harnessed 1.0.0

package/manifests/SCHEMA.md

@@ -0,0 +1,180 @@
+# manifests/ — Manifest Schema v1 (Human-Readable Reference)
+
+> **决策真理来源**：[`docs/adr/0001-manifest-schema-v1.md`](../docs/adr/0001-manifest-schema-v1.md)
+> **机器消费 artifact**：[`schemas/manifest.v1.schema.json`](../schemas/manifest.v1.schema.json)（`pnpm build && pnpm build:schema` 产出）
+> **本文件定位**：人类可读视图（schema 字段速查 + 9 上游路径占位 + IDE 集成示例），与 ADR 0001 互补 — ADR 决策；本文件帮你**写**和**读** manifest。
+
+任何字段语义冲突以 ADR 0001 为准；任何机器校验差异以 `schemas/manifest.v1.schema.json` 为准。
+
+---
+
+## 1. 顶层结构（4 个必填字段）
+
+```yaml
+apiVersion: harnessed/v1   # 仿 K8s CRD，固定字面量
+kind: Manifest             # 固定字面量
+metadata: {...}            # 见 § 2
+spec: {...}                # 见 § 3
+```
+
+`additionalProperties: false` 全树启用 — 任何未声明字段被 reject（拒绝清单见 ADR 0001 line 134-139）。
+
+---
+
+## 2. metadata 字段表
+
+| 字段 | 必填 | 类型 | 约束 | 来源 |
+|------|------|------|------|------|
+| `name` | ✅ | string | `^[a-z0-9][a-z0-9-]*$`，全局唯一 | ADR 0001 line 44 |
+| `display_name` | optional | string | UI 展示名 | ADR 0001 line 45 |
+| `description` | ✅ | string | ≤ 120 char | ADR 0001 line 46 |
+| `upstream.source` | ✅ | string | 上游官方名 | ADR 0001 line 48 |
+| `upstream.homepage` | ✅ | uri | https URL | ADR 0001 line 49 |
+| `upstream.repository` | ✅ | uri | git URL（用于 audit 检测篡改） | ADR 0001 line 50 |
+| `upstream.license` | ✅ | SPDX enum | `MIT` / `Apache-2.0` / `BSD-3-Clause` / `ISC` / `0BSD` | ADR 0001 line 51 |
+| `upstream.notice` | ✅ | string | 1 行致谢，≤ 500 char，写入用户 NOTICES.md | ADR 0001 line 52 |
+
+非白名单 license（GPL / AGPL / SSPL / proprietary）一律 reject — vendor 准入门槛见 [`vendor/ENTRY-CRITERIA.md`](../vendor/ENTRY-CRITERIA.md)。
+
+---
+
+## 3. spec 字段表
+
+| 字段 | 必填 | 类型 | 约束 |
+|------|------|------|------|
+| `type` | ✅ | enum | `cc-plugin` / `cc-skill-pack` / `mcp-npm` / `cli-npm` |
+| `component_type` | ✅ | enum | `command` / `behavior-rule` / `mcp-tool` / `cli-binary` |
+| `install` | ✅ | object | 见 § 4 install 矩阵 |
+| `verify.cmd` | ✅ | string | health-check 命令 |
+| `verify.timeout_ms` | optional | int | 100..60000 ms，默认 5000 |
+| `verify.expected_exit_code` | optional | int | 默认 0 |
+| `uninstall.cmd` | ✅ | string | 1-key 卸载命令 |
+| `uninstall.cleanup_paths` | optional | string[] | 额外清理路径 |
+| `upstream_health.stability` | ✅ | enum | `stable` / `beta` / `unstable` / `archived` |
+| `upstream_health.last_check` | ✅ | ISO date | weekly CI 自动写入 |
+| `upstream_health.last_known_good_version` | ✅ | string | weekly CI 自动维护 |
+| `upstream_health.fallback_action` | ✅ | enum | `warn` / `block` / `use_alternative` |
+| `upstream_health.alternative` | conditional | string | `fallback_action == use_alternative` 时必填 |
