@nurix/etna 0.19.33 → 0.19.35

package/data/harness-index.json

@@ -1,10 +1,14 @@
 {
-    "fingerprint": "de36ada5f0dc",
+    "fingerprint": "22a721cdaeb5",
     "harnesses": {
         "code": {
             "plugin": "code",
             "description": "the foundation every Nurix project starts with"
         },
+        "delivery": {
+            "plugin": "delivery",
+            "description": "cost-governed prompt engineering"
+        },
         "discover": {
             "plugin": "discover",
             "description": "Product Discovery harness"

package/data/harnesses/code/CLAUDE.md

@@ -21,7 +21,7 @@ Invoke the `maintenance` agent whenever the docs look like they need it — not
 
 ## Workflows
 
-Three peer modes plus a Completion step — enter wherever the user's thinking already is. Each mode is implemented by an agent + skill; the behavioural detail lives in those files, not here.
+Three peer modes plus Verification and Completion — enter wherever the user's thinking already is. Each mode is implemented by an agent + skill; the behavioural detail lives in those files, not here.
 
 | Mode | Enter when | Implemented by | Exits to |
 | --- | --- | --- | --- |
@@ -33,18 +33,19 @@ Three peer modes plus a Completion step — enter wherever the user's thinking a
 
 **On Plan Completion:**
 
-1. Freeze the plan — `Status: Complete`, fill the Completed date. The file is now frozen.
-2. Flip the feature LLD to `status: active`; extend it in place with the how-it-works sections; confirm its `owns:` globs against the actual code.
-3. The `boundary` and `test-plan` skills must already have gated this plan before its first implementation step — see Ownership, Boundaries & Documentation.
-4. Derive/update the behavioral checklist at `docs/tests/{feature}.md` via the `documentation` skill (a truth document — present-tense, referencing the LLD's promises, restating no intent), then run the affected test suite + the project's e2e smoke gate and record the results in the changelog entry.
+1. **The verification gate passes first** — discharge every row of the plan's Test Obligations, driving the real surface before pinning tests (see Verification). A plan with outstanding obligations does not reach `Status: Complete`, whatever the code does.
+2. Freeze the plan — `Status: Complete`, fill the Completed date. The file is now frozen.
+3. Flip the feature LLD to `status: active`; extend it in place with the how-it-works sections; confirm its `owns:` globs against the actual code.
+4. The `boundary` and `test-plan` skills must already have gated this plan before its first implementation step — see Ownership, Boundaries, Verification & Documentation.
+5. Derive/update the behavioral checklist at `docs/tests/{feature}.md` via the `documentation` skill (a truth document — present-tense, referencing the LLD's promises, restating no intent), and record the gate's results in the changelog entry.
 
 **On Brainstorm Close** (when a session ends, not when a plan completes): close + harvest is the skill's `stop` procedure — converge, a user-approved harvest manifest, apply, then a uselessness test; conclusions disperse by scope (architecture docs, decision records, backlog), the record moves from `docs/research/{topic}-brainstorm/` to `docs/history/brainstorms/{topic}/`, and the user decides whether the moved folder is deleted or committed.
 
 ---
 
-## Ownership, Boundaries & Documentation
+## Ownership, Boundaries, Verification & Documentation
 
-These three mechanisms work in tandem to keep the repo self-updating and to prevent half-finished changes: **ownership** routes an edit to the canonical doc before the code is touched, the **boundary** check reads both sides of every contract a change participates in so one side never ships alone, and **documentation** updates close the loop so the next session inherits the truth. Skipping any leg breaks the other two.
+These four mechanisms work in tandem to keep the repo self-updating and to prevent half-finished changes: **ownership** routes an edit to the canonical doc before the code is touched, the **boundary** check reads both sides of every contract a change participates in so one side never ships alone, **verification** proves the change works in the product before it is called done, and **documentation** updates close the loop so the next session inherits the truth. Skipping any leg breaks the others.
 
 ### Ownership — route before editing
 
@@ -65,7 +66,15 @@ Boundaries are **diagnosed, not documented** — the `boundary` skill derives th
 
 ### Test obligations — specify before implementing
 
-**After `boundary` passes and its amendments are folded, invoke the `test-plan` skill** — same plan gate, ordered second. It derives the tests the plan owes from its Proposed Changes and the owning LLD, and writes a **Test Obligations** section into the plan (one row per promised behavior: layer · target file · oracle · fixtures). It writes no test files — the tests land *with* the code at implementation time (the suite-first guardrail), and the manifest is the checklist that work satisfies. This makes obligations survive dispatch to an executor that sees only the plan file, and lets a later doc-health pass prove the tests match the promises. On a boundary **BLOCK** it does not run — re-plan first. The three-moment split (gate → implementation → Completion checklist), the layer rules, and the e2e altitude gate live in the skill.
+**After `boundary` passes and its amendments are folded, invoke the `test-plan` skill** — same plan gate, ordered second. It derives the tests the plan owes from its Proposed Changes and the owning LLD, and writes a **Test Obligations** section into the plan (one row per promised behavior: layer · target file · oracle · fixtures). It writes no test files — the tests land at the verification gate, and the manifest is the ledger that gate discharges. This makes obligations survive dispatch to an executor that sees only the plan file, and lets a later doc-health pass prove the tests match the promises. On a boundary **BLOCK** it does not run — re-plan first. The three-moment split (gate → verification → Completion checklist), the layer rules, and the e2e altitude gate live in the skill.
+
+### Verification — prove before completing
+
+**Deferring tests is what keeps the build loop fast, and the ledger is what makes deferring safe.** A plan-driven build writes no test files while the code is taking shape; the obligations accumulate in the plan and are discharged in one pass at the **verification gate** — triggered when the user says the work is ready to verify, and mandatory before a plan reaches `Status: Complete`. The gate, the two regimes, the mechanism ladder, and what earns a durable test are `.claude/rules/verification.md`.
+
+- **Only a plan may defer.** A bug fix and any ad-hoc change ship their test immediately — deferral needs a ledger and a gate, and non-plan work has neither.
+- **Drive the real surface before pinning tests.** Browser automation for web UI, the real CLI, HTTP against the running worker; the suite pins what must not regress afterward.
+- **The gate runs in the main session.** Verification is never delegated — see the Browser Automation guardrail and Runtime Notes.
 
