@walwal-harness/cli 7.1.56 → 7.1.58

package/HR-Resource/hiring/SKILL.md

@@ -9,6 +9,8 @@ disable-model-invocation: false
 
 Hire workers from `.harness/shared/HR-Resource/`.
 
+At effective S, CTO/CQO execute directly and do not hire. COO/CDO deliverables remain worker-backed at every tier. At S/M, OPS observes directly and hires only for recovery or monitoring setup. A role whose `{cxx}.md` is `## Not Applicable` hires nobody.
+
 ## Required Inputs
 
 - requester
@@ -27,13 +29,13 @@ Hire workers from `.harness/shared/HR-Resource/`.
 5. Update `.harness/shared/hr-roster.json` without deleting existing hired entries. Record `owner` as the owning CXX, `skillPath` as `.harness/shared/HR-Resource/{name}/SKILL.md`, and `skillPaths.claude` / `skillPaths.codex` as tool-specific hierarchical installed paths.
 6. The owning CXX must write worker reports under `.harness/documents/{mission}/{owning-cxx}/workers/{name}.md`. Do not write flat `.harness/documents/{mission}/workers/{name}.md` except when migrating legacy missions.
 7. Ask the `harness-resource-manager` skill to update trigger wording.
-8. Return worker name, owner, declared model, source skill path, installed paths, mission report path, invocation wording, related convention/gotcha links supplied by the owning CXX, and the mandatory report appendix below.
+8. Return worker name, owner, declared model, source skill path, installed paths, mission report path, invocation wording, related convention/gotcha links supplied by the owning CXX, and the instruction to fill the seeded report.
 
 ## Worker Rule Links
 
 Every hired worker receives the owning CXX's relevant convention/gotcha links in the worker brief. Workers read those linked topic files only when they match the assigned task.
 
-Requirements the owning CXX must satisfy and that its worker must also satisfy are copied into the brief **verbatim** — the browser-automation clause, the report skeleton, the `## Lessons Tally` line, the `## Implementation Notes` block. A rule stated one layer above the layer that executes it does not apply. Reject a hire request whose brief omits them.
+**Worker brief:** name the seeded report path and instruct the worker to fill its existing sections incrementally. Do not copy the report skeleton, Tally, or Notes block into the brief. Continue to pass relevant corpus links and copy behavioral requirements absent from the seed (including the browser-automation clause) verbatim. Reject briefs missing the seeded report path or applicable behavioral requirements.
 
 ## Declared Model
 
@@ -47,24 +49,6 @@ The owning CXX creates `.harness/documents/{mission}/{owning-cxx}/workers/{name}
 
 ## Mandatory Worker Report Appendix
 
-Every hired worker must append this English section to the bottom of its existing report:
-
-```
-## Implementation Notes
-
-### Design Decisions
-- ...
-
-### Deviations
-- ...
-
-### Tradeoffs
-- ...
-
-### Open Questions
-- ...
-```
-
-The appendix must summarize risks, self-corrections, and chosen direction. Use `None` when a subsection has no entries.
+The mandatory appendix already exists in the seed template. Return its report path and require the worker to fill risks, self-corrections, chosen direction, and unresolved questions in the existing four Notes subsections (`None` when empty). Do not copy the template into the assignment.
 
 Never mark a missing worker as available.

package/HR-Resource/ops/SKILL.md

@@ -24,15 +24,25 @@ OPS must not directly perform DevOps implementation, service fixes, config rewri
 
 ### Lessons Before Plan
 
+At effective tier S/M, role documents may replace Lessons Preflight + Lessons Tally with `## Lessons` containing `Preflight: <applicable items and why>` (before work) and `Fired: <items or 0 fired>` (at completion). `## Implementation Notes` may contain concise bullets. At L, keep the full role format below. All worker reports retain the full seeded format at every tier.
+
 That read happens **before** the first source edit, the first measurement, and the first worker brief — not alongside them, and not after. The corpus is rarely the problem; the ordering is. Then, in `ops.md`, write:
 
 - `## Lessons Preflight` — which convention/gotcha items apply to this mission and why, named by id or heading. Written before any worker is dispatched. If the corpus genuinely has nothing for this topic, say so explicitly.
 - `## Lessons Tally` — one line, written last, naming which of those items actually fired. **`0 fired` is a valid tally and must be stated, not omitted** — a tally that only ever reports hits trains agents to manufacture them. Place it immediately before `## Implementation Notes`.
 
-**Propagate verbatim.** Any requirement this skill places on OPS that its workers must also satisfy — the linked corpus items, the browser-automation clause, the seeded report skeleton, the `## Lessons Tally` line, the `## Implementation Notes` block — is copied **word for word** into every worker brief. *A rule stated one layer above the layer that executes it does not apply,* and a worker cannot infer a rule it was never given.
+**Worker brief:** name the seeded report path and instruct the worker to fill its existing sections incrementally. Do not copy the report skeleton, Tally, or Notes block into the brief. Continue to pass relevant corpus links and copy behavioral requirements absent from the seed (including the browser-automation clause) verbatim.
 
 Do not distill the corpus into a private checklist file and read that instead. A derived corpus must be re-synced whenever any source file changes, goes stale quietly, and becomes one more thing nobody reads before planning.
 
+## When OPS Reports
+
+OPS reports only when summoned, and CEO summons OPS only when a long-lived runtime is in play: dev server, Docker, preview, cloud, device, or production service. Unit tests, builds, linters, and other self-exiting commands need no OPS; CQO records `OPS N/A: <reason>` instead and no `ops.md` is written.
+
+- **Summoned, nothing to watch:** write `ops.md` with only `## Not Applicable` and one reason line. No worker, Lessons, or Implementation Notes. The completion gate accepts it.
+- **Effective S/M:** OPS records Environment Evidence and CQO Verification Watch directly from logs, health, ports, and processes, without hiring a worker. Hire only for recovery or monitoring setup. Lessons/Notes may be compact.
+- **L:** the full worker-backed format below.
+
 ## CEO-Approved Operations
 
 OPS must not ask the Owner to approve routine monitoring operations. OPS proposes a default to CEO, and CEO decides.
@@ -79,12 +89,21 @@ After service launch, OPS continues the same monitoring duty against `runtime.pr
 - Repeated incidents must trigger recovery coordination through CEO -> CTO/CQO/OPS. OPS supplies evidence and recovery criteria; CTO owns fixes; CQO owns regression confirmation.
 - OPS may classify resolved events as close candidates only after the monitored endpoint is healthy and logs no longer show the triggering error pattern.
 
+## Reachability, Not Just Reading
+
+Lazy loading is a **promise about reachability**. When you register a convention or gotcha, declare every role that should be able to find it — `<!-- roles: cto, cqo -->` at the top of a topic file, or `- **Roles**: cto, cqo` inside an index entry — and link it from **each** of those roles' index files, not only your own.
+
+**The failure is filing under yourself.** Registration feels complete because the entry is indexed; it just is not where its declared readers are told to look. Measured on a live corpus: 69 items, **10 unreachable role-routings, 7 of them invisible to a role the entry itself named.** An agent that follows the reading rule exactly still never sees them — the rule stops narrowing the search and starts hiding the entry.
+
+Verify with `bash scripts/harness-corpus-reachability.sh . text` (add `--fix` to link what is missing). This runs at the completion gate, so an unreachable corpus blocks the mission from closing.
+
 ## Instrument Validity
 
 OPS supplies most of the harness's negative evidence — "no crash", "no error in the log", "health stayed green" — so OPS owns proving the instrument could have seen the failure.
 
