freeharness 0.4.1

package/provenance/canonical.PROVENANCE.yaml

@@ -0,0 +1,740 @@
+# Provenance for canonical content derived from external sources. Every file listed here was
+# rewritten in the FreeHarness style (English, no-bold prose, our tool-routing contract, Google
+# docstrings / JSDoc in code); none is a verbatim copy. `upstream_path` is the file whose ideas
+# the entry derives from; `commit` is the pinned upstream revision at harvest time.
+# `upstream_sha256` is the hash of the upstream file (or, for a directory, of its sorted
+# file names + contents) at that commit; the test asserts our file never hashes to it.
+# Harvest classifications and rationale: canonical/HARVEST.yaml.
+
+sources:
+  claude-code:
+    repo: https://github.com/anthropics/claude-code
+    fork: https://github.com/anegrelli/claude-code
+    baseline_commit: "b3f0e50"
+  caveman:
+    repo: https://github.com/JuliusBrussee/caveman
+    baseline_commit: "367fdb7f"
+    license: MIT (skills/ only; engine, proxy, mcp, shrink, mem are BSL-1.1 and ship nothing)
+  pi:
+    repo: https://github.com/badlogic/pi-mono
+    baseline_commit: "4cc339f5"
+    license: MIT
+  deepseek-harness:
+    repo: https://github.com/deepseek-ai/deepseek-harness
+    baseline_commit: "d347e703"
+    license: MIT
+  superpowers:
+    repo: https://github.com/obra/superpowers
+    baseline_commit: "b36e0829"
+    license: MIT
+  ecc:
+    repo: https://github.com/affaan-m/ECC
+    baseline_commit: "68e926bf"
+    license: MIT
+  openspec:
+    repo: https://github.com/Fission-AI/OpenSpec
+    fork: https://github.com/anegrelli/OpenSpec
+    baseline_commit: "e062b957"
+    license: MIT
+
+files:
+  - path: agents/explorer-ai-engineer-analyst.md
+    source: claude-code
+    upstream_path: plugins/feature-dev/agents/code-explorer.md
+    upstream_sha256: "3b277703de7458988ec3b8021c716f79f642e174950ed332629310f68322029a"
+    commit: "b3f0e50"
+    rewritten: true
+    note: "Only the feature_trace_mode section derives from upstream (entry points -> call chain -> layers -> essential-files list, file:line discipline); the agent itself predates the harvest (local-code angle). Former agents/code-explorer.md folded here."
+
+  - path: openspec/schema.spec-driven.yaml
+    source: claude-code
+    upstream_path: plugins/feature-dev/agents/code-architect.md
+    upstream_sha256: "c50fb08d59a4bbd19660860626a049e44cf1a2b0c1cf782e6c7a99ba7e71b0c3"
+    commit: "b3f0e50"
+    rewritten: true
+    note: "Only the design artifact instruction derives from upstream (compare 2-3 approaches grounded in codebase patterns, commit with rationale, file-level blueprint with interfaces, data flow and test points); the schema predates the harvest. Former agents/code-architect.md and agents/planner.md folded here; /opsx:propose writes the artifacts."
+
+  - path: openspec/templates/design.md
+    source: claude-code
+    upstream_path: plugins/feature-dev/commands/feature-dev.md
+    upstream_sha256: "652e5d6264fd253fcb70c2f84de986a88d77109a02410aacd90230a6ab4bf557"
+    commit: "b3f0e50"
+    rewritten: true
+    note: "Only the Open Questions Resolved, Candidate Approaches and Blueprint sections derive from upstream (clarify + architect phases); implement/review phases are subagent-driven-development + TDD + code-review. Former skills/feature-dev/SKILL.md folded here."
+
+  - path: agents/pr-reviewer.md
+    source: claude-code
+    upstream_path: plugins/pr-review-toolkit/agents
+    upstream_sha256: "1828c969ec52ea8542fb98fad6f57cde3103e8039056d0a88571ab0c14cc56b7"
+    commit: "b3f0e50"
+    rewritten: true
+    note: "Six upstream agents (comment-analyzer, pr-test-analyzer, silent-failure-hunter, type-design-analyzer, code-simplifier, code-reviewer) folded into one agent with lens sections and P0/P1/P2 output; project-specific logging references dropped."
+
+  - path: skills/code-review/SKILL.md
+    source: claude-code
+    upstream_path: plugins/code-review/commands/code-review.md
+    upstream_sha256: "2b0837c5ec0b2e75f8ba4565bdafd76fa916b0dc146608c5733af7ba5802012c"
+    commit: "b3f0e50"
+    rewritten: true
+    note: "Only the parallel-lens dispatch and validate-before-consolidate paragraph derives from upstream; the diff-driven lens selection paragraph derives from plugins/pr-review-toolkit/commands/review-pr.md (former skills/pr-review/SKILL.md, folded here); the rest of the skill predates the harvest (Superpowers-derived, rewritten in v1)."
+
+  - path: hooks/freeharness-security-guidance.mjs
+    source: claude-code
+    upstream_path: plugins/security-guidance/hooks/patterns.py
+    upstream_sha256: "7870f5cac17034e9bfff829a2bba283bbcb47b416c915d8c8a1ab7ec02c5b4aa"
+    commit: "b3f0e50"
+    rewritten: true
+    note: "Node rewrite of the pattern catalogue with reworded reminders; adds SQL string building, path traversal, hardcoded secrets, prompt interpolation, and model-output-to-sink rules; advisory only (additionalContext, exit 0)."
