions/api/`.
 
 ## Strategy
 
-1. **OpenAPI / Swagger** — fetch the spec verbatim into `raw/openapi.json` (digest if multi-MB:
-   keep `info`, `servers`, the full paths list, the component schema *names* + key schemas, drop
-   redundant examples). Build an **endpoint catalog**: every path × method, summary, auth, the
-   request/response schema names, pagination style, rate-limit headers.
-2. **GraphQL** — if introspection is on or a schema is published, capture types, queries,
-   mutations, subscriptions. Note if introspection is disabled (a finding).
+1. **OpenAPI / Swagger** — fetch the spec verbatim into `raw/openapi.json` (digest if multi-MB: keep `info`, `servers`, the full paths list, the component schema _names_ + key schemas, drop redundant examples). Build an **endpoint catalog**: every path × method, summary, auth, the request/response schema names, pagination style, rate-limit headers.
+2. **GraphQL** — if introspection is on or a schema is published, capture types, queries, mutations, subscriptions. Note if introspection is disabled (a finding).
 3. **REST-reference prose** (no machine spec) — reconstruct the catalog from the docs section.
-4. Note the **auth model** (token type + header), the **response envelope** shape, the **error
-   format**, **versioning**, and **webhooks** (event types + payload shapes) if documented.
-5. **MCP / tool-catalog fold-in** — probe for an MCP server manifest (`/.well-known/mcp`, an MCP
-   config), a function-calling tool schema, or an LLM "actions"/tools file. An MCP tool list *is*
-   an API catalog, so it lives here (not as its own dimension) → `raw/tool-catalog.md`. Increasingly
-   common in 2026; an absent one is fine, a present one is high-signal.
+4. Note the **auth model** (token type + header), the **response envelope** shape, the **error format**, **versioning**, and **webhooks** (event types + payload shapes) if documented.
+5. **MCP / tool-catalog fold-in** — probe for an MCP server manifest (`/.well-known/mcp`, an MCP config), a function-calling tool schema, or an LLM "actions"/tools file. An MCP tool list _is_ an API catalog, so it lives here (not as its own dimension) → `raw/tool-catalog.md`. Increasingly common in 2026; an absent one is fine, a present one is high-signal.
 
 ## Output
 
-- `research/<target>/dimensions/api/_summary.md` (per contract — incl. the provenance
-  frontmatter: method/confidence/completeness/gaps): Method, Findings (auth model, envelope,
-  pagination, the endpoint-family overview as a table, webhook events, any tool-catalog),
-  Inferences (API generation/style — REST/GraphQL/RPC; maturity; versioning posture), Open
-  questions, Artifacts.
+- `research/<target>/dimensions/api/_summary.md` (per contract — incl. the provenance frontmatter: method/confidence/completeness/gaps): Method, Findings (auth model, envelope, pagination, the endpoint-family overview as a table, webhook events, any tool-catalog), Inferences (API generation/style — REST/GraphQL/RPC; maturity; versioning posture), Open questions, Artifacts.
 - `raw/openapi.json` (or `raw/graphql-schema.md`) — the spec, verbatim or digested.
 - `raw/endpoint-catalog.md` — the full path × method × auth × schema table.
 - `raw/tool-catalog.md` — the MCP/tool-schema surface, if present.
 
 ## Return value
-A one-paragraph headline (the API surface in a sentence) + endpoint-family counts + the auth
-model. Flag overlap with the packages/docs dimensions (the published SDK often wraps this API)
-and especially any drift vs. the session dimension's *observed* wire surface, for synthesis.
 
-**Discipline:** the spec is the load-bearing artifact — capture it accurately, digest if huge.
-Redact any embedded keys/example tokens. A disabled-introspection or undocumented API is a
-finding, recorded as an Open question, not a guess.
+A one-paragraph headline (the API surface in a sentence) + endpoint-family counts + the auth model. Flag overlap with the packages/docs dimensions (the published SDK often wraps this API) and especially any drift vs. the session dimension's _observed_ wire surface, for synthesis.
+
+**Discipline:** the spec is the load-bearing artifact — capture it accurately, digest if huge. Redact any embedded keys/example tokens. A disabled-introspection or undocumented API is a finding, recorded as an Open question, not a guess.

package/data/harnesses/discover/agents/codebase.md

@@ -7,46 +7,31 @@ model: inherit
 
 # codebase — the open-source codebase dimension
 
-You collect the **source** of a target into `research/<target>/dimensions/codebase/`. Read
-`.claude/rules/ingestion.md` (repo root) first — it defines the `_summary.md` + `raw/` shape,
-the size discipline, and the redaction rules. You obey it.
+You collect the **source** of a target into `research/<target>/dimensions/codebase/`. Read `.claude/rules/ingestion.md` (repo root) first — it defines the `_summary.md` + `raw/` shape, the size discipline, and the redaction rules. You obey it.
 
-You **cannot spawn sub-agents.** Your job is the top-level map *plus* a per-package work-list
-that the main session uses to fan out deep per-package readers. Don't try to read every line
-of every package yourself — map breadth, flag depth.
+You **cannot spawn sub-agents.** Your job is the top-level map _plus_ a per-package work-list that the main session uses to fan out deep per-package readers. Don't try to read every line of every package yourself — map breadth, flag depth.
 
