@nurix/etna 0.19.41 → 0.19.43

package/data/harnesses/discover/rules/calibration.md

@@ -0,0 +1,219 @@
+# Calibration Reference — Blind Re-runs · Disposition · The Fleet Ledger
+
+The reference for the harness's **only external signal**. Everything else in this harness is self-assessment:
+collectors grade their own `confidence` and `completeness_pct`, Evaluation weights those self-grades, and
+Mode 5 scores the result against a checklist the same system authored. That loop can converge on a corpus
+that is confidently, well-provenanced, and wrong.
+
+**Calibration is the one procedure that can tell you whether any of it is true.** It re-derives claims a
+prior run published, blind, and records what survived.
+
+> **The measured position, as of 2026-07-28.** One target has ever been re-run (`emergent`, 2026-06-25 →
+> 2026-07-28). Of 16 claims re-tested: **7 refuted, 4 corrected, 5 confirmed** — a 44% flat-falsification
+> rate — and **4 of the 7 refutations came from lanes the prior run had graded `confidence: high`.** The
+> prior run had self-scored **88/100 "strong"** and `stopped_on: converged`.
+>
+> That is **n=1**. It is the entire empirical basis of this harness. Every rule in `.claude/rules/` is
+> currently a hypothesis with n=0 on any target it did not come from. The purpose of this file is to make
+> n grow.
+
+---
+
+## Two tiers — pick the one that will actually happen
+
+A metric too expensive to run leaves `n` at 1 forever. The cheap tier is the important one.
+
+| Tier | Cadence | Cost | What it measures |
+| --- | --- | --- | --- |
+| **A — Claim spot-check** | monthly | ~1 session, no full ingestion | the refutation rate, and whether `confidence` tracks truth |
+| **B — Full blind re-run** | quarterly, or when a rule set changes materially | a complete run | everything Tier A does, plus coverage drift and whether new rules changed behaviour |
+
+**Tier A is the default. Do not skip it waiting for capacity to do Tier B** — a monthly spot-check of 15–20
+claims across one target produces the regression that matters, and produces it twelve times a year.
+
+---
+
+## Selection — rotate, never choose
+
+**The target is selected by rotation, not by judgment.** Take the least-recently-calibrated target in the
+corpus root; break ties by oldest `captured_at`. Record the selection rule alongside the result.
+
+A human (or a run) choosing which target to re-check will choose the one it feels good about. That single
+substitution destroys the metric, because the sample stops being representative of the fleet and starts
+being representative of the harness's confidence — which is the very thing under test.
+
+---
+
+## THE BLIND RULE (this is what makes it evidence)
+
+**Capture first. Read the prior corpus only after your own observation is written down.**
+
+1. Select the target. **Do not open its corpus.**
+2. Draw the claim sample (below) — a list of *questions*, not answers. Someone or something other than the
+   re-deriving agent extracts the questions, or the questions are extracted mechanically from claim
+   anchors, so the sample carries no prior conclusions.
+3. **Re-derive each claim from the live product**, from scratch, recording what you observe and the method.
+4. **Only then** open the prior corpus and diff.
+
+> **This deliberately overrides `discovery.md` Step 00 for calibration runs.** Step 00 tells a run to find a
+> prior corpus, restore it, and reconcile against it — correct for a normal re-run, where the prior corpus
+> is a genuine corroboration lane and re-deriving everything from zero is waste. **It is wrong here.** A run
+> that reads the prior claim first will anchor on it: it will look for confirmation, find it, and report a
+> confirmation rate that measures its own suggestibility. Anchoring is the specific failure this protocol
+> exists to avoid, so for a calibration run Step 00 is deferred until after step 3, and the run records
+> `blind: true`.
+>
+> If a run cannot honestly attest that it re-derived before reading, it must record `blind: false` — and
