harness-everything 0.32.0 → 0.34.0

package/docs/workflows/code-review.md

@@ -0,0 +1,58 @@
+# Workflow: Code Review
+
+> Independently review a PR, diff, or finished implementation for correctness, contract, and negative-path defects — read-only by default, with evidence-tiered, source-anchored findings.
+
+Source of truth: `code-review/SKILL.md`.
+
+Contract summary from SKILL.md — Trigger: requested review of a PR, diff, implementation, or revised HEAD. Output: source-anchored findings and an evidence-qualified summary. USE FOR: review a PR/diff/finished implementation before merge, re-review a revised HEAD (prior-finding disposition + new risks). DO NOT USE FOR: security-only threat modeling/secrets/OWASP (use `security-review`); design or plan stress-testing (use `grill-me`); running gates (use `verification-loop`); writing the fix (use `tdd`).
+
+## 1. Skill Behavior Workflow
+
+```mermaid
+graph TD
+  A[Pinned Repo Principle BB And CI State] --> B[Read Diff And Relevant Callers Callees]
+  B --> C[Map State Trust Fallback Consumers Tests]
+  C --> D[Construct Counterexamples And Negative Paths]
+  D --> E[Verify Findings Against Source And CI]
+  E --> F{Actionable Supported Finding}
+  F -->|yes| G[P1 P2 P3 Severity Plus Evidence Tier Plus Minimal Fix Plus Regression]
+  F -->|no| H[Discard Qualify Or Mark Inconclusive]
+  G --> I[Report Read Only Only Authorized Actions Post]
+  H --> I
+```
+
+## 2. Triggering and Routing Path
+
+```mermaid
+graph TD
+  ReviewReq[Review This PR Or Diff Request] --> Skill[code-review SKILL]
+  ReReviewReq[Re-Review Fix At New HEAD] --> Skill
+  SecurityReq[Threat Model Secrets OWASP] --> NotCodeReview[security-review SKILL]
+  DesignReq[Stress Test Plan Or Design] --> Grm[grill-me SKILL]
+  GateReq[Run Build Test Lint Gates] --> VL[verification-loop SKILL]
+  FixReq[Implement Or Fix] --> Tdd[tdd SKILL]
+```
+
+## 3. Re-Review Cycle
+
+```mermaid
+graph TD
+  New[Fix Pushed New HEAD] --> Pin[Pin New SHA And Diff]
+  Pin --> Prior[Disposition Every Prior Finding Resolved Open Superseded Inconclusive]
+  Prior --> Regress[Inspect Fix For Induced Side Effects And New Changes]
+  Regress --> Sum[Summary Scope SHA CI Fixed Open New Counts Evidence-Grounded Recommendation]
+  Sum -->|fix needed| Fix[Fix New Defects]
+  Fix --> Pin
+```
+
+Template: `code-review/templates/finding.template.md`. Deep dive: `code-review/references/review-playbook.md`.
+
+## 4. Verification Check
+
+- [ ] Repository, contract, base/head SHA, changed scope, and CI state pinned before reviewing
+- [ ] Independent pass completed; author explanations and tests treated as leads, not proof
+- [ ] Applicable counterexamples constructed (missing/malformed input, persisted state, transitions, boundaries, degraded dependencies, OS/shell, concurrency); irrelevant categories not forced
+- [ ] Every reported finding carries exact path:line/diff anchor at HEAD, trigger, observed behavior, violated contract, impact, evidence tier (executed / source-traced / inconclusive), smallest fix, negative regression, and positive control
+- [ ] Prior findings dispositioned at the new HEAD on re-review, plus fix-induced regressions inspected
+- [ ] Review stayed read-only unless explicitly authorized; no edits, comments, labels, or merges on review authority
+- [ ] Summary distinguished "no actionable findings in examined scope" from "bug-free," with test/CI/live-host evidence boundaries stated

package/evals/code-review/eval.yaml

@@ -0,0 +1,26 @@
+name: code-review-routing-eval
+description: Trigger precision eval for the code-review skill.
+skill: code-review
+version: "1.0"
+config:
+  trials_per_task: 1
+  timeout_seconds: 300
+  parallel: false
+  executor: copilot-sdk
+  model: claude-sonnet-4.6
+metrics:
+  - name: task_completion
+    weight: 0.7
+    threshold: 0.8
+    description: Did code-review trigger exactly when it should, and stay dormant for neighboring skills' requests?
+  - name: efficiency
+    weight: 0.3
+    threshold: 0.7
+    description: Did the skill stay within behavior limits?
+graders:
+  - type: behavior
+    name: token-budget
+    config:
+      max_tokens: 1200
+tasks:
+  - "tasks/*.yaml"

package/evals/code-review/tasks/negative-grill-me.yaml

@@ -0,0 +1,16 @@
+id: negative-code-review-002
+name: Plan stress-testing must route to grill-me, not code-review
+description: Stress-testing a design or plan one question at a time is in code-review's DO NOT USE FOR scope and belongs to grill-me; code-review must stay dormant.
+tags:
+  - negative-trigger
+inputs:
+  prompt: "Re-review my plan, asking one question at a time: stress-test the new billing service plan until we agree on where retries live."
+expected:
+  should_trigger: false
+graders:
+  - type: text
+    name: not-contains-keywords
+    config:
+      contains:
+        - "source-anchored"
+        - "source-traced"

