repo-harness 0.14.0 → 0.14.2

package/AGENTS.md

@@ -90,7 +90,6 @@ bun src/cli/index.ts init --repo . --dry-run
 - Verification: Use root required checks plus local commands recorded in this capability contract.
 - Latest snapshot: `(none yet)`
 - Semantic diagram source: `docs/architecture/modules/verification/evals-checks.md`
-- Latest human diagram: `(none yet)`
 - Pending architecture request: `(none)`
 
 ## Active Workstreams

package/CLAUDE.md

@@ -90,7 +90,6 @@ bun src/cli/index.ts init --repo . --dry-run
 - Verification: Use root required checks plus local commands recorded in this capability contract.
 - Latest snapshot: `(none yet)`
 - Semantic diagram source: `docs/architecture/modules/verification/evals-checks.md`
-- Latest human diagram: `(none yet)`
 - Pending architecture request: `(none)`
 
 ## Active Workstreams

package/README.es.md

@@ -446,7 +446,8 @@ son dependencias empaquetadas ordinarias.
 | --- | --- | --- |
 | [Hylarucoder](https://x.com/hylarucoder) / Geju | El método de due diligence P1/P2/P3 y la práctica Geju que dieron forma a la disciplina de planning, tracing y decision-rationale de este workflow | Contribución metodológica y agradecimiento; no es una dependencia empaquetada |
 | Waza de [TW93](https://x.com/HiTw93), incluyendo `think`, `hunt`, `check` y `health` | Planning diario, bug hunts, verificación, health checks y sync de skill Codex-first | Instalado a través del skills CLI en los host skill roots |
-| `mermaid` | Diagramas de architecture y system-flow legibles por humanos cuando Mermaid no alcanza | Skill runtime-referenced, no vendored en los repos generados |
+| `mermaid` | Soporte de authoring y review para bloques Mermaid fenced dentro de la documentación de arquitectura | Skill externo runtime-referenced, no vendored en los repos generados y sin generar HTML standalone |
+| [`reverse-skill-router`](https://github.com/zhaoxuya520/reverse-skill) | Enruta tareas de ingeniería inversa y seguridad a playbooks especializados | Skill recomendado pero solo explícito (`--with-reverse-skill`); queda fuera de los perfiles porque la suposición upstream «objetivo mencionado = autorizado» exige una revisión independiente del scope |
 | CodeGraph (`@colbymchenry/codegraph`) | Navegación symbol-aware, impact tracing y readiness checks para este repo self-host | Dev dependency en este repo; los repos generados se mantienen global-MCP-first salvo que la policy haga opt-in |
 | [Oracle](https://github.com/steipete/oracle) de [Peter Steinberger](https://x.com/steipete) (`@steipete/oracle`, MIT) | Motor de consulta de navegador GPT Pro / ChatGPT Web por defecto, al que el Oracle provider `chatgpt-browser` invoca externamente (shell out) para las consultas `gptpro` | Binario resuelto externamente (`--oracle-bin`, `REPO_HARNESS_ORACLE_BIN`, `node_modules/.bin`, o `PATH`); nunca se descarga automáticamente, y un binario ausente es un fallo duro de `ORACLE_NOT_INSTALLED` |
 | OpenAI Codex | Agente de ejecución primario para implementación repo-local, verificación y GitHub contributor attribution cuando un commit incluye materialmente trabajo escrito por Codex | Un runtime de agente externo; la atribución es un trailer de commit explícito, no automatización oculta de hooks |
@@ -466,8 +467,8 @@ repositorio adopte la misma política.
 