+> the result is then a **consistency check, not a calibration**, and does not enter the ledger's refutation
+> rate.
+
+**Sampling the claims.** 15–20 per target, drawn to make the regression computable, not to be flattering:
+
+- **Stratify by the prior run's stated `confidence`** — roughly equal numbers of `high`, `medium`, `low`.
+  Without this the regression cannot be computed, and the regression is the point.
+- **Include the load-bearing ones** — claims a README headline rests on, and claims a reader would act on
+  (pricing, limits, guarantees, auth model, what the product can and cannot do).
+- **Include at least 3 negative claims** ("no public SDK", "no realtime layer", "not supported"). Negatives
+  are the harness's demonstrated weak spot: **5 of the 7 refutations in the one data point were negatives.**
+- **Exclude** anything whose truth cannot change and cannot be re-checked (a historical funding round).
+
+---
+
+## Disposition — five values, and the fifth is the one the old schema lacked
+
+Every sampled claim resolves to exactly one:
+
+| Disposition | Meaning | What it says about the harness |
+| --- | --- | --- |
+| **confirmed** | independently re-derived, same conclusion | the method worked |
+| **corrected** | right direction, wrong detail (a count, a version, a name) | the method worked; the reading was imprecise |
+| **refuted** | the claim was **wrong when it was made** | **the method failed — this is the signal** |
+| **stale** | the claim was **true when made; the product changed** | the method worked; the corpus has a shelf life |
+| **unverifiable** | cannot be re-checked now (surface gone, plan changed, gated) | no signal either way; excluded from the rate |
+
+> **`refuted` and `stale` are the distinction the original artifact had no slot for, and they mean opposite
+> things.** A high `refuted` rate means *the instrument is unreliable* and the rules need work. A high
+> `stale` rate means *the instrument is fine and the corpus decays* — which calls for shorter shelf-lives
+> and `volatility` tagging, not methodology changes. Conflating them makes the harness fix the wrong
+> problem. When you cannot tell which it is — no dated evidence either way — record **`refuted`**. The
+> conservative reading is the one that keeps the harness honest about itself.
+>
+> (Origin: `emergent/00-prior-run-reconciliation.md` — a genuinely good artifact whose section A had to be
+> titled *"REFUTED (prior claim was wrong, not merely stale)"* precisely because the schema gave it nowhere
+> else to put the distinction.)
+
+**The refutation rate** = `refuted ÷ (confirmed + corrected + refuted + stale)`. `unverifiable` is excluded
+from the denominator, and its count is reported so a shrinking sample is visible.
+
+---
+
+## The regression — the actual question
+
+For each calibration, record the disposition **against the prior run's stated confidence for that claim**:
+
+| prior confidence | n | confirmed | corrected | refuted | stale | refutation rate |
+| --- | --- | --- | --- | --- | --- | --- |
+| high | | | | | | |
+| medium | | | | | | |
+| low | | | | | | |
+
+**If `high` claims are refuted at a similar rate to `low` claims, the `confidence` field carries no signal
+and `ingestion.md` §3's method→confidence table is decorative.** That is the single most consequential thing
+this harness could learn about itself, and it is unknowable without this table.
+
+Also record refutation rate **by `method`** once n is large enough — that tells you which of the 17 methods
+in §3 are over-graded, which is directly actionable (a method's band gets lowered).
+
+---
+
+## Artifacts
+
+### Per calibration — `research/<target>/00-prior-run-reconciliation.md`
+
+Formalizes the shape `emergent` invented. **This file is part of the output contract** whenever a prior
+corpus exists.
+
+```markdown
+---
+target: <slug>
+reconciled_at: <YYYY-MM-DD>
+prior_run_date: <YYYY-MM-DD>
+prior_run_commit: <sha>
+prior_run_score: <n>
+tier: A | B                     # spot-check or full blind re-run
+blind: true | false             # false ⇒ consistency check only, excluded from the rate