 - Every claim of the form "nothing bad happened" ships with a **positive control that fired in the same run** and varied the exact variable under suspicion. Without one, report the observation as unverified, not clean.
 - **Read dependency-supplied filtering from source and quote it** — package, version, file, line range — instead of inferring it from what appeared in the log. Log middleware, dev servers, proxies, and test runners routinely drop successful or sub-threshold requests at a log level nobody chose deliberately, and that rule appears nowhere in the project's own code.
+- A summary statistic is published **with its `n`**, and a spiky series is characterised by **percentiles, never min–max** — a range is the two least representative points in the set, and reads as a finding.
 - Record the instrument in Environment Evidence: what tool observed the runtime, at what log level, with what filter, and what the control was. An unrecorded instrument makes every negative result from that run unusable.
 
 ## Port Policy
@@ -141,7 +160,13 @@ OPS must not accept worker plans or reports that omit this requirement when brow
 8. Lessons Tally — one line naming which preflight items actually fired. `0 fired` is valid and must be stated.
 9. Implementation Notes — in English, with `Design Decisions`, `Deviations`, `Tradeoffs`, and `Open Questions`.
 
-Every OPS worker brief must require the worker to append the same English `## Implementation Notes` block to the bottom of `.harness/documents/{mission_name}/ops/workers/{worker-name}.md`, covering risks, self-corrections, chosen direction, and unresolved questions. Use `None` for empty subsections.
+Every OPS worker brief must point to the seeded report and require filling its existing English `## Implementation Notes` block to the bottom of `.harness/documents/{mission_name}/ops/workers/{worker-name}.md`, covering risks, self-corrections, chosen direction, and unresolved questions. Use `None` for empty subsections.
+
+## The Document Is The Record
+
+A conclusion you hold but have not written into `ops.md` **is not held by the company.** Before reporting any state change — to CEO, to a peer CXX, to the Owner — reconcile it in your own document *and* in `progress.json`. Strike and correct in place; never delete the superseded line, because a reader arriving later needs to see that it was superseded rather than never written.
+
+Check your document against your peers' documents, not only against itself. The cheap version of this failure is a deliverable table that contradicts three messages you already sent. The expensive version was measured: a completed step reported and accepted, never written to the state file, and an orchestration loop that went on trying to spawn it **70 times**.
 
 ## Worker Spawn Contract
 

package/HR-Resource/resource-manager/SKILL.md

@@ -22,7 +22,7 @@ Manage worker availability and invocation wording.
 
 1. Check whether the requester is a CXX. CEO cannot request specialist worker assignment directly.
 2. Check whether a suitable worker is already hired for that owning CXX.
-3. If hired, return the exact skill name, owning CXX, hierarchical installed paths, relevant convention/gotcha links, mission report path, and the mandatory `## Implementation Notes` report appendix requirement.
+3. If hired, return the exact skill name, owning CXX, hierarchical installed paths, relevant convention/gotcha links, mission report path, and the instruction to fill the seeded report including its Notes appendix.
 4. If not hired, suggest `.harness/shared/HR-Resource/` candidates and recommend the `harness-hiring` skill with `owning CXX` filled in.
 5. Keep aliases narrow enough to avoid accidental generic invocation.
 
@@ -30,4 +30,4 @@ Manage worker availability and invocation wording.
 
 Every worker assignment must include only the convention/gotcha links relevant to the assigned task. The owning CXX selects those links from its CXX index files.
 
-Every worker assignment must require the worker to append an English `## Implementation Notes` section with these subsections: `Design Decisions`, `Deviations`, `Tradeoffs`, and `Open Questions`. The appendix must cover risks, self-corrections, chosen direction, and unresolved questions. Use `None` for empty subsections.
+The appendix is already in the seed template. Return the report path and require filling its existing Implementation Notes subsections (risks, self-corrections, chosen direction, unresolved questions; `None` when empty), without copying the block into the assignment.

package/apps/harness-dashboard/lib/__tests__/sandbox-e2e.test.ts

@@ -178,7 +178,9 @@ gate("walwal-harness sandbox e2e — two usage modes", () => {
     const roster = JSON.parse(readFileSync(rosterPath, "utf8"));
     expect(roster.hired[0].skillPaths.codex).toContain(".codex/skills/");
     expect(roster.hired[0].skillPaths.source).toBe(".harness/shared/HR-Resource/react-ui-worker/SKILL.md");
-    expect(readFileSync(path.join(sbx, ".harness", ".bundle-version"), "utf8")).toBe("7.1.48\n");
+    expect(readFileSync(path.join(sbx, ".harness", ".bundle-version"), "utf8").trim()).toBe(
+      JSON.parse(readFileSync(path.join(repoRoot, "package.json"), "utf8")).version
+    );
   });
 
   it("gitignore management untracks runtime state without untracking shared harness files", () => {

package/assets/templates/AGENTS-ko.md.template

@@ -74,6 +74,26 @@
 
 ## 5. 진입점
 
+### 미션 등급
+
+CEO는 intake에서 `mission-state.json`에 `tier: "S"|"M"|"L"`을 기록하고 `ceo.md`에 근거 한 줄을 남긴다. Owner에게 분류를 묻지 않는다.
+
+| 등급 | 기준과 실행 |
+|---|---|
+| S | 예상 변경 파일 3개 이하 또는 약 150줄 이하. 새 의존성·외부 스펙 및 auth·결제·보안·데이터 마이그레이션·인프라·새 포트가 없고 기존 테스트로 검증 가능. CTO 직접 구현, 별도 CQO 세션에서 직접 검증. CTO/CQO용 hiring 생략. |
+| M | 나머지 유한 작업. 구현 worker와 평가 worker 1명. CQO는 CTO의 `## CQO Handoff` 이후에만 시작한다(직렬 게이트, 병렬 금지). |
+| L | 새 서비스·포트, 외부 스펙, 영구 운영, production 배포, 보안·결제·데이터 변경. 기존 worker 절차 유지. |
+
+L 위험 기준이 규모보다 우선한다. 필요한 CXX만 호출한다. CXX는 호출됐을 때만 문서를 쓴다. OPS는 검증이 장기 실행 runtime(dev server, Docker, preview, cloud, device)을 다룰 때만 호출하고, 그 외에는 CQO가 `OPS N/A: <이유>`를 기록한다. 호출됐지만 할 일이 없는 COO/CDO/OPS는 `## Not Applicable`과 이유 한 줄만 쓴다. COO/CDO 산출물은 모든 등급에서 worker를 쓰고, S/M의 OPS는 직접 관찰한다.
+
+유효 등급은 현재 tier와 `tier_history[]`의 `from`·`to` 모두의 최대 순위다(S=0, M=1, L=2; 미지 값·누락=2). 문자열 순서로 비교하지 않는다. `behavior.mission_tiers=false`는 L을 강제하며 null만 기본 true로 읽는다. tier 필드가 없는 legacy는 L 절차를 따르되 새 완료 검사는 적용하지 않는다.
+
+규모 초과·위험 영역 접촉·CQO FAIL 2회면 상향한다. 현재 tier를 올리고 `{from,to,at,reason}`을 이력에 추가한다. 하향 이력은 유효 등급을 낮추지 않는다. S→M/L에서는 상향 전에 `bash scripts/harness-worker-evidence-validate.sh . direct-work-sha mission:<mission-rel>` 출력값을 `direct_work_sha256`으로 이력에 기록하고 CTO의 `## Direct Work` 본문을 동결한다. 해시가 없으면 면제되지 않고, 본문이 바뀌면 거부된다. 상향 후 CTO는 `## Post-Upgrade Work`에 추가 구현을 기록하고 worker에게 맡긴다. 추가 구현이 없으면 첫 비공백 줄에 `none — <이유>`를 쓴다. CQO 최종 검증은 새 등급의 평가 worker가 수행한다. M→L은 역할 보고서만 전체 형식으로 보강한다.
+
+S/M 역할 보고서는 `## Lessons`에 `Preflight: <항목과 이유>`와 `Fired: <항목 또는 0 fired>`를 쓰고, `## Implementation Notes`는 bullet 요약으로 쓴다. L 역할 및 모든 worker 보고서는 기존 전체 형식을 유지한다. 브리프에는 seed된 보고서 경로와 기존 섹션 작성 지시를 넣고 골격·Tally·Notes 블록을 복사하지 않는다. seed에 없는 행동 규칙(브라우저 자동화 등)은 원문으로 전달한다.
+
+모든 등급에서 구현·검증 분리, 실행 명령·exit code·출력 증거, 변경 범위 및 제공된 전체 테스트 실행(이전 실행은 CQO 증거 재사용 조건을 충족할 때만 재사용), Owner 테스터 금지, runtime 전이 종료, headed Playwright, 장기 실행 runtime 검증 시 OPS 관제 증거를 유지한다. CTO와 CQO는 동시에 돌지 않는다. CQO는 CTO의 CQO Handoff로 트리가 동결된 뒤 시작하고, 전체 테스트는 최종 인계 트리에서 1회 실행한다.
+
 Owner가 회사에 접근하는 명령은 세 개뿐이다. 그 외의 경로는 없다.
 
