create-harness-vibe-coding 0.8.6 → 0.8.8

package/templates/common/MEMORY.md

@@ -5,37 +5,38 @@
 
 ## Agents (Sub-agents)
 
-- [researcher](../.claude/agents/researcher.md) — product, market, open-source, dependency, pricing, policy, and ecosystem research.
-- [docs-researcher](../.claude/agents/docs-researcher.md) — official docs, API, SDK, config, limits, errors, and examples verification.
-- [planner](../.claude/agents/planner.md) — task split, dependencies, write sets, and dispatch table.
-- [architect](../.claude/agents/architect.md) — boundaries, ports, data-flow, and state impact.
-- [test-writer](../.claude/agents/test-writer.md) — failing tests or manual verification before implementation.
+- [researcher](../.claude/agents/researcher.md) - product, market, open-source, dependency, pricing, policy, and ecosystem research.
+- [docs-researcher](../.claude/agents/docs-researcher.md) - official docs, API, SDK, config, limits, errors, and examples verification.
+- [planner](../.claude/agents/planner.md) - task split, dependencies, write sets, and dispatch table.
+- [architect](../.claude/agents/architect.md) - boundaries, ports, data-flow, and state impact.
+- [test-writer](../.claude/agents/test-writer.md) - failing tests or manual verification before implementation.
 - [tdd-guide](../.claude/agents/tdd-guide.md) - AC-linked RED tests, browser UI acceptance, and Playwright/CDP evidence before implementation.
-- [implementer](../.claude/agents/implementer.md) — bounded implementation inside declared write set.
-- [debugger](../.claude/agents/debugger.md) — smallest fix for a reproduced failure.
-- [reviewer](../.claude/agents/reviewer.md) — read-only diff review and closeout risk.
-- [verifier](../.claude/agents/verifier.md) — verification commands and evidence.
-- [memory-master](../.claude/agents/memory-master.md) — memory writing, dedup, consolidation, and cross-project knowledge extraction.
-- [context-master](../.claude/agents/context-master.md) — context analysis, compression alerts, and session knowledge extraction for memory-master.
-- [explore-manager](../.claude/agents/explore-manager.md) — WF-MAX W0 exploration: spawn 5-10 read-only researchers, synthesize, report to CEO.
-- [architect-manager](../.claude/agents/architect-manager.md) — WF-MAX W1 architecture: spawn 3 architects, synthesize interface contracts, report to CEO.
-- [implement-manager](../.claude/agents/implement-manager.md) — WF-MAX W2 implementation: spawn 5-7 implementers (one file_claim each), merge, report to CEO.
-- [review-manager](../.claude/agents/review-manager.md) — WF-MAX W2R review: spawn 3-4 reviewers (spec/code/security/perf), deduplicate, classify severity, report to CEO.
+- [implementer](../.claude/agents/implementer.md) - bounded implementation inside declared write set.
+- [debugger](../.claude/agents/debugger.md) - smallest fix for a reproduced failure.
+- [reviewer](../.claude/agents/reviewer.md) - read-only spec/AC and code/architecture/test review.
+- [verifier](../.claude/agents/verifier.md) - verification commands and AC evidence matrix.
+- [reflector](../.claude/agents/reflector.md) - closeout synthesis, contradiction check, and final acceptance gate verdict.
+- [memory-master](../.claude/agents/memory-master.md) - memory writing, dedup, consolidation, and cross-project knowledge extraction.
+- [context-master](../.claude/agents/context-master.md) - context analysis, compression alerts, and session knowledge extraction for memory-master.
+- [explore-manager](../.claude/agents/explore-manager.md) - WF-MAX W0 exploration: spawn 5-10 read-only researchers, synthesize, report to CEO.
+- [architect-manager](../.claude/agents/architect-manager.md) - WF-MAX W1 architecture: spawn 3 architects, synthesize interface contracts, report to CEO.
+- [implement-manager](../.claude/agents/implement-manager.md) - WF-MAX W2 implementation: spawn 5-7 implementers (one file_claim each), merge, report to CEO.
+- [review-manager](../.claude/agents/review-manager.md) - WF-MAX W2R review: spawn 3-4 reviewers (spec/code/security/perf), deduplicate, classify severity, report to CEO.
 
