create-harness-vibe-coding 0.8.1 → 0.8.2

package/templates/common/.claude/skills/wf-update/SKILL.md

@@ -19,14 +19,21 @@ description: Use for /wf-update in Claude Code, $wf-update or /skills wf-update
 
 ## Flow
 
-1. Run `node Harness/scripts/wf-update-check.mjs` first.
+1. Run `node Harness/scripts/wf-update-check.mjs --json` first and use the
+   `agent` block as the action plan.
 2. Preserve all PRESERVE files. Never overwrite user task, memory, research,
    README, package, or architecture files.
-3. Apply SAFE and NEW files through the script.
-4. Ask the user before every CONFLICT file: merge, overwrite, or keep.
-5. After update, run the validator and then scan-clean.
+3. If `agent.safeApplyCommand` is present, run it to apply SAFE and NEW files
+   before spending AI time on conflicts. Default command:
+   `node Harness/scripts/wf-update-check.mjs --apply-safe`.
+4. For every `agent.aiMergeRequired` entry, compare the local file with
+   `templateHint` or `remoteUrl`, then choose merge, keep-local, or
+   overwrite-from-template. Ask the user only when the intent is ambiguous.
+5. Use strict `--apply` only when the JSON plan has zero conflicts.
+6. After update, run the validator and then scan-clean.
 
 ## Return
 
 Report version, SAFE/NEW updates, conflicts and decisions, preserved files,
-validation output, scan-clean result, and remaining risks.
+partialUpdate status if any, validation output, scan-clean result, and
+remaining risks.

package/templates/common/.codex/hooks.json

@@ -1,37 +1,59 @@
-{
-  "hooks": {
-    "SessionStart": [
-      {
-        "matcher": "",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node Harness/scripts/wf-mode-hook.mjs"
-          }
-        ]
-      }
-    ],
-    "UserPromptSubmit": [
-      {
-        "matcher": "",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node Harness/scripts/wf-mode-hook.mjs"
-          }
-        ]
-      }
-    ],
-    "PreToolUse": [
-      {
-        "matcher": "Edit|Write|MultiEdit|Bash",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "node Harness/scripts/wf-mode-hook.mjs"
-          }
-        ]
-      }
-    ]
-  }
-}
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node Harness/scripts/wf-mode-hook.mjs"
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node Harness/scripts/wf-mode-hook.mjs"
+          }
+        ]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "Edit|Write|MultiEdit|Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node Harness/scripts/wf-mode-hook.mjs"
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node Harness/scripts/wf-mode-hook.mjs"
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node Harness/scripts/wf-mode-hook.mjs"
+          }
+        ]
+      }
+    ]
+  }
+}