+selection_rule: rotation        # or: named-by-user (record it either way)
+sampled: <n>
+confirmed: <n>
+corrected: <n>
+refuted: <n>
+stale: <n>
+unverifiable: <n>
+refutation_rate: <0-100>
+by_confidence:                  # the regression — REQUIRED
+  high:   { n: <n>, refuted: <n> }
+  medium: { n: <n>, refuted: <n> }
+  low:    { n: <n>, refuted: <n> }
+---
+
+## A. REFUTED — wrong when made        (claim · what was observed · lane that refuted it · prior confidence)
+## B. STALE — true when made, changed  (claim · what changed · evidence of the change being NEW)
+## C. CORRECTED — right, imprecise
+## D. CONFIRMED — independently re-derived
+## E. UNVERIFIABLE — and why
+## F. What this says about the METHOD  (which lanes/methods produced the refutations, and whether a
+                                        §3 confidence band should be lowered)
+```
+
+### Fleet-level — `research/_calibration/ledger.md`
+
+**The metric itself.** One row per calibration, accumulating across targets and time. This is the file to
+read when asking "does this harness work?" It is never rewritten, only appended to.
+
+---
+
+## What a result CHANGES (otherwise this is just bookkeeping)
+
+A calibration that produces a number and no action is theatre. Each outcome routes:
+
+| Finding | Action |
+| --- | --- |
+| A **method** shows a high refutation rate | lower its band in `ingestion.md` §3, and record the calibration as the origin |
+| **Negative claims** refute disproportionately | tighten the absence rules (`ingestion.md` §7 rule 10, `discovery.md` Part B) — the `blind_to:` direction |
+| `high` refutes ≈ as often as `low` | **the confidence field is not carrying signal** — this is a structural finding about the harness, and it goes to the user, not into a rule tweak |
+| A **rule added after the prior run** would have prevented a refutation | evidence the improvement loop works — record it, it is the only such evidence that exists |
+| A refutation recurs **after** a rule was added to prevent it | evidence a rule did **not** change behaviour; escalate to the user rather than adding another rule |
+| High **stale** rate | shorten shelf-life expectations and tag volatile claims; **not** a methodology problem |
+
+---
+
+## How to run one (Tier A, the monthly default)
+
+1. **Select** by rotation from `research/_calibration/ledger.md`. Record the target and the rule.
+2. **Extract the sample** mechanically — pull claim anchors from the target's `evaluation/*.md`, stratify by
+   the cited confidence, and write them as **questions with the answers stripped**.
+3. **Re-derive blind.** Do not open the corpus. Use whatever lanes the access vector allows; record method
+   and observation per claim.
+4. **Diff and disposition** each claim into the five values.
+5. **Write** `00-prior-run-reconciliation.md` (append a new dated section if one already exists — never
+   overwrite a prior calibration).
+6. **Append one row** to the fleet ledger, and update its running totals.
+7. **Route** every finding through the table above. Anything that becomes a rule change goes through the
+   normal Mode-5 approval gate.
+
+**Cost/state discipline is unchanged:** a calibration is read-only unless the user authorizes otherwise; a
+claim that can only be re-derived by spending money or mutating state is recorded `unverifiable` with the
+reason, never quietly exercised.
+
+---
+
+## How the harness uses this reference
+
+Calibration is a **cross-run process**, not a mode of a single run — nothing in Modes 1–5 triggers it, and it
+must not be folded into them (a run cannot calibrate itself; that is the circularity it exists to break).
+Mode 5 reads the fleet ledger as *context* when weighing a proposal — a rule contradicted by calibration
+data should not be promoted — but Mode 5 never writes to it.
+
+> **Do not attach calibration to the Mode-5 score.** The moment `refutation_rate` becomes a rubric input,
+> the run acquires an interest in the number, and the one uncorrupted signal in the system is gone. It
+> measures the **harness**, not the run. Publish it; never grade with it.