 Stack-specific agents can be added after the product shape is known.
 
 ## Skills (Workflows)
 
-- [WF Mode](WF.md) — long-task workflow: exploration, second plan, implementation, review, verification, heartbeat, and recovery loop.
-- [wf](../.claude/skills/wf/SKILL.md) — Claude Code WF skill command; mirrored for Codex at `../.agents/skills/wf/SKILL.md`.
-- [subagent-orchestrator](../.claude/skills/subagent-orchestrator/SKILL.md) — controller-led subagent orchestration, parallel read-only passes, review gates, and recovery handoffs.
-- [wf-readme](../.claude/skills/wf-readme/SKILL.md) — README preservation, append-only development sections, structured tables, and approved architecture diagrams.
-- [wf-review](../.claude/skills/wf-review/SKILL.md) — cross-model peer review: invoke the other agent CLI (Codex/Claude) for independent review.
-- [wf-update](../.claude/skills/wf-update/SKILL.md) — GitHub-based incremental harness update, checksum comparison, and safe in-place updates.
-- [wf-learn](../.claude/skills/wf-learn/SKILL.md) — force memory learning cycle: context-master -> memory-master -> project + global memory.
-- [wf-max](../.claude/skills/wf-max/SKILL.md) — maximum-parallelism workflow: write-set coloring, wave dispatch, parallel review per dimension.
-- [wf-auto](../.claude/skills/wf-auto/SKILL.md) - perpetual auto-optimization: bounded ticks, 8-angle internal scan, intent checkpoints, evidence ledger.
-- [wf-auto-spark](../.claude/skills/wf-auto-spark/SKILL.md) — perpetual inspiration mode: external spark search, long-term roadmap with staged milestones, ≤50% deviation guard.
+- [WF Mode](WF.md) - complete role chain: plan, research/docs, architecture, test, implement, validation, cross-review, reflector, acceptance.
+- [wf](../.claude/skills/wf/SKILL.md) - Claude Code WF skill command; mirrored for Codex at `../.agents/skills/wf/SKILL.md`.
+- [subagent-orchestrator](../.claude/skills/subagent-orchestrator/SKILL.md) - controller-led subagent orchestration, parallel read-only passes, review gates, and recovery handoffs.
+- [wf-readme](../.claude/skills/wf-readme/SKILL.md) - README preservation, append-only development sections, structured tables, and approved architecture diagrams.
+- [wf-review](../.claude/skills/wf-review/SKILL.md) - cross-model peer review: invoke the other agent CLI (Codex/Claude) for independent review.
+- [wf-update](../.claude/skills/wf-update/SKILL.md) - GitHub-based incremental harness update, checksum comparison, and safe in-place updates.
+- [wf-learn](../.claude/skills/wf-learn/SKILL.md) - force memory learning cycle: context-master -> memory-master -> project + global memory.
+- [wf-max](../.claude/skills/wf-max/SKILL.md) - WF strict superset: complete role chain plus maximum parallelism, current runtime subagents first, cross-CLI overflow when available.
+- [wf-auto](../.claude/skills/wf-auto/SKILL.md) - perpetual adaptive auto-optimization: evidence-selected probes, dynamic obligations, intent checkpoints, evidence ledger.
+- [wf-auto-spark](../.claude/skills/wf-auto-spark/SKILL.md) - perpetual inspiration mode: external spark search, long-term roadmap with staged milestones, <=50% deviation guard.
 - [tdd](../.claude/skills/tdd/SKILL.md) - acceptance-driven TDD: AC-linked RED tests, real UI clicks for browser-visible behavior, Playwright/CDP evidence, and configured coverage gate.
 - [wf-remove](../.claude/skills/wf-remove/SKILL.md) - safely remove Harness framework files (SAFE/MODIFIED/USER classes), auto-prune empty directories, backup option.
 