 ## Inputs (from the dispatch prompt)
+
 - target slug, the repo clone URL (or a path if already cloned in `source/<target>/`),
 - the output dir `research/<target>/dimensions/codebase/`.
 
 ## Steps
 
-1. **Clone** (if not already): `git clone --depth 1 <url> source/<target>/`. Capture the
-   HEAD commit. If huge, still shallow-clone; you'll digest, not read everything.
-2. **Orientation read:** root `README.md`, `AGENTS.md`/`CLAUDE.md`, `CONTRIBUTING`, the root
-   manifest (`package.json` / `pyproject.toml` / `Cargo.toml` / `go.mod`), and the workspace
-   manifest (`pnpm-workspace.yaml` / `turbo.json` / `lerna.json` / Cargo workspace).
-3. **Structural map:** top-level layout; every package/app/module with a one-line purpose
-   (from its own README / manifest `description`); the **internal dependency hierarchy**
-   (which package depends on which); the build system, language(s), test setup; license posture
-   (look for a `licenses/` dir or per-package `license` fields).
-4. **Identify the substantial units** — the packages/modules worth a deep read (public SDKs,
-   the core engine, anything large or load-bearing). These become the work-list.
+1. **Clone** (if not already): `git clone --depth 1 <url> source/<target>/`. Capture the HEAD commit. If huge, still shallow-clone; you'll digest, not read everything.
+2. **Orientation read:** root `README.md`, `AGENTS.md`/`CLAUDE.md`, `CONTRIBUTING`, the root manifest (`package.json` / `pyproject.toml` / `Cargo.toml` / `go.mod`), and the workspace manifest (`pnpm-workspace.yaml` / `turbo.json` / `lerna.json` / Cargo workspace).
+3. **Structural map:** top-level layout; every package/app/module with a one-line purpose (from its own README / manifest `description`); the **internal dependency hierarchy** (which package depends on which); the build system, language(s), test setup; license posture (look for a `licenses/` dir or per-package `license` fields).
+4. **Identify the substantial units** — the packages/modules worth a deep read (public SDKs, the core engine, anything large or load-bearing). These become the work-list.
 
 ## Output
 
-Write `research/<target>/dimensions/codebase/_summary.md` (per the contract): Method,
-Findings (the structural map + dep hierarchy + build system, as tables), Inferences
-(architecture, public vs private packages, runtime model), Open questions, Artifacts.
+Write `research/<target>/dimensions/codebase/_summary.md` (per the contract): Method, Findings (the structural map + dep hierarchy + build system, as tables), Inferences (architecture, public vs private packages, runtime model), Open questions, Artifacts.
 
-Write `research/<target>/dimensions/codebase/raw/structure-map.md` — the full layout + a
-table of every package: name · path · purpose · public/private · key deps. And
-`raw/dependency-graph.md` — the internal dependency hierarchy.
+Write `research/<target>/dimensions/codebase/raw/structure-map.md` — the full layout + a table of every package: name · path · purpose · public/private · key deps. And `raw/dependency-graph.md` — the internal dependency hierarchy.
 
 ## Return value (critical — this drives the fan-out)
 
-Return a **per-unit work-list** as a compact table so the main session can dispatch one reader
-per unit:
+Return a **per-unit work-list** as a compact table so the main session can dispatch one reader per unit:
 
 ```
 | unit | path | why it matters | suggested output file |
@@ -55,9 +40,6 @@ per unit:
 | ... | ... | ... | ... |
 ```
 
-Plus a one-paragraph headline of what the codebase reveals. The main session will dispatch
-readers that each write `raw/<unit>.md` (install/exports/key-files/architecture for that unit).
+Plus a one-paragraph headline of what the codebase reveals. The main session will dispatch readers that each write `raw/<unit>.md` (install/exports/key-files/architecture for that unit).
 
-**Discipline:** breadth over depth; digest large trees; never read or write secrets (scan
-`.env*`, config, fixtures for credentials and redact before quoting). An empty/over-large
-area is an Open question, not a guess.
+**Discipline:** breadth over depth; digest large trees; never read or write secrets (scan `.env*`, config, fixtures for credentials and redact before quoting). An empty/over-large area is an Open question, not a guess.

package/data/harnesses/discover/agents/community.md

@@ -9,39 +9,27 @@ skills:
 
 # community — the community & changelog dimension
 
-You collect a target's living signal into `research/<target>/dimensions/community/`. Read
-`.claude/rules/ingestion.md` (repo root) first and obey it. Be respectful and read-only —
-themes and clusters, never bulk-scraping every thread.
+You collect a target's living signal into `research/<target>/dimensions/community/`. Read `.claude/rules/ingestion.md` (repo root) first and obey it. Be respectful and read-only — themes and clusters, never bulk-scraping every thread.
 
