create-harness-vibe-coding 0.8.3 → 0.8.4

package/templates/common/.harness-version

@@ -1,12 +1,12 @@
 {
-  "generator": "0.8.3",
-  "generated": "2026-07-02T04:50:02.856Z",
+  "generator": "0.8.4",
+  "generated": "2026-07-02T09:50:07.142Z",
   "options": [],
   "autoCheck": true,
   "source": "https://raw.githubusercontent.com/zingspark/create-harness-vibe-coding/main/templates/common/",
   "checksums": {
     ".agents/skills/subagent-orchestrator/SKILL.md": "sha256-d17b1e49aa8e3125b17621242f620ac89c10692fac853bf0a682a87f660d86da",
-    ".agents/skills/tdd/SKILL.md": "sha256-2a86f45b3685670f5f214fdcc8d21ecc3d04f42af4f7cae2a38e994ab24bfb1e",
+    ".agents/skills/tdd/SKILL.md": "sha256-1e2ec0b54a5cf5b071800b0f2e5672a128a42471e16f70f00bb4c0a07a3617cb",
     ".agents/skills/wf-auto-spark/SKILL.md": "sha256-b07a3570e232cf47b179b9774daed4c00d7756ccce9e2339556d3544f92cf02b",
     ".agents/skills/wf-auto/SKILL.md": "sha256-ac3177dc7c5f40f99017b79dbb71722325f75c2e608f20aca780fd874c9755ee",
     ".agents/skills/wf-learn/SKILL.md": "sha256-7f3e1ee0aa83cbb76707698d0c26b703ad5c74b2df95a7dc4d751939a4ba05b2",
@@ -18,24 +18,25 @@
     ".agents/skills/wf/SKILL.md": "sha256-70766bd2cb02bc489b5cc021797af62596a005d444a026abb511054a1a820a67",
     ".claude/agents/architect-manager.md": "sha256-d98c3a2d044d5216d9bcde217b4359b1c33f5be152416e242807652ddcd2868b",
     ".claude/agents/architect.md": "sha256-61cea40c8c3e01bd53f3ad642ef734850fdb931497e7ee20552ea7a8b4e7b70c",
-    ".claude/agents/context-master.md": "sha256-e94c921565d979fef5651aeaad190b531b407075ce94c72dfa4412c1282e250a",
+    ".claude/agents/context-master.md": "sha256-32746ef283ab1b98574f302c5ed0429743aa77a0558fa78a4183cadf16a82469",
     ".claude/agents/debugger.md": "sha256-c0d322ca971c6be38c99f0e20b6d5feec26d4f62b84aeffecc4279c1cce59480",
     ".claude/agents/docs-researcher.md": "sha256-f8a34420ec10c185c4457d2e5e9ab584b676615ec471a9e671420d36e4e604f6",
     ".claude/agents/explore-manager.md": "sha256-64c7d1bdf8b490339b5a3487229fcb3e28d0d84983d9a4fa93060c2cf47b1dfc",
     ".claude/agents/implement-manager.md": "sha256-7387ee0e12ba189aa35fea453f93a1bd14549556754e002590b1af4de0ebb209",
     ".claude/agents/implementer.md": "sha256-86a32182798480b09bcc87e47605a1247f15d5ab91b58dfedb6496e3b0335618",
-    ".claude/agents/memory-master.md": "sha256-a8a2e3c8c53f54e63f11cc7543204d99f8be11fd974c8aefc66cdaa6957ef551",
+    ".claude/agents/memory-master.md": "sha256-443bd69895ce6ed8ab449876bbf91b2c536d7a21c6d72dcccbb227964355ac92",
     ".claude/agents/planner.md": "sha256-7d1911adbd3a4a6b82713fb0e2358bf01d3f7f3b8aeccd38bd51cb445b1fb7a9",
     ".claude/agents/researcher.md": "sha256-402fef14dee8f495dc9ddfad5af3ad233d254326b49b831f604014a8cb6d0beb",
     ".claude/agents/review-manager.md": "sha256-fb8fbd6c6624279cc97aa3dbd50ec20c150ff4a2d195788bc8537d98699cc41b",
     ".claude/agents/reviewer.md": "sha256-2913b7799fcd8e162f01ae0de09a41ec7083de5f0cae3abcd4ecc62acc675a6b",
-    ".claude/agents/tdd-guide.md": "sha256-c1663ffba6e48c7c19b0de1bb3eae674b3e85386fc959b15dd30d696aef6433c",
-    ".claude/agents/test-writer.md": "sha256-9018a9f65f1861a9bade999790e945d258781c1d846eb30a9de23ec3ce5f1d82",
+    ".claude/agents/tdd-guide.md": "sha256-d7c7ad3f61f6a6dc73cfa54ffe7e215ded0421a3058654a01731d1a5d5f4c336",
+    ".claude/agents/test-writer.md": "sha256-724866d627f193caaf060ec6af97b1d54c2df2d5c5f937e78fc3c53c7f798b16",
     ".claude/agents/verifier.md": "sha256-6d8ca8bd13d7bb7680423875269e407c06aca60334df44d9230a015aabd0a8d0",
-    ".claude/rules/ecc/common.md": "sha256-157c300e3b47049998d1bca867da6f9b54efb5de6efbabbb64a22af4cb2b84e8",