 | 명령 | 사용 시점 |
@@ -101,10 +121,14 @@ Owner
 각 CXX는:
 - **독립된 fresh session 컨텍스트**에서 실행된다 — CEO 세션과 메모리를 공유하지 않는다
 - 결정을 `.harness/documents/{goal-or-child-mission}/{cxx}.md`에 기록한다
-- 모든 전문 작업을 hired worker에게 위임한다 — 직접 실행하지 않는다
+- M/L에서는 전문 작업을 worker에게 위임한다. S에서는 CTO가 직접 구현하고 CQO가 별도 세션에서 검증한다. COO/CDO 산출물은 모든 등급에서 worker를 사용하고, S/M의 OPS는 직접 관찰한다.
 - 필요한 worker가 없으면 `harness-hiring`을 먼저 호출한다
 
-CEO는 worker 기록 없이 완료된 산출물을 포함한 CXX 보고서를 거부한다.
+CEO는 S의 CTO/CQO 및 동결된 상향 전 CTO 작업 외에는 worker 증거를 요구한다.
+
+Prefer a genuinely separate CQO session (Claude Agent, Codex sub-agent, or `codex exec`) from implementation. Reading another role skill in the same session is only a role switch, not independent verification. If separate execution is unavailable, record `Verification Session: same-session` and disclose the limitation to Owner; the completion gate warns but permits it.
+
+For acceptance, leave the mission active and run `bash scripts/harness-company-complete.sh . <reason> <mission-rel>` as the final action; the script checks evidence before writing `complete` and `active:false`. On refusal, keep working. For termination without acceptance, first write lifecycle `cancelled`, `superseded`, or `closed` and `active:false`, then call the same explicit transition. `closed` means ended without acceptance; disclose “미수락 종료” in the Owner report and never archive without PASS. For an external-authority block, record `blocked`/`active:false` and run `bash scripts/harness-company-block.sh . "<exact missing authority>"`. `<mission-rel>` is the path relative to `.harness/documents/`.
 
 ## 7. Owner 역할
 
@@ -128,7 +152,7 @@ Owner는 최종 검수자다. Tester, QA worker, debugger, 배포 확인 담당
 
 1. CEO가 Owner 요청을 읽고 판단한다: 브레인스토밍 먼저, 또는 즉시 실행.
 2. CEO가 관련 CXX에게만 범위를 한정한 질문을 전달한다.
-3. 각 CXX가 worker를 고용하고, 위임하고, 결과를 수집하여 `{cxx}.md`에 기록한다.
+3. 각 CXX가 유효 등급에 따라 직접 실행하거나 worker에게 위임하고, 결과를 수집하여 `{cxx}.md`에 기록한다.
 4. CEO가 CXX 산출물을 종합하여 다음 CXX에 라우팅하거나 Owner에게 보고한다.
 5. 실행 가능한 local, preview, Docker, production-like 환경이 포함된 mission이면, CQO evaluator worker가 Playwright/E2E/API/visual/performance/regression 검수를 수행하는 동안 OPS가 해당 runtime을 관제한다.
 
@@ -147,12 +171,12 @@ Owner는 최종 검수자다. Tester, QA worker, debugger, 배포 확인 담당
 ### Hot Fix
 
 1. CEO가 긴급 요청을 받고 즉시 CTO와 CQO를 소집한다.
-2. CTO가 최소 패치 경로를 설계하고 구현 worker를 고용한다.
-3. Worker가 구현한다. CTO가 worker 증거를 검증하고 `cto.md`를 작성한다.
-4. CQO가 회귀 게이트를 실행한다. `.harness/gotchas/` 또는 `.harness/conventions/`에 교훈을 등록하고 `cqo.md`를 작성한다.
+2. CTO가 최소 패치 경로를 설계하고 S는 직접 구현하고 M/L은 구현 worker를 고용한다.
+3. 등급에 따라 CTO 또는 worker가 구현한다. CTO가 worker 증거를 검증하고 `cto.md`를 작성한다.
+4. CQO가 회귀 게이트를 실행한다. 등급과 재발 신호에 따라 교훈을 기록하고 `cqo.md`를 작성한다.
 5. CQO 판정 **PASS** 이후에만 archive한다.
 
-**완료 기준:** `cto.md`, `cqo.md`, 그리고 최소 하나의 신규 gotcha 또는 convention 항목이 존재한다.
+**완료 기준:** `cto.md`, `cqo.md`, 그리고 재발 가능성에 따른 교훈 또는 `none — <이유>` 기록이 존재한다.
 
 주의: harness 문서(ceo.md, cto.md, cqo.md, worker 보고서)에 대한 docmeta skip 판단은 미션 프로토콜 단계를 건너뛸 권한을 부여하지 않는다. 이 파일들은 분석 산출물이 아니라 미션 기록이다.
 