 ## Inputs (from the dispatch prompt)
-- target slug; the community surfaces found in the plan (changelog URL, GitHub repo for
-  issues/discussions, Discord, blog/RSS); the output dir
-  `research/<target>/dimensions/community/`.
+
+- target slug; the community surfaces found in the plan (changelog URL, GitHub repo for issues/discussions, Discord, blog/RSS); the output dir `research/<target>/dimensions/community/`.
 
 ## Strategy
 
-1. **Changelog** — the single best roadmap signal. Read the recent entries (or
-   `source/<target>/CHANGELOG*.md` if cloned). Capture: release cadence, and *what they're
-   investing in* (which areas get the most churn lately). This tells you direction.
-2. **GitHub issues & discussions** — use `gh` CLI (`gh issue list`, `gh search issues`) or the
-   API. Cluster into **themes**: most-requested features, recurring bugs, common integration
-   questions, known limitations the maintainers acknowledge. Report the clusters with rough
-   counts, not hundreds of individual issues.
+1. **Changelog** — the single best roadmap signal. Read the recent entries (or `source/<target>/CHANGELOG*.md` if cloned). Capture: release cadence, and _what they're investing in_ (which areas get the most churn lately). This tells you direction.
+2. **GitHub issues & discussions** — use `gh` CLI (`gh issue list`, `gh search issues`) or the API. Cluster into **themes**: most-requested features, recurring bugs, common integration questions, known limitations the maintainers acknowledge. Report the clusters with rough counts, not hundreds of individual issues.
 3. **Blog** — the strategic narrative: launches, positioning shifts, technical deep-dives.
 4. **Status page** — reliability posture, if public.
 
 ## Output
 
-- `research/<target>/dimensions/community/_summary.md` (per contract): Method, Findings
-  (release cadence + recent direction; the top issue/request themes as a table with counts;
-  blog narrative), Inferences (where the product is heading, the rough edges, the gaps),
-  Open questions, Artifacts.
+- `research/<target>/dimensions/community/_summary.md` (per contract): Method, Findings (release cadence + recent direction; the top issue/request themes as a table with counts; blog narrative), Inferences (where the product is heading, the rough edges, the gaps), Open questions, Artifacts.
 - `raw/changelog-digest.md` — release cadence + the recent-direction summary.
 - `raw/issue-themes.md` — the clustered themes with representative examples + counts.
 
 ## Return value
-A one-paragraph headline (where the product is heading + its biggest acknowledged gap) + the
-top 3–5 themes. This feeds the competitive-positioning and product-features rollups.
 
-**Discipline:** themes over threads; cite representative examples, don't dump feeds. Respect
-rate limits and TOS. Mark anything paywalled/private as an Open question.
+A one-paragraph headline (where the product is heading + its biggest acknowledged gap) + the top 3–5 themes. This feeds the competitive-positioning and product-features rollups.
+
+**Discipline:** themes over threads; cite representative examples, don't dump feeds. Respect rate limits and TOS. Mark anything paywalled/private as an Open question.

package/data/harnesses/discover/agents/deployed-client-bundle.md

@@ -7,63 +7,29 @@ model: inherit
 
 # deployed-client-bundle — the unauthenticated app-shell dimension
 
-You collect the **static, unauthenticated SPA** of a target into
-`research/<target>/dimensions/deployed-client-bundle/`. Read `.claude/rules/ingestion.md`
-(repo root) first — it defines the `_summary.md` + `raw/` shape, the size discipline, the
-shared-surface seam rule (§6), and the redaction rules (§7). You obey it.
+You collect the **static, unauthenticated SPA** of a target into `research/<target>/dimensions/deployed-client-bundle/`. Read `.claude/rules/ingestion.md` (repo root) first — it defines the `_summary.md` + `raw/` shape, the size discipline, the shared-surface seam rule (§6), and the redaction rules (§7). You obey it.
 
-This dimension is the **app shell with no login** — distinct from `website` (marketing pages)
-and `session` (authenticated runtime). It works on closed SaaS with no repo and no session:
-what the product *ships to the browser before anyone signs in* already leaks the route table,
-the endpoints it will call, and the flags it gates behind.
+This dimension is the **app shell with no login** — distinct from `website` (marketing pages) and `session` (authenticated runtime). It works on closed SaaS with no repo and no session: what the product _ships to the browser before anyone signs in_ already leaks the route table, the endpoints it will call, and the flags it gates behind.
 
 ## Inputs (from the dispatch prompt)
+
 - target slug, the app origin (`app.<target>.*` or the SPA route that serves the JS graph),
 - the output dir `research/<target>/dimensions/deployed-client-bundle/`.
 
