harness-everything 0.2.1 → 0.3.6

package/docs/workflows/repo-docs.md

@@ -1,59 +1,64 @@
-# Workflow: Repo Docs
-
-> Generates high-quality, professional README.md and AGENTS.md files based on actual workspace structures and product-archetype templates.
-
----
-
-## 1. Skill Behavior Workflow
-
-This section visualizes how the `repo-docs` skill executes internally, detailing the sequence of operations, state transitions, and evaluation steps.
-
-```mermaid
-graph TD
-  Start([Generate Repository Docs]) --> AuditProjectStructure["Audit workspace directory tree"]
-  AuditProjectStructure --> ClassifyProductArchetype["Classify repository archetype: tool, library, platform"]
-  ClassifyProductArchetype --> LoadTemplates["Load standard README and AGENTS templates"]
-  LoadTemplates --> InjectCustomStructure["Populate files with actual paths, licenses, and badges"]
-  InjectCustomStructure --> FormatMarkdown["Format documents following clean layout rules"]
-  FormatMarkdown --> WriteFiles["Commit README.md and AGENTS.md to workspace root"]
-  WriteFiles --> End([Professional onboarding documentation created])
-```
-
----
-
-## 2. Triggering and Routing Path
-
-This diagram illustrates how the `repo-docs` skill is triggered through user requests or developer actions, and how it integrates or chains together with other companion skills in the Harness OS ecosystem to form unified workflows.
-
-```mermaid
-graph LR
-  Router["harness-everything / tier-router.js"] -->|Keyword: doc / readme / agents-template| RepoDocs["repo-docs / SKILL.md"]
-  RepoDocs -->|Integrates frontmatter constraints into| BMAS["build-multi-agent-system / SKILL.md"]
-  RepoDocs -->|Leverages ADR details generated in| GWD["grill-with-docs / SKILL.md"]
-```
-
----
-
-## 3. Real-World Use Case Flowchart
-
-Here we model concrete real-world scenarios and use cases of the `repo-docs` skill, illustrating standard success paths, error handling, or recovery loops.
-
-```mermaid
-graph TD
-  Start["New library lacks onboarding docs and setup details"] --> Trigger["repo-docs skill invoked"]
-  Trigger --> Scan["Scans folders: discovers it's a TypeScript utility package"]
-  Scan --> MatchTemplate["Loads library archetype README template"]
-  MatchTemplate --> GenDocs["Outputs README.md with TypeScript usage examples, badges, and structure"]
-  GenDocs --> GenOnboarding["Outputs AGENTS.md defining the developer agent rules for the repo"]
-  GenOnboarding --> Done([Clean, standardized documentation committed])
-```
-
----
-
-## 4. Verification Check
-
-To ensure that the `repo-docs` skill is operating in strict compliance with Harness OS design laws, verify the following:
-
-- [ ] **Physical Boundary Verification**: The skill boundaries are respected and do not leak context.
-- [ ] **State Checkpoint Verification**: The active state is established, validated, and recorded at the beginning and end of each execution branch.
-- [ ] **Cognitive Alignment**: The skill conforms to the **Think > Try > Summarize > Record** cognitive loop.
+# Workflow: Repo Docs
+
+> Generates high-quality, professional README.md and AGENTS.md files based on actual workspace structures and product-archetype templates.
+
+---
+
+## 1. Skill Behavior Workflow
+
+This section visualizes how the `repo-docs` skill executes internally, detailing the sequence of operations, state transitions, and evaluation steps.
+
+```mermaid
+graph TD
+  Start([Generate / Update Repository Docs]) --> AuditProjectStructure["Audit workspace directory tree & build configs"]
+  AuditProjectStructure --> CheckExisting{Existing README / AGENTS File Found?}
+  
+  CheckExisting -->|Yes| ReadOld["Read Existing File & Extract Bespoke Notes (env vars, URLs, gotchas)"]
+  CheckExisting -->|No| ClassifyProductArchetype["Classify repository archetype"]
+  
+  ReadOld --> ClassifyProductArchetype
+  ClassifyProductArchetype --> LoadTemplates["Load standard README and AGENTS templates"]
+  LoadTemplates --> SmartMerge["Smartly Merge Codebase Facts + Bespoke Notes + Template Structure"]
+  SmartMerge --> FormatMarkdown["Format documents following clean layout rules"]
+  FormatMarkdown --> WriteFiles["Save / Merge README.md and AGENTS.md at Root or .github/"]
+  WriteFiles --> End([Professional onboarding documentation created without losing history])
+```
+
+---
+
+## 2. Triggering and Routing Path
+
+This diagram illustrates how the `repo-docs` skill is triggered through user requests or developer actions, and how it integrates or chains together with other companion skills in the Harness OS ecosystem to form unified workflows.