+| `signed_by` | ✅ | string | maintainer GitHub username（v0.1-0.3 commit hash 校验，v0.4+ sigstore） |
+| `signature.sigstore_bundle` | optional | uri | v0.4+ 启用 |
+| `platforms` | ✅ | enum[] | 至少 1 个：`linux` / `darwin` / `win32`，去重 |
+| `tested_with_versions.cc_versions` | optional | string[] | weekly CI 回填 |
+| `tested_with_versions.node_versions` | optional | string[] | weekly CI 回填 |
+| `mutually_exclusive_with` | optional | string[] | manifest names（v0.2+ 启用） |
+
+---
+
+## 4. type × install.method 兼容矩阵（4 type × 6 method）
+
+CI 通过 ManifestSchema 顶层 `allOf` + `if/then` 严格 enforce；任何不在矩阵中的组合直接 reject。
+
+| type \ method | `cc-plugin-marketplace` | `git-clone-with-setup` | `npx-skill-installer` | `npm-cli` | `mcp-stdio-add` | `mcp-http-add` |
+|:---:|:---:|:---:|:---:|:---:|:---:|:---:|
+| **cc-plugin** | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ |
+| **cc-skill-pack** | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ |
+| **mcp-npm** | ❌ | ❌ | ❌ | ❌ | ✅ | ✅ |
+| **cli-npm** | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ |
+
+**install.* method-条件必填字段**（discriminator union）：
+
+| install.method | 额外必填字段 |
+|---|---|
+| `cc-plugin-marketplace` | `git_ref` |
+| `git-clone-with-setup` | `git_ref` |
+| `npx-skill-installer` | `npm_version` |
+| `npm-cli` | `npm_version` |
+| `mcp-stdio-add` | `npm_version` |
+| `mcp-http-add` | `npm_version` |
+
+**install.* 通用必填字段**：`method` / `cmd` / `idempotent_check`
+**install.* 通用可选字段**：`cwd` / `env` / `args`
+
+---
+
+## 5. component_type 4 种语义
+
+| component_type | 描述 | v0.1 上游样例 |
+|---|---|---|
+| `command` | 注册 `/foo:bar` 命令，可被 workflow `invokes` 引用 | mattpocock-skills, GSD, gstack, planning-with-files, ralph-loop, superpowers |
+| `behavior-rule` | CLAUDE.md 注入行为规范，**无命令** | karpathy-skills |
+| `mcp-tool` | MCP server 提供的 tool（`claude mcp add` 注册） | tavily-mcp, exa-mcp |
+| `cli-binary` | 独立 CLI 可执行（`command -v` 验证） | ctx7 |
+
+特殊语义（ADR 0001 line 124-128）：
+
+- `behavior-rule` 安装 = CLAUDE.md merge（多源时按未来 `priority` 字段排序）
+- `behavior-rule` 卸载 = 移除 CLAUDE.md 中对应 block（marker 注释定位）
+- `mcp-tool` 安装/卸载强制走 `claude mcp add/remove` CLI，**禁止**直接编辑 `~/.claude.json` 或 `.mcp.json`
+
+---
+
+## 6. v0.1 上游 manifest 路径占位（9 上游 / 10 manifest）
+
+phase 1.1 dry-run 验证字段充分性；实际 install/verify 命令在 phase 1.2 落地 installer 时精化。
+
+| 上游 | 文件路径 | type | install.method | component_type |
+|---|---|---|---|---|
+| gstack | `manifests/skill-packs/gstack.yaml` | cc-skill-pack | git-clone-with-setup | command |
+| GSD | `manifests/skill-packs/gsd.yaml` | cli-npm | npm-cli | command |
+| superpowers | `manifests/tools/superpowers.yaml` | cc-plugin | cc-plugin-marketplace | command |