@@ -188,14 +212,14 @@ CEO, CXX, hired worker의 모든 Playwright 사용은 실제로 보이는 브라
 
 1. **`{mission}/cto.md` 없이 소스 코드 편집 금지** — CTO의 범위 승인이 있어야 소스 파일을 수정할 수 있다.
 2. **CXX 사칭 금지** — 현재 모델이 CEO/CTO/CQO를 인라인으로 대행하지 않는다. 설치된 harness skill을 fresh session에서 사용한다.
-3. **이름 없는 worker 금지** — 모든 전문 작업은 `harness-hiring` → `harness-resource-manager`를 거친다.
-4. **CQO 판정 없이 archive 금지** — 명시적 PASS가 담긴 `{mission}/cqo.md`가 존재해야 한다.
-5. **gotcha 등록 생략 금지** — 모든 hot-fix는 `.harness/gotchas/` 또는 `.harness/conventions/`에 최소 하나의 항목을 만든다.
+3. **이름 없는 worker 금지** — S CTO/CQO 직접 실행을 제외한 전문 작업은 `harness-hiring` → `harness-resource-manager`를 거친다.
+4. **CQO 판정 없이 archive 금지** — CQO Verdict 섹션들의 마지막 `Verdict:` 후보가 유효한 대문자 PASS/ACCEPTED여야 한다. 마지막 후보가 무효이면 이전 PASS로 돌아가지 않는다. 사유는 다음 줄에 쓴다.
+5. **신호 기반 교훈 등록** — S/M은 재발 가능하거나 원인이 비자명할 때 등록하고, 아니면 Recurrence Notes에 `none — <이유>`를 쓴다. L은 기존 등록 의무를 유지한다.
 6. **미션 중 이 파일 편집 금지** — AGENTS.md를 수정하려면 별도 `/goal`을 제출한다.
 7. **Owner는 최종 검수만 수행** — Owner는 tester나 QA 대체자가 아니다. CEO/CXX는 worker-backed verification으로 goal 완료 가능성을 증명하기 전까지 "완료했습니다, 확인해 주세요"라고 보고하지 않는다.
 8. **OPS는 CQO 검수 중 관제한다** — 실행 가능한 제품에서 CQO PASS는 OPS가 검수 runtime을 관제했거나 OPS watch가 불필요한 이유를 기록했을 때만 유효하다. 열린 OPS incident, runtime mapping 누락, 필수 로그 누락, service down, health mismatch, 검수 대상 service 미관제는 Owner acceptance를 막는다.
 9. **Production incident는 회사 이벤트다** — 오픈 후 사용자 영향 OPS signal은 CEO를 통해 CTO/CQO/OPS로 라우팅된다. CTO는 복구, CQO는 회귀 검증, OPS는 증거와 close criteria를 책임진다.
-10. **Implementation Notes는 같은 보고서 하단에 작성** — `ceo.md`, 모든 `{cxx}.md`, 모든 worker report는 하나의 English `## Implementation Notes` 섹션으로 끝나야 한다. 별도 sidecar notes 파일을 만들지 않는다. 결정/증거를 만든 동일한 role 또는 worker report 하단에 `Design Decisions`, `Deviations`, `Tradeoffs`, `Open Questions`를 작성하고 빈 항목은 `None`을 사용한다.
+10. **Implementation Notes는 같은 보고서 하단에 작성** — S/M 역할 문서는 `## Lessons`(Preflight/Fired 두 줄)와 Notes bullet 요약을 허용한다. 아래 전체 형식은 L 역할 및 모든 worker 보고서에 적용한다. `ceo.md`, 모든 `{cxx}.md`, 모든 worker report는 하나의 English `## Implementation Notes` 섹션으로 끝나야 한다. 별도 sidecar notes 파일을 만들지 않는다. 결정/증거를 만든 동일한 role 또는 worker report 하단에 `Design Decisions`, `Deviations`, `Tradeoffs`, `Open Questions`를 작성하고 빈 항목은 `None`을 사용한다.
 11. **Playwright는 visible이 기본값이다** — 모든 Playwright/browser automation은 headed/visible mode(`headless: false` 또는 동등한 설정)를 사용한다. Headless Playwright는 mission에 기록된 Owner의 명시적 승인이 필요하다.
 
 ---

package/assets/templates/AGENTS.md.template

@@ -26,7 +26,7 @@ Codex does not need `.codex/agents/` to run this harness. The installed Codex co
 - Owner entrypoints are `.codex/commands/goal.md`, `.codex/commands/submission.md`, and `.codex/commands/hot-fix.md`.
 - Harness role protocols live in `.codex/skills/harness-{ceo,coo,cdo,cto,cqo,ops,hiring,resource-manager,brick-office}/SKILL.md`.
 - If Codex does not auto-list these as available skills, manually read the relevant `SKILL.md` file and follow it. Do not report that the harness is unavailable just because `.codex/agents/` is absent.
-- When a command asks for a "fresh session context", Codex must create a role-scoped context by reading only the role skill, the active mission files, and required conventions/gotchas before writing that role's `{cxx}.md`. If Codex sub-agent tooling is explicitly available and requested, it may be used; otherwise execute the role protocol sequentially with clear role boundaries.
+- Prefer a genuinely separate CQO session (Claude Agent, Codex sub-agent, or `codex exec`) from implementation. Reading another role skill in the same session is only a role switch, not independent verification. If separate execution is unavailable, record `Verification Session: same-session` and disclose the limitation to Owner; the completion gate warns but permits it.
 - Codex must not treat `.codex/skills` as passive documentation. These files are the installed runtime protocol for Codex.
 
 ---
@@ -62,10 +62,10 @@ Owner
 Each CXX:
 - Runs in a **fresh session context** — no shared memory with CEO's session
 - Records decisions in `.harness/documents/{goal-or-child-mission}/{cxx}.md`
-- Delegates all specialist work to hired workers — never executes directly
+- Delegates specialist work at M/L; only CTO/CQO execute directly at S
 - If a required worker is absent, invokes `harness-hiring` before assigning
 
-CEO rejects any CXX report that contains completed deliverables without matching worker records.
+CEO requires worker records except for S CTO/CQO and frozen pre-upgrade CTO work.
 
 ## 4. Owner Role
 
@@ -78,7 +78,7 @@ The Owner is the final acceptance reviewer, not a tester, QA worker, debugger, o
 - Reversible project-local automation is a CEO decision. Do not wait for Owner approval to start hourly review, scheduler checks, dashboard refresh, or monitoring briefs when credentials/config are already present.
 - Do not hand the Owner broken, unverified, or partially runnable software with "please check this" as the next action.
 - Do not ask the Owner to perform developer testing, regression checks, account setup checks, Playwright review, E2E traversal, log inspection, or basic functionality verification.
-- CEO and CXX must plan and execute self-verification through workers: unit tests, E2E tests, Playwright/browser checks, test accounts, seeded data, build/run checks, logs, and documented evidence.
+- CEO and CXX must plan and execute self-verification directly at S (CQO) or through workers: unit tests, E2E tests, Playwright/browser checks, test accounts, seeded data, build/run checks, logs, and documented evidence.
 - Owner inspection happens only after CEO has collected CXX completion records, CTO implementation evidence, CQO evaluator evidence, and any OPS verification-watch/runtime evidence needed to show the goal is genuinely complete.
 - A final Owner report may ask for acceptance review, product judgment, or business approval. It must not ask the Owner to discover whether the software works.
 
@@ -86,15 +86,39 @@ The Owner is the final acceptance reviewer, not a tester, QA worker, debugger, o
 
 ## 5. Mission Flow
 
+### Mission Tier
+
+CEO records `tier: "S"|"M"|"L"` in every new mission-state.json at intake and one line of rationale in ceo.md, without asking Owner.
+
+| Tier | Criteria and routing |
+|---|---|
+| S | At most 3 expected changed files OR about 150 changed lines; no new dependency or external spec; no auth, payment, security, data migration, infrastructure, or new port; existing test commands suffice. CTO implements directly; CQO verifies in a separate session. No hiring for CTO/CQO. |
+| M | Remaining finite work: implementation worker(s), one evaluator worker. CQO starts only after CTO's `## CQO Handoff` (serial gate, never parallel). |
+| L | Any new service/port, external spec integration, operating goal, production deployment, security, payment, or data change. Existing worker process. |
+
+L risk criteria take precedence over size. Invoke only relevant CXX; S normally needs CTO and CQO. A CXX writes a document only when summoned. Summon OPS only when verification exercises a long-lived runtime (dev server, Docker, preview, cloud, device); otherwise CQO records `OPS N/A: <reason>`. A summoned COO/CDO/OPS with no work writes only `## Not Applicable` and one reason line. COO/CDO deliverables stay worker-backed at every tier; at S/M OPS observes directly.
+
+Effective tier is the highest rank among current `tier` and BOTH `from` and `to` in every `tier_history` entry: S=0, M=1, L=2; unknown or missing values rank 2. Never compare tier strings lexically. `behavior.mission_tiers=false` forces L (read null as true, preserve false). Missing tier means legacy: L procedure, without the new tiered completion checks.
+
+Escalate on exceeding scope, touching a risk area, or two CQO FAILs. Set the higher tier and append `{from,to,at,reason}` to `tier_history`; downgrades never reduce effective tier. Preserve completed work at its original tier; subsequent work and final verification follow the higher tier.
+
+For S→M/L, before changing the tier, run `bash scripts/harness-worker-evidence-validate.sh . direct-work-sha mission:<mission-rel>` and record its output as `direct_work_sha256` in that history entry. Freeze the exact `## Direct Work` body. CTO adds `## Post-Upgrade Work`: first nonblank line `none — <reason>` if only re-verification remains, otherwise assign added implementation to CTO worker(s). Missing hash removes the exemption; changed Direct Work is rejected. CQO always uses an evaluator worker after upgrade. M→L only requires expanding role documents to L format; worker reports already use the full format.
+
+At effective tier S/M, role documents may replace Lessons Preflight + Lessons Tally with `## Lessons` containing `Preflight: <applicable items and why>` (before work) and `Fired: <items or 0 fired>` (at completion). `## Implementation Notes` may contain concise bullets. At L, keep the full role format below. All worker reports retain the full seeded format at every tier.
+
+Across tiers: keep implementation and verification separate, use executed commands with exit codes and output excerpts, run changed-scope tests and the available full suite (a prior run is reusable only under CQO Evidence Reuse), never use Owner as tester, end via runtime transition only, keep Playwright headed (`headless: false`, default `slowMo: 120`), and preserve OPS watch evidence when a long-lived runtime is tested. CTO and CQO never run concurrently: CQO starts after CTO's CQO Handoff freezes the tree, and the full suite runs once on the final handed-off tree.
+
+
+
 ### Goal
 
