coding-agent-harness 1.0.8 → 1.1.0

package/templates/integrations/api-contract.md

@@ -13,7 +13,7 @@ API
 
 | Service Profile | Development Context | Contract Index | Last Verified | Confidence |
 | --- | --- | --- | --- | --- |
-| `coding-agent-harness/context/architecture/services/<service-key>.md` | `coding-agent-harness/context/development/external-context/<service-key>.md` | `coding-agent-harness/context/integrations/README.md` | unknown | low |
+| `{{paths.harnessRoot}}/context/architecture/services/<service-key>.md` | `{{paths.harnessRoot}}/context/development/external-context/<service-key>.md` | `{{paths.harnessRoot}}/context/integrations/README.md` | unknown | low |
 
 ## Auth
 

package/templates/integrations/event-contract.md

@@ -13,7 +13,7 @@ Event
 
 | Service Profile | Development Context | Contract Index | Last Verified | Confidence |
 | --- | --- | --- | --- | --- |
-| `coding-agent-harness/context/architecture/services/<service-key>.md` | `coding-agent-harness/context/development/external-context/<service-key>.md` | `coding-agent-harness/context/integrations/README.md` | unknown | low |
+| `{{paths.harnessRoot}}/context/architecture/services/<service-key>.md` | `{{paths.harnessRoot}}/context/development/external-context/<service-key>.md` | `{{paths.harnessRoot}}/context/integrations/README.md` | unknown | low |
 
 ## Topic / Channel
 

package/templates/integrations/third-party/vendor-template.md

@@ -13,7 +13,7 @@ Third-party service
 
 | Service Profile | Development Context | Contract Index | Last Verified | Confidence |
 | --- | --- | --- | --- | --- |
-| `coding-agent-harness/context/architecture/services/<vendor-key>.md` | `coding-agent-harness/context/development/external-context/<vendor-key>.md` | `coding-agent-harness/context/integrations/README.md` | unknown | low |
+| `{{paths.harnessRoot}}/context/architecture/services/<vendor-key>.md` | `{{paths.harnessRoot}}/context/development/external-context/<vendor-key>.md` | `{{paths.harnessRoot}}/context/integrations/README.md` | unknown | low |
 
 ## Auth
 

package/templates/integrations/webhook-contract.md

@@ -13,7 +13,7 @@ Webhook
 
 | Service Profile | Development Context | Contract Index | Last Verified | Confidence |
 | --- | --- | --- | --- | --- |
-| `coding-agent-harness/context/architecture/services/<service-key>.md` | `coding-agent-harness/context/development/external-context/<service-key>.md` | `coding-agent-harness/context/integrations/README.md` | unknown | low |
+| `{{paths.harnessRoot}}/context/architecture/services/<service-key>.md` | `{{paths.harnessRoot}}/context/development/external-context/<service-key>.md` | `{{paths.harnessRoot}}/context/integrations/README.md` | unknown | low |
 
 ## Auth
 

package/templates/ledger/Harness-Ledger.md

@@ -12,7 +12,7 @@ Repo Governance / CI-CD changes remain routed through their reference standards
 
 | ID | Scope | Module | Task | State | Queues | Plan | Review | Lessons Check | Closeout | Residual | Updated |
 | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
-| HL-YYYY-MM-DD-001 | task | none | Short operational title | planned | none | coding-agent-harness/planning/tasks/.../task_plan.md | pending | pending | pending | none | YYYY-MM-DD |
+| HL-YYYY-MM-DD-001 | task | none | Short operational title | planned | none | {{paths.harnessRoot}}/planning/tasks/.../task_plan.md | pending | pending | pending | none | YYYY-MM-DD |
 
