@walwal-harness/cli 7.1.17 → 7.1.19

package/HR-Resource/ceo/SKILL.md

@@ -18,7 +18,7 @@ You are the only direct conversation channel with the Owner.
    - CDO: branding, UI/UX direction, mock selection, design review.
    - CTO: architecture, platform, API, account, web/app/backend/frontend wiring.
    - CQO: quality gates, e2e/backtest strategy, regression and archive criteria.
-   - OPS: build/service environment monitoring, port map checks, launch observation, and exception monitoring.
+   - OPS: build/service environment monitoring, CQO verification watch, port map checks, launch observation, production watch, and exception monitoring.
 4. Route completed outputs to the next responsible CXX.
 5. Report outcomes and escalations to the Owner.
 
@@ -34,9 +34,12 @@ You are the only direct conversation channel with the Owner.
 - Before CTO/CDO/OPS allocate runnable services, agree with the Owner on a `{xx}000` base port and write it to project `.env` as `HARNESS_BASE_PORT={xx}000`. Mentioning the value in `ceo.md` is not sufficient.
 - After writing `.env`, verify with `grep '^HARNESS_BASE_PORT=' .env` before routing service work.
 - For service monitoring, collect the Owner's server mapping first: local PC, Docker, VM, AWS/cloud, host, port, health path, log path, and contact/source.
+- For runnable verification, collect or require CTO to record the test runtime mapping before CQO starts evaluator work: command/service name, cwd, host, port, health path if any, log path if any, and owner. OPS must watch that runtime during CQO Playwright/E2E/API/visual/performance/regression checks.
+- CEO must not accept CQO PASS for a runnable product unless OPS has supplied clean verification-watch evidence or an explicit not-applicable reason. Open OPS incidents, missing runtime mapping, missing required logs, service down, or health mismatch block Owner acceptance.
+- After launch, CEO treats OPS production incidents as company events. CEO convenes CTO/CQO/OPS when user-impacting production signals appear; CTO owns recovery, CQO owns regression confirmation, and OPS owns evidence and close criteria.
 - Every CEO and CXX mission document must include an English `## Implementation Notes` section with the required subsections below. CEO must reject CXX reports that omit it.
 - Owner is the final acceptance reviewer, not a tester, QA substitute, debugger, or deployment verifier. CEO must not send "done, please check" reports while core functionality, regression, account setup, browser flows, logs, or runtime health remain unverified by workers.
-- Before requesting Owner acceptance, CEO must collect and summarize CXX-backed completion evidence: CTO implementation evidence, CQO evaluator/tester evidence, and OPS runtime evidence when services are involved. The final Owner report may request acceptance review or business/product judgment, but must not ask the Owner to discover whether the software works.
+- Before requesting Owner acceptance, CEO must collect and summarize CXX-backed completion evidence: CTO implementation evidence, CQO evaluator/tester evidence, and OPS verification-watch/runtime evidence when runnable environments are involved. The final Owner report may request acceptance review or business/product judgment, but must not ask the Owner to discover whether the software works.
 
 ## Required Mission Note Format
 

package/HR-Resource/cqo/SKILL.md

@@ -18,7 +18,7 @@ Own quality, recurrence prevention, and archive eligibility.
 5. Use the `harness-hiring` skill before assigning any task that has no hired worker. Do not complete that task yourself.
 6. Define quality gates and delegate evidence collection to hired workers in fresh sessions.
 7. Monitor repeated issues and promote verified lessons to `.harness/conventions`, `.harness/gotchas`, `.harness/memories`, or `.harness/shared`.
-8. Approve or reject archive based solely on worker-provided evidence.
+8. Approve or reject archive based solely on worker-provided evidence and OPS runtime/watch evidence when the mission uses a runnable environment.
 
 ## Hard Rules
 
@@ -32,13 +32,23 @@ Every evaluator/tester dispatched by CQO must write its report under `.harness/d
 
 **Owner is not the QA tester.** CQO must not approve a handoff that asks the Owner to verify basic functionality, regression safety, browser behavior, account setup, logs, or runtime health. CQO must use evaluator/tester workers to collect the evidence, including E2E/Playwright/browser checks, regression commands, test-account or seeded-data validation, screenshots, logs, and risk notes when relevant. If evidence is missing, CQO verdict is BLOCKED or FAIL, not "ask Owner to check."
 
+**OPS must watch runnable verification.** When CQO evaluator workers run Playwright, E2E, API, visual, accessibility, performance, or regression checks against a local/dev/preview/Docker/cloud runtime, CQO must request OPS monitoring before issuing PASS. CQO must include OPS evidence in `cqo.md` or mark the verdict BLOCKED. A CQO PASS is invalid if OPS reports an open INCIDENT, missing runtime mapping, required log missing, service down, health mismatch, or unmonitored runtime that is part of the tested scenario.
+
+If OPS reports an incident during verification:
+
+1. CQO pauses PASS/Archive judgment.
+2. CQO records which evaluator scenario was affected.
+3. CQO routes impact back to CEO, who convenes CTO/CQO/OPS.
+4. After CTO recovery, CQO reruns affected evaluator scenarios and requires OPS to confirm the runtime is clean.
+
 Required output sections in `cqo.md`:
 
