harnessed 1.0.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for describing the origin of the Work and
+      reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Support. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or support.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 harnessed maintainers
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,20 @@
+harnessed
+Copyright 2026 harnessed maintainers
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+----
+
+Not affiliated with, endorsed by, or sponsored by Harness Inc.
+The "harnessed" name refers to the Anthropic Claude Code "harness" terminology
+and reflects the project's role as a composition orchestrator over AI coding
+harnesses.
+
+----
+
+Upstream attributions are tracked separately in NOTICES.md (auto-populated by
+`harnessed install` from each manifest's `metadata.upstream.notice` field).

package/README.md

@@ -0,0 +1,178 @@
+# harnessed
+
+> **完整三层栈方法论的可执行 engine** — 6+ 虚拟角色（gstack 决策层 + GSD 项目经理 + superpowers 资深工程师）/ 双职责治理 / 4 心法 always-on / 23 招式 phase 路由 / 6 skill category，把 CLAUDE.md 协作规则机器化
+> 在装配主义 base 之上：不 vendor 上游代码，用 manifest 描述 install/check，用 composition skill 编排多上游工作流（详 [ADR 0006](./docs/adr/0006-architecture-wedge-revision-v3.md)）
+
+[![License: Apache-2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](./LICENSE)
+[![npm](https://img.shields.io/npm/v/harnessed?label=npm&color=blue)](https://npmjs.com/package/harnessed)
+[![Sponsor](https://img.shields.io/github/sponsors/easyinplay?logo=github&label=Sponsor)](https://github.com/sponsors/easyinplay)
+
+> Not affiliated with, endorsed by, or sponsored by Harness Inc.（见 [NOTICE](./NOTICE)）
+
+## 一句话定位
+
+别人造轮子（如 ECC 自家 30 agents/135 skills），我们做"指挥棒"——装配市面上最优秀的开源 Claude Code 生态组件，用强意见的 composition skill 织成统一工作流；上层把 CLAUDE.md 里写的"gstack 决策 → GSD 项目经理 → superpowers 资深工程师"三层栈方法论机器化为可执行 engine。
+
+## 关键差异化
+
+- **三层栈机器化**（[ADR 0006](./docs/adr/0006-architecture-wedge-revision-v3.md)）：gstack（决策层 / 6+ 虚拟角色 / 治理关卡） + GSD（项目经理 / phase orchestration / 状态持久化） + superpowers（资深工程师 / 子任务执行质量） + andrej-karpathy-skills（4 心法 always-on baseline） + mattpocock-skills（23 招式 by-phase routing） — 8 支柱 100% capture，把 CLAUDE.md 协作规则机器化为可执行 engine
+- **不 vendor**（base layer）：上游代码不进我们仓库，靠 manifest 描述 install/check（schema v1 frozen — see [ADR 0001](./docs/adr/0001-manifest-schema-v1.md)；phase 1.3 加 categorization 3 字段 errata see [ADR 0007](./docs/adr/0007-categorization-schema-extension.md)）
+- **Composition Skill**：自家 workflow skill 当指挥棒，调度多个上游协同（research / execute-task / plan-feature 三 MVP workflow）
