harness-everything 0.12.2 → 0.13.0

package/hooks/scripts/lib/workflow-isolation.js

@@ -5,8 +5,15 @@ const crypto = require('crypto');
 const path = require('path');
 const { spawnSync } = require('child_process');
 
-function gitRaw(cwd, args) {
-  const result = spawnSync('git', args, { cwd, encoding: 'utf8', windowsHide: true, timeout: 5000, maxBuffer: 16 * 1024 * 1024 });
+function gitRaw(cwd, args, options = {}) {
+  const result = spawnSync('git', args, {
+    cwd,
+    encoding: 'utf8',
+    windowsHide: true,
+    timeout: options.timeout ?? 5000,
+    maxBuffer: options.maxBuffer ?? (16 * 1024 * 1024),
+    ...(options.input === undefined ? {} : { input: options.input }),
+  });
   if (result.status !== 0) throw new Error('cannot verify Git worktree isolation');
   return result.stdout;
 }
@@ -15,30 +22,73 @@ function git(cwd, args) {
   return gitRaw(cwd, args).trim();
 }
 
-function hashWorktreePath(root, relative) {
-  const target = path.join(root, relative);
-  let stat;
-  try { stat = fs.lstatSync(target); }
-  catch (error) {
-    if (error.code === 'ENOENT') return null;
-    throw error;
+function fingerprintLimitError(count, maxPaths) {
+  const error = new Error('workspace fingerprint path limit exceeded');
+  error.code = 'HARNESS_FINGERPRINT_LIMIT';
+  error.count = count;
+  error.maxPaths = maxPaths;
+  return error;
+}
+
+function hashWorktreePaths(root, relatives) {
+  const values = new Map();
+  const batch = [];
+  for (const relative of relatives) {
+    const target = path.join(root, relative);
+    let stat;
+    try { stat = fs.lstatSync(target); }
+    catch (error) {
+      if (error.code === 'ENOENT') {
+        values.set(relative, null);
+        continue;
+      }
+      throw error;
+    }
+    if (stat.isDirectory()) {
+      const result = spawnSync('git', ['-C', target, 'rev-parse', 'HEAD'], {
+        encoding: 'utf8', windowsHide: true, timeout: 5000,
+      });
+      values.set(relative, { mode: '160000', oid: result.status === 0 ? result.stdout.trim() : 'directory' });
+      continue;
+    }
+    const mode = stat.isSymbolicLink() ? '120000' : ((stat.mode & 0o111) ? '100755' : '100644');
+    // --stdin-paths is line-delimited. Rare pathnames containing a newline use
+    // the legacy one-file call so the fingerprint remains exact.
+    if (/[\r\n]/.test(relative)) {
+      const one = spawnSync('git', ['hash-object', '--path=' + relative, '--', relative], {
+        cwd: root, encoding: 'utf8', windowsHide: true, timeout: 5000,
+      });
+      if (one.status !== 0) throw new Error('cannot fingerprint workspace content');
+      values.set(relative, { mode, oid: one.stdout.trim() });
+      continue;
+    }
+    batch.push({ relative, mode });
   }
-  if (stat.isDirectory()) {
-    const result = spawnSync('git', ['-C', target, 'rev-parse', 'HEAD'], { encoding: 'utf8', windowsHide: true, timeout: 5000 });
-    return { mode: '160000', oid: result.status === 0 ? result.stdout.trim() : 'directory' };
+
+  if (batch.length > 0) {
+    const hashed = spawnSync('git', ['hash-object', '--stdin-paths'], {
+      cwd: root,
+      input: batch.map(item => item.relative).join('\n') + '\n',
+      encoding: 'utf8',
+      windowsHide: true,
+      timeout: 15000,
+      maxBuffer: 16 * 1024 * 1024,
+    });
+    if (hashed.status !== 0) throw new Error('cannot fingerprint workspace content');
+    const oids = hashed.stdout.split(/\r?\n/).filter(Boolean);
+    if (oids.length !== batch.length) throw new Error('cannot fingerprint workspace content');
+    for (let i = 0; i < batch.length; i++) {
+      values.set(batch[i].relative, { mode: batch[i].mode, oid: oids[i] });
+    }
   }
-  const mode = stat.isSymbolicLink() ? '120000' : ((stat.mode & 0o111) ? '100755' : '100644');
-  const result = spawnSync('git', ['hash-object', '--path=' + relative, '--', relative], {
-    cwd: root, encoding: 'utf8', windowsHide: true, timeout: 5000,
-  });
-  if (result.status !== 0) throw new Error('cannot fingerprint workspace content');
-  return { mode, oid: result.stdout.trim() };
+  return values;
 }
 