+
+  - path: hooks/hooks.security-guidance.claude-code.json
+    source: claude-code
+    upstream_path: plugins/security-guidance/hooks/hooks.json
+    upstream_sha256: "37181aea2a1ccd4efa88c427d4cd194fac48ab1ca67779c14edf8de375809181"
+    commit: "b3f0e50"
+    rewritten: true
+    note: "PreToolUse fragment only; the upstream SessionStart/UserPromptSubmit/Stop LLM-review events are not adopted."
+
+  - path: skills/git-workflow/SKILL.md
+    source: claude-code
+    upstream_path: plugins/commit-commands/commands
+    upstream_sha256: "00b7e943b9737f1cbf3e4d08db412370862728972b27b70c1cef9e54d5d3cac7"
+    commit: "b3f0e50"
+    rewritten: true
+    note: "commit.md, commit-push-pr.md, clean_gone.md merged into one skill with conventional messages and non-negotiable safety rules."
+
+  - path: agents/python-reviewer.md
+    source: claude-code
+    upstream_path: plugins/pr-review-toolkit/agents/silent-failure-hunter.md
+    upstream_sha256: "fa9b0daec5a267e7e66435cc48b3328301fc9f70c3af259fe248881327a1babc"
+    commit: "b3f0e50"
+    rewritten: true
+    note: "Only the appended checklist_harvested section derives from upstream (silent failures, comment accuracy, type invariants)."
+
+  - path: agents/security-reviewer.md
+    source: claude-code
+    upstream_path: plugins/security-guidance/hooks/patterns.py
+    upstream_sha256: "7870f5cac17034e9bfff829a2bba283bbcb47b416c915d8c8a1ab7ec02c5b4aa"
+    commit: "b3f0e50"
+    rewritten: true
+    note: "Only the appended checklist_harvested section derives from upstream (execution sinks, deserialization, transport and crypto)."
+
+  # ---- v4 (freeharness-v4, P1 harness-intelligence). Concept rewrites: the upstream file is
+  # the source of the idea, the FreeHarness paragraph is authored from scratch (English,
+  # no bold, XML-tag sections). One entry per (target, upstream) pair; a target with several
+  # upstream sources has several entries.
+
+  - path: rules/CLAUDE.md
+    source: caveman
+    upstream_path: skills/caveman/SKILL.md
+    upstream_sha256: "c4d7354b4b063d54601fcdd5097a5b1713d1a1a2e386ac39efa438aa1ffef8ce"
+    commit: "367fdb7f"
+    license: MIT
+    rewritten: true
+    note: "Only the three <output_rules> lines derive from upstream (terse default with the keep-list, auto-clarity triggers, boundaries for persisted artifacts); levels, wenyan variants and the /caveman command are not adopted (P1.1)."
+
+  - path: rules/CLAUDE.md
+    source: caveman
+    upstream_path: skills/cavecrew/SKILL.md
+    upstream_sha256: "c05f8e8d16bd8ae1c8d0b0abf6e8b9671051bde61653c4986304c2de3a1cf5d4"
+    commit: "367fdb7f"
+    license: MIT
+    rewritten: true
+    note: "Only the Delegation paragraph in <orchestration_contract> derives from upstream (subagent when the caller needs facts or results and the return is compressed by contract; inline otherwise); no cavecrew agents shipped (P1.1)."
+
+  - path: rules/CLAUDE.md
+    source: pi
+    upstream_path: AGENTS.md
+    upstream_sha256: "9aa976721907c0e705333516969abe57163c8ac1895e920883380367a86af12e"
+    commit: "4cc339f5"
+    license: MIT
+    rewritten: true
+    note: "Two rule lines: state agree or disagree before stating what changed (<communication_and_language>); dependency and lockfile changes are reviewed code (<code_quality_and_comments>) (P1.1)."
+
+  - path: rules/CLAUDE.md
+    source: deepseek-harness
+    upstream_path: .agents/skills/dsh-trim-cot-leakage/SKILL.md
+    upstream_sha256: "d81b60699eec7413183b4fbb7a26a940bedde2f816dba0eccbfa453549292dcc"
+    commit: "d347e703"
+    license: MIT
+    rewritten: true
+    note: "HEAD-reader test, the eight leak classes in one line, restate-then-delete and the not-leakage keep list in <code_quality_and_comments> (P1.5)."
+
+  - path: rules/CLAUDE.md
+    source: deepseek-harness
+    upstream_path: .agents/skills/dsh-prose-standard/SKILL.md
+    upstream_sha256: "df56be84f9ee917a34055c9e229d06c409bce478de7bb0deb233240c1887f2eb"
+    commit: "d347e703"
+    license: MIT
+    rewritten: true
+    note: "Complete-proposition rule for docs (enumerate propositions before trimming; keep obligations, invariants, provenance; word count alone is not an improvement) (P1.5)."
+
+  - path: rules/CLAUDE.md
+    source: deepseek-harness
+    upstream_path: .agents/notes/README.md
+    upstream_sha256: "722a3ed38f137a08121bdd807c1841d7d6bd142ed5bce8033123c7a9247ffd75"
+    commit: "d347e703"
+    license: MIT
+    rewritten: true
+    note: "Only the <spec_first_opsx> non-trivial definition (behavior, architecture, cross-file contract, process or tooling, on-disk/wire/config format) and the rule 'no OpenSpec change = no non-trivial code change' derive from the Agent Notes when-to-write-one rule (P1.4)."
