@polderlabs/bizar 8.0.0 → 9.0.0

package/.claude/worktrees/kanban-overhaul/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DrB0rk
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/.claude/worktrees/kanban-overhaul/MILESTONES.md

@@ -0,0 +1,257 @@
+# BizarHarness — Milestones
+
+> The strategic roadmap for **Bizar** as a **self-improving, autonomous,
+> long-horizon coding platform** built on Claude Code. Phased by capability, with
+> hard success gates per phase. Updated at every phase end.
+
+## Vision
+
+> **Bizar is the smallest serious multi-agent coding harness with the largest
+> closed learning loop in the field.**
+
+A user submits a goal — a refactor, a new feature, a multi-day codebase
+migration. They walk away. Bizar handles the work end-to-end, escalating
+only when the decision is too expensive, too irreversible, or too uncertain
+to make on its own. When the user comes back, the work is either done,
+partially done with a clear handoff, or paused at a checkpoint that needs them.
+
+Concretely, a goal looks like one of these:
+
+- **"Refactor the auth module to use JWT."** Odin decomposes the work.
+  Mimir investigates the current code. Tyr drafts the refactor with
+  tests. Forseti reviews. Thor applies it across the codebase. The user
+  approves the merge in a single click from their phone.
+- **"Build a complete iOS app from this spec."** Tyr designs the
+  architecture, breaks it into 40 features. The scheduler dispatches
+  them to Thor in dependency-ordered waves, integrates the results,
+  runs the test suite, fixes failures, and reports.
+- **"Monitor this codebase for security issues and patch them."** A
+  recurring background loop. Mimir watches for new CVEs, Tyr drafts
+  patches, Forseti reviews, the agent-browser agent verifies the fix
+  in a real browser.
+
+## Pillars
+
+| Pillar | Description | Status |
+| --- | --- | --- |
+| **1. Autonomy** | Run unsupervised, survive failures, make progress without human input | v6.0.0 |
+| **2. Long-horizon** | Execute tasks that span hours, days, or weeks | v6.0.0 |
+| **3. Looping** | Three closed feedback loops that make Bizar self-improving | v6.0.0 |
+| **4. Cline integration** | First-class integration with Claude Code (in-process; Agent SDK + MCP + skills + Agent dispatch) | v6.0.0 |
+| **5. Browser automation** | Self-healing CDP wrapper for browser-driven E2E verification | v6.0.0 (agent-browser) |
+| **6. Provider model** | Provider abstraction + automatic fallback chain | v5.7.0 |
+| **7. Knowledge graph** | Cross-agent knowledge graph | v6.0.0 |
+| **8. Subagent RPC** | Zero-context-cost multi-step pipelines | v5.7.0 |
+| **9. Trajectory capture** | Capture + replay + evaluate agent runs | v5.7.0 |
+| **10. Approval gates + audit log** | Hard guardrails for tool execution | v6.0.0 |
+
+## Closed feedback loops
+
+### Loop A — Per-task improvement (every task)
+
+```
+Task starts
+  ↓
+Trajectory: tool call → model → result → model → ... → final response
+  ↓
+Capture:  .bizar/trajectories/<task-id>.jsonl  (turn-by-turn)
+  ↓
+Compress: 6-step compression (protect head/tail, summarize middle via LLM)
+  ↓
+Store:    .bizar/trajectories/<task-id>.jsonl.zst
+  ↓
+Skill extraction: "what reusable patterns did you see?"
+  ↓
+For each pattern: create or update .bizar/skills/<category>/<name>/SKILL.md
+  ↓
+Next task: include top-N relevant skills in system prompt
+```
+
+### Loop B — Per-session improvement (every session)
+
+```
+Session starts
+  ↓
+Memory prefetch: search .bizar/memory.db for similar past sessions
+  ↓
+Inject: <prior_work> block in system prompt
+  ↓
+Session runs (Loop A captures trajectory)
+  ↓
+Memory update: insert key facts into .bizar/memory.db
+  ↓
+User profile: update .bizar/users/<id>/profile.json
+  ↓
+Project profile: update .bizar/projects/<hash>/profile.json
+```
+
+### Loop C — Per-week curation (every week)
+
+```
+Curator cron fires (Saturday 2am)
+  ↓
+Read last 7 days of trajectories + skills
+  ↓
+For each skill: check usage count, last-used date
+  ↓
+Archive: skills with use_count == 0 for 90+ days
+  ↓
+Consolidate: skills with overlapping purpose merge
+  ↓
+Update: stale skills get a "needs-review" tag
+  ↓
+Report: .bizar/curator/weekly-<date>.md
+```
+
+## Phased milestones
+
+### Phase 1 — Foundation (v6.0.0) ✅ SHIPPED
+
+**Goal:** Bizar is the smallest serious multi-agent coding harness with a
+closed learning loop.