-    ".claude/settings.json": "sha256-4a2bdeb15d9911c8fa624e90ef977e857790981017ff10f44de36a343249ce25",
+    ".claude/commands/wf-help.md": "sha256-a11a0ecfb524ad51eff0237980ecdbc3e77ba260d5348a1a19c58232137769fa",
+    ".claude/rules/ecc/common.md": "sha256-52818d2a2e10bdafc059844f1e9e7d5f7bc2c9113c5ed0b890142c2e179e8b72",
+    ".claude/settings.json": "sha256-16a8631502d609ee9164e83537421d5f4c35de5cbc99b0be638f545daa785357",
     ".claude/skills/subagent-orchestrator/SKILL.md": "sha256-d17b1e49aa8e3125b17621242f620ac89c10692fac853bf0a682a87f660d86da",
-    ".claude/skills/tdd/SKILL.md": "sha256-2a86f45b3685670f5f214fdcc8d21ecc3d04f42af4f7cae2a38e994ab24bfb1e",
+    ".claude/skills/tdd/SKILL.md": "sha256-1e2ec0b54a5cf5b071800b0f2e5672a128a42471e16f70f00bb4c0a07a3617cb",
     ".claude/skills/wf-auto-spark/SKILL.md": "sha256-b07a3570e232cf47b179b9774daed4c00d7756ccce9e2339556d3544f92cf02b",
     ".claude/skills/wf-auto/SKILL.md": "sha256-ac3177dc7c5f40f99017b79dbb71722325f75c2e608f20aca780fd874c9755ee",
     ".claude/skills/wf-learn/SKILL.md": "sha256-7f3e1ee0aa83cbb76707698d0c26b703ad5c74b2df95a7dc4d751939a4ba05b2",
@@ -45,33 +46,41 @@
     ".claude/skills/wf-review/SKILL.md": "sha256-cc6d536ec6de25546a0ba96e686f195da50ed11bc03763a76ef46d77243d3537",
     ".claude/skills/wf-update/SKILL.md": "sha256-d57cd89e271b2af63b6a1264af552a30f8d44959cf4782b42f0ab082a90be9cf",
     ".claude/skills/wf/SKILL.md": "sha256-70766bd2cb02bc489b5cc021797af62596a005d444a026abb511054a1a820a67",
-    ".codex/config.toml": "sha256-d37497c3278121598a663564ab38b53f658969717f78decb661ddd11c66551ea",
-    ".codex/hooks.json": "sha256-ec2322e080b96b1c0cb86161476ff75a4ed00312b57eed979d7d4a379365d0b7",
-    "AGENTS.md": "sha256-c6e6f08195c41b49b682291c7b83f55acd9750767a7eef3811bf5bbdaa66f76a",
-    "CLAUDE.md": "sha256-b62a1bc5410280ed17f87ba591f571a0917f438589627fc50e9a53b9e9d0bb75",
-    "Harness/ECC-GUIDE.md": "sha256-48924c4c0e17dc47be53d616a6690415307688f971ec872d8860c5bbe64c90d7",
-    "Harness/MEMORY.md": "sha256-6e01795e787eb809f856cce8d90a15a118f8fac1ebbb71dd746a868f207a9457",
-    "Harness/README.md": "sha256-3f33274b01d100f20694efdf6c4633a01a79dcef9c9b8974ad5e8796ef928dc6",
-    "Harness/SETUP.md": "sha256-2a59db4e5053faf5f82ceb402491df016fee93bd59449202d4c9e1e7388df977",
-    "Harness/TDD-GUIDE.md": "sha256-a038f0aea67c72220684d6854536ad7b2d59ab52342374d4710f2c94828f88c4",
+    ".codex/config.toml": "sha256-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+    "AGENTS.md": "sha256-d5604c83b9d8f51a5e65d764e15523324259cc3cb26a85799907821eee9d0e93",
+    "CLAUDE.md": "sha256-b494721cf31c5afcb64bf4e1fc9f1172266d138b9f75557049665ba3442a9ad6",
+    "Harness/ACCEPTANCE_PROTOCOL.md": "sha256-2bd51e1c65eadaa1c8ef6c46ba8bb6ee3cadc4510b9e1277a1831dc3b9fea4ad",
+    "Harness/AGENT_ISOLATION.md": "sha256-54abcd4fdaf8810ab42da8a7f2ab5b5f5305f105f93e8764081b10edce053506",
+    "Harness/DEBUG_PROTOCOL.md": "sha256-ed80de0e3e1a40dbb9fd0bdead9174f1650e1833027f3d7fb4bb5884142e03f7",
+    "Harness/ECC-GUIDE.md": "sha256-136e60327813609516c6c10e2a5254d7d300e1631ba80d33fb375fdf3800ca7e",
+    "Harness/HARNESS_BRIDGE.md": "sha256-681dbeca9a590bbeb3a0c01b044e40e642e6d640632d8611064eb897ada8a48d",
+    "Harness/MEMORY.md": "sha256-038217c5407a526dca3bd186ec4880f266fa6a8a31d52ebcd27d55aa11f32bb0",
+    "Harness/MEMORY_PROTOCOL.md": "sha256-c24c232442a50f1dc7183480fc3b51c6171e32d3ba6648c056797ccd69fea717",
+    "Harness/README.md": "sha256-f646e1b02cd3344e4b379aa150af914758376fc576f6ed6e648d00b87a837405",
+    "Harness/SETUP.md": "sha256-33e05d9bc99449b7942db3a8c70160dab1c3ecfec0510afccd459790088118e8",
+    "Harness/TDD-GUIDE.md": "sha256-602084530fd0dea7499a023ce75738351e5d97a0c222b64d405f36da6b59a162",
