create-harness-vibe-coding 0.8.17 → 0.8.19

package/templates/common/.claude/commands/wf-update.md

@@ -22,7 +22,23 @@ targeted inspection.
 
 ## Flow
 
-1. Run `node Harness/scripts/wf-update-check.mjs --json` first and use the
+Scope resolution is deterministic:
+
+- Current project has `Harness/scripts/wf-update-check.mjs`: update the project
+  install from that script.
+- A global runtime is discoverable from `Harness/.harness-version.globalDir`,
+  `HARNESS_GLOBAL_HOME`, or the default `~/.harness/create-harness-vibe-coding`:
+  update that runtime too, then sync its Claude/Codex/OpenCode host-global
+  copies.
+- Current project has no Harness install: update only the global runtime and
+  host-global copies. Do not scaffold or modify the project unless the user
+  explicitly asks to install Harness there.
+`Harness/scripts/wf-update-runner.mjs` implements this multi-scope routing.
+Older installs that do not have the runner fall back to
+`Harness/scripts/wf-update-check.mjs`.
+
+1. Run `node Harness/scripts/wf-update-runner.mjs --json` first when present;
+   otherwise run `node Harness/scripts/wf-update-check.mjs --json`. Use the
    `agent` block as the action plan. Preserve `agent.releaseHighlights` for the
    user-facing update summary. Current updaters try npm
    `create-harness-vibe-coding@latest` first, then the canonical GitHub source
@@ -33,9 +49,11 @@ targeted inspection.
    starter files may be created, and checksum-matching legacy architecture can
    move to `Harness/project/architecture.md`. Harness/README.md is merge-tier,
    not PRESERVE.
-3. If `agent.safeApplyCommand` is present, run it to apply SAFE, NEW, and
-   adopted metadata-only files before spending AI time on conflicts. Default
-   command: `node Harness/scripts/wf-update-check.mjs --apply-safe`.
+3. If `agent.safeApplyCommand` is present, run the runner apply path to apply
+   SAFE, NEW, and adopted metadata-only files across every discovered scope
+   before spending AI time on conflicts. Default multi-scope command:
+   `node Harness/scripts/wf-update-runner.mjs --apply-safe --json`. Single-scope
+   fallback command: `node Harness/scripts/wf-update-check.mjs --apply-safe`.
    Framework-owned templates, commands, skills, agents, and scripts are
    script-owned and should be overwritten by the updater after checksum
    validation.
@@ -53,11 +71,38 @@ targeted inspection.
    `--accept-local <file>`, `--accept-merged <file>`, or
    `--accept-template <file>`; do not hand-edit `Harness/.harness-version`.
    Ask the user only when the intent is ambiguous.
-7. Run `node Harness/scripts/wf-update-check.mjs --finalize` after all
-   conflicts have script-recorded decisions. Use strict `--apply` only when the
-   JSON plan has zero conflicts.
-8. After update, run `node Harness/scripts/validate-harness.mjs` and then
-   `node Harness/scripts/scan-clean.mjs`.
+7. Run `node Harness/scripts/wf-update-runner.mjs --finalize --json` after all
+   conflicts have script-recorded decisions. Single-scope fallback:
+   `node Harness/scripts/wf-update-check.mjs --finalize`. Use strict `--apply` only when
+   the JSON plan has zero conflicts.
+8. After update, sync and validate all machine surfaces:
+   ```
+   node Harness/scripts/sync-host-global.mjs --json
+   node Harness/scripts/sync-host-global.mjs --apply --json
+   node Harness/scripts/validate-harness.mjs
+   node Harness/scripts/validate-harness.mjs --manifest-audit
+   node Harness/scripts/scan-clean.mjs --json
+   ```
+   `sync-host-global.mjs` is a no-op for project-only installs. For global
+   installs it compares host-global files against the runtime sources listed in
+   `.harness-version.hostGlobal.targets`; missing or Harness-marked stale copies
+   are repaired by script, while user-looking files stay conflicts.
+9. If the update reports "Already up to date" but files are missing (e.g.,
+   new commands not showing up on a platform), run:
+   ```
+   node Harness/scripts/wf-update-runner.mjs --repair --json
+   node Harness/scripts/wf-update-runner.mjs --repair --apply-safe --json
+   node Harness/scripts/wf-update-runner.mjs --repair --finalize --json
+   node Harness/scripts/wf-update-check.mjs --repair --json
+   node Harness/scripts/wf-update-check.mjs --repair --apply-safe
+   node Harness/scripts/wf-update-check.mjs --repair --finalize
+   node Harness/scripts/sync-host-global.mjs --apply --json
+   node Harness/scripts/validate-harness.mjs --manifest-audit
+   ```
+   `--repair` bypasses the version check and forces a full file diff against
+   the latest remote template. This catches files that were missed during a
+   previous partial update where the version was bumped but not all files
+   were written.
 