 1. Worker Task Briefs — gate, capability needed, selected evaluator or hiring request, acceptance criteria.
 2. Worker Evidence Manifest — worker name, report path, command or artifact evidence, status.
-3. CQO Verdict — PASS, FAIL, or BLOCKED based only on worker evidence. Must reference Worker Evidence Manifest entries.
-4. Recurrence Notes — accepted gotchas, conventions, memories, or none.
-5. Implementation Notes — in English, with `Design Decisions`, `Deviations`, `Tradeoffs`, and `Open Questions`.
+3. OPS Watch Evidence — ops report path, monitored runtime mapping, incidents/warnings, and whether runtime evidence permits PASS.
+4. CQO Verdict — PASS, FAIL, or BLOCKED based only on worker evidence plus required OPS watch evidence. Must reference Worker Evidence Manifest entries.
+5. Recurrence Notes — accepted gotchas, conventions, memories, or none.
+6. Implementation Notes — in English, with `Design Decisions`, `Deviations`, `Tradeoffs`, and `Open Questions`.
 
 ## Worker Report Note Requirement
 

package/HR-Resource/ops/SKILL.md

@@ -9,9 +9,10 @@ disable-model-invocation: false
 
 Monitor the environments that make the mission runnable.
 
-OPS owns two environment classes:
+OPS owns three environment classes:
 
 - Build environment: command-based local execution such as `flutter run`, `npm run dev`, test watchers, local build scripts, and other foreground/background commands used by CXX workers.
+- Verification environment: the runnable local, preview, Docker, or cloud target used while CQO evaluator workers run Playwright, E2E, API, visual, accessibility, performance, or regression checks.
 - Service environment: an actual server endpoint that can be monitored. The server may be the Owner's local PC, Docker, a VM, AWS, or another cloud/server target. OPS does not invent this mapping; CEO must collect it from the Owner and record it before OPS treats it as live.
 
 OPS is not the implementation owner. CTO/DevOps workers start or change systems; OPS observes whether the declared build/service environments are healthy and raises evidence-backed events.
@@ -21,6 +22,24 @@ OPS must not directly perform DevOps implementation, service fixes, config rewri
 
 Owner is the final acceptance reviewer, not the runtime monitor. OPS must provide build/service evidence through logs, health checks, port checks, process status, and worker-backed recovery reports when needed. Do not ask the Owner to verify that a server is running, a port is correct, or logs are clean; report BLOCKED or INCIDENT to CEO when runtime evidence is missing.
 
+## CQO Verification Watch
+
+OPS must actively watch the runtime while CQO evaluator workers test the product. This is a pre-acceptance gate, not a post-launch nicety.
+
+- Before CQO starts Playwright, E2E, API, visual, accessibility, performance, or regression checks, OPS must confirm the verification environment mapping: command/service name, cwd, host, port, health path if any, log path if any, and owning CXX.
+- During CQO verification, OPS monitors declared build commands and service endpoints for crashes, port drops, health mismatches, log errors, API shape errors, abnormal response codes, and unmapped runtime drift.
+- If OPS finds a non-good-case signal during CQO verification, OPS must record an INCIDENT or WARNING and immediately route the event to CEO with recommended participants: CTO for fix ownership, CQO for test impact, and OPS for evidence.
+- CQO cannot issue PASS for a runnable product while OPS reports an open INCIDENT, missing runtime mapping, missing logs required by the mission, or an unmonitored service that is part of the tested scenario.
+- OPS does not wait for the Owner to notice defects. Owner acceptance starts only after CQO evidence and OPS runtime evidence are both clean, or after CEO explicitly reports remaining operational risk.
+
+## Post-Launch Watch
+
+After service launch, OPS continues the same monitoring duty against `runtime.production.services[]`.
+
+- User-impacting production signals are INCIDENT by default: service down, health check failure, repeated log errors, authentication/API breakage, payment/data-loss risk, severe latency, or critical user journey failure.
+- Repeated incidents must trigger recovery coordination through CEO -> CTO/CQO/OPS. OPS supplies evidence and recovery criteria; CTO owns fixes; CQO owns regression confirmation.
+- OPS may classify resolved events as close candidates only after the monitored endpoint is healthy and logs no longer show the triggering error pattern.
+
 ## Port Policy
 
 - CEO must agree on a `{xx}000` base port with the Owner before CXX services are allocated.
@@ -31,16 +50,17 @@ Owner is the final acceptance reviewer, not the runtime monitor. OPS must provid
 