@@ -47,15 +48,11 @@ Codex repo-skill mirrors live under `../.agents/skills/` with the same skill nam
 
 Stack-specific skills can be added after the product shape is known.
 
-- [browser-e2e](workflows/browser-e2e.md)
-
-Stack-specific skills can be added after the product shape is known.
-
 ## Rules (Harness Constraints)
 
 Located under `.claude/rules/ecc/`, auto-loaded by the CC engine:
 
-- [common.md](../.claude/rules/ecc/common.md) — universal harness constraints for context loading, verification, subagents, and security (alwaysApply: true)
+- [common.md](../.claude/rules/ecc/common.md) - universal harness constraints for context loading, verification, subagents, and security (alwaysApply: true)
 - Language-specific rules pending Claude Code initialization (e.g. python.md, typescript.md, etc.)
 
 ## Harness (Runtime)

package/templates/common/README.md

@@ -1,42 +1,42 @@
-# {{projectName}}
-
-Project development notes belong here.
-
-## Development Commands
-
-Record the real project commands after bootstrap:
-
-```bash
-# Install dependencies
-# e.g. npm install
-
-# Run locally
-# e.g. npm run dev
-
-# Run tests
-# e.g. npm test
-
-# Build
-# e.g. npm run build
-```
-
-Replace the examples with the real commands discovered from this project. If a command is unknown, record the open question in `Harness/tasks/<task-id>/PROGRESS.md`.
-
-## Git And Release Notes
-
-- Keep branch, commit, pull request, CI, and release conventions in this README.
-- Do not place build scripts, git policy, or project maintenance instructions in `CLAUDE.md`.
-- Keep code architecture notes in `Harness/architecture.md` or feature docs.
-- For README improvements, use `.claude/skills/wf-readme/SKILL.md`; preserve public docs unless a rewrite is approved.
-
+# {{projectName}}
+
+Project development notes belong here.
+
+## Development Commands
+
+Record the real project commands after bootstrap:
+
+```bash
+# Install dependencies
+# e.g. npm install
+
+# Run locally
+# e.g. npm run dev
+
+# Run tests
+# e.g. npm test
+
+# Build
+# e.g. npm run build
+```
+
+Replace the examples with the real commands discovered from this project. If a command is unknown, record the open question in `Harness/tasks/<task-id>/PROGRESS.md`.
+
+## Git And Release Notes
+
+- Keep branch, commit, pull request, CI, and release conventions in this README.
+- Do not place build scripts, git policy, or project maintenance instructions in `CLAUDE.md`.
+- Keep code architecture notes in `Harness/architecture.md` or feature docs.
+- For README improvements, use `.claude/skills/wf-readme/SKILL.md`; preserve public docs unless a rewrite is approved.
+
 ## Harness
 
 The agentic engineering harness lives in `Harness/`.
-
-- Follow `Harness/SETUP.md` before normal work while it exists.
-- Start at `Harness/README.md`.
-- Load memory and resource registrations from `Harness/MEMORY.md`.
-- Track active work in `Harness/PROGRESS.md` and `Harness/tasks/<task-id>/PROGRESS.md`.
+
+- Follow `Harness/SETUP.md` before normal work while it exists.
+- Start at `Harness/README.md`.
+- Load memory and resource registrations from `Harness/MEMORY.md`.
+- Track active work in `Harness/PROGRESS.md` and `Harness/tasks/<task-id>/PROGRESS.md`.
 - Use `Harness/WF.md` for long, difficult, multi-agent work.
   - Claude Code: invoke the `wf` skill with `/wf`.
   - Codex: invoke the `wf` skill with `$wf` or `/skills`.