 Codex users without a direct command surface: use `$wf-update` (skill path) or
 `node Harness/scripts/wf-update-check.mjs`.

package/templates/common/.claude/rules/ecc/common.md

@@ -8,7 +8,7 @@ alwaysApply: true
 ## Context
 
 - Start with `CLAUDE.md`. When `Harness/` exists, also read `Harness/memory/startup-hints.md` (L2 lightweight digest, not full router).
-- When the user explicitly invokes a workflow command (`/wf-*`, `$wf-*`, or `/skills wf-*`), excluding `/wf-help`, `$wf-help`, `/skills wf-help`, `/wf-update`, `$wf-update`, and `/skills wf-update`, load `Harness/MEMORY.md` and `Harness/README.md`.
+- When the user explicitly invokes a workflow command (`/wf-*`, `$wf-*`, or `/skills wf-*`), excluding `/wf-help`, `$wf-help`, `/skills wf-help`, `/wf-update`, `$wf-update`, `/skills wf-update`, `/wf-task-record`, `$wf-task-record`, `/skills wf-task-record`, `/wf-task-list`, `$wf-task-list`, `/skills wf-task-list`, `/wf-task-archive`, `$wf-task-archive`, `/skills wf-task-archive`, `/wf-command-create`, `$wf-command-create`, `/skills wf-command-create`, `/wf-ui`, `$wf-ui`, and `/skills wf-ui`, load `Harness/MEMORY.md` and `Harness/README.md`.
 - For simple single-step tasks without `/wf-*`, operate in direct mode: skip the Harness router and execute directly.
 - Do not bulk-read `Harness/`. Load by router trigger.
 - Keep `Harness/tasks/<task-id>/PROGRESS.md` and `Harness/tasks/<task-id>/PLAN.md` current when work has multiple steps, files, or agents.

package/templates/common/.claude/skills/wf-agents-docs/SKILL.md

@@ -9,13 +9,10 @@ Use this skill before shelling out to `claude`, `codex`, or `opencode` from Harn
 
 ## Source Order
 
-1. Prefer installed help: `claude --help`, `codex exec --help`, `opencode run --help`.
-2. Check official docs for flags that affect cost, auth, JSON, resume, tools/MCP, or telemetry.
-3. When adding automation, record command, source, stdout/stderr shape, and failed patterns.
+Prefer installed help (`claude --help`, `codex exec --help`, `opencode run --help`), then official docs for cost/auth/JSON/resume/tools/telemetry; record command, source, stdout/stderr shape, and failures.
 
 ## Claude Code CLI
 
-- Interactive: `claude`.
 - Non-interactive JSON: pipe ASCII or UTF-8-safe stdin into `claude -p --output-format json`.
 - Stream JSON requires verbose mode: `claude -p --output-format stream-json --verbose`.
 - Continue/resume: `claude -c -p "..."` or `claude -p --resume <session-id> "..."`; for PowerShell automation, prefer stdin and validate non-empty JSON before parsing.
@@ -26,19 +23,15 @@ Use this skill before shelling out to `claude`, `codex`, or `opencode` from Harn
 
 ## Codex CLI
 
-- Interactive: `codex`.
 - Non-interactive: `codex exec "task"`.
-- Read stdin as the full prompt: `cat prompt.txt | codex exec -`.
-- Prompt plus stdin context: `some-command | codex exec "summarize this output"`.
+- Stdin modes: `cat prompt.txt | codex exec -`; `some-command | codex exec "summarize this output"`.
 - Machine output: `codex exec --json "task"` emits JSONL events; parse `turn.completed.usage`, including `cached_input_tokens` when present.
 - Resume: `codex exec resume --last "..."` or `codex exec resume <SESSION_ID> "..."`.
 - Permissions: default is read-only; set `--sandbox workspace-write` only when edits are required. Use `--ignore-user-config` / `--ignore-rules` for controlled automation.
 
