@pieerry/harness-kit 3.0.0

package/.claude/plugins/staff-software-engineer/hooks/post-write-plan.sh

@@ -0,0 +1,49 @@
+#!/bin/bash
+# After Write to outputs/plan/, run sensors and write phase markers.
+
+set -euo pipefail
+
+FILE_PATH="${CLAUDE_TOOL_FILE_PATH:-}"
+PLUGIN_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+
+case "$FILE_PATH" in
+  *.claude/plugins/staff-software-engineer/outputs/plan/*.md) ;;
+  *) exit 0 ;;
+esac
+
+if grep -q "<!-- approved:" "$FILE_PATH" 2>/dev/null; then
+  exit 0
+fi
+
+echo "[hook] Running plan sensors on $(basename "$FILE_PATH")" >&2
+
+FAILURES=()
+for sensor in "$PLUGIN_DIR"/sensors/plan-*.md; do
+  [ -f "$sensor" ] || continue
+  if ! python3 "$PLUGIN_DIR/scripts/sensor-runner.py" \
+        --sensor "$sensor" \
+        --artifact "$FILE_PATH" >&2; then
+    FAILURES+=("$(basename "$sensor")")
+  fi
+done
+
+if [ ${#FAILURES[@]} -gt 0 ]; then
+  echo "[hook] Plan sensor failures: ${FAILURES[*]}" >&2
+  exit 2
+fi
+
+echo "[hook] Plan sensors passed" >&2
+
+FEATURE_ID="$(basename "$FILE_PATH" .md)"
+MARKERS_DIR="$PLUGIN_DIR/outputs/.markers"
+mkdir -p "$MARKERS_DIR"
+NOW="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+
+if [ ! -f "$MARKERS_DIR/${FEATURE_ID}.plan-validate.start" ]; then
+  if [ -f "$MARKERS_DIR/${FEATURE_ID}.plan-generate.start" ]; then
+    printf '{"timestamp":"%s"}\n' "$NOW" > "$MARKERS_DIR/${FEATURE_ID}.plan-generate.end"
+    printf '{"timestamp":"%s","session_id":"%s"}\n' "$NOW" "${CLAUDE_SESSION_ID:-}" > "$MARKERS_DIR/${FEATURE_ID}.plan-validate.start"
+  fi
+fi
+
+exit 0

package/.claude/plugins/staff-software-engineer/sensors/code-conventions.md

@@ -0,0 +1,37 @@
+# Sensor: Code Conventions
+
+Type: deterministic (via project-specific tooling)
+Mode: hard gate
+
+Run lint and format checks for the area being touched.
+
+## Backend (Java/Kotlin)
+
+Detect via build file:
+- Maven: `mvn -q checkstyle:check` or `mvn -q spotless:check` if configured
+- Gradle: `./gradlew detekt` or `./gradlew checkstyleMain`
+
+If no linter is configured, skip and emit a warning.
+
+## Web (Vue/JS)
+
+- `npm run lint` if defined
+- `npm run typecheck` or `tsc --noEmit` if TS
+
+## Mobile
+
+- iOS: `swiftlint`
+- Android: `./gradlew ktlintCheck` or `./gradlew detekt`
+
+## DevOps
+
+- `terraform fmt -check -recursive`
+- `yamllint` for workflows
+
+## On failure
+
+Block. Surface the linter output. Agent fixes and re-runs.
+
+## On warning (no linter configured)
+
+Note in the output, do not block. Suggest adding the linter to the repo.

package/.claude/plugins/staff-software-engineer/sensors/plan-structure.md

@@ -0,0 +1,37 @@
+# Sensor: Plan Structure
+
+Type: deterministic
+Mode: hard gate
+
+## Required sections
+
+- Scope
+- Repos and files touched
+- Execution flow
+- Risks
+- Rollout
+- Tests
+
+## Forbidden tokens
+
+- lorem
+- TODO without ticket reference
+- placeholder
+
+## Markdown rules
+
+- exactly 1 H1 heading
+- no em-dash
+- no ASCII box-drawing
+
+## Required metadata
+
+Header must declare:
+- Source PRP
+- Squad
+- Tech lead
+- Date
+
+## On failure
+
+Block publish. Return missing sections and rule violations. Agent regenerates failed parts only.