 ## Strategy
 
-1. **Locate the bundle graph.** Fetch the app shell HTML (`curl -sL https://app.<target>/`);
-   pull every `<script src>` and `<link rel=modulepreload>`. Vite/Next ship hashed
-   `/assets/*.js` and `/_next/static/chunks/*.js`. Grab the entry chunk + the largest vendor
-   chunk; `curl -s <chunk-url> -o raw/.work/<name>.js`. Note `Content-Length` per chunk.
-   **Bound this — do NOT exhaustively fetch every lazy chunk.** The route table and the GraphQL/op
-   registry live in the entry + `_app` + a registry chunk; grab those plus the largest few vendor
-   chunks (cap ~40 chunks / ~5 MB / 90 s), and record the rest as a `gap`. Fetching all lazy chunks
-   (often 90+, multi-MB) can run 3–4× a sibling collector and read as hung. **Per §8, write a
-   `status: partial` `_summary.md` from the entry/manifest chunks BEFORE the wider fetch loop**, then
-   enrich and flip to `complete`.
-2. **Check for source maps FIRST.** Grep each chunk for `//# sourceMappingURL=`. If present,
-   fetch the `.map` and reassemble original sources (`npx source-map-explorer` or unpack
-   `sourcesContent` from the JSON map). A live map flips you to `method: source-map-reassembly,
-   confidence: high` — original module paths, not minified strings. Note this in `_summary.md`.
-3. **Route table.** String-mine the router config: react-router `path:` literals, Next route
-   manifests (`__BUILD_MANIFEST`, `/_next/static/.../_buildManifest.js`), lazy-import chunk maps.
-   `grep -oE '"/[a-z][a-z0-9/:_-]*"'` over the de-minified source, then de-dup → `raw/route-table.md`.
-4. **API-path catalog (SHARED seam — §6).** Mine fetch/axios base URLs and path literals
-   (`/api/`, `/graphql`, `${API_BASE}` template fragments). **Append** rows to the **one physical
-   shared file** `research/<target>/dimensions/_shared/api-path-catalog.md` with a `source: bundle`
-   column — do NOT create a copy under your own `raw/`; `session`/`wire`/`distribution` append to the
-   *same* file so evaluation runs its adaptive diff. A path here that `session`/`wire` never hit is a
-   dormant/unshipped route (a finding). **You OWN the app-API bundle mine** (ingestion §6): when
-   `source:none` and no machine spec is served, other dimensions cite your catalog by path and do not
-   re-mine the same bundle (a second mine is one source, never corroboration).
-5. **Feature flags (SHARED).** Find flag SDK keys and flag literals (LaunchDarkly `client-side-id`,
-   Statsig/Flagsmith/PostHog keys, `flags[` / `isEnabled('...')` / `experiment` string literals).
-   **Append** to the shared `research/<target>/dimensions/_shared/feature-flags.md` with `source: bundle`.
-6. **Embedded env config.** Grep `VITE_`, `NEXT_PUBLIC_`, `REACT_APP_`, `import.meta.env`,
-   `window.__ENV__`. **Field-names only — REDACT every value** to `<REDACTED:env-value>` per §7
-   (publishable keys, analytics IDs, base URLs are field-name-worthy; treat any value as a secret
-   until proven public). Log redactions in the artifact's metadata → `raw/env-config.md`.
-7. **Digest, don't dump (§5).** A 3 MB minified chunk is summarized: detected framework + version,
-   build tool tells, vendor libs (from import strings), chunk count + sizes, one redacted
-   representative snippet. The bundle map (libs, sizes, source-map status) → `raw/bundle-map.md`.
+1. **Locate the bundle graph.** Fetch the app shell HTML (`curl -sL https://app.<target>/`); pull every `<script src>` and `<link rel=modulepreload>`. Vite/Next ship hashed `/assets/*.js` and `/_next/static/chunks/*.js`. Grab the entry chunk + the largest vendor chunk; `curl -s <chunk-url> -o raw/.work/<name>.js`. Note `Content-Length` per chunk. **Bound this — do NOT exhaustively fetch every lazy chunk.** The route table and the GraphQL/op registry live in the entry + `_app` + a registry chunk; grab those plus the largest few vendor chunks (cap ~40 chunks / ~5 MB / 90 s), and record the rest as a `gap`. Fetching all lazy chunks (often 90+, multi-MB) can run 3–4× a sibling collector and read as hung. **Per §8, write a `status: partial` `_summary.md` from the entry/manifest chunks BEFORE the wider fetch loop**, then enrich and flip to `complete`.
+2. **Check for source maps FIRST.** Grep each chunk for `//# sourceMappingURL=`. If present, fetch the `.map` and reassemble original sources (`npx source-map-explorer` or unpack `sourcesContent` from the JSON map). A live map flips you to `method: source-map-reassembly, confidence: high` — original module paths, not minified strings. Note this in `_summary.md`.
+3. **Route table.** String-mine the router config: react-router `path:` literals, Next route manifests (`__BUILD_MANIFEST`, `/_next/static/.../_buildManifest.js`), lazy-import chunk maps. `grep -oE '"/[a-z][a-z0-9/:_-]*"'` over the de-minified source, then de-dup → `raw/route-table.md`.
+4. **API-path catalog (SHARED seam — §6).** Mine fetch/axios base URLs and path literals (`/api/`, `/graphql`, `${API_BASE}` template fragments). **Append** rows to the **one physical shared file** `research/<target>/dimensions/_shared/api-path-catalog.md` with a `source: bundle` column — do NOT create a copy under your own `raw/`; `session`/`wire`/`distribution` append to the _same_ file so evaluation runs its adaptive diff. A path here that `session`/`wire` never hit is a dormant/unshipped route (a finding). **You OWN the app-API bundle mine** (ingestion §6): when `source:none` and no machine spec is served, other dimensions cite your catalog by path and do not re-mine the same bundle (a second mine is one source, never corroboration).
+5. **Feature flags (SHARED).** Find flag SDK keys and flag literals (LaunchDarkly `client-side-id`, Statsig/Flagsmith/PostHog keys, `flags[` / `isEnabled('...')` / `experiment` string literals). **Append** to the shared `research/<target>/dimensions/_shared/feature-flags.md` with `source: bundle`.
+6. **Embedded env config.** Grep `VITE_`, `NEXT_PUBLIC_`, `REACT_APP_`, `import.meta.env`, `window.__ENV__`. **Field-names only — REDACT every value** to `<REDACTED:env-value>` per §7 (publishable keys, analytics IDs, base URLs are field-name-worthy; treat any value as a secret until proven public). Log redactions in the artifact's metadata → `raw/env-config.md`.
+7. **Digest, don't dump (§5).** A 3 MB minified chunk is summarized: detected framework + version, build tool tells, vendor libs (from import strings), chunk count + sizes, one redacted representative snippet. The bundle map (libs, sizes, source-map status) → `raw/bundle-map.md`.
 8. Clean up `raw/.work/` raw `.js` blobs after mining — they are not artifacts, just scratch.
 
