harness-everything 0.31.3 → 0.33.0

package/ci/mechanism-2ba-step-type-docs.test.js

@@ -0,0 +1,166 @@
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+const registryFile = path.join(ROOT, 'hooks', 'scripts', 'lib', 'step-types.json');
+const routerFile = path.join(ROOT, 'harness-everything', 'scripts', 'kernel-router.js');
+const AUTHORITATIVE_DOC = 'harness-everything/references/router-workflow-plan.md';
+const ALLOWED_LIST_DOCS = [
+  'docs/routing.md',
+  'harness-everything/references/router-workflow-plan.md',
+  'harness-everything/references/triage-and-tiers.md',
+  'docs/workflows/harness-everything.md',
+];
+const START = '<!-- step-types:start -->';
+const END = '<!-- step-types:end -->';
+const FIX_PROMPT = 'Fix this checkout bug and add a regression test.';
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-step-type-docs-'));
+let failed = 0;
+
+process.on('exit', () => fs.rmSync(tempRoot, { recursive: true, force: true }));
+
+console.log('\n[2ba] step-type registry documentation and router drift...');
+
+function check(name, ok, detail) {
+  if (ok) console.log(`✅ ${name}`);
+  else {
+    failed++;
+    console.log(`❌ ${name}`);
+    if (detail) console.log(`   ${detail}`);
+  }
+}
+
+function checkCase(name, run) {
+  try {
+    run();
+    check(name, true);
+  } catch (error) {
+    check(name, false, error && error.message ? error.message : String(error));
+  }
+}
+
+// Independent oracle: renders the registry directly from the JSON file, not through the runtime loader.
+function renderRegistry(entries) {
+  const byId = (left, right) => (left.id < right.id ? -1 : left.id > right.id ? 1 : 0);
+  const list = bindings => bindings.map(binding => `\`${binding}\``).join(', ') || 'none';
+  return entries.slice().sort(byId).map(entry =>
+    `- \`${entry.id}\` — required bindings: ${list(entry.requiredBindings)} — forbidden bindings: ${list(entry.forbiddenBindings)}`,
+  );
+}
+
+function markerBlocks(text, label) {
+  const lines = text.split('\n');
+  const blocks = [];
+  let openAt = null;
+  lines.forEach((line, index) => {
+    const marker = line.trim();
+    if (marker === START) {
+      if (openAt !== null) throw new Error(`${label}: nested step-types:start at line ${index + 1}`);
+      openAt = index;
+    } else if (marker === END) {
+      if (openAt === null) throw new Error(`${label}: step-types:end without start at line ${index + 1}`);
+      blocks.push(lines.slice(openAt + 1, index).map(item => item.trim()).filter(Boolean));
+      openAt = null;
+    }
+  });
+  if (openAt !== null) throw new Error(`${label}: step-types:start is never closed`);
+  return blocks;
+}
+
+function routeFixPrompt(runtimeRoot, workspace) {
+  const home = path.join(tempRoot, `home-${Math.random().toString(36).slice(2)}`);
+  fs.mkdirSync(home, { recursive: true });
+  const payload = { session_id: `2ba-${Math.random().toString(36).slice(2)}`, cwd: workspace, prompt: FIX_PROMPT };
+  return spawnSync(process.execPath, [path.join(runtimeRoot, 'harness-everything', 'scripts', 'kernel-router.js')], {
+    cwd: workspace,
+    encoding: 'utf8',
+    input: JSON.stringify(payload),
+    env: {
+      ...process.env,
+      HARNESS_STATE_HOME: path.join(tempRoot, 'state'),
+      HARNESS_WORKSPACE_ROOT: workspace,
+      HOME: home,
+      USERPROFILE: home,
+    },
+  });
+}
+
+const registry = JSON.parse(fs.readFileSync(registryFile, 'utf8'));
+const registryIds = registry.map(entry => entry.id).sort();
+const expectedLines = renderRegistry(registry);
+
+checkCase('2ba. every step-types marker block in the allowed-list docs equals the registry rendering', () => {
+  let total = 0;
+  for (const doc of ALLOWED_LIST_DOCS) {
+    const blocks = markerBlocks(fs.readFileSync(path.join(ROOT, doc), 'utf8'), doc);
+    for (const block of blocks) {
+      total++;
+      if (JSON.stringify(block) !== JSON.stringify(expectedLines)) {
+        throw new Error(`${doc} marker block drifted from the registry:\n${block.join('\n')}\nexpected:\n${expectedLines.join('\n')}`);