 ## Workflow
 
-1. Read `.env` and `.harness/config.json runtime.ports`, `runtime.build`, and `runtime.production`.
+1. Read `.env` and `.harness/config.json runtime.ports`, `runtime.build`, `runtime.verification`, and `runtime.production`.
 2. Use the `harness-resource-manager` skill to check available Ops, DevOps, SRE, incident, or evidence-collection workers for monitoring tasks that require execution beyond reading declared status.
 3. Use the `harness-hiring` skill before assigning any missing monitoring or recovery specialty. Do not complete that task yourself.
 4. Monitor build environments declared in `runtime.build.commands[]`: command, cwd, expected port, log path, and owner.
-5. Monitor service environments declared in `runtime.production.services[]`: environment type, host, port, health path, log path, and owner contact/source.
-6. Write daily logs under `.harness/logs/YYYY-MM-DD/` and mission decisions in `.harness/documents/{mission_name}/ops.md`.
-7. Treat good-case success events as optional noise.
-8. Log all non-good-case results: command failed, port down, health mismatch, log missing, missing parameter, API mismatch, crash, abnormal response shape, and deployment exception.
-9. Classify exceptions as build, backend, frontend, platform, external API, infrastructure, owner-config, or unknown.
-10. Raise emergency events to CEO/CTO/CQO with evidence and the mapped environment record.
+5. Monitor verification environments declared in `runtime.verification` or reused from `runtime.build`/`runtime.production` while CQO evaluator workers run tests.
+6. Monitor service environments declared in `runtime.production.services[]`: environment type, host, port, health path, log path, and owner contact/source.
+7. Write daily logs under `.harness/logs/YYYY-MM-DD/` and mission decisions in `.harness/documents/{mission_name}/ops.md`.
+8. Treat good-case success events as optional noise.
+9. Log all non-good-case results: command failed, port down, health mismatch, log missing, missing parameter, API mismatch, crash, abnormal response shape, test-time runtime exception, user-impacting production exception, and deployment exception.
+10. Classify exceptions as verification, build, backend, frontend, platform, external API, infrastructure, owner-config, production, or unknown.
+11. Raise emergency events to CEO/CTO/CQO with evidence and the mapped environment record.
 
 ## Required Output Sections
 
@@ -48,6 +68,8 @@ Owner is the final acceptance reviewer, not the runtime monitor. OPS must provid
 2. Environment Evidence — config path, command/service checked, observed status.
 3. Worker Evidence Manifest — worker name, report path, status for delegated monitoring or recovery tasks.
 4. OPS Event Decision — good-case silence, warning, incident, or emergency escalation.
-5. Implementation Notes — in English, with `Design Decisions`, `Deviations`, `Tradeoffs`, and `Open Questions`.
+5. CQO Verification Watch — whether CQO testing was monitored, runtime mapping used, open incidents, and PASS/BLOCKED implication.
+6. Post-Launch Watch — production services monitored, open incidents, recovery status, or not applicable.
+7. Implementation Notes — in English, with `Design Decisions`, `Deviations`, `Tradeoffs`, and `Open Questions`.
 
 Every OPS worker brief must require the worker to append the same English `## Implementation Notes` block to the bottom of `.harness/documents/{mission_name}/ops/workers/{worker-name}.md`, covering risks, self-corrections, chosen direction, and unresolved questions. Use `None` for empty subsections.

package/README.md

@@ -105,7 +105,7 @@ Owner /submission → CEO → [relevant CXX] → [workers] → [convention updat
 | 7 | No CXX self-execution — deliverables without matching worker records are rejected |
 | 8 | No verdict without worker evidence — CQO self-inspection is not valid |
 | 9 | Hierarchical worker ownership — worker reports live under `.harness/documents/{goal-or-child-mission}/{owning-cxx}/workers/` |
-| 10 | Implementation Notes required — `ceo.md`, every `{cxx}.md`, and every worker report must end with an English `## Implementation Notes` section |
+| 10 | Implementation Notes required — `ceo.md`, every `{cxx}.md`, and every worker report must end with one English `## Implementation Notes` section in the same file |
 