+- **包管理器思维**：`harnessed install <workflow>` 自动解析依赖图、`doctor` 健康检查、`install-base` 一键装齐 base profile（10 固定 manifest）
+- **强意见 vs all-in-one**：用户面对 `/harnessed:*` 统一入口，不需学每家上游术语
+
+## Repo Structure
+
+```
+harnessed/
+├── manifests/           # 上游描述层（不 vendor）
+│   ├── tools/          # cc-plugin / mcp-npm / cli-npm
+│   └── skill-packs/    # cc-skill-pack
+├── workflows/          # composition skill（指挥棒）
+├── routing/            # B+C 混合路由 SSOT
+├── config-templates/   # 配置注入层（hooks 等）
+├── schemas/            # JSON Schema artifact (publish 给 IDE / CI)
+├── src/                # TS 源码（installer / validator / router / checkpoint）
+├── tests/              # vitest 单测 + 集成 + bench
+└── docs/adr/           # 架构决策记录
+```
+
+## Status
+
+- **Current**: 🎯 **v1.0 GA SHIPPED 2026-05-22** (21/21 phases 100%); npm publish stream live; maintenance-only mode triggers ~2026-11 post organic clock end (per ADR 0020)
+- **Next**: v1.0+ — maintenance-only mode (~2026-11 per D-04 HYBRID 2-clock); co-maintainer organic clock running post-2026-05-22
+- **Full phase history + release plan + per-milestone audits**: [.planning/ROADMAP.md](./.planning/ROADMAP.md) / [CHANGELOG.md](./CHANGELOG.md)
+
+## Install Quick Start（phase 1.2 ready）
+
+`harnessed install <name>` **默认 dry-run**——列出将装的上游 / 改的文件，必须 `y` / `--apply` 才执行。详见 [docs/INSTALLER-CONTRACT.md](./docs/INSTALLER-CONTRACT.md) 6 条用户视角硬契约。
+
+```bash
+# 默认 dry-run（看 diff，不写盘）
+harnessed install ctx7
+
+# 显式 apply（交互场景）
+harnessed install ctx7 --apply
+
+# 自动化场景（CI 流水线）— 双 flag 必须
+harnessed install tavily-mcp --non-interactive --apply
+
+# 看已装状态 / 备份 / 清理
+harnessed status
+harnessed backup list
+harnessed gc --older-than 30d --apply
+
+# 出错恢复（一行回滚 + EOL preserve + sha1 verify）
+harnessed rollback 2026-05-12T15:30:00Z
+
+# 健康检查（4-check：Node ≥ 22 / MCP scope / jq present / Win bash flavor）
+harnessed doctor
+```
+
+### Flags
+
+| Flag | 说明 |
+| ---- | ---- |
+| `--apply` | 显式执行（默认 dry-run） |
+| `--dry-run` | 永不写盘（即使加 `--apply` 也优先 dry-run） |
+| `--system` | L4 全局装允许（否则自动降级 L1 npx ephemeral） |
+| `--non-interactive` | 自动化场景；必须配合 `--apply` 或 `--dry-run` 否则 exit 2 |
+| `--full-diff` | 展开 > 200 行的 diff 折叠 |
+| `--no-color` | 强制 nocolor（即使 TTY） |
+
+## 使用流程（phase 1.2 实装后启用）
+
+harnessed 是 **CLI + CC skill 混合体**——CLI 管装/检/恢复，skill 管编排：
+
+harnessed 装齐 **CLAUDE.md 4-stage 三层栈方法论** 所需上游 (gstack + GSD + superpowers + karpathy + mattpocock + planning-with-files + ralph-loop), `/harnessed:<workflow>` 启动 4-stage 自动化:
+