+      }
+    }
+  }
+  if (total === 0) throw new Error('no step-types marker block found in any allowed-list doc');
+  const authoritative = markerBlocks(fs.readFileSync(path.join(ROOT, AUTHORITATIVE_DOC), 'utf8'), AUTHORITATIVE_DOC);
+  if (authoritative.length !== 1) throw new Error(`${AUTHORITATIVE_DOC} must carry exactly one step-types marker block; found ${authoritative.length}`);
+});
+
+checkCase('2ba. router lists exactly the registry step-type ids', () => {
+  const routed = routeFixPrompt(ROOT, ROOT);
+  if (routed.status !== 0) throw new Error(`router exited ${routed.status}: ${routed.stderr}`);
+  const match = routed.stdout.match(/Record ordered step types \(([^)]*)\) and their bindings/);
+  if (!match) throw new Error('router did not print the ordered step-type list');
+  const listed = match[1].split(',').map(item => item.trim());
+  if (JSON.stringify(listed) !== JSON.stringify(registryIds)) {
+    throw new Error(`router listed [${listed.join(', ')}]; registry ids are [${registryIds.join(', ')}]`);
+  }
+});
+
+checkCase('2ba. router example plan does not steer step authoring toward behavior-change', () => {
+  const routed = routeFixPrompt(ROOT, ROOT);
+  const recordPlan = routed.stdout.split('\n').find(line => line.includes('Record plan:')) || '';
+  if (!recordPlan) throw new Error('router did not print a Record plan example');
+  if (recordPlan.includes('behavior-change')) throw new Error(`example still hard-codes behavior-change: ${recordPlan}`);
+});
+
+checkCase('2ba. router prints the explicit-choice guidance line exactly once in fresh tier2 output', () => {
+  const guidance = '- Replace <step-type-id> with a registered type you choose explicitly; mixed docs+code work uses separate doc-change and behavior-change steps; keep the verification step.';
+  const routed = routeFixPrompt(ROOT, ROOT);
+  if (routed.status !== 0) throw new Error(`router exited ${routed.status}: ${routed.stderr}`);
+  const matches = routed.stdout.split('\n').filter(line => line.trim() === guidance);
+  if (matches.length !== 1) throw new Error(`expected the guidance line exactly once; found ${matches.length}`);
+});
+
+checkCase('2ba. router record-plan guidance keeps the space after "node" in fresh tier2 output', () => {
+  const routed = routeFixPrompt(ROOT, ROOT);
+  if (routed.status !== 0) throw new Error(`router exited ${routed.status}: ${routed.stderr}`);
+  if (!routed.stdout.includes('   - Record plan: node "')) {
+    throw new Error(`router record-plan line lacks "Record plan: node"; got: ${routed.stdout.split('\n').find(line => line.includes('Record plan')) || '(none)'}`);
+  }
+});
+
+checkCase('2ba. router never crashes or prints a stale step-type list when the registry is missing', () => {
+  const copy = path.join(tempRoot, 'runtime-without-registry');
+  fs.cpSync(ROOT, copy, {
+    recursive: true,
+    filter: source => !/[\\/](node_modules|\.git|benchmarks|plugins)([\\/]|$)/.test(source),
+  });
+  fs.rmSync(path.join(copy, 'hooks', 'scripts', 'lib', 'step-types.json'));
+  const routed = routeFixPrompt(copy, copy);
+  if (routed.status !== 0) throw new Error(`router exited ${routed.status} without the registry: ${routed.stderr}`);
+  if (/Record ordered step types \(/.test(routed.stdout)) throw new Error('router printed a step-type list without a registry');
+  if (!routed.stderr.includes('cannot load step-type registry')) {
+    throw new Error(`router did not surface the missing registry visibly; stderr: ${routed.stderr}`);
+  }
+});
+
+checkCase('2ba. router-workflow-plan documents old-runtime rejection of persisted doc-change plans', () => {
+  const text = fs.readFileSync(path.join(ROOT, AUTHORITATIVE_DOC), 'utf8');
+  for (const required of ['doc-change', 'declared-only', 'planning:steps-invalid']) {
+    if (!text.includes(required)) throw new Error(`${AUTHORITATIVE_DOC} must mention ${required}`);
+  }
+});
+
+process.exitCode = failed ? 1 : 0;