     "Harness/WF-AUTO-SPARK.md": "sha256-48cc08e1a78cd4abb2ae9c2807ef1ac9a09544eb954220b9087b2032fabbd690",
-    "Harness/WF-AUTO.md": "sha256-ac0ab13e11ca658cd2c5b6ce73f3d267bea6391a04e850c9f9a24d642f1ad350",
-    "Harness/WF-MAX.md": "sha256-98a4a918eb8e97c40422c7e133a0bc33184faf7771ca9645f4161d82a5cac8cb",
-    "Harness/WF.md": "sha256-7cce2568444295cb387fa958cd4ef9711a19697b60ce9cba0e142484e0a165ae",
-    "Harness/agent-workflow.md": "sha256-1aff5e7dc1e082c559cb0a9086c4f93f6702905aff00ebb957300f463ea80b31",
-    "Harness/context-loading.md": "sha256-a2e71435e127c2ff5b70ebfddb1a8bbaa64dfd584505fbd6e14dc059e18cc6a1",
-    "Harness/dispatch.md": "sha256-e823b905bbdcae396d759f281bbd413693904c80b6c18f7993718e63a961b2a6",
-    "Harness/extension.md": "sha256-686f76d83e91750c20d4f5aa8e614f5003baeb5a703d0451f469ca7eeab75e37",
-    "Harness/lifecycle.md": "sha256-5979c37e66e35940cb707f8cd71e97d53bb05399c3281c714f69499abdee59a4",
+    "Harness/WF-AUTO.md": "sha256-d31b545249588a69c73e5e0ad8b1286ece1a53d9cd0e93b8ba0ae6dac6fdd119",
+    "Harness/WF-MAX.md": "sha256-aab1f168c00a5fb54b0eb75843218f722374d02b98e8fb14658f9f8d41cda348",
+    "Harness/WF.md": "sha256-b24d969e867927a004c92923ed4cbbcfb173a17ccd095166077e6cb5232c644d",
+    "Harness/agent-workflow.md": "sha256-fb602865cef26c63d60cecc390f02b34831924059ef9fa5e31c7920a9fac33b6",
+    "Harness/context-loading.md": "sha256-eff7f332045e02636ab1466eb9a663b7bb183eb23f90f02d18e020d6e0ed58d5",
+    "Harness/dispatch.md": "sha256-a9293dcc3c44cc16b5cfc717e460db98a5bc0bcfd3805c0f614de0e6e7c33c4f",
+    "Harness/extension.md": "sha256-ff93616aaa5ad232b6a32ac6c98bb1a3a08ee5da2ddad92eb9090f5b8e9e3e47",
+    "Harness/lifecycle.md": "sha256-a2d025e52f3b4412d8439083aca0d2cf7a4458ad0e30de4fc6465f990379190f",
     "Harness/research/README.md": "sha256-956c154df01cb9376972eb8b88bb3be0fe4e2dda802a72457c0126e3476fa755",
     "Harness/scripts/scan-clean.mjs": "sha256-7f693faf762c9c8e7657143d651f7c8369ed4823f18babe21daec58a55025593",
-    "Harness/scripts/validate-harness.mjs": "sha256-fd904202f99cd30ad7ce69f5343c4adca94ab30b7a5f8eab37004d748e0779ab",
-    "Harness/scripts/wf-mode-hook.mjs": "sha256-be0669a539cd1f67706b1105fd474a4377bd133def9556a1b9e855288c49ccb7",
-    "Harness/scripts/wf-remove.mjs": "sha256-ae941d34d7d263f2b65751d177673a3c4fb11c326885ca413245e3f93e99a006",
-    "Harness/scripts/wf-statusline.ps1": "sha256-49effdea8b0980e762a9440f4be9011543ede3533f6df1b2008368d78c427fcc",
-    "Harness/scripts/wf-statusline.sh": "sha256-6fa034fab9abe9361daae14cdb802f69825ce20d4bf6a9c18f58c04e971693ac",
+    "Harness/scripts/validate-harness.mjs": "sha256-e584959476265d53408484ec3653dd652a0f64922c785db97f0638c26f19e04c",
+    "Harness/scripts/wf-remove.mjs": "sha256-4eb136ab26a9e20a949835e8cc6ff716b4beb3496c81ae3a4c03c049db60895c",
     "Harness/scripts/wf-update-check.mjs": "sha256-d14ce08f4c05ba118362a56a4b7d5965b114bc2b15a023c08e21d57f32b2cf93",
-    "Harness/subagents.md": "sha256-31818b96f4e834087d8ce8887758f303114b3fd67fb9819fd661f78170fb39d3"
+    "Harness/subagents.md": "sha256-16255092bab9011bb67359b4399d27ab292c14a717e67123e8a76e40e8669661",
+    "Harness/templates/ACCEPTANCE.template.md": "sha256-394a6c08b155b1d121f1d51da774f7988bdb891224c6d5f2ca2c131e8c95ffb3",
+    "Harness/templates/API_CONTRACT.template.md": "sha256-e11ec9866576624982f35e77359e3f4ef3aea3e3f6b5895f6cc5419d29699fc5",
+    "Harness/templates/PLAYWRIGHT_SPEC.template.ts": "sha256-bef5f3bbae833b31eeb8cab04fc5a5ff355e9eda4ba6909db70f83b403607115",
+    "Harness/templates/PRD.template.md": "sha256-033c746daec3eacbf69b0ca91a6f09997a9852d30467681260f3dbdde391d841",