 ### Implementation Notes Format
 
@@ -127,7 +127,7 @@ Every `ceo.md`, `{cxx}.md`, and worker report must end with:
 - What still needs Owner or CXX confirmation
 ```
 
-Use `None` when a subsection has no entries. This section is mandatory even for small or emergency work. CEO must reject any CXX report that omits it. CTO and CQO must not accept worker output that omits it.
+Use `None` when a subsection has no entries. This section is mandatory even for small or emergency work. Do not create a separate sidecar notes file; the notes belong at the bottom of the same role or worker report that produced the decision/evidence. CEO must reject any CXX report that omits it. CTO and CQO must not accept worker output that omits it.
 
 ---
 
@@ -223,6 +223,8 @@ harness-hiring           → register and onboard worker
 
 | Version | Summary |
 |---|---|
+| 7.1.19 | `migrate` now carries OPS verification rules into existing installs: runtime.verification merge, HARNESS refresh, and AGENTS migration block |
+| 7.1.18 | OPS watches CQO runnable verification and production incidents; Implementation Notes stay in the same role/worker report |
 | 7.1.17 | Dashboard: fix /submission and /hot-fix missions displaying as /goal; runtime strip shows live owner command in mission flow tab |
 | 7.1.16 | `migrate` now always fully replaces /goal, /submission, /hot-fix commands regardless of current state |
 | 7.1.15 | Dashboard: reset embedded View Doc state when the selected mission or document target changes |

package/apps/harness-dashboard/lib/__tests__/harness-state.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from "vitest";
-import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { mkdtempSync, mkdirSync, rmSync, utimesSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { readHarnessState } from "../harness-state";
@@ -191,4 +191,60 @@ describe("readHarnessState", () => {
     const snap = readHarnessState(dir);
     expect(snap.archive.all.find((e) => e.dir === "sprint-1")?.result).toBe("PASS");
   });
+
+  it("marks in-place goal document updates as submission only after the owner prompt", () => {
+    const harnessDir = path.join(dir, ".harness");
+    const missionDir = path.join(harnessDir, "documents", "goal-1-auth-system");
+    mkdirSync(missionDir, { recursive: true });
+    writeFileSync(path.join(missionDir, "ceo.md"), "# Auth system\n");
+    const beforePrompt = new Date("2026-05-20T01:00:00Z");
+    utimesSync(missionDir, beforePrompt, beforePrompt);
+
+    writeFileSync(
+      path.join(harnessDir, "progress.json"),
+      JSON.stringify({
+        owner_prompt: {
+          command: "submission",
+          summary: "/submission add SSO",
+          received_at: "2026-05-20T01:05:00Z",
+          status: "routing",
+        },
+      })
+    );
+
+    expect(readHarnessState(dir).missions[0].type).toBe("goal");
+
+    const afterPrompt = new Date("2026-05-20T01:06:00Z");
+    utimesSync(missionDir, afterPrompt, afterPrompt);
+
+    expect(readHarnessState(dir).missions[0].type).toBe("submission");
+  });
+
+  it("keeps explicit submission subdirectories as submission without relabeling the parent goal", () => {
+    const harnessDir = path.join(dir, ".harness");
+    const goalDir = path.join(harnessDir, "documents", "goal-1-auth-system");
+    const submissionDir = path.join(goalDir, "submission-1-add-sso");
+    mkdirSync(submissionDir, { recursive: true });
+    writeFileSync(path.join(goalDir, "ceo.md"), "# Auth system\n");
+    writeFileSync(path.join(submissionDir, "ceo.md"), "# Add SSO\n");
+    utimesSync(goalDir, new Date("2026-05-20T01:00:00Z"), new Date("2026-05-20T01:00:00Z"));
+    utimesSync(submissionDir, new Date("2026-05-20T01:06:00Z"), new Date("2026-05-20T01:06:00Z"));
+
+    writeFileSync(
+      path.join(harnessDir, "progress.json"),
+      JSON.stringify({
+        owner_prompt: {
+          command: "submission",
+          summary: "/submission add SSO",
+          received_at: "2026-05-20T01:05:00Z",
+          status: "routing",
+        },
+      })
+    );
+
+    const missions = readHarnessState(dir).missions;
+    expect(missions[0].missionId).toBe("goal-1-auth-system/submission-1-add-sso");
+    expect(missions[0].type).toBe("submission");
+    expect(missions.find((mission) => mission.missionId === "goal-1-auth-system")?.type).toBe("goal");
+  });
 });

package/apps/harness-dashboard/lib/harness-state.ts

@@ -1091,7 +1091,15 @@ function readMissions(rootDir: string, progress: RawProgress | null = null, limi
   const cmd = progress?.owner_prompt?.command;
   if (missions.length > 0 && (cmd === "submission" || cmd === "hot-fix")) {
     const top = missions[0];
-    if (top.type === "goal") {
+    const ownerPromptReceivedAt = progress?.owner_prompt?.received_at
+      ? new Date(progress.owner_prompt.received_at).getTime()
+      : null;
+    const missionUpdatedAt = new Date(top.ts).getTime();
+    const missionUpdatedAfterPrompt =
+      ownerPromptReceivedAt === null ||
+      Number.isNaN(ownerPromptReceivedAt) ||
+      missionUpdatedAt >= ownerPromptReceivedAt;
+    if (top.type === "goal" && missionUpdatedAfterPrompt) {
       missions[0] = { ...top, type: cmd === "hot-fix" ? "hotfix" : "submission" };
     }
   }

package/assets/templates/AGENTS-ko.md.template

@@ -113,7 +113,7 @@ Owner는 최종 검수자다. Tester, QA worker, debugger, 배포 확인 담당
 - 동작하지 않거나 검증되지 않았거나 부분적으로만 실행되는 소프트웨어를 Owner에게 전달하며 "확인해 주세요"를 다음 액션으로 삼지 않는다.
 - Owner에게 개발자 테스트, 회귀 확인, 계정 생성/로그인 확인, Playwright 확인, E2E 순회, 로그 점검, 기본 기능 검증을 요구하지 않는다.
 - CEO와 CXX는 worker를 통해 자체 검증을 계획하고 실행한다: unit test, E2E test, Playwright/browser check, test account, seed data, build/run check, log evidence.
-- Owner 검수는 CEO가 CXX 완료 기록, CTO 구현 증거, CQO evaluator 증거, 필요한 OPS 런타임 증거를 모아 goal이 실제로 완수되었음을 보인 뒤에만 요청한다.
+- Owner 검수는 CEO가 CXX 완료 기록, CTO 구현 증거, CQO evaluator 증거, 필요한 OPS 검수관제/런타임 증거를 모아 goal이 실제로 완수되었음을 보인 뒤에만 요청한다.
 - 최종 Owner 보고는 acceptance review, 제품 판단, 비즈니스 승인을 요청할 수 있다. 소프트웨어가 동작하는지 발견해 달라고 요청해서는 안 된다.
 