+① **Discuss** (gstack `/office-hours` 治理 + GSD `/gsd-discuss-phase` 澄清) → ② **Plan** (GSD `/gsd-plan-phase` + planning-with-files 持久化 + 可选 gstack `/plan-eng-review`) → ③ **Execute** (GSD `/gsd-execute-phase` + superpowers brainstorm + karpathy 心法 + mattpocock 招式 + 可选 TDD + ralph-loop 至 COMPLETE) → ④ **Verify** (GSD `/gsd-verify-work` + code-review + gstack `/review` + code-simplifier + `/retro`)
+
+→ **详细 mermaid + 与 CLAUDE.md prescribed gap 分析**: [docs/WORKFLOW.md](./docs/WORKFLOW.md). harnessed v0.4 已装齐所有上游; `/harnessed:plan-feature` 当前实装 Stage ①+② 5-phase 编排 (governance PUSH veto halt_workflow); Stage ③+④ 子任务级编排为 reference 调用 (用户在 Claude Code 内手动); 完整自动化推 v0.5+。
+
+```bash
+# 1. 一次性 setup（装 workflow skills 到 ~/.claude/skills/、配置 hooks）
+npx harnessed@latest setup
+
+# 2. 装某个 workflow 用到的所有上游 plugin（一行装齐 4-5 个上游）
+harnessed install plan-feature
+# → 自动装 gstack + superpowers + GSD + planning-with-files
+
+# 3. 跑 workflow（在 Claude Code 内输入 slash command）
+/harnessed:plan-feature "新功能 X"
+# → 调度 5 phase: gstack governance → superpowers brainstorm → GSD discuss/plan → planning-with-files persist
+# → 暂停点等用户 approve（CEO veto / final task_plan lock）
+
+# 4. 中断后恢复
+harnessed status   # 看当前 phase
+harnessed resume   # 从最近 checkpoint 继续
+
+# 5. 健康检查
+harnessed doctor   # 检测上游 stale / Windows ACL / 配置漂移
+```
+
+## FAQ — 常见疑问
+
+**Q1. 装了 harnessed，还需要装 superpowers/gstack/GSD 等上游 plugin 吗？**
+
+需要，但**用户感知 = 一行命令**：`harnessed install <workflow>` 自动解析 manifest 依赖图、装齐所有上游。类比 `brew install <formula>` 装全套依赖——你不需要单独 `brew install` 每个依赖项。
+
+**Q2. 为什么不把 superpowers/gstack 的相关 skill 直接 vendor 进 harnessed 仓库？**
+
+4 条理由：
+
+1. **差异化哲学**（[ADR 0001](./docs/adr/0001-manifest-schema-v1.md) + PROJECT-SPEC § 6 wedge）：harnessed 是「装配主义包管理器」对位 ECC 的「all-in-one 自建派」。vendor = 失去 wedge → 沦为又一个 plugin pack
+2. **License + attribution 噩梦**：vendor 4-5 个主动维护的上游 = 复杂 license 拼盘 + 违反 [vendor/ENTRY-CRITERIA.md](./vendor/ENTRY-CRITERIA.md)（要求"上游已停摆"才允许 vendor）
+3. **上游升级反向**：当前 manifest 描述 → 上游升级用户重 install 即得新版；vendor 后必须手动 sync code → 永远落后
+4. **Bus factor 1**：单 maintainer 维护 vendor 4-5 上游 = 加速 burnout（Avelino 论文实证 OSS 单 maintainer 年掉队率 36%）
+
+**Q3. gstack 的 `/office-hours`、GSD 的 `/gsd-discuss-phase`、superpowers 的 brainstorming 看起来都是"plan/discuss"类，是不是重叠？**
+
+不是。它们是**三层栈的不同阶段**（PROJECT-SPEC § 10 phases schema 显式编排）：
+
+| 阶段 | 上游 | 职责 |
+|------|------|------|
+| Governance | gstack | 多角色决策关卡（CEO/EM/Designer/Paranoid Engineer） |
+| Brainstorming | superpowers | 子任务设计澄清、方案对比 |
+| Orchestration | GSD | 高层 phase 任务图 + 依赖分析 |
+| Persistence | planning-with-files | 持久化 task_plan / progress / findings 到 markdown |
+
+`/harnessed:plan-feature` 把这 4 个阶段串起来——每个阶段做不同事，输出喂给下一阶段。**没有合并**。