package/data/harnesses/discover/rules/tooling.md

@@ -0,0 +1,205 @@
+# Tooling Reference — Host Capability · Tiers · The Bright Line
+
+The reference for **Step 0** (`discover` harness, run once per corpus folder before Mode 1). Capture depth
+is bounded by host tooling most machines lack. This file carries the **tier lists** (what to recommend),
+the **ethics classification** (clean · gated · avoid), the **per-dimension gap map** (what a bare host
+cannot do), and the **install caveats** that have actually bitten.
+
+**Nothing here is ever installed automatically.** The harness detects what is present, recommends only what
+is missing, and records the result in `.claude/discover-tooling.json` so it never re-prompts in the same
+folder. The harness recommends; the user decides. A user who declines proceeds to Mode 1 on whatever is
+present — a missing capability is re-surfaced at the Mode 2 capability-gap checkpoint (`ingestion.md` §8),
+never silently degraded.
+
+A host almost always arrives strong on languages and package managers (node, pnpm, python, uv, cargo, gh,
+jq, ripgrep) and **bare on capture/analysis tooling**. That gap is the difference between a shallow capture
+and a deep one.
+
+---
+
+## The three classes (this is an ethics classification, not a convenience one)
+
+| Class | Meaning | Rule |
+| --- | --- | --- |
+| **clean** | passive / local-only; always in-bounds | recommend freely, offer the one-paste block |
+| **gated** | in-bounds **only** first-party / user-owned / opt-in — the user installs the CA, routes *their own* client, owns the keys | surface the command, **never run it for the user** |
+| **avoid** | crosses the harness bright line (active scanning, exploitation, third-party interception) | never recommend; listed so it is not added by reflex |
+
+The harness is for **spec-writing / integration / competitive analysis** — passive or first-party only,
+respecting TOS and robots (`ingestion.md` §7). No tool changes that; the gated ones simply need the user in
+the loop, exactly as `session` Pass-2 and `wire-capture` rung 3 do.
+
+---
+
+## Why this file matters more since the §5 rewrite
+
+`ingestion.md` §5 now requires **verbatim dumping** — the artifact lands on disk whole, and the digest is
+written *beside* it, never *instead* of it. The obvious objection is "a 6 MB spec is unusable." **These
+tools are the answer to that objection.** They are what make a verbatim corpus queryable, which is what
+makes dumping-not-digesting practical:
+
+| Instead of digesting… | Dump verbatim, then |
+| --- | --- |
+| a 6 MB OpenAPI spec → a hand-typed endpoint table | `curl -o raw/spec.json` → **spectral** to catalog, **oasdiff** to diff, **gron** to grep |
+| a 9 MB minified bundle → prose about the routes | `curl -o raw/bundle.js` → **webcrack** / **source-map-explorer** to read, **ast-grep** to query |
+| a HAR → a narrative of the calls | keep `raw/flows.har` → **gron** to flatten and grep |
+| a docs site → distilled sections only | keep the page sources → **trafilatura** / **pandoc** to render |
+| a package's exports → string-mined prose | `npm view --json` → **typescript + attw + publint**, **griffe** for Python |
+
+**A digest is a lossy compression you cannot undo; a verbatim artifact plus a query tool is lossless.**
+Recommend Tier 1 on that basis, not as a nice-to-have.
+
+---
+
+## Tier 1 — clean, install now (broad leverage)
+
+Highest-consensus, always in-bounds. Offer as one paste:
+
+```bash
+# Homebrew (CLI analysis + data-wrangling + web→text)
+brew install gron pandoc ast-grep scc universal-ctags oasdiff fd yq dasel monolith tokei sevenzip
+# Rust
+cargo install htmlq
+# Python (via uv — pipx is typically absent; uv tool install is the path)
+uv tool install trafilatura && uv tool install griffe
+# Node global (JS/TS surface + bundle de-obfuscation + spec lint)
+npm i -g webcrack source-map-explorer @arethetypeswrong/cli publint @electron/asar typescript @stoplight/spectral-cli
+# Headless browser for JS-rendered docs/marketing (clean — the user's own headless instance)
+npm i -g playwright && npx playwright install chromium
+```
+
+| Tool | Unlocks | Dimensions served |
+| --- | --- | --- |
+| **gron** | flatten any JSON → greppable/diffable `path = value` (specs, captures, manifests, HAR, configs) | **7** (codebase, api, session, bundle, infra, wire, cross-cutting) |
+| **trafilatura** | boilerplate-stripped main content + dates from HTML → clean markdown; feed/sitemap discovery | **4** (docs, website, community, infra) |
+| **pandoc** | deterministic HTML→GFM (headings, tables, code fences) at scale | 3 (docs, website, community) |
+| **ast-grep** | tree-sitter structural search/count across many files + langs (call sites, routes, exports) — catches what regex misses | 2 (codebase, bundle) |
+| **oasdiff** | structured breaking-vs-non-breaking OpenAPI diff — makes the published-vs-app-own diff machine-checked | 2 (api, cross-cutting) |