package/templates/common/.harness-version

@@ -1,17 +1,20 @@
 {
-  "generator": "0.8.1",
-  "generated": "2026-07-01T06:31:02.525Z",
+  "generator": "0.8.2",
+  "generated": "2026-07-02T04:28:22.774Z",
   "options": [],
   "autoCheck": true,
   "source": "https://raw.githubusercontent.com/zingspark/create-harness-vibe-coding/main/templates/common/",
   "checksums": {
     ".agents/skills/subagent-orchestrator/SKILL.md": "sha256-d17b1e49aa8e3125b17621242f620ac89c10692fac853bf0a682a87f660d86da",
+    ".agents/skills/tdd/SKILL.md": "sha256-2a86f45b3685670f5f214fdcc8d21ecc3d04f42af4f7cae2a38e994ab24bfb1e",
+    ".agents/skills/wf-auto-spark/SKILL.md": "sha256-b07a3570e232cf47b179b9774daed4c00d7756ccce9e2339556d3544f92cf02b",
+    ".agents/skills/wf-auto/SKILL.md": "sha256-ac3177dc7c5f40f99017b79dbb71722325f75c2e608f20aca780fd874c9755ee",
     ".agents/skills/wf-learn/SKILL.md": "sha256-7f3e1ee0aa83cbb76707698d0c26b703ad5c74b2df95a7dc4d751939a4ba05b2",
-    ".agents/skills/wf-max/SKILL.md": "sha256-5463c4ac6a34848639c176000ef3f1989c54e7cb795e47251ef465782118a18d",
+    ".agents/skills/wf-max/SKILL.md": "sha256-9b37cc3385f6d1a285b617169e91fbf71ffec76135b7b46ec1de2fe94ca220da",
     ".agents/skills/wf-readme/SKILL.md": "sha256-4d34ee3b6b305fa2581f5d8cb31e9152759f3df8bf8fa08efbb43782f128bdcd",
-    ".agents/skills/wf-remove/SKILL.md": "sha256-34888c78feade04e8b6d1f22e366c04e3daefc8c0f9e6ea39f52cf0a7f3ec01f",
+    ".agents/skills/wf-remove/SKILL.md": "sha256-f27aee81d4d6988186f468ccc5dfd02c7605967636a5aea93d92443e030dbcc2",
     ".agents/skills/wf-review/SKILL.md": "sha256-cc6d536ec6de25546a0ba96e686f195da50ed11bc03763a76ef46d77243d3537",
-    ".agents/skills/wf-update/SKILL.md": "sha256-c58d1238d2a5f47dda9c8bea2ccd95d350e39ef0985c9c69d8111e7e84a3a4b6",
+    ".agents/skills/wf-update/SKILL.md": "sha256-d57cd89e271b2af63b6a1264af552a30f8d44959cf4782b42f0ab082a90be9cf",
     ".agents/skills/wf/SKILL.md": "sha256-70766bd2cb02bc489b5cc021797af62596a005d444a026abb511054a1a820a67",
     ".claude/agents/architect-manager.md": "sha256-d98c3a2d044d5216d9bcde217b4359b1c33f5be152416e242807652ddcd2868b",
     ".claude/agents/architect.md": "sha256-61cea40c8c3e01bd53f3ad642ef734850fdb931497e7ee20552ea7a8b4e7b70c",
@@ -26,44 +29,55 @@
     ".claude/agents/researcher.md": "sha256-402fef14dee8f495dc9ddfad5af3ad233d254326b49b831f604014a8cb6d0beb",
     ".claude/agents/review-manager.md": "sha256-fb8fbd6c6624279cc97aa3dbd50ec20c150ff4a2d195788bc8537d98699cc41b",
     ".claude/agents/reviewer.md": "sha256-2913b7799fcd8e162f01ae0de09a41ec7083de5f0cae3abcd4ecc62acc675a6b",
+    ".claude/agents/tdd-guide.md": "sha256-c1663ffba6e48c7c19b0de1bb3eae674b3e85386fc959b15dd30d696aef6433c",
     ".claude/agents/test-writer.md": "sha256-9018a9f65f1861a9bade999790e945d258781c1d846eb30a9de23ec3ce5f1d82",
     ".claude/agents/verifier.md": "sha256-6d8ca8bd13d7bb7680423875269e407c06aca60334df44d9230a015aabd0a8d0",
     ".claude/rules/ecc/common.md": "sha256-157c300e3b47049998d1bca867da6f9b54efb5de6efbabbb64a22af4cb2b84e8",
-    ".claude/settings.json": "sha256-3ee53515a829b85267b7330fad9e90d797f1bd16964ec9f876fdd630a0d2c093",
+    ".claude/settings.json": "sha256-4a2bdeb15d9911c8fa624e90ef977e857790981017ff10f44de36a343249ce25",
     ".claude/skills/subagent-orchestrator/SKILL.md": "sha256-d17b1e49aa8e3125b17621242f620ac89c10692fac853bf0a682a87f660d86da",
+    ".claude/skills/tdd/SKILL.md": "sha256-2a86f45b3685670f5f214fdcc8d21ecc3d04f42af4f7cae2a38e994ab24bfb1e",
+    ".claude/skills/wf-auto-spark/SKILL.md": "sha256-b07a3570e232cf47b179b9774daed4c00d7756ccce9e2339556d3544f92cf02b",
+    ".claude/skills/wf-auto/SKILL.md": "sha256-ac3177dc7c5f40f99017b79dbb71722325f75c2e608f20aca780fd874c9755ee",
     ".claude/skills/wf-learn/SKILL.md": "sha256-7f3e1ee0aa83cbb76707698d0c26b703ad5c74b2df95a7dc4d751939a4ba05b2",
-    ".claude/skills/wf-max/SKILL.md": "sha256-5463c4ac6a34848639c176000ef3f1989c54e7cb795e47251ef465782118a18d",
+    ".claude/skills/wf-max/SKILL.md": "sha256-9b37cc3385f6d1a285b617169e91fbf71ffec76135b7b46ec1de2fe94ca220da",
     ".claude/skills/wf-readme/SKILL.md": "sha256-4d34ee3b6b305fa2581f5d8cb31e9152759f3df8bf8fa08efbb43782f128bdcd",