+
+```mermaid
+graph LR
+  Router["harness-everything / tier-router.js"] -->|Keyword: doc / readme / agents-template| RepoDocs["repo-docs / SKILL.md"]
+  RepoDocs -->|Integrates frontmatter constraints into| BMAS["multi-agent-workspace / SKILL.md"]
+  RepoDocs -->|Leverages ADR details generated in| GWD["grill-with-docs / SKILL.md"]
+```
+
+---
+
+## 3. Real-World Use Case Flowchart
+
+Here we model concrete real-world scenarios and use cases of the `repo-docs` skill, illustrating standard success paths, error handling, or recovery loops.
+
+```mermaid
+graph TD
+  Start["New library lacks onboarding docs and setup details"] --> Trigger["repo-docs skill invoked"]
+  Trigger --> Scan["Scans folders: discovers it's a TypeScript utility package"]
+  Scan --> MatchTemplate["Loads library archetype README template"]
+  MatchTemplate --> GenDocs["Outputs README.md with TypeScript usage examples, badges, and structure"]
+  GenDocs --> GenOnboarding["Outputs AGENTS.md defining the developer agent rules for the repo"]
+  GenOnboarding --> Done([Clean, standardized documentation committed])
+```
+
+---
+
+## 4. Verification Check
+
+To ensure that the `repo-docs` skill is operating in strict compliance with Harness OS design laws, verify the following:
+
+- [ ] **Physical Boundary Verification**: The skill boundaries are respected and do not leak context.
+- [ ] **State Checkpoint Verification**: The active state is established, validated, and recorded at the beginning and end of each execution branch.
+- [ ] **Cognitive Alignment**: The skill conforms to the **Think > Try > Summarize > Record** cognitive loop.

package/docs/workflows/rewrite-commits.md

@@ -1,60 +1,60 @@
-# Workflow: Rewrite Commits
-
-> Safely rewrites or squashes a specified range of commits into highly professional, Conventional Commits (Angular style) on a new branch.
-
----
-
-## 1. Skill Behavior Workflow
-
-This section visualizes how the `rewrite-commits` skill executes internally, detailing the sequence of operations, state transitions, and evaluation steps.
-
-```mermaid
-graph TD
-  Start([Define Commit Range]) --> BackupBranch["Create a backup branch of current state"]
-  BackupBranch --> ReadCommits["Read all commit messages in the range"]
-  ReadCommits --> AnalyzeDiffs["Read files & diffs associated with each commit"]
-  AnalyzeDiffs --> GenNewMessages["Generate high-quality Angular-style messages for each diff"]
-  GenNewMessages --> SoftReset["Execute git reset --soft to merge range changes"]
-  SoftReset --> ReapplyCommits["Re-apply changes with perfectly clean, segmented commit history"]
-  ReapplyCommits --> VerifyBranch["Run verification checks on the final rebuilt branch"]
-  VerifyBranch --> End([Perfectly clean Git history on new branch])
-```
-
----
-
-## 2. Triggering and Routing Path
-
-This diagram illustrates how the `rewrite-commits` skill is triggered through user requests or developer actions, and how it integrates or chains together with other companion skills in the Harness OS ecosystem to form unified workflows.
-
-```mermaid
-graph LR
-  Router["harness-everything / tier-router.js"] -->|Keyword: commit / rewrite / squash| Rewrite["rewrite-commits / SKILL.md"]
-  Rewrite -->|Supplements convention templates in| GitCommit["git-commit / SKILL.md"]
-  Rewrite -->|Pre-verify rewritten commits via| VerLoop["verification-loop / SKILL.md"]
-```
-
----
-
-## 3. Real-World Use Case Flowchart
-
-Here we model concrete real-world scenarios and use cases of the `rewrite-commits` skill, illustrating standard success paths, error handling, or recovery loops.
