create-harness-vibe-coding 0.8.16 → 0.8.18

package/templates/common/.claude/commands/wf-task-record.md

@@ -0,0 +1,24 @@
+# /wf-task-record
+
+Record a task into a Harness task capsule. Do not invoke a skill or start WF mode.
+
+## Classification
+
+DIRECT command. Wraps `node Harness/scripts/task-state.mjs record`. Never loads Harness/MEMORY.md.
+
+## Usage
+
+/wf-task-record [<task-id>] [--title <slug>] [--note <text>] [--context <text>] [--new] [--create] [--status <status>] [--mode <mode>] [--text "description"]
+
+- With <task-id>: record to that task (existing semantics).
+- Without <task-id>: --title/--note/--context required. Deterministically matches open tasks; updates if unique match found; creates new if no match; fails if ambiguous unless --new.
+- Never uses LLM or embeddings — slug + keyword overlap only.
+
+## Execution
+
+Run: `node Harness/scripts/task-state.mjs record [<task-id>] [--title <slug>] [--note <text>] [--context <text>] [--new] [--create] [--apply] [--text "..."] [--status <status>] [--mode <mode>] [--json]`
+
+## Return
+
+- Output of `node Harness/scripts/task-state.mjs record ... --json`
+- If the command fails, report the error and do not retry.

package/templates/common/.claude/commands/wf.md

@@ -0,0 +1,16 @@
+---
+description: Run the tiered WF workflow (WF-Light/Standard/Full) via the wf skill
+---
+
+# /wf
+
+This is a **workflow command**, not a direct command. Do not execute it as a
+static help or script command.
+
+1. Load `CLAUDE.md`, `Harness/MEMORY.md` (index only per Memory Preflight), then `Harness/README.md`.
+2. Preserve cache-first order per `Harness/specs/runtime/context-loading.md#Cache-First Context Contract`.
+3. Execute per the skill adapter `.claude/skills/wf/SKILL.md` (mirror: `.agents/skills/wf/SKILL.md`).
+4. Do not duplicate the workflow here. The skill adapter and `Harness/specs/workflows/WF.md` are authoritative.
+
+If this runtime cannot invoke the skill directly, read
+`.claude/skills/wf/SKILL.md` and follow it in place.

package/templates/common/.claude/rules/ecc/common.md

@@ -8,7 +8,7 @@ alwaysApply: true
 ## Context
 
 - Start with `CLAUDE.md`. When `Harness/` exists, also read `Harness/memory/startup-hints.md` (L2 lightweight digest, not full router).
-- When the user explicitly invokes a `/wf-*` workflow command, excluding `/wf-help` and `/wf-update`, load `Harness/MEMORY.md` and `Harness/README.md`.
+- When the user explicitly invokes a workflow command (`/wf-*`, `$wf-*`, or `/skills wf-*`), excluding `/wf-help`, `$wf-help`, `/skills wf-help`, `/wf-update`, `$wf-update`, `/skills wf-update`, `/wf-task-record`, `$wf-task-record`, `/skills wf-task-record`, `/wf-task-list`, `$wf-task-list`, `/skills wf-task-list`, `/wf-task-archive`, `$wf-task-archive`, `/skills wf-task-archive`, `/wf-command-create`, `$wf-command-create`, and `/skills wf-command-create`, load `Harness/MEMORY.md` and `Harness/README.md`.
 - For simple single-step tasks without `/wf-*`, operate in direct mode: skip the Harness router and execute directly.
 - Do not bulk-read `Harness/`. Load by router trigger.
 - Keep `Harness/tasks/<task-id>/PROGRESS.md` and `Harness/tasks/<task-id>/PLAN.md` current when work has multiple steps, files, or agents.

package/templates/common/.claude/skills/wf-agents-docs/SKILL.md

@@ -9,13 +9,10 @@ Use this skill before shelling out to `claude`, `codex`, or `opencode` from Harn
 
 ## Source Order
 
-1. Prefer installed help: `claude --help`, `codex exec --help`, `opencode run --help`.
-2. Check official docs for flags that affect cost, auth, JSON, resume, tools/MCP, or telemetry.
-3. When adding automation, record command, source, stdout/stderr shape, and failed patterns.
+Prefer installed help (`claude --help`, `codex exec --help`, `opencode run --help`), then official docs for cost/auth/JSON/resume/tools/telemetry; record command, source, stdout/stderr shape, and failures.
 