+
+  - path: skills/code-review/SKILL.md
+    source: deepseek-harness
+    upstream_path: .agents/skills/dsh-trim-cot-leakage/SKILL.md
+    upstream_sha256: "d81b60699eec7413183b4fbb7a26a940bedde2f816dba0eccbfa453549292dcc"
+    commit: "d347e703"
+    license: MIT
+    rewritten: true
+    note: "Only the stage-2 CoT-leakage lens paragraph derives from upstream (HEAD-reader test, eight classes, restated replacement, keep list); the rest of the skill is claude-code-derived (entry above) and pre-harvest (P1.5)."
+
+  # Skill description discipline (P1.11): only the front-matter `description:` form (at most
+  # 500 characters, trigger-worded 'Use when ...') derives from the deepseek-harness skill
+  # catalog convention; every description text is ours.
+
+  - path: skills/agent-evaluation/SKILL.md
+    source: deepseek-harness
+    upstream_path: packages/skill/README.md
+    upstream_sha256: "1c9a960d4d9a5fe22b70ead5528d568190642d5de51d2759ca5f2df18288a086"
+    commit: "d347e703"
+    license: MIT
+    rewritten: true
+    note: "Description form only (P1.11)."
+
+  - path: skills/agentic-architecture/SKILL.md
+    source: deepseek-harness
+    upstream_path: packages/skill/README.md
+    upstream_sha256: "1c9a960d4d9a5fe22b70ead5528d568190642d5de51d2759ca5f2df18288a086"
+    commit: "d347e703"
+    license: MIT
+    rewritten: true
+    note: "Description form only (P1.11)."
+
+  - path: skills/code-review/SKILL.md
+    source: deepseek-harness
+    upstream_path: packages/skill/README.md
+    upstream_sha256: "1c9a960d4d9a5fe22b70ead5528d568190642d5de51d2759ca5f2df18288a086"
+    commit: "d347e703"
+    license: MIT
+    rewritten: true
+    note: "Description form only (P1.11)."
+
+  - path: skills/git-workflow/SKILL.md
+    source: deepseek-harness
+    upstream_path: packages/skill/README.md
+    upstream_sha256: "1c9a960d4d9a5fe22b70ead5528d568190642d5de51d2759ca5f2df18288a086"
+    commit: "d347e703"
+    license: MIT
+    rewritten: true
+    note: "Description form only (P1.11)."
+
+  - path: skills/local-code/SKILL.md
+    source: deepseek-harness
+    upstream_path: packages/skill/README.md
+    upstream_sha256: "1c9a960d4d9a5fe22b70ead5528d568190642d5de51d2759ca5f2df18288a086"
+    commit: "d347e703"
+    license: MIT
+    rewritten: true
+    note: "Description form only (P1.11)."
+
+  - path: skills/report-formatting/SKILL.md
+    source: deepseek-harness
+    upstream_path: packages/skill/README.md
+    upstream_sha256: "1c9a960d4d9a5fe22b70ead5528d568190642d5de51d2759ca5f2df18288a086"
+    commit: "d347e703"
+    license: MIT
+    rewritten: true
+    note: "Description form only (P1.11)."
+
+  - path: skills/subagent-driven-development/SKILL.md
+    source: deepseek-harness
+    upstream_path: packages/skill/README.md
+    upstream_sha256: "1c9a960d4d9a5fe22b70ead5528d568190642d5de51d2759ca5f2df18288a086"
+    commit: "d347e703"
+    license: MIT
+    rewritten: true
+    note: "Description form only (P1.11)."
+
+  - path: skills/systematic-debugging/SKILL.md
+    source: deepseek-harness
+    upstream_path: packages/skill/README.md
+    upstream_sha256: "1c9a960d4d9a5fe22b70ead5528d568190642d5de51d2759ca5f2df18288a086"
+    commit: "d347e703"
+    license: MIT
+    rewritten: true
+    note: "Description form only (P1.11)."
+
+  - path: skills/test-driven-development/SKILL.md
+    source: deepseek-harness
+    upstream_path: packages/skill/README.md
+    upstream_sha256: "1c9a960d4d9a5fe22b70ead5528d568190642d5de51d2759ca5f2df18288a086"
+    commit: "d347e703"
+    license: MIT
+    rewritten: true
+    note: "Description form only (P1.11)."
+
+  - path: skills/verification-before-completion/SKILL.md
+    source: deepseek-harness
+    upstream_path: packages/skill/README.md
+    upstream_sha256: "1c9a960d4d9a5fe22b70ead5528d568190642d5de51d2759ca5f2df18288a086"
+    commit: "d347e703"
+    license: MIT
+    rewritten: true
+    note: "Description form only (P1.11)."
+
+  - path: agents/explorer-ai-engineer-analyst.md
+    source: pi
+    upstream_path: packages/coding-agent/examples/extensions/subagent/agents/scout.md
+    upstream_sha256: "3b84e8e01c6e05c8dfbff1c845c0c6371f4f16350735d4d1dbd02bfa98b1d4e6"
+    commit: "4cc339f5"
+    license: MIT
+    rewritten: true
+    note: "Only the <scout_handoff> contract derives from upstream (handoff for an agent that has not seen the files, essential files with line ranges, key code, start-here order); section names and rules are ours (P1.6)."