 ## Field Rules
 

package/templates/modules/module_brief.md

@@ -0,0 +1,50 @@
+# {{TASK_TITLE}} Module
+
+## Module Key
+
+`{{TASK_ID}}`
+
+## Created
+
+{{DATE}}
+
+## Outcome Statement
+
+One sentence stating the durable module result this workstream must maintain.
+
+## Outcome Value
+
+Write 100-300 words explaining what the user, project, coordinator, or worker
+agents get from this module when it is healthy. Describe the decisions, delivery
+coordination, verification, or handoff work this module makes easier. Focus on
+the module's operating result rather than its internal process.
+
+## Deliverables
+
+- Visible artifact:
+- Owned surfaces:
+- Verification evidence:
+
+## First Human Read
+
+Name the module plan, task list, evidence, or generated outputs a human should
+inspect first.
+
+## Module Role
+
+State what this module owns and why it exists.
+
+## Boundaries
+
+- Owns: directories, services, or document areas under this module.
+- Shared surfaces: files that require coordinator sync.
+- Does not own: adjacent modules or global files outside the declared scope.
+
+## Completion Judgment
+
+List the conditions that prove this module brief still reflects the active module
+contract. Keep execution detail in `module_plan.md`.
+
+## Current Work
+
+List active module tasks or point to `module_plan.md`.

package/templates/modules/module_plan.md

@@ -0,0 +1,49 @@
+# {{TASK_TITLE}} Module Plan
+
+## Module Identity
+
+- Module key: `{{TASK_ID}}`
+- Owner: coordinator
+- Branch:
+- Write scope:
+- Shared surfaces:
+- Depends on:
+
+## Boundaries
+
+- May edit:
+- Must not edit:
+- External dependencies:
+
+## Steps
+
+| Step ID | Name | Status | Task Plan | Depends On |
+| --- | --- | --- | --- | --- |
+| MOD-01 | Define module operating contract | planned | none | none |
+
+## Active Tasks
+
+| Task | State | Owner | Evidence | Notes |
+| --- | --- | --- | --- | --- |
+| none | planned | coordinator | none | Replace this row when module tasks exist. |
+
+## Verification
+
+| Check | Command or Evidence | Required |
+| --- | --- | --- |
+| Module task contract | `harness check --profile target-project .` | yes |
+
+## Handoff
+
+- Branch:
+- Commit SHA:
+- Checks:
+- Files changed:
+- Residual risks:
+- Coordinator updates needed:
+
+## Template Boundary
+
+This module root owns only `brief.md` and `module_plan.md` by default. Task
+execution contracts such as `execution_strategy.md`, `visual_map.md`,
+`review.md`, and `walkthrough.md` belong under concrete task directories.

package/templates/modules/registry_view.md

@@ -0,0 +1,9 @@
+# Module Registry
+
+Generated from `harness.yaml` `modules.items`. Do not edit this view directly.
+
+## Active Modules
+
+| ID | Key | Title | Prefix | Branch | Current Step | Status | Owner | Scope | Shared | Depends On | Plan | Brief | Updated |
+| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
+| none | none | none | none | none | none | planned | none | none | none | none | none | none | none |

package/templates/modules/session_prompt_pack.md

@@ -0,0 +1,55 @@
+# Module Session Prompt Pack
+
+Use this global prompt pack when a coordinator starts work for a registered
+module. Replace placeholders with current module facts from `harness.yaml`,
+the generated `Module-Registry.md`, and the module's `module_plan.md`.
+
+## Context Package
+
+- Project: [project]
+- Module key: [module]
+- Task directory: [path]
+- Module plan: [path]
+- Assigned worktree: [path]
+- Assigned branch: [branch]
+
+## Goal
+
+[State one concrete module outcome.]
+
+## Write Scope
+
+You may edit only:
+
+- [path]
+
+Do not edit shared SSoT files, coordinator-owned integration files, or unrelated
+modules unless the coordinator explicitly assigns that scope.
+
+## Required Output
+
+- Branch name
+- Commit SHA
+- Files changed
+- Checks run and results
+- Residual risks
+- Coordinator updates needed
+
+## Review And State Rule
+
+- Keep `task.state`, `lifecycleState`, `reviewStatus`, and `closeoutStatus` separate when reporting progress.
+- `done` means the implementation step finished. It is not `closed` until closeout evidence is recorded.
+- Use the current task `visual_map.md` phase table as the lifecycle map. At the end of a slice, inspect the current gate phase and follow its `Exit Command` only when its `Actor` is `agent`.
+- If review is required, update `review.md`. Human review completion must be confirmed through the local Dashboard workbench; do not mark it complete while open P0/P1/P2 findings remain.
+
+## Shared Sync Rule
+
+Do not update Module Registry, Harness Ledger, Closeout Index, Regression SSoT,
+or Cadence Ledger from a worker session unless the coordinator assigned the
+shared lock.
+
+## Stop Rule
+
+Pause and report if the requested change requires editing outside the assigned
+scope, resolving unrelated dirty files, making a product decision, or changing a
+shared contract.