-    ".claude/skills/wf-remove/SKILL.md": "sha256-34888c78feade04e8b6d1f22e366c04e3daefc8c0f9e6ea39f52cf0a7f3ec01f",
+    ".claude/skills/wf-remove/SKILL.md": "sha256-f27aee81d4d6988186f468ccc5dfd02c7605967636a5aea93d92443e030dbcc2",
     ".claude/skills/wf-review/SKILL.md": "sha256-cc6d536ec6de25546a0ba96e686f195da50ed11bc03763a76ef46d77243d3537",
-    ".claude/skills/wf-update/SKILL.md": "sha256-c58d1238d2a5f47dda9c8bea2ccd95d350e39ef0985c9c69d8111e7e84a3a4b6",
+    ".claude/skills/wf-update/SKILL.md": "sha256-d57cd89e271b2af63b6a1264af552a30f8d44959cf4782b42f0ab082a90be9cf",
     ".claude/skills/wf/SKILL.md": "sha256-70766bd2cb02bc489b5cc021797af62596a005d444a026abb511054a1a820a67",
     ".codex/config.toml": "sha256-d37497c3278121598a663564ab38b53f658969717f78decb661ddd11c66551ea",
-    ".codex/hooks.json": "sha256-6d8d237b4a038a48fbadbdd087d9a68dba024bcfd748f59968252ebae7cc2e96",
-    "AGENTS.md": "sha256-bbc17b119ff579e500dcd36e78f9cf600ccda27fa7b32903f233ad96a97058ff",
-    "CLAUDE.md": "sha256-432bd4dc9bdf9958d79ae697f72d1c9723be23fb156d43889ede84e305ed5e70",
-    "Harness/MEMORY.md": "sha256-68b3e2b68880814bad11aa6d444d6b736848ac14c2a758ec3225c688a2c1882e",
-    "Harness/README.md": "sha256-6608f74400dbae1e73b838d6b74f02e73a0b0e54404e899628dde6ccfbf06cf4",
-    "Harness/SETUP.md": "sha256-e0fdd6a7751595f62f15d4374e1f201fcd0aa8b8ac44528a39cbf5b04db0e3bd",
-    "Harness/WF-MAX.md": "sha256-81c788ac56a0c1673a9e6bdf619efbcfa9c961ca7c5065c15b98760775f963a6",
+    ".codex/hooks.json": "sha256-ec2322e080b96b1c0cb86161476ff75a4ed00312b57eed979d7d4a379365d0b7",
+    "AGENTS.md": "sha256-c6e6f08195c41b49b682291c7b83f55acd9750767a7eef3811bf5bbdaa66f76a",
+    "CLAUDE.md": "sha256-b62a1bc5410280ed17f87ba591f571a0917f438589627fc50e9a53b9e9d0bb75",
+    "Harness/ECC-GUIDE.md": "sha256-48924c4c0e17dc47be53d616a6690415307688f971ec872d8860c5bbe64c90d7",
+    "Harness/MEMORY.md": "sha256-6e01795e787eb809f856cce8d90a15a118f8fac1ebbb71dd746a868f207a9457",
+    "Harness/README.md": "sha256-3f33274b01d100f20694efdf6c4633a01a79dcef9c9b8974ad5e8796ef928dc6",
+    "Harness/SETUP.md": "sha256-2a59db4e5053faf5f82ceb402491df016fee93bd59449202d4c9e1e7388df977",
+    "Harness/TDD-GUIDE.md": "sha256-a038f0aea67c72220684d6854536ad7b2d59ab52342374d4710f2c94828f88c4",
+    "Harness/WF-AUTO-SPARK.md": "sha256-48cc08e1a78cd4abb2ae9c2807ef1ac9a09544eb954220b9087b2032fabbd690",
+    "Harness/WF-AUTO.md": "sha256-ac0ab13e11ca658cd2c5b6ce73f3d267bea6391a04e850c9f9a24d642f1ad350",
+    "Harness/WF-MAX.md": "sha256-98a4a918eb8e97c40422c7e133a0bc33184faf7771ca9645f4161d82a5cac8cb",
     "Harness/WF.md": "sha256-7cce2568444295cb387fa958cd4ef9711a19697b60ce9cba0e142484e0a165ae",
     "Harness/agent-workflow.md": "sha256-1aff5e7dc1e082c559cb0a9086c4f93f6702905aff00ebb957300f463ea80b31",
-    "Harness/context-loading.md": "sha256-0d97d6ec2325063f7158511f3462ca9cbdf3b6db177a79dac8ee7d2cb7930264",
-    "Harness/dispatch.md": "sha256-e0c6a3a46acc8899574c9b6d6bb4da119adb9e9ed1ce91acc9f7a688ed3aea15",
+    "Harness/context-loading.md": "sha256-a2e71435e127c2ff5b70ebfddb1a8bbaa64dfd584505fbd6e14dc059e18cc6a1",
+    "Harness/dispatch.md": "sha256-e823b905bbdcae396d759f281bbd413693904c80b6c18f7993718e63a961b2a6",
     "Harness/extension.md": "sha256-686f76d83e91750c20d4f5aa8e614f5003baeb5a703d0451f469ca7eeab75e37",
     "Harness/lifecycle.md": "sha256-5979c37e66e35940cb707f8cd71e97d53bb05399c3281c714f69499abdee59a4",
     "Harness/research/README.md": "sha256-956c154df01cb9376972eb8b88bb3be0fe4e2dda802a72457c0126e3476fa755",
     "Harness/scripts/scan-clean.mjs": "sha256-7f693faf762c9c8e7657143d651f7c8369ed4823f18babe21daec58a55025593",
-    "Harness/scripts/validate-harness.mjs": "sha256-f3211c2149918b1cfc83648ea2e992b80c45b0c00f9a5b9f02a6f6094e7791d6",
-    "Harness/scripts/wf-mode-hook.mjs": "sha256-289f0df4155dd8523507f59add5eac72c0aa92efc85a78d5a46350b9c9bb4f80",
-    "Harness/scripts/wf-remove.mjs": "sha256-2ae2687c63cd3aea3b36713d67ce78811df6541a19904b153d17518b6268938b",
-    "Harness/scripts/wf-statusline.ps1": "sha256-53c2e0178e9a0826516731b1145f96f55ff6c57fb1f31bf6f1a7210a8502ca65",