 ## 8. 미션 플로우
@@ -124,6 +124,7 @@ Owner는 최종 검수자다. Tester, QA worker, debugger, 배포 확인 담당
 2. CEO가 관련 CXX에게만 범위를 한정한 질문을 전달한다.
 3. 각 CXX가 worker를 고용하고, 위임하고, 결과를 수집하여 `{cxx}.md`에 기록한다.
 4. CEO가 CXX 산출물을 종합하여 다음 CXX에 라우팅하거나 Owner에게 보고한다.
+5. 실행 가능한 local, preview, Docker, production-like 환경이 포함된 mission이면, CQO evaluator worker가 Playwright/E2E/API/visual/performance/regression 검수를 수행하는 동안 OPS가 해당 runtime을 관제한다.
 
 **완료 기준:** `.harness/documents/goal-{index}-{name}/ceo.md`에 최종 Owner 보고가 존재한다.
 
@@ -174,6 +175,9 @@ Owner는 최종 검수자다. Tester, QA worker, debugger, 배포 확인 담당
 5. **gotcha 등록 생략 금지** — 모든 hot-fix는 `.harness/gotchas/` 또는 `.harness/conventions/`에 최소 하나의 항목을 만든다.
 6. **미션 중 이 파일 편집 금지** — AGENTS.md를 수정하려면 별도 `/goal`을 제출한다.
 7. **Owner는 최종 검수만 수행** — Owner는 tester나 QA 대체자가 아니다. CEO/CXX는 worker-backed verification으로 goal 완료 가능성을 증명하기 전까지 "완료했습니다, 확인해 주세요"라고 보고하지 않는다.
+8. **OPS는 CQO 검수 중 관제한다** — 실행 가능한 제품에서 CQO PASS는 OPS가 검수 runtime을 관제했거나 OPS watch가 불필요한 이유를 기록했을 때만 유효하다. 열린 OPS incident, runtime mapping 누락, 필수 로그 누락, service down, health mismatch, 검수 대상 service 미관제는 Owner acceptance를 막는다.
+9. **Production incident는 회사 이벤트다** — 오픈 후 사용자 영향 OPS signal은 CEO를 통해 CTO/CQO/OPS로 라우팅된다. CTO는 복구, CQO는 회귀 검증, OPS는 증거와 close criteria를 책임진다.
+10. **Implementation Notes는 같은 보고서 하단에 작성** — `ceo.md`, 모든 `{cxx}.md`, 모든 worker report는 하나의 English `## Implementation Notes` 섹션으로 끝나야 한다. 별도 sidecar notes 파일을 만들지 않는다. 결정/증거를 만든 동일한 role 또는 worker report 하단에 `Design Decisions`, `Deviations`, `Tradeoffs`, `Open Questions`를 작성하고 빈 항목은 `None`을 사용한다.
 
 ---
 

package/assets/templates/AGENTS.md.template

@@ -61,7 +61,7 @@ The Owner is the final acceptance reviewer, not a tester, QA worker, debugger, o
 - Do not hand the Owner broken, unverified, or partially runnable software with "please check this" as the next action.
 - Do not ask the Owner to perform developer testing, regression checks, account setup checks, Playwright review, E2E traversal, log inspection, or basic functionality verification.
 - CEO and CXX must plan and execute self-verification through workers: unit tests, E2E tests, Playwright/browser checks, test accounts, seeded data, build/run checks, logs, and documented evidence.
-- Owner inspection happens only after CEO has collected CXX completion records, CTO implementation evidence, CQO evaluator evidence, and any OPS runtime evidence needed to show the goal is genuinely complete.
+- Owner inspection happens only after CEO has collected CXX completion records, CTO implementation evidence, CQO evaluator evidence, and any OPS verification-watch/runtime evidence needed to show the goal is genuinely complete.
 - A final Owner report may ask for acceptance review, product judgment, or business approval. It must not ask the Owner to discover whether the software works.
 
 ---
@@ -74,6 +74,7 @@ The Owner is the final acceptance reviewer, not a tester, QA worker, debugger, o
 2. CEO sends scoped questions to relevant CXX only.
 3. Each CXX hires workers, collects reports, records decisions in `{cxx}.md`.
 4. CEO aggregates CXX outputs, routes to next CXX or reports to Owner.
+5. If the mission uses a runnable local, preview, Docker, or production-like environment, OPS watches the runtime while CQO evaluator workers run Playwright/E2E/API/visual/performance/regression checks.
 
 **Complete when:** `.harness/documents/goal-{index}-{name}/ceo.md` contains a final Owner report.
 
@@ -131,8 +132,10 @@ Note: A docmeta skip decision on harness documents (ceo.md, cto.md, cqo.md, work
 8. **No CXX self-execution** — CXX agents coordinate and manage only. A CXX that produces deliverables without matching worker records has violated its scope. CEO must reject such reports.
 9. **No verdict without worker evidence** — CQO cannot issue ACCEPTED/REJECTED without a Worker Evidence Manifest referencing at least one evaluator worker. Self-inspection by CQO is not valid evidence.
 10. **Hierarchical worker ownership** — Hired workers are installed under `.claude/skills/{owning-cxx}/{worker}/` and `.codex/skills/{owning-cxx}/{worker}/`; mission worker reports live under `.harness/documents/{goal-or-child-mission}/{owning-cxx}/workers/`. Flat `{mission}/workers/` reports are legacy and signal an ownership violation unless explicitly migrated.
-11. **Implementation Notes required** — `ceo.md`, every `{cxx}.md`, and every worker report must end with an English `## Implementation Notes` section containing `Design Decisions`, `Deviations`, `Tradeoffs`, and `Open Questions`. Use `None` for empty subsections.
+11. **Implementation Notes required** — `ceo.md`, every `{cxx}.md`, and every worker report must end with one English `## Implementation Notes` section containing `Design Decisions`, `Deviations`, `Tradeoffs`, and `Open Questions`. Use `None` for empty subsections. Do not create a separate sidecar notes file; the notes belong at the bottom of the same role or worker report that produced the decision/evidence.
 12. **Owner is final acceptance only** — Owner is not a tester or QA substitute. CEO/CXX must not report "done, please check" until worker-backed verification proves the goal can be completed. Use unit tests, E2E, Playwright, test accounts, seeded data, build/run checks, logs, and CQO evidence before requesting Owner acceptance.
+13. **OPS watches CQO verification** — For runnable products, CQO PASS is invalid unless OPS has monitored the verification runtime or documented why OPS watch is not applicable. Open OPS incidents, missing runtime mapping, required log gaps, service down, health mismatch, or an unmonitored tested service block Owner acceptance.
+14. **Production incidents are company events** — After launch, user-impacting OPS signals route through CEO to CTO/CQO/OPS. CTO owns recovery, CQO owns regression confirmation, and OPS owns evidence plus close criteria.
 
 ---
 

package/assets/templates/HARNESS.md

@@ -109,4 +109,4 @@ Flat `.harness/documents/{mission}/workers/` reports are legacy. New worker evid
 - None
 ```
 