-
-```mermaid
-graph TD
-  Start["Branch has messy commits: 'fixed stuff', 'more fixes', 'bug'"] --> Trigger["Rewrite-commits skill run for HEAD~3"]
-  Trigger --> Backup["Backup branch 'backup-feature-x' created"]
-  Trigger --> GatherDiffs["Analyze total diff across the 3 messy commits"]
-  GatherDiffs --> Generate完美["Determine changes relate to user auth session handling"]
-  Generate完美 --> Rebuild["Reset and make 1 perfect commit: 'fix(auth): correct token refresh race condition'"]
-  Rebuild --> Done([Clean, reviewable PR history ready])
-```
-
----
-
-## 4. Verification Check
-
-To ensure that the `rewrite-commits` skill is operating in strict compliance with Harness OS design laws, verify the following:
-
-- [ ] **Physical Boundary Verification**: The skill boundaries are respected and do not leak context.
-- [ ] **State Checkpoint Verification**: The active state is established, validated, and recorded at the beginning and end of each execution branch.
-- [ ] **Cognitive Alignment**: The skill conforms to the **Think > Try > Summarize > Record** cognitive loop.
+# Workflow: Rewrite Commits
+
+> Safely rewrites or squashes a specified range of commits into highly professional, Conventional Commits (Angular style) on a new branch.
+
+---
+
+## 1. Skill Behavior Workflow
+
+This section visualizes how the `rewrite-commits` skill executes internally, detailing the sequence of operations, state transitions, and evaluation steps.
+
+```mermaid
+graph TD
+  Start([Define Commit Range]) --> BackupBranch["Create a backup branch of current state"]
+  BackupBranch --> ReadCommits["Read all commit messages in the range"]
+  ReadCommits --> AnalyzeDiffs["Read files & diffs associated with each commit"]
+  AnalyzeDiffs --> GenNewMessages["Generate high-quality Angular-style messages for each diff"]
+  GenNewMessages --> SoftReset["Execute git reset --soft to merge range changes"]
+  SoftReset --> ReapplyCommits["Re-apply changes with perfectly clean, segmented commit history"]
+  ReapplyCommits --> VerifyBranch["Run verification checks on the final rebuilt branch"]
+  VerifyBranch --> End([Perfectly clean Git history on new branch])
+```
+
+---
+
+## 2. Triggering and Routing Path
+
+This diagram illustrates how the `rewrite-commits` skill is triggered through user requests or developer actions, and how it integrates or chains together with other companion skills in the Harness OS ecosystem to form unified workflows.
+
+```mermaid
+graph LR
+  Router["harness-everything / tier-router.js"] -->|Keyword: commit / rewrite / squash| Rewrite["rewrite-commits / SKILL.md"]
+  Rewrite -->|Supplements convention templates in| GitCommit["git-commit / SKILL.md"]
+  Rewrite -->|Pre-verify rewritten commits via| VerLoop["verification-loop / SKILL.md"]
+```
+
+---
+
+## 3. Real-World Use Case Flowchart
+
+Here we model concrete real-world scenarios and use cases of the `rewrite-commits` skill, illustrating standard success paths, error handling, or recovery loops.
+
+```mermaid
+graph TD
+  Start["Branch has messy commits: 'fixed stuff', 'more fixes', 'bug'"] --> Trigger["Rewrite-commits skill run for HEAD~3"]
+  Trigger --> Backup["Backup branch 'backup-feature-x' created"]
+  Trigger --> GatherDiffs["Analyze total diff across the 3 messy commits"]
+  GatherDiffs --> Generate完美["Determine changes relate to user auth session handling"]
+  Generate完美 --> Rebuild["Reset and make 1 perfect commit: 'fix(auth): correct token refresh race condition'"]
+  Rebuild --> Done([Clean, reviewable PR history ready])
+```
+
+---
+
+## 4. Verification Check
+
+To ensure that the `rewrite-commits` skill is operating in strict compliance with Harness OS design laws, verify the following:
+
+- [ ] **Physical Boundary Verification**: The skill boundaries are respected and do not leak context.
+- [ ] **State Checkpoint Verification**: The active state is established, validated, and recorded at the beginning and end of each execution branch.
