@uzysjung/agent-harness 26.156.0 → 26.158.0

package/dist/trust-tier-drift.js

@@ -17,7 +17,7 @@ import {
   init_esm_shims,
   residentCost,
   resolveBundleRoot
-} from "./chunk-PPJUFG53.js";
+} from "./chunk-HHCNPPGS.js";
 
 // src/trust-tier-drift.ts
 init_esm_shims();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uzysjung/agent-harness",
-  "version": "26.156.0",
+  "version": "26.158.0",
   "description": "Curate vetted AI-coding skills & plugins by your tech stack — install only what you need, across Claude Code, Codex, OpenCode & Antigravity",
   "type": "module",
   "publishConfig": {

package/templates/rules/test-policy.md

@@ -6,6 +6,16 @@ belongs to the Delivery rule.
 - An ordinary change gets the repository's baseline CI and regression across the affected scope;
   independent verification only where the Delivery rule requires it. A high-risk one widens that in
   proportion to what it touches and what its failure would cost.
+- Preserve required outcomes with the least burdensome reliable protection.
+  Prefer fixing the cause and reusing or improving existing mechanisms within scope;
+  no new guard is needed when those suffice. Judge safeguards by credible risk,
+  the assurance they add, and total effort, not request emphasis, incident counts,
+  or the number or subject of checks. Tests of safeguards follow the same standard.
+  Reuse valid evidence and recheck affected claims when relevant conditions change.
+  Within project policy, adapt methods to demonstrated model and tool capabilities
+  while preserving acceptance criteria, required gates, and authority boundaries.
+  Finish optional verification when required outcomes have sufficient evidence
+  and residual risk is within the project's accepted limits.
 - High-risk includes at least authentication, authorization, payments and settlement, personal
   data, data integrity, concurrency, state transitions, and migrations.
 - Full regression, full E2E, full mutation, and periodic security scanning belong to the CI/CD
@@ -16,5 +26,7 @@ belongs to the Delivery rule.
   the result. Otherwise, use explicit test doubles or contract tests.
 - Never use unauthorized production personal data, credentials, or secrets in tests.
 - Do not hide failures by weakening assertions, deleting or skipping tests, excluding coverage, or
-  adding indiscriminate retries. Change tests only when the intended behavior has changed.
+  adding indiscriminate retries. Correct or consolidate tests when their expectations are
+  wrong, obsolete, or redundant; preserve coverage of the accepted contract and follow project
+  policy for changes to mandatory gates.
 - If the affected scope cannot be established confidently, broaden the validation.

package/templates/skills/audit-harness-fit/references/audit.md

@@ -107,6 +107,24 @@ for consequential context gaps supported by repeated questions, repository evide
 or a concrete blocked task. Supplement only the actionable information needed to
 resolve the gap, using established references where possible.
 
+Look for guard proliferation where checks duplicate assurance, constrain incidental
+wording or implementation details, or repeatedly confirm another safeguard's
+existence without protecting a consequential outcome. A check's subject, nesting
+depth, or lack of recorded incidents is a review signal, not a removal rule.
+
+For a candidate, identify the required outcome or constraint and the meaningful
+coverage, independence, diagnosis, or recovery value it adds beyond existing
+protection. Consider fixing the cause, repairing or consolidating existing checks,
+replacing a mechanism, narrowing its scope, or retiring it rather than following
+an escalation or downgrade ladder.
+
+Compare the retained quality and credible risk with setup, execution, context,
+false-alarm, review, and maintenance effort. Use qualitative judgment when it
+settles the choice; measure or propose a bounded trial only for uncertainty that
+could change the decision. State unsupported assumptions rather than inventing
+incident probabilities or cost estimates. For consolidation or retirement,
+explain how still-required protection remains covered, or why it is no longer needed.
+
 Choose **keep / rewrite / narrow / supplement / merge / relocate / retire / defer**.
 A useful tool can remain while its wrapper or routing changes. Equivalent content
 under the same scope can establish duplication without an incident or benchmark.

package/templates/skills/audit-harness-fit/references/verification.md

@@ -52,6 +52,21 @@ its assertions and conditions actually support each. Separate targets do not by
 themselves require separate runs or separate reviewers. Add checks for evidence gaps,
 credible risk, or applicable policy; required review independence is a separate issue.
 