+
+  - path: agents/pr-reviewer.md
+    source: caveman
+    upstream_path: agents/cavecrew-reviewer.md
+    upstream_sha256: "e302fce4e8012b25031427fb076ced3c79b03438c8e0f01cb6fb10f1f5857086"
+    commit: "367fdb7f"
+    license: MIT
+    rewritten: true
+    note: "Only the <output_contract> derives from upstream (one line per finding path:line: severity: problem. fix., file order, totals line, clean marker); P0/P1/P2 replace the emoji tiers and the lenses/checklists are ours (P1.6). mle-reviewer folded into pr-reviewer's mle lens; this entry also covers that checklist section, attributed to the same caveman upstream as the rest of the reviewer contracts."
+
+  - path: agents/python-reviewer.md
+    source: caveman
+    upstream_path: agents/cavecrew-reviewer.md
+    upstream_sha256: "e302fce4e8012b25031427fb076ced3c79b03438c8e0f01cb6fb10f1f5857086"
+    commit: "367fdb7f"
+    license: MIT
+    rewritten: true
+    note: "Only the <output_contract> derives from upstream (one line per finding path:line: severity: problem. fix., file order, totals line, clean marker); P0/P1/P2 replace the emoji tiers and the lenses/checklists are ours (P1.6)."
+
+  - path: agents/database-reviewer.md
+    source: caveman
+    upstream_path: agents/cavecrew-reviewer.md
+    upstream_sha256: "e302fce4e8012b25031427fb076ced3c79b03438c8e0f01cb6fb10f1f5857086"
+    commit: "367fdb7f"
+    license: MIT
+    rewritten: true
+    note: "Only the <output_contract> derives from upstream (one line per finding path:line: severity: problem. fix., file order, totals line, clean marker); P0/P1/P2 replace the emoji tiers and the lenses/checklists are ours (P1.6)."
+
+  - path: agents/security-reviewer.md
+    source: caveman
+    upstream_path: agents/cavecrew-reviewer.md
+    upstream_sha256: "e302fce4e8012b25031427fb076ced3c79b03438c8e0f01cb6fb10f1f5857086"
+    commit: "367fdb7f"
+    license: MIT
+    rewritten: true
+    note: "Only the <output_contract> derives from upstream (one line per finding path:line: severity: problem. fix., file order, totals line, clean marker); P0/P1/P2 replace the emoji tiers and the lenses/checklists are ours (P1.6)."
+
+  - path: agents/python-reviewer.md
+    source: deepseek-harness
+    upstream_path: docs/defensive-patterns.md
+    upstream_sha256: "919d27a033c655ea6187496872caa4aa9babf08d87179562ca23545301108bb1"
+    commit: "d347e703"
+    license: MIT
+    rewritten: true
+    note: "<checklist_defensive_patterns>: orthogonal outcomes, async state, quiescent teardown, contained callbacks, scrubbed subprocess environment; error = code + next action from the structured-error note (P1.6, P1.7)."
+
+  - path: agents/security-reviewer.md
+    source: deepseek-harness
+    upstream_path: docs/defensive-patterns.md
+    upstream_sha256: "919d27a033c655ea6187496872caa4aa9babf08d87179562ca23545301108bb1"
+    commit: "d347e703"
+    license: MIT
+    rewritten: true
+    note: "<checklist_defensive_patterns>: scrubbed environment, private temp paths, link-shaped path removal, safe error text, independent outcomes (P1.6)."
+
+  - path: skills/agentic-architecture/reference/reliability-observability.md
+    source: deepseek-harness
+    upstream_path: docs/defensive-patterns.md
+    upstream_sha256: "919d27a033c655ea6187496872caa4aa9babf08d87179562ca23545301108bb1"
+    commit: "d347e703"
+    license: MIT
+    rewritten: true
+    note: "Only the 'Error contract: code + next action' section derives from upstream (orthogonal outcomes, async state, boundary normalization) plus the structured-error taxonomy note; the rest of the reference predates the harvest (P1.7)."
+
+  - path: skills/verification-before-completion/SKILL.md
+    source: deepseek-harness
+    upstream_path: packages/goal/goal-round-driver/src/prompt.ts
+    upstream_sha256: "48410d77077e88053cded777736a425534e91b36402ab46dc151ea9867a3db97"
+    commit: "d347e703"
+    license: MIT
+    rewritten: true
+    note: "<grounding> authoritative-state, evidence-before-completion and three-round blocked lines derive from the goal-round prompt (P1.9)."
+
+  - path: skills/verification-before-completion/SKILL.md
+    source: deepseek-harness
+    upstream_path: docs/postmortem/0003-web-agent-gui-feedback-loop.md
+    upstream_sha256: "b3127e3b387e95dc167a85edb5a2c97f73a3b1029fb81f3dfad16709d5586b0a"
+    commit: "d347e703"
+    license: MIT
+    rewritten: true
+    note: "Acceptance names the exact origin; replacement service, build success and bare HTTP 200 prove nothing; the port 3081 rationalization row and eval fixture (P1.9, P1.15)."
+
+  - path: skills/verification-before-completion/SKILL.md
+    source: superpowers
+    upstream_path: skills/verification-before-completion/SKILL.md
+    upstream_sha256: "2befe7fc55bcadaa3d97dd9e8efeb633d2561c0ebe74c5a8b17c4d9e7e4520b3"
+    commit: "b36e0829"
+    license: MIT
+    rewritten: true
+    note: "Rationalization table shape (claim, why not evidence, what counts) and the gate-then-claim order; rows and stop conditions are ours (P1.9)."