+| **webcrack** | un-minify / un-webpack / de-obfuscate SPA & Electron JS into readable modules | 2 (bundle, distribution) |
+| **scc** | instant LOC-by-language + complexity census of a fresh clone (JSON) — the codebase opening move | 1 (codebase) |
+| **universal-ctags** | real multi-lang JSON symbol index (the host's BSD ctags is broken for this) | 1 (codebase) |
+| **htmlq** | surgical CSS-selector extraction (pricing cards, feature tables) instead of regex | 1 (website) |
+| **source-map-explorer** | reassemble a shipped `.map` → original `src/` tree (the `source-map-reassembly` method) | 1 (bundle) |
+| **spectral** | validate/resolve an OpenAPI/AsyncAPI spec → structured endpoint/security/`$ref` catalog | 1 (api) |
+| **griffe** | extract a PyPI package's full public API (the `.d.ts` equivalent for Python) | 1 (packages) |
+| **@arethetypeswrong/cli + typescript + publint** | parse the real `.d.ts`/exports type graph + grade the publish surface (verbatim, not string-mined) | 1 (packages) |
+| **@electron/asar** | extract Electron `app.asar` → JS module tree (the distribution step the playbook names but cannot otherwise run) | 1 (distribution) |
+| **fd · yq · dasel · monolith · tokei · sevenzip** | gitignore-aware file discovery · YAML/XML/TOML query · RSS/XML→JSON · single-file page archive · LOC cross-check · multi-format extract | several |
+
+---
+
+## Tier 2 — gated, install when a run needs them (first-party / passive only)
+
+The capture lanes. In-bounds **only** for the user's own session, the user's own first-party clients, or
+passive sources. **Surface these; never run them for the user.**
+
+```bash
+brew install mitmproxy websocat grpcurl subfinder tlsx testssl jadx apktool
+npm i -g chrome-remote-interface get-graphql-schema
+# one-time, USER-RUN: expose a CDP port on the user's own Chrome (closes the WS-frame blind spot)
+#   open -na "Google Chrome" --args --remote-debugging-port=9222
+# mobile-only, the user's own device + explicit opt-in:  uv tool install frida-tools
+```
+
+| Tool | Unlocks | Ethics note |
+| --- | --- | --- |
+| **mitmproxy** | decode full HTTPS + WebSocket flows of any **first-party** client (CLI/desktop/mobile/SDK) — the `wire-capture` rung-3 keystone (`ingestion.md` §7.1) | user installs the CA and routes *their own* client only |
+| **chrome-remote-interface** | raw CDP → `Network.webSocketFrameReceived`/`Created`, SSE, full bodies — **captures the on-load WS frames the browser MCP's HTTP-only `read_network_requests` drops** | the user's own logged-in session |
+| **websocat** | curl-for-WebSockets: connect / frame / replay / hexdump a realtime endpoint outside the browser | first-party endpoint |
+| **grpcurl** | list services + invoke RPCs via gRPC server reflection → readable op/message catalog | first-party endpoint |
+| **get-graphql-schema** | introspect a first-party GraphQL endpoint → full SDL | first-party endpoint |
+| **subfinder · tlsx · testssl.sh** | passive CT/DNS subdomain breadth + structured TLS posture (vs hand-rolled crt.sh + openssl text) | passive aggregation; respect rate limits |
+| **jadx · apktool** | decompile Android `.apk`/`.dex` → Java + decode `AndroidManifest`/resources (capability map) | public binary; read the EULA first (`ingestion.md` §7.2) |
+| **frida-tools** | cert-pinning bypass to capture **the user's own** mobile client's wire | the user's own device + explicit opt-in only |
+
+> **The single biggest unlock for a realtime target** is `chrome-remote-interface` + a Chrome
+> `--remote-debugging-port` + `websocat` + `mitmproxy` together: they give `session`/`wire-capture` a real
+> WebSocket/SSE capture path instead of a client-side-remount workaround. The browser MCP's
+> `read_network_requests` is **HTTP-only** — that is *why* a realtime tap comes back empty until the remount
+> trick (`tradecraft.md` gotcha #13, `ingestion.md` §9.4). A CDP port removes the injection-timing problem
+> entirely rather than working around it.
+>
+> (Origin: Emergent — with no CDP port open, the run fell back to in-page taps. That worked, but a
+> post-boot `window.WebSocket` wrapper is structurally blind to a library socket opened at boot, and the
+> prior run published a false negative because of it.)
+
+---
+
+## AVOID — never recommend (this is the bright line)
+
+Out-of-bounds for a spec-writing / competitive-analysis harness. Listed so they are not added by reflex:
+
+- **`nmap`, `masscan`, `naabu`** — active port sweeps / service-version probing of remote hosts.
+- **`nuclei`** — template-based remote vulnerability scanning.
+- **`sqlmap`** — injection / exploitation.
+- **`amass` (active mode)** — active DNS brute-forcing. Its *passive* mode overlaps subfinder; prefer subfinder.
+- **`mitmproxy` or `frida` against a third party**, **`socat` as a public relay** — intercepting traffic the
+  user does not own is the line this harness will not cross.
+
+These stay absent **by design**. The recon ethics depend on it, and a tool absent from the host is a