+- [ ] **Cognitive Alignment**: The skill conforms to the **Think > Try > Summarize > Record** cognitive loop.

package/docs/workflows/security-review.md

@@ -1,58 +1,77 @@
-# Workflow: Security Review
-
-> Automated security scanning, threat modeling, and input-validation reviews to identify potential security holes and enforce robust safety guardrails.
-
----
-
-## 1. Skill Behavior Workflow
-
-This section visualizes how the `security-review` skill executes internally, detailing the sequence of operations, state transitions, and evaluation steps.
-
-```mermaid
-graph TD
-  Start([Code Refactoring / Feature Done]) --> ScanInputs["Locate all user input and API boundary points"]
-  ScanInputs --> ThreatModeling["Perform threat modeling on data flow"]
-  ThreatModeling --> CheckCommonVulnerabilities["Check for SQL Injection, XSS, CSRF, and broken access controls"]
-  CheckCommonVulnerabilities --> AuditDependencies["Scan package dependencies for known CVE vulnerabilities"]
-  AuditDependencies --> FlagSinks["Flag insecure coding patterns, hardcoded secrets, or raw exec commands"]
-  FlagSinks --> CompileSecurityReport["Compile actionable security hardening proposal"]
-  CompileSecurityReport --> End([Codebase hardened and verified secure])
-```
-
----
-
-## 2. Triggering and Routing Path
-
-This diagram illustrates how the `security-review` skill is triggered through user requests or developer actions, and how it integrates or chains together with other companion skills in the Harness OS ecosystem to form unified workflows.
-
-```mermaid
-graph LR
-  Router["harness-everything / tier-router.js"] -->|Pre-flight / Quality PR reviews| SecReview["security-review / SKILL.md"]
-  SecReview -->|Informs security tests written in| TDD["tdd / SKILL.md"]
-  SecReview -->|Integrated as mandatory PR gate in| VerLoop["verification-loop / SKILL.md"]
-```
-
----
-
-## 3. Real-World Use Case Flowchart
-
-Here we model concrete real-world scenarios and use cases of the `security-review` skill, illustrating standard success paths, error handling, or recovery loops.
-
-```mermaid
-graph TD
-  Start["New search feature: executes system shell query using raw user input string"] --> Trigger["security-review skill runs"]
-  Trigger --> Scan["Flags potential command injection vulnerability in search.js"]
-  Scan --> Propose["Propose input sanitization and switching to child_process.execFile with argument array"]
-  Propose --> Implement["Refactor code to use safe argument arrays instead of raw string shell execution"]
-  Implement --> Done([Critical remote code execution vulnerability resolved])
-```
-
----
-
-## 4. Verification Check
-
-To ensure that the `security-review` skill is operating in strict compliance with Harness OS design laws, verify the following:
-
-- [ ] **Physical Boundary Verification**: The skill boundaries are respected and do not leak context.
-- [ ] **State Checkpoint Verification**: The active state is established, validated, and recorded at the beginning and end of each execution branch.
-- [ ] **Cognitive Alignment**: The skill conforms to the **Think > Try > Summarize > Record** cognitive loop.
+# Workflow: Security Review
+
+> Automated security scanning, threat modeling, and input-validation reviews to identify potential security holes and enforce robust safety guardrails.
+
+---
+
+## 1. Skill Behavior Workflow
+
+This section visualizes how the `security-review` skill executes internally, detailing the sequence of operations, state transitions, and evaluation steps.
