agent-docs-bootstrap 0.0.0-stage → 0.3.0

package/skills/docs-bootstrap/vendor/writing-for-agents/SKILL-MECHANICS.md

@@ -0,0 +1,22 @@
+# Skill mechanics
+
+The skill-specific branch of [`writing-for-agents`](SKILL.md): what changes when the document is a skill (frontmatter, the invocation choice, and router skills). Everything else about writing it is the universal reference in `SKILL.md`.
+
+## Invocation
+
+Two choices, trading the two loads:
+
+- A **model-invoked** skill keeps a `description`, so the agent can fire it autonomously, and other skills can reach it. You can still type its name: model-invocation always _includes_ user reach; a description only ever adds agent discovery, never removes the human's. The description is the skill's top-level context pointer, forced to stay loaded at all times: permanent context load in exchange for discoverability. A model-invoked skill whose content is all reference is also one home for shared reference: another skill can invoke it, so reference needed by several skills lives in one place. Mechanics: omit `disable-model-invocation`, and write a model-facing description carrying the trigger branches (the pointer-writing rules in `SKILL.md` apply in full).
+- A **user-invoked** skill strips the description from the agent's reach: only the human typing its name can invoke it, and no other skill can. Zero context load, but it spends cognitive load: you are the index that must remember it exists. Mechanics: set `disable-model-invocation: true`; the `description` becomes human-facing: a one-line summary, trigger lists stripped.
+
+Pick model-invocation only when the agent must reach the skill on its own, or another skill must. If it only ever fires by hand, make it user-invoked and pay no context load.
+
+Shared reference that two user-invoked skills both need can live in neither: with no descriptions, neither can fire the other. Push it to a plain file outside the skill system: external reference any skill can point at.
+
+## Splitting by invocation
+
+The invocation cut of splitting (the sequence cut lives in `SKILL.md`): split off a model-invoked skill when you have a distinct leading word that should trigger it on its own (a trigger word you actually use in your prompts), or another skill must reach it. You pay context load for the new always-loaded description, so that independent reach has to be worth it.
+
+## Router skills
+
+When user-invoked skills multiply past what you can remember, that piled-up cognitive load is cured by a **router skill**: one user-invoked skill that names the others and when to reach for each, so the human has one skill to remember instead of many. It can only hint, never fire them: user-invoked skills have no description, so nothing but the human can reach them.

package/skills/docs-bootstrap/vendor/writing-for-agents/agents/openai.yaml

@@ -0,0 +1,3 @@
+interface:
+  display_name: "Writing for Agents"
+  short_description: "Write documents agents consume"

package/skills/docs-bootstrap/vendor/writing-for-agents/writing-for-agents.md

@@ -0,0 +1,81 @@
+---
+name: writing-for-agents
+description: Writing documents for agents. Use when creating or editing skills, or modifying AGENTS.md or CLAUDE.md.
+---
+
+Reference for writing any document an agent consumes: a skill, an `AGENTS.md` / `CLAUDE.md`, a doc reached by a pointer. The packaging differs; the writing does not: the same levers make each one predictable, since the agent takes the same _process_ every run rather than producing the same output.
+
+When the document you're writing is a skill, read [`SKILL-MECHANICS.md`](SKILL-MECHANICS.md) for frontmatter, invocation choice, and router skills.
+
+## Context pointers
+
+A **context pointer** is a reference held in the agent's context that names some out-of-context material and encodes the condition for reaching it. A skill's description is one; a line in `AGENTS.md` naming a doc is the same object. The pointer's _wording_, not its target, decides when the agent reaches the material, and how reliably. A must-have target behind a weakly worded pointer is a variance bug: sharpen the wording first, and inline the material only if sharpening fails.
+
+A pointer does two jobs: state what the material is, and list the **branches** that should trigger reaching it (a branch is a distinct case the document handles, so different runs take different paths through it). Every word of an always-loaded pointer costs on every turn, so it earns even harder pruning than the body:
+
+- **Front-load the leading word**: the pointer is where it does its triggering work.
+- **One trigger per branch.** Synonyms that rename a single branch are one branch written twice; collapse them and keep only genuinely distinct branches.
+- **Cut identity the body already carries.**
+
+## The two loads
+
+Every document and pointer you add spends one of two budgets:
+
+- **Context load** is the cost of always-loaded material on the agent's window: an `AGENTS.md` line, a skill description, anything sitting in context every turn, spending tokens and attention whether or not it fires.
+- **Cognitive load** is the cost on the human: which documents exist and when to reach for each. The human is the index. Not a cost to minimise: it is the price of human agency; spend it where human judgement matters, remove it where it does not.