 ## Output
 
-Write `research/<target>/dimensions/deployed-client-bundle/_summary.md` per the contract, with the
-provenance frontmatter:
+Write `research/<target>/dimensions/deployed-client-bundle/_summary.md` per the contract, with the provenance frontmatter:
 
 ```yaml
 ---
@@ -71,36 +37,19 @@ dimension: deployed-client-bundle
 target: <slug>
 status: complete | partial | blocked
 access_grade_used: runtime:reachable
-method: bundle-string-mine        # or source-map-reassembly if a live map was reassembled
+method: bundle-string-mine # or source-map-reassembly if a live map was reassembled
 completeness_pct: <0-100, honest>
-confidence: medium                # high ONLY if method == source-map-reassembly (per §3)
+confidence: medium # high ONLY if method == source-map-reassembly (per §3)
 captured_at: <YYYY-MM-DD>
 sources: [<app origin, each chunk URL actually fetched>]
 gaps: [<unmined chunks, absent source maps, obfuscated route tables, ...>]
 ---
 ```
 
-Then Method / Findings (framework, build tool, route count, endpoint count — tables) / Inferences
-(public-vs-gated routes, the backend the SPA expects, which third-party SDKs are wired) / Open
-questions / Artifacts. Dimension-private `raw/` files: `raw/{route-table.md, env-config.md,
-bundle-map.md}` — each prose artifact carrying the `<!-- source: ... · captured_at: ... · method: ... -->`
-line; the API-path catalog and feature flags are **appended to the shared
-`dimensions/_shared/{api-path-catalog.md, feature-flags.md}`**, which your `_summary.md` Artifacts list
-*links* (not duplicates).
+Then Method / Findings (framework, build tool, route count, endpoint count — tables) / Inferences (public-vs-gated routes, the backend the SPA expects, which third-party SDKs are wired) / Open questions / Artifacts. Dimension-private `raw/` files: `raw/{route-table.md, env-config.md, bundle-map.md}` — each prose artifact carrying the `<!-- source: ... · captured_at: ... · method: ... -->` line; the API-path catalog and feature flags are **appended to the shared `dimensions/_shared/{api-path-catalog.md, feature-flags.md}`**, which your `_summary.md` Artifacts list _links_ (not duplicates).
 
 ## Return value
 
-Return a one-paragraph headline of what the deployed shell reveals — framework + build tool, route
-count, the shape of the API surface it calls, whether source maps were shipped (and the confidence
-that implies). **Cross-checks:** flag that `dimensions/_shared/api-path-catalog.md` and
-`dimensions/_shared/feature-flags.md` are the SHARED seam artifacts (§6, one physical file each) —
-`session`/`wire`/`distribution` append to the same files with `source: session | wire | distribution`,
-and evaluation owns the adaptive static-vs-observed diff. Surface any
-endpoint or flag that looks authed/internal but is statically declared in the unauth bundle — that
-gap is the dimension's highest-value output.
+Return a one-paragraph headline of what the deployed shell reveals — framework + build tool, route count, the shape of the API surface it calls, whether source maps were shipped (and the confidence that implies). **Cross-checks:** flag that `dimensions/_shared/api-path-catalog.md` and `dimensions/_shared/feature-flags.md` are the SHARED seam artifacts (§6, one physical file each) — `session`/`wire`/`distribution` append to the same files with `source: session | wire | distribution`, and evaluation owns the adaptive static-vs-observed diff. Surface any endpoint or flag that looks authed/internal but is statically declared in the unauth bundle — that gap is the dimension's highest-value output.
 