package/.claude/plugins/staff-software-engineer/sensors/test-coverage.md

@@ -0,0 +1,28 @@
+# Sensor: Test Coverage
+
+Type: heuristic
+Mode: hard gate
+
+Every feature or bugfix must include tests for the changed code.
+
+## Check
+
+For each changed source file in the dev commit set, look for:
+- a corresponding test file (e.g., `Foo.java` -> `FooTest.java`, `bar.ts` -> `bar.test.ts`)
+- OR a test file modified in the same commit that exercises the change
+
+Patterns recognized:
+- `**/test/**`, `**/tests/**`, `**/__tests__/**`, `**/spec/**`, `**/specs/**`
+- File suffix: `Test`, `Tests`, `.test.`, `.spec.`, `_test.`, `_spec.`
+
+## Exclusions
+
+The following do not need a test in the same commit:
+- README and docs
+- migration files (V*.sql)
+- pure config (yaml, json)
+- generated code
+
+## On failure
+
+Block. List the source files without tests. Agent adds the missing tests.

package/.claude/plugins/staff-software-engineer/skills/backend/SKILL.md

@@ -0,0 +1,80 @@
+---
+name: backend
+description: Backend engineering conventions for team. Java/Kotlin servers. Project conventions in .claude/conventions/backend.md override these defaults.
+user_invocable: false
+---
+
+Backend conventions, team default.
+
+Project override: if `{repo}/.claude/conventions/backend.md` exists, it overrides any rule here. See guides/conventions-override.md.
+
+## Defaults
+
+These are illustrative defaults for a JVM-leaning backend. Override per repo via `.claude/conventions/backend.md`.
+
+Stack:
+- Java or Kotlin (check pom.xml or build.gradle.kts)
+- Spring Boot (current major) or Ktor for Kotlin services
+- Build: Maven (mvn) or Gradle (gradlew)
+- Deploy: JAR with embedded server
+- Package prefix: match repo convention
+
+Persistence:
+- Custom JDBC AbstractRepository + SQL templates. Avoid JPA except where the repo already uses it.
+- Migrations via Flyway, naming `V{YYYYMMDD}__{description}.sql`.
+
+Mapping:
+- Orika 1.5.x. Avoid MapStruct unless repo already uses it.
+
+Lombok:
+- `@Data`, `@Builder`, `@RequiredArgsConstructor` OK.
+- Avoid `@SneakyThrows`. Be explicit about checked exceptions.
+
+Null handling:
+- `Objects.equals()` for equality.
+- `Boolean.TRUE.equals(...)` for nullable booleans.
+- Guards and early returns. Avoid deep nesting.
+
+Streams:
+- Fluent: `.stream().filter(...).findAny().orElseThrow(...)`.
+- Avoid stream-of-stream when a guard would do.
+
+Transactions:
+- `@Transactional` on service methods, not repositories.
+
+Tests:
+- JUnit 4 + Mockito legacy; JUnit 5 + Mockito for newer.
+- `@RunWith(MockitoJUnitRunner.class)` (JUnit 4) or `@ExtendWith(MockitoExtension.class)` (JUnit 5).
+- Naming: `givenX_WhenY_ShouldZ` or `shouldDoSomethingWhenCondition`.
+- Cover positive, negative, and edge cases.
+- `verify()` with `never()`, `times()`, arg matchers.
+
+## Before writing code
+
+Read at least 3 similar files in the target repo to confirm:
+- framework version
+- build tool
+- package layout
+- test framework
+- helpers in use (Lombok, Orika, custom)
+
+Never assume. Stack varies per repo.
+
+## Forbidden in PR
+
+- new JPA usage in repos that use AbstractRepository
+- MapStruct in repos using Orika
+- Composition API in Vue 2 repos (web side)
+- code without tests
+- `@SuppressWarnings` to silence real issues
+- placeholder TODO comments without ticket reference
+
+## Mark gaps
+
+If you cannot find a pattern in the repo, do not invent it:
+
+```java
+// TBD - verify with tech lead: {what you searched, what is missing}
+```
+
+Read actual code first. A TODO with context beats fabricated code.