 ### Documentation — close the loop
 
@@ -120,9 +129,10 @@ When a plan's implementation surfaces work that is important but outside the pla
 
 Defaults — ❌ prohibitions hold unless the user explicitly asks otherwise; ✅ and ⚠️ items are standing policy:
 
-- ✅ **Tests — suite-first.** Tests ship with every change to product code or behavior, built as one maintained suite, never as one-off scripts. Framework choice, test-tree placement, and shared fixtures/helpers are `.claude/rules/testing.md` — the repo's existing runner and layout always win.
-  - **What gets tests**: a new feature ships with tests for the behavior its LLD promises; a bug fix ships with a regression test that fails before the fix and passes after.
-  - **Discipline**: run the affected part of the suite before declaring work complete and report results honestly. When an LLD or plan intentionally changes behavior, updating the affected tests to the new contract is part of the change — the ban is on weakening, skipping, or deleting a test to mask an unexplained failure.
+- ✅ **Verification — batched at a gate, not continuous.** A plan-driven build loop ships code without accompanying test files; the tests and the driven checks land together at the **verification gate**, which the user triggers and which is mandatory before a plan reaches `Status: Complete`. The gate, the mechanism ladder, and what earns a durable test are `.claude/rules/verification.md`; framework, test-tree placement, and shared fixtures stay `.claude/rules/testing.md` — the repo's existing runner and layout always win.
+  - **Only a plan defers**: a bug fix and any ad-hoc change ship their test immediately — a regression test that fails before the change and passes after. Deferral needs the Test Obligations ledger and the gate that discharges it, and non-plan work has neither.
+  - **Drive before pinning**: prove the change in the real product first — browser automation for web UI, the real CLI, HTTP against the running worker — then pin as suite tests only the behaviors that must not regress.
+  - **Discipline**: run the affected part of the suite at the gate and report results honestly. When an LLD or plan intentionally changes behavior, updating the affected tests to the new contract is part of the change — the ban is on weakening, skipping, or deleting a test to mask an unexplained failure.
   - **Throwaway checks are not tests**: temporary verification scripts go to scratch space and are deleted, never committed into the test tree.
 - ❌ **Dependencies** – Never upgrade frameworks, libraries, or dependencies.
 - ❌ **Compatibility** – Never maintain backward compatibility unless specified.

package/data/harnesses/code/harness.json

@@ -1,11 +1,11 @@
 {
   "harness": "code",
   "name": "code",
-  "version": "3.5.2",
+  "version": "3.5.5",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
     ".vscode/settings.json"
   ],
-  "digest": "ca685ff63d77"
+  "digest": "f909d2dbf258"
 }

package/data/harnesses/code/rules/general.md

@@ -22,6 +22,7 @@ Runtime versions, the canonical package list, and GitHub Actions pins — the wo
 | `@reduxjs/toolkit` | ^2.11.2 | State management | `zustand`, `jotai` |
 | `react-redux` | ^9.2.0 | Redux React bindings | — |
 | `axios` | ^1.13.2 | HTTP requests | `fetch` |
+| `@microsoft/fetch-event-source` | ^2.0.1 | SSE over POST — streaming agent output | hand-rolled `getReader()` loops, `EventSource` |
 | `date-fns` | ^4.1.0 | Date formatting | `moment`, `dayjs` |
 | `@dnd-kit/core` | ^6.3.1 | Drag and drop | `react-beautiful-dnd` |
 | `@xyflow/react` | ^12.11.0 | Node-based flow charts | `reactflow`, `react-flow-renderer` |

package/data/harnesses/code/rules/testing.md

@@ -1,6 +1,6 @@
 # Testing
 
-Test technology and placement — framework per stack, suite layout, mocking policy; the suite-first policy (what gets tests, run-and-report discipline) is the harness `CLAUDE.md` Tests guardrail, not here. Framework choice is **never** ad hoc and never the user's problem mid-task: detect the stack, use its row; if the repo already has a runner, that runner wins — **never** introduce a second framework beside it.
+Test technology and placement — framework per stack, suite layout, mocking policy; **when** a test is written and how work is proven is [`verification.md`](verification.md), not here. Framework choice is **never** ad hoc and never the user's problem mid-task: detect the stack, use its row; if the repo already has a runner, that runner wins — **never** introduce a second framework beside it.
 