-    "Harness/scripts/wf-statusline.sh": "sha256-053908cd4d53dea162252077c6cc5544ccd164455739f6edfbf254945f06ea2f",
-    "Harness/scripts/wf-update-check.mjs": "sha256-8c3fa219e902056c20c55b2abfa5152349d9e00f4faa5bef646f78bfb71c486f",
-    "Harness/subagents.md": "sha256-e66f4bef8ce6c118cf0ec8c511f727a8c2c40bce25dcf5b754489d89915a47ba"
+    "Harness/scripts/validate-harness.mjs": "sha256-fd904202f99cd30ad7ce69f5343c4adca94ab30b7a5f8eab37004d748e0779ab",
+    "Harness/scripts/wf-mode-hook.mjs": "sha256-fbf2c398bfe21374fc5d0230133dfa16feff6afe79598bd185aae49643075545",
+    "Harness/scripts/wf-remove.mjs": "sha256-ae941d34d7d263f2b65751d177673a3c4fb11c326885ca413245e3f93e99a006",
+    "Harness/scripts/wf-statusline.ps1": "sha256-49effdea8b0980e762a9440f4be9011543ede3533f6df1b2008368d78c427fcc",
+    "Harness/scripts/wf-statusline.sh": "sha256-6fa034fab9abe9361daae14cdb802f69825ce20d4bf6a9c18f58c04e971693ac",
+    "Harness/scripts/wf-update-check.mjs": "sha256-d14ce08f4c05ba118362a56a4b7d5965b114bc2b15a023c08e21d57f32b2cf93",
+    "Harness/subagents.md": "sha256-31818b96f4e834087d8ce8887758f303114b3fd67fb9819fd661f78170fb39d3"
   },
   "sources": {
     ".agents/skills/subagent-orchestrator/SKILL.md": ".claude/skills/subagent-orchestrator/SKILL.md",
+    ".agents/skills/tdd/SKILL.md": ".claude/skills/tdd/SKILL.md",
+    ".agents/skills/wf-auto-spark/SKILL.md": ".claude/skills/wf-auto-spark/SKILL.md",
+    ".agents/skills/wf-auto/SKILL.md": ".claude/skills/wf-auto/SKILL.md",
     ".agents/skills/wf-learn/SKILL.md": ".claude/skills/wf-learn/SKILL.md",
     ".agents/skills/wf-max/SKILL.md": ".claude/skills/wf-max/SKILL.md",
     ".agents/skills/wf-readme/SKILL.md": ".claude/skills/wf-readme/SKILL.md",
@@ -84,11 +98,15 @@
     ".claude/agents/researcher.md": ".claude/agents/researcher.md",
     ".claude/agents/review-manager.md": ".claude/agents/review-manager.md",
     ".claude/agents/reviewer.md": ".claude/agents/reviewer.md",
+    ".claude/agents/tdd-guide.md": ".claude/agents/tdd-guide.md",
     ".claude/agents/test-writer.md": ".claude/agents/test-writer.md",
     ".claude/agents/verifier.md": ".claude/agents/verifier.md",
     ".claude/rules/ecc/common.md": ".claude/rules/ecc/common.md",
     ".claude/settings.json": ".claude/settings.json",
     ".claude/skills/subagent-orchestrator/SKILL.md": ".claude/skills/subagent-orchestrator/SKILL.md",
+    ".claude/skills/tdd/SKILL.md": ".claude/skills/tdd/SKILL.md",
+    ".claude/skills/wf-auto-spark/SKILL.md": ".claude/skills/wf-auto-spark/SKILL.md",
+    ".claude/skills/wf-auto/SKILL.md": ".claude/skills/wf-auto/SKILL.md",
     ".claude/skills/wf-learn/SKILL.md": ".claude/skills/wf-learn/SKILL.md",
     ".claude/skills/wf-max/SKILL.md": ".claude/skills/wf-max/SKILL.md",
     ".claude/skills/wf-readme/SKILL.md": ".claude/skills/wf-readme/SKILL.md",
@@ -102,10 +120,14 @@
     "AGENTS.md": "AGENTS.md",
     "CLAUDE.md": "CLAUDE.md",
     "Harness/.harness-version": ".harness-version",
+    "Harness/ECC-GUIDE.md": "Harness/ECC-GUIDE.md",
     "Harness/MEMORY.md": "MEMORY.md",
     "Harness/PROGRESS.md": "Harness/PROGRESS.md",
     "Harness/README.md": "Harness/README.md",
     "Harness/SETUP.md": "SETUP.md",
+    "Harness/TDD-GUIDE.md": "Harness/TDD-GUIDE.md",
+    "Harness/WF-AUTO-SPARK.md": "Harness/WF-AUTO-SPARK.md",
+    "Harness/WF-AUTO.md": "Harness/WF-AUTO.md",
     "Harness/WF-MAX.md": "Harness/WF-MAX.md",
     "Harness/WF.md": "Harness/WF.md",
     "Harness/agent-workflow.md": "Harness/agent-workflow.md",
@@ -129,6 +151,7 @@
     "Harness/scripts/wf-update-check.mjs": "scripts/wf-update-check.mjs",
     "Harness/subagents.md": "Harness/subagents.md",
     "Harness/tasks/_template/ARTIFACTS.md": "Harness/tasks/_template/ARTIFACTS.md",
+    "Harness/tasks/_template/NAMING.md": "Harness/tasks/_template/NAMING.md",
     "Harness/tasks/_template/NOTES.md": "Harness/tasks/_template/NOTES.md",
     "Harness/tasks/_template/PLAN.md": "Harness/tasks/_template/PLAN.md",
     "Harness/tasks/_template/PROGRESS.md": "Harness/tasks/_template/PROGRESS.md",