 1. CEO reads the Owner request. Decides: brainstorm first, or assign immediately.
 2. CEO sends scoped questions to relevant CXX only.
-3. Each CXX hires workers, collects reports, records decisions in `{cxx}.md`.
+3. Each CXX follows the effective tier, collects evidence, records decisions in `{cxx}.md`.
 4. CEO aggregates CXX outputs, routes to next CXX or reports to Owner.
 5. If the mission uses a runnable local, preview, Docker, or production-like environment, OPS watches the runtime while CQO evaluator workers run Playwright/E2E/API/visual/performance/regression checks.
 
-**Complete when:** `.harness/documents/goal-{index}-{name}/ceo.md` contains a final Owner report, `mission-state.json` is terminal (`complete`, `closed`, `cancelled`, or `superseded`) with `active:false`, **and** CEO has fired the runtime transition `bash scripts/harness-company-complete.sh . <reason>` (or `harness-company-block.sh` for an external-authority block) so `progress.json` leaves the `running` state. Document state alone does not end the loop — the Stop loop and dashboard read `progress.json`.
+**Complete when:** final Owner report and evidence exist and the explicit runtime transition succeeds. For acceptance, leave the mission active and run `bash scripts/harness-company-complete.sh . <reason> <mission-rel>` as the final action; the script checks evidence before writing `complete` and `active:false`. On refusal, keep working. For termination without acceptance, first write lifecycle `cancelled`, `superseded`, or `closed` and `active:false`, then call the same explicit transition. `closed` means ended without acceptance; disclose “미수락 종료” in the Owner report and never archive without PASS. For an external-authority block, record `blocked`/`active:false` and run `bash scripts/harness-company-block.sh . "<exact missing authority>"`. `<mission-rel>` is the path relative to `.harness/documents/`.
 
 ### Operating (perpetual) goal
 
@@ -118,12 +142,12 @@ If the goal is to **operate/monitor/keep growing** something indefinitely (e.g.
 ### Hot Fix
 
 1. CEO receives emergency request. Immediately summons CTO and CQO.
-2. CTO designs the minimum patch path. Hires implementation workers.
-3. Workers implement. CTO verifies evidence, writes `cto.md`.
-4. CQO runs regression gate. Registers a lesson in `.harness/gotchas/` or `.harness/conventions/`. Writes `cqo.md`.
+2. CTO designs the minimum patch path. Implements directly at S, otherwise hires implementation workers.
+3. CTO or its workers implement according to tier. CTO verifies evidence, writes `cto.md`.
+4. CQO runs regression gate. Registers a lesson when recurrence is plausible or the cause is non-obvious (mandatory at L); otherwise records `none — <reason>` in Recurrence Notes. Writes `cqo.md`.
 5. Archive only after CQO verdict: **PASS**.
 
-**Complete when:** `cto.md`, `cqo.md`, and at least one new gotcha or convention entry exist.
+**Complete when:** `cto.md`, `cqo.md`, and justified Recurrence Notes exist, followed by a successful explicit runtime transition.
 
 Note: A docmeta skip decision on harness documents (ceo.md, cto.md, cqo.md, worker reports) does not authorize skipping any mission protocol step. These are mission records, not derived output documents.
 
@@ -168,24 +192,24 @@ All Playwright usage by CEO, CXX, and hired workers must run with a visible real
 
