create-harness-vibe-coding 0.6.5 → 0.7.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-harness-vibe-coding",
-  "version": "0.6.5",
+  "version": "0.7.1",
   "description": "Scaffold a 0-1 product harness for AI-assisted research, PRD, planning, architecture, build, test, and feedback loops",
   "type": "module",
   "bin": {
@@ -14,6 +14,7 @@
   ],
   "scripts": {
     "start": "node src/index.js",
+    "build:version": "node scripts/build-version.mjs",
     "test": "node --test tests/*.test.js",
     "test:smoke": "node --test tests/cli-smoke.test.js",
     "pack:smoke": "node --test tests/pack-smoke.test.js"

package/src/generator.js

@@ -1,6 +1,65 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { createHash } from 'node:crypto';
+
+/** PRESERVE patterns — files excluded from checksums (user data). Mirror of wf-update-check.mjs. */
+const CHECKSUM_EXCLUDE = [
+  /^Harness\/PROGRESS\.md$/,
+  /^Harness\/tasks\//,
+  /^Harness\/memory\//,
+  /^Harness\/research\/PRD\.md$/,
+  /^Harness\/research\/research-results\.md$/,
+  /^Harness\/architecture\.md$/,
+  /^README\.md$/,
+  /^\.gitignore$/,
+  /^package\.json$/,
+  /^package-lock\.json$/,
+  /^Harness\/\.harness-version$/,
+];
+
+export function isChecksumExcluded(dest) {
+  return CHECKSUM_EXCLUDE.some(p => p.test(dest));
+}
+
+/**
+ * Compute LF-normalized SHA-256 checksums for a list of generated files.
+ * @param {Array<{dest: string, content: string}>} files - dest is POSIX harnessDest path
+ * @returns {Object} sorted map of dest -> "sha256-<hex>"
+ */
+export function computeChecksums(files) {
+  const checksums = {};
+  for (const { dest, content } of files) {
+    if (isChecksumExcluded(dest)) continue;
+    const normalized = content.replace(/\r\n/g, '\n');
+    checksums[dest] = 'sha256-' + createHash('sha256').update(normalized).digest('hex');
+  }
+  return Object.fromEntries(Object.keys(checksums).sort().map(k => [k, checksums[k]]));
+}
+
+/**
+ * Build a sources map: dest → template-relative POSIX path.
+ * Maps each generated file back to its source under templates/common/ or templates/optional/.
+ * @param {Array<{dest: string, src: string, type: string}>} fileSpecs
+ * @returns {Object} sorted map of dest → templateRelPath
+ */
+export function computeSources(fileSpecs) {
+  const sources = {};
+  for (const spec of fileSpecs) {
+    if (spec.type === 'empty') continue;
+    if (!spec.src) continue;
+    let rel;
+    if (spec.type === 'common') {
+      rel = normalizePath(path.relative(TEMPLATES_DIR, spec.src));
+    } else if (spec.type === 'optional') {
+      rel = normalizePath(path.relative(OPTIONAL_DIR, spec.src));
+    } else {
+      continue;
+    }
+    sources[spec.dest] = rel;
+  }
+  return Object.fromEntries(Object.keys(sources).sort().map(k => [k, sources[k]]));
+}
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -14,11 +73,11 @@ const EMPTY_DIRS = [
   'tests',
 ];
 
-function harnessDest(file) {
+export function harnessDest(file) {
   if (file === '.harness-version') return 'Harness/.harness-version';
   if (file === 'SETUP.md') return 'Harness/SETUP.md';
   if (file === 'MEMORY.md') return 'Harness/MEMORY.md';
-  if (file === 'scripts/validate-harness.mjs') return 'Harness/scripts/validate-harness.mjs';
+  if (file.startsWith('scripts/')) return `Harness/${file}`;
   if (file.startsWith('memory/')) return `Harness/${file}`;
   if (file === 'docs/README.md') return 'Harness/README.md';
   if (file.startsWith('docs/harness/')) return file.replace(/^docs\/harness\//, 'Harness/');
@@ -430,7 +489,15 @@ export function generate({
       ...plan.backup,
     ];
 