-The notes must be written in English. Use `None` when a subsection has no entries.
+The notes must be written in English. Use `None` when a subsection has no entries. Do not create a separate sidecar notes file; keep the notes at the bottom of the same role or worker report that produced the decision/evidence.

package/assets/templates/config.json

@@ -213,6 +213,20 @@
         }
       ]
     },
+    "verification": {
+      "comment": "CQO evaluator 가 Playwright/E2E/API/visual/performance/regression 검수를 수행하는 동안 OPS 가 관제할 runtime mapping. 기본값은 build/production mapping 을 재사용하되, 검수 전 CTO/CQO/OPS 가 실제 command/service, port, health_path, log_path 를 확정해야 한다.",
+      "watch_during_cqo": true,
+      "require_ops_evidence_for_pass": true,
+      "reuse": "build_or_production",
+      "block_pass_on": [
+        "open_incident",
+        "missing_runtime_mapping",
+        "missing_required_log",
+        "service_down",
+        "health_mismatch",
+        "unmonitored_tested_service"
+      ]
+    },
     "play": {
       "comment": "/play-harness 가 실행하는 play mode command. release mode 와 공존할 수 없으며, scripts/play.sh 가 상호 배타 상태를 강제한다.",
       "cwd": ".",

package/bin/init.js

@@ -1204,8 +1204,11 @@ function detectMigrationNeeded() {
     progressLegacyRouting: false,
     configMissingCompanyMode: false,
     configLegacyRouting: false,
+    configRuntimeVerificationMissing: false,
     coreSkillsStale: false,
     hrResourcePoolStale: false,
+    harnessMdStale: false,
+    agentsMissingOpsVerificationRules: false,
     rosterCodexPathsMissing: false,
     resourceIndexCodexWordingMissing: false,
     memoryMissingSystemEntries: [],
@@ -1231,6 +1234,12 @@ function detectMigrationNeeded() {
     }
   }
 