+
+  - path: skills/subagent-driven-development/SKILL.md
+    source: superpowers
+    upstream_path: skills/subagent-driven-development/SKILL.md
+    upstream_sha256: "8dd1b8e698edec3700c6d89517dbe96febd3bacd3f6ea21c1a3569c62ea104b5"
+    commit: "b36e0829"
+    license: MIT
+    rewritten: true
+    note: "File-based briefs and review packages, explicit tier per dispatch, one combined task reviewer, final branch review, no finding suppression, batching of same-shape tasks, no nested subagents, 5-round breaker with rulings, the four stop classes; re-expressed on .freeharness/sdd/<change>/ and the OpenSpec change id as Spec pointer (P1.8)."
+
+  - path: skills/subagent-driven-development/SKILL.md
+    source: deepseek-harness
+    upstream_path: packages/experimental/tool-agent-team/src/index.ts
+    upstream_sha256: "dc3030fe8ee7c5262e5d4bd435fdf2499b0687138487336b81639c7a88c7d180"
+    commit: "d347e703"
+    license: MIT
+    rewritten: true
+    note: "Team lessons from the collaboration policy: disjoint write scopes, the lead reviews the final diff and runs the tests, a member's success report is not acceptance; the JSON handoff with completed|partial|blocked and a labeled partial output is ours (P1.8)."
+
+  - path: skills/subagent-driven-development/SKILL.md
+    source: caveman
+    upstream_path: skills/cavecrew/SKILL.md
+    upstream_sha256: "c05f8e8d16bd8ae1c8d0b0abf6e8b9671051bde61653c4986304c2de3a1cf5d4"
+    commit: "367fdb7f"
+    license: MIT
+    rewritten: true
+    note: "Work-pattern stop tokens as terminal first tokens (too-big, needs-confirm, ambiguous, regressed) in the handoff blocked_reason (P1.8)."
+
+  - path: skills/subagent-driven-development/reference/handoff.md
+    source: caveman
+    upstream_path: skills/cavecrew/SKILL.md
+    upstream_sha256: "c05f8e8d16bd8ae1c8d0b0abf6e8b9671051bde61653c4986304c2de3a1cf5d4"
+    commit: "367fdb7f"
+    license: MIT
+    rewritten: true
+    note: "Stop-condition tokens only; the schema and the lead-evaluation section are ours (P1.8)."
+
+  - path: skills/subagent-driven-development/reference/brief.md
+    source: superpowers
+    upstream_path: skills/subagent-driven-development/SKILL.md
+    upstream_sha256: "8dd1b8e698edec3700c6d89517dbe96febd3bacd3f6ea21c1a3569c62ea104b5"
+    commit: "b36e0829"
+    license: MIT
+    rewritten: true
+    note: "Brief as the single source of requirements, report path named after the brief, batching rule; header lines and the write scope are ours (P1.8)."
+
+  - path: skills/test-driven-development/reference/writing-good-tests.md
+    source: superpowers
+    upstream_path: skills/test-driven-development/writing-good-tests.md
+    upstream_sha256: "51471c853306ff92ca8bb41dcaea05f31c0e46b03651f8f3c99754b7172f4ae1"
+    commit: "b36e0829"
+    license: MIT
+    rewritten: true
+    note: "Falsifiability, independent expectations, string-presence and change-detector traps, mock discipline, the mutation check; condensed to six rules with our content-test exception (P1.10)."
+
+  - path: skills/test-driven-development/SKILL.md
+    source: superpowers
+    upstream_path: skills/test-driven-development/writing-good-tests.md
+    upstream_sha256: "51471c853306ff92ca8bb41dcaea05f31c0e46b03651f8f3c99754b7172f4ae1"
+    commit: "b36e0829"
+    license: MIT
+    rewritten: true
+    note: "<reference> pointer and the five-row rationalization table (P1.10)."
+
+  - path: skills/systematic-debugging/SKILL.md
+    source: superpowers
+    upstream_path: skills/systematic-debugging/SKILL.md
+    upstream_sha256: "808fc5717aa88ad65efff312b11c186294d3e6ee301afb584e2f86599b137787"
+    commit: "b36e0829"
+    license: MIT
+    rewritten: true
+    note: "Stop conditions (three failed hypotheses question the architecture, scope growth, no reproduction) and the trigger check; phases predate the harvest (P1.10)."
+
+  - path: rules/safety.md
+    source: ecc
+    upstream_path: skills/safety-guard/SKILL.md
+    upstream_sha256: "9247b4a05dde847b93d28997477fd3be53dfed967a6279f5d0fc9fab104528ee"
+    commit: "68e926bf"
+    license: MIT
+    rewritten: true
+    note: "Invariants 6-8 (destructive command patterns, credential file globs, network egress review) extend the careful-mode watch list; no hook, freeze mode or log shipped (P1.12)."
+
+  - path: skills/git-workflow/SKILL.md
+    source: superpowers
+    upstream_path: skills/using-git-worktrees/SKILL.md
+    upstream_sha256: "8cfb86f121269e8f7f12361e6795c4f6738828340e28964c9229d365666c9edd"
+    commit: "b36e0829"
+    license: MIT
+    rewritten: true
+    note: "<worktrees>: in-project .worktrees/ verified ignored before creation; the never-delete-dirty and never-discard lines are ours (P1.12)."