package/templates/planning/brief.md

@@ -1,7 +1,5 @@
 # {{TASK_TITLE}}
 
-## Brief
-
 ## Task ID
 
 `{{TASK_ID}}`
@@ -10,23 +8,49 @@
 
 {{DATE}}
 
-## Outcome
+## Outcome Statement
+
+One sentence stating the concrete result this task must produce.
+
+## Outcome Value
+
+Write 100-300 words explaining what the user, project, or next agent gets when
+this task is complete. Describe the decision, delivery, verification, or next
+development step this result unlocks. Focus on the usable result rather than the
+implementation process unless the implementation method is itself the
+deliverable.
+
+## Deliverables
 
-State the user-visible or project-visible result this task must deliver.
+- Visible artifact:
+- Modified surface:
+- Verification evidence:
+
+## First Human Read
+
+Name the files, evidence, or generated outputs a human should inspect first when
+they open this task.
 
 ## Boundaries
 
 - In scope: files, behavior, documentation, or verification this task may change.
 - Out of scope: work that must not be folded into this task.
-- Stop conditions: uncertainty, risk, or missing access that requires coordinator or user review.
+- Stop conditions: uncertainty, risk, or missing access that requires coordinator
+  or user review.
+
+## Completion Judgment
+
+List 3-5 concrete conditions that prove the outcome has been reached. Keep the
+full execution plan in `task_plan.md`.
 
 ## Execution Contract
 
 - Owner: coordinator
 - Lifecycle state: not_started
-- Required files: `INDEX.md`, `task_plan.md`, `execution_strategy.md`, `visual_map.md`, `progress.md`, `findings.md`, `review.md`
+- Required files: `INDEX.md`, `task_plan.md`, `execution_strategy.md`,
+  `visual_map.md`, `progress.md`, `findings.md`, `review.md`
 - Required closeout: verification evidence recorded in `progress.md`
 
-## First Next Step
+## Current Next Step
 
-Replace this line with the first concrete action before implementation starts.
+State the first concrete action before implementation starts.

package/templates/planning/module_brief.md

@@ -1,7 +1,5 @@
 # {{TASK_TITLE}} Module
 
-## Brief
-
 ## Module Key
 
 `{{TASK_ID}}`
@@ -10,7 +8,29 @@
 
 {{DATE}}
 
-## Role
+## Outcome Statement
+
+One sentence stating the durable module result this workstream must maintain.
+
+## Outcome Value
+
+Write 100-300 words explaining what the user, project, coordinator, or worker
+agents get from this module when it is healthy. Describe the decisions, delivery
+coordination, verification, or handoff work this module makes easier. Focus on
+the module's operating result rather than its internal process.
+
+## Deliverables
+
+- Visible artifact:
+- Owned surfaces:
+- Verification evidence:
+
+## First Human Read
+
+Name the module plan, task list, evidence, or generated outputs a human should
+inspect first.
+
+## Module Role
 
 State what this module owns and why it exists.
 
@@ -20,6 +40,11 @@ State what this module owns and why it exists.
 - Shared surfaces: files that require coordinator sync.
 - Does not own: adjacent modules or global files outside the declared scope.
 
+## Completion Judgment
+
+List the conditions that prove this module brief still reflects the active module
+contract. Keep execution detail in `module_plan.md`.
+
 ## Current Work
 
 List the active module tasks or point to `module_plan.md`.

package/templates/planning/module_plan.md

@@ -1,30 +1,37 @@
-# [Module Name] - Module Plan
+# {{TASK_TITLE}} Module Plan
 
 ## Module Identity
 
-- Module key: [key]
-- Owner: [agent / human]
-- Branch: [branch]
-- Write Scope: [directories or files]
-- Shared files: [files requiring coordinator lock, or none]
+- Module key: `{{TASK_ID}}`
+- Owner: coordinator
+- Branch:
+- Write scope:
+- Shared surfaces:
+- Depends on:
 
 ## Boundaries
 
-- May edit: [paths]
-- Must not edit: [paths or shared surfaces]
-- External dependencies: [services, packages, teams, or none]
+- May edit:
+- Must not edit:
+- External dependencies:
 