package/ci/openai-plugin-package.test.js

@@ -104,7 +104,7 @@ const packagedSkillNames = fs.readdirSync(path.join(PLUGIN, 'skills'), { withFil
   .filter(entry => entry.isDirectory())
   .map(entry => entry.name)
   .sort();
-assert.strictEqual(skillNames.length, 26, 'canonical suite should contain 26 skills');
+assert.strictEqual(skillNames.length, 27, 'canonical suite should contain 27 skills');
 assert.deepStrictEqual(packagedSkillNames, skillNames, 'OpenAI package must contain exactly the canonical skill set');
 for (const entry of SOURCE_MANIFEST.skills) {
   const source = path.resolve(ROOT, entry);

package/ci/release-consistency-check.js

@@ -43,6 +43,22 @@ const releaseRenames = new Map([
   ['create-agent-launcher', 'multi-agent-workspace']
 ]);
 
+function logicalSkillName(skill) {
+  return releaseRenames.get(skill) || skill;
+}
+
+function compareSkillCatalogs(tagSkills, currentSkills) {
+  const releaseLogical = new Set(tagSkills.map(logicalSkillName));
+  const currentLogical = new Set(currentSkills.map(logicalSkillName));
+  const missing = [...releaseLogical].filter(skill => !currentLogical.has(skill)).sort();
+  const additions = [...new Set(currentSkills.filter(skill => !releaseLogical.has(logicalSkillName(skill))))].sort();
+  return { missing, additions, exitCode: missing.length ? 1 : 0 };
+}
+
+function formatAdditions(additions) {
+  return additions.length ? `Additions since release tag: ${additions.join(', ')}` : '';
+}
+
 function git(args) {
   return execFileSync('git', args, { cwd: root, encoding: 'utf8' }).trim();
 }
@@ -90,15 +106,13 @@ function main() {
     process.exit(2);
   }
   const current = new Set(discoverSkills(root));
-  const currentLogical = new Set([...current].map(skill => releaseRenames.get(skill) || skill));
-  const releaseLogical = new Set(tagRoot.map(skill => releaseRenames.get(skill) || skill));
-  const missing = [...releaseLogical].filter(skill => !currentLogical.has(skill));
-  const extra = [...currentLogical].filter(skill => !releaseLogical.has(skill));
+  const comparison = compareSkillCatalogs(tagRoot, [...current]);
   console.log(`Release ${tag}: ${tagRoot.length} skill(s); current tree: ${current.size} skill(s).`);
-  if (missing.length || extra.length) {
-    if (missing.length) console.error(`Missing from current tree: ${missing.join(', ')}`);
-    if (extra.length) console.error(`Not present in release tag: ${extra.join(', ')}`);
-    process.exit(1);
+  const additionsLine = formatAdditions(comparison.additions);
+  if (additionsLine) console.log(additionsLine);
+  if (comparison.exitCode !== 0) {
+    console.error(`Missing from current tree: ${comparison.missing.join(', ')}`);
+    process.exit(comparison.exitCode);
   }
 
   let references = 0;
@@ -140,7 +154,10 @@ function main() {
     console.error(`CURRENT RELEASE CHECK FAILED: ${currentReferences.failures.length} dangling reference(s).`);
     process.exit(1);
   }
-  console.log(`RELEASE SKILL CATALOG PASSED for ${tag}; current source has the same logical skill catalog (${tagRoot.length} release entries, ${current.size} current directories after merges).`);
+  const additionLabel = comparison.additions.length === 1 ? 'addition' : 'additions';
+  console.log(`RELEASE SKILL BASELINE PASSED for ${tag}: all ${tagRoot.length} release-tag skills remain present; current source has ${current.size} skill(s), including ${comparison.additions.length} ${additionLabel} not yet in the tag.`);
 }
 