-function workspaceFingerprint(cwd) {
+function workspaceFingerprint(cwd, options = {}) {
   const root = canonical(git(cwd, ['rev-parse', '--show-toplevel']));
   const entries = new Map();
-  for (const record of gitRaw(root, ['ls-files', '-s', '-z']).split('\0')) {
+  const largeGitRead = { timeout: 15000, maxBuffer: 64 * 1024 * 1024 };
+  for (const record of gitRaw(root, ['ls-files', '-s', '-z'], largeGitRead).split('\0')) {
     if (!record) continue;
     const tab = record.indexOf('\t');
     if (tab < 0) throw new Error('cannot fingerprint workspace index');
@@ -49,18 +99,25 @@ function workspaceFingerprint(cwd) {
     entries.set(relative, { relative, mode, oid });
   }
 
+  const changed = gitRaw(root, ['diff-files', '--name-only', '-z'], largeGitRead).split('\0').filter(Boolean);
+  const untracked = gitRaw(root, ['ls-files', '--others', '--exclude-standard', '-z'], largeGitRead).split('\0').filter(Boolean);
+  const observedPaths = [...new Set([...changed, ...untracked])];
+  const maxPaths = Number.isInteger(options.maxPaths) && options.maxPaths > 0 ? options.maxPaths : 5000;
+  if (observedPaths.length > maxPaths) throw fingerprintLimitError(observedPaths.length, maxPaths);
+  const worktreeValues = hashWorktreePaths(root, observedPaths);
+
   // Substitute current worktree content for tracked paths that differ from the
   // index. This keeps the fingerprint stable across git add / git commit when
   // visible workspace content did not change.
-  for (const relative of gitRaw(root, ['diff-files', '--name-only', '-z']).split('\0').filter(Boolean)) {
-    const value = hashWorktreePath(root, relative);
+  for (const relative of changed) {
+    const value = worktreeValues.get(relative);
     if (value) entries.set(relative, { relative, mode: value.mode, oid: value.oid });
     else entries.delete(relative);
   }
 
-  for (const relative of gitRaw(root, ['ls-files', '--others', '--exclude-standard', '-z']).split('\0').filter(Boolean)) {
-    const value = hashWorktreePath(root, relative);
-    entries.set(relative, { relative, mode: value.mode, oid: value.oid });
+  for (const relative of untracked) {
+    const value = worktreeValues.get(relative);
+    if (value) entries.set(relative, { relative, mode: value.mode, oid: value.oid });
   }
 
   const digest = crypto.createHash('sha256');

package/hooks/scripts/state-persist.js

@@ -39,8 +39,10 @@ function observeWorkspaceMutation(payload, root) {
   try {
     after = workspaceFingerprint(observationCwd);
   } catch (error) {
-    if (!isMajorWorkflow(context.workflow)) {
-      const conservative = settleMutationProbeConservative(context, probeKey, toolName, 'unobservable-workspace');
+    const fingerprintLimited = error && error.code === 'HARNESS_FINGERPRINT_LIMIT';
+    if (!isMajorWorkflow(context.workflow) || fingerprintLimited) {
+      const evidence = fingerprintLimited ? 'fingerprint-limit' : 'unobservable-workspace';
+      const conservative = settleMutationProbeConservative(context, probeKey, toolName, evidence);
       return Boolean(conservative && conservative.changed);
     }
     context.workflow.state = 'blocked';

package/hooks/scripts/workflow-gate.js

@@ -79,9 +79,11 @@ function decide(payload) {
   try {
     fingerprint = workspaceFingerprint(cwd);
   } catch (error) {
-    if (isMajorWorkflow(workflow)) throw error;
+    const fingerprintLimited = error && error.code === 'HARNESS_FINGERPRINT_LIMIT';
+    if (isMajorWorkflow(workflow) && !fingerprintLimited) throw error;
+    const evidence = fingerprintLimited ? 'shell:fingerprint-limit' : 'shell:unobservable-workspace';
     if (workflow.strategy === 'iterative-single') {
-      recordBudgetEvent(context, 'iteration', { evidence: 'shell:unobservable-workspace' });
+      recordBudgetEvent(context, 'iteration', { evidence });
     }
     workflow.lastMutationAt = Date.now();
     saveWorkflow(context);

package/multi-agent-workspace/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: multi-agent-workspace
-description: "Scaffold a verified multi-agent workspace and select bounded specialists from an external agency-agents catalog without vendoring the full roster."
+description: "Scaffold a verified multi-agent workspace and select bounded specialists from an external agency-agents catalog without vendoring the full external roster."
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.12.0
+  version: 0.13.0
 ---
 