 ## OpenCode CLI
 
-- Interactive: `opencode`.
-- Non-interactive: `opencode run [message..]`.
-- JSON events: `opencode run --format json "task"`.
+- Non-interactive: `opencode run [message..]`; JSON events: `opencode run --format json "task"`.
 - Resume: `opencode run --continue "..."` or `opencode run --session <id> "..."`.
 - Peer role: `opencode run --agent reviewer --dir . "review prompt"`.
 - Reuse a server to avoid MCP cold boot: `opencode serve`, then `opencode run --attach http://localhost:4096 "task"`.
@@ -48,31 +41,27 @@ Use this skill before shelling out to `claude`, `codex`, or `opencode` from Harn
 
 - Prefer stdin over trailing prompt args for `claude -p` in PowerShell.
 - Use ASCII prompts or explicitly UTF-8-safe input for automated probes.
-- Do not trust exit code alone. Fail on empty/non-JSON stdout or error/budget terminal fields.
+- Do not trust exit code alone. Fail on empty/non-JSON stdout, error/budget/fallback terminal fields, or missing final model text.
 - Avoid naming function parameters `$Args`; PowerShell treats `$Args` specially.
 - Store telemetry outside the repo, e.g. `$HOME/.claude/cache-telemetry/*.json`, so git status does not perturb prefixes.
 
 ## Evidence-Packet Review Pattern
 
-For peer review, route smokes, cache analysis, and audits, gather evidence
-first; the peer judges only the bounded packet.
+For peer review, route smokes, cache analysis, and audits, gather evidence first; the peer judges only the bounded packet.
 
-- Gather paths, line snippets, command names, exits, and invariants with `rg`,
-  `node` scripts, validators, or small reads.
-- Send only that packet. Exclude full docs, raw logs, timestamps, session IDs,
-  and screenshots unless they are the evidence.
-- Prefer no tools for judgment-only review; otherwise allow only read-only
-  tools and name the exact read set.
+- Gather paths, line snippets, command names, exits, and invariants with `rg`, `node` scripts, validators, or small reads.
+- Send only that packet. Exclude full docs, raw logs, timestamps, session IDs, and screenshots unless they are the evidence.
+- Prefer no tools for judgment-only review; otherwise allow only read-only tools and name the exact read set.
 - Controller accepts, rejects, or escalates findings. Peers do not own scope.
+- Fail on empty/non-JSON stdout, explicit error events, budget errors, fallback warnings, or missing final model text.
+- For `claude -p --output-format json`, check `is_error`, `subtype`, and `result` fields before treating output as review evidence.
+- For `opencode run --format json`, extract `text` from JSONL events; the stream is not a single review result.
 
 ## No Scratch-File Rule
 
-- Do not write CLI probe output under `%TEMP%`, `$env:TEMP`, `/tmp`, or other
-  system temp directories.
-- Prefer stdout, JSON/JSONL streaming, or in-memory parsing.
+- Do not write CLI probe output under `%TEMP%`, `$env:TEMP`, `/tmp`, or other system temp directories; prefer stdout, JSON/JSONL streaming, or in-memory parsing.
 - Persistent repo evidence goes under `Harness/tasks/<task-id>/evidence/`.
-- Cache telemetry may live under `$HOME/.claude/cache-telemetry/` to avoid repo
-  prompt-cache churn.
+- Cache telemetry may live under `$HOME/.claude/cache-telemetry/` to avoid repo prompt-cache churn.
 - Do not create prompt temp files. Use stdin.
 
 ## Subagent Output Contract
@@ -102,8 +91,7 @@ Follow `Harness/specs/runtime/context-loading.md#Cache-First Context Contract`:
 ## Batch-Test Pattern
 
 1. Probe command availability with `Get-Command claude,codex,opencode -ErrorAction SilentlyContinue`.
-2. Build a compact evidence packet before invoking peer agents; use the peer
-   only for judgment unless the test explicitly requires live agent discovery.
+2. Build a compact evidence packet before invoking peer agents; use the peer only for judgment unless the test explicitly requires live agent discovery.
 3. Run a cold turn and capture session id.
 4. Resume that session for two warm turns.
 5. For each turn record input, cache creation, cache read, ratio, cost, model/session id, and exact flags.
@@ -111,9 +99,6 @@ Follow `Harness/specs/runtime/context-loading.md#Cache-First Context Contract`:
 
 ## Official References
 
-- Claude Code CLI reference: https://code.claude.com/docs/en/cli-reference
-- Claude Code prompt caching: https://code.claude.com/docs/en/prompt-caching
-- Claude Code status line schema: https://code.claude.com/docs/en/statusline
+- Claude Code CLI/cache/statusline: https://code.claude.com/docs/en/cli-reference
 - Codex CLI: https://developers.openai.com/codex/cli
-- Codex non-interactive mode: https://learn.chatgpt.com/docs/non-interactive-mode
 - OpenCode CLI: https://opencode.ai/docs/cli/