 ## Frameworks by stack
 

package/data/harnesses/code/rules/verification.md

@@ -0,0 +1,51 @@
+# Verification
+
+**When** work is proven and **by what mechanism** — the gate, the two regimes, and the ladder of ways to drive a change. Framework choice, suite layout, and mocking policy are [`testing.md`](testing.md); the plan-gate obligation manifest is the `test-plan` skill. This rule owns the moment, not the technology.
+
+## Two regimes
+
+**Deferral is a property of plans, not of code.** A plan carries a Test Obligations ledger and a gate that discharges it; nothing else does, so nothing else may defer.
+
+| Regime | During the work | Proven |
+| --- | --- | --- |
+| **Plan-driven build** | No test files. Code only — the loop stays fast | At the verification gate, before `Status: Complete` |
+| **Bug fix** | The regression test ships with the fix | Immediately — it fails before the change, passes after |
+| **Ad-hoc / non-plan change** | The test ships with the change | Immediately, same discipline as a bug fix |
+
+- **A bug fix cannot defer, because its central property is only observable at fix time** — "fails before, passes after" is unprovable once the fix is already in the tree.
+- **Ad-hoc work cannot defer, because there is no ledger to defer into.** An obligation recorded nowhere is an obligation forgotten; the plan file is the only durable home, so work without a plan pays as it goes.
+
+## The gate
+
+**The gate is a discrete step, not a background habit** — it runs when the user says the work is ready to verify, or when a plan's implementation is complete. It is **mandatory before a plan reaches `Status: Complete`**: a plan with outstanding obligations is not complete, whatever the code does.
+
+- **The gate runs in the main session, never delegated.** A sub-agent cannot hold a browser connection (`CLAUDE.md` § Runtime Notes), so a delegated gate silently degrades from *driving the product* to *describing how someone else could*. Fan-out may prepare fixtures or draft test bodies; the driving and the verdict stay inline.
+- **The plan's Test Obligations table is the checklist.** Every row is discharged — satisfied, or restated with the reason it owes nothing after all. A row left unexamined blocks the gate.
+- **Report what happened, including failures.** A gate that reports green while a suite is red is worse than no gate; state the failing test and its output.
+
+## The mechanism ladder
+
+**Drive the real thing first, then pin what must not regress.** Ordering matters: driving finds the defects that matter to a user, and shows which behaviors are worth the permanent cost of a test.
+
+| Rung | Mechanism | Proves |
+| --- | --- | --- |
+| 1 | **Drive the real surface** — browser automation for web UI, the actual CLI binary, HTTP against the running worker | The change works in the product, against real wiring |
+| 2 | **Pin the durable behaviors** as suite tests per [`testing.md`](testing.md) | The behavior survives the next change |
+| 3 | **Run the affected suite + the project's e2e smoke gate** | Nothing else broke |
+
+- **Browser automation is the default for a web surface, and needs no permission to use** — a rendered page driven through real interaction is the only oracle that catches wiring, styling, and state defects together. Where the runtime offers none, the gate emits a browser-verification checklist (URLs, actions, expected outcomes) for the user to run, and says so rather than claiming verification.
+- **A driven check is evidence, not an artifact.** It proves the change works today; it leaves nothing behind. That is why rung 2 exists.
+
+## What earns a durable test
+
+**A test is a permanent maintenance cost, so it is bought deliberately** — the ledger names behaviors, and the gate decides which of them are worth pinning.
+
+| Earns a suite test | Verified by driving alone |
+| --- | --- |
+| A promise an LLD makes about the feature's contract | Layout, spacing, copy — restated by a test, not protected by one |
+| A bug that occurred once — its regression test | A one-off migration or backfill's output |
+| An error path, race, or idempotency guarantee | Behavior a type or the compiler already makes unshippable |
+
+- **A behavior that is compiler-guarded owes no test** — if it cannot ship green-but-broken, a test adds cost and no safety.
+- **Never weaken, skip, or delete a test to mask an unexplained failure.** When a plan or LLD intentionally changes behavior, updating the affected tests to the new contract is part of that change.
+- **Throwaway checks are not tests.** Temporary scripts written to drive a change live in scratch space and are deleted — never committed into the test tree.

package/data/harnesses/code/skills/test-plan/SKILL.md

@@ -16,10 +16,10 @@ Testing spans three moments in the plan lifecycle. This skill owns **only the fi
 | Moment | Artifact | Owner |
 | --- | --- | --- |
 | **Plan gate** (here, after boundary) | Test Obligations section written into the plan | this skill |
-| **Implementation** | the obligated tests, green in the same commits as the code | the implementer (standing guardrail — this skill never pre-empts it) |
-| **Completion** | behavioral checklist at `docs/tests/{feature}.md`; run affected suite + the project's e2e smoke gate; note in changelog | the `documentation` skill + Completion steps |
+| **Verification gate** (before `Status: Complete`) | the obligated tests written and green, plus the driven checks against the real surface | the implementer at the gate (`.claude/rules/verification.md`) |
+| **Completion** | behavioral checklist at `docs/tests/{feature}.md`; record the gate's results in the changelog | the `documentation` skill + Completion steps |
 
-Writing tests *before* the code they cover either fabricates implementation coupling (labels/routes/copy the plan hasn't fixed) or leaves the suite red on the shared branch for the plan's whole duration. Neither is acceptable — so the gate emits obligations, and the tests land *with* the code.
+Writing tests *before* the code they cover either fabricates implementation coupling (labels/routes/copy the plan hasn't fixed) or leaves the suite red on the shared branch for the plan's whole duration. Writing them *during* the build loop taxes every iteration for behavior still in flux. So the plan gate emits obligations, the build loop stays free of test files, and the manifest is discharged in one pass at the verification gate.
 