 ## Versión actual
 
-- Paquete npm: `repo-harness@0.14.0`
-- Sello de workflow generado: `repo-harness@0.14.0+template@0.14.0`
+- Paquete npm: `repo-harness@0.14.2`
+- Sello de workflow generado: `repo-harness@0.14.2+template@0.14.2`
 - Repositorio de GitHub: `Ancienttwo/repo-harness`
 - Notas de versión e historial: [`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/README.fr.md

@@ -77,7 +77,7 @@ alias de skill repo-harness, installe les hook adapters de niveau utilisateur,
 et enregistre un install profile explicite. Il est idempotent et n'applique
 aucun fichier de workflow repo-local au répertoire courant. `--dry-run --json`
 liste d'abord les composants à installer, ignorer et supprimer. Profiles,
-delegation mode, commandes de rafraîchissement, et l'audit read-only `setup
+autorité de délégation Codex native, commandes de rafraîchissement, et l'audit read-only `setup
 check` : [`install-profiles.md`](docs/reference-configs/install-profiles.md).
 
 ### 3. Prévisualiser le contrat repo-local
@@ -441,7 +441,8 @@ pas des dépendances embarquées ordinaires.
 | --- | --- | --- |
 | [Hylarucoder](https://x.com/hylarucoder) / Geju | Méthode de due-diligence P1/P2/P3 et pratique Geju qui ont façonné la discipline de planning, de trace et de decision-rationale dans ce workflow | Contribution méthodologique et remerciement ; pas une dépendance embarquée |
 | Waza par [TW93](https://x.com/HiTw93), incluant `think`, `hunt`, `check` et `health` | Planning quotidien, bug hunts, vérification, health checks et skill sync Codex-first | Installé via le skills CLI dans les host skill roots |
-| `mermaid` | Diagrammes d'architecture et de system-flow lisibles par un humain quand Mermaid seul ne suffit pas | Skill référencé au runtime, non vendored dans les dépôts générés |
+| `mermaid` | Support d'authoring et de review pour les blocs Mermaid fenced dans la documentation d'architecture | Skill externe référencé au runtime, non vendored dans les dépôts générés et ne générant pas de HTML standalone |
+| [`reverse-skill-router`](https://github.com/zhaoxuya520/reverse-skill) | Route les tâches de rétro-ingénierie et de sécurité vers les playbooks spécialisés | Skill recommandé mais uniquement explicite (`--with-reverse-skill`) ; hors profils car l'hypothèse amont « cible mentionnée = autorisée » exige une revue indépendante du scope |
 | CodeGraph (`@colbymchenry/codegraph`) | Navigation symbol-aware, impact tracing et readiness checks pour ce dépôt self-host | Dev dependency dans ce dépôt ; les dépôts générés restent global-MCP-first sauf opt-in de la policy |
 | [Oracle](https://github.com/steipete/oracle) par [Peter Steinberger](https://x.com/steipete) (`@steipete/oracle`, MIT) | Moteur par défaut de consult navigateur GPT Pro / ChatGPT Web, que le provider Oracle `chatgpt-browser` invoque en shell out pour les consults `gptpro` | Binaire résolu en externe (`--oracle-bin`, `REPO_HARNESS_ORACLE_BIN`, `node_modules/.bin`, ou `PATH`) ; jamais téléchargé automatiquement, et un binaire manquant est une erreur franche `ORACLE_NOT_INSTALLED` |
 | OpenAI Codex | Agent d'exécution principal pour l'implémentation repo-local, la vérification, et l'attribution de contributeur GitHub quand un commit inclut matériellement du travail écrit par Codex | Agent runtime externe ; l'attribution est un commit trailer explicite, pas une automatisation cachée par hook |
@@ -461,8 +462,8 @@ adopte la même policy.
 