 ## Steps
 
 | Step ID | Name | Status | Task Plan | Depends On |
 | --- | --- | --- | --- | --- |
-| MOD-01 | [step name] | planned | [path] | none |
+| MOD-01 | Define module operating contract | planned | none | none |
+
+## Active Tasks
+
+| Task | State | Owner | Evidence | Notes |
+| --- | --- | --- | --- | --- |
+| none | planned | coordinator | none | Replace this row when module tasks exist. |
 
 ## Verification
 
 | Check | Command or Evidence | Required |
 | --- | --- | --- |
-| [check name] | [command or path] | yes / no |
+| Module task contract | `harness check --profile target-project .` | yes |
 
 ## Handoff
 
@@ -34,3 +41,11 @@
 - Files changed: [summary]
 - Residual risks: [none / list]
 - Coordinator updates needed: [none / list]
+
+## Template Boundary
+
+This legacy planning template is kept for compatibility. New module roots are
+scaffolded from `templates/modules/**` and own only `brief.md` plus
+`module_plan.md` by default. Task execution contracts such as
+`execution_strategy.md`, `visual_map.md`, `review.md`, and `walkthrough.md`
+belong under concrete task directories.

package/templates/planning/module_session_prompt.md

@@ -1,4 +1,8 @@
-# Module Worker Session Prompt
+# Module Session Prompt Pack
+
+This legacy planning template is kept as a compatibility alias. New installs use
+the global `templates/modules/session_prompt_pack.md`; per-module
+`session_prompt.md` files are not scaffolded by default.
 
 ## Context Package
 
@@ -21,6 +25,11 @@ You may edit only:
 
 Do not edit shared SSoT files, coordinator-owned integration files, or unrelated modules unless the coordinator explicitly assigns that scope.
 
+Create or update concrete work under
+`{{paths.modulesRoot}}/<module-key>/tasks/<task-id>/`. Task execution contracts
+such as `execution_strategy.md` and `visual_map.md` live in those task
+directories, not in the module root.
+
 ## Required Output
 
 - Branch name
@@ -35,7 +44,7 @@ Do not edit shared SSoT files, coordinator-owned integration files, or unrelated
 - Keep `task.state`, `lifecycleState`, `reviewStatus`, and `closeoutStatus` separate when reporting progress.
 - `done` means the implementation step finished. It is not `closed` until closeout evidence is recorded.
 - Use the current task `visual_map.md` phase table as the lifecycle map. At the end of a slice, inspect the current gate phase and follow its `Exit Command` only when its `Actor` is `agent`.
-- If review is required, update `review.md`. Human review completion must be confirmed through the local dashboard workbench or by the coordinator with `harness review-confirm`; do not mark it complete while open P0/P1/P2 findings remain.
+- If review is required, update `review.md`. Human review completion must be confirmed through the local Dashboard workbench; do not mark it complete while open P0/P1/P2 findings remain.
 
 ## Shared Sync Rule
 

package/templates/planning/optional/slices/_slice-template/brief.md

@@ -1,5 +1,27 @@
 # Slice Brief
 
+## Outcome Statement
+
+One sentence stating the concrete slice result.
+
+## Outcome Value
+
+Write 100-300 words explaining what the parent task, coordinator, or downstream
+worker gets when this slice is complete. Describe what decision, integration,
+verification, or next slice this result unlocks. Keep implementation detail in
+the slice plan or evidence files.
+
+## Deliverables
+
+- Visible artifact:
+- Modified surface:
+- Verification evidence:
+
+## First Human Read
+
+Name the slice evidence, changed files, or handoff note a human should inspect
+first.
+
 ## Identity
 
 | Parent Phase ID | Depends On | State | Owner / Handoff |
@@ -16,6 +38,12 @@
 - Out of scope: [items]
 - Write scope: [paths]
 