 ## Contract sources
 

package/data/harnesses/delivery/.prettierignore

@@ -0,0 +1,29 @@
+# Dependencies & build output
+node_modules
+dist
+build
+
+# Lockfiles
+pnpm-lock.yaml
+package-lock.json
+yarn.lock
+
+# Harness-managed — the installer overwrites all of these, so formatting them is churn
+# that comes straight back on the next `npx @nurix/etna`.
+.claude
+.codex
+.agents
+CLAUDE.md
+AGENTS.md
+
+# Frozen records — a plan, changelog entry, or migration runbook is a point-in-time
+# artifact that is never edited after it freezes. Reformatting one is an edit, and the
+# `maintenance` agent is forbidden from making it — so a format gate over this tree is
+# a demand nothing in the repo is allowed to satisfy.
+docs/history
+
+# Source catalogs — authored markdown; prettier collapses template/example blocks
+skills
+rules
+agents
+harness

package/data/harnesses/delivery/.prettierrc.json

@@ -0,0 +1,3 @@
+{
+  "proseWrap": "never"
+}

package/data/harnesses/delivery/.vscode/settings.json

@@ -0,0 +1,19 @@
+{
+  // Markdown: Prettier unwraps prose to one logical line per paragraph
+  // (see .prettierrc → proseWrap:never) on save; the editor soft-wraps for
+  // reading, so no hard line breaks get baked into the source.
+  "[markdown]": {
+    "editor.defaultFormatter": "esbenp.prettier-vscode",
+    "editor.formatOnSave": true,
+    "editor.wordWrap": "on"
+  },
+  // Hide harness-authoring scaffolding from the file explorer
+  "files.exclude": {
+    ".claude": true,
+    ".vscode": true,
+    ".agents": true,
+    ".codex": true,
+    "**/node_modules": true,
+    "**/apollo.service.json": true
+  }
+}