 ## Release actuelle
 
-- Package npm : `repo-harness@0.14.0`
-- Generated workflow stamp : `repo-harness@0.14.0+template@0.14.0`
+- Package npm : `repo-harness@0.14.2`
+- Generated workflow stamp : `repo-harness@0.14.2+template@0.14.2`
 - Dépôt GitHub : `Ancienttwo/repo-harness`
 - Notes et historique de release : [`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/README.ja.md

@@ -76,7 +76,7 @@ repo-harness の skill alias を更新し、user-level の hook adapter をイ
 明示的な install profile を記録します。冪等(idempotent)であり、repo-local な
 workflow ファイルをカレントディレクトリへ適用することはありません。
 `--dry-run --json` を使うと、インストール・skip・削除される component を
-先に一覧できます。profile、delegation mode、refresh コマンド、read-only な
+先に一覧できます。profile、native Codex delegation authority、refresh コマンド、read-only な
 `setup check` audit については
 [`install-profiles.md`](docs/reference-configs/install-profiles.md)
 を参照してください。
@@ -449,7 +449,8 @@ agent runtime を中心に構築されています。これらは通常の bundl
 | --- | --- | --- |
 | [Hylarucoder](https://x.com/hylarucoder) / Geju | この workflow における planning、tracing、decision-rationale の規律を形作った P1/P2/P3 due-diligence method と Geju の実践 | Methodology への貢献と謝辞であり、bundled dependency ではありません |
 | Waza by [TW93](https://x.com/HiTw93)(`think`、`hunt`、`check`、`health` を含む) | 日々の planning、bug hunt、verification、health check、Codex-first な skill sync | skills CLI を通じて host の skill root にインストールされます |
-| `mermaid` | Mermaid だけでは足りないときの、人間が読める architecture / system-flow diagram | Runtime で参照される skill であり、生成されたリポジトリには vendor されません |
+| `mermaid` | architecture 文書内の Mermaid fenced block に対する authoring / review 支援 | Runtime で参照される外部 skill であり、生成されたリポジトリには vendor されず、standalone HTML も生成しません |
+| [`reverse-skill-router`](https://github.com/zhaoxuya520/reverse-skill) | リバースエンジニアリングと security task を専門 playbook にルーティングします | 推奨ですが明示 opt-in (`--with-reverse-skill`) のみ。upstream の「対象を言及 = 許可済み」という前提は独立した scope review が必要なため、profile には含めません |
 | CodeGraph(`@colbymchenry/codegraph`) | この self-host リポジトリのための symbol-aware navigation、impact tracing、readiness check | 本リポジトリでは dev dependency。生成されたリポジトリは、policy が opt-in しない限り global-MCP-first のままです |
 | [Oracle](https://github.com/steipete/oracle) by [Peter Steinberger](https://x.com/steipete)(`@steipete/oracle`、MIT) | `chatgpt-browser` の Oracle provider が `gptpro` consult のために shell out する、既定の GPT Pro / ChatGPT Web browser consult engine | 外部で解決される binary(`--oracle-bin`、`REPO_HARNESS_ORACLE_BIN`、`node_modules/.bin`、または `PATH`)。自動ダウンロードはされず、binary が見つからない場合は hard な `ORACLE_NOT_INSTALLED` failure になります |
 | OpenAI Codex | commit が実質的に Codex 作成の作業を含むときの、repo-local な実装・verification・GitHub contributor attribution を担う primary execution agent | 外部 agent runtime。attribution は隠れた hook automation ではなく、明示的な commit trailer です |
@@ -469,8 +470,8 @@ commit script や hooks に組み込まないでください。
 
 ## 現在の Release
 
-- npm package：`repo-harness@0.14.0`
-- Generated workflow stamp：`repo-harness@0.14.0+template@0.14.0`
+- npm package：`repo-harness@0.14.2`
+- Generated workflow stamp：`repo-harness@0.14.2+template@0.14.2`
 - GitHub repository：`Ancienttwo/repo-harness`
 - Release notes and history：[`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/README.md

@@ -74,7 +74,7 @@ The global bootstrap: installs the npm package as the global CLI, refreshes
 repo-harness skill aliases, installs user-level hook adapters, and records an
 explicit install profile. It is idempotent and does not apply repo-local workflow
 files to the current directory. `--dry-run --json` lists components to install,
-skip, and remove first. Profiles, delegation mode, refresh commands, and the
+skip, and remove first. Profiles, native Codex delegation authority, refresh commands, and the
 read-only `setup check` audit:
 [`install-profiles.md`](docs/reference-configs/install-profiles.md).
 