+
+```mermaid
+graph TD
+  Start([Code Refactoring / Feature Done / Security Audit]) --> STRIDE["1. STRIDE Threat Modeling & Abuse Case Design"]
+  STRIDE --> CheckScript{2. Is audit-secrets.js Executable?}
+  
+  CheckScript -->|Yes| RunAudit["Run node security-review/scripts/audit-secrets.js"]
+  CheckScript -->|No / Fails| GrepFallback["Scan Workspace Secrets & Inputs via grep_search"]
+  
+  RunAudit --> CheckVun{3. Detect Vulnerabilities or Leaks?}
+  GrepFallback --> CheckVun
+  
+  CheckVun -->|Hardcoded Secrets| FixSecrets["Always Do: Refactor to process.env & .env.local"]
+  CheckVun -->|SQL Concatenation| FixSQL["Always Do: Refactor to Parameterized Queries / ORM"]
+  CheckVun -->|Unvalidated Input| FixInput["Always Do: Add Zod Schema Validation"]
+  CheckVun -->|High-Risk Auth Shift| AskUser["Ask First: Require User Approval for Auth Shift"]
+  
+  FixSecrets --> CompileSecurityReport["4. Compile Security Audit Report"]
+  FixSQL --> CompileSecurityReport
+  FixInput --> CompileSecurityReport
+  AskUser -->|Approved| CompileSecurityReport
+  CheckVun -->|Clean| CompileSecurityReport
+  
+  CompileSecurityReport --> ResolveReportPath{5. Resolve Audit Report Path}
+  ResolveReportPath -->|docs/ Exists| WriteDocs["Save to docs/security-audit.md"]
+  ResolveReportPath -->|Protected / No Folder| WritePlatform["Save to .github/harness-everything/security-audit.md"]
+  
+  WriteDocs --> End([Codebase hardened and verified secure])
+  WritePlatform --> End
+```
+
+---
+
+## 2. Triggering and Routing Path
+
+This diagram illustrates how the `security-review` skill is triggered through user requests or developer actions, and how it integrates or chains together with other companion skills in the Harness OS ecosystem to form unified workflows.
+
+```mermaid
+graph LR
+  Router["harness-everything / tier-router.js"] -->|Pre-flight / Quality PR reviews| SecReview["security-review / SKILL.md"]
+  SecReview -->|Informs security tests written in| TDD["tdd / SKILL.md"]
+  SecReview -->|Integrated as mandatory PR gate in| VerLoop["verification-loop / SKILL.md"]
+```
+
+---
+
+## 3. Real-World Use Case Flowchart
+
+Here we model concrete real-world scenarios and use cases of the `security-review` skill, illustrating standard success paths, error handling, or recovery loops.
+
+```mermaid
+graph TD
+  Start["New search feature: executes system shell query using raw user input string"] --> Trigger["security-review skill runs"]
+  Trigger --> Scan["Flags potential command injection vulnerability in search.js"]
+  Scan --> Propose["Propose input sanitization and switching to child_process.execFile with argument array"]
+  Propose --> Implement["Refactor code to use safe argument arrays instead of raw string shell execution"]
+  Implement --> Done([Critical remote code execution vulnerability resolved])
+```
+
+---
+
+## 4. Verification Check
+
+To ensure that the `security-review` skill is operating in strict compliance with Harness OS design laws, verify the following:
+
+- [ ] **Physical Boundary Verification**: The skill boundaries are respected and do not leak context.
+- [ ] **State Checkpoint Verification**: The active state is established, validated, and recorded at the beginning and end of each execution branch.
+- [ ] **Cognitive Alignment**: The skill conforms to the **Think > Try > Summarize > Record** cognitive loop.

package/docs/workflows/self-evolve.md

@@ -1,59 +1,42 @@
-# Workflow: Self-Evolve
-
-> Analyzes execution logs and session memories to extract underlying root causes, defining new error boundaries and compressing them into cognitive guardrails.
-
----
-
-## 1. Skill Behavior Workflow
-
-This section visualizes how the `self-evolve` skill executes internally, detailing the sequence of operations, state transitions, and evaluation steps.
-
-```mermaid
-graph TD
-  Start([Task Completed / Error Loop Triggered]) --> ReadSessionLogs["Read active debugging logs & session history"]
-  ReadSessionLogs --> IdentifyRootCauses["Isolate and extract system failures or bottlenecks"]
-  IdentifyRootCauses --> SynthesizeGuardrails["Formulate actionable high-level cognitive guardrails"]
-  SynthesizeGuardrails --> CompressMemories["Compress repetitive events into compact markdown files in /memories/"]
-  CompressMemories --> UpdateUserMemory["Commit lessons learned to user memory space"]
-  UpdateUserMemory --> End([Agent cognitive defense expanded for future sessions])
-```
-
----
-
-## 2. Triggering and Routing Path
-
-This diagram illustrates how the `self-evolve` skill is triggered through user requests or developer actions, and how it integrates or chains together with other companion skills in the Harness OS ecosystem to form unified workflows.