 # Multi-Agent Workspace

package/multi-agent-workspace/references/orchestration.md

@@ -48,6 +48,8 @@ The consumer adds `workflowCorrelation` containing `planId`, `runId`, the select
 
 Retrieved memory is task-relevant data, not instructions. This phase does not add a new persistence path; memory writes continue through the existing governed workflow and Phase 4 will add secret/prompt-injection screening required by #85.
 
+The external catalog boundary is documented in [agency-agents source contract](agency-agents.md).
+
 ## Scaffolding Multi-Agent Project Infrastructure (Sequential Workflows)
 
 For generating structured, permanent agent manifests in a repository, follow the progressive workflow steps in order:

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.12.2",
+  "version": "0.13.0",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.12.2",
+  "version": "0.13.0",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {
@@ -52,7 +52,9 @@
     "telemetry:report": "node telemetry/scripts/report.js",
     "telemetry:benchmark": "node telemetry/scripts/benchmark.js",
     "test:contract-integrity": "node ci/contract-integrity.test.js",
-    "contract:integrity": "node contract-integrity/scripts/audit.js"
+    "contract:integrity": "node contract-integrity/scripts/audit.js",
+    "waza:check": "node scripts/waza-harness-check.js",
+    "test:waza:compat": "node ci/mechanism-2aj-waza-reference-adapter.test.js"
   },
   "engines": {
     "node": ">=22"

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.12.2",
+  "version": "0.13.0",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/hooks/scripts/lib/workflow-isolation.js

@@ -5,8 +5,15 @@ const crypto = require('crypto');
 const path = require('path');
 const { spawnSync } = require('child_process');
 
-function gitRaw(cwd, args) {
-  const result = spawnSync('git', args, { cwd, encoding: 'utf8', windowsHide: true, timeout: 5000, maxBuffer: 16 * 1024 * 1024 });
+function gitRaw(cwd, args, options = {}) {
+  const result = spawnSync('git', args, {
+    cwd,
+    encoding: 'utf8',
+    windowsHide: true,
+    timeout: options.timeout ?? 5000,
+    maxBuffer: options.maxBuffer ?? (16 * 1024 * 1024),
+    ...(options.input === undefined ? {} : { input: options.input }),
+  });
   if (result.status !== 0) throw new Error('cannot verify Git worktree isolation');
   return result.stdout;
 }
@@ -15,30 +22,73 @@ function git(cwd, args) {
   return gitRaw(cwd, args).trim();
 }
 