 if (require.main === module) main();
+
+module.exports = { compareSkillCatalogs, formatAdditions };

package/ci/release-consistency-check.test.js

@@ -0,0 +1,30 @@
+'use strict';
+
+const assert = require('assert');
+const { compareSkillCatalogs, formatAdditions } = require('./release-consistency-check');
+
+const addedSkill = compareSkillCatalogs(
+  ['existing-skill'],
+  ['code-review', 'existing-skill']
+);
+assert.deepStrictEqual(addedSkill.missing, [], 'a release-tag skill must remain present');
+assert.deepStrictEqual(addedSkill.additions, ['code-review']);
+assert.strictEqual(addedSkill.exitCode, 0, 'an extra current skill is informational');
+assert.strictEqual(formatAdditions(addedSkill.additions), 'Additions since release tag: code-review');
+
+const missingSkill = compareSkillCatalogs(
+  ['existing-skill', 'removed-skill'],
+  ['existing-skill']
+);
+assert.deepStrictEqual(missingSkill.missing, ['removed-skill']);
+assert.strictEqual(missingSkill.exitCode, 1, 'a released skill missing from current source must fail');
+
+const renamedSkill = compareSkillCatalogs(
+  ['build-multi-agent-system'],
+  ['multi-agent-workspace']
+);
+assert.deepStrictEqual(renamedSkill.missing, [], 'the established rename must satisfy the released entry');
+assert.deepStrictEqual(renamedSkill.additions, [], 'a rename must not be reported as a new addition');
+assert.strictEqual(renamedSkill.exitCode, 0);
+
+console.log('Release consistency catalog additions, missing-skill failures, and rename mapping verified.');

package/ci/router-workflow-plan.test.js

@@ -27,6 +27,12 @@ function check(condition, message) {
   }
 }
 
+function reviewBindingIds(run) {
+  const text = `${run.result.stdout || ''}\n${run.result.stderr || ''}`;
+  const line = text.match(/Candidate step binding ids: ([^\r\n]+)/);
+  return line ? line[1].split(',').map(id => id.trim()).filter(Boolean) : [];
+}
+
 function runTier(prompt, options = {}) {
   const contractPath = path.join(os.tmpdir(), `harness-router-test-${process.pid}-${Math.random().toString(16).slice(2)}.json`);
   const context = options.context || null;
@@ -91,6 +97,36 @@ if (validContract(iterative, 'iterative-single')) {
   check(!plan.requiredInvariants.includes('tdd'), 'binding ids remain step-local rather than workflow invariants');
 }
 
+const reviewPositives = [
+  'Review PR #412 before we merge it',
+  'Review pull request #412',
+  'Review this PR before merge',
+  'Review the diff',
+  'Review the implementation',
+  'Re-review the fix at the new HEAD',
+];
+const reviewNegatives = [
+  'review project plan',
+  'review proposal',
+  'review process',
+  'preview pr environment',
+  'Review this proposal',
+  'Review the project plan',
+  'Review my process',
+  'Re-review the problem statement',
+  'Review my implementation plan, ask one question at a time',
+  'Preview the diff rendering',
+  'Preview PR #412 environment',
+];
+for (const prompt of reviewPositives) {
+  const run = runTier(prompt);
+  check(reviewBindingIds(run).includes('code-review'), `review signal: ${JSON.stringify(prompt)} yields the code-review candidate`);
+}
+for (const prompt of reviewNegatives) {
+  const run = runTier(prompt);
+  check(!reviewBindingIds(run).includes('code-review'), `review signal: ${JSON.stringify(prompt)} stays code-review-free`);
+}
+
 const memoryPersist = runTier('Persist this lesson as memory after resolving the checkout regression.');
 if (validContract(memoryPersist, 'self-evolve persistence')) {
   const plan = memoryPersist.contract.workflowPlan;