package/templates/common/.claude/skills/wf-auto/SKILL.md

@@ -48,7 +48,7 @@ that auto scanning costs more than it helps.
    obligations are covered, two different confirmation strategies are empty,
    and unresolved uncertainty is recorded.
 2. CEO never edits production source. CEO may write only
-   `Harness/tasks/auto/PLAN.md` and `Harness/tasks/auto/PROGRESS.md`.
+   `Harness/tasks/continuous/PLAN.md` and `Harness/tasks/continuous/PROGRESS.md`.
 3. Build a project profile each W0 cycle and dispatch only the selected probes;
    invoke oracle and spark searchers when evidence justifies them.
 4. One accepted finding per cycle: <=3 files and <=50 changed lines. Larger
@@ -61,8 +61,8 @@ that auto scanning costs more than it helps.
    below 3.
 8. Intent Checkpoint is adaptive: 2 -> 5 -> 10 cycles, exactly two questions.
 9. Record compact evidence per cycle; do not paste full logs or transcripts.
-10. A bounded test tick still creates or updates `Harness/tasks/auto/PLAN.md`
-    and `Harness/tasks/auto/PROGRESS.md`; missing auto capsule evidence is a
+10. A bounded test tick still creates or updates `Harness/tasks/continuous/PLAN.md`
+    and `Harness/tasks/continuous/PROGRESS.md`; missing auto capsule evidence is a
     failed cycle record.
 
 ## Loop

package/templates/common/.claude/skills/wf-auto-spark/SKILL.md

@@ -44,5 +44,5 @@ replaying search transcripts.
 6. Value reflection is required every cycle: source, why it matters, deviation,
    evidence, and milestone progress.
 
-Active roadmap: `Harness/tasks/auto/SPARK-ROADMAP.md`.
-Per-cycle evidence: `Harness/tasks/auto/PROGRESS.md`.
+Active roadmap: `Harness/tasks/continuous/SPARK-ROADMAP.md`.
+Per-cycle evidence: `Harness/tasks/continuous/PROGRESS.md`.

package/templates/common/.claude/skills/wf-command-create/SKILL.md

@@ -0,0 +1,37 @@
+---
+name: wf-command-create
+description: Create or modify Harness wf-* commands atomically. Use for $wf-command-create or /skills wf-command-create in Codex, and for /wf-command-create in Claude Code/OpenCode. Direct/compat maintenance command; creates or resumes a task capsule but does not enter WF mode.
+---
+
+# WF Command Create Adapter
+
+This skill is a Codex compatibility shim for the direct `/wf-command-create`
+maintenance command. It does not start WF mode or load `Harness/MEMORY.md`.
+
+## Invocation
+
+- Codex: `$wf-command-create` or `/skills` then choose `wf-command-create`.
+- Claude Code: `/wf-command-create` direct command from `.claude/commands/wf-command-create.md`.
+- OpenCode: `/wf-command-create` direct command from `.opencode/commands/wf-command-create.md`.
+
+## Load
+
+- `.claude/commands/wf-command-create.md`
+- `Harness/specs/runtime/command-surface.json`
+
+## Rules
+
+Execute the command instructions from `.claude/commands/wf-command-create.md`.
+
+- Create or resume the task capsule first.
+- Update `command-surface.json` before creating command files.
+- Keep `.agents/skills/<id>/SKILL.md` byte-identical to `.claude/skills/<id>/SKILL.md`.
+- Keep `.opencode/commands/<id>.md` body-identical to `.claude/commands/<id>.md`.
+- Run the validation list from the command file or record why a check could not complete.
+
+## Return
+
+- Task capsule path
+- Command classification
+- Changed surface checklist
+- Verification results

package/templates/common/.claude/skills/wf-max/SKILL.md

@@ -43,7 +43,7 @@ WF-MAX inherits the selected WF tier and the shared WF-KERNEL gates
 default; WF-Max-Strict only on explicit strict request. Execution expands
 through:
 
-- New task state directories MUST use task ids matching
+- New task capsules / state directories MUST use task ids matching
   `task-<verb>-<noun>[-detail]` under `Harness/tasks/<task-id>/`; never
   create bare `fix-*` task ids.
 1. Global mode: `wf-max`

package/templates/common/.claude/skills/wf-review/SKILL.md

@@ -55,12 +55,39 @@ the review prompt.
 