+
+| Deliverable | Status |
+| --- | --- |
+| Cline rewrite (OpenCode → Cline) | ✅ shipped (v5.6.0-beta.1) — historical, superseded by v6.3.0 Claude Code migration |
+| All 22 tools use `createTool` from `@cline/sdk` | ✅ shipped |
+| 4 + 2 safety hooks (beforeTool, afterTool, beforeModel, onEvent + curator + flush) | ✅ shipped |
+| In-process ClineCore (no subprocess) | ✅ shipped (DEC-002) |
+| In-process memory vault | ✅ shipped (DEC-003) |
+| Cline agent teams (`bizar_spawn_team`) | ✅ shipped (DEC-004) |
+| Kanban board (5 columns + team badge) | ✅ shipped (DEC-006) |
+| DANGEROUS_PATTERNS approval gate (36 patterns) | ✅ shipped (DEC-007) |
+| Skill curator (closed learning loop) | ✅ shipped (DEC-008) |
+| Pre-compaction memory flush | ✅ shipped (DEC-009) |
+| Knowledge graph query tools (3 tools) | ✅ shipped (DEC-010) |
+| Harness engineering audit at 73/73 | ✅ shipped |
+| Claude Code migration (Cline → Claude Code) | ✅ shipped (v6.3.0) |
+
+**Test gate:** ✅ 656/658 plugin + 71/74 SDK + 27/27 E2E + 73/73 audit
+
+### Phase 2 — Capability expansion (v5.7.0) — IN PROGRESS
+
+**Goal:** Bizar is the Claude Code-native multi-agent coding harness for long-horizon coding.
+
+| Deliverable | Status |
+| --- | --- |
+| Provider profile + fallback chain | ⏳ next |
+| Knowledge graph query-tool surface polish | ✅ v6.0.0 |
+| Subagent RPC (zero-context-cost pipelines) | ⏳ |
+| Approval gates + audit log extension | ✅ v6.0.0 (gate done) |
+| Trajectory capture + evaluation harness | ⏳ |
+| Self-healing browser automation (agent-browser) | ⏳ **next** |
+| Cline agent team progress on kanban | ⏳ |
+
+**Test gate:** Phase 2 long-horizon eval suite (3-5 scenarios, 1-2 hours
+each) passes at 70%+ completion.
+
+**Success metric:** Bizar runs 4-hour tasks end-to-end without human
+intervention. Provider fallback works (kill primary mid-task).
+
+### Phase 3 — Differentiation (v5.8.0) — UPCOMING
+
+**Goal:** Bizar is uniquely valuable for autonomous, long-horizon,
+self-improving coding.
+
+| Deliverable | Status |
+| --- | --- |
+| Scheduler (cron + on-exit) | ⏳ |
+| Multi-phase Hands (3+ examples) | ⏳ |
+| Terminal backends (Docker + SSH) | ⏳ |
+| MCP server exposure | ⏳ |
+
+**Test gate:** All Phase 2 tests pass + 24-hour unsupervised scenario
+runs successfully.
+
+**Success metric:** Bizar has ≥50 active skills, ≥3 multi-phase Hands,
+≥2 terminal backends, and an MCP server is in use by ≥2 external agents.
+
+### Phase 4 — Long-horizon master (v6.0.0 — far future)
+
+**Goal:** Bizar is the autonomous long-horizon coding platform.