+## Completion Judgment
+
+- [ ] The stated slice result is present.
+- [ ] Required evidence is recorded.
+- [ ] Shared updates or residual risks are named for the coordinator.
+
 ## Required Evidence
 
 | Evidence | Command / Path | Required |

package/templates/planning/review.md

@@ -82,7 +82,7 @@ Do not keep sample findings. If there are no material findings, leave only the h
 | Blocked | yes / no | Open blocking finding, invalid state transition, failed audit, or human waiver needed. | Blocker is fixed, closed, or explicitly waived. |
 | Lessons | yes / no | Lesson candidate needs rejection, task-local retention, dry-run promotion, or a sedimentation task. | Human decides candidate routing; promotion remains a separate maintenance task unless explicitly approved. |
 | Confirmed / Finalized | yes / no | Human confirmation exists; closeout or governance work may still be pending. | Closeout, ledger, and lesson routing are complete. |
-| Soft-deleted / Superseded | yes / no | Task has tombstone, superseded-by, archive, duplicate, or abandoned status. | Reopen or keep as read-only audit history. |
+| Soft-deleted / Superseded | yes / no | Task has tombstone, superseded-by, or archive state; duplicate or abandoned semantics are recorded as `Reason`. | Reopen or keep as read-only audit history. |
 
 ## Final Confidence Basis
 

package/templates/planning/visual_map.md

@@ -27,7 +27,7 @@ flowchart LR
 | INIT-01 | init | none | planned | 0 | Approved task plan and execution strategy | `task_plan.md`, `execution_strategy.md` | `harness task-start {{TASK_ID}}` | agent | missing | none | coordinator |
 | EXEC-01 | execution | INIT-01 | planned | 0 | Scoped implementation, document update, and verification evidence | diff, commands, worker handoff, or artifact path | `harness task-phase {{TASK_ID}} EXEC-01 --state done --completion 100 --evidence present` | agent | missing | [risk] | [owner] |
 | GATE-01 | gate | EXEC-01 | planned | 0 | Agent Review Submission | `review.md`, progress update, lesson routing | `harness task-review {{TASK_ID}} --message "<summary>"` | agent | missing | [risk] | coordinator |
-| GATE-02 | gate | GATE-01 | planned | 0 | Human Review Confirmation | review packet and human confirmation | `harness review-confirm {{TASK_ID}} --confirm {{TASK_ID}}` | human | missing | agent must not perform human confirmation | human |
+| GATE-02 | gate | GATE-01 | planned | 0 | Human Review Confirmation | review packet and human confirmation | Open local Dashboard workbench and confirm `{{TASK_ID}}` | human | missing | agent must not perform human confirmation | human |
 
 Allowed Kind: init, execution, gate.
 Allowed Actor: agent, human, coordinator.

package/templates/reference/docs-library-standard.md

@@ -20,16 +20,16 @@ Use these directories as a low-entropy context system:
 
 | Directory | Owns | Must Not Own | Required Schema Signals |
 | --- | --- | --- | --- |
-| `coding-agent-harness/context/architecture/` | system structure, service responsibility, ownership, service catalog, critical flows, ADRs | endpoint payloads, mock instructions, task logs | `Context Doc Type`, `Source Evidence`, `Last Verified`, `Confidence` |
-| `coding-agent-harness/context/development/` | local setup, codebase map, external development context, external source packs, mocks, stubs, cross-repo debugging | long-lived architecture facts, API payload contracts, undigested external document dumps | `Context Doc Type`, `Development Use`, `Do Not Assume`, `Mocks / Stubs`, `Source Evidence`, `Last Verified`, `Confidence` |
-| `coding-agent-harness/context/integrations/` | API/event/webhook/SDK/third-party contracts, auth, payloads, errors, contract tests | global topology, service ownership catalog, debugging notes | `Context Doc Type`, `Contract Type`, `Auth`, `Payload`, `Errors`, `Contract Tests`, `Source Evidence`, `Last Verified`, `Confidence` |
+| `{{paths.harnessRoot}}/context/architecture/` | system structure, service responsibility, ownership, service catalog, critical flows, ADRs | endpoint payloads, mock instructions, task logs | `Context Doc Type`, `Source Evidence`, `Last Verified`, `Confidence` |
+| `{{paths.harnessRoot}}/context/development/` | local setup, codebase map, external development context, external source packs, mocks, stubs, cross-repo debugging | long-lived architecture facts, API payload contracts, undigested external document dumps | `Context Doc Type`, `Development Use`, `Do Not Assume`, `Mocks / Stubs`, `Source Evidence`, `Last Verified`, `Confidence` |
+| `{{paths.harnessRoot}}/context/integrations/` | API/event/webhook/SDK/third-party contracts, auth, payloads, errors, contract tests | global topology, service ownership catalog, debugging notes | `Context Doc Type`, `Contract Type`, `Auth`, `Payload`, `Errors`, `Contract Tests`, `Source Evidence`, `Last Verified`, `Confidence` |
 