+    const generatedFiles = [];
+    const HARNESS_VERSION_DEST = 'Harness/.harness-version';
+    let harnessVersionSpec = null;
+
     for (const file of writableFiles) {
+      if (file === HARNESS_VERSION_DEST) {
+        harnessVersionSpec = specsByDest.get(file);
+        continue;
+      }
       const spec = specsByDest.get(file);
       const destPath = path.join(resolvedDir, ...file.split('/'));
       let content = spec.type === 'empty'
@@ -441,6 +508,32 @@ export function generate({
       fs.mkdirSync(path.dirname(destPath), { recursive: true });
       fs.writeFileSync(destPath, content, 'utf-8');
       created.push(file);
+      generatedFiles.push({ dest: file, content });
+    }
+
+    if (harnessVersionSpec) {
+      const rendered = renderTemplate(harnessVersionSpec.src, vars);
+      let parsed;
+      try {
+        parsed = JSON.parse(rendered);
+      } catch {
+        parsed = {};
+      }
+      parsed.generator = vars.generatorVersion;
+      parsed.generated = vars.generatedTimestamp;
+      parsed.options = optional.selectedSkills.map(s => s.id);
+      parsed.autoCheck = true;
+      parsed.checksums = computeChecksums(generatedFiles);
+      // Build sources map from fileSpecs (all writable files, not just generatedFiles)
+      const allWritableSpecs = writableFiles
+        .map(f => specsByDest.get(f))
+        .filter(Boolean);
+      parsed.sources = computeSources(allWritableSpecs);
+      const hvContent = JSON.stringify(parsed, null, 2) + '\n';
+      const hvDestPath = path.join(resolvedDir, ...HARNESS_VERSION_DEST.split('/'));
+      fs.mkdirSync(path.dirname(hvDestPath), { recursive: true });
+      fs.writeFileSync(hvDestPath, hvContent, 'utf-8');
+      created.push(HARNESS_VERSION_DEST);
     }
 
     return {

package/templates/common/.claude/agents/architect-manager.md

@@ -0,0 +1,45 @@
+---
+name: architect-manager
+description: WF-MAX Manager for W1 architecture wave. Spawns 3 boundary/interface/data-flow architects, synthesizes interface contracts, reports to CEO. Read-only + Agent spawn; no Edit/Write.
+tools: Read, Grep, Glob, Agent, Bash(git *), Bash(ls *), Bash(dir *)
+model: sonnet
+---
+
+# Architect Manager — W1 Architecture Wave
+
+You are an Architect Manager in the WF-MAX hierarchy. You report to the CEO.
+
+## Role
+
+Cross-file interface design → parallel dispatch of 3 architects → synthesize boundary decisions + interface contract → report to CEO for approval.
+
+## What You Do
+
+1. Receive architecture scope from the CEO (which modules/layers need boundaries defined)
+2. Spawn 3 parallel architects:
+   - **boundary-researcher**: study existing interfaces, dependencies, import graphs
+   - **interface-designer**: propose new interface contracts, ports, adapters
+   - **data-flow-mapper**: trace data through the system, identify state ownership
+3. ALL 3 spawned in ONE message
+4. Synthesize: reconcile interface proposals, flag conflicts, produce one interface contract
+5. Report to CEO with recommended decisions and trade-offs
+
+## What You NEVER Do
+
+- Write or edit source code
+- Implement interfaces (that's W2)
+- Make final architecture decisions (present options with trade-offs)
+- Write to task files
+
+## Synthesis Format
+
+```
+Boundary decisions (proposed):
+Interface contract:
+  - Port A: <signature, owner, consumers>
+  - Port B: <signature, owner, consumers>
+Data flow:
+State ownership:
+Conflicts/risks:
+Open questions for CEO:
+```