+  const harnessMdPath = path.join(HARNESS_DIR, 'HARNESS.md');
+  const harnessMdTplPath = path.join(PKG_ROOT, 'assets', 'templates', 'HARNESS.md');
+  if (fs.existsSync(harnessMdTplPath) && (!fs.existsSync(harnessMdPath) || fs.readFileSync(harnessMdPath, 'utf8') !== fs.readFileSync(harnessMdTplPath, 'utf8'))) {
+    flags.harnessMdStale = true;
+  }
+
   // Gotcha entry-level diff: for each bundled gotcha file, compare entry IDs.
   // 사용자가 직접 추가한 [G-NNN] 은 절대 건드리지 않으며, 패키지에서 새로
   // 도입된 시스템 entry 만 append 대상.
@@ -1295,6 +1304,9 @@ function detectMigrationNeeded() {
     try {
       const c = JSON.parse(fs.readFileSync(configPath, 'utf8'));
       if (!c.company_mode || c.mode_selection) flags.configMissingCompanyMode = true;
+      if (!c.runtime?.verification?.watch_during_cqo || !c.runtime?.verification?.require_ops_evidence_for_pass) {
+        flags.configRuntimeVerificationMissing = true;
+      }
       if (
         c.behavior?.auto_route_dispatcher !== undefined ||
         c.behavior?.auto_route_dispatcher_description ||
@@ -1303,6 +1315,19 @@ function detectMigrationNeeded() {
       ) flags.configLegacyRouting = true;
     } catch {}
   }
+  const agentsPath = path.join(PROJECT_ROOT, 'AGENTS.md');
+  if (fs.existsSync(agentsPath)) {
+    try {
+      const agentsBody = fs.readFileSync(agentsPath, 'utf8');
+      if (
+        !agentsBody.includes('OPS watches CQO verification') &&
+        !agentsBody.includes('OPS는 CQO 검수 중 관제한다') &&
+        !agentsBody.includes('runtime.verification')
+      ) {
+        flags.agentsMissingOpsVerificationRules = true;
+      }
+    } catch {}
+  }
   if (fs.existsSync(rosterPath)) {
     try {
       const roster = JSON.parse(fs.readFileSync(rosterPath, 'utf8'));
@@ -1410,9 +1435,20 @@ function showMigrationProposal(flags) {
     console.log('  • config.json: company_mode 섹션 동기화 가능');
     console.log('    Owner /goal, /submission, /hot-fix → CEO/CXX/worker 흐름으로 고정합니다.');
   }
+  if (flags.configRuntimeVerificationMissing) {
+    console.log('  • config.json: runtime.verification 섹션 추가 가능');
+    console.log('    CQO 검수 중 OPS runtime watch 와 PASS 차단 조건을 설정합니다.');
+  }
   if (flags.configLegacyRouting) {
     console.log('  • config.json: legacy dispatcher/conductor wording → v7 CEO/CXX wording');
   }
+  if (flags.harnessMdStale) {
+    console.log('  • .harness/HARNESS.md: 최신 패키지 reference 문서로 refresh 가능');
+  }
+  if (flags.agentsMissingOpsVerificationRules) {
+    console.log('  • AGENTS.md: OPS/CQO 검수관제 시스템 규칙 append 가능');
+    console.log('    사용자 규칙은 보존하고 하네스 migration block 만 끝에 추가합니다.');
+  }
   if (flags.coreSkillsStale) {
     console.log('  • .claude/.codex skills: harness-* core skills 최신 패키지로 refresh');
   }
@@ -1475,8 +1511,11 @@ function runMigrate(opts = {}) {
     !flags.progressLegacyRouting &&
     !flags.configMissingCompanyMode &&
     !flags.configLegacyRouting &&
+    !flags.configRuntimeVerificationMissing &&
     !flags.coreSkillsStale &&
     !flags.hrResourcePoolStale &&
+    !flags.harnessMdStale &&
+    !flags.agentsMissingOpsVerificationRules &&
     !flags.rosterCodexPathsMissing &&
     !flags.resourceIndexCodexWordingMissing &&
     (!flags.memoryMissingSystemEntries || flags.memoryMissingSystemEntries.length === 0) &&
@@ -1526,29 +1565,36 @@ function runMigrate(opts = {}) {
     }
   }
 
-  // 2. config.json — inject company_mode from template if missing
+  // 2. config.json — inject company_mode/runtime verification from template if missing
   const configPath = path.join(HARNESS_DIR, 'config.json');
   const tplPath = path.join(PKG_ROOT, 'assets', 'templates', 'config.json');
-  if ((flags.configMissingCompanyMode || flags.configLegacyRouting) && fs.existsSync(configPath) && fs.existsSync(tplPath)) {
+  if ((flags.configMissingCompanyMode || flags.configLegacyRouting || flags.configRuntimeVerificationMissing) && fs.existsSync(configPath) && fs.existsSync(tplPath)) {
     const original = fs.readFileSync(configPath, 'utf8');
     const c = JSON.parse(original);
     const tpl = JSON.parse(fs.readFileSync(tplPath, 'utf8'));
     if (tpl.company_mode) {
-      c.company_mode = {
-        ...tpl.company_mode,
-        comment: 'v7 — 회사모드는 CEO/CXX/worker 문서 흐름으로 운영된다.',
-        owner: 'ceo',
-      };
-      c.harness = tpl.harness || c.harness;
-      c.agents = tpl.agents || c.agents;
-      c.flow = tpl.flow || c.flow;
-      c.behavior = c.behavior || {};
-      c.behavior.auto_route_ceo = c.behavior.auto_route_ceo ?? c.behavior.auto_route_dispatcher ?? true;
-      c.behavior.auto_route_ceo_description = 'true 이면 /goal, /submission, /hot-fix 이후 Owner 입력을 v7 CEO/CXX mission flow 기준으로 안내한다.';
-      delete c.behavior.auto_route_dispatcher;
-      delete c.behavior.auto_route_dispatcher_description;
-      delete c.mode_selection;
-      log('  config.json: v7 CEO/CXX routing 섹션 동기화');
+      if (flags.configMissingCompanyMode || flags.configLegacyRouting) {
+        c.company_mode = {
+          ...tpl.company_mode,
+          comment: 'v7 — 회사모드는 CEO/CXX/worker 문서 흐름으로 운영된다.',
+          owner: 'ceo',
+        };
+        c.harness = tpl.harness || c.harness;
+        c.agents = tpl.agents || c.agents;
+        c.flow = tpl.flow || c.flow;
+        c.behavior = c.behavior || {};
+        c.behavior.auto_route_ceo = c.behavior.auto_route_ceo ?? c.behavior.auto_route_dispatcher ?? true;
+        c.behavior.auto_route_ceo_description = 'true 이면 /goal, /submission, /hot-fix 이후 Owner 입력을 v7 CEO/CXX mission flow 기준으로 안내한다.';
+        delete c.behavior.auto_route_dispatcher;
+        delete c.behavior.auto_route_dispatcher_description;
+        delete c.mode_selection;
+        log('  config.json: v7 CEO/CXX routing 섹션 동기화');
+      }
+      if (flags.configRuntimeVerificationMissing && tpl.runtime?.verification) {
+        c.runtime = c.runtime || {};
+        c.runtime.verification = deepMerge(tpl.runtime.verification, c.runtime.verification || {});
+        log('  config.json: runtime.verification 섹션 동기화');
+      }
       if (!dryRun) {
         fs.writeFileSync(path.join(backupDir, 'config.json'), original);
         fs.writeFileSync(configPath, JSON.stringify(c, null, 2) + '\n');
@@ -1720,7 +1766,50 @@ function runMigrate(opts = {}) {
     }
   }
 