+
+Material reached only through a pointer escapes context load at the price of the pointer's own line; material with no pointer at all rides entirely on cognitive load.
+
+## Information hierarchy
+
+A document is built from two content types: **steps** (the ordered actions the agent performs) and **reference** (definitions, rules, facts consulted on demand). The two mix freely: all steps (a recipe), all reference (a review's rules, this skill), or both. The core decision is where each piece sits on the **information hierarchy**, a ladder ranked by how immediately the agent needs the material:
+
+1. **In-file step** is the primary tier: what the agent does, in order.
+2. **In-file reference** is consulted on demand. Often a legitimately flat peer-set (every rule of a review on one rung), which is a fine arrangement, not a smell.
+3. **Disclosed reference** is pushed out into a separate file, reached by a context pointer, loaded only when the pointer fires. Spans a sibling file in the same folder through fully external reference that lives anywhere and any document can point at.
+
+Push too little down and the top bloats; push too much and you hide material the agent actually needs. That tension is the whole decision.
+
+**Progressive disclosure** is the move down the ladder (out of the main file and behind a pointer) so the top stays legible. Not primarily a token optimisation: it is how the hierarchy is protected. Branching is the cleanest disclosure test: inline what every branch needs, and push behind a pointer what only some branches reach. When a document has steps, in-file reference that should be disclosed buries them and turns attending to them into a coin-flip: a variance lever, not just a legibility one.
+
+**Co-location** is the within-file companion: where the ladder decides _how far down_ a piece sits, co-location decides _what sits beside it_ once there. Keep a concept's definition, rules, and caveats under one heading rather than scattered, so reading one part brings its neighbours with it. The test: the document should read like documentation written for the agent. Grouped material reads that way; scattered material does not. (Distinct from duplication: that repeats one meaning in two places; scattering fragments one meaning across many.)
+
+**Sprawl** is the failure mode here: a document simply too long, even when every line is live and unique. Attention thins across the excess, and every extra line is one more to keep relevant. The cure is the ladder: disclose reference behind pointers, and split by branch or sequence so each path carries only what it needs.
+
+## Steps and completion criteria
+
+Every step ends on a **completion criterion**, the condition that tells the agent the work is done. Two properties make it a lever:
+
+- **Clarity**: can the agent tell done from not-done? A vague bound ("understanding reached") invites **premature completion**: ending the step before it is genuinely done, attention slipping to _being done_. The visible steps still ahead (the **post-completion steps**) supply the pull; the criterion's clarity is the resistance. Defend in order: **sharpen the bound first** (local and cheap); only if it is irreducibly fuzzy _and_ you observe the rush, hide the later steps by splitting the sequence. Hiding only works across a real context boundary (a hand-off or a subagent dispatch; an inline call leaves the later steps in context and clears nothing).
+- **Demand**: how much it requires. "Every modified model accounted for" forces thorough work where "produce a change list" does not. Demand drives **legwork** (the digging the agent does within the work, latent in the wording rather than written as its own step), and it is not step-bound: "every rule applied" binds a body of flat reference just as "every step done" binds a sequence, which is how an all-reference document still carries an exhaustiveness bar.
+
+The strongest criteria are both checkable and exhaustive.
+
+## When to split
+
+Splitting one document into two spends one of the two loads, so split only when the cut earns it:
+
+- **By sequence**: split a run of steps where the post-completion steps tempt the agent to rush the one in front of it. Keeping them out of view drives more legwork on the current task. Beware the reverse: merging sequences exposes each step's later steps to what follows, inviting premature completion.
+- **By invocation**, skill-specific: see [`SKILL-MECHANICS.md`](SKILL-MECHANICS.md).
+
+## Leading words
+
+A **leading word** is a compact concept already living in the model's pretraining that the agent thinks with while running the document (_lesson_, _fog of war_, _tracer bullets_). Repeated as a token, never as a sentence, it accumulates a distributed definition and anchors a whole region of behaviour in the fewest tokens, by recruiting priors the model already holds. Coining your own works if you define it clearly, but a made-up word recruits no priors: you pay in definition tokens what a pretrained word gives free; reach for an existing word first.
+
+It anchors twice. In the body, _execution_: the agent reaches for the same behaviour every time the word appears, and inside flat reference it focuses attention on a class of thing to look for. In a pointer, _invocation_: when the same word lives in your prompts, your docs, and your codebase, the agent links that shared language to the material and reaches it more reliably.
+
+Hunt for opportunities to refactor with leading words. A triad spelled out at three sites, a pointer spending a sentence to gesture at one idea. Each is a passage begging to collapse into a single token:
+
+- "fast, deterministic, low-overhead" → _tight_ (a _tight_ loop).