 ## Claude Code CLI
 
-- Interactive: `claude`.
 - Non-interactive JSON: pipe ASCII or UTF-8-safe stdin into `claude -p --output-format json`.
 - Stream JSON requires verbose mode: `claude -p --output-format stream-json --verbose`.
 - Continue/resume: `claude -c -p "..."` or `claude -p --resume <session-id> "..."`; for PowerShell automation, prefer stdin and validate non-empty JSON before parsing.
@@ -26,19 +23,15 @@ Use this skill before shelling out to `claude`, `codex`, or `opencode` from Harn
 
 ## Codex CLI
 
-- Interactive: `codex`.
 - Non-interactive: `codex exec "task"`.
-- Read stdin as the full prompt: `cat prompt.txt | codex exec -`.
-- Prompt plus stdin context: `some-command | codex exec "summarize this output"`.
+- Stdin modes: `cat prompt.txt | codex exec -`; `some-command | codex exec "summarize this output"`.
 - Machine output: `codex exec --json "task"` emits JSONL events; parse `turn.completed.usage`, including `cached_input_tokens` when present.
 - Resume: `codex exec resume --last "..."` or `codex exec resume <SESSION_ID> "..."`.
 - Permissions: default is read-only; set `--sandbox workspace-write` only when edits are required. Use `--ignore-user-config` / `--ignore-rules` for controlled automation.
 
 ## OpenCode CLI
 
-- Interactive: `opencode`.
-- Non-interactive: `opencode run [message..]`.
-- JSON events: `opencode run --format json "task"`.
+- Non-interactive: `opencode run [message..]`; JSON events: `opencode run --format json "task"`.
 - Resume: `opencode run --continue "..."` or `opencode run --session <id> "..."`.
 - Peer role: `opencode run --agent reviewer --dir . "review prompt"`.
 - Reuse a server to avoid MCP cold boot: `opencode serve`, then `opencode run --attach http://localhost:4096 "task"`.
@@ -48,31 +41,27 @@ Use this skill before shelling out to `claude`, `codex`, or `opencode` from Harn
 
 - Prefer stdin over trailing prompt args for `claude -p` in PowerShell.
 - Use ASCII prompts or explicitly UTF-8-safe input for automated probes.
-- Do not trust exit code alone. Fail on empty/non-JSON stdout or error/budget terminal fields.
+- Do not trust exit code alone. Fail on empty/non-JSON stdout, error/budget/fallback terminal fields, or missing final model text.
 - Avoid naming function parameters `$Args`; PowerShell treats `$Args` specially.
 - Store telemetry outside the repo, e.g. `$HOME/.claude/cache-telemetry/*.json`, so git status does not perturb prefixes.
 
 ## Evidence-Packet Review Pattern
 
-For peer review, route smokes, cache analysis, and audits, gather evidence
-first; the peer judges only the bounded packet.
+For peer review, route smokes, cache analysis, and audits, gather evidence first; the peer judges only the bounded packet.
 
-- Gather paths, line snippets, command names, exits, and invariants with `rg`,
-  `node` scripts, validators, or small reads.
-- Send only that packet. Exclude full docs, raw logs, timestamps, session IDs,
-  and screenshots unless they are the evidence.
-- Prefer no tools for judgment-only review; otherwise allow only read-only
-  tools and name the exact read set.
+- Gather paths, line snippets, command names, exits, and invariants with `rg`, `node` scripts, validators, or small reads.
+- Send only that packet. Exclude full docs, raw logs, timestamps, session IDs, and screenshots unless they are the evidence.
+- Prefer no tools for judgment-only review; otherwise allow only read-only tools and name the exact read set.
 - Controller accepts, rejects, or escalates findings. Peers do not own scope.
+- Fail on empty/non-JSON stdout, explicit error events, budget errors, fallback warnings, or missing final model text.
+- For `claude -p --output-format json`, check `is_error`, `subtype`, and `result` fields before treating output as review evidence.
+- For `opencode run --format json`, extract `text` from JSONL events; the stream is not a single review result.
 