+| planning-with-files | `manifests/skill-packs/planning-with-files.yaml` | cc-skill-pack | cc-plugin-marketplace | command |
+| mattpocock-skills | `manifests/skill-packs/mattpocock-skills.yaml` | cc-skill-pack | npx-skill-installer | command |
+| karpathy-skills | `manifests/skill-packs/karpathy-skills.yaml` | cc-skill-pack | npx-skill-installer | behavior-rule |
+| ralph-loop | `manifests/tools/ralph-loop.yaml` | cc-plugin | cc-plugin-marketplace | command |
+| tavily-mcp | `manifests/tools/tavily-mcp.yaml` | mcp-npm | mcp-stdio-add | mcp-tool |
+| exa-mcp | `manifests/tools/exa-mcp.yaml` | mcp-npm | mcp-stdio-add | mcp-tool |
+| ctx7 | `manifests/tools/ctx7.yaml` | cli-npm | npm-cli | cli-binary |
+
+矩阵覆盖：4/4 type，6/6 method 中 5 个真实命中（`mcp-http-add` 在 v0.1 无上游，仅 schema 占位 — phase 1.2 会找一个 mcp-http server demo 来覆盖）。
+
+---
+
+## 7. IDE 集成（VS Code yaml-language-server）
+
+在 manifest yaml 顶部加一行：
+
+```yaml
+# yaml-language-server: $schema=https://harnessed.dev/schemas/manifest.v1.schema.json
+apiVersion: harnessed/v1
+kind: Manifest
+...
+```
+
+`redhat.vscode-yaml` 插件自动启用补全 + 实时校验。
+
+本仓库内贡献者也可指向相对路径（手 ABT)：
+
+```yaml
+# yaml-language-server: $schema=../../schemas/manifest.v1.schema.json
+```
+
+---
+
+## 8. 必填字段 checklist（review 自检）
+
+提交新 manifest 前确认：
+
+- [ ] `apiVersion: harnessed/v1` + `kind: Manifest`
+- [ ] `metadata.name` kebab-case 唯一 + `metadata.description` ≤ 120 char
+- [ ] `metadata.upstream` 全 5 字段（source / homepage / repository / license / notice）
+- [ ] `spec.type` ∈ 4 enum + `spec.component_type` ∈ 4 enum
+- [ ] `spec.install.{method, cmd, idempotent_check}` + 按 method 决定的 `git_ref` / `npm_version`
+- [ ] `spec.verify.cmd` + `spec.uninstall.cmd`
+- [ ] `spec.upstream_health` 4 字段（stability / last_check / last_known_good_version / fallback_action）
+- [ ] `spec.signed_by` GitHub username + `spec.platforms` ≥ 1 个
+- [ ] type × method 在 § 4 矩阵合法组合内
+- [ ] 没有 `${shell}` `$(cmd)` `eval(...)` `!ruby/regexp` 等动态求值（ADR 0001 reject 清单）
+- [ ] 没有 `extends` / `inherits` 等 templating 字段（schema v1 简洁性优先）
+
+CI 强制校验：`pnpm test` + `pnpm validate:schema`。
+
+---
+
+## 9. 关联
+
+- **决策**：`docs/adr/0001-manifest-schema-v1.md`
+- **JSON Schema artifact**：`schemas/manifest.v1.schema.json` —— `pnpm build && pnpm build:schema` 产出
+- **TypeBox 源定义**：`src/manifest/schema/`（`index.ts` / `metadata.ts` / `spec.ts` / `installMethods/*.ts`）
+- **校验器入口**：`src/manifest/validate.ts` — `validateManifestFile(yamlSrc, file)` 返回 `{ok, manifest|errors}`
+- **测试**：`tests/unit/manifest-validate.*.test.ts` + `tests/unit/schema-artifact.test.ts`
+- **PROJECT-SPEC § 8.1**：schema 冻结纪律（任何字段 add / remove / rename / type 变更 → 新 ADR + 全量 migration）

