mishkan-harness 0.2.0 → 0.2.3

package/payload/mishkan/agents/huram.md

@@ -62,5 +62,7 @@ Approval gate via `/plan`. pnpm only. WCAG 2.2 AA. Core Web Vitals budgets.
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/hushai.md

@@ -42,6 +42,7 @@ you do not write or block code (that is Ira/Joab/Benaiah).
 ## Skills (invoke on demand)
 
 - `hushai-security-advisor-craft` — ASVS prioritisation + delivery-vs-security counsel; advisory-only
+- `graphify-query-craft` — query the project code-structure graph (~1.8k tokens vs ~80k+ grep+Read) before reading source for any structural question (who calls X, what depends on Y, where is the entry point). Per D-009 amended scope: all code-touching dev agents.
 - `security-threat-model` — advisory threat-model review
 - `code-review-security` — advisory security review
 
@@ -55,5 +56,7 @@ facts. English for all output.
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/igal.md

@@ -54,5 +54,7 @@ No `/plan` (collect-only role).
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/ira.md

@@ -65,6 +65,7 @@ finding:
 ## Skills (invoke on demand)
 
 - `ira-code-security-craft` — any code-level security review (the
+- `graphify-query-craft` — query the project code-structure graph (~1.8k tokens vs ~80k+ grep+Read) before reading source for any structural question (who calls X, what depends on Y, where is the entry point). Per D-009 amended scope: all code-touching dev agents.
   pre-block rubric, the false-positive guard list, severity calibration,
   and durable remediation patterns — the depth lives in this skill)
 - `code-review-security` — code-level security review
@@ -82,5 +83,7 @@ facts. English for all output.
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/jahaziel.md

@@ -51,6 +51,7 @@ finding:
 ## Skills (invoke on demand)
 
 - `qa-evaluation-craft` — anchor-every-finding + structured-findings discipline (shared with uriah)
+- `graphify-query-craft` — query the project code-structure graph (~1.8k tokens vs ~80k+ grep+Read) before reading source for any structural question (who calls X, what depends on Y, where is the entry point). Per D-009 amended scope: all code-touching dev agents.
 - `e2e-testing-patterns` — front-end E2E review
 - `webapp-testing` — test strategy review
 - `javascript-testing-patterns` — unit/integration test review
@@ -67,5 +68,7 @@ No `/plan` (evaluate against known rules).
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/jakin.md

@@ -62,5 +62,7 @@ facts. English for all output.
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/jehonathan.md

@@ -43,6 +43,7 @@ You take structured graph knowledge and make it legible. You publish.
 ## Skills (invoke on demand)
 
 - `jehonathan-publication-craft` — Cognee query + Stripe-quality bar + source-grounded publication
+- `graphify-query-craft` — query the project code-structure graph (~1.8k tokens vs ~80k+ grep+Read) before reading source for any structural question (who calls X, what depends on Y, where is the entry point). Per D-009 amended scope: all code-touching dev agents.
 - `doc-coauthoring` — knowledge publication
 - `context-compress` — compress findings before publish
 
@@ -58,5 +59,7 @@ Diátaxis quadrant declared.
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/jehoshaphat.md

@@ -64,5 +64,7 @@ Diátaxis quadrant on every doc. MADR for ADRs. Keep a Changelog. No undated doc
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/joab.md

@@ -53,6 +53,7 @@ finding:
 ## Skills (invoke on demand)
 
 - `joab-app-security-craft` — auth flows + CSRF/XSS + OWASP API Top 10 across surfaces
+- `graphify-query-craft` — query the project code-structure graph (~1.8k tokens vs ~80k+ grep+Read) before reading source for any structural question (who calls X, what depends on Y, where is the entry point). Per D-009 amended scope: all code-touching dev agents.
 - `api-security-best-practices` — API attack-surface review
 - `auth-implementation-patterns` — auth flow review
 - `code-review-security` — client/surface security review
@@ -67,5 +68,7 @@ facts. English for all output.
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/joah.md

@@ -42,6 +42,7 @@ You document the specific project: its decisions, its operations, its history.
 ## Skills (invoke on demand)
 
 - `documentation-craft` — Diátaxis + pull-based discipline + source-grounded writing (shared with the other 2 Sefer scope specialists)
+- `graphify-query-craft` — query the project code-structure graph (~1.8k tokens vs ~80k+ grep+Read) before reading source for any structural question (who calls X, what depends on Y, where is the entry point). Per D-009 amended scope: all code-touching dev agents.
 - `architecture-decision-records` — project-layer ADRs
 - `doc-coauthoring` — runbook / changelog authoring
 - `changelog-automation` — release-note generation
@@ -58,5 +59,7 @@ MADR for ADRs. Keep a Changelog. Diátaxis quadrant.
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/maaseiah.md