 OpenCode note: `opencode run [message..]` is the non-interactive CLI path and
 `--agent reviewer` selects the installed `.opencode/agents/reviewer.md` role.
+However, the installed agent is `mode: subagent`; OpenCode falls back to the
+default agent. Prefer same-runtime reviewer subagent over `opencode run --agent reviewer`.
+
+For `opencode run --format json`, parse JSONL events; the stream is not a single
+review result.
+
+## Evidence-Packet Peer Review Contract
+
+When invoking a peer CLI, use stdin prompt transport for PowerShell automation.
+Return the raw evidence packet to the controller for formal acceptance.
+
+### JSON/JSONL Validation
+
+For `claude -p` with `--output-format json`:
+- Fail if stdout is empty, non-JSON, `is_error: true`, `subtype` starts with `error_`, or no final model `text`/`result` is present.
+- Do NOT use tiny `--max-budget-usd` values in real reviews; if budget is set and exhausted, record BLOCKED rather than treating it as reviewer output.
+
+For `opencode run --format json`:
+- Parse JSONL events, extract final `text` parts.
+- Do NOT treat the whole JSONL stream as the review result.
+- Do NOT claim `opencode run --agent reviewer` used the reviewer role unless a probe confirms the agent is a primary runnable agent. Current evidence: `.opencode/agents/reviewer.md` is `mode: subagent` and OpenCode falls back to the default agent.
+- Prefer native reviewer subagent fallback inside the current runtime when OpenCode cannot run reviewer as a primary CLI agent.
+
+General parsing rules: parse JSON/JSONL and fail on empty output, non-JSON output, explicit error events, budget errors, fallback warnings, or missing final model text.
+
+### Controller Adjudication
+
+The controller accepts, rejects, or escalates each finding after parsing the evidence packet. Do not pass raw output through as accepted findings without controller review.
 
 ## Review Dimensions
 
 Cover correctness, security, architecture, performance, and tests. Classify
-findings as Critical, High, Medium, or Low. Return raw peer or subagent output
-first, then the controller's severity-classified synthesis.
+findings as Critical, High, Medium, or Low.
 
 ## Reviewer Role Fallback
 

package/templates/common/.claude/skills/wf-task-archive/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: wf-task-archive
+description: Archive completed task capsules. Use for $wf-task-archive or /skills wf-task-archive in Codex. Direct/compat command wrapping task-state.mjs — does not enter WF mode.
+---
+
+# WF Task Archive Adapter
+
+This skill is a Codex compatibility shim. It does not start WF mode, dispatch agents, or edit files directly.
+
+## Invocation
+
+- Codex: `$wf-task-archive` or `/skills` then choose `wf-task-archive`.
+- Claude Code: `/wf-task-archive` direct command from `.claude/commands/wf-task-archive.md`.
+- OpenCode: `/wf-task-archive` direct command from `.opencode/commands/wf-task-archive.md`.
+
+## Load
+
+- `.claude/commands/wf-task-archive.md`
+
+## Rules
+
+Execute the command instructions from `.claude/commands/wf-task-archive.md` directly.
+Do not load `Harness/MEMORY.md`, do not enter WF.
+
+## Return
+
+- Task archive result
+- Note that Codex uses `$wf-task-archive` or `/skills wf-task-archive`

package/templates/common/.claude/skills/wf-task-list/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: wf-task-list
+description: List task capsules. Use for $wf-task-list or /skills wf-task-list in Codex. Direct/compat command wrapping task-state.mjs — does not enter WF mode.
+---
+
+# WF Task List Adapter
+
+This skill is a Codex compatibility shim. It does not start WF mode, dispatch agents, or edit files directly.
+
+## Invocation
+
+- Codex: `$wf-task-list` or `/skills` then choose `wf-task-list`.
+- Claude Code: `/wf-task-list` direct command from `.claude/commands/wf-task-list.md`.
+- OpenCode: `/wf-task-list` direct command from `.opencode/commands/wf-task-list.md`.
+
+## Load
+
+- `.claude/commands/wf-task-list.md`
+
+## Rules
+
+Execute the command instructions from `.claude/commands/wf-task-list.md` directly.
+Do not load `Harness/MEMORY.md`, do not enter WF.
+
+## Return
+
+- Task listing result
+- Note that Codex uses `$wf-task-list` or `/skills wf-task-list`

package/templates/common/.claude/skills/wf-task-record/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: wf-task-record
+description: Record user intent into a task capsule. Use for $wf-task-record or /skills wf-task-record in Codex. Direct/compat command wrapping task-state.mjs — does not enter WF mode.
+---
+
+# WF Task Record Adapter
+
+This skill is a Codex compatibility shim. It does not start WF mode, dispatch agents, or edit files directly.
+
+## Invocation
+
+- Codex: `$wf-task-record` or `/skills` then choose `wf-task-record`.
+- Claude Code: `/wf-task-record` direct command from `.claude/commands/wf-task-record.md`.
+- OpenCode: `/wf-task-record` direct command from `.opencode/commands/wf-task-record.md`.
+
+## Load
+
+- `.claude/commands/wf-task-record.md`
+
+## Rules
+
+Execute the command instructions from `.claude/commands/wf-task-record.md` directly.
+Do not load `Harness/MEMORY.md`, do not enter WF.
+
+## Return
+
+- Task record result
+- Note that Codex uses `$wf-task-record` or `/skills wf-task-record`