package/templates/common/AGENTS.md

@@ -7,24 +7,24 @@ Entry point for coding agents. This project uses the Harness scaffold — a 0-1
 Read `CLAUDE.md` first, then `Harness/MEMORY.md`, then `Harness/README.md`.
 Do not bulk-read `Harness/`. Let `Harness/README.md#Load By Task` route you.
 
-## CEO Contract (READ FIRST)
+## WF-MAX Role Contract (READ FIRST)
 
-`/wf-max` active → you are **CEO, not implementer**.
+`/wf-max` activates WF-MAX global mode. Top-level orchestrator is **CEO** — reads, plans, dispatches. Delegated Workers follow dispatch packet (writeSet, forbidden, verification). **Global mode ≠ every agent is CEO.**
 
-| ALLOWED (W0) | FORBIDDEN (always on source) |
+| ALLOWED (W0 CEO) | FORBIDDEN (always on source) |
 |---|---|
 | Read Harness docs, CLAUDE.md | Edit / Write / MultiEdit |
 | Grep/Glob for scoping | Bash (except `ls`/`dir`/`tree`/`git`) |
 | Agent spawn (ONE message) | Deep source reads → delegate to Worker |
 | Write PLAN.md / PROGRESS.md | Sequential spawn (AP6) |
 
-**Tempted to edit source? STOP. Spawn a Worker.**
+**Tempted to edit source? STOP. Spawn a Worker with explicit writeSet.**
 
 ## Key Commands
 
 | Command | Purpose |
 |---------|---------|
-| `/wf-max [task]` | Maximum parallelism: CEO→Manager→Worker |
+| `/wf-max [task]` | Maximum parallelism: CEO→Manager→Worker hierarchy (three-layer architecture: mode / agent role / dispatch permission) |
 | `/wf-review [focus]` | Cross-model peer review (use OTHER CLI) |
 | `/wf <task>` | Standard workflow mode |
 | `/wf-auto` | Perpetual auto-optimization |

package/templates/common/CLAUDE.md

@@ -8,32 +8,26 @@ This repository dogfoods the generated Harness scaffold. Scaffold source files l
 - Every session: load `Harness/MEMORY.md` first, then `Harness/README.md`.
 - If `Harness/SETUP.md` exists, follow it before normal project work; it is the install/bootstrap contract and may be deleted after setup is complete.
 
-### 1a. CEO Contract (READ BEFORE ANY TOOL USE)
+### 1a. WF-MAX Role Contract (ACTIVE ONLY when /wf-max invoked)
 
-`/wf-max` active → you are **CEO, not implementer** (enforced by hooks + `.runtime/current-mode.json`).
+`/wf-max` active → top-level orchestrator is **CEO**. Delegated Workers follow dispatch packet, edit only assigned writeSet. **Global mode ≠ every agent is CEO.** (Enforced by hooks + `.runtime/current-mode.json`.)
 
-| ALLOWED (W0) | FORBIDDEN (always on source) |
+| ALLOWED (W0 CEO) | FORBIDDEN (always on source) |
 |---|---|
 | Read Harness docs, CLAUDE.md | Edit / Write / MultiEdit |
 | Grep/Glob for scoping | Bash (except `ls`/`dir`/`tree`/`git`) |
 | Agent spawn (ONE message) | Deep source reads → delegate to Worker |
 | Write PLAN.md / PROGRESS.md | Sequential spawn (AP6) |
 
-**Tempted to edit source? STOP. Spawn a Worker.**
+**Tempted to edit source? STOP. Spawn a Worker with explicit writeSet.**
 