+
+  - path: skills/git-workflow/SKILL.md
+    source: pi
+    upstream_path: AGENTS.md
+    upstream_sha256: "9aa976721907c0e705333516969abe57163c8ac1895e920883380367a86af12e"
+    commit: "4cc339f5"
+    license: MIT
+    rewritten: true
+    note: "<worktrees>: never move the worktree to another branch or PR unless asked, inspect PRs against fetched refs, resolve rebase conflicts only in files this branch modified (P1.12)."
+
+  - path: hooks/freeharness-output-pruner.mjs
+    source: pi
+    upstream_path: packages/coding-agent/src/core/tools/truncate.ts
+    upstream_sha256: "104e61ea602c7f7894097b2771dad8c68de75c5a10ea6222e615c4ad144451c7"
+    commit: "4cc339f5"
+    license: MIT
+    rewritten: true
+    note: "Dual byte/line limit, whole lines only, size formatting in the marker; the PostToolUse updatedToolOutput mechanism, the disk copy, the failure-block grammars and the cost-log record are ours (P2.1)."
+
+  - path: hooks/hooks.output-pruner.claude-code.json
+    source: pi
+    upstream_path: packages/coding-agent/src/core/tools/truncate.ts
+    upstream_sha256: "104e61ea602c7f7894097b2771dad8c68de75c5a10ea6222e615c4ad144451c7"
+    commit: "4cc339f5"
+    license: MIT
+    rewritten: true
+    note: "Only the 8 KB / 200-line defaults derive from the dual-limit idea; the fragment shape is our settings.json merge (P2.1)."
+
+  - path: hooks/freeharness-output-pruner.mjs
+    source: deepseek-harness
+    upstream_path: packages/compaction/compaction-tool-result-pruner/src/index.ts
+    upstream_sha256: "f39bfdd135c9d22c82c426c276eda1d467035c316bb88e7b76145bfec0a1dd25"
+    commit: "d347e703"
+    license: MIT
+    rewritten: true
+    note: "Head + marker + tail replacement of an over-budget tool result and the spill of the full text to a session-scoped file (dsh-spill's saveText contract) are the shape; the line-based budget, the protected failure blocks and the hook wiring are ours (P2.1)."
+
+  - path: hooks/freeharness-repeat-tool.mjs
+    source: deepseek-harness
+    upstream_path: packages/guard/repeat-tool-reminder/src/index.ts
+    upstream_sha256: "5cd612ff3b24eef3febb1b8b4ac6b76b0f431de3def509a9a7021ec2d51d9363"
+    commit: "d347e703"
+    license: MIT
+    rewritten: true
+    note: "Deep key-sort canonicalization, the 3/5/8 escalation (gentle then detailed with a capped argument preview), denied calls counted, user prompt resets, fail-loud threshold validation; the per-session ring file, the sha256 key, the stderr-and-defaults fallback and the PreToolUse/UserPromptSubmit wiring are ours (P2.4)."
+
+  - path: hooks/hooks.repeat-tool.claude-code.json
+    source: deepseek-harness
+    upstream_path: packages/guard/repeat-tool-reminder/src/index.ts
+    upstream_sha256: "5cd612ff3b24eef3febb1b8b4ac6b76b0f431de3def509a9a7021ec2d51d9363"
+    commit: "d347e703"
+    license: MIT
+    rewritten: true
+    note: "Only the default thresholds and preview cap derive from upstream's Config defaults (P2.4)."
+
+  - path: hooks/freeharness-session-start
+    source: deepseek-harness
+    upstream_path: packages/compaction/compaction-basic/src/summarizer.ts
+    upstream_sha256: "3589f95a1b63d882d3907752d369c641a1f473b49e538a071f8a3604dda9789c"
+    commit: "d347e703"
+    license: MIT
+    rewritten: true
+    note: "The fixed checkpoint section list (Primary Request, Files and Code, Errors and Fixes, Pending Jobs, Current Work, Next Step, Critical Context; Corrections is ours), '(none)' for empty sections and the verbatim-identifiers rule; the SessionStart(compact|resume) re-injection, the active change, dogfood tail and file-operation list are ours (P2.5)."
+
+  - path: hooks/hooks.claude-code.json
+    source: deepseek-harness
+    upstream_path: packages/compaction/compaction-basic/src/summarizer.ts
+    upstream_sha256: "3589f95a1b63d882d3907752d369c641a1f473b49e538a071f8a3604dda9789c"
+    commit: "d347e703"
+    license: MIT
+    rewritten: true
+    note: "The fragment only widens the SessionStart matcher to compact|resume|fork so the checkpoint re-injection fires (P2.5)."
+
+  - path: rules/project-CLAUDE.template.md
+    source: deepseek-harness
+    upstream_path: packages/compaction/compaction-basic/src/summarizer.ts
+    upstream_sha256: "3589f95a1b63d882d3907752d369c641a1f473b49e538a071f8a3604dda9789c"
+    commit: "d347e703"
+    license: MIT
+    rewritten: true
+    note: "The `# Compact instructions` block names what a checkpoint keeps verbatim (paths, error strings, identifiers, the next step), the summarizer's preservation rule; the template itself predates the harvest (P2.5)."
+
+  - path: hooks/freeharness-config-guard.mjs
+    source: ecc
+    upstream_path: scripts/hooks/config-protection.js
+    upstream_sha256: "04e6c0fbe1f3e9ef1dcfe3c015464838ad9045571efa443259e46bfaa1da4ea3"
+    commit: "e04ea0b9"
+    license: MIT
+    rewritten: true
+    note: "PreToolUse deny on a protected-file list read from tool_input.file_path; our list is the harness configuration (settings, .mcp.json, hooks, CLAUDE.md), the TTL allow marker, the Bash write-construct rule and the JSON permissionDecision are ours (P2.3)."