+stronger guarantee than a rule telling the agent not to use it.
+
+---
+
+## Per-dimension gap map (what a bare host cannot do)
+
+| Dimension | Biggest capability gap on a bare host | Top addition(s) |
+| --- | --- | --- |
+| **codebase** | no LOC census, no AST search; the host's BSD ctags is broken for this | scc · ast-grep · universal-ctags (+ fd) |
+| **docs** | no HTML/MDX→md, no JS render → client-rendered docs come back empty | pandoc · trafilatura · playwright |
+| **packages** | the real `.d.ts`/exports surface is string-mined, not parsed | typescript + attw + publint · griffe (Py) · yq |
+| **api** | can fetch a spec but cannot lint / diff / introspect / exercise it | spectral · oasdiff · get-graphql-schema · grpcurl · websocat |
+| **website** | no JS render, no clean table/text extraction → misses pricing and feature grids | trafilatura · htmlq · playwright |
+| **community** | no clean changelog/blog→text, no RSS→JSON | trafilatura · pandoc · dasel |
+| **session** | **structurally blind to WebSocket/SSE frames** (HTTP-only MCP, no CDP port) | chrome-remote-interface · mitmproxy · websocat |
+| **deployed-client-bundle** | a minified/obfuscated blob stays opaque; no source-map reassembly | webcrack · source-map-explorer · ast-grep · gron |
+| **infra-backend-fingerprint** | shallow CT coverage, TLS posture by hand, sub-processor pages scraped raw | subfinder · tlsx · trafilatura (passive only) |
+| **wire-capture** | the keystone (mitmproxy) plus every non-browser replay/decode client is absent | mitmproxy · websocat · grpcurl |
+| **distribution-artifacts** | only CRX/Mach-O readable; no Electron or Android decoders | @electron/asar · jadx · apktool · webcrack · sevenzip |
+| **external-reputation / hiring-intel** | bot-walled review and ATS pages return 403 to plain fetch | playwright (own headless instance) · trafilatura · dasel |
+| **cross-cutting (synthesis)** | no structured diff for the N-way seam reconciliation; no out-of-band WS capture | gron · oasdiff · chrome-remote-interface · yq |
+
+---
+
+## Known install caveats (each of these has actually bitten)
+
+- **`webcrack` needs Node 22.** Its hard dependency `isolated-vm` is a native (node-gyp) addon that fails to
+  build against Node 26, and `--omit=optional` does not help — the dep is non-optional. Run it under a Node
+  22 LTS shim (`npx -y webcrack@latest …` in a Node-22 env), or lean on the already-clean
+  `source-map-explorer` (the preferred `source-map-reassembly` path whenever the SPA ships `.map` files)
+  plus `ast-grep`. De-obfuscating a **no-maps, minified** bundle is the only gap this leaves.
+- **`chrome-remote-interface` is a library, not a CLI.** It installs as a Node module and is invoked from a
+  script, not a shell binary. **Detect it with `npm ls -g chrome-remote-interface`, not `command -v`** — a
+  `command -v` probe reports it missing when it is installed, and the run then wrongly records a capability
+  gap.
+- **`pipx` is typically absent; use `uv tool install`** for Python CLIs (uv is present). Simpler than adding pipx.
+- **`playwright` is clean** — the user's own headless instance. It unblocks JS-rendered docs and marketing
+  for `docs` + `website` **without contending for the gated `session` Chrome**, which matters because the
+  browser is a singleton (`ingestion.md` §7 rule 9).
+
+---
+
+## How Step 0 uses this reference
+
+Once per corpus folder, before Mode 1. If `.claude/discover-tooling.json` exists, tooling was already
+reviewed here — **skip straight to Mode 1 and never re-prompt.** If it is absent:
+
+1. Read this file — the tier lists, the classification, the AVOID list.
+2. **Detect before recommending** — `command -v <tool>` per tool, and `npm ls -g <pkg>` for the Node
+   libraries that ship no binary (see the caveat above). Detection only; nothing is installed at this step.
+3. **Recommend only what is missing**, grouped **clean** (offer the Tier-1 one-paste block) vs **gated**
+   (surface the command, never run it). Never suggest anything on the AVOID list. If nothing is missing,
+   say so in one line.
+4. Write the state file so the harness never asks again in this folder:
+   ```json
+   { "checked": "<ISO date>", "present": ["gron", "pandoc"], "missing": ["mitmproxy"], "recommended": true }
+   ```
+
+The state file is **host-local** (tools live on the machine, not the repo) — gitignore it in a shared
+folder; delete it to force a fresh check after installing a batch. **This step never blocks a run.**
+
+> **Maintenance loop.** When a run hits a capability wall — a format nothing on the host can read, a
+> capture lane that needed a tool that was not listed, an install that failed in a new way — fold it back
+> in here: the tool into the right tier with its ethics class, or the failure into the caveats. This file
+> only stays useful if every new wall is recorded (the same loop `ingestion.md` §7.0 carries for redaction
+> patterns).