+- "a loop you believe in" → _red_, turning a fuzzy gate into a binary observable state (the loop goes _red_ on the bug, or it doesn't).
+
+You win twice: fewer tokens, and a sharper hook for the agent to hang its thinking on. Assume every document is carrying restatements that leading words retire. Go find them.
+
+**Negation** is the failure mode beside this lever: steering by prohibition drags the forbidden behaviour into context and makes it _more_ available, not less. _Don't think of an elephant_, and the elephant is all there is; the negation is a weak modifier the strongly-activated concept overruns, so the ban half-reads as an instruction to do the thing. Prompt the **positive**: state the target behaviour ("write one-line comments") so the banned one is never spoken. A prohibition earns its place only as a hard guardrail you cannot phrase positively; even then, pair it with the positive target so attention lands on what to do.
+
+## Pruning
+
+- Keep each meaning in a **single source of truth**: one authoritative place, so changing the behaviour is a one-place edit. **Duplication** (the same meaning in more than one place) costs maintenance and tokens, and inflates a meaning's prominence on the ladder past its real rank. (The accidental inverse of a leading word, which repeats a token on purpose, never the meaning.)
+- The **environment** is a source of truth too (`package.json` scripts, config files, the directory layout, `--help` output), and a document that restates it is a **cache**: a copy of a lookup, earning its load only when the lookup is expensive. Cache what the agent cannot find by looking: the unwritten convention, the reason behind a choice, the gotcha no config confesses. Leave the one-file, one-command lookups to the environment, where they cannot go stale.
+- Check every line for **relevance**: does it still bear on what the document does? A line loses relevance by never bearing on the task (mere exposition, or a branch that should be disclosed) or by going stale as the behaviour or world it describes changes. Shorter documents are easier to keep relevant. Without a pruning discipline the default fate is **sediment**: stale layers that settle because adding feels safe and removing feels risky, until you must core down through them to find what is still live.
+- Hunt **no-ops** sentence by sentence: an instruction the model already obeys by default pays load to say nothing. The test (does it change behaviour versus the default?) is model-relative, not reader-relative: two people disagreeing about a no-op disagree about the default, and settle it by running the document, not by debate. When a sentence fails, delete the whole sentence rather than trim words from it. The test also grades leading words: a word too weak to beat the default (_be thorough_ when the agent is already thorough-ish) is a no-op, and the fix is a stronger word (_relentless_), not a different technique.

package/skills/docs-check/SKILL.md

@@ -0,0 +1,114 @@
+---
+name: docs-check
+description: Optional reader test for project documentation — a fresh agent, started as a separate process, plans a task on a history-free code snapshot with the current docs. Two modes - history (real past tasks, the plan is compared with what the real commit changed, gaps become one list of doc fixes) and own task (the human gives a task and reads the plan). Use only when the user asks to check, test or measure a project's docs or AGENTS.md; docs-bootstrap does not run it.
+---
+
+# docs-check
+
+Checks whether an agent can work from the project's documentation. It is optional: run it only when the human asks. It costs a reader process per task and several minutes each, and it diagnoses where a fresh agent stumbles rather than proving the documentation good.
+
+Two modes. Ask once which one, unless the human already said or gave a task with the command:
+
+- **History** — three real past tasks; the reader's plans are compared with what the real commits changed, and the gaps become one list of doc fixes. Steps 1–5 below.
+- **Own task** — the human gives a task, for example a current ticket; the reader plans it from the documents, and the human reads the plan. See [Own task](#own-task).
+
+You organise the test; you do not judge whether the documentation is good and do not defend it. In the history mode the reference is what the real commit changed, not your opinion.
+
+No `docs/agents/reader-tests.md` → create it from this skill's template (`templates/reader-tests.md`). No `docs/agents/scratch/` line in the project's `.gitignore` → add it. Hand-written documentation can be checked too, not only documentation built with `docs-bootstrap`.
+
+## Step 1. Tasks
+
+Three tasks with status `ready` in `reader-tests.md` → leak check below, then step 2. A task marked `used` was the source of earlier fixes: the documents now hold its answer, so it tests nothing. Replace it.
+
+Missing tasks → start the `docs-scout` subagent with the brief "Reader test task candidates" from `docs-bootstrap/references/scout-briefs.md`. Pick three from different areas yourself, preferring candidates with a clear commit message, a test in the diff and no unrelated files in `--stat`. Prefer commits made after the documents were written (the dates in `docs/agents/bootstrap-state.md`, or the documents' first commits): the documents could not know their solutions. Fewer than three such commits → say so in the report: older tasks may share material with the documents. Do not stop to ask the human: they see the tasks with the results in step 5 and can strike out what came from a poor commit.