 ## No Scratch-File Rule
 
-- Do not write CLI probe output under `%TEMP%`, `$env:TEMP`, `/tmp`, or other
-  system temp directories.
-- Prefer stdout, JSON/JSONL streaming, or in-memory parsing.
+- Do not write CLI probe output under `%TEMP%`, `$env:TEMP`, `/tmp`, or other system temp directories; prefer stdout, JSON/JSONL streaming, or in-memory parsing.
 - Persistent repo evidence goes under `Harness/tasks/<task-id>/evidence/`.
-- Cache telemetry may live under `$HOME/.claude/cache-telemetry/` to avoid repo
-  prompt-cache churn.
+- Cache telemetry may live under `$HOME/.claude/cache-telemetry/` to avoid repo prompt-cache churn.
 - Do not create prompt temp files. Use stdin.
 
 ## Subagent Output Contract
@@ -102,8 +91,7 @@ Follow `Harness/specs/runtime/context-loading.md#Cache-First Context Contract`:
 ## Batch-Test Pattern
 
 1. Probe command availability with `Get-Command claude,codex,opencode -ErrorAction SilentlyContinue`.
-2. Build a compact evidence packet before invoking peer agents; use the peer
-   only for judgment unless the test explicitly requires live agent discovery.
+2. Build a compact evidence packet before invoking peer agents; use the peer only for judgment unless the test explicitly requires live agent discovery.
 3. Run a cold turn and capture session id.
 4. Resume that session for two warm turns.
 5. For each turn record input, cache creation, cache read, ratio, cost, model/session id, and exact flags.
@@ -111,9 +99,6 @@ Follow `Harness/specs/runtime/context-loading.md#Cache-First Context Contract`:
 
 ## Official References
 
-- Claude Code CLI reference: https://code.claude.com/docs/en/cli-reference
-- Claude Code prompt caching: https://code.claude.com/docs/en/prompt-caching
-- Claude Code status line schema: https://code.claude.com/docs/en/statusline
+- Claude Code CLI/cache/statusline: https://code.claude.com/docs/en/cli-reference
 - Codex CLI: https://developers.openai.com/codex/cli
-- Codex non-interactive mode: https://learn.chatgpt.com/docs/non-interactive-mode
 - OpenCode CLI: https://opencode.ai/docs/cli/