 Concrete split:
 
-- `coding-agent-harness/context/architecture/service-catalog.md` gives only the service summary and links.
-- `coding-agent-harness/context/integrations/<service>-api-contract.md` owns payload bodies, auth, errors, and contract tests.
-- `coding-agent-harness/context/development/external-context/<service>.md` owns mocks, stubs, unsafe assumptions, and debug notes.
-- `coding-agent-harness/context/development/external-source-packs/` owns external source indexes, digests, and projection status only; final facts must be written back to `context/{architecture,development,integrations}`.
+- `{{paths.harnessRoot}}/context/architecture/service-catalog.md` gives only the service summary and links.
+- `{{paths.harnessRoot}}/context/integrations/<service>-api-contract.md` owns payload bodies, auth, errors, and contract tests.
+- `{{paths.harnessRoot}}/context/development/external-context/<service>.md` owns mocks, stubs, unsafe assumptions, and debug notes.
+- `{{paths.harnessRoot}}/context/development/external-source-packs/` owns external source indexes, digests, and projection status only; final facts must be written back to `context/{architecture,development,integrations}`.
 
 ## External Source Intake
 

package/templates/reference/execution-workflow-standard.md

@@ -40,6 +40,19 @@ Optional directories are created only when triggered:
 
 Preset packages must not add or replace root-level base scaffold documents. Presets may append controlled sections to fixed base documents or add isolated resources under `references/**` and `artifacts/**`. Resource rows belong only in `references/INDEX.md` and `artifacts/INDEX.md`; the root `INDEX.md` may show only system-rendered preset summary fields.
 
+## Module Package Boundary
+
+Registered modules live in root `harness.yaml` under `modules.items`. The
+generated `planning/modules/Module-Registry.md` is a reading view, not the
+editable source of truth.
+
+Use `harness module register` or `harness module scaffold` instead of
+hand-copying module files. The module root owns only `brief.md` and
+`module_plan.md` by default. Task execution contracts such as
+`execution_strategy.md`, `visual_map.md`, `review.md`, and `walkthrough.md`
+belong under concrete task directories, including
+`planning/modules/<key>/tasks/<task-id>/`.
+
 ## Required Checklist
 
 - Goal, scope, acceptance criteria, and constraints are written down.

package/templates/reference/external-source-intake-standard.md

@@ -10,7 +10,7 @@ This standard defines how agents receive, filter, organize, and project large ex
 external source material -> source pack index -> digest -> context/{architecture,development,integrations} execution projection
 ```
 
-`context/architecture`, `context/development`, and `context/integrations` only hold facts that have been distilled enough to guide work. Raw external files, long documents, screenshots, exported chats, diagrams, and historical packets first go through `coding-agent-harness/context/development/external-source-packs/`.
+`context/architecture`, `context/development`, and `context/integrations` only hold facts that have been distilled enough to guide work. Raw external files, long documents, screenshots, exported chats, diagrams, and historical packets first go through `{{paths.harnessRoot}}/context/development/external-source-packs/`.
 
 ## When To Ask The User
 
@@ -33,14 +33,14 @@ Recommended questions:
 | Case | Storage |
 | --- | --- |
 | Only 1-4 stable external documents | No separate source pack is required; link them from `Source Evidence` in the relevant `context/{architecture,development,integrations}` docs |
-| More than 5 documents, multiple topics, or continuing growth | Create `coding-agent-harness/context/development/external-source-packs/<source-key>/` |
+| More than 5 documents, multiple topics, or continuing growth | Create `{{paths.harnessRoot}}/context/development/external-source-packs/<source-key>/` |
 | Material contains secrets, customer data, private links, or cannot be committed | Do not copy raw files; record external location, owner, access condition, and digest only |
 | Material is safe to commit | Raw files may go under `raw/`, but only digested facts may be projected into execution docs |
 
 Recommended structure:
 