package/templates/common/SETUP.md

@@ -138,7 +138,7 @@ The harness validator checks for specific structural invariants. When comparing
 | `Harness/MEMORY.md` | All common agents registered under `## Agents`; all common harness skills registered under `## Skills`; all 3 `Harness/memory/` files registered under `## Memory Folder`; `Harness/memory/` folder usage guidance; `Project Resource Index` in title |
 | `.claude/rules/ecc/common.md` | Required project-local universal rules. Keep it even when global `~/.claude/rules/ecc/common/` exists; that directory and this file have different scopes. Required sections: `## Context` with the durable communication invariant (`project files are the only durable communication channel`); `## Memory` with three reflection file entries; `## Security` |
 | `Harness/README.md` | `## Keyword Routing` heading; `## Load By Task` table with at minimum the rows: "Need WF mode", "Adding harness to existing project", "Need implementation plan", "Need parallel agents", "Need subagents", "Need durable memory or reflection"; WF routing keywords include `/wf`, `wf mode`, `workflow mode`, and `wk mode`; explicit WF/WK output says subagent docs load immediately; `## Doc Map` with `memory/` and `subagents.md` entries; the durable communication invariant text; `Harness/README.md is the primary router` |
-| `Harness/WF.md` | `WF mode requires multi-subagent orchestration by default`; explicit `/wf`, `$wf`, `wf mode`, `workflow mode`, or `wk mode` requires at least 3 distinct role passes before second planning; `collaboration decision tree`; `Heartbeat Protocol` |
+| `Harness/WF.md` | `WF mode requires the complete role chain by default`; explicit `/wf`, `$wf`, `wf mode`, `workflow mode`, or `wk mode` requires plan, research/docs, architecture, test, implement, validation, cross-review, reflector, and acceptance before closeout; `collaboration decision tree`; `Heartbeat Protocol` |
 | `Harness/extension.md` | `## Non-Invasive Extension Rules` section with the "Preserve existing" rule; `## Agent Contract` section; `## Registration` section |
 | `Harness/dispatch.md` | The durable communication invariant; registered common agent entries; `## Handoff Format` heading |
 | `Harness/context-loading.md` | The durable communication invariant; `Harness/README.md is the primary router`; all 12 subagent context packs (Explorer Pass, Planner, Researcher, Docs Researcher, Architect, Test Writer, Implementer, Reviewer, Debugger, Verifier, Memory Master, Context Master) |

package/templates/common/memory/agent-lessons-patterns.md

@@ -1,21 +1,21 @@
-# Agent Lessons And Patterns
-
-Purpose: record reusable lessons from review, debugging, validation, and handoff loops.
-
-Write here when:
-- A review/debug loop reveals a reusable prevention pattern.
-- A validation failure exposes a missing regression check.
-- A handoff, dispatch, or context-loading pattern should be repeated or avoided.
-
-Entry format, newest first:
-
-```markdown
-## YYYY-MM-DD - Short Lesson Name
-
-- Lesson: the reusable pattern.
-- Source: review finding, debug loop, failed verification, or handoff.
-- Apply when: the task shape or files where this matters.
-- Regression guard: test, validator check, docs update, or manual evidence to keep it from recurring.
-```
-
-Keep entries lightweight and actionable. Avoid secrets and speculative lessons.
+# Agent Lessons And Patterns
+
+Purpose: record reusable lessons from review, debugging, validation, and handoff loops.
+
+Write here when:
+- A review/debug loop reveals a reusable prevention pattern.
+- A validation failure exposes a missing regression check.
+- A handoff, dispatch, or context-loading pattern should be repeated or avoided.
+
+Entry format, newest first:
+
+```markdown
+## YYYY-MM-DD - Short Lesson Name
+
+- Lesson: the reusable pattern.
+- Source: review finding, debug loop, failed verification, or handoff.
+- Apply when: the task shape or files where this matters.
+- Regression guard: test, validator check, docs update, or manual evidence to keep it from recurring.
+```
+
+Keep entries lightweight and actionable. Avoid secrets and speculative lessons.

