@tech-leads-club/harness-toolkit 0.2.1

package/CHANGELOG.md

@@ -0,0 +1,95 @@
+# Changelog
+
+Generated from `docs/decisions/` — do not edit by hand. Run `node tools/render-changelog.ts`.
+
+Each entry is an architectural decision record: what changed, why, what was refused, and what it costs.
+A **Needs your action** line is a change `tlc harness doctor` cannot detect for you; everything else
+doctor reports against your own configuration.
+
+## Unreleased
+
+- **AD-001** — Optional parent-Fast sticky deny for Task spawns
+- **AD-002** — Provider-neutral naming and layout
+- **AD-003** — No backward compatibility
+- **AD-004** — Ports and adapters with an anti-corruption layer per provider
+- **AD-005** — Local test runner is the gate; CI matrix runs on every push
+- **AD-006** — Windows ships in scope, with CI covering the suite and the build
+- **AD-007** — Vendor check applies to core tests; absence checks do not
+- **AD-008** — Biome + TypeScript in the gate; @types/node pinned to the declared floor
+- **AD-009** — Event kinds are provider-agnostic; capabilities are data, not flags
+- **AD-010** — Shared vocabulary moves to src/contracts/
+- **AD-011** — Vendor-specific data belongs to the provider, not to core
+- **AD-012** — Prefer Bun at runtime, keep dist/ for the Node fallback, ship no binary
+- **AD-013** — Documentation follows the Open Knowledge Format (OKF v0.1)
+- **AD-014** — Claude Code hook payload field paths, pinned
+- **AD-015** — Wiring handler names are the entrypoint filenames
+- **AD-016** — Field semantics, state writers, and the core export surface
+- **AD-017** — The docs gate delegates to the project's tool, and the catalog is the only source of capability metadata
+- **AD-018** — Three rails adopted from an external review, each off by default and declared rather than inferred
+- **AD-019** — A resource is identified by what it resolves to, and a declared capability must be read where it matters
+- **AD-020** — One resolution for the install path, one source for posture, and a config that only advertises what it reads
+- **AD-021** — A gate command that never resolved is a config fault, and a recipe runner does not receive file arguments
+- **AD-022** — The policy surface is a floor rule, detection sits behind interception, and the operator/agent line is structural
+- **AD-023** — One finding per failure, and lesson relevance is recurrence rather than exposure
+- **AD-024** — The gate tells the truth about its own environment, its own lock, and the cause of a failure
+- **AD-025** — Posture governs surfacing only, and each posture has exactly one name
+- **AD-026** — An interruption is worth what it costs: narrower asks, a deadline on questions, and a rate the operator can see
+- **AD-027** — Evidence is ordered against the code, every rail's firing is recorded, and a checker can run with its rule off
+  - **Needs your action:** Re-run your verification after the last code change before citing the verdict — the ship gate now refuses evidence written before the code it certifies, so a claim that used to pass can block. Nothing in doctor can see this one; it shows up as a blocked stop.
+- **AD-028** — A resolved failure is kept, a session attests to itself, and provider neutrality becomes a proof
+- **AD-029** — A capability the init skill cannot correctly initialise is not shipped
+- **AD-030** — Clearing a policy divergence is one operator command behind four independent locks, and a refusal never points an agent at a door the floor holds shut
+- **AD-031** — The decisions are the changelog, a breaking change carries its own instruction, and looking never changes anything
+- **AD-032** — A hook is healthy when it can run, not when a marker string is present
+- **AD-033** — The gate says what it costs, appendFiles stops promising what it cannot deliver, and a dead capability leaves
+- **AD-034** — A warning that fires on a healthy install is not a warning, and the author reads the operator's output before anyone else does
+- **AD-035** — A lesson learned by reasoning can be written down, and the harness never learns where lessons come from
+- **AD-036** — A lesson names what makes it true, and stops being injected when that is gone
+- **AD-037** — A lesson can be true for a period, and an unparseable bound withholds it
+- **AD-038** — Promotion counts distinct sessions, because one stuck session is one observation