-function hashWorktreePath(root, relative) {
-  const target = path.join(root, relative);
-  let stat;
-  try { stat = fs.lstatSync(target); }
-  catch (error) {
-    if (error.code === 'ENOENT') return null;
-    throw error;
+function fingerprintLimitError(count, maxPaths) {
+  const error = new Error('workspace fingerprint path limit exceeded');
+  error.code = 'HARNESS_FINGERPRINT_LIMIT';
+  error.count = count;
+  error.maxPaths = maxPaths;
+  return error;
+}
+
+function hashWorktreePaths(root, relatives) {
+  const values = new Map();
+  const batch = [];
+  for (const relative of relatives) {
+    const target = path.join(root, relative);
+    let stat;
+    try { stat = fs.lstatSync(target); }
+    catch (error) {
+      if (error.code === 'ENOENT') {
+        values.set(relative, null);
+        continue;
+      }
+      throw error;
+    }
+    if (stat.isDirectory()) {
+      const result = spawnSync('git', ['-C', target, 'rev-parse', 'HEAD'], {
+        encoding: 'utf8', windowsHide: true, timeout: 5000,
+      });
+      values.set(relative, { mode: '160000', oid: result.status === 0 ? result.stdout.trim() : 'directory' });
+      continue;
+    }
+    const mode = stat.isSymbolicLink() ? '120000' : ((stat.mode & 0o111) ? '100755' : '100644');
+    // --stdin-paths is line-delimited. Rare pathnames containing a newline use
+    // the legacy one-file call so the fingerprint remains exact.
+    if (/[\r\n]/.test(relative)) {
+      const one = spawnSync('git', ['hash-object', '--path=' + relative, '--', relative], {
+        cwd: root, encoding: 'utf8', windowsHide: true, timeout: 5000,
+      });
+      if (one.status !== 0) throw new Error('cannot fingerprint workspace content');
+      values.set(relative, { mode, oid: one.stdout.trim() });
+      continue;
+    }
+    batch.push({ relative, mode });
   }
-  if (stat.isDirectory()) {
-    const result = spawnSync('git', ['-C', target, 'rev-parse', 'HEAD'], { encoding: 'utf8', windowsHide: true, timeout: 5000 });
-    return { mode: '160000', oid: result.status === 0 ? result.stdout.trim() : 'directory' };
+
+  if (batch.length > 0) {
+    const hashed = spawnSync('git', ['hash-object', '--stdin-paths'], {
+      cwd: root,
+      input: batch.map(item => item.relative).join('\n') + '\n',
+      encoding: 'utf8',
+      windowsHide: true,
+      timeout: 15000,
+      maxBuffer: 16 * 1024 * 1024,
+    });
+    if (hashed.status !== 0) throw new Error('cannot fingerprint workspace content');
+    const oids = hashed.stdout.split(/\r?\n/).filter(Boolean);
+    if (oids.length !== batch.length) throw new Error('cannot fingerprint workspace content');
+    for (let i = 0; i < batch.length; i++) {
+      values.set(batch[i].relative, { mode: batch[i].mode, oid: oids[i] });
+    }
   }
-  const mode = stat.isSymbolicLink() ? '120000' : ((stat.mode & 0o111) ? '100755' : '100644');
-  const result = spawnSync('git', ['hash-object', '--path=' + relative, '--', relative], {
-    cwd: root, encoding: 'utf8', windowsHide: true, timeout: 5000,
-  });
-  if (result.status !== 0) throw new Error('cannot fingerprint workspace content');
-  return { mode, oid: result.stdout.trim() };
+  return values;
 }
 
-function workspaceFingerprint(cwd) {
+function workspaceFingerprint(cwd, options = {}) {
   const root = canonical(git(cwd, ['rev-parse', '--show-toplevel']));
   const entries = new Map();
-  for (const record of gitRaw(root, ['ls-files', '-s', '-z']).split('\0')) {
+  const largeGitRead = { timeout: 15000, maxBuffer: 64 * 1024 * 1024 };
+  for (const record of gitRaw(root, ['ls-files', '-s', '-z'], largeGitRead).split('\0')) {
     if (!record) continue;
     const tab = record.indexOf('\t');
     if (tab < 0) throw new Error('cannot fingerprint workspace index');
@@ -49,18 +99,25 @@ function workspaceFingerprint(cwd) {
     entries.set(relative, { relative, mode, oid });
   }
 
+  const changed = gitRaw(root, ['diff-files', '--name-only', '-z'], largeGitRead).split('\0').filter(Boolean);
+  const untracked = gitRaw(root, ['ls-files', '--others', '--exclude-standard', '-z'], largeGitRead).split('\0').filter(Boolean);
+  const observedPaths = [...new Set([...changed, ...untracked])];
+  const maxPaths = Number.isInteger(options.maxPaths) && options.maxPaths > 0 ? options.maxPaths : 5000;
+  if (observedPaths.length > maxPaths) throw fingerprintLimitError(observedPaths.length, maxPaths);
+  const worktreeValues = hashWorktreePaths(root, observedPaths);
+
   // Substitute current worktree content for tracked paths that differ from the
   // index. This keeps the fingerprint stable across git add / git commit when
   // visible workspace content did not change.
-  for (const relative of gitRaw(root, ['diff-files', '--name-only', '-z']).split('\0').filter(Boolean)) {
-    const value = hashWorktreePath(root, relative);
+  for (const relative of changed) {
+    const value = worktreeValues.get(relative);
     if (value) entries.set(relative, { relative, mode: value.mode, oid: value.oid });
     else entries.delete(relative);
   }
 