+
+Record in `reader-tests.md`: commit hash, parent commit, task wording, reference, status `ready`.
+
+**Wording.** What a developer would understand without the ticket: what to do and where the user sees it. No file names, hashes, ticket numbers or tracker links. The reader gets it word for word.
+
+**Reference.** Files and areas of code and tests from `git show --stat <hash>`, without unrelated changes in the commit. Verification commands only if the reader can find them in the repository (package scripts, CI jobs that run locally). No documentation files, CI scans or deploys: the reader cannot name them.
+
+**Leak check.** Before every run, take from `git show <hash>` the names the solution introduced: new files, classes, functions, endpoints, keys. Search for them:
+
+- in the parent's code (`git grep <name> <parent>`) → found: the solution is already in the snapshot. Mark the task `replaced` and pick another;
+- in the current documents (`AGENTS.md`, `CLAUDE.md`, `CONTEXT*.md`, `docs/`) → found: the documents already know the answer and the task tests nothing. Mark it `used` and pick another.
+
+## Steps 2–3. Snapshot and reader
+
+The reader must not see the solution, the history, your session's instructions or the project's own repository. So it runs as a **separate process** of your harness, in a snapshot **outside the repository**, never as a subagent of this session: a subagent shares the session's working directory, where the solution sits in the current code. The kit's script builds the snapshot and starts the reader the same way in bash, PowerShell and cmd.
+
+1. Write the run's tasks to `docs/agents/scratch/reader-runs/<date>/tasks.json`:
+
+   ```json
+   { "tasks": [ { "n": 1, "parent": "<parent>", "task": "<wording from reader-tests.md>" } ] }
+   ```
+
+2. Run the script once per task from the project root, with `--harness` set to the harness you are running in (`claude`, `codex` or `opencode`). The three runs are independent: start them in parallel if your harness can, one at a time only if the model provider rate-limits parallel requests. A reader takes several minutes: if your shell tool has a timeout, set it to 15 minutes.
+
+   ```
+   node <skills>/docs-check/scripts/reader-run.mjs docs/agents/scratch/reader-runs/<date> <N> --harness <harness>
+   ```
+
+   `<skills>` is where this skill is installed: `.claude/skills` or `.agents/skills`. Write the command exactly like this, with forward slashes and without `cd`, `&&`, pipes or redirects, so it works in any shell. For a global install, add `--reader <path to the installed docs-reader>`.
+
+What the script does:
+
+- the snapshot is the parent's code without the documents and the kit's installed files, with the current documents from the working tree on top, committed or not (git-ignored and deleted ones are skipped, `docs/agents/` never goes in). Do not keep unfinished hand edits in the documents during a run: the reader gets them as they are. `README` and other files stay as they were in the parent commit, like the code: today's `README` may already describe the solution;
+- the snapshot gets an empty `git init`, which stops the harness from loading `AGENTS.md` or `CLAUDE.md` from parent directories. No installed dependencies: the reader builds a plan, it does not execute it;
+- the reader: Claude Code `claude -p --restricted` with only `Read`, `Grep`, `Glob` and no MCP servers; Codex `codex exec -s read-only` with every MCP server, plugin and app turned off; OpenCode `opencode run --pure` with the `docs-reader` agent, whose permissions deny everything but reading, MCP tools included. The prompt is the installed `docs-reader`, the task goes through stdin;
+- it writes `rt-<N>-plan.md` and `rt-<N>-log.md` to the run directory and prints a three-line summary.
+
+Non-zero exit or "plan EMPTY" → show the human the summary and `rt-<N>-log.md`; do not guess. A plan that cites files outside the snapshot, the history, a tracker or external docs is invalid: note why in `reader-tests.md` and rerun.
+
+The user's global instructions may still reach the reader: Codex loads `~/.codex/AGENTS.md`, OpenCode `~/.config/opencode/AGENTS.md`; whether `claude -p --restricted` loads `~/.claude/CLAUDE.md` is not documented. If they are about this project, ask the human to move them aside for the test.
+
+Your harness is not `claude`, `codex` or `opencode`, its CLI is not in PATH, or there is no `node` → do not play the reader yourself: you have seen the docs and the history. Run the script with `--snapshot-only` (it prints the snapshot path) and ask the human to start a new agent session with its working directory set to that path, paste the `docs-reader` prompt and the task, and save the answer to `rt-<N>-plan.md`.