-**Discipline:** breadth over depth; digest large chunks, never paste them; check for a source map
-before string-mining (it upgrades confidence); REDACT every env value before any `raw/` write and
-log it in `_meta.redactions`; obey the seam rule — one canonical shared catalog name, never a
-private fork. An absent bundle, obfuscated route table, or missing source map is an Open question,
-not a guess.
+**Discipline:** breadth over depth; digest large chunks, never paste them; check for a source map before string-mining (it upgrades confidence); REDACT every env value before any `raw/` write and log it in `_meta.redactions`; obey the seam rule — one canonical shared catalog name, never a private fork. An absent bundle, obfuscated route table, or missing source map is an Open question, not a guess.

package/data/harnesses/discover/agents/distribution-artifacts.md

@@ -7,54 +7,31 @@ model: inherit
 
 # distribution-artifacts — the downloadable-client dimension
 
-You collect a target's **shipped binary client** into `research/<target>/dimensions/distribution-artifacts/`.
-Read `.claude/rules/ingestion.md` (repo root) first — it defines the `_summary.md` + `raw/` shape,
-the size discipline (§5), the shared-surface seam rule (§6), and the redaction + EULA rules (§7,
-§7.2). You obey it.
+You collect a target's **shipped binary client** into `research/<target>/dimensions/distribution-artifacts/`. Read `.claude/rules/ingestion.md` (repo root) first — it defines the `_summary.md` + `raw/` shape, the size discipline (§5), the shared-surface seam rule (§6), and the redaction + EULA rules (§7, §7.2). You obey it.
 
-A downloadable client is unlocked by `runtime` (a non-web client exists) and is often **the closest
-thing to source for a closed product**: the binary already declares its hosts, permissions, route
-table, and feature flags. Your job is to decode what ships, not to decompile protected logic.
+A downloadable client is unlocked by `runtime` (a non-web client exists) and is often **the closest thing to source for a closed product**: the binary already declares its hosts, permissions, route table, and feature flags. Your job is to decode what ships, not to decompile protected logic.
 
 ## Inputs (from the dispatch prompt)
-- target slug; the artifact type(s) detected by discovery (extension / electron / mobile / cli) and
-  their download URLs or store listings;
+
+- target slug; the artifact type(s) detected by discovery (extension / electron / mobile / cli) and their download URLs or store listings;
 - the output dir `research/<target>/dimensions/distribution-artifacts/`.
 
 ## Strategy
 
-**Read the EULA/license FIRST (contract §7.2).** Before extracting, fetch the artifact's own
-license / EULA / terms (`WebFetch` the store listing's terms, or read a bundled `LICENSE`/`EULA`).
-Downloading a public binary and reading its manifest/strings is fine; **decompilation can violate
-the EULA**. If the license is restrictive, record it as an **Open question** and STOP at manifest/
-string-level inspection — never silently decompile.
+**Read the EULA/license FIRST (contract §7.2).** Before extracting, fetch the artifact's own license / EULA / terms (`WebFetch` the store listing's terms, or read a bundled `LICENSE`/`EULA`). Downloading a public binary and reading its manifest/strings is fine; **decompilation can violate the EULA**. If the license is restrictive, record it as an **Open question** and STOP at manifest/ string-level inspection — never silently decompile.
 
 Then dispatch by artifact type (do all that apply):
 
-- **EXTENSION (CRX/XPI).** The `manifest.json` is a capability map. Download the CRX, unzip
-  (`unzip -o <file>.crx -d raw/crx/` — CRX is a zip with a header; `unzip` tolerates it). Decode
-  `permissions`, `host_permissions`/`matches`, `content_scripts`, `background`, `externally_connectable`.
-  Each host pattern and permission is a backend tell. → `raw/extension-manifest.md`.
-- **ELECTRON (.asar).** Unpack the app: `npx --yes asar extract app.asar raw/asar/`
-  (the `.asar` lives in `Contents/Resources/` on macOS, `resources/` on Win/Linux). Map the JS
-  modules (`grep -rn "https\?://" raw/asar/` for hosts; locate the route table, API client, feature-
-  flag config). The desktop client is often **richer than the web app**. → `raw/electron-asar-map.md`.
-- **MOBILE (.ipa/.apk).** Read `Info.plist` (iOS) / `AndroidManifest.xml` (Android) for declared
-  hosts, `NSAppTransportSecurity` ATS exceptions, and permissions. Pull the **embedded-SDK list**
-  from `strings <binary> | sort -u` (analytics/crash/AI/payment SDK names are backend tells).
-  **REDACT every embedded key** before writing. → `raw/mobile-strings.md`.
-- **CLI.** Install / fetch and harvest help text: `<cli> --help`, `<cli> help`, and per-subcommand
-  `<cli> <sub> --help`. The subcommand tree **is** an API catalog. → `raw/cli-catalog.md`.
-
-For each, **also** harvest the API surface and feature flags by **appending** to the **shared seam
-artifacts** (contract §6, one physical file each): `dimensions/_shared/api-path-catalog.md` with a
-`source: distribution` column, and `dimensions/_shared/feature-flags.md` if flags ship — never a private
-copy. Digest large bundles (counts + shape + one redacted sample), never paste (§5).
+- **EXTENSION (CRX/XPI).** The `manifest.json` is a capability map. Download the CRX, unzip (`unzip -o <file>.crx -d raw/crx/` — CRX is a zip with a header; `unzip` tolerates it). Decode `permissions`, `host_permissions`/`matches`, `content_scripts`, `background`, `externally_connectable`. Each host pattern and permission is a backend tell. → `raw/extension-manifest.md`.
+- **ELECTRON (.asar).** Unpack the app: `npx --yes asar extract app.asar raw/asar/` (the `.asar` lives in `Contents/Resources/` on macOS, `resources/` on Win/Linux). Map the JS modules (`grep -rn "https\?://" raw/asar/` for hosts; locate the route table, API client, feature- flag config). The desktop client is often **richer than the web app**. → `raw/electron-asar-map.md`.
+- **MOBILE (.ipa/.apk).** Read `Info.plist` (iOS) / `AndroidManifest.xml` (Android) for declared hosts, `NSAppTransportSecurity` ATS exceptions, and permissions. Pull the **embedded-SDK list** from `strings <binary> | sort -u` (analytics/crash/AI/payment SDK names are backend tells). **REDACT every embedded key** before writing. → `raw/mobile-strings.md`.
+- **CLI.** Install / fetch and harvest help text: `<cli> --help`, `<cli> help`, and per-subcommand `<cli> <sub> --help`. The subcommand tree **is** an API catalog. → `raw/cli-catalog.md`.
+
+For each, **also** harvest the API surface and feature flags by **appending** to the **shared seam artifacts** (contract §6, one physical file each): `dimensions/_shared/api-path-catalog.md` with a `source: distribution` column, and `dimensions/_shared/feature-flags.md` if flags ship — never a private copy. Digest large bundles (counts + shape + one redacted sample), never paste (§5).
 