+    "Harness/templates/TEST_PLAN.template.md": "sha256-f7e9a701b0922a405bcde7c168791fe6406530ce7e644a3a736cc3fa1e74c928",
+    "Harness/templates/UI_CONTRACT.template.md": "sha256-87c9bc47452c53caca9333130aef567cf9b16ffc5e82a8f6592bbd4f715875ef",
+    "Harness/templates/VALIDATION_REPORT.template.md": "sha256-feb1f7b9bba18f1ce028954b48775730f7dd8b7c2afd0ef44cda54bfe13c1875"
   },
   "sources": {
     ".agents/skills/subagent-orchestrator/SKILL.md": ".claude/skills/subagent-orchestrator/SKILL.md",
@@ -101,6 +110,7 @@
     ".claude/agents/tdd-guide.md": ".claude/agents/tdd-guide.md",
     ".claude/agents/test-writer.md": ".claude/agents/test-writer.md",
     ".claude/agents/verifier.md": ".claude/agents/verifier.md",
+    ".claude/commands/wf-help.md": ".claude/commands/wf-help.md",
     ".claude/rules/ecc/common.md": ".claude/rules/ecc/common.md",
     ".claude/settings.json": ".claude/settings.json",
     ".claude/skills/subagent-orchestrator/SKILL.md": ".claude/skills/subagent-orchestrator/SKILL.md",
@@ -115,13 +125,17 @@
     ".claude/skills/wf-update/SKILL.md": ".claude/skills/wf-update/SKILL.md",
     ".claude/skills/wf/SKILL.md": ".claude/skills/wf/SKILL.md",
     ".codex/config.toml": ".codex/config.toml",
-    ".codex/hooks.json": ".codex/hooks.json",
     ".gitignore": ".gitignore",
     "AGENTS.md": "AGENTS.md",
     "CLAUDE.md": "CLAUDE.md",
     "Harness/.harness-version": ".harness-version",
+    "Harness/ACCEPTANCE_PROTOCOL.md": "Harness/ACCEPTANCE_PROTOCOL.md",
+    "Harness/AGENT_ISOLATION.md": "Harness/AGENT_ISOLATION.md",
+    "Harness/DEBUG_PROTOCOL.md": "Harness/DEBUG_PROTOCOL.md",
     "Harness/ECC-GUIDE.md": "Harness/ECC-GUIDE.md",
+    "Harness/HARNESS_BRIDGE.md": "Harness/HARNESS_BRIDGE.md",
     "Harness/MEMORY.md": "MEMORY.md",
+    "Harness/MEMORY_PROTOCOL.md": "Harness/MEMORY_PROTOCOL.md",
     "Harness/PROGRESS.md": "Harness/PROGRESS.md",
     "Harness/README.md": "Harness/README.md",
     "Harness/SETUP.md": "SETUP.md",
@@ -144,10 +158,7 @@
     "Harness/research/research-results.md": "Harness/research/research-results.md",
     "Harness/scripts/scan-clean.mjs": "scripts/scan-clean.mjs",
     "Harness/scripts/validate-harness.mjs": "scripts/validate-harness.mjs",
-    "Harness/scripts/wf-mode-hook.mjs": "scripts/wf-mode-hook.mjs",
     "Harness/scripts/wf-remove.mjs": "scripts/wf-remove.mjs",
-    "Harness/scripts/wf-statusline.ps1": "scripts/wf-statusline.ps1",
-    "Harness/scripts/wf-statusline.sh": "scripts/wf-statusline.sh",
     "Harness/scripts/wf-update-check.mjs": "scripts/wf-update-check.mjs",
     "Harness/subagents.md": "Harness/subagents.md",
     "Harness/tasks/_template/ARTIFACTS.md": "Harness/tasks/_template/ARTIFACTS.md",
@@ -155,6 +166,13 @@
     "Harness/tasks/_template/NOTES.md": "Harness/tasks/_template/NOTES.md",
     "Harness/tasks/_template/PLAN.md": "Harness/tasks/_template/PLAN.md",
     "Harness/tasks/_template/PROGRESS.md": "Harness/tasks/_template/PROGRESS.md",
+    "Harness/templates/ACCEPTANCE.template.md": "Harness/templates/ACCEPTANCE.template.md",
+    "Harness/templates/API_CONTRACT.template.md": "Harness/templates/API_CONTRACT.template.md",
+    "Harness/templates/PLAYWRIGHT_SPEC.template.ts": "Harness/templates/PLAYWRIGHT_SPEC.template.ts",
+    "Harness/templates/PRD.template.md": "Harness/templates/PRD.template.md",
+    "Harness/templates/TEST_PLAN.template.md": "Harness/templates/TEST_PLAN.template.md",
+    "Harness/templates/UI_CONTRACT.template.md": "Harness/templates/UI_CONTRACT.template.md",
+    "Harness/templates/VALIDATION_REPORT.template.md": "Harness/templates/VALIDATION_REPORT.template.md",
     "README.md": "README.md"
   }
 }