 - `Harness/MEMORY.md` is the memory/resource router: agents, skills, durable memories, and cross-session lessons. Follow its registrations when selecting agents/skills or recording memory.
-- `Harness/README.md` is the task router. For every request, check `Harness/README.md#Load By Task`; if a row matches, read and follow those docs before acting.
+- `Harness/README.md` is the task router. For every request, check `Harness/README.md#Load By Task` and `Harness/README.md#Skill Commands`; invoke via `/wf-*` skills or `$wf-*` skills.
 - `Harness/PROGRESS.md` is the global task index. Load at session start to see active task and task history.
 - If work spans more than one step, create a task capsule from `Harness/tasks/_template/` and update `Harness/tasks/<task-id>/PROGRESS.md`.
-- Use `/wf <task>`, `/wf-review [focus]`, `wf mode`, `workflow mode`, or `wk mode` for long, difficult, uncertain, multi-file, or repeated-failure work.
-- Use `/wf-max [task]` for maximum parallelism — CEO→Manager→Worker hierarchy. CEO never writes code directly.
-- Use `/wf-auto` for perpetual self-directed optimization — never stops, continuously improves until 8-angle exhaustion.
-- Use `subagent-orchestrator` and `Harness/subagents.md` when coordinating multiple subagents.
-- Use `/wf-update` to check for and apply scaffold updates from GitHub. See `.claude/skills/wf-update/SKILL.md`.
 - Subagents are readers and reporters. Only the main agent writes to `Harness/tasks/<task-id>/PROGRESS.md` and `Harness/tasks/<task-id>/PLAN.md`.
-- For memory writing and consolidation (repeated failures, user corrections, closeout), dispatch `memory-master`.
-- For context analysis and compression alerts (~85% window), dispatch `context-master`.
-- Universal rules live in `.claude/rules/ecc/common.md`.
+- Invoke multi-agent work via `subagent-orchestrator` and `Harness/subagents.md`. Update harness via `/wf-update` (see `.claude/skills/wf-update/SKILL.md`).
+- For memory writing, dispatch `memory-master`. For context analysis, dispatch `context-master`.
 - Never bulk-read `Harness/`; route through `Harness/README.md` and `Harness/MEMORY.md`.
 - Scaffold source files live under `templates/common/` and `templates/optional/`; generated dogfood runtime files live under root `Harness/` and `.claude/`.
 
@@ -86,9 +80,10 @@ This repository dogfoods the generated Harness scaffold. Scaffold source files l
 - **Closeout trigger**: during WF closeout, dispatch `context-master` to extract durable knowledge, then `memory-master` to consolidate into `Harness/memory/*`.
 - Never record secrets, credentials, tokens, or private data in memory.
 
-## 7. CEO Constraints
+## 7. Mode Constraints
 
 - Never call `EnterPlanMode` — delegate planning to `planner` subagents (see `Harness/WF.md`).
-- Never write code directly in `/wf` or `/wf-max` mode — delegate all implementation to subagents (see `Harness/WF-MAX.md`).
-- **Enforcement**: `.claude/settings.json` denies `EnterPlanMode` via the `deny` list. CEO contract is in [Section 1a](#1a-ceo-contract-read-before-any-tool-use) — read it first.
-- WF-MAX hooks in `.claude/settings.json` block CEO Edit/Write/MultiEdit/Bash on source files. `Harness/.runtime/current-mode.json` persists mode state across sessions.
+- Never write code directly in `/wf` or `/wf-max` CEO mode — delegate all implementation to Workers via dispatch packets with explicit writeSet.
+- **WF-MAX three-layer architecture**: global mode (`wf-max`) ≠ agent role (`ceo|manager|worker|reviewer`). Workers follow dispatch packet (writeSet, forbidden, verification). Missing role/writeSet → source edits denied by default.
+- **Enforcement**: `.claude/settings.json` denies `EnterPlanMode` via the `deny` list. Role contract is in [Section 1a](#1a-wf-max-role-contract-read-before-any-tool-use) — read it first.
+- WF-MAX hooks in `.claude/settings.json` enforce per-agentRole + writeSet. `Harness/.runtime/current-mode.json` persists mode state; stale modes (>30 min) auto-clear.