+- **AD-039** — A lesson is graded by the gate it was injected for, and unproven is not a passing reading
+- **AD-040** — Three lesson tiers, and nothing crosses between products by itself
+- **AD-041** — A member something reads and nothing writes fails the gate
+- **AD-042** — The suite gets an empty runtime home, and one renderer renders a lesson
+- **AD-043** — A standing rule is pinned, not ranked, and the budget says what it dropped
+- **AD-044** — Only an injection a gate could grade can be unproven
+- **AD-045** — A gate verdict is reused when the content hash of its inputs did not change
+- **AD-046** — The runtime path is an artifact, and update never touches what it does not own
+- **AD-047** — An instruction is not an affordance, and a refusal names the route that works
+- **AD-048** — A broken updater cannot deliver its own fix, so the installer is the recovery route
+- **AD-049** — An empty synced file says which of four reasons made it empty
+- **AD-050** — Lesson transport is a provider capability, not an operator preference
+- **AD-051** — A warning fails the gate, and a suppression states what breaks without it
+- **AD-052** — The repository moves to the org and the runtime paths do not
+- **AD-053** — The harness ships no model allowlist, and a list that names nothing enforces nothing
+- **AD-054** — npm is the distribution, and a merged release PR is the only thing that publishes
+- **AD-055** — The changelog is rendered from the decision records, and git says which release each landed in
+- **AD-056** — The package delivers the runtime, and the runtime path stays where hooks already point
+- **AD-057** — The release PR is a mechanism, not a gate, and the bot merges it
+- **AD-058** — Gates diff against the turn's base, and language knowledge is one table
+  - **Needs your action:** If a project has the comment gate on, expect it to start firing on turns that commit and on languages it never covered. Nothing changes in your config.
+- **AD-059** — A rail never writes a field it reads, and a counter reads the plane its events land on
+- **AD-060** — The gate records the environment it ran under, and names it only once the cheap explanations are spent
+- **AD-061** — A decision that refuses names its rule, and degrading preserves it
+- **AD-062** — One command answers whether the harness did that, and says so plainly when it did not
+- **AD-063** — One palette for human output, and a checker keeping it out of everything else
+- **AD-064** — A snapshot is assigned, never accumulated, and a table does not list what it cannot count
+- **AD-065** — The obs bus has a contract, and the gate checks both sides of it
+- **AD-066** — Uninstall reads the artefact, and the plan is the confirmation
+- **AD-067** — A reserved file that cannot be retired is rendered, and the gate holds it there
+- **AD-068** — A directory decides what ships, and dist is derived from disk in both directions
+- **AD-069** — A decision record declares its shape, and cites by link so a move cannot break it
+- **AD-070** — A comment has to read for somebody who was not in the session
+- **AD-071** — The turn's added lines are checked against the code the project already has
+- **AD-072** — A record can leave the corpus, and removing is a change worth recording
+- **AD-073** — A neighbour mid-gate is not a reason to block a turn
+- **AD-074** — Code the gate cannot read is refused, and a credential is not always a file
+- **AD-075** — A dependency a turn adds outlives the turn, so two mechanical failures are worth a stop
+- **AD-076** — Goal-hijack enforcement needs the tool's output, and the host does not deliver it
+- **AD-077** — A command that appears verbatim in fetched content is put to the operator
+- **AD-078** — The two files the harness reads aloud are sealed on write and verified on injection
+- **AD-079** — The coverage claim is a generated page with its gaps in it, not a badge in the README
+- **AD-080** — Every hand-written list of our own rules is now checked, including the one that drifted while writing this
+- **AD-081** — The manifest npm publishes is checked here, because the release runner was the only thing reading it
+- **AD-082** — npm is the documented install, and the first version cannot come from CI
+- **AD-083** — Going public switched the branch ruleset on, and an unattended release needs the App to bypass it