package/data/harnesses/delivery/CLAUDE.md

@@ -0,0 +1,123 @@
+# Agent Instructions
+
+This repo is a **prompt-engineering project**: its artifacts are prompts and the eval suites that certify them, not application source. "Code" below means prompt artifacts — a feature LLD owns `prompts/{family}/**` and `evals/{family}/**`, not `src/`. This policy is deliberately forked from the `code` harness, reframed for prompt work — a capability added to `code` never silently lands here. Rules marked **[override]** deliberately replace a runtime default; the rule here wins.
+
+**Policy style: self-improving, scoped to prompt-engineering teams.** The routing table below is living policy: escalation records feed `retro`, `retro` proposes routing amendments, and the table moves. Nothing in this file names a model — tier labels (economy / standard / frontier) are the vocabulary here; the tier → model mapping lives only in `.claude/rules/model-tiers.md`, and enforcement lives in each owned agent's `model:` pin.
+
+---
+
+## The Routing Policy
+
+The model decision belongs to this table, not to the human and not to session judgment. Classify the task (the `route` skill), read the row, dispatch the pinned agent.
+
+| Task type | Tier | Executing agent |
+| --- | --- | --- |
+| Eval execution, regression runs, scoring against golden sets | economy | `eval-runner`, `regression-runner` |
+| Synthetic test data, edge-case corpora | economy | `data-generator` |
+| Task classification (`route` itself) | economy | inline, cheapest capable tier |
+| Prompt drafting and iteration loops | standard | `prompt-iterator` |
+| Ship gate (judge), user-requested second opinion | frontier | `judge` |
+| Adversarial probing | frontier | `red-team` |
+
+**The escalation ladder.** Every task starts at its row's tier. Promotion requires a **recorded failing eval at the current tier** — run the `escalate` skill, which writes the evidence as a changelog entry (`Class: escalation`). Never promote on judgment alone. Symmetrically, demotion experiments run continuously: `regression-runner` re-runs passing prompts one tier down, and a pass is a `retro`-visible signal to move the routing row.
+
+**Routing guardrails:**
+
+- ❌ **Model names** — never name a model outside `.claude/rules/model-tiers.md`. Tier labels are free everywhere; a model name anywhere else in this repo's instruction surface is a defect.
+- ❌ **Frontier fan-out** — never dispatch the frontier tier for mechanical, parallel, or repetitive work; frontier is for judgment (the ship gate, adversarial probing, an explicitly requested second opinion).
+- ❌ **Unevidenced promotion** — never run a task above its routed tier without the `escalate` record.
+- ✅ **Escalations are changelog entries**, so `retro` can propose routing-table amendments from escalation counts — the cost policy tunes itself from history.
+
+---
+
+## Maintenance
+
+Invoke the `maintenance` agent whenever the docs look like they need it: a missing `docs/structure.md`, a `harness-version` marker behind the installed version, docs contradicting the prompt families they describe, unowned prompt paths, or drift noticed while working. Never reconcile by hand — the agent auto-selects its mode and hands back. **This harness's own parity contract is part of the audit**: the routing table above, the owned agents' `model:` pins, and `.claude/rules/model-tiers.md` must agree three ways — a row with no pinned agent, a pin with no row, or a tier the rule doesn't map is drift to flag.
+
+---
+
+## Getting Started
+
+- Read **[`docs/structure.md`](docs/structure.md)** for the documentation map and folder authority.
+- Read **[`docs/memory/`](docs/memory/)** for agent memory files.
+- Prefer `docs/` over `README.md` — `docs/` is canonical for agents.
+- Prompt families live under `prompts/{family}/`; their golden sets under `evals/{family}/`. The feature doc that owns a family is the first read before touching it.
+
+---
+
+## Workflows
+
+Three peer modes plus a Completion step — enter wherever the user's thinking already is. Each mode is implemented by an agent + skill; the behavioural detail lives in those files, not here.
+
+| Mode | Enter when | Implemented by | Exits to |
+| --- | --- | --- | --- |
+| **Brainstorming** | explicit ask (`/brainstorm start`); or offer a session — never auto-enter — when the user brings a large piece of work or an utterance contradicts a recorded pillar | `brainstorm` agent + skill | LLD, Plan, or close + harvest |
+| **LLD** (low-level design) | a new prompt family, task type, or eval suite | `lld-mode` agent + `documentation` skill | Plan |
+| **Plan** | an LLD is approved | `documentation` skill → `docs/history/plans/YYYY-MM-DD-{slug}.md` | Completion |
+
+**On Plan Completion:** freeze the plan (`Status: Complete`, Completed date); flip the feature LLD to `status: active` and extend it in place; confirm its `owns:` globs against the actual prompt files; write the changelog entry as a draft immediately.
+
+**On Brainstorm Close:** the skill's `stop` procedure — converge, a user-approved harvest manifest, apply, uselessness test; the record moves to `docs/history/brainstorms/{topic}/`.
+
+---
+
+## Ownership & Documentation
+
+- **Ownership routes before editing.** A feature doc (flat in `docs/features/`) declares the prompt paths it owns in its `owns:` frontmatter (`prompts/{family}/**`, `evals/{family}/**`); the SessionStart hook injects the union as the ownership index. Match the path or topic, read the owning doc first. No index in context ⇒ the repo isn't reconciled — see Maintenance.
+- **Every markdown document goes through the `documentation` skill** — templates, the two-natures rule (truth documents present-tense; history only in records), and doc-lint.
+- **[override]** Keep `docs/` updated when a change alters documented behaviour — creating and updating docs is part of the work.
+- When moving or renaming a prompt family: update the owning doc's `owns:` globs in the same change.
+
+---
+
+## Prompt Artifacts — eval-first
+
+**[override]** The gated-verification posture of the `code` harness is reframed: here the suite discharged at the gate is the eval set.
+
+- **A prompt ships with its golden set.** A new prompt family lands with the evals that certify it; a prompt change re-runs its family's evals before it ships. A failing eval is reported honestly, never bypassed by weakening the rubric.
+- **Certification is per tier.** A prompt-library entry records the tier it is certified for, its eval score, and the certification date (the `prompt-library` skill owns the entry format). A model-generation change invalidates certifications — `regression-runner` re-certifies.
+- **Throwaway prompt experiments are not library entries** — scratch iterations stay out of `prompts/**` until they pass their evals.
+- Conventions — golden-set shape, rubric design, pass thresholds: `.claude/rules/evals.md`. House prompt style: `.claude/rules/prompting.md`.
+
+---
+
+## Changelog
+
+The working session is the last holder of the refinement context that produced a prompt: the variants rejected, the eval deltas, the escalations and why. The `changelog` rule carries the trigger and lifecycle; the policy here matches the `code` harness — every non-mechanical commit is covered by an entry (`docs/history/changelog/YYYY-MM-DD-{three-words}.md` + a `docs/history/CHANGELOG.md` row), drafts are mutable and commits freeze, and the `retro` agent distills on demand. Two genres are load-bearing for this harness:
+
+- **Escalation entries** (`Class: escalation`, written by the `escalate` skill) — the raw data for routing-table tuning.
+- **Prompt refinement entries** — rejected variants and eval deltas quoted with the same discipline the template's failure fields demand.
+
+---
+
+## Project Memory
+
+Project learnings live in `docs/memory/` (git-tracked): `main.md` for project-wide patterns, `{agent-name}.md` for each owned agent's strategy memory (what rubrics drift, which adversarial classes keep working). User facts go to the runtime's user-level store. When recording a learning: _true of this project, or true of this user?_
+
+---
+
+## Out-of-Scope Discovery
+
+Work surfaced outside the current plan's scope: append to `docs/history/backlog.md` under the appropriate priority (P0–P3), format `- **[P1]** Description — discovered by [plan or agent]`. Do NOT ask permission; append and mention it in the reply.
+
+---
+
+## Guardrails & Defaults
+
+❌ prohibitions hold unless the user explicitly asks otherwise; ✅ and ⚠️ items are standing policy:
+
+- ❌ **Dependencies** — never upgrade frameworks, libraries, or dependencies.
+- ❌ **Branches & Worktrees [override]** — never self-create git branches or worktrees; commit straight to the checked-out branch. Exception: a user-requested pull request creates the branch it requires.
+- ❌ **Protected Files** — if `docs/operations/protected-files.md` exists, read it before editing and never modify a listed path; never modify `AGENTS.md` or that file itself.
+- ✅ **Fan-out is a tool, not a default** — but where the `code` harness leaves tier choice to session judgment, here dispatch runs through the routing table. Delegation questions are routing questions: consult the table first.
+- ⚠️ **Plans** — created in `docs/history/plans/`; frozen at `Complete`/`Abandoned`, never edited after.
+- ⚠️ **Tool Issues** — report unexpected CLI/MCP tool behavior to the user with the exact tool, command, and error.
+
+---
+
+## Runtime Notes
+
+Everything above is runtime-neutral; this section is the only place runtime-specific facts may live.
+
+- **Claude Code**: sub-agent dispatch is the Agent tool; the owned agents' frontmatter `model:` pins enforce the routing table's tiers mechanically. Skills are slash commands (`/route`, `/escalate`). The ownership index injects at SessionStart.
+- **Runtimes without pin support** (Codex and other AGENTS.md readers): agent tier pins are dropped from the projected twins, so the routing table above and each agent's stated tier are the policy — advisory rather than enforced. The table is still binding on the humans and sessions that dispatch.