package/templates/common/.claude/skills/wf-ui/SKILL.md

@@ -0,0 +1,78 @@
+---
+name: wf-ui
+description: Codex compatibility: use $wf-ui or /skills wf-ui in Codex. In Claude Code and OpenCode, /wf-ui is a direct command that starts the local Harness browser control panel.
+---
+
+# WF-UI Adapter
+
+This skill is a Codex compatibility shim for opening the Harness control panel.
+Claude Code and OpenCode handle `/wf-ui` as a direct command. Do not route this
+through WF mode.
+
+## Invocation
+
+- Codex CLI or IDE: use `$wf-ui` or `/skills` then choose `wf-ui`.
+- Claude Code: `/wf-ui` is a direct command from `.claude/commands/wf-ui.md`.
+- OpenCode: `/wf-ui` is a direct command from `.opencode/commands/wf-ui.md`.
+
+## Load
+
+No router preload. Read only the local command file above when this runtime
+needs the exact direct command text.
+
+## Cache Discipline
+
+Keep the context to the command, current project root, and returned local URL.
+Do not paste full API responses, accessibility trees, or terminal transcripts.
+
+## Startup
+
+Run from the project root:
+
+```text
+create-harness-vibe-coding wf-ui --project . --host 127.0.0.1 --port 0 --open
+```
+
+If the global binary is not available, use:
+
+```text
+npx create-harness-vibe-coding@0.8.19 wf-ui --project . --host 127.0.0.1 --port 0 --open
+```
+
+Rules:
+- Bind only to `127.0.0.1`; never `0.0.0.0`.
+- Default port `0` for an OS-assigned free port.
+- Generate a random one-time token.
+- Open `http://127.0.0.1:<port>/?token=<token>`.
+- Leave the server running until the user stops it.
+
+## Architecture
+
+```text
+Browser UI (React + TypeScript + Motion for React + Lucide)
+    |
+    | HTTP JSON APIs + WebSocket
+    v
+Local Node server bound to 127.0.0.1 only
+    |
+    | fs + task-state.mjs + optional node-pty
+    v
+Project-local Harness files (tasks/**, settings, version, command surfaces)
+```
+
+## Communication Protocol
+
+- HTTP snapshots are canonical state: `/api/tasks`, `/api/settings`, `/api/project`.
+- WebSocket events are invalidation hints only. The UI refreshes HTTP snapshots
+  on reconnect or sequence gaps.
+- Browser writes go through typed `POST` endpoints.
+- `Harness/tasks/**` is the durable source of truth; UI state is derived.
+
+## Security
+
+- Loopback-only binding (`127.0.0.1`).
+- One-time token auth on HTTP and WebSocket.
+- Path traversal prevention on all task capsule reads.
+- Command allowlist for PTY: `claude`, `codex`, `opencode`.
+- Terminal default mode: watch/read-only; attach mode is explicit.
+- `node-pty` is optional; missing means the terminal session reports blocked.

package/templates/common/.claude/skills/wf-update/SKILL.md

@@ -16,89 +16,86 @@ This skill is a Codex compatibility shim plus script-flow reference. Claude Code
 ## Load
 
 - `Harness/.harness-version`
+- `Harness/ownership.manifest.json`
 - `Harness/scripts/wf-update-check.mjs`
+- `Harness/scripts/wf-update-runner.mjs`
+- `Harness/scripts/sync-host-global.mjs`
 - `Harness/scripts/scan-clean.mjs`
 - `Harness/scripts/validate-harness.mjs`
 
 ## Cache Discipline
 
-Follow `Harness/specs/runtime/context-loading.md#Cache-First Context Contract`: keep updater
-scripts and ownership docs stable, consume compact `--json` agent plans first,
-and avoid pasting verbose diffs or full remote files unless a conflict requires
-targeted inspection.
+Follow `Harness/specs/runtime/context-loading.md#Cache-First Context Contract`: keep updater scripts and ownership docs stable, consume compact `--json` agent plans first, and avoid pasting verbose diffs or full remote files unless a conflict requires targeted inspection.
 