+For a new or materially changed executable safeguard, use proportionate evidence
+that it accepts valid operation and detects the relevant violation. Existing tests,
+controlled counterexamples, or another reliable method may suffice. A failing run
+supports the claim only if it fails for the intended reason.
+
+When a check can pass without exercising its intended scope, distinguish that
+condition from a meaningful pass where the contract requires coverage. A known
+violation can exercise detection without proving real-target discovery or required
+execution.
+
+Prefer existing test and execution mechanisms to a new supervisory layer.
+Retain tests of safeguards when they close a meaningful evidence gap; adding a
+check alone creates no need for another. Apply the evidence-reuse, invalidation,
+and stopping guidance below.
+
 Identify binding tests and independent-review gates from their policy / CI source.
 Explicit project policy can bind even without CI enforcement. Preserve those gates;
 route disproportionate mandatory requirements to a separate policy decision. Retain

package/templates/skills/recurrence-prevention/SKILL.md

@@ -3,9 +3,10 @@ name: recurrence-prevention
 description: >-
   When the same defect, mistake, or incident happens AGAIN — a recurrence, not a one-off — verify
   it against prior evidence (memory, rule 근거 links, git/CHANGELOG history), classify it as a
-  simple slip vs a complex harness problem, then escalate the countermeasure one level up the
-  ladder: record (1st) → forced rule with linked priors (2nd) → structural gate — test, hook, or
-  derive — once prose has failed (3rd+). Complex problems get countermeasure candidates designed
+  simple slip vs a complex harness problem, then re-evaluate the countermeasure that failed:
+  repair or replace it, choosing a record, a one-line criterion, a code fix, or a structural gate
+  (test, hook, derive) by evidence — more deterministic when prose has demonstrably failed,
+  nothing new when repair suffices. Complex problems get countermeasure candidates designed
   by a multi-persona panel instead of a quick patch. Use for "재발했어", "같은 실수 또 했네",
   "이거 저번에도 그랬잖아", "재발방지 대책 등록해줘", "재발방지 룰 만들어", "this happened again",
   "same bug as last time", "add a recurrence countermeasure", "postmortem this failure". Do NOT use
@@ -18,15 +19,18 @@ description: >-
 A defect that happens once is a bug. A defect that happens **twice is a countermeasure failure** —
 whatever was supposed to prevent the second occurrence (a mental note, a memory entry, a rule)
 demonstrably did not. So on a recurrence, the unit of work is not the fix (you already know the
-fix — you applied it last time). The unit of work is the **countermeasure**, and the core move is:
-**escalate it one level, because the current level just failed.**
+fix — you applied it last time). The unit of work is the **countermeasure**: re-evaluate the cause
+analysis and whatever was supposed to prevent this, repair or replace it, and reach for a more
+deterministic mechanism only when repairing the existing one cannot suffice. **A recurrence is
+evidence for that re-evaluation, not an order to add a level.**
 
 This skill codifies a practice proven in the harness repo that ships it: the no-false-ship rule
 was created only after the *third* false-ship incident; CHANGELOG drift survived a written
 convention for seven releases and stopped only when a test gate enforced it; comment warnings
 against hardcoded-list drift failed twice before "derive to a single source" became mandatory.
-The pattern is consistent: **each enforcement level fails in a characteristic way, and the answer
-is the next level up — not a louder version of the same level.**
+The pattern is consistent: **each enforcement level fails in a characteristic way, and when one
+has demonstrably failed the answer is usually a more deterministic mechanism — not a louder
+version of the same level, and not a new mechanism when the existing one can be repaired.**
 
 ## When to use
 
@@ -89,7 +93,7 @@ For the capture checklist (what to write down about the failure so the next coun
 | Correct behavior | Known, agreed, undisputed | Disputed, unclear, or trade-off-laden |
 | Why it recurred | Wasn't followed: forgot, skipped, overlooked | The countermeasure itself was wrong/insufficient, or cause spans components |
 | Typical examples | Forgot a checklist step; committed a forbidden file; skipped a verification | A "verified" path that still shipped broken; drift between N surfaces; a gate that passes while the behavior fails |
-| Path | **Escalation ladder** (Step 3a) | **Multi-persona countermeasure design** (Step 3b) |
+| Path | **Choose the countermeasure level** (Step 3a) | **Multi-persona countermeasure design** (Step 3b) |
 
 Two quick discriminators:
 - Could you write the corrective rule in one sentence right now, with confidence nobody would
@@ -103,21 +107,22 @@ When the classification itself is unclear, the cause taxonomy in
 policy · coordination · loop) usually decides it: a `logic`/`state` cause with agreed correct
 behavior is a slip; a `policy`/`coordination` cause is almost always the complex path.
 