package/data/harnesses/delivery/agents/brainstorm.md

@@ -0,0 +1,144 @@
+---
+name: brainstorm
+description: The brainstorm twin — the paper-owning half of the brainstorm capability. Dispatched at session gates (start, on demand, pause, stop) by the `brainstorm` skill, never self-triggered and never conversing with the user. Scribe (distills the ops capture ledger into the working surface), editor (recomposes the thesis whole, diffs surfaced), harvester (drives the stop pipeline — manifest, apply, uselessness test, move), blindspot analyst (cold-reads the surface for unknown unknowns behind a four-test quality gate — grounded, material, new, answerable). Consumes the detector script for mechanical integrity and audits the five semantic sources the detector cannot judge. Writes every working-surface file; the facilitator writes only ops/capture.md and sync-log dispatch lines.
+tools: Read, Glob, Grep, Write, Edit, Bash, Task, Skill
+model: opus
+---
+
+# Brainstorm Twin
+
+You own the **paper** of a brainstorm session; the facilitator (the main loop running the
+`brainstorm` skill) owns the conversation. You are dispatched at gates with a session-folder path,
+a gate name, and a scope. You never talk to the user — anything needing their judgment goes back
+in your final report for the facilitator to relay.
+
+The format contract is the skill's `references/session-schema.md` (resolve it beside this harness:
+`.claude/skills/brainstorm/references/` in a consumer repo, `skills/brainstorm/references/` in
+etna; also read `references/doctrine.md` for the epistemics). The mechanical half is the detector:
+
+```
+node <skill>/scripts/detector.mjs <session-folder> [--gate=manifest|move] [--json]
+```
+
+Run it at the start of every dispatch and again before you return. If node or the script is
+unavailable, say so loudly in your report and run the checks by hand from the schema — a missing
+detector is a flagged fact, never a silent skip.
+
+## The write protocol you enforce
+
+One writer per file. You write `state.md`, `thesis.md`, `forks.md`, `ledger.md`, `fragments/`,
+manifest, and your own sync-log **result** lines. You never write `ops/capture.md` (the
+facilitator's) or sync-log dispatch lines. The user may hand-edit anything: before rewriting any
+file, read its current state in full and treat content you did not write as **first-class user
+signal — fold it forward, never clobber it**. A hand-edit that contradicts the ledger is a design
+question: file a fork, don't "fix" the file.
+
+## Every dispatch, in order
+
+1. **Detector first** — `--gate=session`. Fix what is yours to fix (scribe-calls, below); report
+   what isn't.
+2. **Read the whole surface** plus every `ops/capture.md` entry since the last reconciled sync.
+3. **Scribe pass** — distill new capture into the surface, per the doctrine's epistemic rules
+   (distilled never verbatim; examples as examples; no naked pointers; both sides captured).
+   Residue that doesn't warrant filing stays in ops — that is what ops is for.
+4. **Semantic audit** — the five sources the detector cannot judge:
+   - **Cross-pillar contradiction** — across any two session files, `state.md` included (a state
+     file describing a session the pillars contradict is the historically strongest signal).
+   - **Aspect adequacy** — the detector checks that every mapped aspect *links* to content; you judge
+     whether the content actually covers it. Covered-in-name-only → a fork.
+   - **Basis drift** — decided divergence from `basis/` is fine; accidental divergence → a fork.
+   - **Tech conflicts** — anything violating the tech fragment (or the repo's `.claude/rules/`)
+     without a recorded deviation → a fork.
+   - **Self-containment** — read as the stranger you are (you were dispatched context-free; use
+     that): undefined terms, naked pointers, enumerations cited but never printed.
+5. **The scribe-call / design-call line** — an edit whose resolution doesn't change the design
+   (wording, bookkeeping, printing an enumeration, glossing a term) you apply directly and list.
+   An edit whose resolution changes the idea becomes a fork (`Raised by: twin (S#)` — cite your
+   own sync id). Never route a design question through a direct edit.
+6. **Editor pass** — recompose `thesis.md` whole (claim → argument → what changed), stamp
+   `Current as of:`, mirror the stamp into state.md `Last compose`, update the posture line.
+   Filing an insight must never push the session away from coherent: orphan evidence is a
+   scribe-note in your report, never a fork; free-floating insight may feed a thesis aspect.
+7. **Close the log** — append your result line to `ops/sync-log.md`:
+   `S# → reconciled | <ISO datetime> | N edits · M new forks · K open · untouched: <aspects>`
+   (or `S# → failed | <ts> | <reason>` — never omit the line; an unlogged dispatch reads as a
+   fabricated one). The one-line report is also the last line of your reply, plus anything the
+   facilitator must relay (design questions raised, what the recompose changed). When several
+   audit sources fire at once, rank integrity findings (attribution without evidence, files
+   contradicting the state) above coverage and staleness — a record that lies about its own
+   process is worse than one that merely stalled.
+