package/templates/common/AGENTS.md

@@ -22,9 +22,10 @@ Do not bulk-read `Harness/`. Let `Harness/README.md#Load By Task` route you.
 
 ## Key Commands
 
-| Command | Purpose |
-|---------|---------|
-| `/wf-max [task]` | Maximum parallelism: CEO→Manager→Worker hierarchy (three-layer architecture: mode / agent role / dispatch permission) |
-| `/wf-review [focus]` | Cross-model peer review (use OTHER CLI) |
-| `/wf <task>` | Standard workflow mode |
-| `/wf-auto` | Perpetual auto-optimization |
+| Command | Purpose |
+|---------|---------|
+| `/wf-help` | Direct help table for all Harness WF commands |
+| `/wf-max [task]` | Maximum parallelism: CEO→Manager→Worker hierarchy (three-layer architecture: mode / agent role / dispatch permission) |
+| `/wf-review [focus]` | Cross-model peer review (use OTHER CLI) |
+| `/wf <task>` | Standard workflow mode |
+| `/wf-auto` | Perpetual auto-optimization |

package/templates/common/CLAUDE.md

@@ -10,7 +10,7 @@ This repository dogfoods the generated Harness scaffold. Scaffold source files l
 
 ### 1a. WF-MAX Role Contract (ACTIVE ONLY when /wf-max invoked)
 
-`/wf-max` active → top-level orchestrator is **CEO**. Delegated Workers follow dispatch packet, edit only assigned writeSet. **Global mode ≠ every agent is CEO.** (Enforced by hooks + `.runtime/current-mode.json`.)
+`/wf-max` active -> top-level orchestrator is **CEO**. Delegated Workers follow dispatch packet, edit only assigned writeSet. **Global mode != every agent is CEO.** There is no runtime hook enforcement; role/writeSet compliance is enforced by dispatch packets, review, validation, and durable task evidence.
 
 | ALLOWED (W0 CEO) | FORBIDDEN (always on source) |
 |---|---|
@@ -84,6 +84,5 @@ This repository dogfoods the generated Harness scaffold. Scaffold source files l
 
 - Never call `EnterPlanMode` — delegate planning to `planner` subagents (see `Harness/WF.md`).
 - Never write code directly in `/wf` or `/wf-max` CEO mode — delegate all implementation to Workers via dispatch packets with explicit writeSet.
-- **WF-MAX three-layer architecture**: global mode (`wf-max`) ≠ agent role (`ceo|manager|worker|reviewer`). Workers follow dispatch packet (writeSet, forbidden, verification). Missing role/writeSet → source edits denied by default.
-- **Enforcement**: `.claude/settings.json` denies `EnterPlanMode` via the `deny` list. Role contract is in [Section 1a](#1a-wf-max-role-contract-read-before-any-tool-use) — read it first.
-- WF-MAX hooks in `.claude/settings.json` enforce per-agentRole + writeSet. `Harness/.runtime/current-mode.json` persists mode state; stale modes (>30 min) auto-clear.
+- **WF-MAX three-layer architecture**: global mode (`wf-max`) != agent role (`ceo|manager|worker|reviewer`). Workers follow dispatch packet (writeSet, forbidden, verification). Missing role/writeSet means the controller must not proceed with source edits.
+- **Enforcement**: `.claude/settings.json` denies `EnterPlanMode` via the `deny` list. WF-MAX role/writeSet compliance is not hook-enforced; it is maintained through dispatch packets, independent review, validation evidence, and the task capsule. Role contract is in [Section 1a](#1a-wf-max-role-contract-active-only-when-wf-max-invoked) - read it first.