@@ -111,7 +111,7 @@ looks wrong, stop and read
 ### Update and remove
 
 ```bash
-repo-harness update          # refresh user-level CLI and runtime pieces
+repo-harness update          # reconcile CLI, mandatory deps, profile tooling, and CodeGraph
 repo-harness update --check  # read-only repair guidance, no writes
 repo-harness uninstall       # remove managed host adapters only
 ```
@@ -422,7 +422,8 @@ dependencies.
 | --- | --- | --- |
 | [Hylarucoder](https://x.com/hylarucoder) / Geju | P1/P2/P3 due-diligence method and Geju practice that shaped the planning, tracing, and decision-rationale discipline in this workflow | Methodology contribution and acknowledgement; not a bundled dependency |
 | Waza by [TW93](https://x.com/HiTw93), including `think`, `hunt`, `check`, and `health` | Daily planning, bug hunts, verification, health checks, and Codex-first skill sync | Installed through the skills CLI into host skill roots |
-| `mermaid` | Human-readable architecture and system-flow diagrams when Mermaid is not enough | Runtime-referenced skill, not vendored into generated repos |
+| `mermaid` | Authoring and readability review for Mermaid architecture and system-flow source | Runtime-referenced review skill, not vendored into generated repos and never an HTML artifact generator |
+| [`reverse-skill-router`](https://github.com/zhaoxuya520/reverse-skill) | Routes reverse-engineering and security tasks to specialist playbooks | Recommended explicit-only Skill (`--with-reverse-skill`); not profile-selected because upstream's target-mention authorization assumption requires independent scope review |
 | CodeGraph (`@colbymchenry/codegraph`) | Symbol-aware navigation, impact tracing, and readiness checks for this self-host repo | Dev dependency in this repo; generated repos stay global-MCP-first unless policy opts in |
 | [Oracle](https://github.com/steipete/oracle) by [Peter Steinberger](https://x.com/steipete) (`@steipete/oracle`, MIT) | Default GPT Pro / ChatGPT Web browser consult engine that the `chatgpt-browser` Oracle provider shells out to for `gptpro` consults | Externally-resolved binary (`--oracle-bin`, `REPO_HARNESS_ORACLE_BIN`, `node_modules/.bin`, or `PATH`); never auto-downloaded, and a missing binary is a hard `ORACLE_NOT_INSTALLED` failure |
 | OpenAI Codex | Primary execution agent for repo-local implementation, verification, and GitHub contributor attribution when a commit materially includes Codex-authored work | External agent runtime; attribution is an explicit commit trailer, not hidden hook automation |
@@ -441,8 +442,8 @@ repo-harness commit scripts or hooks unless that repo adopts the same policy.
 
 ## Current Release
 
-- npm package: `repo-harness@0.14.0`
-- Generated workflow stamp: `repo-harness@0.14.0+template@0.14.0`
+- npm package: `repo-harness@0.14.2`
+- Generated workflow stamp: `repo-harness@0.14.2+template@0.14.2`
 - GitHub repository: `Ancienttwo/repo-harness`
 - Release notes and history: [`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/README.zh-CN.md

@@ -73,7 +73,7 @@ repo-harness install
 这个全局 bootstrap 会把 npm 包安装成全局 CLI，刷新 repo-harness 的 skill
 aliases，安装 user-level hook adapters，并记录一份明确的 install profile。
 它是幂等的，不会把 repo-local workflow 文件应用到当前目录。`--dry-run
---json` 会先列出将要安装、跳过和移除的组件。Profile、delegation mode、
+--json` 会先列出将要安装、跳过和移除的组件。Profile、原生 Codex delegation authority、
 刷新命令，以及只读的 `setup check` audit，见
 [`install-profiles.md`](docs/reference-configs/install-profiles.md)。
 