+
+## Step 4. Gaps
+
+Compare each plan with the reference in `reader-tests.md`. Each of these is a gap, written down as is, without interpretation:
+
+- an expected file or area is not named in the plan (a named directory of the area counts);
+- an expected verification command is not named;
+- a term listed under `_Avoid_` in the glossary is used (if `CONTEXT.md` exists);
+- a directory outside the expected areas is proposed for change;
+- a solution rejected in an ADR is proposed (if `docs/adr/` exists);
+- an item under "had to search" whose answer is or should be in the documents.
+
+Not gaps, but kept:
+
+- "had to search" items only a human can answer (product clarifications) — candidates for how-tos and `AGENTS.md`;
+- **snapshot artifacts** — the documents describe a newer layout than the parent's code (a moved directory, a new test runner). Many of them mean the task is too old: replace it next time.
+
+An item where the reader says it found the answer in the documents is not a "had to search" item.
+
+## Step 5. Fixes
+
+**One list, no rerun loop.**
+
+1. Group the gaps by the document that should hold the answer (`AGENTS.md`, glossary, a how-to, an ADR). For each fix, the gap it closes and the task it came from. Write a fix as general project knowledge ("new pages are registered in …"), not as this task's solution. A fix never contains passwords, tokens or keys: only where to get them. Product questions go to a separate block as open questions, not fixes.
+2. Show the list with the three tasks and their commits. Say that some gaps may come from the commit rather than the docs (a commit the team would not repeat today, unrelated changes), and let the human strike those out. This is the only stop in the check.
+3. Apply the approved fixes. Mark each task the documents were fixed for as `used`: they now hold its answer.
+4. Do not rerun the same task to "confirm" the fix: it will pass because the answer is now in the documents, which proves nothing. The next check on new tasks shows whether the docs got better.
+
+Add a row to the runs table in `reader-tests.md`: date, task, gaps found, snapshot artifacts, fixes applied.
+
+Report to the human: per task, the gaps and the applied fixes, the open questions, and when to check again — after a few weeks of team work or notable changes, on new tasks.
+
+## Own task
+
+The human gives a task in their own words, for example a ticket they are about to start. There is no reference commit, so there is no leak check, no gap list and no task status: the human reads the plan and decides what the documents lack.
+
+1. Take the wording as the human gave it. Remove file names, hashes and tracker links only with their consent: they hand the reader the answer. Record the task in the "Own tasks" table of `reader-tests.md` with the commit it runs on.
+2. The snapshot is the current commit: write `tasks.json` as in steps 2–3 with `"parent"` set to the hash from `git rev-parse HEAD`, and run the script the same way. The code comes from that commit and the documents from the working tree, so uncommitted code changes are not in the snapshot: tell the human if `git status` shows any.
+3. Show the plan as it is, then two lists from it: what the reader had to search the code for or guess, and its questions to the team. Do not grade the plan or argue with it.
+4. The human says what the documents should have answered. Group those items by document as in step 5 and apply what they approve; secrets are never written, only where to get them. Add a row to the runs table.
+
+Do not reuse an own task for the history mode later: its plan has already shaped the documents.
+
+## Never
+
+- Ask any agent to judge the plans or the documentation instead of comparing with the reference: an LLM judge prefers the longer, more confident plan.
+- Start the reader as a subagent of this session, from inside the repository, or with your own commands instead of `reader-run.mjs`.
+- Show the reader the project's git history or a tracker link, or mention the history. The empty repository that `reader-run.mjs` creates in the snapshot holds no history.
+- Rerun a task after fixing the documents for it.

package/skills/docs-check/agents/openai.yaml

@@ -0,0 +1,3 @@
+interface:
+  display_name: "Docs Check"
+  short_description: "Reader-test a project's docs"

package/skills/docs-check/scripts/reader-run.mjs

@@ -0,0 +1,188 @@
+#!/usr/bin/env node
+// docs-check steps 2–3: a history-free snapshot outside the repository and a fresh reader started as a
+// separate process of your harness. Works the same from bash, PowerShell and cmd; needs git and Node 18+.
+//
+//   node <skills>/docs-check/scripts/reader-run.mjs <run dir> <N> --harness claude|codex|opencode [--reader <path>] [--timeout-min <m>]
+//   node <skills>/docs-check/scripts/reader-run.mjs <run dir> <N> --snapshot-only
+//
+// <run dir> holds tasks.json: { "tasks": [ { "n": 1, "parent": "<hash>", "task": "<wording>" } ] }.
+// Writes rt-<N>-plan.md (the reader's answer) and rt-<N>-log.md there; prints a short summary.
+// --timeout-min stops the reader after that many minutes (default 12).