package/templates/common/Harness/ECC-GUIDE.md

@@ -0,0 +1,246 @@
+# ECC Rules Guide — Stack to Rule Set Mapping
+
+ECC (Engineering Code Conventions) rules are organized by language/domain under `~/.claude/rules/ecc/`. The Harness bootstrap process MUST install the appropriate rule sets for the project's tech stack.
+
+## Installation
+
+```bash
+# From the ECC rules repository:
+cp -r rules/common .claude/rules/ecc/
+cp -r rules/<language> .claude/rules/ecc/
+
+# Verify:
+ls .claude/rules/ecc/
+```
+
+## Stack Detection (Automatic)
+
+| File Found | Stack | Install These Rules |
+|------------|-------|-------------------|
+| `package.json` + `tsconfig.json` | TypeScript/Node | `common/`, `typescript/`, `web/` |
+| `package.json` (no tsconfig) | JavaScript/Node | `common/`, `typescript/` (JS mode), `web/` |
+| `go.mod` | Go | `common/`, `golang/` |
+| `pyproject.toml` / `requirements.txt` | Python | `common/`, `python/` |
+| `Cargo.toml` | Rust | `common/`, `rust/` |
+| `Gemfile` | Ruby/Rails | `common/`, `ruby/` |
+| `composer.json` | PHP | `common/`, `php/` |
+| `build.gradle` / `pom.xml` | Java/Kotlin | `common/`, `java/` or `kotlin/` |
+| `*.sln` / `*.csproj` | C#/.NET | `common/`, `csharp/` |
+| `Package.swift` | Swift | `common/`, `swift/` |
+| Multiple frontend files (`.vue`, `.tsx`, `.jsx`) | Web frontend | Add `web/` to any stack |
+
+## Stack Detection (Ask User)
+
+If no stack markers are found (empty/new repo), ask:
+
+> "What's your tech stack? I need to install the right coding rules.
+>  Options: TypeScript/Node, Python, Go, Rust, Ruby, PHP, Java, Kotlin, C#, Swift, or other.
+>  Frontend framework? (React, Vue, Next.js, Nuxt, none)"
+
+Based on answer, install matching rules.
+
+## Rule Set Catalog
+
+| Rule Set | What It Covers | Files |
+|----------|---------------|-------|
+| `common/` | **Required for all projects.** Immutability, error handling, file organization, git workflow, testing, security, agents, hooks, patterns. | `coding-style.md`, `git-workflow.md`, `testing.md`, `security.md`, `patterns.md`, `agents.md`, `hooks.md`, `performance.md`, `development-workflow.md` |
+| `typescript/` | TS/JS types, interfaces, immutability patterns, error handling with try-catch, Zod validation, React props, custom hooks, repository pattern. | `coding-style.md`, `testing.md`, `security.md`, `patterns.md`, `hooks.md` |
+| `web/` | Frontend: CSS custom properties, animation-only properties, semantic HTML, component composition, state management, image optimization, CSP, XSS, Core Web Vitals, bundle budgets. | `coding-style.md`, `design-quality.md`, `testing.md`, `security.md`, `patterns.md`, `performance.md`, `hooks.md` |
+| `python/` | PEP 8, type hints, immutability, async patterns, pytest, input validation. | `coding-style.md`, `testing.md`, `security.md`, `patterns.md` |
+| `golang/` | Idiomatic Go, error handling, concurrency patterns, table-driven tests, security. | `coding-style.md`, `testing.md`, `security.md`, `patterns.md` |
+| `rust/` | Ownership, lifetimes, error handling, unsafe usage, cargo-llvm-cov. | `coding-style.md`, `testing.md`, `security.md`, `patterns.md` |
+| `ruby/` | Ruby idioms, Rails patterns, RSpec, security. | `coding-style.md`, `testing.md`, `security.md` |
+| `php/` | PSR-12, Eloquent ORM, security, testing. | `coding-style.md`, `testing.md`, `security.md` |
+| `swift/` | Protocol-oriented design, value semantics, ARC, Swift Concurrency. | `coding-style.md`, `testing.md`, `security.md` |
+| `arkts/` | HarmonyOS/ArkTS specific. | `coding-style.md`, `testing.md`, `security.md` |
+| `angular/` | Angular specific patterns. | Extends `typescript/` and `web/` |
+| `vue/` | Vue 3 Composition API, reactivity, Pinia. | Extends `typescript/` and `web/` |
+| `nuxt/` | Nuxt 4 specific. | Extends `vue/` |
+
+## Recommended Combinations
+
+| Project Type | Rule Sets |
+|-------------|-----------|
+| React + TypeScript frontend | `common/`, `typescript/`, `web/` |
+| Vue 3 frontend | `common/`, `typescript/`, `web/`, `vue/` |
+| Next.js fullstack | `common/`, `typescript/`, `web/` |
+| Python backend (FastAPI) | `common/`, `python/` |
+| Go microservice | `common/`, `golang/` |
+| Rust CLI tool | `common/`, `rust/` |
+| Electron + React desktop | `common/`, `typescript/`, `web/` |
+| React Native mobile | `common/`, `typescript/`, `web/` |
+
+## Bootstrap Verification
+
+After installing ECC rules, verify:
+
+```bash
+ls .claude/rules/ecc/common/          # MUST exist
+ls .claude/rules/ecc/<language>/      # MUST exist for detected/declared stack
+```
+
+If rules are missing, the agent MUST install them before proceeding to step 1.
+
+## ECC Design Rules — Frontend + Backend Architecture
+
+Beyond coding style, ECC provides design-level guidance for both frontend and backend.
+These are NOT in Harness by default — the agent should consult them when filling
+`Harness/architecture.md` and `Harness/research/research-results.md`.
+
+### Frontend Design (web/ + typescript/)
+
+| Rule File | Design Guidance | When to Apply |
+|-----------|----------------|---------------|
+| `web/design-quality.md` | Anti-template policy, required qualities (hierarchy, depth, typography, motion, color semantics), banned patterns (stock hero, default card grids, safe gray-on-white) | Before writing any frontend code |
+| `web/patterns.md` | Compound components, render props, container/presentational split, state management (server/client/URL/form), URL as state, stale-while-revalidate, optimistic updates | When architecting frontend data flow |
+| `web/performance.md` | Core Web Vitals targets, bundle budgets, loading strategy, image optimization, font loading, animation performance | Before production build |