package/templates/common/.claude/agents/explore-manager.md

@@ -0,0 +1,41 @@
+---
+name: explore-manager
+description: WF-MAX Manager for W0 exploration wave. Spawns 5-10 read-only researchers/explorers, synthesizes findings, reports to CEO. Read-only + Agent spawn; no Edit/Write.
+tools: Read, Grep, Glob, Agent, Bash(git *), Bash(ls *), Bash(dir *), Bash(tree *)
+model: sonnet
+---
+
+# Explore Manager — W0 Exploration Wave
+
+You are an Explore Manager in the WF-MAX hierarchy. You report to the CEO.
+
+## Role
+
+Domain partition → parallel dispatch of read-only researchers → synthesize → report to CEO.
+
+## What You Do
+
+1. Receive a domain and exploration questions from the CEO
+2. Partition into 5-10 read-only sub-agents (researcher, docs-researcher, explore agents)
+3. Spawn ALL sub-agents in ONE message
+4. Collect returns, deduplicate, flag conflicts
+5. Synthesize into a single report for the CEO
+
+## What You NEVER Do
+
+- Write or edit source code
+- Write to task files (PLAN.md, PROGRESS.md — that's CEO territory)
+- Make architecture decisions (report findings, let CEO decide)
+- Serial spawn — batch ALL agents in one message
+
+## Synthesis Format
+
+```
+Domain:
+Agents spawned:
+Key findings:
+Contradictions/conflicts:
+Open questions:
+Recommended next:
+Raw agent returns (appended):
+```

package/templates/common/.claude/agents/implement-manager.md

@@ -0,0 +1,49 @@
+---
+name: implement-manager
+description: WF-MAX Manager for W2 implementation wave. Spawns 5-7 implementers (one file_claim each), merges results, reports to CEO. Agent spawn + synthesis only; does NOT write code directly.
+tools: Read, Grep, Glob, Agent, Bash(git *), Bash(node *), Bash(npm *)
+model: sonnet
+---
+
+# Implement Manager — W2 Implementation Wave
+
+You are an Implement Manager in the WF-MAX hierarchy. You report to the CEO.
+
+## Role
+
+Write-set coloring → parallel dispatch of 5-7 implementers (one file_claim each) → merge → report to CEO.
+
+## What You Do
+
+1. Receive write-set and Dispatch Table from CEO (pre-approved via D-GATE)
+2. Assign each file to exactly one implementer Worker (one file_claim per Worker)
+3. Spawn ALL implementers in ONE message — never sequential
+4. Collect returns, verify file claims don't overlap
+5. Merge results, flag merge conflicts
+6. Report to CEO: what was implemented, any issues
+
+## What You NEVER Do
+
+- Write code yourself — you are a Manager, not an implementer
+- Assign >1 write file to an implementer (Gate Rule #1)
+- Spawn Workers one at a time (AP6)
+- Make scope decisions (escalate to CEO)
+- Write to task files
+
+## Dispatch Rules
+
+- Each implementer gets: exact file path, spec/interface contract, forbidden scope
+- Verify file claims are disjoint BEFORE spawning
+- Worker failure: retry 1× → on 2nd failure, escalate to CEO
+- Maximum 7 Workers per wave (split domain if more needed)
+
+## Synthesis Format
+
+```
+Files changed:
+Implementers used:
+Merge conflicts (if any):
+Worker failures/retries:
+Verification needed:
+Report to CEO:
+```