+
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { execFileSync, spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+
+const a = parseArgs(process.argv.slice(2));
+if (a.help || a._.length < 2) {
+  const src = fs.readFileSync(new URL(import.meta.url), 'utf8').split('\n').slice(1);
+  console.log(src.slice(0, src.findIndex(l => !l.startsWith('//'))).map(l => l.replace(/^\/\/ ?/, '')).join('\n'));
+  process.exit(a.help ? 0 : 1);
+}
+
+const ROOT = git(['rev-parse', '--show-toplevel'], process.cwd()).trim();
+const RUN = path.resolve(a._[0]);
+const N = Number(a._[1]);
+const spec = JSON.parse(read(path.join(RUN, 'tasks.json'), 'no tasks.json in the run directory'));
+const task = (spec.tasks || []).find(t => Number(t.n) === N) || die(`tasks.json has no task n=${N}`);
+if (!task.parent || !task.task) die(`task ${N} has no parent or task`);
+
+// The path hash keeps two repositories with the same folder name apart.
+const SNAPS = path.join(os.tmpdir(), `agent-docs-check-${path.basename(ROOT)}-${createHash('sha1').update(ROOT).digest('hex').slice(0, 8)}`);
+const SNAP = path.join(SNAPS, `rt-${N}`);
+const TIMEOUT_MS = Number(a['timeout-min'] || 12) * 60 * 1000;
+const win = process.platform === 'win32';
+
+// Documents the kit builds; kit-installed paths and its run files never reach the reader. The marker is committed
+// and could hold any line, so only lines shaped like an installed path count (a line `docs` would hide every document).
+const KIT_DIRS = ['.claude/skills', '.claude/agents', '.agents/skills', '.codex/agents', '.opencode/agents', '.opencode/commands'];
+const kitPaths = read(path.join(ROOT, '.agent-docs-bootstrap'), '', true).split('\n').map(l => l.trim())
+  .filter(l => KIT_DIRS.includes(path.posix.dirname(l)) && /^[a-z0-9-]+(\.md|\.toml)?$/.test(path.posix.basename(l)));
+const isKit = (p) => p === '.agent-docs-bootstrap' || p.startsWith('docs/agents/') || kitPaths.some(k => p === k || p.startsWith(k + '/'));
+// README and other files stay as they were in the parent commit, like the code: they are the project as it was,
+// not the documents under test, and today's README may already describe the solution.
+const isDoc = (p) => /(^|\/)(AGENTS\.md|CLAUDE\.md|CONTEXT[^/]*\.md)$/.test(p) || p.startsWith('docs/');
+
+// ---------- snapshot: the parent's code without documents, today's documents from the working tree on top
+fs.rmSync(SNAP, { recursive: true, force: true });
+fs.mkdirSync(SNAP, { recursive: true });
+exportParent(p => !isKit(p) && !isDoc(p));
+// Tracked and new documents, committed or not; git-ignored and deleted ones are skipped.
+const docs = git(['ls-files', '-z', '--cached', '--others', '--exclude-standard'], ROOT).split('\0')
+  .filter(p => p && isDoc(p) && !isKit(p) && fs.existsSync(path.join(ROOT, p)));
+for (const p of docs) {
+  fs.mkdirSync(path.dirname(path.join(SNAP, p)), { recursive: true });
+  fs.copyFileSync(path.join(ROOT, p), path.join(SNAP, p));
+}
+// An empty repository stops harnesses from loading AGENTS.md / CLAUDE.md from parent directories.
+git(['init', '-q', SNAP], SNAP);
+
+const files = walk(SNAP).filter(p => !p.startsWith('.git/'));
+const leaked = files.filter(isKit);
+if (leaked.length) die(`kit files in the snapshot: ${leaked.slice(0, 5).join(', ')}`);
+if (a['snapshot-only']) { console.log(SNAP); process.exit(0); }
+
+// ---------- reader
+const harness = a.harness || die('pass --harness claude|codex|opencode: the harness you are running in');
+const defaults = { claude: '.claude/agents/docs-reader.md', codex: '.codex/agents/docs-reader.toml', opencode: '.opencode/agents/docs-reader.md' };
+if (!defaults[harness]) die(`unknown harness '${harness}'`);
+const readerFile = path.resolve(ROOT, a.reader || defaults[harness]);
+const reader = parseReader(read(readerFile, `no docs-reader for ${harness} (installed with --target ${harness}? pass --reader <path>)`));
+const ask = `Task: ${task.task.trim()}\n\nMake a plan: files, changes, verification commands. Do not edit anything. Separately list everything you had to search the code for or guess, and your questions to the team.`;
+const plan = path.join(RUN, `rt-${N}-plan.md`);
+fs.mkdirSync(RUN, { recursive: true });
+
+let cmd, args, env = { ...process.env }, input, fromFile = false;
+if (harness === 'claude') {
+  // --restricted: no shell tools, file tools confined to the snapshot, no settings files; no MCP servers.