package/manifests/aliases.yaml

@@ -0,0 +1,14 @@
+# manifests/aliases.yaml — Phase 3.3 R7.5 deprecation marker + upstream rename redirect
+# Phase 3.3 MVP empty seed; Phase 3.4 dogfood adds first actual deprecation entries.
+# Schema: src/manifest/schema/aliases.v1.ts (12th surface, D-01 RICH)
+#
+# Example entry shape (commented for reference, uncomment + populate when needed):
+# old-package-name:
+#   redirect: new-package-name
+#   reason: upstream renamed (v2.0 rebrand)
+#   since_version: '0.3.0'
+#   deprecation_date: '2026-05-17'
+#   removal_date: '2026-12-31'  # optional, 长尾窗口
+
+schemaVersion: harnessed.aliases.v1
+aliases: {}

package/manifests/cc-hooks/dashboard-autospawn.yaml

@@ -0,0 +1,45 @@
+# yaml-language-server: $schema=../../schemas/manifest.v1.schema.json
+# Phase 2.4 W3 T3.1 (D-04 § 3.1 + R2.4.4) — first cc-hook-add fixture.
+# Registers a SessionStart hook that auto-spawns the harnessed dashboard
+# (--no-open keeps the hook quiet; user clicks the URL in the welcome banner).
+# Idempotent — re-install on existing matching entry → skip.
+apiVersion: harnessed/v1
+kind: Manifest
+metadata:
+  name: dashboard-autospawn
+  display_name: Dashboard Autospawn (SessionStart)
+  description: SessionStart hook that boots the harnessed read-only dashboard on every CC session start.
+  upstream:
+    source: dashboard-autospawn
+    homepage: https://github.com/easyinplay/harnessed
+    repository: https://github.com/easyinplay/harnessed.git
+    license: MIT
+    notice: First-party harnessed hook (Phase 2.4 W3 T3.1 D-04 § 3.1).
+spec:
+  type: cc-hook
+  component_type: command
+  category: meta
+  install_type: hook
+  install:
+    method: cc-hook-add
+    cmd: "node scripts/dashboard.mjs --no-open"
+    hook_event: SessionStart
+    hook_matcher: "startup|resume"
+    hook_command: "node scripts/dashboard.mjs --no-open"
+    idempotent_check: "grep -q dashboard.mjs ~/.claude/settings.json"
+  verify:
+    cmd: "grep -q dashboard.mjs ~/.claude/settings.json"
+    timeout_ms: 5000
+    expected_exit_code: 0
+  uninstall:
+    cmd: "true"
+  upstream_health:
+    stability: beta
+    last_check: "2026-05-16"
+    last_known_good_version: "0.2.0"
+    fallback_action: warn
+  signed_by: easyinplay
+  platforms:
+    - linux
+    - darwin
+    - win32

package/manifests/skill-packs/anthropics-skills-pptx.yaml

@@ -0,0 +1,46 @@
+# yaml-language-server: $schema=../../schemas/manifest.v1.schema.json
+apiVersion: harnessed/v1
+kind: Manifest
+metadata:
+  name: anthropics-skills-pptx
+  display_name: Anthropic Skills — pptx
+  description: PowerPoint deck generation skill from anthropics/skills upstream (English-first slide-deck output).
+  upstream:
+    source: github.com/anthropics/skills
+    homepage: https://github.com/anthropics/skills/tree/main/skills/pptx
+    repository: https://github.com/anthropics/skills.git
+    license: anthropics-official
+    notice: |
+      Anthropic skills — pptx sub-skill from anthropics/skills (source-available; anthropics-official carve-out per .planning/research/v0.2.0-extensions.md § 2.1).
+      content category — PowerPoint file generation; routed via decision_rules.yaml `pptx-file-task` (priority 80).
+spec:
+  type: cc-skill-pack
+  component_type: command
+  category: content
+  install_type: skill
+  install:
+    method: npx-skill-installer
+    cmd: "npx --yes skills@1.5.7 add anthropics/skills/pptx --copy --global"
+    npm_version: ^1.5.7
+    idempotent_check: "test -f ~/.claude/skills/pptx/SKILL.md"
+  verify:
+    cmd: "test -f ~/.claude/skills/pptx/SKILL.md"
+    timeout_ms: 5000
+    expected_exit_code: 0
+  uninstall:
+    cmd: "rm -rf ~/.claude/skills/pptx"
+    cleanup_paths:
+      - ~/.claude/skills/pptx
+  upstream_health:
+    stability: stable
+    last_check: "2026-05-16"
+    last_known_good_version: "1.5.7"
+    fallback_action: warn
+  signed_by: easyinplay
+  platforms:
+    - linux
+    - darwin
+    - win32
+  decision_rules:
+    trigger: "user 请求生成 pptx / PowerPoint / slide deck (English)"
+    default_expert: anthropics-skills-pptx