package/data/harnesses/discussion/harness.json

@@ -7,5 +7,6 @@
     ".prettierrc.json",
     ".vscode/settings.json"
   ],
+  "seeds": [],
   "digest": "74ab29c65c8f"
 }

package/data/harnesses/etna/agents/maintenance.md

@@ -27,7 +27,7 @@ Decide the mode once, up front, from the version marker — then run.
 2. Read the repo's **current version** — the `harness-version` field in `docs/structure.md` frontmatter (a semver).
    - **Absent** ⇒ the repo is unharnessed ⇒ **baseline mode** (reconcile from nothing), then audit.
    - **Behind on major** ⇒ **baseline mode** (reconcile across the gap), then audit.
-   - **Behind on minor/patch** ⇒ **probe before deciding.** Run the Step B2 detection pass read-only: if any old-shape artifact in the fold table is present, **or** any **scaffolded file** in the target tree is missing (`docs/README.md`, `docs/structure.md`, `docs/history/CHANGELOG.md`, `docs/history/backlog.md`, `docs/memory/index.md`), the shape *did* change ⇒ **baseline mode**. Only when the probe finds nothing ⇒ re-stamp the version (no reshape), then audit.
+   - **Behind on minor/patch** ⇒ **probe before deciding.** Run the Step B2 detection pass read-only: if any old-shape artifact in the fold table is present, **or** any **scaffolded file** in the target tree is missing (`docs/README.md`, `docs/structure.md`, `docs/history/CHANGELOG.md`, `docs/history/backlog.md`, `docs/memory/main.md`), the shape *did* change ⇒ **baseline mode**. Only when the probe finds nothing ⇒ re-stamp the version (no reshape), then audit.
 