 1. **No source edit without `{mission}/cto.md`** — CTO scope sign-off is required before any source file is modified.
 2. **No CXX impersonation** — The active model must not act as CEO/CTO/CQO inline. Use installed harness skills in fresh sessions.
-3. **No unnamed workers** — All specialist work routes through `harness-hiring` → `harness-resource-manager`.
-4. **No archive without CQO verdict** — `{mission}/cqo.md` with explicit PASS must exist.
-5. **No gotcha skip** — Every hot-fix produces at least one `.harness/gotchas/` or `.harness/conventions/` entry.
+3. **No unnamed workers** — Except direct S CTO/CQO work, specialist work routes through `harness-hiring` → `harness-resource-manager`.
+4. **No archive without CQO verdict, and nothing is complete in the abstract** — `{mission}/cqo.md` with explicit PASS must exist. **A mission records the version and content hash of every external spec it builds against** (`{mission}/spec-pins.json`, managed by `scripts/harness-spec-pin.sh`), and the pins are re-checked against the current documents **before any category is marked complete and before any archive**. A category is complete *against a spec version*, never in the abstract: a spec can move under a category already marked done, changing a contract, with every later revision landing silently. For tiered missions, only the last `Verdict:` candidate inside CQO Verdict sections counts; it must be a plain (optionally quoted) uppercase `Verdict: PASS` or `Verdict: ACCEPTED` line. Malformed final candidates are rejected without fallback. Write reasons on the next line.
+5. **Record recurrence signals** — At S/M, register gotchas when recurrence is plausible or the cause is non-obvious; otherwise record `none — <reason>` in cqo.md Recurrence Notes. L hot-fixes retain mandatory registration.
 6. **This file is read-only during missions** — Raise a separate `/goal` to update AGENTS.md.
 7. **CEO routes only to CXX — never to workers** — CEO must not dispatch, hire, or brief specialist workers directly. Implementation workers are hired by CTO. Evaluator/tester workers are hired by CQO.
-8. **No CXX self-execution** — CXX agents coordinate and manage only. A CXX that produces deliverables without matching worker records has violated its scope. CEO must reject such reports.
-9. **No verdict without worker evidence** — CQO cannot issue ACCEPTED/REJECTED without a Worker Evidence Manifest referencing at least one evaluator worker. Self-inspection by CQO is not valid evidence.
+8. **Tier-scoped execution** — At M/L, CXX agents coordinate and manage only. A CXX that produces deliverables without matching worker records has violated its scope. CEO must reject such reports. Effective S exempts only CTO/CQO from worker delegation: CTO implements directly, CQO tests in a separate session. COO/CDO deliverables remain worker-backed; at S/M OPS observes directly.
+9. **Executed verdict evidence** — At M/L, CQO cannot issue ACCEPTED/REJECTED without a Worker Evidence Manifest referencing at least one evaluator worker. Self-inspection by CQO is not valid evidence. Effective S exempts only CTO/CQO from worker delegation: CTO implements directly, CQO tests in a separate session. COO/CDO/OPS remain worker-backed.
 10. **Hierarchical worker ownership** — Hired workers are installed under `.claude/skills/{owning-cxx}/{worker}/` and `.codex/skills/{owning-cxx}/{worker}/`; mission worker reports live under `.harness/documents/{goal-or-child-mission}/{owning-cxx}/workers/`. Flat `{mission}/workers/` reports are legacy and signal an ownership violation unless explicitly migrated.
-11. **Lazy convention/gotcha loading** — *What* to read. *When* to read it, and what to write about it, is Rule 20. CXX roles read `.harness/conventions/shared.md`, `.harness/conventions/{cxx}.md`, `.harness/gotchas/shared.md`, and `.harness/gotchas/{cxx}.md`, then follow only the related topic links listed in those CXX files. Workers read only the related links supplied by their owning CXX.
-12. **Implementation Notes required** — `ceo.md`, every `{cxx}.md`, and every worker report must end with one English `## Implementation Notes` section containing `Design Decisions`, `Deviations`, `Tradeoffs`, and `Open Questions`. Use `None` for empty subsections. Do not create a separate sidecar notes file; the notes belong at the bottom of the same role or worker report that produced the decision/evidence.
+11. **Lazy convention/gotcha loading is a promise about reachability** — *What* to read. *When* to read it, and what to write about it, is Rule 20. CXX roles read `.harness/conventions/shared.md`, `.harness/conventions/{cxx}.md`, `.harness/gotchas/shared.md`, and `.harness/gotchas/{cxx}.md`, then follow only the related topic links listed in those CXX files. Workers read only the related links supplied by their owning CXX. **An entry is linked from the index of every role it names as an audience, not only its author's.** Registration is incomplete until each declared audience can reach it by the path that role is told to use — where the promise is not kept, this rule does not narrow the search, **it hides the entry**. Declare the audience (`<!-- roles: cto, cqo -->` on a topic file, `- **Roles**: cto, cqo` on an index entry) and verify with `scripts/harness-corpus-reachability.sh`. The recurring failure is mundane: *the author files under itself*, and registration feels complete because the entry is indexed — just not where its declared readers look.
+12. **The document is the record** — A conclusion a session holds but has not written into its role document **is not held by the company**. Before reporting a state change to anyone, reconcile it in your own document and in the runtime state file; strike and correct in place, never delete. Role documents are checked against peer documents, not only against themselves. `ceo.md`, every `{cxx}.md`, and every worker report must end with one English `## Implementation Notes` section containing `Design Decisions`, `Deviations`, `Tradeoffs`, and `Open Questions`. Use `None` for empty subsections. Do not create a separate sidecar notes file; the notes belong at the bottom of the same role or worker report that produced the decision/evidence. S/M role documents may use concise bullets under Implementation Notes; L roles and all workers keep the four subsections.
 13. **Structured runtime state** — If the harness must parse it, record it in JSON or JSONL. CXX todo queues, event history, heartbeat timestamps, preemption/resume state, and completion evidence belong in `.harness/todos/*.json*` or `.harness/events.jsonl`, not in free-form Markdown tables. Markdown remains for instructions, conventions, gotchas, skills, and human-readable mission narrative.
 14. **Mission lifecycle is explicit** — Every goal, submission, and hot-fix directory must contain `mission-state.json` with `lifecycle` and `active`. Only one child mission under a goal may be active. Starting a newer submission/hot-fix closes, cancels, or supersedes the previous active child unless CEO records a deliberate TODO/resume plan.
-15. **Owner is final acceptance only** — Owner is not a tester or QA substitute. CEO/CXX must not report "done, please check" until worker-backed verification proves the goal can be completed. Use unit tests, E2E, Playwright, test accounts, seeded data, build/run checks, logs, and CQO evidence before requesting Owner acceptance.
+15. **Owner is final acceptance only** — Owner is not a tester or QA substitute. CEO/CXX must not report "done, please check" until executed CQO verification (direct at S, worker-backed at M/L) proves the goal can be completed. Use unit tests, E2E, Playwright, test accounts, seeded data, build/run checks, logs, and CQO evidence before requesting Owner acceptance.
 16. **OPS watches CQO verification** — For runnable products, CQO PASS is invalid unless OPS has monitored the verification runtime or documented why OPS watch is not applicable. Open OPS incidents, missing runtime mapping, required log gaps, service down, health mismatch, or an unmonitored tested service block Owner acceptance.
 17. **Production incidents are company events** — After launch, user-impacting OPS signals route through CEO to CTO/CQO/OPS. CTO owns recovery, CQO owns regression confirmation, and OPS owns evidence plus close criteria.
 18. **Playwright is visible by default** — All Playwright/browser automation must use headed/visible mode (`headless: false` or equivalent). Headless Playwright requires explicit Owner approval recorded in the mission.
-19. **The loop ends only via a runtime transition** — There are exactly two legitimate stop conditions: COMPLETE and BLOCKED-on-external-authority. The autonomous Stop loop and the dashboard read `progress.json` runtime state, not mission documents. After the final Owner report and terminal `mission-state.json`, CEO's last action MUST be `scripts/harness-company-complete.sh` (complete) or `scripts/harness-company-block.sh "<missing authority>"` (blocked). Never end a turn in the `running` state with no queued action, and never fire a terminal transition while real CXX/worker/verification work remains. Between these two endpoints the company keeps progressing autonomously — the Owner is not the pump.
-20. **Lessons precede planning** — Before any source edit, any measurement, and before any brief is issued, every CXX and every hired worker reads `.harness/conventions/shared.md`, `.harness/conventions/{role}.md`, `.harness/gotchas/shared.md`, and `.harness/gotchas/{role}.md`, follows only the topic links those files name, and writes a `## Lessons Preflight` section stating which items apply and why. Any requirement placed on a CXX that its workers must also satisfy is inserted **verbatim** into the worker brief — *a rule stated one layer above the layer that executes it does not apply.* Every `ceo.md`, every `{cxx}.md`, and every worker report carries a one-line `## Lessons Tally` naming which of those items actually fired, placed immediately before `## Implementation Notes`. **Zero fired is a valid tally and must be stated, not omitted** — a tally that only ever reports hits trains agents to manufacture them. Do not distill the corpus into a second checklist file: a derived corpus must be re-synced whenever any source file changes, and it becomes one more thing nobody reads before planning.
+19. **The loop ends only via a runtime transition** — There are exactly two legitimate stop conditions: COMPLETE and BLOCKED-on-external-authority. The autonomous Stop loop and the dashboard read `progress.json` runtime state, not mission documents. For acceptance, leave the mission active and run `bash scripts/harness-company-complete.sh . <reason> <mission-rel>` as the final action; the script checks evidence before writing `complete` and `active:false`. On refusal, keep working. For termination without acceptance, first write lifecycle `cancelled`, `superseded`, or `closed` and `active:false`, then call the same explicit transition. `closed` means ended without acceptance; disclose “미수락 종료” in the Owner report and never archive without PASS. For an external-authority block, record `blocked`/`active:false` and run `bash scripts/harness-company-block.sh . "<exact missing authority>"`. `<mission-rel>` is the path relative to `.harness/documents/`. Never end a turn in the `running` state with no queued action, and never fire a terminal transition while real CXX/worker/verification work remains. Between these two endpoints the company keeps progressing autonomously — the Owner is not the pump.
+20. **Lessons precede planning** — Read shared/role conventions and gotchas before edits, measurements, or briefs; follow relevant topic links. At effective tier S/M, role documents may replace Lessons Preflight + Lessons Tally with `## Lessons` containing `Preflight: <applicable items and why>` (before work) and `Fired: <items or 0 fired>` (at completion). `## Implementation Notes` may contain concise bullets. At L, keep the full role format below. All worker reports retain the full seeded format at every tier. **Worker brief:** name the seeded report path and instruct the worker to fill its existing sections incrementally. Do not copy the report skeleton, Tally, or Notes block into the brief. Continue to pass relevant corpus links and copy behavioral requirements absent from the seed (including the browser-automation clause) verbatim.
 21. **Every worker spawn declares its model** — Never inherit the CLI default. The spawning CXX names the model in the brief, in the Worker Evidence Manifest, and in `progress.json` `company_state.workers[]`. A worker terminated by a usage limit is indistinguishable, from the outside, from a worker that finished — so **a silent loop is a rate limit until proven otherwise.** Check the limit and its reset time before re-briefing, re-hiring, or rewriting the task.
 22. **Readers do not filter by content** — Any reader that scans a role document, worker report, or mission record for sections matches `^>?\s*#{1,6}` and returns every hit: blockquoted or plain, at any depth, with no content filter of any kind. Do not select headings by what they appear to say. A document is free to put verdicts, retractions, standing rules, and continuation lines in a heading, so a reader anchored on `^#` can return superseded content as current — worse than returning nothing. **The reader that decides what is important before reading is the failure.**
 