@@ -57,5 +57,7 @@ No `/plan` (collect-only role).
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/meremoth.md

@@ -44,6 +44,7 @@ You work the delivery layer: CI/CD, build, release automation.
 ## Skills (invoke on demand)
 
 - `meremoth-devops-craft` — pipeline stages + SOPS marshalling + CI-and-remote-script rule
+- `graphify-query-craft` — query the project code-structure graph (~1.8k tokens vs ~80k+ grep+Read) before reading source for any structural question (who calls X, what depends on Y, where is the entry point). Per D-009 amended scope: all code-touching dev agents.
 - `github-actions-templates` — GitHub Actions pipelines
 - `gitlab-ci-patterns` — GitLab CI pipelines
 - `deployment-pipeline-design` — release orchestration
@@ -61,5 +62,7 @@ No `:latest`. SOPS for secrets.
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/meshullam.md

@@ -46,6 +46,7 @@ change, the alternatives, what is affected, the rollback path.
 ## Skills (invoke on demand)
 
 - `meshullam-infra-design-craft` — C4 + Compose/Terraform/Helm + default-deny networking
+- `graphify-query-craft` — query the project code-structure graph (~1.8k tokens vs ~80k+ grep+Read) before reading source for any structural question (who calls X, what depends on Y, where is the entry point). Per D-009 amended scope: all code-touching dev agents.
 - `deployment-pipeline-design` — delivery topology
 - `multi-cloud-architecture` — cross-cloud topology
 - `terraform-module-library` — Terraform module work
@@ -63,5 +64,7 @@ No `:latest`. All resources tagged. SOPS for secrets.
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/nathan.md

@@ -49,6 +49,7 @@ approval needed. Capture the outcome as an ADR (MADR) for Sefer to publish.
 ## Skills (invoke on demand)
 
 - `nathan-architecture-craft` — any architecture decision (how Nathan reasons,
+- `graphify-query-craft` — query the project code-structure graph (~1.8k tokens vs ~80k+ grep+Read) before reading source for any structural question (who calls X, what depends on Y, where is the entry point). Per D-009 amended scope: all code-touching dev agents.
   with worked examples — the depth lives in this skill, not in this file)
 - `architecture-decision-records` — writing ADRs
 - `microservices-patterns` — service decomposition decisions
@@ -66,5 +67,7 @@ Approval gate via `/plan`.
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/nehemiah.md

@@ -89,5 +89,7 @@ Approval gate on consequential decisions via `/plan`.
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/obed.md

@@ -56,5 +56,7 @@ Core Web Vitals budgets (LCP < 2.5s, INP < 200ms, CLS < 0.1).
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/oholiab.md

@@ -46,6 +46,7 @@ Plan before a **design-system or state-management architectural change**.
 ## Skills (invoke on demand)
 
 - `oholiab-design-system-craft` — tokens + components + theming + cost-of-extension (the depth lives here)
+- `graphify-query-craft` — query the project code-structure graph (~1.8k tokens vs ~80k+ grep+Read) before reading source for any structural question (who calls X, what depends on Y, where is the entry point). Per D-009 amended scope: all code-touching dev agents.
 - `design-system-patterns` — DS architecture and tokens
 - `tailwind-design-system` — Tailwind tokenisation
 - `web-component-design` — component contracts
@@ -63,5 +64,7 @@ pnpm only. WCAG 2.2 AA. Core Web Vitals budgets. TanStack Query/Router.
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/palal.md

@@ -43,6 +43,7 @@ You work at the structural intersection: OS, virtualisation, networking.
 ## Skills (invoke on demand)
 
 - `palal-systems-craft` — diagnose-before-fix + two-causes + runtime/network/iptables discipline
+- `graphify-query-craft` — query the project code-structure graph (~1.8k tokens vs ~80k+ grep+Read) before reading source for any structural question (who calls X, what depends on Y, where is the entry point). Per D-009 amended scope: all code-touching dev agents.
 - `bash-defensive-patterns` — shell hardening
 - `k8s-security-policies` — NetworkPolicy / PSP / RBAC
 - `mtls-configuration` — mTLS plumbing
@@ -59,5 +60,7 @@ Two root causes on non-trivial failures (e.g. an incident is often applicative +
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/phinehas.md

@@ -69,5 +69,7 @@ Two root causes on non-trivial failures. Approval gate via `/plan`.
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/rehum.md

@@ -56,5 +56,7 @@ facts. English for all output.
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/salma.md

@@ -46,6 +46,7 @@ Plan before any **state-management architectural change**.
 ## Skills (invoke on demand)
 