@@ -428,7 +428,8 @@ dependency。
 | --- | --- | --- |
 | [Hylarucoder](https://x.com/hylarucoder) / Geju | P1/P2/P3 due-diligence 方法和 Geju 实践，塑造了这套 workflow 里 planning、tracing 和 decision-rationale 的纪律 | 方法论贡献和致谢；不是 bundled dependency |
 | [TW93](https://x.com/HiTw93) 的 Waza，包括 `think`、`hunt`、`check` 和 `health` | 日常 planning、bug hunt、verification、health check，以及 Codex-first 的 skill sync | 通过 skills CLI 安装进 host skill root |
-| `mermaid` | 当 Mermaid 不够用时，提供人类可读的 architecture 和 system-flow 图 | Runtime-referenced 的 skill，不会 vendor 进生成的仓库 |
+| `mermaid` | 为架构文档中的 Mermaid fenced blocks 提供 authoring 和 review 支持 | Runtime-referenced 的外部 skill，不会 vendor 进生成的仓库，也不会生成 standalone HTML |
+| [`reverse-skill-router`](https://github.com/zhaoxuya520/reverse-skill) | 将逆向工程和安全任务路由到专项 playbook | 推荐但仅显式安装（`--with-reverse-skill`）；上游把“提到目标”视作授权，因此必须独立审核 scope，不进入任何默认 profile |
 | CodeGraph（`@colbymchenry/codegraph`） | 为这个 self-host 仓库提供 symbol-aware 导航、impact tracing 和 readiness check | 本仓库的 dev dependency；生成的仓库默认保持 global-MCP-first，除非 policy 显式开启 |
 | [Peter Steinberger](https://x.com/steipete) 的 [Oracle](https://github.com/steipete/oracle)（`@steipete/oracle`，MIT） | `chatgpt-browser` 的 Oracle provider 为 `gptpro` consult 默认 shell 出去调用的 GPT Pro / ChatGPT Web 浏览器 consult 引擎 | 外部解析的 binary（`--oracle-bin`、`REPO_HARNESS_ORACLE_BIN`、`node_modules/.bin` 或 `PATH`）；从不自动下载，缺失 binary 会硬失败 `ORACLE_NOT_INSTALLED` |
 | OpenAI Codex | repo-local 实现和验证的主要执行 agent；commit 实质包含 Codex 产出内容时，也承担 GitHub contributor attribution | 外部 agent runtime；attribution 是显式的 commit trailer，不是隐藏的 hook automation |
@@ -448,8 +449,8 @@ policy。
 
 ## 当前 Release
 
-- npm package：`repo-harness@0.14.0`
-- Generated workflow stamp：`repo-harness@0.14.0+template@0.14.0`
+- npm package：`repo-harness@0.14.2`
+- Generated workflow stamp：`repo-harness@0.14.2+template@0.14.2`
 - GitHub repository：`Ancienttwo/repo-harness`
 - Release notes 和 history：[`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/assets/AGENTS.md

@@ -50,7 +50,6 @@ Owns the workflow-engine-contract-assets capability boundary declared in .archco
 - Verification: Use root required checks plus local commands recorded in this capability contract.
 - Latest snapshot: `(none yet)`
 - Semantic diagram source: `docs/architecture/modules/workflow-engine/contract-assets.md`
-- Latest human diagram: `(none yet)`
 - Pending architecture request: `(none)`
 
 ## Active Workstreams

package/assets/CLAUDE.md

@@ -50,7 +50,6 @@ Owns the workflow-engine-contract-assets capability boundary declared in .archco
 - Verification: Use root required checks plus local commands recorded in this capability contract.
 - Latest snapshot: `(none yet)`
 - Semantic diagram source: `docs/architecture/modules/workflow-engine/contract-assets.md`
-- Latest human diagram: `(none yet)`
 - Pending architecture request: `(none)`
 