-## Step 3a — Simple slip: the escalation ladder
+## Step 3a — Simple slip: choose the countermeasure level
 
-Enter the ladder at the level matching the count. **Never enter above your count** — a gate for a
-first-time slip is gate inflation, and every gate is permanent maintenance + false-positive cost.
-(Two exceptions. Downward-honest: a **registered countermeasure that failed** counts that failure
-at its own level — a violated Level-1 rule at count 2 legitimately escalates to Level 2. And
-cost-driven: the Level 1 pre-flight below sends a count-2 slip straight to Level 2 when the wrong
-action is deterministically detectable, because a gate is the *cheaper* artifact, not the stronger
-one.)
+The levels below are **options ordered by determinism, not a mandatory sequence**. The count is
+evidence of how far the current countermeasure has failed; it does not select the level by itself.
+Choose the least burdensome option that reliably prevents the cause: repair or replace the failed
+countermeasure first; prefer a gate when prose has demonstrably failed or when the wrong action is
+deterministically detectable (a gate is then the *cheaper* artifact, not the stronger one); and
+let credible risk, not the count, justify protection — a concrete irreversible-damage path earns a
+gate at count 0, while a first-time slip with no credible risk earns none (every gate is permanent
+maintenance + false-positive cost).
 
-| Level | When | Countermeasure | Characteristic failure of this level |
+| Level | Typical evidence (a signal, not a trigger) | Countermeasure | Characteristic failure of this level |
 |---|---|---|---|
 | **0 기록** | 1st occurrence | Fix + durable record: memory/lessons entry with **Why** it matters and **How to apply**, or an occurrence link on a related rule's 신설 근거 line if one already exists | Records don't steer — nothing re-reads them at the decision moment |
 | **1 룰 강제 등록** | 2nd occurrence (the record failed) | Register a forced rule on the project's **always-loaded steering surface**, using the template below — one-line principle + a one-line "신설 근거" with links to each occurrence. `.claude/rules/<name>.md` (Claude Code) or a rules section in `AGENTS.md` (other CLIs) — and **verify it actually loads**: if the always-loaded context (CLAUDE.md / AGENTS.md) doesn't already pull that location in, reference the rule from it. A rule file nothing loads is still Level 0 with extra steps. **Shape**: the *minimum condition* that prevents the failure — what must be true, not how to do it — stated in positive form; a prohibition only where the damage is irreversible | Prose can be skimmed, forgotten under context pressure, or rationalized around |
-| **2 구조적 게이트** | 3rd+ occurrence, **or** a registered countermeasure failed — bypassed *or* followed as designed yet insufficient | Deterministic enforcement that does not depend on the agent reading anything: a test gate that fails CI, a pre-action hook that blocks the command (where the CLI supports hooks), or **derive-to-single-source** so the drift is structurally impossible. **Shape**: one level up means *more deterministic*, not *more forbidden* — the gate checks a result and leaves the model's judgment where no check can express it | Gates that never demonstrably fire; gates so noisy they get bypassed |
+| **2 구조적 게이트** | 3rd+ occurrence, **or** a registered countermeasure failed — bypassed *or* followed as designed yet insufficient | Deterministic enforcement that does not depend on the agent reading anything: a test gate that fails CI, a pre-action hook that blocks the command (where the CLI supports hooks), or **derive-to-single-source** so the drift is structurally impossible. **Shape**: a stronger countermeasure means *more deterministic*, not *more forbidden* — the gate checks a result and leaves the model's judgment where no check can express it | Gates that never demonstrably fire; gates so noisy they get bypassed |
 