package/code-review/SKILL.md

@@ -0,0 +1,41 @@
+---
+name: code-review
+description: "Independently review a PR, diff or finished implementation for correctness, contract and negative-path defects, with source-anchored findings labelled executed, source-traced or inconclusive; read-only by default. USE FOR: \"review this PR before merge\", \"re-review the fix at the new HEAD\". DO NOT USE FOR: \"security threat modeling\", \"implementing or fixing the code\"."
+license: Apache-2.0
+metadata:
+  author: Miya Daniel
+  version: 0.33.0
+---
+
+# Code Review
+
+Independently review completed changes for correctness, contract violations, and negative-path defects. Default to read-only.
+
+## 📋 Skill Contract
+
+| Component | Specification |
+| :--- | :--- |
+| **Trigger / Input** | Requested review of a PR, diff, implementation, or revised HEAD. |
+| **Expected Output** | Source-anchored findings and an evidence-qualified summary. |
+| **State Mutations** | None unless the user explicitly authorizes an action. |
+| **Enforcement Gate** | Apply the checklist in `<this-skill-dir>/references/review-playbook.md`. |
+
+## USE FOR:
+- Review a PR / diff / finished implementation before merge
+- Re-review a revised HEAD: prior-finding disposition + new risks
+
+## DO NOT USE FOR:
+- Security-only threat modeling / secrets / OWASP (use `security-review`)
+- Design or plan stress-testing (use `grill-me`); running gates (use `verification-loop`); writing the fix (use `tdd`)
+
+## Workflow
+
+1. Pin repository, contract, base/head, changed scope, and CI state; inspect relevant callers and consumers.
+2. Independently trace behavior and test applicable counterexamples. Separate severity from safety conditions.
+3. Report only supported findings with evidence tier, smallest correction, regression, and positive control. Use `<this-skill-dir>/templates/finding.template.md`.
+4. On re-review, disposition every prior finding at the new HEAD, then inspect for regressions.
+5. Keep review read-only unless explicitly authorized. Do not claim “bug-free.”
+
+In the interim, bind explicitly on an existing review step: `{"stepType":"review","optionalBindings":["code-review"]}`.
+
+Deep dive: <this-skill-dir>/references/review-playbook.md

package/code-review/references/review-playbook.md

@@ -0,0 +1,40 @@
+# Review Playbook
+
+Use this checklist for the applicable risks; do not force irrelevant categories.
+
+## Establish scope and evidence
+
+- [ ] Pin repository, PR, base/head SHA, user requirement or PRD/ADR, changed files, relevant callers/callees, and current CI state. Avoid unrelated checkout areas.
+- [ ] Make an independent pass. Treat author explanations and tests as leads, not proof; derive expected behavior from contracts and source.
+- [ ] Label evidence honestly: **executed/reproduced** (command, result, environment, SHA); **source-traced** (concrete path and preconditions); **inconclusive** (missing facts or ambiguous semantics; do not present as a proven blocker).
+- [ ] Inventory user-facing entry points and configuration handoffs (CLI flags, cwd, path spellings, config loading). Exercise them end-to-end, not only the recently edited internals.
+- [ ] Reproduce a candidate finding against the PR base before classifying it as new. Pre-existing defects are follow-ups, not new blockers.
+
+## Try applicable counterexamples
+
+- [ ] Missing, null, malformed input; old persisted state; base-to-candidate transitions; tenant/scope boundaries.
+- [ ] Missing or broken dependencies: enumerate every entry point, including help, recovery, and stop paths; inspect fallback behavior.
+- [ ] OS/shell differences; concurrency, crash, retry; user paths and symlinks; API/migration compatibility; downstream or generated views.
+- [ ] Follow each important diagnostic/fact through every consumer and ancestor. Check whether required facts are computed before derived authority, indexes, or output.
+- [ ] Compare new rules with previously accepted rules and controls. Separate display severity from safety prerequisites.
+
+## Check tests and output
+
+- [ ] Ask whether each test still passes if the behavior is disabled, bypassed, or broken (mutation thought experiment). Confirm the test is included in CI.
+- [ ] When output text changes, compare the intended changed lines with literal templates; do not exclude changed lines from assertions.
+- [ ] Dedupe findings. Use P1 for severe merge blockers, P2 for meaningful correctness/contract defects, P3 for low-risk issues; avoid speculation.
+- [ ] For each finding, include exact path:line or diff anchor at HEAD SHA, trigger, observed behavior, violated contract and impact, evidence tier, smallest fix, negative regression, positive control, and disposition.
+
+## Re-review and conclude
+
+- [ ] Pin the new HEAD. Disposition every prior finding separately: resolved, still open, superseded, or inconclusive. Then inspect fix-induced side effects and new changes.
+- [ ] Stay read-only unless the user/workflow explicitly authorizes action. Do not edit, comment, label, or merge on review authority alone.
+- [ ] Summarize scope/SHA, CI, covered and unexamined risks, fixed/open/new counts, and evidence-grounded merge recommendation. “No actionable findings in examined scope” does not mean “bug-free.” Distinguish repository tests from live-host evidence.
+
+## Per-finding format
+
+`[P1/P2/P3] Title` — `path:line @ <HEAD SHA>`
+
+**Trigger** → **behavior** → **contract violation / impact**. **Evidence:** executed / source-traced / inconclusive. **Minimal correction:** … **Regression:** negative case …; positive control … **Disposition:** blocker / follow-up / owner decision.
+
+Use `<this-skill-dir>/templates/finding.template.md` for the complete findings and summary form.