package/assets/templates/config.json

@@ -18,7 +18,7 @@
   },
   "flow": {
     "sequence": ["ceo", "coo", "cdo", "cto", "cqo", "ops"],
-    "worker_gate": "CXX agents must use harness-resource-manager and harness-hiring before specialist deliverables.",
+    "worker_gate": "M/L CXX and S COO/CDO/OPS use harness-resource-manager and harness-hiring; S CTO/CQO execute directly.",
     "worker_reports_required": ".harness/documents/{goal-or-child-mission}/{owning-cxx}/workers/{worker-name}.md",
     "retry_on_fail": true,
     "max_retries_per_sprint": 5,
@@ -166,6 +166,7 @@
     }
   },
   "behavior": {
+    "mission_tiers": true,
     "comment": "하네스 동작 플래그. UserPromptSubmit 훅이 이 값을 읽어 v7 CEO/CXX 라우팅 안내를 결정한다.",
     "auto_route_ceo": true,
     "auto_route_ceo_description": "true 이면 /goal 또는 /hot-fix 이후 Owner 입력을 v7 CEO/CXX mission flow 기준으로 안내한다. 사용자가 'harness skip' 등을 말하면 단일 메시지 한정으로 건너뛴다.",

package/commands/goal.md

@@ -10,25 +10,27 @@ Route the Owner request to the installed `harness-ceo` agent/skill.
 Codex adapter:
 - If Codex does not auto-load `harness-ceo`, manually read `.codex/skills/harness-ceo/SKILL.md` and follow it.
 - Absence of `.codex/agents/` is not a failure. `.codex/skills/**/SKILL.md` is the Codex runtime protocol.
-- For CXX "fresh session context", use role-scoped context: read the CXX skill, active mission files, and required conventions/gotchas before writing that role's `{cxx}.md`.
+- Prefer a genuinely separate CQO session (Claude Agent, Codex sub-agent, or `codex exec`) from implementation. Reading another role skill in the same session is only a role switch, not independent verification. If separate execution is unavailable, record `Verification Session: same-session` and disclose the limitation to Owner; the completion gate warns but permits it.
+
+At intake, classify and record `tier` (S/M/L) using the CEO Mission Tier criteria; record the rationale in `ceo.md`. Preserve the highest historical tier when requirements change.
 
 Required flow:
 1. Create or update a goal under `.harness/documents/goal-{goal_index}-{goal_name}/`.
 2. Classify the goal, then write `.harness/documents/goal-{goal_index}-{goal_name}/mission-state.json` before routing CXX:
-   - **Finite** goal (build/add/fix something with a definite done state) → `{"lifecycle":"active","active":true}`.
-   - **Operating/perpetual** goal (operate/monitor/keep growing/지속·영구 운영, e.g. "run a trading bot and keep it profitable forever") → `{"lifecycle":"operating","active":true}`. An operating goal NEVER completes: drive it as the agenda-driven standing loop in the CEO skill ("Operating (Perpetual) Goals"), and never run `harness-company-complete.sh` for it. It ends only on explicit Owner stop or a true external-authority block.
+   - **Finite** goal (build/add/fix something with a definite done state) → `{"lifecycle":"active","active":true,"tier":"S"}` (replace S with the classified tier).
+   - **Operating/perpetual** goal (operate/monitor/keep growing/지속·영구 운영, e.g. "run a trading bot and keep it profitable forever") → `{"lifecycle":"operating","active":true,"tier":"L"}`. An operating goal NEVER completes: drive it as the agenda-driven standing loop in the CEO skill ("Operating (Perpetual) Goals"), and never run `harness-company-complete.sh` for it. It ends only on explicit Owner stop or a true external-authority block.
 3. Record CEO decisions in `.harness/documents/goal-{goal_index}-{goal_name}/ceo.md`.
 4. CEO decides whether brainstorming is needed or whether CXX questions can be issued immediately. CEO must not ask the Owner which path to take.
-5. CEO asks COO, CDO, CTO, and CQO only the questions needed for this goal.
+5. CEO routes only to the CXX needed for this goal and its effective tier.
 6. CXX roles must start in a fresh session context. Do not let the default model impersonate a missing worker.
-7. CXX roles must not directly execute specialist deliverables. They must use hired workers for research, planning, design, implementation, QA, ops checks, and documentation.
+7. At effective tier M/L, and for COO/CDO deliverables at every tier, delegate specialist execution to hired workers. At S, CTO implements directly and CQO directly runs verification in a separate session; no CTO/CQO hiring is needed. At S/M, OPS observes directly. CQO starts only after CTO's CQO Handoff — never in parallel. A CXX writes a document only when summoned; a summoned COO/CDO/OPS with no work writes only `## Not Applicable` and one reason.
 8. If a required CXX or worker skill is missing, CEO must invoke the installed `harness-hiring` skill before assigning the work.
-9. CEO must require a Worker Evidence Manifest and worker report paths under `.harness/documents/goal-{goal_index}-{goal_name}/{owning-cxx}/workers/` before accepting CXX completion.
-10. When the goal is accepted, cancelled, superseded, blocked, or closed, update `mission-state.json` to `complete`, `cancelled`, `superseded`, `blocked`, or `closed` and set `active:false`. Then fire the matching runtime transition as the literal final action of the turn so the documented terminal state matches the `progress.json` flag the harness actually reads: a finished/closed goal → `bash scripts/harness-company-complete.sh . goal-complete`; an external-authority block → `bash scripts/harness-company-block.sh . "<exact missing authority>"`. This clears `progress.json` out of `running`, lets the autonomous loop stop cleanly, and makes the dashboard show the company as idle/done. Omitting this step leaves the loop perpetually "running".
+9. For roles requiring workers, CEO must require a Worker Evidence Manifest and worker report paths under `.harness/documents/goal-{goal_index}-{goal_name}/{owning-cxx}/workers/` before accepting CXX completion.
+10. For acceptance, leave the mission active and run `bash scripts/harness-company-complete.sh . <reason> <mission-rel>` as the final action; the script checks evidence before writing `complete` and `active:false`. On refusal, keep working. For termination without acceptance, first write lifecycle `cancelled`, `superseded`, or `closed` and `active:false`, then call the same explicit transition. `closed` means ended without acceptance; disclose “미수락 종료” in the Owner report and never archive without PASS. For an external-authority block, record `blocked`/`active:false` and run `bash scripts/harness-company-block.sh . "<exact missing authority>"`. `<mission-rel>` is the path relative to `.harness/documents/`.
 11. Do not invoke internal roles through slash commands; commands are Owner entrypoints only.
 12. Do not ask the Owner whether to continue, hire workers, choose internal options, or start the next step. If CEO cannot decide alone, convene the relevant CXX agents and decide from their written recommendations. CEO may approve reversible routine operations such as local cron/launchd/wake automation, dashboard refresh, monitoring cadence, Telegram briefing format using existing credentials, and mission consolidation/supersede cleanup. Stop only for external authority such as new credentials/secrets, payment approval, legal/business acceptance, unavailable production access, destructive data action, or direct conflict with stated Owner direction.
 