+  cmd = 'claude';
+  args = ['-p', '--restricted', '--strict-mcp-config', '--no-session-persistence', '--output-format', 'text',
+    ...(reader.model ? ['--model', reader.model] : []), '--tools', 'Read,Grep,Glob'];
+  input = `${reader.prompt}\n\n${ask}`;
+} else if (harness === 'codex') {
+  cmd = 'codex';
+  args = ['exec', '-C', SNAP, '-s', 'read-only', '--skip-git-repo-check', '--ephemeral', ...codexMcpOff(),
+    ...(reader.model ? ['-m', reader.model] : []), '-o', plan, '-'];
+  input = `${reader.prompt}\n\n${ask}`;
+  fromFile = true;
+} else {
+  // The agent definition goes to a config dir outside the snapshot; its permissions do the confining.
+  const cfg = path.join(SNAPS, 'opencode');
+  fs.mkdirSync(path.join(cfg, 'agents'), { recursive: true });
+  fs.copyFileSync(readerFile, path.join(cfg, 'agents', 'docs-reader.md'));
+  env = { ...env, OPENCODE_CONFIG_DIR: cfg, OPENCODE_DISABLE_CLAUDE_CODE: '1' };
+  cmd = 'opencode';
+  args = ['run', '--pure', '--dir', SNAP, '--agent', 'docs-reader'];
+  input = ask;
+}
+
+// On Windows the CLIs are often .cmd shims that only a shell can start. The task goes through stdin,
+// so quotes and non-ASCII text never pass through the shell.
+const child = spawn(win ? [cmd, ...args].map(q).join(' ') : cmd, win ? [] : args,
+  { cwd: SNAP, env, shell: win, stdio: ['pipe', 'pipe', 'pipe'] });
+child.stdin.end(input);
+let out = '', err = '';
+child.stdout.on('data', d => { out += d; });
+child.stderr.on('data', d => { err += d; });
+// With shell: true on Windows, child.kill() stops only cmd.exe; taskkill /T takes the CLI with it.
+const stop = () => win ? spawn('taskkill', ['/pid', String(child.pid), '/T', '/F'], { stdio: 'ignore' }) : child.kill();
+const timer = setTimeout(() => { err += `\nstopped after ${TIMEOUT_MS / 60000} min`; stop(); }, TIMEOUT_MS);
+child.on('error', e => die(`${cmd} did not start: ${e.message}`));
+child.on('close', code => {
+  clearTimeout(timer);
+  if (!fromFile || !fs.existsSync(plan)) fs.writeFileSync(plan, out);
+  const text = read(plan, '', true).trim();
+  fs.writeFileSync(path.join(RUN, `rt-${N}-log.md`), `# rt-${N}: ${harness} reader output\n\n## stdout\n\n\`\`\`\n${out.trim()}\n\`\`\`\n\n## stderr\n\n\`\`\`\n${err.trim()}\n\`\`\`\n`);
+  console.log([
+    `task ${N}, parent ${task.parent}, harness ${harness}`,
+    `snapshot: ${SNAP} (${files.length} files, ${docs.length} documents)`,
+    `reader: exit ${code}, plan ${text ? 'written' : 'EMPTY'}: ${path.relative(ROOT, plan)}`,
+  ].join('\n'));
+  process.exit(code === 0 && text ? 0 : 1);
+});
+
+// ---------- helpers
+function exportParent(keep) {
+  const list = git(['ls-tree', '-r', '-z', '--name-only', task.parent], ROOT).split('\0').filter(Boolean).filter(keep);
+  if (!list.length) return;
+  const index = path.join(SNAPS, `index-${N}`);
+  const genv = { ...process.env, GIT_INDEX_FILE: index };
+  try {
+    // A temporary index: the repository's own index and working tree are untouched, no tar needed.
+    execFileSync('git', ['read-tree', task.parent], { cwd: ROOT, env: genv, stdio: ['ignore', 'ignore', 'pipe'] });
+    execFileSync('git', ['checkout-index', '-f', '-z', '--stdin', `--prefix=${SNAP.split(path.sep).join('/')}/`],
+      { cwd: ROOT, env: genv, input: list.join('\0'), stdio: ['pipe', 'ignore', 'pipe'] });
+  } finally { fs.rmSync(index, { force: true }); }
+}
+// `-c mcp_servers={}` is merged into the user's table and disables nothing. Plugin and app servers go with
+// their features; every server from config.toml is switched off by name. A name with a dot cannot be
+// addressed in a `-c` path.