-
-```mermaid
-graph LR
-  SessionEnd["Task Completed / Session Closed"] --> Evolve["self-evolve / SKILL.md"]
-  Evolve -->|Reads from| HistoryLog["VS Code Debug logs & memory directories"]
-  Evolve -->|Writes permanent updates to| UserMemory["/memories/ / user-memory files"]
-  Evolve -->|Informs future task triage in| Router["harness-everything / tier-router.js"]
-```
-
----
-
-## 3. Real-World Use Case Flowchart
-
-Here we model concrete real-world scenarios and use cases of the `self-evolve` skill, illustrating standard success paths, error handling, or recovery loops.
-
-```mermaid
-graph TD
-  Start["Session ends after solving a recurring, messy Windows path-slashes bug"] --> Trigger["self-evolve skill runs automatically"]
-  Trigger --> Analyze["Reads last 5 execution logs"]
-  Analyze --> DetectPattern["Finds 3 consecutive terminal command failures caused by path backslashes in PowerShell"]
-  DetectPattern --> Formulate["Formulate new guardrail: 'When on Windows, convert backslashes to forward slashes for cross-shell command lines'"]
-  Formulate --> Write["Write bullet point to /memories/debugging.md"]
-  Write --> Done([Memory recorded: future sessions will automatically avoid Windows path errors])
-```
-
----
-
-## 4. Verification Check
-
-To ensure that the `self-evolve` skill is operating in strict compliance with Harness OS design laws, verify the following:
-
-- [ ] **Physical Boundary Verification**: The skill boundaries are respected and do not leak context.
-- [ ] **State Checkpoint Verification**: The active state is established, validated, and recorded at the beginning and end of each execution branch.
-- [ ] **Cognitive Alignment**: The skill conforms to the **Think > Try > Summarize > Record** cognitive loop.
+# Workflow: Self-Evolve
+
+> The host agent supplies relevant session evidence and a generalized root-cause analysis. `self-evolve` classifies, validates, and persists the lesson; it does not collect host transcripts.
+
+Load `self-evolve/references/memory-resolution.md` on demand when the persistence decision, fallback path, lazy-loading rule, or dynamic-skill registration details are needed.
+
+## 1. Responsibility boundary
+
+The host agent may inspect the current session and any history explicitly exposed by the host. It selects the evidence and states the reusable root cause. `self-evolve` MUST NOT scan global host transcript stores or persist raw transcripts.
+
+## 2. Persistence flow
+
+```mermaid
+graph TD
+  Start([Agent has resolved a recurring problem]) --> Evidence["Agent selects allowed evidence and states root cause"]
+  Evidence --> Memory{Existing workspace memory?}
+  Memory -->|Yes| Lines{Target under 60 lines?}
+  Memory -->|No| Route["Choose workspace memory fallback"]
+  Lines -->|Yes| Append["Append concise rule"]
+  Lines -->|No| Modular["Create topic memory and add lazy-load pointer"]
+  Route --> Append
+  Append --> Validate["Run self-evolve self-regression and quality gates"]
+  Modular --> Validate
+  Evidence -->|Reusable multi-step pattern| Dynamic["Load skill-creator, create draft skill, register generated[]"]
+  Dynamic --> Validate
+  Validate --> Done([Lesson persisted])
+```
+
+## 3. Triggering and routing
+
+The agent invokes `self-evolve/SKILL.md` after a resolved struggle, zoom-out recovery, or explicit request. It passes the selected evidence and root cause to `persist-memory.js`, or routes a reusable pattern through `skill-creator` and `register-dynamic-skill.js`. The router later matches registered `generated[]` metadata; this is not an automatic transcript scan.
+
+## 4. Example
+
+After resolving a recurring Windows path error, the agent summarizes the cause, checks existing memory, and chooses either a concise rule or a draft dynamic skill. It runs the relevant quality/self-regression gate before persistence and records only the generalized lesson.
+
+## 5. Verification checklist
+
+- [ ] Evidence came from the host context the agent is authorized to inspect.
+- [ ] No raw transcript, secret, or one-off detail was persisted.
+- [ ] Rule/dynamic-skill classification and deduplication passed.
+- [ ] Self-regression passed before the memory or manifest changed.