 Load-bearing principle at Level 2: **comment warnings and doc reminders are not a blocking
 mechanism.** If the countermeasure's effect depends on someone (human or model) reading prose at
@@ -140,10 +145,10 @@ every install, forever**, while a gate costs CI time and **zero** standing conte
 questions in order and stop at the first that decides:
 
 1. **Can the wrong action be detected deterministically?** — a failing test, a hook that exits
-   non-zero, a derive that deletes the duplicated list. If yes, **write the gate instead, even at
-   count 2.** This is the one sanctioned way to enter above your count, and it is not gate
-   inflation: you are not buying stronger enforcement than the count justifies, you are picking
-   the cheaper artifact for the same enforcement. Code answers what code can answer.
+   non-zero, a derive that deletes the duplicated list. If yes, **write the gate instead of a
+   rule.** That is not gate inflation: you are not buying stronger enforcement than the risk
+   justifies, you are picking the cheaper artifact for the same enforcement. Code answers what
+   code can answer.
 2. **Would the rule change behaviour that would otherwise be wrong?** If the corrective principle
    is something a competent agent does anyway, or it restates a rule that already exists, it buys
    nothing and bills every session. Stay at Level 0.
@@ -185,7 +190,8 @@ irreversible damage or a protected gate; otherwise state the condition and leave
 
 1. 즉시 정정 보고 (무엇이 어떻게 위반이었는지 명시)
 2. 발생을 이슈·ADR 에 기록하고 durable memory 에 추가한 뒤, 위 근거 줄의 횟수와 링크를 올린다
-3. 재위반이면 구조적 게이트(테스트/훅/derive)로 승격 — 프로즈는 이미 두 번 실패했다
+3. 재위반이면 원인 분석과 이 룰을 재평가한다 — 룰을 고쳐 충분하면 거기서 끝내고, 프로즈가 실제로
+   실패한 것이면 결정론적 장치(테스트/훅/derive)로 대체한다
 ```
 
 The 근거 line is not decoration — it is the recurrence counter for the *next* occurrence, and it
@@ -210,10 +216,10 @@ for mechanics — run 3-5 personas in parallel, independently, then synthesize):
 Synthesize into 2-3 concrete countermeasure options with costs, and present them as a decision
 (recommendation first, ASIS→TOBE contrast — see `user-centered-explanation` if bundled). The
 chosen option still lands on the ladder: it becomes a record, a rule, or a gate — the panel decides
-*what* the countermeasure is, the ladder decides *how hard* it is enforced. The
-never-above-your-count guard governs slips with no failed countermeasure; here, a prior
-countermeasure that fired as designed and still failed already justifies landing one level above
-it (a failed Level-1 rule → a Level-2 gate is escalation, not inflation).
+*what* the countermeasure is, the evidence decides *how deterministic* it must be. A prior
+countermeasure that fired as designed and still failed is evidence that repairing it is not
+enough, which justifies a more deterministic mechanism (a failed rule → a gate); it is not a
+mandate to add one — replacing the failed mechanism is the default, stacking a new one on top is not.
 
 When choosing among the panel's options, compare them on prevention strength, false-positive rate,
 standing context cost, **per-run speed cost** (time, rounds, and questions added to every task),
@@ -232,7 +238,7 @@ would be a false ship. Before closing:
   test gate or derive.
 - **Derive/single-source**: show the duplicated site is gone (grep returns one definition).
 - **Rule (prose)**: not mechanically verifiable — say so explicitly ("등록됨, 준수는 미검증").
-  That honesty is what justifies escalating to Level 2 if it recurs anyway.
+  That honesty is what justifies replacing it with a deterministic mechanism if it recurs anyway.
 
 ## Output format — 재발방지 보고
 
@@ -278,7 +284,8 @@ before creating them. Level 0 records need no confirmation.
   of prohibitions either routes around it or freezes. Write the state that must hold; reserve
   prohibitions for irreversible damage and protected gates.
 - **Same-level retry** — responding to a recurrence by rewriting the same rule more emphatically
-  (CAPS, "NEVER", repetition). The level failed, not the wording. Escalate.
+  (CAPS, "NEVER", repetition). The level failed, not the wording — repair it if it can be
+  repaired, otherwise replace it with a more deterministic mechanism.
 - **Inflating the count** — when no prior artifact can be found, record this as the first confirmed
   occurrence rather than borrowing a remembered one to reach count 2.