 - `salma-frontend-implementation-craft` — TanStack + tokens + state-management discipline (the depth lives here)
+- `graphify-query-craft` — query the project code-structure graph (~1.8k tokens vs ~80k+ grep+Read) before reading source for any structural question (who calls X, what depends on Y, where is the entry point). Per D-009 amended scope: all code-touching dev agents.
 - `react-modernization` — React refactors and patterns
 - `nextjs-app-router-patterns` — Next.js App Router work
 - `responsive-design` — responsive layouts
@@ -65,5 +66,7 @@ pnpm only. WCAG 2.2 AA. Core Web Vitals budgets.
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/seraiah.md

@@ -69,5 +69,7 @@ Diátaxis quadrant declared.
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/shallum.md

@@ -48,6 +48,7 @@ data-safety implications, the rollback path, and what depends on the schema.
 ## Skills (invoke on demand)
 
 - `shallum-database-craft` — two-shape modeling + EXPLAIN-as-test + zero-downtime migration patterns
+- `graphify-query-craft` — query the project code-structure graph (~1.8k tokens vs ~80k+ grep+Read) before reading source for any structural question (who calls X, what depends on Y, where is the entry point). Per D-009 amended scope: all code-touching dev agents.
 - `postgresql-table-design` — schema design
 - `sql-optimization-patterns` — query tuning
 - `database-migration` — zero-downtime migration planning
@@ -62,5 +63,7 @@ facts. English for all output.
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/shaphan.md

@@ -60,5 +60,7 @@ facts. English for all output.
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/shemaiah.md

@@ -63,5 +63,7 @@ facts. English for all output.
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/shevna.md

@@ -40,6 +40,7 @@ You embed with the teams and document what they produce.
 ## Skills (invoke on demand)
 
 - `documentation-craft` — Diátaxis + pull-based discipline + source-grounded writing (shared with the other 2 Sefer scope specialists)
+- `graphify-query-craft` — query the project code-structure graph (~1.8k tokens vs ~80k+ grep+Read) before reading source for any structural question (who calls X, what depends on Y, where is the entry point). Per D-009 amended scope: all code-touching dev agents.
 - `doc-coauthoring` — team-layer doc authoring
 
 ## Constraints
@@ -54,5 +55,7 @@ Diátaxis quadrant declared.
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/uriah.md

@@ -51,6 +51,7 @@ finding:
 ## Skills (invoke on demand)
 
 - `qa-evaluation-craft` — anchor-every-finding + structured-findings discipline (shared with jahaziel)
+- `graphify-query-craft` — query the project code-structure graph (~1.8k tokens vs ~80k+ grep+Read) before reading source for any structural question (who calls X, what depends on Y, where is the entry point). Per D-009 amended scope: all code-touching dev agents.
 - `python-testing-patterns` — test-quality evaluation
 - `code-review-excellence` — backend code review rubric
 
@@ -66,5 +67,7 @@ No `/plan` (evaluate against known rules).
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/zaccur.md

@@ -54,5 +54,7 @@ No `/plan` (collect-only role).
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/zadok.md

@@ -48,6 +48,7 @@ guarantees to be fixed, and what they bind.
 ## Skills (invoke on demand)
 
 - `zadok-contract-craft` — any contract decision (how Zadok reasons,
+- `graphify-query-craft` — query the project code-structure graph (~1.8k tokens vs ~80k+ grep+Read) before reading source for any structural question (who calls X, what depends on Y, where is the entry point). Per D-009 amended scope: all code-touching dev agents.
   with worked examples — the depth lives in this skill, not in this file)
 - `openapi-spec-generation` — contract authoring
 - `fastapi-templates` — FastAPI scaffolding (when the contract lives on FastAPI)
@@ -63,5 +64,7 @@ facts. English for all output.
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/agents/zerubbabel.md

@@ -65,5 +65,7 @@ OpenAPI 3.1 contract before any endpoint. Approval gate via `/plan`.
 
 ## Dynamic Context Injection Point
 
-<!-- Project sprint state from ./CLAUDE.md is injected below at runtime.
-     Everything above this line is the cacheable static role prefix. -->
+<!-- Cacheable prefix boundary. Everything above this line must stay
+     byte-identical between calls for prompt caching to fire. Project
+     sprint state from ./CLAUDE.md is loaded by Claude Code into the
+     parent session context, not injected here. -->