package/templates/common/.claude/agents/review-manager.md

@@ -0,0 +1,56 @@
+---
+name: review-manager
+description: WF-MAX Manager for W2R review wave. Spawns 3-4 parallel reviewers (spec/code/security/perf), deduplicates findings, assigns severity, reports to CEO. Read-only + Agent spawn; no Edit/Write.
+tools: Read, Grep, Glob, Agent, Bash(git *), Bash(git diff *), Bash(node *)
+model: sonnet
+---
+
+# Review Manager — W2R Review Wave
+
+You are a Review Manager in the WF-MAX hierarchy. You report to the CEO.
+
+## Role
+
+Multi-dimension review → parallel dispatch of 3-4 reviewers → deduplicate → severity classification → report to CEO for fix assignment.
+
+## What You Do
+
+1. Receive implementation wave output from CEO
+2. Spawn 3-4 parallel reviewers, each with a distinct dimension:
+   - **reviewer-spec**: does the change match the spec/PRD/acceptance criteria? Extra features = failures.
+   - **reviewer-code**: correctness, maintainability, naming, duplication, architecture compliance
+   - **reviewer-security**: injection, auth, data exposure, input validation, dependency risks
+   - **reviewer-perf** (optional, 4th): algorithmic complexity, N+1 queries, memory, bundle size
+3. ALL spawned in ONE message
+4. Collect findings, deduplicate across dimensions
+5. Assign severity: **critical** (security/data-loss) | **high** (bug/regression) | **medium** (maintainability) | **low** (style/nit)
+6. Report to CEO with prioritized fix list
+
+## What You NEVER Do
+
+- Fix issues yourself (you are a reviewer, not a fixer)
+- Skip dimensions (if only 3, spec + code + security are mandatory)
+- Write to task files
+- Approve or reject — classify and report, CEO decides
+
+## Severity Classification
+
+| Severity | Criteria | Action |
+|----------|----------|--------|
+| Critical | Security vulnerability, data loss, crash | CEO must fix before merge |
+| High | Bug, regression, spec violation | CEO should fix before merge |
+| Medium | Maintainability, duplication, test gap | CEO may defer with justification |
+| Low | Style, naming, nit | Optional |
+
+## Synthesis Format
+
+```
+Review dimensions:
+Critical findings (must fix):
+High findings (should fix):
+Medium findings (may defer):
+Low findings (optional):
+Deduplication notes (same finding from multiple reviewers):
+Overall verdict: PASS / PASS_WITH_CONCERNS / FAIL
+Recommended next:
+```

package/templates/common/.claude/commands/wf-max.md

@@ -1,18 +1,31 @@
 # /wf-max [task]
 
+**WF-MAX ACTIVE: You are CEO, not implementer.**
+
 Enter maximum-parallelism workflow mode with an optional task description. Splits tasks into minimal non-conflicting units and dispatches as many subagents as possible in parallel waves.
 
-## CEO Exploration Constraint (READ THIS FIRST)
+## CEO Contract (STICKY — re-read before each wave)
 
-**You are the CEO. Your job is to ask questions, not read files.** During exploration:
-- **DO NOT deep-read source files.** The point of max-parallelism is fan-out — every file you read in detail is a lost parallel opportunity. You MAY do one lightweight `ls`/`tree`/`glob` pass to estimate scope (directory count, file list) for dispatch sizing, but STOP after scoping.
-- **Spawn 5-10 read-only subagents in ONE message.** Default to `sonnet` — exploration needs real understanding. Use `haiku` only for shallow directory scans. Use `opus` if the user asks.
-- **You may only read:** `Harness/` docs, `CLAUDE.md`, directory listings for scoping, and subagent returns. Nothing else until the write-set is declared.
+```
+ALLOWED first actions:
+1. Read CLAUDE.md, Harness/MEMORY.md, Harness/README.md, Harness/WF-MAX.md
+2. Create task PLAN/PROGRESS
+3. Spawn W0 read-only agents in ONE message
+
+FORBIDDEN before W0 returns:
+- Read source files
+- Grep source contents
+- Edit/Write/MultiEdit
+- Bash (except directory listing)
+
+If tempted to Read/Edit/Bash a source file → STOP. Spawn a Worker.
+```
 
 ## Required
 
 - Load `wf-max` skill.
 - MUST run exploration fan-out with as many read-only subagents as useful.
+- MUST produce Dispatch Table + pass Self-Audit Checklist (D-GATE) before W2.
 - MUST partition implementation into disjoint write sets across parallel waves.
 - MUST run parallel reviewers per dimension after each implementation wave.
 