+function codexMcpOff() {
+  const off = ['--disable', 'plugins', '--disable', 'apps'];
+  const ls = [...off, 'mcp', 'list', '--json'];
+  let list;
+  try {
+    const out = execFileSync(win ? ['codex', ...ls].join(' ') : 'codex', win ? [] : ls,
+      { cwd: SNAP, encoding: 'utf8', shell: win, stdio: ['ignore', 'pipe', 'pipe'] });
+    list = JSON.parse(out);
+  } catch (e) { die(`codex mcp list --json failed, cannot turn MCP servers off: ${(e.stderr || e.message).toString().trim()}`); }
+  const names = list.filter(s => s.enabled !== false).map(s => s.name);
+  const dotted = names.filter(n => n.includes('.'));
+  if (dotted.length) die(`MCP server names with a dot cannot be turned off for the reader: ${dotted.join(', ')}`);
+  return [...off, ...names.flatMap(n => ['-c', `mcp_servers.${n}.enabled=false`])];
+}
+// The installed docs-reader: Markdown with frontmatter (Claude Code, OpenCode) or TOML (Codex).
+function parseReader(text) {
+  if (readerFile.endsWith('.toml')) {
+    return { prompt: (text.match(/developer_instructions = '''\n?([\s\S]*?)'''/) || die(`${readerFile}: no developer_instructions`))[1].trim(),
+      model: (text.match(/^model = "(.*)"$/m) || [])[1] };
+  }
+  const m = text.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/) || die(`${readerFile}: no frontmatter`);
+  return { prompt: m[2].trim(), model: (m[1].match(/^model: (.+)$/m) || [])[1] };
+}
+function git(args, cwd) {
+  try { return execFileSync('git', args, { cwd, encoding: 'utf8', maxBuffer: 256 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'] }); }
+  catch (e) { die(`git ${args.join(' ')}: ${(e.stderr || e.message).toString().trim()}`); }
+}
+function walk(dir, base = dir) {
+  return fs.readdirSync(dir, { withFileTypes: true }).flatMap(e => {
+    const p = path.join(dir, e.name);
+    return e.isDirectory() ? walk(p, base) : [path.relative(base, p).split(path.sep).join('/')];
+  });
+}
+function q(s) { return /^[\w./:\\=,-]+$/.test(s) ? s : `"${s}"`; }
+function read(p, msg, optional) { try { return fs.readFileSync(p, 'utf8').replace(/\r\n/g, '\n'); } catch { return optional ? '' : die(`${msg}: ${p}`); } }
+function die(msg) { console.error(`reader-run: ${msg}`); process.exit(1); }
+function parseArgs(argv) {
+  const o = { _: [] };
+  for (let i = 0; i < argv.length; i++) {
+    const k = argv[i];
+    if (k === '-h' || k === '--help') o.help = true;
+    else if (k === '--snapshot-only') o['snapshot-only'] = true;
+    else if (k.startsWith('--')) o[k.slice(2)] = argv[++i];
+    else o._.push(k);
+  }
+  return o;
+}

package/skills/docs-check/templates/reader-tests.md

@@ -0,0 +1,29 @@
+# Reader test tasks
+
+Tasks for the `docs-check` skill, an optional check the team runs when it wants to. History tasks are three typical project tasks from git history, picked by the agent; own tasks are given by a human.
+
+Wording — what a developer would understand without the ticket: no file names, hashes or tracker links. Reference — files and areas of code and tests from `git show --stat`, without unrelated changes; commands only those the reader can find in the repository. Documentation, CI scans and deploys are not part of the reference.
+
+Status: `ready` — goes into the next check; `used` — the documents hold its answer (they were fixed for it or mention the solution), replace it; `replaced` — the solution was already in the parent's code, or the task was swapped.
+
+## History tasks
+
+| # | Commit (hash) | Parent | Task (wording for the reader) | Expected files/areas | Expected commands | Area | Status |
+|---|---|---|---|---|---|---|---|
+| 1 | | | | | | | ready |
+| 2 | | | | | | | ready |
+| 3 | | | | | | | ready |
+
+## Own tasks
+
+| Date | Commit the snapshot ran on | Task (wording for the reader) | Given by |
+|---|---|---|---|
+| | | | |
+
+## Runs
+
+Plans and reader logs are in `docs/agents/scratch/reader-runs/<date>/`. For an own task, the gaps are what the human said the documents should have answered; snapshot artifacts do not apply.
+
+| Date | Task | Gaps found | Snapshot artifacts | Fixes applied |
+|---|---|---|---|---|
+| | | | | |