+
+  - path: hooks/hooks.config-guard.claude-code.json
+    source: ecc
+    upstream_path: scripts/hooks/config-protection.js
+    upstream_sha256: "04e6c0fbe1f3e9ef1dcfe3c015464838ad9045571efa443259e46bfaa1da4ea3"
+    commit: "e04ea0b9"
+    license: MIT
+    rewritten: true
+    note: "Matcher and deny shape only; the 30-minute TTL flag is ours (P2.3)."
+
+  - path: hooks/freeharness-context-monitor.mjs
+    source: ecc
+    upstream_path: scripts/hooks/suggest-compact.js
+    upstream_sha256: "e031a96b7d05b689a457eb4c2c02dd8e1171cd5e68633f30b60a3f0f6ce4471a"
+    commit: "e04ea0b9"
+    license: MIT
+    rewritten: true
+    note: "Context-size signal from the latest assistant usage and a per-session state file so a reminder fires once per bucket; our thresholds are 60/85% of a budget read from the cost snapshot, delivered as a Stop systemMessage (P2.2)."
+
+  - path: hooks/hooks.context-monitor.claude-code.json
+    source: ecc
+    upstream_path: scripts/hooks/suggest-compact.js
+    upstream_sha256: "e031a96b7d05b689a457eb4c2c02dd8e1171cd5e68633f30b60a3f0f6ce4471a"
+    commit: "e04ea0b9"
+    license: MIT
+    rewritten: true
+    note: "Stop registration with the budget/threshold flags; upstream runs on PreToolUse (P2.2)."
+
+  - path: openspec/templates/design.md
+    source: deepseek-harness
+    upstream_path: .agents/notes/README.md
+    upstream_sha256: "722a3ed38f137a08121bdd807c1841d7d6bd142ed5bce8033123c7a9247ffd75"
+    commit: "d347e703"
+    license: MIT
+    rewritten: true
+    note: "Agent Notes loop: the Consequences (cost and bought) section after Decisions, the recorded-not-invented alternatives line and the Supersedes: link; the template itself predates the harvest (P4.3)."
+
+  - path: openspec/schema.spec-driven.yaml
+    source: deepseek-harness
+    upstream_path: .agents/notes/AGENTS.md
+    upstream_sha256: "1c1b4a6d771ed1a7b0e4fd83776dd0cfb0567f4e89f2c7b3bc8b61b73e9a01d2"
+    commit: "d347e703"
+    license: MIT
+    rewritten: true
+    note: "Design instruction: per-decision cost and bought lines, alternatives recorded from what was considered, the Supersedes: convention; proposal instruction: the supersession check over openspec/specs and openspec/changes/archive (P4.3, P4.4)."
+
+  - path: packages/sdd/vendor/openspec/generation/templates/workflows/propose.ts
+    source: openspec
+    upstream_path: src/core/templates/workflows/propose.ts
+    upstream_sha256: "21cafd6eb89936b02d510e46ca3250d9a7e1c7b4eae32fd2ebd7b2a8563626cd"
+    commit: "e062b957"
+    license: MIT
+    rewritten: true
+    note: "Upstream 1.12 inspect-before-drafting step (#1737) ported verbatim; the supersession-check step is ours (dsh Agent Notes loop, P4.2/P4.4). The /opsx:propose skill is generated from this module."
+
+  - path: packages/sdd/vendor/openspec/generation/templates/workflows/archive-change.ts
+    source: openspec
+    upstream_path: src/core/templates/workflows/archive-change.ts
+    upstream_sha256: "6dfb4c6ba31698935bc1090051271e83c26b75b3940bb0604ae690f85ad17044"
+    commit: "e062b957"
+    license: MIT
+    rewritten: true
+    note: "Upstream template plus our supersession check before the archive step (Supersedes: link, reverse link, in-place edit refusal) (P4.4)."
+
+  - path: packages/sdd/vendor/openspec/generation/templates/workflows/explore.ts
+    source: openspec
+    upstream_path: src/core/templates/workflows/explore.ts
+    upstream_sha256: "82ec21c11241b58002998702336201748db62511f09786f2a8fe7e04dd8899f0"
+    commit: "e062b957"
+    license: MIT
+    rewritten: true
+    note: "Upstream 1.12 explore confirmation before the first write, dependency-ordered single discovery questions and ASCII-only diagrams (#1716/#1017/#1010) ported as the upstream diff; header note ours (P4.2)."
+
+  - path: packages/sdd/vendor/openspec/generation/templates/workflows/ff-change.ts
+    source: openspec
+    upstream_path: src/core/templates/workflows/ff-change.ts
+    upstream_sha256: "de0c3b1b28ed7289adea2bf58f1a179528218f22dcf7e895765bc726727710f0"
+    commit: "e062b957"
+    license: MIT
+    rewritten: true
+    note: "Upstream 1.12 inspect-before-drafting step (#1737) ported as the upstream diff; header note ours (P4.2)."
+
+  - path: openspec/templates/proposal.md
+    source: openspec
+    upstream_path: schemas/spec-driven/templates/proposal.md
+    upstream_sha256: "ea0879a322bb1a3c6e3002c67b5a29e31120dcb17219e3000d43775f48481284"
+    commit: "e062b957"
+    license: MIT
+    rewritten: true
+    note: "Override template (predates the port); the scope/depth dial line (AI-DLC) is ours (P4.5)."