package/code-review/templates/finding.template.md

@@ -0,0 +1,33 @@
+# Code Review — <PR or change>
+
+## Scope and evidence
+
+- Repository / PR:
+- Base SHA → reviewed HEAD SHA:
+- Requirement / PRD / ADR:
+- Changed files and relevant callers/consumers:
+- CI state and commands observed:
+- Counterexample categories covered:
+- Risks not examined / evidence limits:
+
+## Findings
+
+### [P1/P2/P3] <Short, specific title>
+
+- **Location:** `<path>:<line or diff anchor> @ <HEAD SHA>`
+- **Trigger:** <minimal input, state transition, or interleaving>
+- **Behavior → impact:** <observed or source-traced behavior and violated contract>
+- **Evidence tier:** <executed/reproduced | source-traced | inconclusive; include exact command/result or preconditions>
+- **Minimal correction:** <smallest feasible fix>
+- **Regression:** Negative case: <case that fails before fix>; positive control: <valid behavior that remains valid>
+- **Disposition:** <blocker | follow-up | owner decision; for re-review, resolved | still open | superseded | inconclusive>
+
+<!-- Duplicate this finding section as needed. Remove headings for which there are no findings. -->
+
+## Summary
+
+- **Scope / reviewed SHA:**
+- **CI evidence:**
+- **Covered / unexamined risks:**
+- **Findings:** <fixed / open / new counts on re-review>
+- **Conclusion:** <merge recommendation grounded in evidence; “no actionable findings in examined scope” is not a claim of bug-free code>

package/docs/openai-plugin.md

@@ -74,7 +74,7 @@ The local package path is distinct from the general `--codex` installer. The gen
 The package tests prove the following repository-side contract:
 
 - the portable root manifest and `.codex-plugin` compatibility manifest agree on identity, version, interface, and hook entry point;
-- the root `skills/` tree contains exactly the 26 canonical skills;
+- the root `skills/` tree contains exactly the 27 canonical skills;
 - Windows and POSIX hook commands resolve through `PLUGIN_ROOT`;
 - session start emits the compact policy and prompt submission invokes invariant-first routing;
 - supported local `Bash` and `apply_patch` calls receive the packaged guards and state tracking;