package/templates/common/.claude/skills/wf-browser/SKILL.md

@@ -0,0 +1,176 @@
+---
+name: wf-browser
+description: Built-in browser automation and E2E verification workflow. Use for Claude /wf-browser, Codex $wf-browser or /skills wf-browser, Browser Use, Playwright, Chrome DevTools/CDP, screenshots, forms, UI verification, and browser-visible acceptance.
+---
+
+# WF Browser
+
+This skill is the single Browser E2E entry. Do not use or create a separate
+browser E2E skill. The browser evidence contract lives here plus
+`Harness/specs/protocols/HARNESS_BRIDGE.md`.
+
+## Invocation
+
+- Claude Code: use `/wf-browser <task>` or select the `wf-browser` skill.
+- Codex CLI or IDE: use `$wf-browser <task>` or `/skills` then choose `wf-browser`.
+- OpenCode: use `/wf-browser <task>`.
+
+## Load
+
+- `CLAUDE.md`
+- `Harness/MEMORY.md` index only per Memory Preflight
+- `Harness/README.md`
+- `Harness/specs/protocols/HARNESS_BRIDGE.md`
+- Project run/build/test instructions
+- Official Browser Use skill text from `browser-use skill` when Browser Use is used
+
+## Cache Discipline
+
+Follow `Harness/specs/runtime/context-loading.md#Cache-First Context Contract`: keep stable
+workflow docs first, then append only the current URL, selectors, concise browser
+state, screenshot paths, trace paths, and failing assertions. Do not paste full
+accessibility trees, browser logs, screenshots, videos, or network dumps into
+task state.
+
+## Browser Evidence Contract
+
+Every browser-visible claim needs real browser evidence:
+
+1. URL and viewport/browser scope.
+2. Stable selector contract using `data-testid` and accessible labels/roles.
+3. Real interaction evidence from Browser Use, Playwright, Chrome DevTools/CDP,
+   or documented manual browser checks.
+4. Console and network checks for runtime exceptions, failed requests, and
+   frontend-backend side effects.
+5. Screenshot, trace, video, state snapshot, or command output path.
+6. AC-by-AC validation matrix when acceptance criteria exist.
+
+No `data-testid` or stable accessible selector, no UI acceptance. No API
+contract, no backend integration acceptance.
+
+## Controllable UI Contract
+
+UI built for browser control must expose targetable, user-meaningful controls:
+
+| Category | Required control surface |
+| --- | --- |
+| Inputs | `<label>` association or `aria-label`, `data-testid`, disabled/invalid states, deterministic placeholder only as fallback |
+| Buttons | accessible name, `data-testid`, disabled/loading state, no icon-only button without `aria-label` |
+| Filters | stable test id for input/menu/chip, selected state, clear/reset control |
+| Rows/items | stable row/item test id plus durable item key such as `data-row-id`; avoid index-only targeting |
+| Empty state | visible empty container with `data-testid="empty-state"` or feature-specific equivalent |
+| Error state | inline error/toast/banner with stable test id and accessible role when appropriate |
+| Loading state | stable spinner/skeleton/progress test id; verify duplicate submit prevention |
+
+Required coverage targets: inputs, buttons, filters, rows, empty/error/loading states.
+
+Selector priority:
+
+1. `data-testid`
+2. accessible labels/roles
+3. visible text for stable user-facing copy
+
+Do not use generated class names, brittle CSS chains, XPath, DOM index selectors,
+or raw coordinates as the primary test contract. Coordinates are acceptable only
+after locating an element through the accessibility tree or when testing canvas
+or other non-DOM UI.
+
+## Browser Use CLI
+
+Use the current script-style Browser Use CLI; old `browser-use open/state/click/screenshot/input/wait` subcommands are removed from the current CLI and must not be used in new docs or tests.
+
+Health check:
+
+```bash
+browser-use --doctor
+browser-use skill
+```
+
+PowerShell smoke:
+
+```powershell
+@'
+new_tab("https://example.com")
+wait_for_load()
+print(page_info())
+path = capture_screenshot("Harness/tasks/<task-id>/evidence/example.png")
+print(path)
+'@ | browser-use
+```
+
+Bash smoke:
+
+```bash
+browser-use <<'PY'
+new_tab("https://example.com")
+wait_for_load()
+print(page_info())
+path = capture_screenshot("Harness/tasks/<task-id>/evidence/example.png")
+print(path)
+PY
+```
+
+Useful helpers include `new_tab(url)`, `goto_url(url)`, `page_info()`,
+`capture_screenshot(path)`, `click_at_xy(x, y)`, `type_text(text)`,
+`fill_input(selector, text)`, `press_key(key)`, `scroll(x, y)`, `js(code)`,
+`cdp(method, ...)`, `wait_for_load()`, `wait_for_element(selector)`,
+`list_tabs()`, `switch_tab(target)`, and `close_tab(target)`.
+
+For local Chrome connection problems, run `browser-use --doctor`. If Chrome asks
+to allow remote debugging, stop and ask the user to approve the browser prompt.
+
+## Playwright Test Pattern
+
+Prefer Playwright for repeatable E2E tests and Browser Use/CDP for exploratory
+or interactive checks.
+
+```ts
+import { test, expect } from "@playwright/test";
+
+test("AC-001 user can submit the form", async ({ page }) => {
+  const requests: Array<{ url: string; method: string; postData: string | null }> = [];
+  page.on("request", request => {
+    requests.push({
+      url: request.url(),
+      method: request.method(),
+      postData: request.postData(),
+    });
+  });
+
+  await page.goto("/example");
+  await page.getByTestId("email-input").fill("test@example.com");
+  await page.getByRole("button", { name: "Submit" }).click();
+
+  await expect(page.getByTestId("loading-spinner")).toBeHidden();
+  await expect(page.getByTestId("result-row")).toBeVisible();
+  expect(requests.some(request => request.url.includes("/api/example"))).toBe(true);
+});
+```
+
+## Chrome DevTools / CDP Checklist
+
+- [ ] Record URL, port, browser, and viewport.
+- [ ] Verify available Browser Use, Playwright, CDP, MCP, or manual tooling.
+- [ ] Check not just HTTP 200.
+- [ ] Verify no runtime exceptions, console errors, and failed network requests.
+- [ ] Confirm stable accessible labels/roles or `data-testid` on interactive elements.
+- [ ] Test the critical flow end-to-end with real user actions.
+- [ ] Capture screenshot, trace, video, state snapshot, or result artifact paths.
+- [ ] Produce an AC-by-AC validation matrix.
+- [ ] Clean up dev server or browser processes that the task started.
+
+## Security
+
+- Never log or screenshot real credentials, API keys, tokens, or private data.
+- Use placeholder credentials in examples.
+- Ask before using a real Chrome profile because it contains cookies and private sessions.
+- Ask before leaving a remote/cloud browser running.
+- For scraping or repeated automated visits, confirm the user owns the target or has permission.
+
+## Return
+
+- Commands or scripts run
+- Selectors used
+- Screenshot/trace/video/state paths
+- Verified flows and AC matrix
+- Failures and remaining risks