package/templates/common/Harness/ACCEPTANCE_PROTOCOL.md

@@ -0,0 +1,170 @@
+# Acceptance Protocol
+
+Purpose: make the Harness workflow acceptance-driven instead of implementation-driven.
+
+The source of truth is not the implementation, not the tests, and not the agent's summary. The source of truth is the PRD-derived Acceptance Criteria. Implementation, tests, reviews, validation, debugging, and memory must all trace back to Acceptance Criteria IDs.
+
+## Mother Flow
+
+All Harness modes use the same product-to-proof flow:
+
+```text
+Context Load
+-> Mini PRD
+-> Acceptance Criteria
+-> UI/API Contracts
+-> Test Plan
+-> Implementation Dispatch
+-> Independent Validation
+-> Review
+-> Debug
+-> Memory
+```
+
+Mode differences are organizational only:
+
+| Mode | Organization | Same Acceptance Flow |
+| --- | --- | --- |
+| `/wf` / `$wf` | Small team, mostly serial | yes |
+| `/wf-max` / `$wf-max` | CEO -> Manager -> Worker hierarchy | yes |
+| `/wf-auto` / `$wf-auto` | Repeating optimization loop | yes, per cycle |
+
+## Gates
+
+These gates apply before implementation unless the user explicitly asks for a small fast lane. A fast lane may compress artifacts into one task PLAN, but it must not skip the substance.
+
+| Gate | Rule | Required Durable Artifact |
+| --- | --- | --- |
+| PRD-GATE | No PRD, no implementation. | `Harness/research/PRD.md` or task PLAN Mini PRD |
+| AC-GATE | No acceptance criteria, no tests, no code. | `ACCEPTANCE.md` section or task PLAN AC table |
+| CONTRACT-GATE | No UI/API contract, no UI/API integration. | `UI_CONTRACT.md`, `API_CONTRACT.md`, or task PLAN contract tables |
+| TEST-GATE | Tests must trace to AC IDs before implementation. | `TEST_PLAN.md` section or task PLAN verification matrix |
+| IMPLEMENT-GATE | Implementer may not modify acceptance truth files except through Change Request. | dispatch write set and forbidden set |
+| VALIDATION-GATE | Validator must be independent and must validate AC IDs against running behavior. | validation report with evidence matrix |
+| REVIEW-GATE | Reviewer reads PRD, AC, diff, and run evidence directly. | findings with AC IDs |
+
+Truth files are:
+
+- PRD or Mini PRD
+- Acceptance Criteria
+- UI Contract
+- API Contract
+- Test Plan
+- Validation Report
+
+## Mini PRD Minimum
+
+Every task that changes behavior needs a Mini PRD. It can live in `Harness/research/PRD.md`, a feature doc, or `Harness/tasks/<task-id>/PLAN.md`.
+
+Minimum fields:
+
+- Goal
+- Scope
+- Non-scope
+- User flow
+- UI elements, if any
+- API behavior, if any
+- State changes
+- Acceptance criteria
+- Verification commands
+
+## Acceptance Criteria Format
+
+Each AC must be independently testable and use a stable ID:
+
+```markdown
+## AC-001: Empty phone number cannot request verification code
+Given the user opens the login page
+When the user clicks "Get code" without entering a phone number
+Then the page shows "Please enter phone number"
+And no `/api/auth/send-code` request is sent
+
+Verification:
+- UI: Playwright clicks `[data-testid=get-code-button]`
+- DOM: expect `[data-testid=phone-error]` visible
+- Network: CDP trace has no `/api/auth/send-code` request
+```
+
+Required fields:
+
+| Field | Description |
+| --- | --- |
+| AC ID | Stable unique ID, e.g. `AC-001` |
+| Scenario | Given / When / Then user behavior |
+| UI elements | Required `data-testid` values or accessible roles |
+| API behavior | Method, URL, payload, response, and whether a request must or must not happen |
+| State change | URL, DOM, store, localStorage, database, or side effect |
+| Verification method | Unit, integration, API, Playwright, CDP, visual, or manual |
+| Evidence | Screenshot, trace, video, log, or command output path |
+
+## Role Ownership
+
+| Role | Owns | Must Not Do |
+| --- | --- | --- |
+| Planner | Mini PRD, scope, non-scope, risks | write implementation |
+| Acceptance Agent | AC IDs from PRD and user scenarios | read implementation code to reverse-engineer tests |
+| Contract Agent | UI/API/state contracts | loosen contracts to match existing code |
+| Test Writer | executable tests from AC/contracts | write tests from implementation behavior |
+| Implementer | code/docs inside dispatch write set | modify truth files to make code pass |
+| Reviewer | diff review against PRD/AC/contracts/evidence | rely only on implementer summary |
+| Validator | running app/API evidence matrix | validate own implementation |
+| Debugger | root cause and smallest fix for reproduced failures | blind-edit without locating the failing layer |
+| Memory Master | durable lessons keyed to AC/failure patterns | store secrets or noisy transcript summaries |
+
+See `AGENT_ISOLATION.md` for context and permission isolation.
+
+## Test Strategy
+
+Tests must be chosen by risk and user-visible behavior:
+
+Syntax-only checks, import tests, shallow renders, typecheck, lint, and build success are never sufficient acceptance evidence for browser-visible behavior. A browser-visible AC requires a real user path through Playwright/CDP, Browser Use, or documented manual browser validation.
+
+| Behavior | Default Verification |
+| --- | --- |
+| Pure logic | unit test with AC ID in test name/comment |
+| API behavior | API/integration test against contract |
+| UI interaction | Playwright real-browser test |
+| Frontend-backend side effect | Playwright plus CDP/network trace |
+| Visual layout risk | screenshot or visual regression evidence |
+| Third-party dependency | seeded/mocked test data plus fallback-path check |
+
+Frontend default verification, when available:
+
+```bash
+npm run test
+npm run typecheck
+npm run lint
+npx playwright test
+```
+
+For complex frontend-backend flows:
+
+```bash
+npx playwright test --trace on
+```
+
+## Acceptance Result Matrix
+
+Validation must end with a matrix, not a generic "all tests passed" claim:
+
+```markdown
+# Acceptance Result
+
+| AC ID | Result | Evidence | Notes |
+| --- | --- | --- | --- |
+| AC-001 | PASS | `test-results/login-empty-phone/trace.zip` | no API request observed |
+| AC-002 | FAIL | `test-results/login-bad-phone/screenshot.png` | error message missing |
+```
+
+Result values: `PASS`, `FAIL`, `BLOCKED`, `NOT RUN`, `N/A`.
+
+## Change Request
+
+If implementation shows an AC or contract is wrong:
+
+1. Stop implementation.
+2. Record the mismatch in task `PROGRESS.md`.
+3. Update PRD/AC/contract through Planner or Acceptance role.
+4. Re-run TEST-GATE before implementation resumes.
+
+The implementer may propose a Change Request, but may not directly rewrite truth files inside the implementation write set.