+
+| Deliverable | Status |
+| --- | --- |
+| Weeks-long task execution | ⏳ |
+| 5x reduction in human-in-the-loop cycles | ⏳ |
+| 80%+ autonomy on Tier 1 work | ⏳ |
+| MTTR < 30s for provider/process crashes | ⏳ |
+| 50+ skills library with self-curation | ⏳ |
+
+## Concrete metrics
+
+### Autonomy
+
+| Metric | Target | Current | Status |
+| --- | --- | --- | --- |
+| Tasks completed without human intervention (Tier 1) | 80%+ | TBD | ⏳ |
+| Mean time to failure recovery | <30s | ~5s | ✅ |
+| False-positive escalation rate | <5% | TBD | ⏳ |
+
+### Long-horizon
+
+| Metric | Target | Current | Status |
+| --- | --- | --- | --- |
+| Maximum task duration | 8h agent / 24h wall | 1h typical | ⏳ |
+| 1-4h task completion rate | 70%+ | TBD | ⏳ |
+| Crash recovery success rate | 95%+ | ~95% | ✅ |
+| Token cost per typical refactor | <$50 | ~$5 | ✅ |
+
+### Looping
+
+| Metric | Target | Current | Status |
+| --- | --- | --- | --- |
+| Skills created per week (after week 4) | 5-20 | TBD | ⏳ |
+| Skill reuse rate | 30%+ | TBD | ⏳ |
+| Skill quality (when reviewed) | 90%+ useful | TBD | ⏳ |
+
+## Audit
+
+Every phase ends with the full harness engineering audit:
+
+```sh
+make check           # tsc + tests
+make e2e             # real plugin load + tools + hooks
+make check-arch      # arch-rules.json enforcement (currently 7 rules)
+make clean-check     # 5-dimension exit gate
+bash tools/audit-harness.sh .    # 73-component audit
+```
+
+### Audit score by version
+
+| Version | Audit score |
+| --- | --- |
+| v5.5.6 | 65/73 |
+| v5.6.0-beta.1 | 73/73 |
+| v5.6.0-beta.6 | **73/73** + console violations fixed |
+| v5.6.0 (stable, target) | 73/73 + 80%+ Phase 2 metrics |
+
+## Documentation map
+
+| Doc | Purpose |
+| --- | --- |
+| [README.md](README.md) | User-facing overview |
+| [MILESTONES.md](MILESTONES.md) | **THIS FILE** — strategic roadmap |
+| [IMPLEMENTATION_PLAN.md](IMPLEMENTATION_PLAN.md) | **Tactical roadmap + current state** |
+| [AGENTS.md](AGENTS.md) | Agent entry point + hard constraints |
+| [PROGRESS.md](PROGRESS.md) | Live cross-session state |
+| [DECISIONS.md](DECISIONS.md) | Architectural decisions |
+| [feature_list.json](feature_list.json) | Machine-readable features |
+| [docs/INDEX.md](docs/INDEX.md) | Topic + role-based doc map |
+| [docs/architecture.md](docs/architecture.md) | Layer model + module map |
+| [docs/safety.md](docs/safety.md) | DANGEROUS_PATTERNS reference |
+| [docs/curator.md](docs/curator.md) | Skill curator reference |
+| [docs/graph-tools.md](docs/graph-tools.md) | Knowledge graph tools |
+| [docs/migration-guide.md](docs/migration-guide.md) | OpenCode → Cline upgrade (historical) |
+| [docs/code-review.md](docs/code-review.md) | Code review findings |
+| [docs/decisions/](docs/decisions/) | 10 ADRs |
+
+## See also
+
+- [research/agent-harness-survey/final-reports/06-bizar-improvement-plan.md](research/agent-harness-survey/final-reports/06-bizar-improvement-plan.md) —
+  the 12-item improvement plan this milestone map is derived from
+- https://github.com/walkinglabs/awesome-harness-engineering — the
+  curated list of 200+ agent-harness projects we cross-referenced
+- https://github.com/vercel-labs/agent-browser — the browser
+  automation CLI for AI agents
+- https://docs.claude.com/claude-code — Claude Code documentation

package/.claude/worktrees/kanban-overhaul/Makefile

@@ -0,0 +1,93 @@
+# Bizar Harness — Makefile
+#
+# Single source of truth for agent commands. Every target is idempotent
+# and exits 0 on success. Run `make help` to see all targets.
+#
+# Migrated to Claude Code (v6.3.0). All `cline`-era targets are gone;
+# the harness now consumes Claude Code via the SDK + MCP server under
+# `packages/sdk/`. Plugin lives under `plugins/bizar/` as a thin shim
+# that re-exports the SDK; the previous framework-coupled plugin source
+# has been deleted.
+
+SHELL := /usr/bin/env bash
+.SHELLFLAGS := -eu -o pipefail -c
+.DEFAULT_GOAL := help
+
+# ── Helpers ─────────────────────────────────────────────────────────────────
+help:  ## Show this help message
+	@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z_-]+:.*?## / {printf "  \033[36m%-20s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST)
+
+# ── Setup / dev ─────────────────────────────────────────────────────────────
+setup:  ## Install Claude Code CLI + Bizar deps
+	npm install -g @anthropic-ai/claude-code
+	npm install
+	@echo "✓ Claude Code CLI + Bizar deps installed"
+
+dev:  ## Start dashboard + SDK in dev mode
+	npm run dev
+
+check:  ## Typecheck + lint
+	@echo "▶ Running TypeScript check..."