package/LICENSE

@@ -0,0 +1,84 @@
+Copyright 2026 Felipe Rodrigues (https://github.com/felipfr)
+
+Required Notice: Copyright 2026 Felipe Rodrigues (https://github.com/felipfr)
+
+SPDX-License-Identifier: PolyForm-Noncommercial-1.0.0
+
+This software is licensed under the PolyForm Noncommercial License 1.0.0.
+Commercial use requires a separate license from the copyright holder.
+
+---
+
+# PolyForm Noncommercial License 1.0.0
+
+<https://polyformproject.org/licenses/noncommercial/1.0.0>
+
+## Acceptance
+
+In order to get any license under these terms, you must agree to them as both strict obligations and conditions to all your licenses.
+
+## Copyright License
+
+The licensor grants you a copyright license for the software to do everything you might do with the software that would otherwise infringe the licensor's copyright in it for any permitted purpose.  However, you may only distribute the software according to [Distribution License](#distribution-license) and make changes or new works based on the software according to [Changes and New Works License](#changes-and-new-works-license).
+
+## Distribution License
+
+The licensor grants you an additional copyright license to distribute copies of the software.  Your license to distribute covers distributing the software with changes and new works permitted by [Changes and New Works License](#changes-and-new-works-license).
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the software from you also gets a copy of these terms or the URL for them above, as well as copies of any plain-text lines beginning with `Required Notice:` that the licensor provided with the software.  For example:
+
+> Required Notice: Copyright Yoyodyne, Inc. (http://example.com)
+
+## Changes and New Works License
+
+The licensor grants you an additional copyright license to make changes and new works based on the software for any permitted purpose.
+
+## Patent License
+
+The licensor grants you a patent license for the software that covers patent claims the licensor can license, or becomes able to license, that you would infringe by using the software.
+
+## Noncommercial Purposes
+
+Any noncommercial purpose is a permitted purpose.
+
+## Personal Uses
+
+Personal use for research, experiment, and testing for the benefit of public knowledge, personal study, private entertainment, hobby projects, amateur pursuits, or religious observance, without any anticipated commercial application, is use for a permitted purpose.
+
+## Noncommercial Organizations
+
+Use by any charitable organization, educational institution, public research organization, public safety or health organization, environmental protection organization, or government institution is use for a permitted purpose regardless of the source of funding or obligations resulting from the funding.
+
+## Fair Use
+
+You may have "fair use" rights for the software under the law. These terms do not limit them.
+
+## No Other Rights
+
+These terms do not allow you to sublicense or transfer any of your licenses to anyone else, or prevent the licensor from granting licenses to anyone else.  These terms do not imply any other licenses.
+
+## Patent Defense
+
+If you make any written claim that the software infringes or contributes to infringement of any patent, your patent license for the software granted under these terms ends immediately. If your company makes such a claim, your patent license ends immediately for work on behalf of your company.
+
+## Violations
+
+The first time you are notified in writing that you have violated any of these terms, or done anything with the software not covered by your licenses, your licenses can nonetheless continue if you come into full compliance with these terms, and take practical steps to correct past violations, within 32 days of receiving notice.  Otherwise, all your licenses end immediately.
+
+## No Liability
+
+***As far as the law allows, the software comes as is, without any warranty or condition, and the licensor will not be liable to you for any damages arising out of these terms or the use or nature of the software, under any kind of legal claim.***
+
+## Definitions
+
+The **licensor** is the individual or entity offering these terms, and the **software** is the software the licensor makes available under these terms.
+
+**You** refers to the individual or entity agreeing to these terms.
+
+**Your company** is any legal entity, sole proprietorship, or other kind of organization that you work for, plus all organizations that have control over, are under the control of, or are under common control with that organization.  **Control** means ownership of substantially all the assets of an entity, or the power to direct its management and policies by vote, contract, or otherwise.  Control can be direct or indirect.
+
+**Your licenses** are all the licenses granted to you for the software under these terms.
+
+**Use** means anything you do with the software requiring one of your licenses.

package/NOTICE

@@ -0,0 +1,9 @@
+Copyright 2026 Felipe Rodrigues (https://github.com/felipfr)
+
+Required Notice: Copyright 2026 Felipe Rodrigues (https://github.com/felipfr)
+
+Licensed under the PolyForm Noncommercial License 1.0.0. See LICENSE.
+
+- Noncommercial use, modification, and distribution are permitted.
+- Keep these notices and the license terms with distributed copies.
+- Commercial use requires a separate license from the copyright holder.