 ## Active Workstreams

package/assets/hooks/AGENTS.md

@@ -62,7 +62,6 @@ Owns the runtime-harness-hook-adapters capability boundary declared in .archcont
 - Verification: Use root required checks plus local commands recorded in this capability contract.
 - Latest snapshot: `(none yet)`
 - Semantic diagram source: `docs/architecture/modules/runtime-harness/hook-adapters.md`
-- Latest human diagram: `(none yet)`
 - Pending architecture request: `(none)`
 
 ## Active Workstreams

package/assets/hooks/CLAUDE.md

@@ -62,7 +62,6 @@ Owns the runtime-harness-hook-adapters capability boundary declared in .archcont
 - Verification: Use root required checks plus local commands recorded in this capability contract.
 - Latest snapshot: `(none yet)`
 - Semantic diagram source: `docs/architecture/modules/runtime-harness/hook-adapters.md`
-- Latest human diagram: `(none yet)`
 - Pending architecture request: `(none)`
 
 ## Active Workstreams

package/assets/partials/05-workflow.partial.md

@@ -40,7 +40,7 @@ PLAN_LOOP:
 - Small or medium feature plans -> Waza `/think`.
 - Bugs, regressions, crashes, errors, or failing tests -> Waza `/hunt`.
 - Implemented diffs, pre-merge checks, or release follow-through -> Waza `/check`.
-- Architecture diagrams or system-flow diagrams -> Markdown Mermaid first, `mermaid` for optional human HTML.
+- Architecture diagrams or system-flow diagrams -> Markdown Mermaid only; use `mermaid` for authoring and review, never standalone HTML output.
 - Use P1/P2/P3 as the shared due-diligence protocol; report it explicitly for complex engineering or architecture planning, `/hunt`, risky refactors, deployments, auth/payment/data work, and shared contracts.
 - Hooks may emit advisory Waza `/check` and `/health` route hints, but must not auto-run skills or vendor skill bodies.
 

package/assets/reference-configs/agentic-development-flow.md

@@ -15,7 +15,7 @@ root prompt concise; this file owns the detailed routing.
 | Small or medium feature/fix plan | Waza `/think` | Concise approved plan, then implementation on request |
 | Bug, regression, error, crash, failing test | Waza `/hunt` | Root cause sentence with evidence before any fix |
 | Implemented diff, pre-merge, release follow-through | Waza `/check` | Review findings, safe fixes, verification, and shipment state |
-| Architecture diagram or system-flow diagram | Markdown Mermaid first, `mermaid` for human HTML | Semantic Mermaid in architecture docs plus optional rendered HTML grounded in repo context |
+| Architecture diagram or system-flow diagram | Markdown Mermaid only; `mermaid` assists authoring and review | Evidence-backed Mermaid fenced blocks in architecture Markdown; no standalone HTML |
 
 ### Parent Agent Planning Ownership
 

package/assets/reference-configs/document-generation.md

@@ -19,7 +19,6 @@ Create these only when the agent has concrete repo evidence or the user asks:
 - `docs/decisions.md`: accepted architecture decisions with trade-offs.
 - `docs/architecture/snapshots/*.md`: current module boundaries and data flow for architecture-sensitive changes.
 - Mermaid fenced blocks in `docs/architecture/modules/**.md` or `docs/architecture/snapshots/*.md`: semantic diagram source for agents and review diffs.
-- `docs/architecture/diagrams/*.html`: optional human-readable `mermaid` renderings produced when a visual is clearer than prose.
 - `docs/packages.md`: package inventory for real multi-package repos.
 - `plans/prds/*.prd.md`: upper-layer PRDs generated through `repo-harness-product`'s PRD mode from `.claude/templates/prd.template.md`; keep Sprint backlogs in `plans/sprints/`.
 