 ## Output
 
-Write `research/<target>/dimensions/distribution-artifacts/_summary.md` with the **provenance
-frontmatter**:
+Write `research/<target>/dimensions/distribution-artifacts/_summary.md` with the **provenance frontmatter**:
 
 ```yaml
 ---
@@ -62,37 +39,22 @@ dimension: distribution-artifacts
 target: <slug>
 status: complete | partial | blocked
 access_grade_used: runtime:reachable
-method: binary-extract            # high confidence — manifests/strings are verbatim
+method: binary-extract # high confidence — manifests/strings are verbatim
 completeness_pct: <0-100>
-confidence: high                  # binary-extract ⇒ high (contract §3)
+confidence: high # binary-extract ⇒ high (contract §3)
 captured_at: <YYYY-MM-DD>
 sources: [<store URLs / download URLs / artifact paths consulted>]
-gaps: [<artifact types not present; anything EULA-blocked from deeper inspection>]
+gaps:
+  [<artifact types not present; anything EULA-blocked from deeper inspection>]
 ---
 ```
 
-Body per the contract: **Method** (what was downloaded, EULA verdict, tools, what was skipped),
-**Findings** (the decoded capability map per artifact, as tables — hosts, permissions, SDKs,
-subcommands), **Inferences** (backend stack + reachable API surface the binary implies; mark
-inference vs. fact), **Open questions** (EULA-restricted decompilation, missing artifact types),
-**Artifacts** (index of `raw/`).
+Body per the contract: **Method** (what was downloaded, EULA verdict, tools, what was skipped), **Findings** (the decoded capability map per artifact, as tables — hosts, permissions, SDKs, subcommands), **Inferences** (backend stack + reachable API surface the binary implies; mark inference vs. fact), **Open questions** (EULA-restricted decompilation, missing artifact types), **Artifacts** (index of `raw/`).
 
-Then write the per-type raw files that apply — `raw/{extension-manifest.md, electron-asar-map.md,
-mobile-strings.md, cli-catalog.md}` (each with the `<!-- source · captured_at · method -->`
-metadata line) — plus **appends** to the shared `dimensions/_shared/api-path-catalog.md`
-(`source: distribution`) and, if flags ship, `dimensions/_shared/feature-flags.md`.
+Then write the per-type raw files that apply — `raw/{extension-manifest.md, electron-asar-map.md, mobile-strings.md, cli-catalog.md}` (each with the `<!-- source · captured_at · method -->` metadata line) — plus **appends** to the shared `dimensions/_shared/api-path-catalog.md` (`source: distribution`) and, if flags ship, `dimensions/_shared/feature-flags.md`.
 