-  // 5. Bundle version stamp — record which package version was last applied.
+  // 5. Refresh package-owned reference doc. This is not user-authored mission state.
+  if (flags.harnessMdStale) {
+    const harnessMdSrc = path.join(PKG_ROOT, 'assets', 'templates', 'HARNESS.md');
+    const harnessMdDest = path.join(HARNESS_DIR, 'HARNESS.md');
+    if (fs.existsSync(harnessMdSrc)) {
+      log('  .harness/HARNESS.md: 최신 reference 문서로 refresh');
+      if (!dryRun) {
+        if (fs.existsSync(harnessMdDest)) {
+          fs.writeFileSync(path.join(backupDir, 'HARNESS.md'), fs.readFileSync(harnessMdDest, 'utf8'));
+        }
+        copyFile(harnessMdSrc, harnessMdDest);
+      }
+    }
+  }
+
+  // 6. AGENTS.md is user/project-facing, so never replace it during migrate.
+  //    Append only a small system migration block when the OPS verification
+  //    rules are absent.
+  if (flags.agentsMissingOpsVerificationRules) {
+    const agentsPath = path.join(PROJECT_ROOT, 'AGENTS.md');
+    if (fs.existsSync(agentsPath)) {
+      const original = fs.readFileSync(agentsPath, 'utf8');
+      const block = [
+        '',
+        '---',
+        '',
+        '## walwal-harness Migration Rules — v7.1.19',
+        '',
+        '- OPS watches CQO verification for runnable local, preview, Docker, or production-like environments.',
+        '- CQO PASS is blocked when OPS reports an open incident, missing runtime mapping, missing required log, service down, health mismatch, or unmonitored tested service.',
+        '- Production incidents are company events routed by CEO to CTO/CQO/OPS: CTO owns recovery, CQO owns regression confirmation, and OPS owns evidence plus close criteria.',
+        '- `ceo.md`, every `{cxx}.md`, and every worker report must keep the English `## Implementation Notes` section in the same file. Do not create a sidecar notes file.',
+        ''
+      ].join('\n');
+      log('  AGENTS.md: OPS/CQO 검수관제 시스템 규칙 append');
+      if (!dryRun) {
+        fs.writeFileSync(path.join(backupDir, 'AGENTS.md'), original);
+        const sep = original.endsWith('\n') ? '' : '\n';
+        fs.writeFileSync(agentsPath, original + sep + block);
+      }
+    }
+  }
+
+  // 7. Bundle version stamp — record which package version was last applied.
   if (flags.bundleVersionStale) {
     const { current, installed } = flags.bundleVersionStale;
     log(`  .bundle-version: ${installed ?? '(none)'} → ${current}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@walwal-harness/cli",
-  "version": "7.1.17",
+  "version": "7.1.19",
   "description": "Company-style AI agent harness for Claude and Codex. Installs commands, CXX agents, skills, HR-Resource hiring pool, and project-local .harness runtime state.",
   "bin": {
     "walwal-harness": "bin/init.js"

package/scripts/harness-user-prompt-submit.sh

@@ -146,7 +146,7 @@ ${CONTEXT_WARNING}
 ## Route
 - pipeline=none/init → harness-ceo 스킬로 Owner /goal, /submission, /hot-fix를 접수하고 mission 문서를 생성
 - 기본 경로는 v7 CXX 회사 루프다: CEO -> COO/CDO/CTO/CQO/OPS -> harness-resource-manager -> harness-hiring -> hired workers -> CXX review -> CEO report
-- CXX는 직접 전문 산출물을 만들지 않고 worker report를 `.harness/documents/{goal-or-child-mission}/{owning-cxx}/workers/`에 남겨야 한다
+- CXX는 직접 전문 산출물을 만들지 않고 worker report를 \`.harness/documents/{goal-or-child-mission}/{owning-cxx}/workers/\`에 남겨야 한다
 - Owner에게 "계속 진행", "진행할까요?", "다음 명령을 입력하세요"를 요구하지 않는다. GOAL이 있고 escalation이 아니면 즉시 next_agent/current_agent 업무를 수행한다
 - Owner 입력은 목표 변경·사고·결과 확인용이지 회사 진행을 펌프하는 신호가 아니다
 - CEO는 필요한 CXX만 호출하고, CXX는 resource-manager/hiring 없이 worker 업무를 수행하지 않는다