package/.claude/plugins/staff-software-engineer/skills/devops/SKILL.md

@@ -0,0 +1,58 @@
+---
+name: devops
+description: DevOps engineering conventions for team. CI/CD, infra-as-code, observability. Project conventions in .claude/conventions/devops.md override these defaults.
+user_invocable: false
+---
+
+DevOps conventions, team default.
+
+Project override: if `{repo}/.claude/conventions/devops.md` exists, it overrides any rule here. See guides/conventions-override.md.
+
+## Defaults
+
+CI/CD:
+- GitHub Actions for most repos. Workflows in `.github/workflows/`.
+- Reusable workflows when steps repeat across repos.
+- Secrets via GitHub Secrets, never inline.
+- Pin actions to commit SHA, not branch.
+
+Containers:
+- Multi-stage Dockerfile. Slim base images (alpine, distroless).
+- Non-root user in production stage.
+- `.dockerignore` mirrors `.gitignore` essentials plus build artifacts.
+
+Infra-as-code:
+- Terraform for infra. State in remote backend (S3, etc).
+- Modules in `terraform/modules/`. Stacks in `terraform/stacks/`.
+- Variables via `terraform.tfvars`, never hardcoded.
+
+Observability:
+- Grafana dashboards JSON in repo when applicable.
+- Alerts as code (Prometheus rules, Datadog monitors).
+- Log structure: JSON, with `trace_id`, `service`, `level`, `msg`.
+
+Secrets:
+- Never commit secrets. Use a secret manager.
+- Pre-commit hook to scan for accidental secrets.
+
+## Before writing code
+
+Read at least 3 similar workflows or terraform modules in the repo. Confirm:
+- runner type (ubuntu-latest, self-hosted)
+- secret naming convention
+- environments (dev, staging, prod)
+- approval gates for prod
+
+## Forbidden in PR
+
+- inline secrets
+- actions pinned to `@main` or `@latest`
+- terraform without state backend
+- Dockerfile running as root in prod
+- alerts without runbook links
+
+## Mark gaps
+
+```yaml
+# TBD - verify with devops lead: {what is missing}
+```

package/.claude/plugins/staff-software-engineer/skills/mobile/SKILL.md

@@ -0,0 +1,52 @@
+---
+name: mobile
+description: Mobile engineering conventions for team. iOS and Android. Project conventions in .claude/conventions/mobile.md override these defaults.
+user_invocable: false
+---
+
+Mobile conventions, team default.
+
+Project override: if `{repo}/.claude/conventions/mobile.md` exists, it overrides any rule here. See guides/conventions-override.md.
+
+## Defaults
+
+team's mobile work is limited; repos vary widely. Always read the repo before writing.
+
+iOS:
+- Swift 5.x. Avoid Objective-C unless repo already uses it.
+- Xcode project conventions per repo.
+- Tests: XCTest. Naming `test_givenX_whenY_thenZ`.
+
+Android:
+- Kotlin. Avoid Java unless repo already uses it.
+- Gradle build. Check `build.gradle.kts` vs `build.gradle`.
+- Tests: JUnit 4 or JUnit 5. Espresso for UI.
+
+Shared:
+- Match existing architecture (MVVM, MVI, Clean, etc).
+- Match existing DI (Hilt, Koin, Dagger).
+
+## Before writing code
+
+Read at least 3 similar files in the repo to confirm:
+- language version (Swift/Kotlin)
+- architecture pattern
+- DI framework
+- test framework
+- networking (Retrofit, Alamofire, URLSession)
+
+Mobile stacks vary more than backend or web. Verify everything.
+
+## Forbidden in PR
+
+- mixing architecture patterns (e.g., MVP + MVVM in same module)
+- hardcoded strings (use string resources)
+- direct file system access without permission checks
+- code without tests
+- TODOs without ticket references
+
+## Mark gaps
+
+```kotlin
+// TBD - verify with mobile tech lead: {what is missing}
+```