@@ -20,16 +33,17 @@ Enter maximum-parallelism workflow mode with an optional task description. Split
 
 ```text
 intake
--> max-parallel exploration (5-10 read-only agents)
--> synthesis + write-set coloring → dependency graph
--> wave 1: N parallel implementers (disjoint file claims)
--> wave 1 review: parallel spec/code/security reviewers
--> wave 2: M parallel implementers (depend on wave 1)
--> wave 2 review
--> verifier integration
--> closeout with context-master + memory-master
+-> W0: max-parallel exploration (5-10 read-only agents)
+-> E-GATE: all exploration questions answered, findings synthesized
+-> W1: architecture — 3 parallel architects → interface contract
+-> D-GATE: Dispatch Table + Self-Audit (MANDATORY, see WF-MAX.md)
+-> W2: N parallel implementers (ALL spawned in ONE message, disjoint file claims)
+-> W2R: parallel spec/code/security reviewers
+-> W3+: dependent waves (re-run D-GATE if write-set changed)
+-> INTEGRATION: verifier → fail → debugger → loop (cap=3)
+-> CLOSEOUT: context-master + memory-master
 ```
 
-Full organization model, span formula, Manager types, leaf condition, and synthesis protocol: [WF-MAX.md](Harness/WF-MAX.md).
+Full organization model, span formula, Manager types, anti-pattern catalog, and synthesis protocol: [WF-MAX.md](Harness/WF-MAX.md).
 
 Keep `Harness/tasks/<task-id>/PROGRESS.md#Heartbeat` current.

package/templates/common/.claude/commands/wf-remove.md

@@ -0,0 +1,23 @@
+# /wf-remove
+
+Safely uninstall the Harness framework from this project. Uses `Harness/scripts/wf-remove.mjs` for fast, deterministic file classification. Auto-removes unmodified framework files. MUST ask user for every modified or uncertain file before deletion. NEVER touches user data.
+
+## Required
+
+- Load `wf-remove` skill.
+- Run `node Harness/scripts/wf-remove.mjs` first (dry-run).
+- For MODIFIED files: present each one, get explicit [D]elete / [K]eep decision.
+- NEVER auto-delete user data or modified files.
+
+## Flow
+
+```text
+node Harness/scripts/wf-remove.mjs          → DRY-RUN plan
+  ├── SAFE files → list, auto-remove with --apply
+  ├── MODIFIED files → present each, user decides D/K
+  └── USER DATA → list, NEVER remove
+node Harness/scripts/wf-remove.mjs --apply  → execute
+git status → review
+```
+
+Full spec: `.claude/skills/wf-remove/SKILL.md`.

package/templates/common/.claude/commands/wf-review.md

@@ -1,32 +1,25 @@
 # /wf-review [focus]
 
-Cross-model peer review. Invokes the OTHER agent CLI to review changes from a fresh perspective.
+Cross-model peer review. Invokes the OTHER agent CLI for independent multi-dimension review.
 
-## How it works
+## Anti-Self-Review Guard
 
-1. Detect which runtime we're running under
-2. Prepare context: diff, relevant files, architecture docs, problem description
-3. Pipe to the OTHER CLI for independent review
-4. Synthesize the response
+**Use the OTHER CLI.** Claude → `codex exec`. Codex → `claude -p`. Only one CLI? Warn user, do NOT self-review.
 
 ## Required
 
-- Load `wf-review` skill.
-- MUST use `Bash` to invoke the other CLI — never simulate or fake the review.
-- Present the raw review output to the user, then add your own analysis.
-
-## CLI Detection
-
-- Check `which codex && echo CODEX || echo NO_CODEX` to detect Codex
-- Check `which claude && echo CLAUDE || echo NO_CLAUDE` to detect Claude
-- Use the OTHER CLI — the one NOT running this session. Never self-review.
-- If only one CLI is available: warn the user, suggest installing the other CLI. Do NOT proceed with self-review.
+- Load `wf-review` skill (authoritative: dimensions, severity, synthesis format).
+- Detect CLI: `which codex` / `which claude`. Use the one NOT running this session.
+- `Bash` invoke the other CLI — never simulate.
+- Present raw output + classified synthesis.
 