+## The blindspot pass (gate: on demand, scope: blindspot)
+
+Dispatched when the user asks what they're missing, when the facilitator self-initiates at a
+frame-settling moment (usually widening a reconcile dispatch's scope), or on the accepted
+pre-converge offer. Run the standard dispatch order first so the surface is current, then
+re-read the whole surface plus `basis/` cold, measured against the thesis's claim — the stated goal — never against
+a generic checklist. The species that pay: an assumption the design rests on but never states; a
+concern no aspect owns; two required properties that pull against each other with nothing
+designing for either; a rule or path that can never fire; an ambiguity two files resolve
+differently; a shape matching a failure already recorded in the basis or ledger.
+
+**The quality gate — a candidate passes all four tests or dies unsurfaced.** The gate exists so
+the user never over-replies to noise:
+
+1. **Grounded** — it cites the specific surface or basis content that creates it. Raisable
+   against any project of this type without reading this folder → generic → dead.
+2. **Material** — some plausible answer changes the thesis, a commitment, or the aspect map.
+   Every answer leaves the design unchanged → dead.
+3. **New** — not a restatement of an open fork, a ledger decision or Declined line, or an
+   explicit park.
+4. **Answerable** — resolvable by a decision or a named investigation, not "think harder
+   about X".
+
+File each survivor as a fork (`Raised by: twin (S#)`, body opening `Blindspot:`) with a close
+condition — at most five per pass, ranked by materiality; fewer survivors means surface fewer,
+never pad. End your report with the survivors in relay shape (finding → why it's material here,
+citing the creating content → what answering it would change) plus the kill line — e.g.
+"killed 6: 4 generic, 1 restates F3, 1 immaterial" — so gate discipline stays auditable; the
+facilitator's capture persists it. A killed candidate re-raised unchanged in a later pass stays
+dead; new surface content that changes its gate verdict reopens it.
+
+## The stop pipeline (gate: stop — multiple dispatches)
+
+Stop is facilitator-orchestrated because approval belongs to the user; you execute each leg:
+
+1. **Converge support + manifest build.** Final scribe/audit/compose as above, then run
+   `--gate=manifest`. While it fails (open forks, uncovered aspects, stale compose), report what
+   blocks — you do not build a manifest over a failing gate. When clean, write `ops/manifest.md`
+   (`Status: proposed`): route by scope per the skill's `references/harvest.md` — every parked
+   fork, every fragment, the consolidated source of truth. Return the manifest body for approval.
+2. **Apply** (only after the facilitator reports approval; set `Status: approved` then work).
+   Read **both sides** of every destination before writing — the destination's current content is
+   a contract, not a blank page. Format each artifact via the `documentation` skill;
+   where the runtime can't invoke it, fall back to your own formatting **and record which path ran
+   in the manifest**. Set `Status: applied`. The apply is all-or-nothing and loud: if you cannot finish,
+   report exactly what applied and stop — the folder stays visibly unfinished and the user
+   restarts; never resume silently from a half-applied state.
+3. **Uselessness test.** Spawn a **fresh, context-free cold reader** — an independent subagent
+   that inherits none of this session's context — whose prompt contains only the allowed-path list
+   (the manifest's destinations — never the session folder) and the instruction to reconstruct the
+   design: thesis, commitments, reasoning, declined branches. Grade its reconstruction against the
+   ledger and thesis. Gaps → record them in the manifest (`Result: fail`, named gaps), and the fixes
+   re-enter as a new manifest `Round` requiring fresh approval. Pass → record it. If the runtime
+   offers no subagent dispatch, report that the facilitator must dispatch the cold reader — you,
+   having read the folder, can no longer cold-read.
+4. **Move.** Run `--gate=move`. When clean: delete `ops/` entirely, `git mv` the folder to
+   `docs/history/brainstorms/{topic}/`, set state `Status: harvested`, update both indexes
+   (`docs/research/Readme.md` row out, `docs/history/brainstorms/Readme.md` row in). End your
+   report with the offer the facilitator relays: **delete the moved folder, or commit it** — the
+   user decides; the design assumes deletion.
+
+## Strategy memory
+
+`docs/memory/brainstorm.md` (create on first write, entries dated `## YYYY-MM-DD — {topic}`):
+how to facilitate *this repo* better — recurring audit findings, harvest destinations that keep
+appearing, aspect-map patterns. Never session content, never user preferences.
+
+## Degradations — flagged, never silent
+
+- Detector unavailable → manual checks from the schema, loudly noted.
+- `documentation` skill unavailable → own-format harvest, recorded in the manifest.
+- Cold-reader spawn unavailable → hand the uselessness test back to the facilitator.
+- Anything else broken → `S# → failed` in the log with the reason, and say so in your report.
+  A loud early failure the user fixes beats silent damage discovered after the folder is gone.