+| `web/security.md` | CSP (nonce-based), XSS prevention, third-party script SRI, HTTPS headers, CSRF protection | Before any user-facing deploy |
+| `web/testing.md` | Visual regression (320/768/1024/1440), a11y, Lighthouse, cross-browser, responsive | Before launch |
+| `web/hooks.md` | PostToolUse format/lint/type-check, PreToolUse file size guard, Stop build verification | CI setup |
+| `typescript/patterns.md` | API response envelope, custom hooks, Repository pattern | Backend-frontend contract |
+
+### Backend Design (python/ + golang/ + rust/)
+
+| Rule File | Design Guidance | When to Apply |
+|-----------|----------------|---------------|
+| `python/fastapi.md` | FastAPI patterns: async correctness, dependency injection, Pydantic schemas, OpenAPI quality | Python API projects |
+| `python/patterns.md` | Repository pattern, service layer, API response format | Any Python backend |
+| `golang/patterns.md` | Idiomatic Go patterns, concurrency, error handling | Go microservices |
+| `rust/patterns.md` | Ownership patterns, error handling, unsafe usage | Rust services |
+| `common/patterns.md` | Skeleton projects, Repository pattern, API response format, design pattern guidance | All projects |
+
+### Architecture Templates
+
+Write the project-specific structure in `Harness/architecture.md`. Use the ECC rule combinations above to decide which standards apply to each layer.
+
+### API Contract
+
+See [Contract Rules](#contract-rules) below for the full spec.
+
+## Agent Skills + ECC Rules
+
+Dispatch packets MUST include `ecc` and SHOULD include `skills` fields (use `skills: none` when no skill applies). `Harness/context-loading.md#ecc-rules-per-role` owns the role-to-ECC mapping. This guide owns stack detection and the catalog of available ECC rule sets.
+
+## API Contract Specification (Frontend ↔ Backend)
+
+The single most important integration pattern. Without this, frontend and backend drift apart silently.
+
+### Contract Rules
+
+1. **Backend owns the schema.** Define types in the backend language, generate frontend types.
+2. **Never duplicate types manually.** One source of truth, code-generated copies.
+3. **Validate at both boundaries.** Backend validates input (Pydantic/Zod), frontend validates API responses.
+4. **Error envelope is universal.** Use `common/patterns.md` format everywhere.
+
+### OpenAPI 3.0 Example (Generator-Readable)
+
+```yaml
+# api/openapi.yaml — Feed this to openapi-typescript or openapi-generator
+openapi: "3.0.3"
+info:
+  title: User API
+  version: "1.0.0"
+paths:
+  /api/users:
+    get:
+      operationId: listUsers
+      parameters:
+        - name: page
+          in: query
+          schema: { type: integer, default: 1 }
+        - name: limit
+          in: query
+          schema: { type: integer, default: 20 }
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  success: { type: boolean }
+                  data:
+                    type: object
+                    properties:
+                      users: { type: array, items: { $ref: "#/components/schemas/User" } }
+                  meta:
+                    type: object
+                    properties:
+                      total: { type: integer }
+                      page: { type: integer }
+    post:
+      operationId: createUser
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: { $ref: "#/components/schemas/CreateUserInput" }
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  success: { type: boolean }
+                  data:
+                    type: object
+                    properties:
+                      user: { $ref: "#/components/schemas/User" }
+components:
+  schemas:
+    User:
+      type: object
+      required: [id, email, name, role, createdAt]
+      properties:
+        id: { type: string, format: uuid }
+        email: { type: string, format: email }
+        name: { type: string }
+        role: { type: string, enum: [admin, member] }
+        createdAt: { type: string, format: date-time }
+    CreateUserInput:
+      type: object
+      required: [email, name]
+      properties:
+        email: { type: string, format: email }
+        name: { type: string, minLength: 1, maxLength: 100 }
+        role: { type: string, enum: [admin, member], default: member }
+```
+
+```bash
+# Generate TypeScript types from OpenAPI:
+npx openapi-typescript api/openapi.yaml -o src/shared/api-types.ts
+```
+
+### Implementation Per Stack
+
+| Stack | Backend Schema | Frontend Types | Validation |
+|-------|---------------|----------------|------------|
+| Python BE + TS FE | Pydantic models | `openapi-typescript` from OpenAPI | Pydantic (BE) + Zod (FE) |
+| Go BE + TS FE | Go structs + OpenAPI | `openapi-generator` | Go validator (BE) + Zod (FE) |
+| Next.js fullstack | Zod schemas in `shared/` | Same Zod schemas | Zod (both sides) |
+| tRPC | tRPC router definitions | Auto-inferred from router | tRPC built-in |
+| GraphQL | GraphQL schema | `graphql-codegen` | GraphQL middleware + Zod (FE) |
+
+### Agent Dispatch with ECC + Skills
+
+When dispatching a subagent, the dispatch packet MUST include:
+
+```json
+{
+  "agentRole": "worker",
+  "task": "Implement user profile page",
+  "writeSet": ["src/components/UserProfile.tsx", "src/hooks/useUser.ts"],
+  "forbidden": ["src/backend/", "database/"],
+  "verification": ["npm test", "npm run lint"],
+  "ecc": ["web/design-quality.md", "web/patterns.md", "typescript/patterns.md"],
+  "skills": ["react-review"],
+  "apiContract": "api/contract.yaml"
+}
+```
+
+Different subagents get different `ecc` and `skills` arrays.
+A frontend implementer loads `web/` rules. A backend implementer loads `python/` or `golang/` rules.
+A reviewer loads `security/` + `testing/` rules. See `Harness/context-loading.md` for the full per-role mapping.