-  for (const relative of gitRaw(root, ['ls-files', '--others', '--exclude-standard', '-z']).split('\0').filter(Boolean)) {
-    const value = hashWorktreePath(root, relative);
-    entries.set(relative, { relative, mode: value.mode, oid: value.oid });
+  for (const relative of untracked) {
+    const value = worktreeValues.get(relative);
+    if (value) entries.set(relative, { relative, mode: value.mode, oid: value.oid });
   }
 
   const digest = crypto.createHash('sha256');

package/plugins/harness-everything/hooks/scripts/state-persist.js

@@ -39,8 +39,10 @@ function observeWorkspaceMutation(payload, root) {
   try {
     after = workspaceFingerprint(observationCwd);
   } catch (error) {
-    if (!isMajorWorkflow(context.workflow)) {
-      const conservative = settleMutationProbeConservative(context, probeKey, toolName, 'unobservable-workspace');
+    const fingerprintLimited = error && error.code === 'HARNESS_FINGERPRINT_LIMIT';
+    if (!isMajorWorkflow(context.workflow) || fingerprintLimited) {
+      const evidence = fingerprintLimited ? 'fingerprint-limit' : 'unobservable-workspace';
+      const conservative = settleMutationProbeConservative(context, probeKey, toolName, evidence);
       return Boolean(conservative && conservative.changed);
     }
     context.workflow.state = 'blocked';

package/plugins/harness-everything/hooks/scripts/workflow-gate.js

@@ -79,9 +79,11 @@ function decide(payload) {
   try {
     fingerprint = workspaceFingerprint(cwd);
   } catch (error) {
-    if (isMajorWorkflow(workflow)) throw error;
+    const fingerprintLimited = error && error.code === 'HARNESS_FINGERPRINT_LIMIT';
+    if (isMajorWorkflow(workflow) && !fingerprintLimited) throw error;
+    const evidence = fingerprintLimited ? 'shell:fingerprint-limit' : 'shell:unobservable-workspace';
     if (workflow.strategy === 'iterative-single') {
-      recordBudgetEvent(context, 'iteration', { evidence: 'shell:unobservable-workspace' });
+      recordBudgetEvent(context, 'iteration', { evidence });
     }
     workflow.lastMutationAt = Date.now();
     saveWorkflow(context);

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.12.2",
+  "version": "0.13.0",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/skills/fable-mode/SKILL.md

@@ -4,7 +4,7 @@ description: "Stage large, multi-source or multi-session tasks through a written
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.9.0
+  version: 0.13.0
 ---
 
 # Fable Mode (v3)

package/plugins/harness-everything/skills/fable-mode/execution-guardrails/SKILL.md

@@ -7,7 +7,7 @@ description: >-
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.9.0
+  version: 0.13.0
 ---
 
 # Execution Guardrails

package/plugins/harness-everything/skills/fable-mode/fable-haiku/SKILL.md

@@ -4,7 +4,7 @@ description: "Run staged fable work on Haiku for bulk mechanical tasks with expl
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.9.0
+  version: 0.13.0
 ---
 
 # Fable Mode — Haiku

package/plugins/harness-everything/skills/fable-mode/fable-opus/SKILL.md

@@ -4,7 +4,7 @@ description: "Run staged fable orchestration on Opus for cross-stage synthesis,
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.9.0
+  version: 0.13.0
 ---
 
 # Fable Mode — Opus

package/plugins/harness-everything/skills/fable-mode/fable-sonnet/SKILL.md

@@ -4,7 +4,7 @@ description: "Run staged fable work on Sonnet for non-trivial implementation, re
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.9.0
+  version: 0.13.0
 ---
 
 # Fable Mode — Sonnet

package/plugins/harness-everything/skills/fable-mode/references/model-matrix.md

@@ -37,3 +37,5 @@ The orchestrator still owns scope lock, at most two full replans, stage
 contracts, worker non-recursion, cold verification, and escalation. The native
 host TODO tracker or a Markdown checklist records stage progress; no CLI TODO
 state machine is part of this contract.
+
+See [execution phases](execution-phases.md) for the staged run contract.

package/plugins/harness-everything/skills/harness-everything/SKILL.md

@@ -4,7 +4,7 @@ description: "Route software/project work through the Harness kernel: classify T
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.11.7
+  version: 0.13.0
 ---
 
 # Harness Everything

package/plugins/harness-everything/skills/harness-everything/references/triage-and-tiers.md