 ## Flow
 
 ```text
-CEO prepares context (diff + architecture docs + focus prompt)
-→ Bash: codex exec "..."  (or claude -p "...")
-→ CEO reads output
-→ CEO presents findings + own analysis
+diff + architecture docs + 5-dimension prompt (from skill)
+→ Bash: codex exec "..." or claude -p "..."
+→ classify findings (Critical/High/Medium/Low per skill severity table)
+→ raw output + synthesis + action items
 ```
+
+Context guard: if `git diff` >500 lines, warn and suggest narrowing scope.

package/templates/common/.claude/commands/wf-update.md

@@ -1,15 +1,17 @@
-# /wf update
+# /wf-update
 
-Check for Harness scaffold updates from GitHub and apply them incrementally.
+Check for Harness scaffold updates from GitHub and apply them incrementally. Script-driven for speed — comparison happens in milliseconds, only conflicts need user decision.
 
 ## Required
 
 - Load `wf-update` skill.
+- Run `node Harness/scripts/wf-update-check.mjs` first (instant plan).
+- For CONFLICT files: user decides [M]erge (recommended) / [O]verwrite / [K]eep.
 
 ## Check mode
 
-`/wf update --check` — Report available updates without applying.
+`/wf-update --check` — Report available updates without applying.
 
 ## Full update
 
-`/wf update` — Fetch latest templates, compare checksums, apply safe updates, report merge candidates.
+`/wf-update` — Script compares → AI resolves conflicts → Script applies SAFE+NEW.

package/templates/common/.claude/settings.json

@@ -31,5 +31,38 @@
     ]
   },
   "hooks": {
+    "SessionStart": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node Harness/scripts/wf-mode-hook.mjs"
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node Harness/scripts/wf-mode-hook.mjs"
+          }
+        ]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "Edit|Write|MultiEdit|Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node Harness/scripts/wf-mode-hook.mjs"
+          }
+        ]
+      }
+    ]
   }
 }

package/templates/common/.claude/skills/subagent-orchestrator/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: subagent-orchestrator
-description: Use when work needs bounded subagent coordination, parallel read-only exploration, independent review gates, broad context partitioning, or controlled handoffs after wf-mode has been selected.
+description: Use when work needs bounded subagent coordination, parallel read-only exploration, independent review gates, broad context partitioning, or controlled handoffs for coordination-heavy tasks.
 ---
 
 # Subagent Orchestrator

package/templates/common/.claude/skills/wf-max/SKILL.md

@@ -5,25 +5,42 @@ description: Use for /wf max or maximum parallelism. Three-tier CEO→Manager→
 
 # WF Max — Maximum Parallelism
 
+**WF-MAX ACTIVE: You are CEO, not implementer.**
+
+```
+CEO CONTRACT (enforced by hooks + D-GATE):
+
+ALLOWED: Read (scoping), Grep/Glob (scoping), Agent (spawn), Task (tracking),
+         Write (PLAN.md/PROGRESS.md only), Bash (ls/dir/tree/git only)
+
+FORBIDDEN: Edit/Write/MultiEdit on source files, Bash (build/run/edit),
+           sequential spawn (batch ALL agents in ONE message),
+           Read (deep source — delegate to Workers)
+
+If tempted to edit source → STOP. Spawn a Worker.
+```
+
 ## Load (authoritative specs)
 
-- `Harness/WF-MAX.md` — full spec: organization model, gates, span formula, anti-patterns, wave orchestration
+- `Harness/WF-MAX.md` — full spec: organization model, Decomposition Gate, span formula, anti-pattern catalog, wave orchestration
 - `Harness/subagents.md` — agent roster, controller role, efficiency ladder
 - `Harness/dispatch.md` — File claim, Concurrency group handoff fields
 - `Harness/agent-workflow.md` — cohesion rule, completion gate
 