package/manifests/skill-packs/anthropics-skills-slide-deck.yaml

@@ -0,0 +1,46 @@
+# yaml-language-server: $schema=../../schemas/manifest.v1.schema.json
+apiVersion: harnessed/v1
+kind: Manifest
+metadata:
+  name: anthropics-skills-slide-deck
+  display_name: Anthropic Skills — slide-deck
+  description: Slide-deck generation skill from anthropics/skills upstream (ZH-first 中文 PPT 演示稿). Complement to pptx.
+  upstream:
+    source: github.com/anthropics/skills
+    homepage: https://github.com/anthropics/skills/tree/main/skills/slide-deck
+    repository: https://github.com/anthropics/skills.git
+    license: anthropics-official
+    notice: |
+      Anthropic skills — slide-deck sub-skill from anthropics/skills (source-available; anthropics-official carve-out per .planning/research/v0.2.0-extensions.md § 2.1).
+      content category — 中文 slide-deck 演示场景; routed via decision_rules.yaml `chinese-content-deck` rule (priority 70).
+spec:
+  type: cc-skill-pack
+  component_type: command
+  category: content
+  install_type: skill
+  install:
+    method: npx-skill-installer
+    cmd: "npx --yes skills@1.5.7 add anthropics/skills/slide-deck --copy --global"
+    npm_version: ^1.5.7
+    idempotent_check: "test -f ~/.claude/skills/slide-deck/SKILL.md"
+  verify:
+    cmd: "test -f ~/.claude/skills/slide-deck/SKILL.md"
+    timeout_ms: 5000
+    expected_exit_code: 0
+  uninstall:
+    cmd: "rm -rf ~/.claude/skills/slide-deck"
+    cleanup_paths:
+      - ~/.claude/skills/slide-deck
+  upstream_health:
+    stability: stable
+    last_check: "2026-05-16"
+    last_known_good_version: "1.5.7"
+    fallback_action: warn
+  signed_by: easyinplay
+  platforms:
+    - linux
+    - darwin
+    - win32
+  decision_rules:
+    trigger: "user 请求中文 slide / 中文 PPT 演示稿 / slide deck (Chinese)"
+    default_expert: anthropics-skills-slide-deck

package/manifests/skill-packs/frontend-design.yaml

@@ -0,0 +1,63 @@
+# yaml-language-server: $schema=../../schemas/manifest.v1.schema.json
+apiVersion: harnessed/v1
+kind: Manifest
+metadata:
+  name: frontend-design
+  display_name: frontend-design (anthropics/skills)
+  description: Style-led / distinctive aesthetic skill. D-08 "做出风格" override anchor; complements ui-ux-pro-max.
+  upstream:
+    source: github.com/anthropics/skills
+    homepage: https://github.com/anthropics/skills/tree/main/skills/frontend-design
+    repository: https://github.com/anthropics/skills.git
+    license: anthropics-official
+    notice: |
+      frontend-design sub-skill from anthropics/skills (source-available; anthropics-official carve-out per .planning/research/v0.2.0-extensions.md § 1).
+      D-08 "做出风格" override anchor — primary expert when user requests style-led / distinctive / bold design.
+      Routing complementary to ui-ux-pro-max (data-driven / standards-based). See routing/decision_rules.yaml `ui-task-bold-style-override`.
+spec:
+  type: cc-skill-pack
+  component_type: command
+  category: design
+  install_type: git
+  install:
+    method: git-clone-with-setup
+    cmd: "rm -rf ~/.claude/skills/.cache/anthropics-skills-fe && git clone https://github.com/anthropics/skills.git ~/.claude/skills/.cache/anthropics-skills-fe && (cd ~/.claude/skills/.cache/anthropics-skills-fe && git checkout f458cee31a7577a47ba0c9a101976fa599385174) && mkdir -p ~/.claude/skills && cp -R ~/.claude/skills/.cache/anthropics-skills-fe/skills/frontend-design ~/.claude/skills/frontend-design && rm -rf ~/.claude/skills/.cache/anthropics-skills-fe"
+    git_ref: f458cee31a7577a47ba0c9a101976fa599385174
+    idempotent_check: "test -f ~/.claude/skills/frontend-design/SKILL.md"
+  verify:
+    cmd: "test -f ~/.claude/skills/frontend-design/SKILL.md"
+    timeout_ms: 5000
+    expected_exit_code: 0
+  uninstall:
+    cmd: "rm -rf ~/.claude/skills/frontend-design"
+    cleanup_paths:
+      - ~/.claude/skills/frontend-design
+  upstream_health:
+    stability: stable
+    last_check: "2026-05-16"
+    last_known_good_version: main-2026-05-09
+    fallback_action: warn
+  signed_by: easyinplay
+  platforms:
+    - linux
+    - darwin
+    - win32
+  decision_rules:
+    trigger: "user 请求 style-led / 独特创意 / 做出风格 / distinctive"
+    default_expert: frontend-design
+    arbitration_rule: "frontend-design 主导剩余维度 (layout / motion / decoration); ui-ux-pro-max 补标准化主方案"
+    override_signals:
+      - phrase: "做出风格"
+        use: frontend-design
+      - phrase: "experimental"
+        use: frontend-design
+      - phrase: "design-led"
+        use: frontend-design
+    # Phase 2.3 W2 T2.5 (S3 plan-check fix) — 双向 redirect 一致性。
+    # frontend-design 拒绝 → ui-ux-pro-max (sister 镜射 ui-ux-pro-max 拒绝 → frontend-design,见该 manifest)
+    do_not_use_when:
+      - data-driven
+      - 标准化
+      - design system 严谨
+      - 数据可视化
+    if_rejected_use: ui-ux-pro-max