package/.claude/plugins/staff-software-engineer/skills/web/SKILL.md

@@ -0,0 +1,64 @@
+---
+name: web
+description: Web frontend engineering conventions for team. Vue.js stack. Project conventions in .claude/conventions/web.md override these defaults.
+user_invocable: false
+---
+
+Web frontend conventions, team default.
+
+Project override: if `{repo}/.claude/conventions/web.md` exists, it overrides any rule here. See guides/conventions-override.md.
+
+## Defaults (team frontend stack)
+
+Stack:
+- Vue 2.6 Options API. Avoid Composition API unless repo already uses Vue 3.
+- Vuex with namespaced modules: `createNamespacedHelpers`.
+- TMS Design System: `IpPageBase`, `IpTabs`, `IpFormField`, `IpSelect`, `IpDialog`, `IpSnackbar`.
+- PrimeVue 2.10 alongside TMS in some repos.
+- `@team-js` packages: `secure-components`, `secure-providers`, `secure-ui`.
+- Feature folders: `/features/private`, `/features/public`.
+
+Component order:
+- data, computed, watch, created/mounted, methods, components.
+
+Styling:
+- Scoped SCSS.
+- BEM-like naming.
+- CSS variables for theming.
+
+UX feedback:
+- Snackbar via `this.$ipSnackbar.add()`.
+- Async: `.catch()` before `.finally()`. Toast on failure.
+
+State:
+- Vuex actions for side effects, mutations for state changes.
+- Getters for derived state.
+
+Tests:
+- Vitest or Jest depending on repo.
+- Vue Test Utils for component tests.
+- Cover happy path, error path, edge case.
+
+## Before writing code
+
+Read at least 3 similar components in the repo to confirm:
+- Vue version (2 vs 3)
+- API style (Options vs Composition)
+- Design system in use (TMS, PrimeVue, custom)
+- State management (Vuex, Pinia, none)
+
+Never assume.
+
+## Forbidden in PR
+
+- Composition API in Vue 2 repos
+- Inline styles when SCSS exists
+- Direct mutation of Vuex state outside mutations
+- Components without tests
+- console.log in production code
+
+## Mark gaps
+
+```vue
+<!-- TBD - verify with tech lead: {what you searched, what is missing} -->
+```

package/.claude/settings.local.json

@@ -0,0 +1,61 @@
+{
+  "permissions": {
+    "allow": [
+      "WebSearch",
+      "Bash(xargs:*)",
+      "Bash(tree:*)",
+      "Bash(git init:*)",
+      "Bash(git add:*)",
+      "Bash(git commit:*)",
+      "Bash(git push:*)",
+      "WebFetch(domain:raw.githubusercontent.com)",
+      "WebFetch(domain:github.com)",
+      "Bash(git mv:*)",
+      "Bash(chmod:*)",
+      "Bash(git rm:*)",
+      "Bash(node bin/cli.js:*)",
+      "Bash(npm view:*)",
+      "WebFetch(domain:openspec.dev)",
+      "Bash(gh release:*)",
+      "Bash(gh api:*)",
+      "Bash(gh run:*)",
+      "Bash(git pull:*)",
+      "Bash(git checkout:*)",
+      "Bash(npm version:*)",
+      "Bash(head:*)",
+      "Bash(ls profiles/*.md)",
+      "Bash(ls profiles/knowledge/*.md)",
+      "Read(//Users/pierryborges/Development/**)",
+      "Bash(rm -f context-vs-onboarding.png FLOW-DETAILS.md CONTRIBUTING.md install.sh README.md CLAUDE.md .cursorrules .DS_Store)",
+      "Bash(rm -rf resources/ .AGENT/)",
+      "Bash(mv .claude-plugins/basic/skills/* .claude/skills/)",
+      "Bash(rm -rf .claude-plugins .claude-plugins-tmp)",
+      "Bash(git -C /Users/pierryborges/Development/eng-delivery-playbook log --oneline -20)",
+      "Bash(git -C /Users/pierryborges/Development/intelipost/pm-os-intelipost-team log --oneline -20)",
+      "Bash(git -C /Users/pierryborges/Development/eng-delivery-playbook status --short)",
+      "Bash(git -C /Users/pierryborges/Development/eng-delivery-playbook ls-tree HEAD --name-only)",
+      "Bash(git -C /Users/pierryborges/Development/eng-delivery-playbook ls-tree HEAD -d --name-only)",
+      "Bash(rm -rf .github bin package.json profiles logo.png .gitignore advanced context-library setup sub-agents templates)",
+      "Bash(rm -rf .claude/hooks .claude/skills)",
+      "Bash(git -C /Users/pierryborges/Development/eng-delivery-playbook add -A)",
+      "Bash(find *)",
+      "Bash(bash *)",
+      "Bash(git -C /Users/pierryborges/Development/eng-delivery-playbook diff --stat --cached)",
+      "Bash(git -C /Users/pierryborges/Development/eng-delivery-playbook show d8e0e3e:bin/cli.js)",
+      "Bash(node bin/edp.js help)",
+      "Bash(node bin/edp.js version)",
+      "Bash(node bin/edp.js status .)",
+      "Bash(grep -rn \"R\\\\$\" .claude/)",
+      "Bash(grep -rn \"R\\\\\\\\\\\\$\" .claude/)",
+      "Bash(python3 *)",
+      "Bash(git -C /Users/pierryborges/Development/eng-delivery-playbook remote -v)",
+      "Bash(git -C /Users/pierryborges/Development/eng-delivery-playbook branch -vv)",
+      "Bash(git -C /Users/pierryborges/Development/eng-delivery-playbook commit -m ' *)",
+      "Bash(git -C /Users/pierryborges/Development/eng-delivery-playbook log --oneline -3)",
+      "Bash(git -C /Users/pierryborges/Development/eng-delivery-playbook status -sb)",
+      "Bash(git -C /Users/pierryborges/Development/eng-delivery-playbook push origin main)",
+      "Bash(git remote *)",
+      "Bash(git fetch *)"
+    ]
+  }
+}