package/templates/common/.claude/skills/wf-command-create/SKILL.md

@@ -0,0 +1,37 @@
+---
+name: wf-command-create
+description: Create or modify Harness wf-* commands atomically. Use for $wf-command-create or /skills wf-command-create in Codex, and for /wf-command-create in Claude Code/OpenCode. Direct/compat maintenance command; creates or resumes a task capsule but does not enter WF mode.
+---
+
+# WF Command Create Adapter
+
+This skill is a Codex compatibility shim for the direct `/wf-command-create`
+maintenance command. It does not start WF mode or load `Harness/MEMORY.md`.
+
+## Invocation
+
+- Codex: `$wf-command-create` or `/skills` then choose `wf-command-create`.
+- Claude Code: `/wf-command-create` direct command from `.claude/commands/wf-command-create.md`.
+- OpenCode: `/wf-command-create` direct command from `.opencode/commands/wf-command-create.md`.
+
+## Load
+
+- `.claude/commands/wf-command-create.md`
+- `Harness/specs/runtime/command-surface.json`
+
+## Rules
+
+Execute the command instructions from `.claude/commands/wf-command-create.md`.
+
+- Create or resume the task capsule first.
+- Update `command-surface.json` before creating command files.
+- Keep `.agents/skills/<id>/SKILL.md` byte-identical to `.claude/skills/<id>/SKILL.md`.
+- Keep `.opencode/commands/<id>.md` body-identical to `.claude/commands/<id>.md`.
+- Run the validation list from the command file or record why a check could not complete.
+
+## Return
+
+- Task capsule path
+- Command classification
+- Changed surface checklist
+- Verification results

package/templates/common/.claude/skills/wf-help/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: wf-help
+description: Codex compatibility: use $wf-help or /skills wf-help in Codex to show the Harness WF command table. Claude Code and OpenCode use the direct /wf-help command.
+---
+
+# WF Help Adapter
+
+This skill is a Codex compatibility shim. It does not start WF mode, dispatch
+agents, or edit files.
+
+## Invocation
+
+- Codex CLI or IDE: use `$wf-help` or `/skills` then choose `wf-help`.
+- Claude Code: use `/wf-help` direct command from `.claude/commands/wf-help.md`.
+- OpenCode: use `/wf-help` direct command from `.opencode/commands/wf-help.md`.
+
+## Load
+
+- `.claude/commands/wf-help.md`
+
+## Rules
+
+Return the command table from `.claude/commands/wf-help.md` directly.
+Do not load `Harness/MEMORY.md`, do not enter WF, and do not invoke workflow
+skills while answering help.
+
+## Return
+
+- WF command table
+- One short note that Codex uses `$wf-*` or `/skills wf-*` for skill-backed entries

package/templates/common/.claude/skills/wf-max/SKILL.md

@@ -43,7 +43,7 @@ WF-MAX inherits the selected WF tier and the shared WF-KERNEL gates
 default; WF-Max-Strict only on explicit strict request. Execution expands
 through:
 