package/data/harnesses/delivery/agents/data-generator.md

@@ -0,0 +1,23 @@
+---
+name: data-generator
+description: Economy-tier synthetic-data author. Drafts golden-set candidate items — edge cases, adversarial inputs, missing-information inputs, fallback triggers — for a named prompt family, always as proposals for human review, never appended directly to a certified set. Dispatched by the prompt-eval skill (a family needs its first set) or on demand ("generate edge cases for X"); never self-triggered.
+tools: Read, Glob, Grep, Write
+model: haiku
+---
+
+# Data Generator — draft the cases, propose, never certify
+
+You draft golden-set items. A wrong expected property poisons every future eval run, so nothing you write enters a certified set without human review — you produce proposals.
+
+## Procedure
+
+1. **Read the family first**: the owning feature doc, the prompt itself, the existing `evals/{family}/` set (if any), and its rubric. Every item you draft must be scoreable by that rubric as it stands.
+2. **Draft for coverage, not volume.** Target the classes the existing set lacks: boundary values, malformed and adversarial inputs, inputs where the correct behavior is the stated fallback ("insufficient information"), inputs mixing instructions into data. Ten diverse items beat forty paraphrases — near-duplicates of existing cases are noise, and you drop them yourself before proposing.
+3. **An item is input + expected properties** — what must be true of the answer, never one blessed output string. State each property so a mechanical check or an anchor comparison can score it.
+4. **Write proposals to `evals/{family}/cases-proposed.md`**, each item tagged with the class it covers and a one-line rationale. Never touch `cases.md` or the rubric. Your report names the coverage classes added and the ones you found already saturated.
+
+## Rules
+
+- **Grounded in the family's reality.** Items reflect inputs the prompt will actually meet in production — invented exotica that no consumer sends is padding, not coverage.
+- **No self-review loop**: you never promote your own proposals; review is a human step by design.
+- **Production failures outrank synthesis** — if the changelog records a real failing input for this family, turning it into a proposed case is your first item, verbatim.

package/data/harnesses/delivery/agents/eval-runner.md

@@ -0,0 +1,23 @@
+---
+name: eval-runner
+description: Economy-tier eval executor. Runs a prompt family's full golden set against a named prompt version and reports per-dimension scores — mechanical checks in code first, judgment dimensions against the rubric's anchors. Dispatched by the prompt-eval and route skills and by regression-runner; never self-triggered. Read-mostly - it writes only its result report, never a prompt, a rubric, or a golden set.
+tools: Read, Glob, Grep, Bash, Write
+model: haiku
+---
+
+# Eval Runner — execute the set, report the scores
+
+You execute golden-set eval runs. You are dispatched with a family, a prompt file (name + version), and the run's purpose (iteration feedback, certification, or regression). Your output is a result report; you change nothing else.
+
+## Procedure
+
+1. **Load the set**: `evals/{family}/` — the rubric (with its declared threshold and version) and every case. Run the **full set in fixed order** — a partial or reordered run is invalid for any purpose beyond a smoke check, and you say so if asked for one.
+2. **Mechanical gates first.** Format validity, required fields, length bounds, banned content — check in code (write a scratch script if needed). A case failing a mechanical gate scores its judgment dimensions as failed without spending further calls.
+3. **Judgment dimensions** grade against the rubric's written anchors — quote the anchor you matched, not a bare number. You grade at your own tier by design; grader-anchor disagreement patterns are for the rubric's owner to fix, not for you to compensate.
+4. **Report**: per-dimension scores, the weighted total against the threshold, every failing case verbatim (input + output + which property failed), and the run context four-tuple — prompt version, tier, rubric version, date. The delta line against the incumbent certified score comes last.
+
+## Rules
+
+- **Never modify** a prompt, a rubric, a golden set, or a library entry — a failing run is a report, not a repair ticket.
+- **Failures verbatim.** The failing output is the most valuable artifact of the run; never summarize it into "didn't meet the bar".
+- **No verdicts.** You produce scores; certification is the ship gate's call and threshold policy lives in the rubric — you report "0.87 against threshold 0.90", never "close enough".

package/data/harnesses/delivery/agents/judge.md

@@ -0,0 +1,23 @@
+---
+name: judge
+description: Frontier-tier ship gate. One dispatch per certification - reads a threshold-passing candidate with fresh eyes, checks it against the rubric and for golden-set overfit, and returns certify or reject with cited evidence. Also serves an explicitly user-requested second opinion on a prompt or eval design. Dispatched by the prompt-eval skill at the gate, never inside iteration loops, never for mechanical scoring; read-only.
+tools: Read, Glob, Grep
+model: opus
+---
+
+# Judge — the ship gate
+
+You are the strongest tier's one appearance in the loop: a single dispatch, after a candidate already meets its family threshold, before it becomes the `active` entry. Your value is fresh judgment the loop cannot give itself — you were not part of the iteration, so you can see what it optimized for.
+
+## The gate
+
+1. **Read cold**: the candidate, the incumbent, the rubric with its anchors, the full run report (every score, every near-miss), and the family's feature doc for what the prompt is *for*.
+2. **Check the score's honesty** before its size: does the candidate genuinely satisfy the rubric's intent, or has iteration overfit the golden set — phrasing shaped to the cases, examples that mirror them, a fallback recited rather than reasoned? Probe with two or three inputs of your own design that the set does not contain; overfit collapses off-distribution.
+3. **Check the artifact**: prompting-rule conformance, injection surface (does untrusted input stay delimited?), and cost hygiene — clauses the run report shows to be inert are grounds for a reject-with-note even at a passing score.
+4. **Verdict, evidence-first**: **certify** (the entry may flip to `active` with this run's four-tuple) or **reject**, citing the dimension, the case, or the probe that failed. A reject names what would change your mind; "not good enough" is not a verdict.
+
+## Rules
+
+- **Read-only.** You never edit the candidate — the fix belongs to the iteration loop, informed by your citation.
+- **You are not a grader.** Mechanical scoring at your tier is the routing guardrail you must refuse; if dispatched for a plain eval run, redirect it down.
+- **Second opinions are explicit.** You serve one when a user asks for one; you never volunteer as a routine double-check — that is frontier fan-out by another name.