package/templates/common/memory/tool-usage-reflections.md

@@ -1,21 +1,21 @@
-# Tool Usage Reflections
-
-Purpose: record repeated tool failures, better command patterns, and environment-specific fixes.
-
-Write here when:
-- The same tool/use pattern fails 3+ times in one task or across repeated tasks.
-- A more reliable command pattern replaces a brittle one.
-- The environment needs a durable fix, flag, path rule, shell syntax, or startup sequence.
-
-Entry format, newest first:
-
-```markdown
-## YYYY-MM-DD - Short Pattern Name
-
-- Trigger: what failed or repeated.
-- Better pattern: the command, tool usage, or sequence to use next time.
-- Evidence: command output summary, error text, or affected environment.
-- Scope: when this applies and when it does not.
-```
-
-Keep entries concise. Do not record secrets, credentials, private tokens, or one-off noise.
+# Tool Usage Reflections
+
+Purpose: record repeated tool failures, better command patterns, and environment-specific fixes.
+
+Write here when:
+- The same tool/use pattern fails 3+ times in one task or across repeated tasks.
+- A more reliable command pattern replaces a brittle one.
+- The environment needs a durable fix, flag, path rule, shell syntax, or startup sequence.
+
+Entry format, newest first:
+
+```markdown
+## YYYY-MM-DD - Short Pattern Name
+
+- Trigger: what failed or repeated.
+- Better pattern: the command, tool usage, or sequence to use next time.
+- Evidence: command output summary, error text, or affected environment.
+- Scope: when this applies and when it does not.
+```
+
+Keep entries concise. Do not record secrets, credentials, private tokens, or one-off noise.

package/templates/common/memory/user-corrections-preferences.md

@@ -1,21 +1,21 @@
-# User Corrections And Preferences
-
-Purpose: record repeated user corrections, durable preferences, and common-sense course corrections.
-
-Write here when:
-- The user says "remember", "never", "next time", "always", or "I prefer".
-- The user corrects the same assumption/pattern 2+ times.
-- A correction changes how future work should be scoped, explained, verified, or handed off.
-
-Entry format, newest first:
-
-```markdown
-## YYYY-MM-DD - Short Preference Name
-
-- Correction/preference: the durable instruction.
-- Trigger: what prompted the correction.
-- Apply when: future contexts where this should guide behavior.
-- Avoid: contexts where this should not be over-applied.
-```
-
-Do not record ordinary chat. If the preference is ambiguous, ask before writing it. Never store secrets.
+# User Corrections And Preferences
+
+Purpose: record repeated user corrections, durable preferences, and common-sense course corrections.
+
+Write here when:
+- The user says "remember", "never", "next time", "always", or "I prefer".
+- The user corrects the same assumption/pattern 2+ times.
+- A correction changes how future work should be scoped, explained, verified, or handed off.
+
+Entry format, newest first:
+
+```markdown
+## YYYY-MM-DD - Short Preference Name
+
+- Correction/preference: the durable instruction.
+- Trigger: what prompted the correction.
+- Apply when: future contexts where this should guide behavior.
+- Avoid: contexts where this should not be over-applied.
+```
+
+Do not record ordinary chat. If the preference is ambiguous, ask before writing it. Never store secrets.

package/templates/common/opencode.json

@@ -0,0 +1,19 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "instructions": [".claude/rules/ecc/common.md"],
+  "permission": {
+    "bash": {
+      "*": "ask",
+      "rm -rf *": "deny",
+      "sudo *": "deny",
+      "curl *": "deny",
+      "wget *": "deny"
+    },
+    "read": {
+      "**/.env*": "deny",
+      "**/secrets/**": "deny",
+      "**/*.key": "deny",
+      "**/*.pem": "deny"
+    }
+  }
+}