package/manifests/skill-packs/gsd.yaml

@@ -0,0 +1,43 @@
+# yaml-language-server: $schema=../../schemas/manifest.v1.schema.json
+apiVersion: harnessed/v1
+kind: Manifest
+metadata:
+  name: gsd
+  display_name: GSD (Get Shit Done)
+  description: Project-manager orchestrator providing /gsd-* discuss-plan-execute-verify workflow.
+  upstream:
+    source: get-shit-done-cc
+    homepage: https://github.com/gsd-build/get-shit-done
+    repository: https://github.com/gsd-build/get-shit-done.git
+    license: MIT
+    notice: GSD by gsd-build (TACHES), used as orchestration layer in harnessed plan-feature workflow.
+spec:
+  type: cli-npm
+  component_type: command
+  category: engineering
+  install_type: npm
+  install:
+    method: npm-cli
+    cmd: "npx --yes get-shit-done-cc@^1.41.0 install"
+    npm_version: ^1.41.0
+    idempotent_check: "test -d ~/.claude/skills/gsd"
+  verify:
+    cmd: "npx --yes get-shit-done-cc@^1.41.0 --version"
+    timeout_ms: 10000
+  uninstall:
+    cmd: "rm -rf ~/.claude/skills/gsd"
+    cleanup_paths:
+      - ~/.claude/skills/gsd
+  upstream_health:
+    stability: beta
+    last_check: "2026-05-11"
+    last_known_good_version: 1.41.2
+    fallback_action: warn
+  signed_by: easyinplay
+  platforms:
+    - linux
+    - darwin
+    - win32
+  tested_with_versions:
+    node_versions:
+      - "22"

package/manifests/skill-packs/gstack.yaml

@@ -0,0 +1,40 @@
+# yaml-language-server: $schema=../../schemas/manifest.v1.schema.json
+apiVersion: harnessed/v1
+kind: Manifest
+metadata:
+  name: gstack
+  display_name: gstack
+  description: Virtual startup team skills (CEO/Eng/Designer/Paranoid Engineer) for governance gates.
+  upstream:
+    source: gstack
+    homepage: https://gstacks.org
+    repository: https://github.com/garrytan/gstack.git
+    license: MIT
+    notice: gstack by Garry Tan, used as governance layer per harnessed plan-feature workflow.
+spec:
+  type: cc-skill-pack
+  component_type: command
+  category: engineering
+  install_type: git
+  install:
+    method: git-clone-with-setup
+    cmd: "git clone https://github.com/garrytan/gstack.git ~/.claude/skills/gstack && cd ~/.claude/skills/gstack && bash ./setup.sh"
+    git_ref: 74895062fb8a3acbf9f66cd088a83359aaaa56cd
+    idempotent_check: "test -d ~/.claude/skills/gstack/.git"
+  verify:
+    cmd: "test -f ~/.claude/skills/gstack/skills/office-hours.md"
+    timeout_ms: 5000
+  uninstall:
+    cmd: "rm -rf ~/.claude/skills/gstack"
+    cleanup_paths:
+      - ~/.claude/skills/gstack
+  upstream_health:
+    stability: stable
+    last_check: "2026-05-11"
+    last_known_good_version: main-269-commits
+    fallback_action: warn
+  signed_by: easyinplay
+  platforms:
+    - linux
+    - darwin
+    - win32