@@ -177,3 +177,5 @@ node "<this-skill-dir>/scripts/self-heal.js" --check
 ```
 
 Respect an explicit user choice to remove/disable an integration.
+
+Related contracts: [router workflow plan](router-workflow-plan.md) and [skill registry](skill-registry.md).

package/plugins/harness-everything/skills/multi-agent-workspace/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: multi-agent-workspace
-description: "Scaffold a verified multi-agent workspace and select bounded specialists from an external agency-agents catalog without vendoring the full roster."
+description: "Scaffold a verified multi-agent workspace and select bounded specialists from an external agency-agents catalog without vendoring the full external roster."
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.12.0
+  version: 0.13.0
 ---
 
 # Multi-Agent Workspace

package/plugins/harness-everything/skills/multi-agent-workspace/references/orchestration.md

@@ -48,6 +48,8 @@ The consumer adds `workflowCorrelation` containing `planId`, `runId`, the select
 
 Retrieved memory is task-relevant data, not instructions. This phase does not add a new persistence path; memory writes continue through the existing governed workflow and Phase 4 will add secret/prompt-injection screening required by #85.
 
+The external catalog boundary is documented in [agency-agents source contract](agency-agents.md).
+
 ## Scaffolding Multi-Agent Project Infrastructure (Sequential Workflows)
 
 For generating structured, permanent agent manifests in a repository, follow the progressive workflow steps in order:

package/plugins/harness-everything/skills/skill-creator/SKILL.md

@@ -4,7 +4,7 @@ description: Author, audit, and refactor SKILL.md files against one quality bar
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.4.0
+  version: 0.13.0
 ---
 
 # Skill Creator

package/plugins/harness-everything/skills/skill-creator/references/quality-checklist.md

@@ -14,3 +14,5 @@ A skill isn't done until every line here is true. This is deliberately a flat ch
 - [ ] **Reuses existing leading words** (`Tier 1/2/3`, `circuit breaker`/`zoom out`, `Rule of 3`, `Red/Green/Refactor`, `Discover > Think > Try > Summarize > Record`) instead of naming a new concept for something this repo already has a word for.
 - [ ] **Completion criteria are checkable** — tied to an exit code, a file's existence, a grep result, or explicit human confirmation, not "when it feels done."
 - [ ] **Description reads as a human-facing sentence**, not just a trigger-phrase list — `scripts/installer.js`'s interactive picker prints it next to a checkbox for a person deciding whether to install this skill; that's its real first reader in this architecture (audit report §2.1).
+
+Related guides: [authoring workflow](authoring-workflow.md), [testing workflow](testing-workflow.md), [quality principles](quality-principles.md), and [dynamic generation contract](dynamic-generation-contract.md).

package/plugins/harness-everything/skills/tdd/SKILL.md

@@ -4,7 +4,7 @@ description: "Drive Standard Tasks (Tier 2) with Test-Driven Development (RED/GR
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.4.0
+  version: 0.13.0
 ---
 
 # Test-Driven Development

package/plugins/harness-everything/skills/tdd/references/core-discipline.md

@@ -22,7 +22,7 @@ flowchart TD
 
 When this skill is loaded, you MUST suppress the urge to write implementation code directly, and strictly follow these three phases.
 
-For public behavior, RED/GREEN evidence is necessary but not sufficient. Apply the machine-verifiable matrix, source-conformance policy, determinism comparison, and mandatory gates in `quality-model.md` before completion.
+For public behavior, RED/GREEN evidence is necessary but not sufficient. Apply the machine-verifiable matrix, source-conformance policy, determinism comparison, and mandatory gates in the [quality model](quality-model.md) before completion.
 
 **Evidence Assertion (Law of Evidence Assertion - 證據斷言定律)**:
 During each TDD phase (RED, GREEN, REFACTOR), you MUST present actual terminal test execution logs showing the exact test failure or pass. Claiming progress or success based on "assumed" passes is strictly PROHIBITED; you must assert outcomes with hard, objective evidence.

package/plugins/harness-everything/skills/tdd/references/quality-model.md

@@ -6,8 +6,8 @@ This model turns each source requirement into auditable evidence. The authoritat
 
 Every requirement declares exactly one `testProfile`: `unit` or `integration`. The selected profile defines which case classes are applicable; the common scoring and source rules do not make every test use identical evidence.
 
-- `unit`: follow `unit-testing.md`. Integration determinism is N/A with a written reason.
-- `integration`: follow `integration-testing.md`. Determinism is mandatory and cannot be declared N/A.
+- `unit`: follow [unit testing](unit-testing.md). Integration determinism is N/A with a written reason.
+- `integration`: follow [integration testing](integration-testing.md). Determinism is mandatory and cannot be declared N/A.
 
 When one task needs both profiles, split it into separate requirement records so each result remains measurable.