 ```text
-coding-agent-harness/context/development/external-source-packs/<source-key>/
+{{paths.harnessRoot}}/context/development/external-source-packs/<source-key>/
 ├── README.md              # source index and projection status
 ├── digests/               # digest for each source or source group
 ├── raw/                   # commit-safe raw material only
@@ -49,10 +49,10 @@ coding-agent-harness/context/development/external-source-packs/<source-key>/
 
 Do not replicate a full `context/{architecture,development,integrations}` tree for every microservice. The source pack is the intake layer. The stable execution entries remain:
 
-- `coding-agent-harness/context/architecture/service-catalog.md`
-- `coding-agent-harness/context/architecture/services/<service-key>.md`
-- `coding-agent-harness/context/development/external-context/<service-key>.md`
-- `coding-agent-harness/context/integrations/<contract>.md`
+- `{{paths.harnessRoot}}/context/architecture/service-catalog.md`
+- `{{paths.harnessRoot}}/context/architecture/services/<service-key>.md`
+- `{{paths.harnessRoot}}/context/development/external-context/<service-key>.md`
+- `{{paths.harnessRoot}}/context/integrations/<contract>.md`
 
 ## Intake Flow
 
@@ -68,9 +68,9 @@ Do not replicate a full `context/{architecture,development,integrations}` tree f
 
 | Source Content | Projection Target |
 | --- | --- |
-| Service responsibility, upstream/downstream relationship, owner, data ownership, topology | `coding-agent-harness/context/architecture/service-catalog.md` or `services/<service-key>.md` |
-| Local mocks, stubs, startup, debugging, cross-repo development behavior | `coding-agent-harness/context/development/external-context/<service-key>.md` |
-| Endpoint, payload, auth, error, event, webhook, SDK, contract test | `coding-agent-harness/context/integrations/<contract>.md` |
+| Service responsibility, upstream/downstream relationship, owner, data ownership, topology | `{{paths.harnessRoot}}/context/architecture/service-catalog.md` or `services/<service-key>.md` |
+| Local mocks, stubs, startup, debugging, cross-repo development behavior | `{{paths.harnessRoot}}/context/development/external-context/<service-key>.md` |
+| Endpoint, payload, auth, error, event, webhook, SDK, contract test | `{{paths.harnessRoot}}/context/integrations/<contract>.md` |
 | Unconfirmed, conflicting, stale, or background-only material | Keep in source pack README / digest; do not project into execution docs |
 
 ## Prohibited

package/templates/reference/repo-governance-standard.md

@@ -12,7 +12,7 @@ Define repository-level rules for branches, commits, pull requests, ownership, g
 4. Generated files, caches, build output, local runtime state, and secrets must be ignored or stored in the approved location.
 5. Commit verified, meaningful slices proactively. Deferred commits require an explicit no-commit reason, owner, and next step.
 6. Do not mix unrelated dirty changes into a task commit. CLI-owned Harness writes should use the local Harness commands so their locked, allowlisted auto-commit can protect shared governance files.
-7. Pull requests must follow `coding-agent-harness/governance/standards/pull-request-standard.md` and describe intent, changed surfaces, version impact, checks run, checks not run, review status, references, and residual risk.
+7. Pull requests must follow `{{paths.harnessRoot}}/governance/standards/pull-request-standard.md` and describe intent, changed surfaces, version impact, checks run, checks not run, review status, references, and residual risk.
 8. Required checks and material review findings block merge unless an approved exception is recorded.
 9. Merge or release ownership must be explicit when several branches or workers contribute to the same outcome.
 

package/templates/reference/review-routing-standard.md

@@ -20,6 +20,10 @@ Define when work needs review, which reviewer identity is appropriate, and how r
 12. Worker subagents require one user authorization recorded in `execution_strategy.md`; reuse is limited to the same task, scope, and worktree/branch.
 13. A `Would a worker subagent materially help?` decision of `ask-user` is a blocking gate until `User Authorization Decision` records `authorized`, `denied`, or `not-needed`.
 
+Subagent authorization is task-local. Do not look for module-root
+`execution_strategy.md`; module roots use `brief.md` and `module_plan.md`, while
+worker authorization belongs in the concrete task directory.
+
 ## Required Checklist
 
 - Review trigger and reviewer identity are documented.