+
+  - path: openspec/templates/tasks.md
+    source: openspec
+    upstream_path: schemas/spec-driven/templates/tasks.md
+    upstream_sha256: "b2a6a4c08c15f347a1d8c3e2d43e0c8fb066dc5cc0feb795f47555f176f9c421"
+    commit: "e062b957"
+    license: MIT
+    rewritten: true
+    note: "Per-task verification wording (#1660) from upstream; the Global Constraints block and the Verify/Interfaces/Boundary/Depends lines are ours (P4.2, P4.5)."
+
+  - path: packages/sdd/vendor/openspec/validation/validator.ts
+    source: openspec
+    upstream_path: src/core/validation/validator.ts
+    upstream_sha256: "cfbecc2e8b6b9386d22bac75dba01ac75bfc2e606521640335833ae520e10c27"
+    commit: "e062b957"
+    license: MIT
+    rewritten: true
+    note: "Purpose-placeholder warning (#1671) and findArchiveBlockers INFO pass (#1710) ported into the trimmed vendored Validator (P4.1)."
+
+  - path: packages/sdd/vendor/openspec/validation/purpose-placeholder.ts
+    source: openspec
+    upstream_path: src/core/validation/purpose-placeholder.ts
+    upstream_sha256: "b9ab338ab62adf261336a577c54ead115773e5b413bc97b8fa5c22b1164846e0"
+    commit: "e062b957"
+    license: MIT
+    rewritten: true
+    note: "Verbatim except the code-fence import path (P4.1)."
+
+  - path: packages/sdd/vendor/openspec/apply/specs-apply.ts
+    source: openspec
+    upstream_path: src/core/specs-apply.ts
+    upstream_sha256: "e2c296f31166e7b201941a3c1945085c19dc382a7671184660bb94791538fd3d"
+    commit: "e062b957"
+    license: MIT
+    rewritten: true
+    note: "RENAMED keeps its position (#1712), ENOENT/ENOTDIR guard (#1710), placeholder constants (#1671) ported; chalk dropped, import paths rebased (P4.1)."
+
+  - path: packages/sdd/src/shim/archive.ts
+    source: openspec
+    upstream_path: src/core/archive.ts
+    upstream_sha256: "a38c46f05f9a1d04787b7118e29d880dc1158b6ed38649d8cdd1b0921c9b2a94"
+    commit: "e062b957"
+    license: MIT
+    rewritten: true
+    note: "Store-free archive orchestration; blockers gate (unchecked tasks + validator INFO, refused without --yes) and the Supersedes: convention are ours (P4.1, P4.4)."
+
+  - path: packages/sdd/src/shim/context.ts
+    source: openspec
+    upstream_path: src/core/planning-home.ts
+    upstream_sha256: "637754bd0eb56e7e861402bd155115ef4a5e4281289183af3f4f0c077d71e676"
+    commit: "e062b957"
+    license: MIT
+    rewritten: true
+    note: "planningHome stub { kind: local, root, changesDir, defaultSchema } in context/status/instructions/new-change --json (#1703 shape, no store) (P4.1)."
+
+  - path: packages/sdd/src/shim/new-change.ts
+    source: openspec
+    upstream_path: src/core/planning-home.ts
+    upstream_sha256: "637754bd0eb56e7e861402bd155115ef4a5e4281289183af3f4f0c077d71e676"
+    commit: "e062b957"
+    license: MIT
+    rewritten: true
+    note: "planningHome stub + changeRoot in the new-change --json payload (P4.1)."
+
+  - path: packages/sdd/PROVENANCE.yaml
+    source: openspec
+    upstream_path: schemas/spec-driven/schema.yaml
+    upstream_sha256: "8a71d362e3ee54b5c978578ac226266bc86cb9fcb9a21fd1dcaa67807862e327"
+    commit: "e062b957"
+    license: MIT
+    rewritten: true
+    note: "Baseline bumped to e062b957 / 1.12.0 by `sync adopt sdd` (tracked assets adopted verbatim: assets/schema.upstream.yaml, assets/skills) plus the V4-P4 port list (P4.7)."
+
+  - path: hooks/freeharness-converge.mjs
+    source: claude-code
+    upstream_path: plugins/ralph-wiggum/hooks/stop-hook.sh
+    upstream_sha256: "c8760febc22ed5e2dd322df277647b7d8fb094a41d590d59236a5a6264c7c9bc"
+    commit: "b3f0e50"
+    license: "Apache-2.0 (plugin, per design.md; fork LICENSE.md: Anthropic Commercial Terms; shape only)"
+    rewritten: true
+    note: "Stop-hook loop shape only: block with a reason until a completion condition, bounded rounds. Ours: tasks.md unchecked tasks as the criterion, the Verify line in the reason, .freeharness/converge.json opt-in, converge.log, self-disable on a malformed tasks.md (P4.6)."
+
+  - path: hooks/hooks.converge.claude-code.json
+    source: claude-code
+    upstream_path: plugins/ralph-wiggum/hooks/hooks.json
+    upstream_sha256: "01180e972a5f6b5c8fa0edcd352ab79b4f8490718fe9c2faac9bfa738f3caa21"
+    commit: "b3f0e50"
+    license: Apache-2.0 (plugin, per design.md; shape only)
+    rewritten: true
+    note: "Stop registration; the command path and the opt-in file are ours (P4.6)."