package/templates/common/Harness/AGENT_ISOLATION.md

@@ -0,0 +1,73 @@
+# Agent Isolation
+
+Purpose: prevent self-review, test backfilling, and context leakage in acceptance-driven work.
+
+## Hard Rules
+
+- The agent that implements code must not be the agent that accepts the code.
+- The agent that writes tests must not derive tests from the implementation.
+- The reviewer must read PRD, acceptance criteria, contracts, diff, and run evidence directly.
+- The validator validates against PRD-derived AC IDs and running behavior, not the implementer's summary.
+- The debugger must locate a root cause from failure evidence before editing.
+
+## Context Isolation Matrix
+
+| Role | May Read | Must Not Read / Trust |
+| --- | --- | --- |
+| Planner | user request, project background, memory, research | implementation files as a reason to skip PRD |
+| Acceptance Agent | PRD, user scenarios, UI requirements, business rules | implementation code for reverse-engineering AC |
+| Contract Agent | PRD, AC, API/schema docs, UI requirements | implementation shortcuts as contract truth |
+| Test Writer | AC, UI contract, API contract, test utilities | production implementation as the source of expected behavior |
+| Implementer | PRD, AC, contracts, tests, relevant code | permission to change AC/contracts without Change Request |
+| Reviewer | PRD, AC, contracts, diff, test result, trace, screenshot | implementer summary as sole evidence |
+| E2E Validator | PRD, AC checklist, contracts, running app URL, test command | implementation plan or private rationale |
+| Debugger | failing logs, traces, screenshots, diff, narrow relevant files | broad source areas without a failure hypothesis |
+| Memory Master | final result, repeated failure patterns, verified lessons | secrets, credentials, raw noisy transcript |
+
+## Permission Isolation
+
+Dispatch packets must declare `Read set`, `Write set`, and `Forbidden`.
+
+| Role Type | Default Write Permission |
+| --- | --- |
+| Planner / Acceptance / Contract | truth docs only, when explicitly assigned |
+| Test Writer | tests and test fixtures only |
+| Implementer | assigned implementation files only |
+| Reviewer / Validator | none |
+| Debugger | smallest assigned fix set after reproduced failure |
+| Memory Master | memory files only |
+
+Implementer forbidden set must include truth files unless a Change Request has been approved:
+
+- PRD
+- Acceptance Criteria
+- UI Contract
+- API Contract
+- Test Plan
+- Validation Report
+
+## Reviewer Evidence Rule
+
+Reviewer must inspect:
+
+- PRD or Mini PRD
+- Acceptance Criteria IDs
+- UI/API contracts relevant to the diff
+- actual diff
+- test/validation command output
+- browser/API evidence when user-visible behavior is affected
+
+Reviewer output must classify findings by severity and cite AC IDs when applicable.
+
+## Validator Evidence Rule
+
+Validator receives only:
+
+- PRD or Mini PRD
+- Acceptance Criteria
+- UI/API contracts
+- running app URL or API endpoint
+- verification commands
+- expected evidence locations
+
+Validator does not need implementation intent. If validation fails, the handoff goes to Debugger with evidence, not to Implementer for blind edits.