package/manifests/skill-packs/karpathy-skills.yaml

@@ -0,0 +1,64 @@
+# yaml-language-server: $schema=../../schemas/manifest.v1.schema.json
+apiVersion: harnessed/v1
+kind: Manifest
+metadata:
+  name: karpathy-skills
+  display_name: Karpathy Baseline (心法 always-on)
+  description: Andrej Karpathy 心法 always-on SKILL-ONLY injection (D-02 锁 不动 CLAUDE.md).
+  upstream:
+    source: github.com/forrestchang/andrej-karpathy-skills
+    homepage: https://github.com/forrestchang/andrej-karpathy-skills
+    repository: https://github.com/forrestchang/andrej-karpathy-skills.git
+    license: MIT
+    notice: |
+      rules attributed to Andrej Karpathy; distilled to ~/.claude/skills/karpathy-baseline/SKILL.md
+      from source-of-truth skills/karpathy-baseline/SKILL.md in this repository. D-02 SKILL-ONLY
+      injection — CLAUDE.md untouched (replaces prior CLAUDE.md sed-injection path).
+spec:
+  type: cc-skill-pack
+  component_type: command
+  category: meta
+  # Phase 2.3 W6 DI-1 hotfix — install_type: git (not skill) per ADR 0007 1:N
+  # closure (skill ∈ {cc-plugin-marketplace, npx-skill-installer}; git ∈ {git-clone-with-setup}).
+  # Semantic: karpathy-baseline IS a skill in nature (placed at ~/.claude/skills/),
+  # but its install method is local-copy from a git-origin upstream (forrestchang/
+  # andrej-karpathy-skills) — install_type tracks the install method semantics
+  # (file-system shape), not the runtime artifact placement.
+  install_type: git
+  install:
+    # Phase 2.3 W6 DI-1 hotfix — git_ref schema pin (Phase 1.1.1 hotfix M1 GIT_REF_PATTERN
+    # requires 7-40 hex SHA or SemVer tag; "HEAD" is rejected by the manifest schema).
+    # NOTE: cmd uses local `cp -R skills/karpathy-baseline ~/.claude/skills/` —
+    # git_ref is semantically UNUSED by this local-copy install path. The all-zeros
+    # SHA below is a 40-hex schema-compliant placeholder. The canonical upstream
+    # this SKILL.md derives from is forrestchang/andrej-karpathy-skills (see
+    # metadata.upstream.repository) — pin to a real SHA when the local-copy path
+    # is migrated to a true `git clone` install method (deferred to v0.2.4+).
+    method: git-clone-with-setup
+    cmd: |
+      if [ -f ~/.claude/CLAUDE.md ]; then
+        node scripts/strip-claude-md-section.mjs "<!-- karpathy-skills:start -->" "<!-- karpathy-skills:end -->" ~/.claude/CLAUDE.md \
+          && echo "[migration] cleaned legacy karpathy-skills CLAUDE.md block (D-02 SKILL-ONLY transition; cross-platform via node script)"
+      fi
+      mkdir -p ~/.claude/skills
+      cp -R skills/karpathy-baseline ~/.claude/skills/
+    git_ref: "0000000000000000000000000000000000000000"
+    idempotent_check: "test -f ~/.claude/skills/karpathy-baseline/SKILL.md"
+  verify:
+    cmd: "test -f ~/.claude/skills/karpathy-baseline/SKILL.md"
+    timeout_ms: 5000
+    expected_exit_code: 0
+  uninstall:
+    cmd: "rm -rf ~/.claude/skills/karpathy-baseline"
+    cleanup_paths:
+      - ~/.claude/skills/karpathy-baseline
+  upstream_health:
+    stability: stable
+    last_check: "2026-05-16"
+    last_known_good_version: skill-only-v1
+    fallback_action: warn
+  signed_by: easyinplay
+  platforms:
+    - linux
+    - darwin
+    - win32