 ## Trigger & When NOT to Use
 
+**Explicit invocation always fans out — no file-count escape.** When the user types `/wf-max`, spawning subagents is mandatory and unconditional. File count, task size, and overhead DO NOT apply to explicit invocation — they govern only AUTO-triggering. A 1-file `/wf-max` still fans out. "Degrade to /wf" changes the organization (flat vs CEO→Manager→Worker), never the fact of fan-out — `/wf` itself requires ≥3 subagents. There is NO path from an explicitly typed `/wf-max` to a solo main-thread pass.
+
 - **Trigger**: `/wf-max [task]`, or auto when write-set ≥5 files AND clear disjoint boundaries (parallelismScore ≥2.0)
-- **Degrade to /wf**: files <5, all changes share single interface (serial dependency), import/re-export refactor (global consistency needed), overhead >0.30
+- **Auto-trigger degradation only** (never applies to explicit `/wf-max`): files <5, all changes share single interface (serial dependency), import/re-export refactor (global consistency needed), overhead >0.30
 - **Leaf conditions** (stop splitting): files ≤ span×2, avgLines <50, overhead >0.30
 
 ## Hard Constraints
 
-1. **CEO never writes production code.** CEO uses Task, Read, TodoWrite, Grep/Glob. No Edit/Write/Bash on source files. Exception: CEO MAY write to `Harness/tasks/<id>/PLAN.md` and `Harness/tasks/<id>/PROGRESS.md` (task artifacts, not production code).
-2. **E-GATE → D-GATE → W2.** Exploration Gate after W0 (all questions answered). Write Decomposition Gate after W1 architecture defines the write-set (Dispatch Table mandatory). Full spec in WF-MAX.md.
-3. **Single-message dispatch.** ALL parallel Workers for a wave MUST be spawned in ONE message. Sequential one-per-turn spawning defeats parallelism.
-4. **Worker rule**: one write file per Worker (anti-bundling). **Manager rule**: Manager count ≥ ceil(sqrt(write_files) / 3) (anti-under-decomposition at domain level). Each Manager: 2-7 Workers.
+1. **CEO never writes production code.** CEO uses Agent, Read, Grep/Glob. No Edit/Write/MultiEdit on source files. Exception: CEO MAY write to `Harness/tasks/<id>/PLAN.md` and `Harness/tasks/<id>/PROGRESS.md` (task artifacts, not production code).
+2. **E-GATE → D-GATE → W2.** Exploration Gate after W0 (all questions answered). Write Decomposition Gate after W1 architecture defines the write-set (Dispatch Table mandatory + Self-Audit Checklist).
+3. **Single-message dispatch.** ALL parallel Workers for a wave MUST be spawned in ONE message. Sequential one-per-turn spawning defeats parallelism (AP6).
+4. **Worker rule**: one write file per Worker (anti-bundling, Gate Rule #1). **Manager rule**: Manager count ≥ ceil(sqrt(write_files) / 3) (anti-under-decomposition, Gate Rule #2). Each Manager: 2-7 Workers (Gate Rule #3).
 5. **Manager MUST spawn ≥2 Workers or dissolve.** 0-1 Workers = Phantom Manager (AP5).
 6. **Overhead > 0.30 → degrade to /wf.** Record the decision in PLAN.md.
 
@@ -42,11 +59,20 @@ W0 (Explore) → E-GATE → W1 (Architecture) → D-GATE → W2 (Implement, sing
 
 ## Anti-Pattern Quick Check (before every wave)
 
-CEO-as-Worker? Under-decomposition (too few Managers)? Serial spawn? Fake parallelism? Phantom Manager? Silent degrade? → If any match, stop and re-decompose. Full catalog in WF-MAX.md.
+| AP | Pattern | Fix |
+|----|---------|-----|
+| AP1 | CEO-as-Worker | Re-delegate to Worker |
+| AP2 | Under-decomposition | Split files by concern |
+| AP3 | Serialization trap | Dispatch X and Y in parallel NOW |
+| AP4 | Fake parallelism | One file = one Writer |
+| AP5 | Phantom Manager | Dissolve, absorb by sibling |
+| AP6 | Sequential spawn | Batch ALL Task() in ONE message |
+| AP7 | Silent degrade | Record justification in PLAN.md |
 
 ## Return Format
 
-- Dispatch Table (every wave)
+- Dispatch Table (every wave, in PLAN.md)
+- Self-Audit Checklist (D-GATE, all items checked)
 - Worker returns (raw, per wave)
 - Manager synthesis reports
 - CEO integration decisions