package/docs/workflows/code-review.md

@@ -0,0 +1,58 @@
+# Workflow: Code Review
+
+> Independently review a PR, diff, or finished implementation for correctness, contract, and negative-path defects — read-only by default, with evidence-tiered, source-anchored findings.
+
+Source of truth: `code-review/SKILL.md`.
+
+Contract summary from SKILL.md — Trigger: requested review of a PR, diff, implementation, or revised HEAD. Output: source-anchored findings and an evidence-qualified summary. USE FOR: review a PR/diff/finished implementation before merge, re-review a revised HEAD (prior-finding disposition + new risks). DO NOT USE FOR: security-only threat modeling/secrets/OWASP (use `security-review`); design or plan stress-testing (use `grill-me`); running gates (use `verification-loop`); writing the fix (use `tdd`).
+
+## 1. Skill Behavior Workflow
+
+```mermaid
+graph TD
+  A[Pinned Repo Principle BB And CI State] --> B[Read Diff And Relevant Callers Callees]
+  B --> C[Map State Trust Fallback Consumers Tests]
+  C --> D[Construct Counterexamples And Negative Paths]
+  D --> E[Verify Findings Against Source And CI]
+  E --> F{Actionable Supported Finding}
+  F -->|yes| G[P1 P2 P3 Severity Plus Evidence Tier Plus Minimal Fix Plus Regression]
+  F -->|no| H[Discard Qualify Or Mark Inconclusive]
+  G --> I[Report Read Only Only Authorized Actions Post]
+  H --> I
+```
+
+## 2. Triggering and Routing Path
+
+```mermaid
+graph TD
+  ReviewReq[Review This PR Or Diff Request] --> Skill[code-review SKILL]
+  ReReviewReq[Re-Review Fix At New HEAD] --> Skill
+  SecurityReq[Threat Model Secrets OWASP] --> NotCodeReview[security-review SKILL]
+  DesignReq[Stress Test Plan Or Design] --> Grm[grill-me SKILL]
+  GateReq[Run Build Test Lint Gates] --> VL[verification-loop SKILL]
+  FixReq[Implement Or Fix] --> Tdd[tdd SKILL]
+```
+
+## 3. Re-Review Cycle
+
+```mermaid
+graph TD
+  New[Fix Pushed New HEAD] --> Pin[Pin New SHA And Diff]
+  Pin --> Prior[Disposition Every Prior Finding Resolved Open Superseded Inconclusive]
+  Prior --> Regress[Inspect Fix For Induced Side Effects And New Changes]
+  Regress --> Sum[Summary Scope SHA CI Fixed Open New Counts Evidence-Grounded Recommendation]
+  Sum -->|fix needed| Fix[Fix New Defects]
+  Fix --> Pin
+```
+
+Template: `code-review/templates/finding.template.md`. Deep dive: `code-review/references/review-playbook.md`.
+
+## 4. Verification Check
+
+- [ ] Repository, contract, base/head SHA, changed scope, and CI state pinned before reviewing
+- [ ] Independent pass completed; author explanations and tests treated as leads, not proof
+- [ ] Applicable counterexamples constructed (missing/malformed input, persisted state, transitions, boundaries, degraded dependencies, OS/shell, concurrency); irrelevant categories not forced
+- [ ] Every reported finding carries exact path:line/diff anchor at HEAD, trigger, observed behavior, violated contract, impact, evidence tier (executed / source-traced / inconclusive), smallest fix, negative regression, and positive control
+- [ ] Prior findings dispositioned at the new HEAD on re-review, plus fix-induced regressions inspected
+- [ ] Review stayed read-only unless explicitly authorized; no edits, comments, labels, or merges on review authority
+- [ ] Summary distinguished "no actionable findings in examined scope" from "bug-free," with test/CI/live-host evidence boundaries stated

package/evals/code-review/eval.yaml

@@ -0,0 +1,26 @@
+name: code-review-routing-eval
+description: Trigger precision eval for the code-review skill.
+skill: code-review
+version: "1.0"
+config:
+  trials_per_task: 1
+  timeout_seconds: 300
+  parallel: false
+  executor: copilot-sdk
+  model: claude-sonnet-4.6
+metrics:
+  - name: task_completion
+    weight: 0.7
+    threshold: 0.8
+    description: Did code-review trigger exactly when it should, and stay dormant for neighboring skills' requests?
+  - name: efficiency
+    weight: 0.3
+    threshold: 0.7
+    description: Did the skill stay within behavior limits?
+graders:
+  - type: behavior
+    name: token-budget
+    config:
+      max_tokens: 1200
+tasks:
+  - "tasks/*.yaml"

package/evals/code-review/tasks/negative-grill-me.yaml

@@ -0,0 +1,16 @@
+id: negative-code-review-002
+name: Plan stress-testing must route to grill-me, not code-review
+description: Stress-testing a design or plan one question at a time is in code-review's DO NOT USE FOR scope and belongs to grill-me; code-review must stay dormant.
+tags:
+  - negative-trigger
+inputs:
+  prompt: "Re-review my plan, asking one question at a time: stress-test the new billing service plan until we agree on where retries live."
+expected:
+  should_trigger: false
+graders:
+  - type: text
+    name: not-contains-keywords
+    config:
+      contains:
+        - "source-anchored"
+        - "source-traced"