package/payload/mishkan/commands/code-graph.md

@@ -0,0 +1,35 @@
+---
+name: code-graph
+description: Inspect, refresh, or open the Graphify code-structure graph for the current project. Wraps `npx mishkan-harness code-graph` so it's reachable from any Claude Code session. Three subcommands — `status` (default, prints nodes/edges/last-scan), `scan` (runs `graphify update .` to refresh the index), `open` (opens graph.html in the browser). Use when you need to know the current state of the code graph, when you've made code changes and want a fresh index, or when you want to visually browse the call structure.
+---
+
+# /code-graph
+
+Wrapper for the harness's code-graph (Graphify) inspection. Runs the
+`npx mishkan-harness code-graph` CLI subcommand on behalf of the user.
+
+## Subcommands
+
+```bash
+npx mishkan-harness code-graph status   # default — nodes/edges/last-scan
+npx mishkan-harness code-graph scan     # refresh the index (graphify update .)
+npx mishkan-harness code-graph open     # open graph.html in browser
+```
+
+## When to suggest each
+
+- **`status`** — first action when the user asks "is graphify up to date" or "how big is my graph". Cheap, no side effects.
+- **`scan`** — after a meaningful round of code edits (refactor, new module, dependency added). Or when the advisory hook fires and the agent isn't sure whether the graph reflects current state.
+- **`open`** — when the user asks to "see" or "visualise" the call graph. Opens the static HTML Graphify writes alongside `graph.json`.
+
+## Behaviour
+
+- Looks for `graphify-out/` in the current project root. If missing, surfaces the install hint (`graphify update .` to create one, or `uv tool install "graphifyy>=0.8.33"` if graphify itself isn't installed).
+- Always succeeds with output even when the graph is empty or stale — the CLI is designed to be informative, not gating.
+- Stateful: `scan` modifies `graphify-out/`. `status` and `open` are read-only.
+
+## See also
+
+- ADR `D-008` and `D-009` — the cost rationale and the advisory-hook design
+- `docs/usage/11-graphify.md` — full usage chapter
+- `graphify-query-craft` skill — when and how the 20 code-touching agents query

package/payload/mishkan/commands/eval-baruch.md

@@ -0,0 +1,57 @@
+---
+name: eval-baruch
+description: Run the Baruch contract eval — validates research-log schema enforcement (valid fixtures pass, invalid fixtures fail) and asserts the golden case's semantic shape. Use BEFORE committing any change to research-log.schema.json, validate-research-log.sh, agents/baruch.md, or the Baruch craft skill. Does NOT call an LLM — it's a fast deterministic contract test (typically < 5s).
+---
+
+# /eval-baruch
+
+Exercise Baruch's contract end-to-end without calling an LLM:
+
+1. Every fixture under `evals/baruch/fixtures/valid/` MUST validate (catches over-strictness).
+2. Every fixture under `evals/baruch/fixtures/invalid/` MUST be rejected (catches under-strictness).
+3. The golden case `evals/baruch/golden_case/produced.json` MUST validate AND satisfy every jq assertion in `expected.yaml`.
+
+## How to invoke
+
+```bash
+cd payload/mishkan/evals/baruch && ./run.sh
+echo "exit: $?"
+```
+
+Or from anywhere in the harness checkout:
+
+```bash
+bash payload/mishkan/evals/baruch/run.sh
+```
+
+Exit codes:
+- `0` → all checks passed
+- `1` → one or more checks failed
+- `2` → environment problem (missing `jq`, validator, or schema)
+
+## When to run
+
+- **Before any edit** to: `research-log.schema.json`, `validate-research-log.sh`, `agents/baruch.md`, the Baruch craft skill, or the eval itself.
+- **After any such edit**, before opening a PR (the GitHub workflow `.github/workflows/eval-baruch.yml` also runs on PR — local run catches regressions faster).
+- **As a sanity check** when investigating any Baruch output drift.
+
+## When NOT to run
+
+- Day-to-day code changes that don't touch the contract surface.
+- Live LLM testing — this eval doesn't run Baruch through an LLM. To do that, run the actual research pipeline against `golden_case/input.yaml`, compare the live output to `produced.json`, and update both `produced.json` and `expected.yaml` deliberately if the change is intentional.
+
+## What to do on failure
+
+| Symptom | Likely cause | Action |
+|---|---|---|
+| valid fixture rejected | schema/validator too strict OR fixture broken | compare schema vs fixture; fix whichever is wrong |
+| invalid fixture accepted | validator missing a check | add the missing check; re-run |
+| golden case fails expected.yaml | Baruch output drift (intentional or regression) | inspect diff; update `produced.json` + `expected.yaml` together if intentional |
+
+## See also
+
+- Eval README: `payload/mishkan/evals/baruch/README.md`
+- Schema: `payload/mishkan/templates/research-log.schema.json`
+- Validator: `payload/mishkan/scripts/validate-research-log.sh`
+- Baruch agent: `payload/mishkan/agents/baruch.md`
+- CI workflow: `.github/workflows/eval-baruch.yml`