package/templates/common/Harness/DEBUG_PROTOCOL.md

@@ -0,0 +1,64 @@
+# Debug Protocol
+
+Purpose: make debug work evidence-led and AC-traceable.
+
+Debugging starts only after a reproduced failure or a concrete validation gap exists.
+
+## Inputs
+
+Debugger receives:
+
+- failed AC ID
+- failing command
+- console output or stack trace
+- screenshot, video, trace, or network capture when available
+- relevant diff
+- smallest relevant files or contracts
+
+Debugger does not start from "try a fix." Debugger starts from "which layer failed?"
+
+## Layer Classification
+
+Classify the failure before editing:
+
+| Layer | Evidence |
+| --- | --- |
+| UI | DOM missing, selector absent, wrong text, visual state wrong |
+| API | request absent, wrong method/URL/payload, bad response handling |
+| State | route/store/localStorage/session mismatch |
+| Data | seed missing, fixture wrong, database not reset |
+| Environment | server not running, port conflict, dependency missing |
+| Test | selector wrong, race/flake, assertion not tied to AC |
+| Contract | PRD/AC/API/UI contract conflict |
+
+## Debug Loop
+
+1. Reproduce or confirm the existing reproduction evidence.
+2. Identify the failing layer and root cause hypothesis.
+3. Edit only the smallest write set needed for that root cause.
+4. Re-run the failed check.
+5. Re-run adjacent checks that could regress.
+6. Update the acceptance result matrix.
+
+If the same class of failure repeats three times, stop blind fixes and run architecture review.
+
+## Debug Handoff
+
+```markdown
+## Debug Handoff
+
+- Failed AC: AC-002
+- Failing command: `npx playwright test login.spec.ts --trace on`
+- Layer: API
+- Root cause: request payload sends `phoneNumber`; contract requires `phone`
+- Fix set: `src/features/login/api.ts`
+- Verification: command passed, trace path recorded
+- Residual risk: none
+```
+
+## Forbidden
+
+- Do not weaken or delete ACs to make tests pass.
+- Do not rewrite tests from implementation behavior.
+- Do not broadly refactor while fixing one reproduced failure.
+- Do not claim browser/API success without browser/API evidence.

package/templates/common/Harness/ECC-GUIDE.md

@@ -43,9 +43,9 @@ Based on answer, install matching rules.
 
 | Rule Set | What It Covers | Files |
 |----------|---------------|-------|
-| `common/` | **Required for all projects.** Immutability, error handling, file organization, git workflow, testing, security, agents, hooks, patterns. | `coding-style.md`, `git-workflow.md`, `testing.md`, `security.md`, `patterns.md`, `agents.md`, `hooks.md`, `performance.md`, `development-workflow.md` |
-| `typescript/` | TS/JS types, interfaces, immutability patterns, error handling with try-catch, Zod validation, React props, custom hooks, repository pattern. | `coding-style.md`, `testing.md`, `security.md`, `patterns.md`, `hooks.md` |
-| `web/` | Frontend: CSS custom properties, animation-only properties, semantic HTML, component composition, state management, image optimization, CSP, XSS, Core Web Vitals, bundle budgets. | `coding-style.md`, `design-quality.md`, `testing.md`, `security.md`, `patterns.md`, `performance.md`, `hooks.md` |
+| `common/` | **Required for all projects.** Immutability, error handling, file organization, git workflow, testing, security, agents, patterns, performance, development workflow. | `coding-style.md`, `git-workflow.md`, `testing.md`, `security.md`, `patterns.md`, `agents.md`, `performance.md`, `development-workflow.md` |
+| `typescript/` | TS/JS types, interfaces, immutability patterns, error handling with try-catch, Zod validation, React props, reusable React hooks, repository pattern. | `coding-style.md`, `testing.md`, `security.md`, `patterns.md` |
+| `web/` | Frontend: CSS custom properties, animation-only properties, semantic HTML, component composition, state management, image optimization, CSP, XSS, Core Web Vitals, bundle budgets. | `coding-style.md`, `design-quality.md`, `testing.md`, `security.md`, `patterns.md`, `performance.md` |
 | `python/` | PEP 8, type hints, immutability, async patterns, pytest, input validation. | `coding-style.md`, `testing.md`, `security.md`, `patterns.md` |
 | `golang/` | Idiomatic Go, error handling, concurrency patterns, table-driven tests, security. | `coding-style.md`, `testing.md`, `security.md`, `patterns.md` |
 | `rust/` | Ownership, lifetimes, error handling, unsafe usage, cargo-llvm-cov. | `coding-style.md`, `testing.md`, `security.md`, `patterns.md` |
@@ -96,7 +96,7 @@ These are NOT in Harness by default — the agent should consult them when filli
 | `web/performance.md` | Core Web Vitals targets, bundle budgets, loading strategy, image optimization, font loading, animation performance | Before production build |
 | `web/security.md` | CSP (nonce-based), XSS prevention, third-party script SRI, HTTPS headers, CSRF protection | Before any user-facing deploy |
 | `web/testing.md` | Visual regression (320/768/1024/1440), a11y, Lighthouse, cross-browser, responsive | Before launch |
-| `web/hooks.md` | PostToolUse format/lint/type-check, PreToolUse file size guard, Stop build verification | CI setup |
+| `web/testing.md` | format/lint/type-check, file size guard, build verification | CI setup |
 | `typescript/patterns.md` | API response envelope, custom hooks, Repository pattern | Backend-frontend contract |
 
 ### Backend Design (python/ + golang/ + rust/)