package/evals/code-review/tasks/negative-security-review.yaml

@@ -0,0 +1,16 @@
+id: negative-code-review-001
+name: Security threat modeling must route to security-review, not code-review
+description: A security-only threat modeling request is in code-review's DO NOT USE FOR scope and belongs to security-review; code-review must stay dormant.
+tags:
+  - negative-trigger
+inputs:
+  prompt: "Re-review the STRIDE threat model for security only: do a full threat model of the new payments endpoint against the OWASP Top 10, including secrets exposure."
+expected:
+  should_trigger: false
+graders:
+  - type: text
+    name: not-contains-keywords
+    config:
+      contains:
+        - "source-anchored"
+        - "source-traced"

package/evals/code-review/tasks/negative-tdd.yaml

@@ -0,0 +1,16 @@
+id: negative-code-review-004
+name: Implementing the fix must route to tdd, not code-review
+description: Writing the fix test-first is implementation work that belongs to tdd; code-review is read-only and must stay dormant.
+tags:
+  - negative-trigger
+inputs:
+  prompt: "Fix the off-by-one error in the pagination helper. Write a regression test first, then make it pass."
+expected:
+  should_trigger: false
+graders:
+  - type: text
+    name: not-contains-keywords
+    config:
+      contains:
+        - "source-anchored"
+        - "source-traced"

package/evals/code-review/tasks/negative-verification-loop.yaml

@@ -0,0 +1,16 @@
+id: negative-code-review-003
+name: Running the gates must route to verification-loop, not code-review
+description: Running the build, types, lint and test gates is an objective check that belongs to verification-loop; code-review must stay dormant.
+tags:
+  - negative-trigger
+inputs:
+  prompt: "Run the build, type check, lint and the full test suite on this branch and tell me which gates pass."
+expected:
+  should_trigger: false
+graders:
+  - type: text
+    name: not-contains-keywords
+    config:
+      contains:
+        - "source-anchored"
+        - "source-traced"

package/evals/code-review/tasks/positive-pr-review.yaml

@@ -0,0 +1,16 @@
+id: positive-code-review-001
+name: Pre-merge PR review request triggers code-review
+description: "Independently review a PR, diff or finished implementation for correctness, contract and negative-path defects, with source-anchored findings labelled executed, source-traced or inconclusive; read-only by default. USE FOR: \"review this PR before merge\", \"re-review the fix at the new HEAD\". DO NOT USE FOR: \"security threat modeling\", \"implementing or fixing the code\"."
+tags:
+  - positive-trigger
+inputs:
+  prompt: "Review PR #412 before we merge it. Check the diff for correctness and negative-path defects against the contract in the PRD, and label each finding as executed, source-traced or inconclusive."
+expected:
+  should_trigger: true
+graders:
+  - type: text
+    name: contains-keywords
+    config:
+      contains:
+        - "source-traced"
+        - "inconclusive"

package/evals/code-review/tasks/positive-revised-head-rereview.yaml

@@ -0,0 +1,16 @@
+id: positive-code-review-002
+name: Re-review of a revised HEAD triggers code-review
+description: "Independently review a PR, diff or finished implementation for correctness, contract and negative-path defects, with source-anchored findings labelled executed, source-traced or inconclusive; read-only by default. USE FOR: \"review this PR before merge\", \"re-review the fix at the new HEAD\". DO NOT USE FOR: \"security threat modeling\", \"implementing or fixing the code\"."
+tags:
+  - positive-trigger
+inputs:
+  prompt: "The author pushed a new commit to address last round's findings. Re-review the new HEAD: check each prior finding on its own as resolved, still open or superseded, and look for regressions the fix introduced."
+expected:
+  should_trigger: true
+graders:
+  - type: text
+    name: contains-keywords
+    config:
+      contains:
+        - "prior finding"
+        - "HEAD"

package/harness-everything/SKILL.md

@@ -4,7 +4,7 @@ description: "Route software/project work through Harness: classify tier/topolog
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.31.0
+  version: 0.33.0
 ---
 
 # Harness Everything