    > **Never probe on a missing folder.** Git does not track empty directories, so an unused folder is absent on every clone — reading that as drift puts the repo in baseline mode *forever* and contradicts this agent's own idempotency guarantee. Only the five scaffolded files above are shape signals; every folder in the target tree is created on first use.
    - **Equal to installed** ⇒ **audit only** (the default spine).
@@ -148,7 +148,7 @@ docs/
 │   ├── research/          # Deep-research records ({topic}/ — README.md synthesis + findings.md + sources.md); frozen, cited, owns no code
 │   └── backlog.md       ✱ # Tracked work items by priority (P0-P3)
 ├── memory/
-│   └── index.md         ✱ #   plus main.md, {agent}.md — project knowledge + per-agent strategy memory
+│   └── main.md          ✱ #   plus {agent}.md — project knowledge + per-agent strategy memory
 └── tests/                 # Behavioral test checklists ({feature}.md, step → **Assert**), derived at plan Completion via the `documentation` skill; author-maintained
 ```
 

package/data/harnesses/etna/codex/agents/maintenance.toml

@@ -25,7 +25,7 @@ Decide the mode once, up front, from the version marker — then run.
 2. Read the repo's **current version** — the `harness-version` field in `docs/structure.md` frontmatter (a semver).
    - **Absent** ⇒ the repo is unharnessed ⇒ **baseline mode** (reconcile from nothing), then audit.
    - **Behind on major** ⇒ **baseline mode** (reconcile across the gap), then audit.
-   - **Behind on minor/patch** ⇒ **probe before deciding.** Run the Step B2 detection pass read-only: if any old-shape artifact in the fold table is present, **or** any **scaffolded file** in the target tree is missing (`docs/README.md`, `docs/structure.md`, `docs/history/CHANGELOG.md`, `docs/history/backlog.md`, `docs/memory/index.md`), the shape *did* change ⇒ **baseline mode**. Only when the probe finds nothing ⇒ re-stamp the version (no reshape), then audit.
+   - **Behind on minor/patch** ⇒ **probe before deciding.** Run the Step B2 detection pass read-only: if any old-shape artifact in the fold table is present, **or** any **scaffolded file** in the target tree is missing (`docs/README.md`, `docs/structure.md`, `docs/history/CHANGELOG.md`, `docs/history/backlog.md`, `docs/memory/main.md`), the shape *did* change ⇒ **baseline mode**. Only when the probe finds nothing ⇒ re-stamp the version (no reshape), then audit.
 
    > **Never probe on a missing folder.** Git does not track empty directories, so an unused folder is absent on every clone — reading that as drift puts the repo in baseline mode *forever* and contradicts this agent's own idempotency guarantee. Only the five scaffolded files above are shape signals; every folder in the target tree is created on first use.
    - **Equal to installed** ⇒ **audit only** (the default spine).
@@ -146,7 +146,7 @@ docs/
 │   ├── research/          # Deep-research records ({topic}/ — README.md synthesis + findings.md + sources.md); frozen, cited, owns no code
 │   └── backlog.md       ✱ # Tracked work items by priority (P0-P3)
 ├── memory/
-│   └── index.md         ✱ #   plus main.md, {agent}.md — project knowledge + per-agent strategy memory
+│   └── main.md          ✱ #   plus {agent}.md — project knowledge + per-agent strategy memory
 └── tests/                 # Behavioral test checklists ({feature}.md, step → **Assert**), derived at plan Completion via the `documentation` skill; author-maintained
 ```
 

package/data/harnesses/etna/harness.json

@@ -1,11 +1,12 @@
 {
   "harness": "etna",
   "name": "etna",
-  "version": "1.3.7",
+  "version": "1.3.8",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
     ".vscode/settings.json"
   ],
-  "digest": "4e555d81995f"
+  "seeds": [],
+  "digest": "91acf558021c"
 }

package/data/harnesses/hr/harness.json

@@ -7,5 +7,6 @@
     ".prettierrc.json",
     ".vscode/settings.json"
   ],
+  "seeds": [],
   "digest": "077993d5c509"
 }

package/data/harnesses/kb-agi/harness.json

@@ -7,5 +7,6 @@
     ".prettierrc.json",
     ".vscode/settings.json"
   ],
+  "seeds": [],
   "digest": "d0b9322bb685"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@nurix/etna",
-    "version": "0.19.41",
+    "version": "0.19.43",
     "description": "Bootstrap a project with a Nurix harness — copies the harness's CLAUDE.md, skills, agents, rules, and hooks directly into the project from a bundled payload (no marketplace fetch, no network).",
     "type": "module",
     "bin": {
@@ -41,5 +41,5 @@
         "agent",
         "plugin"
     ],
-    "etnaFingerprint": "c96b6524c5e6"
+    "etnaFingerprint": "4d6e06e37895"
 }