 ## Classification
 
-MANIFEST-FIRST. The installer and updater read
-`Harness/ownership.manifest.json`:
+MANIFEST-FIRST. The installer and updater read `Harness/ownership.manifest.json`:
 
-- `preserve[]` — never touched (tasks, memory, research, root README,
-  package, architecture). `Harness/tasks/**` is always preserved.
-- `merge[]` — CLAUDE.md, AGENTS.md, MEMORY.md, Harness/MEMORY.md,
-  Harness/README.md → merge or accept-local; prior accepted decisions
-  carry forward.
-- `frameworkOwned[]` — safe overwrite-upgrade fast path (concurrent
-  fetch + hash + all-or-nothing write after checksum validation).
-- `optionalOwned[]` — upgraded only when that option is installed.
+- `preserve[]` - never touched when present as user data: tasks, memory, research, root README, package, architecture, and progress. `Harness/tasks/**` is always preserved.
+- `merge[]` - CLAUDE.md, AGENTS.md, MEMORY.md, Harness/MEMORY.md, Harness/README.md, and Harness/settings.json require merge or accept-local; prior accepted decisions carry forward.
+- `frameworkOwned[]` - safe overwrite-upgrade fast path after checksum validation. This must cover `.claude`, `.codex`, `.agents`, `.opencode`, and Harness template-owned scripts/specs.
+- `optionalOwned[]` - upgraded only when that option is installed.
 
-Content markers (`harness: wf-agent`, `project harness`, `Harness/...`)
-are the FALLBACK when no manifest exists (old installs) and the
-instance-ownership signal that protects a user's same-name file at a
-Harness path. A same-name user file with no marker and no manifest
-declaration → conflict/skip + warning, never overwritten.
+Content markers (`harness: wf-agent`, `project harness`, `Harness/...`) are the fallback when no manifest exists and the instance-ownership signal that protects a user's same-name file at a Harness path. A same-name user file with no marker and no manifest declaration becomes conflict/skip plus warning, never overwrite.
 
 ## Flow
 
-1. Run `node Harness/scripts/wf-update-check.mjs --json` first and use the
-   `agent` block as the action plan. Current updaters try npm
-   `create-harness-vibe-coding@latest` first, then the canonical GitHub source
-   `LiWeny16/create-harness-vibe-coding`, then the legacy compatibility mirror
-   `zingspark/create-harness-vibe-coding`.
-2. Preserve all PRESERVE files. Never overwrite user task, memory, research,
-   root README.md, package, or architecture files. Harness/README.md is
-   merge-tier, not PRESERVE.
-3. If `agent.safeApplyCommand` is present, run it to apply SAFE, NEW, and
-   adopted metadata-only files before spending AI time on conflicts. Default command:
-   `node Harness/scripts/wf-update-check.mjs --apply-safe`.
-   Framework-owned templates, commands, skills, agents, and scripts are
-   script-owned and should be overwritten by the updater after checksum validation.
-4. Previously accepted decisions for any merge-tier file (CLAUDE.md, AGENTS.md,
-   MEMORY.md, Harness/MEMORY.md, Harness/README.md) are carried forward
-   automatically when both the local hash and remote template hash are unchanged.
-5. If a new agent/command/skill path collides with an existing file, do not
-   decide by filename alone. Treat it as Harness-owned only when the file
-   content has Harness/WF markers such as `harness: wf-agent`, `project harness`,
-   or `Harness/...`; otherwise leave it as a real conflict.
-6. For every remaining `agent.aiMergeRequired` entry, compare the local file with
-   `templateHint` or `remoteUrl`, then choose merge, keep-local, or
-   overwrite-from-template. Record the decision through the script with
-   `--accept-local <file>`, `--accept-merged <file>`, or
-   `--accept-template <file>`; do not hand-edit `Harness/.harness-version`.
-   Ask the user only when the intent is ambiguous.
-7. Run `node Harness/scripts/wf-update-check.mjs --finalize` after all
-   conflicts have script-recorded decisions. Use strict `--apply` only when the
-   JSON plan has zero conflicts.
-8. After update, run the validator and then scan-clean.
+Scope resolution is deterministic:
+
+- Current project has `Harness/scripts/wf-update-check.mjs`: update the project install from that script.
+- A global runtime is discoverable from `Harness/.harness-version.globalDir`, `HARNESS_GLOBAL_HOME`, or the default `~/.harness/create-harness-vibe-coding`: update that runtime too, then sync its Claude/Codex/OpenCode host-global copies.
+- Current project has no Harness install: update only the global runtime and host-global copies. Do not scaffold or modify the project unless the user explicitly asks to install Harness there.
+`Harness/scripts/wf-update-runner.mjs` implements this multi-scope routing. Older installs that do not have the runner fall back to `Harness/scripts/wf-update-check.mjs`.
+
+1. Run `node Harness/scripts/wf-update-runner.mjs --json` first when present; otherwise run `node Harness/scripts/wf-update-check.mjs --json` and use the `agent` block as the action plan. Current updaters try npm `create-harness-vibe-coding@latest` first, then canonical GitHub `LiWeny16/create-harness-vibe-coding`, then legacy mirror `zingspark/create-harness-vibe-coding`.
+2. Preserve all PRESERVE files. Never overwrite user task, memory, research, root README.md, package, progress, or architecture files. Harness/README.md is merge-tier, not PRESERVE.
+3. If `agent.safeApplyCommand` is present, run the runner apply path to apply SAFE, NEW, moved, and adopted metadata-only files across every discovered scope before spending AI time on conflicts. Default multi-scope command: `node Harness/scripts/wf-update-runner.mjs --apply-safe --json`. Single-scope fallback command: `node Harness/scripts/wf-update-check.mjs --apply-safe`.
+4. Previously accepted decisions for merge-tier files are carried forward automatically when both the local hash and remote template hash are unchanged.
+5. If a new agent/command/skill path collides with an existing file, do not decide by filename alone. Treat it as Harness-owned only when the file content has Harness/WF markers such as `harness: wf-agent`, `project harness`, or `Harness/...`; otherwise leave it as a real conflict.
+6. For every remaining `agent.aiMergeRequired` entry, compare the local file with `templateHint` or `remoteUrl`, then choose merge, keep-local, or overwrite-from-template. Record the decision through the script with `--accept-local <file>`, `--accept-merged <file>`, or `--accept-template <file>`; do not hand-edit `Harness/.harness-version`.
+7. Run `node Harness/scripts/wf-update-runner.mjs --finalize --json` after all conflicts have script-recorded decisions. Single-scope fallback: `node Harness/scripts/wf-update-check.mjs --finalize`. Use strict `--apply` only when the JSON plan has zero conflicts.
+8. After apply/finalize, run all post-update checks:
+
+```bash
+node Harness/scripts/sync-host-global.mjs --json
+node Harness/scripts/sync-host-global.mjs --apply --json
+node Harness/scripts/validate-harness.mjs
+node Harness/scripts/validate-harness.mjs --manifest-audit
+node Harness/scripts/scan-clean.mjs --json
+```
+
+9. If the update reports "Already up to date" but framework files are missing or stale, run repair mode:
+
+```bash
+node Harness/scripts/wf-update-runner.mjs --repair --json
+node Harness/scripts/wf-update-runner.mjs --repair --apply-safe --json
+node Harness/scripts/wf-update-runner.mjs --repair --finalize --json
+node Harness/scripts/wf-update-check.mjs --repair --json
+node Harness/scripts/wf-update-check.mjs --repair --apply-safe
+node Harness/scripts/wf-update-check.mjs --repair --finalize
+node Harness/scripts/sync-host-global.mjs --apply --json
+node Harness/scripts/validate-harness.mjs --manifest-audit
+```
+
+`--repair` bypasses the version check and forces a full file diff against the latest remote template. This catches partial updates where the version advanced but files such as `/wf-task-list`, `/wf-help`, Codex `.agents` skill mirrors, OpenCode commands, `.codex` config, or Harness scripts were not written.
+`sync-host-global.mjs` is a no-op for project-only installs. For global installs it repairs missing or Harness-marked stale host-global copies by script and reports user-looking files as conflicts.
 