-- New task state directories MUST use task ids matching
+- New task capsules / state directories MUST use task ids matching
   `task-<verb>-<noun>[-detail]` under `Harness/tasks/<task-id>/`; never
   create bare `fix-*` task ids.
 1. Global mode: `wf-max`
@@ -75,16 +75,30 @@ WF-Max-Strict (explicit override): user says `--strict`, `strict wf-max`, or
 
 ## Fan-Out Discipline
 
+- MUST attempt native subagent fan-out before implementation planning is
+  considered complete. A solo controller path is allowed only after recording
+  `fanoutAttempted: true`, the runtime, channel tried, agents requested,
+  limit/cap facts, failure reason, and fallback path in task state.
 - Use as many useful subagents as the runtime safely allows.
-- Codex capacity may be configured through official `agents.max_threads` and
-  `agents.max_depth`; generated Harness config defaults to
-  `.codex/config.toml` with `max_threads = 12` and `max_depth = 1`.
+- Claude Code documents session, concurrent, and spawn-depth subagent caps:
+  `CLAUDE_CODE_MAX_SUBAGENTS_PER_SESSION`,
+  `CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS`, and
+  `CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH`; Harness still enforces its lower
+  WF-MAX caps unless the user explicitly approves a task-local override.
+- Codex capacity is configured through official
+  `agents.max_concurrent_threads_per_session`; `agents.max_threads` is a
+  legacy alias. Do not scaffold scalar `[agents]` caps into
+  `.codex/config.toml`; codex-cli 0.144.x can reject them during TUI
+  `skills/list`. Treat Codex capacity as a runtime probe and manage Harness
+  caps in the dispatch ledger unless the installed Codex version is verified
+  with `codex --strict-config doctor`.
+- OpenCode uses `subagent_depth` for nesting. WF-MAX manager -> worker fan-out
+  requires `subagent_depth >= 2` plus manager `permission.task` allowlists; the
+  scaffold sets `subagent_depth = 2`.
 - Close completed agents before declaring the pool exhausted.
 - If Codex remains bottlenecked, ask the user before raising
-  `agents.max_threads` above the scaffold default. Do not silently edit project
-  or global Codex config.
-- Keep `agents.max_depth = 1` unless the user explicitly approves recursive
-  delegation.
+  `agents.max_concurrent_threads_per_session`. Do not silently edit project or
+  global Codex config.
 - If the current runtime is exhausted, overflow to a peer CLI with explicit
   dispatch packets: `claude -p`, `codex exec`, or
   `opencode run --agent <role> --dir .`.

package/templates/common/.claude/skills/wf-review/SKILL.md

@@ -55,12 +55,39 @@ the review prompt.
 
 OpenCode note: `opencode run [message..]` is the non-interactive CLI path and
 `--agent reviewer` selects the installed `.opencode/agents/reviewer.md` role.
+However, the installed agent is `mode: subagent`; OpenCode falls back to the
+default agent. Prefer same-runtime reviewer subagent over `opencode run --agent reviewer`.
+
+For `opencode run --format json`, parse JSONL events; the stream is not a single
+review result.
+
+## Evidence-Packet Peer Review Contract
+
+When invoking a peer CLI, use stdin prompt transport for PowerShell automation.
+Return the raw evidence packet to the controller for formal acceptance.
+
+### JSON/JSONL Validation
+
+For `claude -p` with `--output-format json`:
+- Fail if stdout is empty, non-JSON, `is_error: true`, `subtype` starts with `error_`, or no final model `text`/`result` is present.
+- Do NOT use tiny `--max-budget-usd` values in real reviews; if budget is set and exhausted, record BLOCKED rather than treating it as reviewer output.
+
+For `opencode run --format json`:
+- Parse JSONL events, extract final `text` parts.
+- Do NOT treat the whole JSONL stream as the review result.
+- Do NOT claim `opencode run --agent reviewer` used the reviewer role unless a probe confirms the agent is a primary runnable agent. Current evidence: `.opencode/agents/reviewer.md` is `mode: subagent` and OpenCode falls back to the default agent.
+- Prefer native reviewer subagent fallback inside the current runtime when OpenCode cannot run reviewer as a primary CLI agent.
+
+General parsing rules: parse JSON/JSONL and fail on empty output, non-JSON output, explicit error events, budget errors, fallback warnings, or missing final model text.
+
+### Controller Adjudication
+
+The controller accepts, rejects, or escalates each finding after parsing the evidence packet. Do not pass raw output through as accepted findings without controller review.
 