package/evals/code-review/tasks/negative-security-review.yaml

@@ -0,0 +1,16 @@
+id: negative-code-review-001
+name: Security threat modeling must route to security-review, not code-review
+description: A security-only threat modeling request is in code-review's DO NOT USE FOR scope and belongs to security-review; code-review must stay dormant.
+tags:
+  - negative-trigger
+inputs:
+  prompt: "Re-review the STRIDE threat model for security only: do a full threat model of the new payments endpoint against the OWASP Top 10, including secrets exposure."
+expected:
+  should_trigger: false
+graders:
+  - type: text
+    name: not-contains-keywords
+    config:
+      contains:
+        - "source-anchored"
+        - "source-traced"

package/evals/code-review/tasks/negative-tdd.yaml

@@ -0,0 +1,16 @@
+id: negative-code-review-004
+name: Implementing the fix must route to tdd, not code-review
+description: Writing the fix test-first is implementation work that belongs to tdd; code-review is read-only and must stay dormant.
+tags:
+  - negative-trigger
+inputs:
+  prompt: "Fix the off-by-one error in the pagination helper. Write a regression test first, then make it pass."
+expected:
+  should_trigger: false
+graders:
+  - type: text
+    name: not-contains-keywords
+    config:
+      contains:
+        - "source-anchored"
+        - "source-traced"

package/evals/code-review/tasks/negative-verification-loop.yaml

@@ -0,0 +1,16 @@
+id: negative-code-review-003
+name: Running the gates must route to verification-loop, not code-review
+description: Running the build, types, lint and test gates is an objective check that belongs to verification-loop; code-review must stay dormant.
+tags:
+  - negative-trigger
+inputs:
+  prompt: "Run the build, type check, lint and the full test suite on this branch and tell me which gates pass."
+expected:
+  should_trigger: false
+graders:
+  - type: text
+    name: not-contains-keywords
+    config:
+      contains:
+        - "source-anchored"
+        - "source-traced"

package/evals/code-review/tasks/positive-pr-review.yaml

@@ -0,0 +1,16 @@
+id: positive-code-review-001
+name: Pre-merge PR review request triggers code-review
+description: "Independently review a PR, diff or finished implementation for correctness, contract and negative-path defects, with source-anchored findings labelled executed, source-traced or inconclusive; read-only by default. USE FOR: \"review this PR before merge\", \"re-review the fix at the new HEAD\". DO NOT USE FOR: \"security threat modeling\", \"implementing or fixing the code\"."
+tags:
+  - positive-trigger
+inputs:
+  prompt: "Review PR #412 before we merge it. Check the diff for correctness and negative-path defects against the contract in the PRD, and label each finding as executed, source-traced or inconclusive."
+expected:
+  should_trigger: true
+graders:
+  - type: text
+    name: contains-keywords
+    config:
+      contains:
+        - "source-traced"
+        - "inconclusive"

package/evals/code-review/tasks/positive-revised-head-rereview.yaml

@@ -0,0 +1,16 @@
+id: positive-code-review-002
+name: Re-review of a revised HEAD triggers code-review
+description: "Independently review a PR, diff or finished implementation for correctness, contract and negative-path defects, with source-anchored findings labelled executed, source-traced or inconclusive; read-only by default. USE FOR: \"review this PR before merge\", \"re-review the fix at the new HEAD\". DO NOT USE FOR: \"security threat modeling\", \"implementing or fixing the code\"."
+tags:
+  - positive-trigger
+inputs:
+  prompt: "The author pushed a new commit to address last round's findings. Re-review the new HEAD: check each prior finding on its own as resolved, still open or superseded, and look for regressions the fix introduced."
+expected:
+  should_trigger: true
+graders:
+  - type: text
+    name: contains-keywords
+    config:
+      contains:
+        - "prior finding"
+        - "HEAD"

package/harness-everything/SKILL.md

@@ -4,7 +4,7 @@ description: "Route software/project work through Harness: classify tier/topolog
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.32.0
+  version: 0.34.0
 ---
 
 # Harness Everything

package/harness-everything/references/skill-registry.md

@@ -18,6 +18,7 @@ Every skill in this repository is reachable from this router. If a task matches
 | `grill-me` | Tier 2 | User asks to be grilled on a plan (pure Q&A). |
 | `improve-codebase-architecture` | Tier 2 | Deep architectural analysis / refactor planning. |
 | `eval-harness` | Tier 2 | Scoring, stress testing, benchmark comparison. |
+| `code-review` | Tier 2 | Explicit review requests of a PR/diff/finished implementation: correctness, contract, and negative-path findings with evidence tiers, read-only by default — not threat modeling (`security-review`), plan interrogation (`grill-me`), or gate running (`verification-loop`). |
 | `verification-loop` | Tier 2/3 gate | Before declaring done or creating a PR. |
 | `security-review` | Tier 2/3 gate | Changes touching auth, input handling, secrets, network boundaries. |
 | `fable-mode` | Tier 3 | v3 staged planning, named-agent delegation, model selection, failable gates, and cold review. |