-Lessons before plan (AGENTS.md Hard Rule 20): CEO and every CXX read `.harness/conventions/{shared,role}.md` and `.harness/gotchas/{shared,role}.md`, follow only the topic links those files name, and write `## Lessons Preflight` **before** the first edit, the first measurement, and the first worker brief. Every role document and worker report closes with a one-line `## Lessons Tally` immediately above `## Implementation Notes` — `0 fired` is a valid tally and must be stated, not omitted. Requirements a CXX must satisfy that its workers must also satisfy go into the worker brief **verbatim**. The Stop hook enforces this; it is not advisory.
+Lessons before plan: read relevant shared/role conventions and gotchas before edits, measurements, or briefs. At effective tier S/M, role documents may replace Lessons Preflight + Lessons Tally with `## Lessons` containing `Preflight: <applicable items and why>` (before work) and `Fired: <items or 0 fired>` (at completion). `## Implementation Notes` may contain concise bullets. At L, retain Lessons Preflight, Lessons Tally, and all four Implementation Notes subsections. All worker reports retain the full seeded format at every tier. **Worker brief:** name the seeded report path and instruct the worker to fill its existing sections incrementally. Do not copy the report skeleton, Tally, or Notes block into the brief. Continue to pass relevant corpus links and copy behavioral requirements absent from the seed (including the browser-automation clause) verbatim.
 
 Note: A goal is the company's objective. Submissions and hot-fixes that happen while pursuing it should be recorded under that goal directory.
 

package/commands/hot-fix.md

@@ -10,25 +10,27 @@ Route the Owner request to the installed `harness-ceo` agent/skill as an emergen
 Codex adapter:
 - If Codex does not auto-load `harness-ceo`, manually read `.codex/skills/harness-ceo/SKILL.md` and follow it.
 - Absence of `.codex/agents/` is not a failure. `.codex/skills/**/SKILL.md` is the Codex runtime protocol.
-- For CXX "fresh session context", use role-scoped context: read the CXX skill, active mission files, and required conventions/gotchas before writing that role's `{cxx}.md`.
+- Prefer a genuinely separate CQO session (Claude Agent, Codex sub-agent, or `codex exec`) from implementation. Reading another role skill in the same session is only a role switch, not independent verification. If separate execution is unavailable, record `Verification Session: same-session` and disclose the limitation to Owner; the completion gate warns but permits it.
+
+At intake, classify and record `tier` (S/M/L) using the CEO Mission Tier criteria; record the rationale in `ceo.md`. Preserve the highest historical tier when requirements change.
 
 Required flow:
 1. Locate the active goal document root under `.harness/documents/{goal_name}/`. If no active goal exists, CEO must create/select one before proceeding.
 2. If another child mission under the goal is active, update its `mission-state.json` to `closed`, `cancelled`, or `superseded` with `active:false` before starting the hot-fix.
 3. Create `.harness/documents/{goal_name}/hotfix-{hotfix_index}-{hotfix_name}/ceo.md`.
-4. Write `.harness/documents/{goal_name}/hotfix-{hotfix_index}-{hotfix_name}/mission-state.json` with `{"lifecycle":"active","active":true}`.
+4. Write `.harness/documents/{goal_name}/hotfix-{hotfix_index}-{hotfix_name}/mission-state.json` with `{"lifecycle":"active","active":true,"tier":"S"}` (replace S with the classified tier).
 5. CEO summons CTO and CQO first; summon COO/CDO only when planning or UX decisions are involved. CEO must not ask the Owner whether to start the fix or which internal path to choose.
-6. CTO applies the smallest correct patch path through hired implementation skills.
+6. CTO applies the smallest correct patch directly at S, or through hired implementation skills at M/L.
 7. CXX roles must start in a fresh session context. Do not let the default model impersonate a missing CXX or worker.
-8. CXX roles must not directly execute specialist deliverables. They must use hired workers for implementation, QA, ops checks, and documentation even when the fix is small.
+8. At effective tier M/L, and for COO/CDO deliverables at every tier, delegate specialist execution to hired workers. At S, CTO implements directly and CQO directly runs verification in a separate session; no CTO/CQO hiring is needed. At S/M, OPS observes directly. CQO starts only after CTO's CQO Handoff — never in parallel. A CXX writes a document only when summoned; a summoned COO/CDO/OPS with no work writes only `## Not Applicable` and one reason.
 9. If a required worker is missing, CEO or the responsible CXX must invoke the installed `harness-hiring` skill before assigning the work.
-10. CEO must require a Worker Evidence Manifest and worker report paths under `.harness/documents/{goal_name}/hotfix-{hotfix_index}-{hotfix_name}/{owning-cxx}/workers/` before accepting CXX completion.
-11. CQO must register durable lessons in `.harness/gotchas/`, `.harness/conventions/`, or `.harness/memories/`. This step is mandatory, not optional, even for small fixes.
-12. Archive only after CQO has accepted the fix, then update `mission-state.json` to `complete` with `active:false`. Then fire the runtime transition as the literal final action of the turn so the terminal document state matches the `progress.json` flag the harness reads: completed → `bash scripts/harness-company-complete.sh . hotfix-complete`; external-authority block → `bash scripts/harness-company-block.sh . "<exact missing authority>"`. This clears `progress.json` out of `running` so the autonomous loop stops cleanly and the dashboard shows idle/done.
+10. For roles requiring workers, CEO must require a Worker Evidence Manifest and worker report paths under `.harness/documents/{goal_name}/hotfix-{hotfix_index}-{hotfix_name}/{owning-cxx}/workers/` before accepting CXX completion.
+11. At S/M, CQO registers a lesson when recurrence is plausible or the cause is non-obvious; otherwise write `none — <reason>` in cqo.md Recurrence Notes. L retains mandatory lesson registration.
+12. For acceptance, leave the mission active and run `bash scripts/harness-company-complete.sh . <reason> <mission-rel>` as the final action; the script checks evidence before writing `complete` and `active:false`. On refusal, keep working. For termination without acceptance, first write lifecycle `cancelled`, `superseded`, or `closed` and `active:false`, then call the same explicit transition. `closed` means ended without acceptance; disclose “미수락 종료” in the Owner report and never archive without PASS. For an external-authority block, record `blocked`/`active:false` and run `bash scripts/harness-company-block.sh . "<exact missing authority>"`. `<mission-rel>` is the path relative to `.harness/documents/`.
 13. Do not invoke internal roles through slash commands; commands are Owner entrypoints only.
 14. Do not ask the Owner whether to continue, hire workers, choose internal options, or start the next step. If CEO cannot decide alone, convene the relevant CXX agents and decide from their written recommendations. CEO may approve reversible routine operations such as local cron/launchd/wake automation, dashboard refresh, monitoring cadence, Telegram briefing format using existing credentials, and mission consolidation/supersede cleanup. Stop only for external authority such as new credentials/secrets, payment approval, legal/business acceptance, unavailable production access, destructive data action, or direct conflict with stated Owner direction.
 
-Lessons before plan (AGENTS.md Hard Rule 20): CEO and every CXX read `.harness/conventions/{shared,role}.md` and `.harness/gotchas/{shared,role}.md`, follow only the topic links those files name, and write `## Lessons Preflight` **before** the first edit, the first measurement, and the first worker brief. Every role document and worker report closes with a one-line `## Lessons Tally` immediately above `## Implementation Notes` — `0 fired` is a valid tally and must be stated, not omitted. Requirements a CXX must satisfy that its workers must also satisfy go into the worker brief **verbatim**. The Stop hook enforces this; it is not advisory.
+Lessons before plan: read relevant shared/role conventions and gotchas before edits, measurements, or briefs. At effective tier S/M, role documents may replace Lessons Preflight + Lessons Tally with `## Lessons` containing `Preflight: <applicable items and why>` (before work) and `Fired: <items or 0 fired>` (at completion). `## Implementation Notes` may contain concise bullets. At L, retain Lessons Preflight, Lessons Tally, and all four Implementation Notes subsections. All worker reports retain the full seeded format at every tier. **Worker brief:** name the seeded report path and instruct the worker to fill its existing sections incrementally. Do not copy the report skeleton, Tally, or Notes block into the brief. Continue to pass relevant corpus links and copy behavioral requirements absent from the seed (including the browser-automation clause) verbatim.
 
 Scale the read to the fix. A four-line patch pays the index files plus only the topic links that match the fix — not the whole corpus. The ordering constraint holds at every size; the depth does not.