 ## Review Dimensions
 
 Cover correctness, security, architecture, performance, and tests. Classify
-findings as Critical, High, Medium, or Low. Return raw peer or subagent output
-first, then the controller's severity-classified synthesis.
+findings as Critical, High, Medium, or Low.
 
 ## Reviewer Role Fallback
 

package/templates/common/.claude/skills/wf-task-archive/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: wf-task-archive
+description: Archive completed task capsules. Use for $wf-task-archive or /skills wf-task-archive in Codex. Direct/compat command wrapping task-state.mjs — does not enter WF mode.
+---
+
+# WF Task Archive Adapter
+
+This skill is a Codex compatibility shim. It does not start WF mode, dispatch agents, or edit files directly.
+
+## Invocation
+
+- Codex: `$wf-task-archive` or `/skills` then choose `wf-task-archive`.
+- Claude Code: `/wf-task-archive` direct command from `.claude/commands/wf-task-archive.md`.
+- OpenCode: `/wf-task-archive` direct command from `.opencode/commands/wf-task-archive.md`.
+
+## Load
+
+- `.claude/commands/wf-task-archive.md`
+
+## Rules
+
+Execute the command instructions from `.claude/commands/wf-task-archive.md` directly.
+Do not load `Harness/MEMORY.md`, do not enter WF.
+
+## Return
+
+- Task archive result
+- Note that Codex uses `$wf-task-archive` or `/skills wf-task-archive`

package/templates/common/.claude/skills/wf-task-list/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: wf-task-list
+description: List task capsules. Use for $wf-task-list or /skills wf-task-list in Codex. Direct/compat command wrapping task-state.mjs — does not enter WF mode.
+---
+
+# WF Task List Adapter
+
+This skill is a Codex compatibility shim. It does not start WF mode, dispatch agents, or edit files directly.
+
+## Invocation
+
+- Codex: `$wf-task-list` or `/skills` then choose `wf-task-list`.
+- Claude Code: `/wf-task-list` direct command from `.claude/commands/wf-task-list.md`.
+- OpenCode: `/wf-task-list` direct command from `.opencode/commands/wf-task-list.md`.
+
+## Load
+
+- `.claude/commands/wf-task-list.md`
+
+## Rules
+
+Execute the command instructions from `.claude/commands/wf-task-list.md` directly.
+Do not load `Harness/MEMORY.md`, do not enter WF.
+
+## Return
+
+- Task listing result
+- Note that Codex uses `$wf-task-list` or `/skills wf-task-list`

package/templates/common/.claude/skills/wf-task-record/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: wf-task-record
+description: Record user intent into a task capsule. Use for $wf-task-record or /skills wf-task-record in Codex. Direct/compat command wrapping task-state.mjs — does not enter WF mode.
+---
+
+# WF Task Record Adapter
+
+This skill is a Codex compatibility shim. It does not start WF mode, dispatch agents, or edit files directly.
+
+## Invocation
+
+- Codex: `$wf-task-record` or `/skills` then choose `wf-task-record`.
+- Claude Code: `/wf-task-record` direct command from `.claude/commands/wf-task-record.md`.
+- OpenCode: `/wf-task-record` direct command from `.opencode/commands/wf-task-record.md`.
+
+## Load
+
+- `.claude/commands/wf-task-record.md`
+
+## Rules
+
+Execute the command instructions from `.claude/commands/wf-task-record.md` directly.
+Do not load `Harness/MEMORY.md`, do not enter WF.
+
+## Return
+
+- Task record result
+- Note that Codex uses `$wf-task-record` or `/skills wf-task-record`

package/templates/common/.codex/config.toml

@@ -1,5 +1,3 @@
-[agents]
-# Harness WF-MAX default: higher than Codex's unset default of 6.
-# Keep depth at 1 unless the user explicitly approves recursive delegation.
-max_threads = 12
-max_depth = 1
+# Codex project config intentionally avoids WF-MAX capacity defaults.
+# codex-cli 0.144.x can reject scalar agent-capacity caps during TUI skills/list.
+# WF-MAX manages fan-out caps in Harness docs and task state instead.