package/manifests/skill-packs/mattpocock-skills.yaml

@@ -0,0 +1,40 @@
+# yaml-language-server: $schema=../../schemas/manifest.v1.schema.json
+apiVersion: harnessed/v1
+kind: Manifest
+metadata:
+  name: mattpocock-skills
+  display_name: mattpocock-skills
+  description: 17 single-slash command skills (/diagnose /zoom-out /tdd /grill-with-docs etc.) by Matt Pocock.
+  upstream:
+    source: mattpocock/skills
+    homepage: https://github.com/mattpocock/skills
+    repository: https://github.com/mattpocock/skills.git
+    license: MIT
+    notice: mattpocock-skills by Matt Pocock, used as on-demand engineering tactics (招式) in harnessed.
+spec:
+  type: cc-skill-pack
+  component_type: command
+  category: engineering
+  install_type: skill
+  install:
+    method: npx-skill-installer
+    cmd: "npx --yes skills@latest add mattpocock/skills"
+    npm_version: ^1.0.0
+    idempotent_check: "test -d ~/.claude/skills/mattpocock-skills"
+  verify:
+    cmd: "test -f ~/.claude/skills/mattpocock-skills/diagnose.md"
+    timeout_ms: 5000
+  uninstall:
+    cmd: "rm -rf ~/.claude/skills/mattpocock-skills"
+    cleanup_paths:
+      - ~/.claude/skills/mattpocock-skills
+  upstream_health:
+    stability: stable
+    last_check: "2026-05-11"
+    last_known_good_version: main-76-commits
+    fallback_action: warn
+  signed_by: easyinplay
+  platforms:
+    - linux
+    - darwin
+    - win32

package/manifests/skill-packs/planning-with-files.yaml

@@ -0,0 +1,45 @@
+# yaml-language-server: $schema=../../schemas/manifest.v1.schema.json
+#
+# NOTE: spec.install.cmd is a Claude Code REPL slash command, NOT a shell command.
+# cc-plugin-marketplace install method's actual mechanism is undefined for
+# headless installer execution. See progress.md § B F20.
+apiVersion: harnessed/v1
+kind: Manifest
+metadata:
+  name: planning-with-files
+  display_name: planning-with-files
+  description: Persistent 3-file planning skill (task_plan.md / findings.md / progress.md) Manus-style.
+  upstream:
+    source: planning-with-files
+    homepage: https://github.com/OthmanAdi/planning-with-files
+    repository: https://github.com/OthmanAdi/planning-with-files.git
+    license: MIT
+    notice: planning-with-files by OthmanAdi, used as plan-persistence base in harnessed plan-feature workflow.
+spec:
+  type: cc-skill-pack
+  component_type: command
+  category: engineering
+  install_type: skill
+  install:
+    method: cc-plugin-marketplace
+    cmd: "/plugin marketplace add OthmanAdi/planning-with-files && /plugin install planning-with-files@planning-with-files"
+    git_ref: v2.37.0
+    idempotent_check: "/plugin list | grep -q planning-with-files"
+    marketplace_source:        # ADR 0005 — third-party marketplace structured metadata
+      source: github
+      repo: OthmanAdi/planning-with-files
+  verify:
+    cmd: "/plugin list | grep -q planning-with-files"
+    timeout_ms: 5000
+  uninstall:
+    cmd: "/plugin uninstall planning-with-files@planning-with-files"
+  upstream_health:
+    stability: stable
+    last_check: "2026-05-11"
+    last_known_good_version: 2.37.0
+    fallback_action: warn
+  signed_by: easyinplay
+  platforms:
+    - linux
+    - darwin
+    - win32