 ## Return value
 
-Return a **one-paragraph headline** of what the shipped client reveals — its declared hosts,
-permission surface, embedded vendor SDKs, and how much richer (or not) it is than the web app.
-The API paths and feature flags you appended feed the **seam rule (§6)**: your
-`dimensions/_shared/api-path-catalog.md` rows carry `source: distribution` so evaluation can run its
-adaptive diff against `deployed-client-bundle` (`source: bundle`), `session`, and `wire-capture`. The hosts and SDK list cross-check
-**infra-backend-fingerprint** (a host the binary calls that DNS/CT didn't surface is a finding);
-the runtime hosts also seed **wire-capture** targets (the binary says what it *might* call; the
-capture says what it *does*).
-
-**Discipline:** EULA before extraction — restrictive license ⇒ Open question, never silent
-decompile. Manifests/strings only; no protected-logic reversing. Redact every embedded key before
-any `raw/` write (§7 rule 3). Digest large bundles (§5). A missing artifact type is a recorded gap, not a guess.
+Return a **one-paragraph headline** of what the shipped client reveals — its declared hosts, permission surface, embedded vendor SDKs, and how much richer (or not) it is than the web app. The API paths and feature flags you appended feed the **seam rule (§6)**: your `dimensions/_shared/api-path-catalog.md` rows carry `source: distribution` so evaluation can run its adaptive diff against `deployed-client-bundle` (`source: bundle`), `session`, and `wire-capture`. The hosts and SDK list cross-check **infra-backend-fingerprint** (a host the binary calls that DNS/CT didn't surface is a finding); the runtime hosts also seed **wire-capture** targets (the binary says what it _might_ call; the capture says what it _does_).
+
+**Discipline:** EULA before extraction — restrictive license ⇒ Open question, never silent decompile. Manifests/strings only; no protected-logic reversing. Redact every embedded key before any `raw/` write (§7 rule 3). Digest large bundles (§5). A missing artifact type is a recorded gap, not a guess.

package/data/harnesses/discover/agents/docs.md

@@ -9,41 +9,32 @@ skills:
 
 # docs — the documentation dimension
 
-You collect a target's docs into `research/<target>/dimensions/docs/`. Read
-`.claude/rules/ingestion.md` (repo root) first and obey its shape + redaction rules.
+You collect a target's docs into `research/<target>/dimensions/docs/`. Read `.claude/rules/ingestion.md` (repo root) first and obey its shape + redaction rules.
 
 ## Inputs (from the dispatch prompt)
-- target slug; the docs entry point(s): an in-repo `docs/` path, an `llms.txt` URL, a docs
-  site root, or a sitemap; the output dir `research/<target>/dimensions/docs/`.
+
+- target slug; the docs entry point(s): an in-repo `docs/` path, an `llms.txt` URL, a docs site root, or a sitemap; the output dir `research/<target>/dimensions/docs/`.
 
 ## Strategy (cheapest complete source wins)
 
-1. **Docs in the cloned repo?** If `source/<target>/docs/` (or similar) exists, read it in
-   place — fastest, most complete, no rate limits. Many products ship docs as `.mdx`/`.md`.
+1. **Docs in the cloned repo?** If `source/<target>/docs/` (or similar) exists, read it in place — fastest, most complete, no rate limits. Many products ship docs as `.mdx`/`.md`.
 2. **`llms.txt` / `llms-full.txt`?** Use it as the curated index; fetch the pages it lists.
-3. **Otherwise crawl** the docs site: pull `/sitemap.xml`, or use the `fetch` skill's `docs`/
-   `clip` modes to convert pages to markdown. Honor robots.txt and rate limits — go gently.
+3. **Otherwise crawl** the docs site: pull `/sitemap.xml`, or use the `fetch` skill's `docs`/ `clip` modes to convert pages to markdown. Honor robots.txt and rate limits — go gently.
 
 ## What to capture
 
 - A **doc map**: every page (or page group) with a one-line summary and its section.
-- Organize by section: getting-started, concepts, guides/how-tos, API reference, integrations,
-  platform/limits/pricing, upgrading/migration, errors/troubleshooting.
-- For each section, a `raw/<section>.md` with the distilled content (not a verbatim mirror of
-  every page — capture the load-bearing API names, concepts, code patterns, and gotchas).
+- Organize by section: getting-started, concepts, guides/how-tos, API reference, integrations, platform/limits/pricing, upgrading/migration, errors/troubleshooting.
+- For each section, a `raw/<section>.md` with the distilled content (not a verbatim mirror of every page — capture the load-bearing API names, concepts, code patterns, and gotchas).
 
 ## Output
 
-- `research/<target>/dimensions/docs/_summary.md` (per contract): Method, Findings (the doc
-  map + section overview, as a table), Inferences (what the docs reveal about the product's
-  surface and intended use), Open questions (gated/paywalled docs), Artifacts.
+- `research/<target>/dimensions/docs/_summary.md` (per contract): Method, Findings (the doc map + section overview, as a table), Inferences (what the docs reveal about the product's surface and intended use), Open questions (gated/paywalled docs), Artifacts.
 - `raw/doc-map.md` — the full page index.
 - `raw/<section>.md` — one per major section.
 
 ## Return value
-A one-paragraph headline (the product's documented surface in a sentence) + the section list
-with page counts + anything that overlaps the api/packages dimensions (flag it so synthesis
-can cross-check).
 
-**Discipline:** distill, don't mirror. A 300-page docs site becomes a navigable map + the
-load-bearing content, not 300 verbatim files. Record paywalled/gated docs as Open questions.
+A one-paragraph headline (the product's documented surface in a sentence) + the section list with page counts + anything that overlaps the api/packages dimensions (flag it so synthesis can cross-check).
+
+**Discipline:** distill, don't mirror. A 300-page docs site becomes a navigable map + the load-bearing content, not 300 verbatim files. Record paywalled/gated docs as Open questions.