+
+**Q4. workflow phase 之间是自动跑还是等用户？**
+
+看 `workflows/<name>/SKILL.md` frontmatter 的 `pause` 字段：
+
+- `pause: human_review` → 阻塞等用户 approve（governance gate / final lock 用，如 plan-feature 的 phase 01 + 05）
+- 无 `pause` → 自动 chain 到下一 phase（中间步骤）
+
+每个 phase 输出写到 `.harnessed/checkpoints/`，session 中断后 `harnessed resume` 从最近 checkpoint 继续。
+
+**Q5. harnessed 自己是 CC plugin 吗？**
+
+混合体：
+
+- `npx harnessed@latest setup` 跑的是 **Node.js CLI**（`bin/harnessed`）
+- setup 装的 **workflow skills**（markdown）进 `~/.claude/skills/`，由 Claude Code 在运行时加载
+- `/harnessed:*` 是 CC 内的 slash command，触发 skill 执行
+- CLI 和 CC skill 共享 `.harnessed/checkpoints/` 状态目录
+
+## 文档导航
+
+- [PROJECT-SPEC.md](./PROJECT-SPEC.md) — 立项参数 spec sheet（v2.1）
+- [WORKFLOWS-MVP.md](./WORKFLOWS-MVP.md) — 3 个 MVP workflow 展开（v2.1）
+- [docs/adr/](./docs/adr/) — 架构决策记录（17 ADRs 0001-0017）｜[docs/WORKFLOW.md](./docs/WORKFLOW.md) — 项目实际 dev 工作流 mermaid + 16-phase cadence 模式表 + CLAUDE.md gap 分析
+- [.planning/ROADMAP.md](./.planning/ROADMAP.md) — 4 milestones × 3-5 phases 路线图
+- [.planning/STATE.md](./.planning/STATE.md) — 跨 session 项目记忆 SSOT
+- [CONTRIBUTING.md](./CONTRIBUTING.md) — 贡献指南（含 Windows corepack ACL workaround）
+- [SECURITY.md](./SECURITY.md) — 漏洞披露通道
+
+## Sponsor / Co-maintainer
+
+GitHub Sponsors **已启用** (Phase 4.2 SHIPPED v0.4.0) — [![Sponsor](https://img.shields.io/github/sponsors/easyinplay?logo=github&label=Sponsor)](https://github.com/sponsors/easyinplay). Co-maintainer 6 月招募窗口已开启 — 完整入门指引参考 [docs/MAINTAINER-ONBOARDING.md](./docs/MAINTAINER-ONBOARDING.md)（30 分钟可跑通 dev 环境 per R8.2 验收）.
+
+stale-bot 已上线 — 90 天无活动 issue/PR 自动关闭 (`.github/workflows/stale.yml`); issue 模板见 `.github/ISSUE_TEMPLATE/`。
+
+## License
+
+[Apache-2.0](./LICENSE) — 见 [NOTICE](./NOTICE)（含 Harness Inc. 商标 disclaimer）

package/config-templates/README.md

@@ -0,0 +1,21 @@
+# config-templates/ — 配置注入层
+
+`config-templates/` 包含 harnessed setup 时**注入用户项目**的配置模板。
+
+## 结构
+
+- `statusline.json` — Claude Code statusline 配置模板（v0.4+）
+- `hooks/` — UserPromptSubmit hook 配置（B+C 混合 C 层 SSOT）
+- `claude-md-block.md` — 注入 CLAUDE.md 的 harnessed 路由块模板
+
+## 安全约束（PROJECT-SPEC.md § 8.3）
+
+- **routing/*.md（hook 配置）必须纯 yaml/markdown** — 数据驱动，无可执行逻辑
+- **harnessed 自带 hook 脚本严格受控** — 用 Node.js 内置 `fs` / `child_process`，禁动态 shell escape
+- **install 时 print 全部脚本代码 + 配置 diff**（100% 透明）
+- **1-key uninstall** 完全清理 settings.json hook entry + 所有 script files
+
+## 关联
+
+- setup 流程：`src/cli/setup.ts`（v0.1 phase 1.3）
+- 用户备份：`<user-project>/.harnessed-backup/`

package/dist/cli.d.ts

@@ -0,0 +1 @@
+#!/usr/bin/env node