package/CLAUDE.md

@@ -0,0 +1,90 @@
+# CLAUDE - Master Context File
+
+Read by Claude Code on every session. Defines how to work in this harness-kit workspace.
+
+## Response Style
+
+- **Language:** match the user. Default English. Domain terms stay native.
+- **Code, commits, PRs:** Conventional Commits, repo language.
+- **Error quotes, file paths, URLs:** verbatim.
+- **Destructive/irreversible ops:** full clarity warning.
+- No emojis in output unless user explicitly asks.
+
+## Role
+
+AI copilot for product + engineering delivery. Thinking partner and execution assistant. Help PMs, EMs, devs to:
+
+- make better strategic decisions
+- write crisp, alignment-focused docs
+- ship features through one consistent pipeline
+- avoid drift in conventions and quality gates
+
+## Squads / Teams
+
+Configurable per consumer. Fill `context-library/business-info.md` and `context-library/squads/{slug}/` with your own structure. Ask which squad the work belongs to when not clear.
+
+## Plugins
+
+This workspace ships two Claude Code plugins under `.claude/plugins/`. Both have their own README with full detail.
+
+### product-manager
+
+PRD and PRP generation. Slash commands:
+- `/product-manager:prd` draft a PRD (business-facing)
+- `/product-manager:prp` draft a PRP (engineering-ready spec)
+- `/product-manager:run` full PM pipeline
+
+Sub-agent `product-manager` is also Task-tool-invokable for delegation.
+
+### staff-software-engineer
+
+Engineering pipeline. Slash commands:
+- `/sse:plan` technical plan from an approved PRP
+- `/sse:dev` implement the plan, run convention gates
+- `/sse:test` run repo tests
+- `/sse:pr` open the draft PR
+- `/sse:run` full SSE pipeline
+
+Sub-agent `staff-software-engineer` is also Task-tool-invokable.
+
+Full pipeline order: `prd → prp → plan → dev → test → pr`. Each stage gets an approval marker. The status bar tracks the current one.
+
+## Project conventions override
+
+Each target repo can override SSE plugin defaults with files in `.claude/conventions/`:
+
+```
+{repo}/.claude/conventions/
+├── backend.md
+├── web.md
+├── mobile.md
+└── devops.md
+```
+
+When a file exists, plugin reads it on top of defaults. Project wins. Reference: `.claude/plugins/staff-software-engineer/guides/conventions-override.md`.
+
+## Token accounting and status bar
+
+After approval, hooks compute tokens used per phase from the Claude transcript and append to `outputs/tokens/{feature_id}.json` (per plugin). One JSON collects phases across the full lifecycle.
+
+The status bar follows the active feature through the 6-stage pipeline. See `.claude/hooks/status-line.sh`.
+
+## Core Principles
+
+### Context engineering
+
+Reference the workspace before generating:
+- `context-library/business-info.md` for company context
+- `context-library/squads/{squad}/` for squad-specific context
+- `context-library/strategy/` for frameworks, OKRs, roadmaps
+- `context-library/example-prds/` for reference artifacts
+- `context-library/decisions/`, `meetings/`, `metrics/`, `research/` for prior work
+
+### Output philosophy
+
+Short, specific, actionable.
+
+- shorter beats longer
+- specific over generic (real names, numbers, quotes)
+- mark gaps with `NOT FOUND - NEEDS REVIEW: {detail}` rather than inventing
+- mermaid not ASCII diagrams

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Space Metrics AI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.