 ## Recovery
 
-If `Harness/scripts/wf-update-check.mjs` is missing (old install without updater), or `Harness/.harness-version` is missing or corrupted, do NOT reinstall from scratch. Recover by regenerating missing infrastructure:
+If `Harness/scripts/wf-update-check.mjs` is missing, or `Harness/.harness-version` is missing or corrupted, do not reinstall from scratch. Recover by regenerating missing infrastructure:
 
-```
+```bash
 npx create-harness-vibe-coding@latest <project-name> . -y --on-conflict skip
 ```
 
-The `--on-conflict skip` policy preserves all existing user files (CLAUDE.md, README.md, tasks, memory, research, architecture) and only creates missing Harness infrastructure files. After recovery, re-run the update check.
+The `--on-conflict skip` policy preserves all existing user files and only creates missing Harness infrastructure files. After recovery, run the update check and manifest audit.
 
-If an old updater reports only `0.8.10`, run the latest installer command above
-or re-run the checker with:
+If an old updater reports only `0.8.10`, run the latest installer command above or re-run the checker with:
 
-```
+```bash
 node Harness/scripts/wf-update-check.mjs --json --source-base https://raw.githubusercontent.com/LiWeny16/create-harness-vibe-coding/main/templates/common/
 ```
 
 ## Return
 
-Report version, SAFE/NEW updates, conflicts and decisions, preserved files,
-partialUpdate status if any, validation output, scan-clean result, and
-remaining risks.
+Report version, SAFE/NEW updates, conflicts and decisions, preserved files, partialUpdate status if any, validation output, manifest-audit output, scan-clean result, and remaining risks. Also report the core release highlights from `agent.releaseHighlights` or `releaseNotes.highlights`.