+	@bunx tsc --noEmit
+	@echo "✓ make check passed"
+
+test:  ## Run all unit tests (sdk + cli)
+	@if command -v bun >/dev/null 2>&1; then \
+		bun test packages/sdk; \
+	else \
+		echo "(bun not found — falling back to vitest via npm)"; \
+		node_modules/.bin/vitest run --root packages/sdk; \
+	fi
+	@node --test cli/install.test.mjs cli/provision.test.mjs cli/worker-dispatcher.test.mjs cli/__tests__/cost-gate.test.mjs cli/__tests__/feature-list-bridge.test.mjs cli/commands/setup-provider.test.mjs cli/commands/rca.test.mjs 2>&1 | tail -5
+
+e2e:  ## End-to-end tests (SDK + Claude Code integration)
+	@echo "▶ E2E: SDK load + tool registration..."
+	@if command -v bun >/dev/null 2>&1; then \
+		bun run scripts/bh-full-e2e.mjs; \
+	else \
+		echo "(bun not found — running e2e with node)"; \
+		node scripts/bh-full-e2e.mjs; \
+	fi
+
+# ── Harness primitives (L07-L12) ────────────────────────────────────────────
+vcr:  ## Verify Code Reality (VCR) check via feature_list.json
+	@echo "▶ Computing VCR ratio from feature_list.json..."
+	@bun -e "const f = JSON.parse(await Bun.file('feature_list.json').text()); const total = f.features.filter(x => x.state !== 'not_started').length; const passing = f.features.filter(x => x.state === 'passing').length; const ratio = total === 0 ? 1.0 : passing / total; console.log('VCR:', passing + '/' + total, '=', ratio.toFixed(3)); if (ratio < 1.0 && total > 0) process.exit(1);"
+
+verify-feature:  ## Verify a feature by ID — usage: make verify-feature ID=F-001
+	@if [ -z "$(ID)" ]; then echo "Usage: make verify-feature ID=<feature-id>"; exit 1; fi
+	@echo "▶ Verifying feature $(ID)..."
+	@bash scripts/verify-feature.sh $(ID)
+
+check-arch:  ## Run architectural constraints (scripts/check-arch.sh)
+	@bash scripts/check-arch.sh .
+
+clean-check:  ## Remove console.log/debugger and run lint
+	@echo "▶ Scanning for console.log / debugger / .only()..."
+	@! grep -rEn '(console\.log|debugger|\.only\()' packages/sdk/src plugins/bizar/index.ts --include='*.ts' --include='*.mjs' 2>/dev/null | grep -v test | grep -v '\.test\.' || (echo "✗ debug artifacts found" && exit 1)
+	@echo "✓ clean-check passed"
+
+# ── Claude Code-specific ───────────────────────────────────────────────────
+# session-start / session-end were Cline-era targets. Claude Code now
+# auto-primes via the SessionStart hook (see .claude/settings.json), so
+# the targets are kept as thin no-op echoes for backward compat.
+session-start:  ## [deprecated] Claude Code auto-primes via SessionStart hook
+	@echo "✓ Claude Code auto-primes via .claude/hooks/sessionstart-prime.mjs"
+
+session-end:  ## [deprecated] Claude Code handles session end automatically
+	@echo "✓ Claude Code handles session end via SessionEnd hook"
+
+init:  ## Run the Claude Code-native initializer
+	@./init.sh --fast
+
+mirror-claude-md:  ## Regenerate .claude/CLAUDE.md mirror from AGENTS.md
+	@./scripts/mirror-claude-md.sh
+
+mirror-claude-md-check:  ## CI check: .claude/CLAUDE.md is in sync with AGENTS.md
+	@./scripts/mirror-claude-md.sh --check
+
+mcp-serve:  ## Run the Bizar MCP server (stdio) for Claude Code
+	@node packages/sdk/dist/mcp/bin.js
+
+# ── Convenience ─────────────────────────────────────────────────────────────
+.PHONY: help setup dev check test e2e vcr verify-feature check-arch clean-check session-start session-end init mirror-claude-md mirror-claude-md-check mcp-serve