@@ -33,7 +32,7 @@ Create these only when the agent has concrete repo evidence or the user asks:
 - Let capability `CLAUDE.md` and `AGENTS.md` carry local contract projections; root docs stay concise.
 - Keep complete workstream TODOs in `tasks/workstreams/<domain>/<capability>/`; contract blocks should link to them instead of becoming task logs.
 - Keep onboarding docs split by reader: agents read active source artifacts first; humans review the Human Review Card, diff, latest trace, and rollback first.
-- Hooks may create `docs/architecture/requests/*.md`; agents own semantic snapshots, embedded Mermaid, and optional `mermaid` HTML output.
+- Hooks may create `docs/architecture/requests/*.md`; agents own semantic snapshots and embedded Mermaid source.
 - Archive handled architecture requests with `repo-harness run archive-architecture-request`; keep `docs/architecture/requests/` pending-only and preserve handled requests under `docs/architecture/requests/archive/YYYY/`. A `Resolved` request must declare its `Architecture Module` and include that exact existing module as a durable `--artifact`.
-- When both Mermaid and HTML exist, keep the Mermaid in Markdown as the semantic source and make the HTML link back to that Markdown source.
-- Treat `mermaid` as an external installed skill dependency at `~/.codex/skills/mermaid`; do not copy or inline its assets into generated repos.
+- Treat Markdown Mermaid as the only architecture diagram artifact; do not generate standalone HTML.
+- Treat `mermaid` as an external authoring/review skill at `~/.codex/skills/mermaid`; do not copy or inline its assets into generated repos.

package/assets/reference-configs/external-tooling.md

@@ -4,6 +4,7 @@ Generated repos route external tooling by host/runtime shape. Task-level
 skill routing lives in `docs/reference-configs/agentic-development-flow.md`.
 
 - `Waza` supplies `/think`, `/hunt`, and `/check` for daily small/medium work
+- `reverse-skill-router` is an explicit-only recommended router for independently authorized reverse-engineering and security work
 - `hai-stack` supplies `geju` for live, pre-contract exploration; only its frozen output enters a contract
 - Codex automation requires `health`, `check`, and `mermaid` from `~/.codex/skills`
 - `CodeGraph` is required agent readiness for code navigation and impact tracing
@@ -32,16 +33,20 @@ bootstrap path must not silently install unrelated toolchains or Claude
 marketplace plugins.
 
 `repo-harness uninstall` removes repo-harness managed Codex/Claude hook
-adapters. It intentionally does not uninstall Waza, Mermaid, CodeGraph,
+adapters. It intentionally does not uninstall Waza, Mermaid, Reverse Skill, CodeGraph,
 brain config, package-manager globals, or user-authored sibling hook entries.
 
-`repo-harness update` refreshes only the CLI and repo-harness-owned user-level
-runtime by default. Third-party tooling and CodeGraph registration stay
-readiness findings from `repo-harness setup check` unless the update command is
-run with an explicit opt-in such as `--with-external-skills` or
-`--configure-codegraph`. Repo-local workflow refresh stays on
-`repo-harness init`; `setup check --check-updates` reports an Agent action when
-the current adopted repo's dry-run adoption plan has pending operations.
+`repo-harness update` is a reconciliation command, not a best-effort package
+install. It verifies the installed package's exact `archctx` and
+`archctx-contracts` dependencies, package-local CodeGraph, compatible ArchContext
+Node runtime, and capability handshake. A stale Bun global dependency tree is
+reported with explicit remove/install recovery commands; update does not remove
+a working CLI before a replacement is known-good. The global CodeGraph CLI/MCP
+is refreshed at the exact shipped compatibility version. Mutable third-party
+Waza and Mermaid providers remain behind explicit `--with-external-skills`;
+`--no-codegraph` disables the CodeGraph refresh.
+Repo-local workflow refresh stays on `repo-harness init`; `setup check
+--check-updates` remains the read-only advisory surface.
 
 The cross-review skill is **harness-owned and self-contained** — its source
 lives in `assets/skills/repo-harness-cross-review/` and it wraps the peer CLI
@@ -59,6 +64,28 @@ package's host-aware installation. These harness skills ship with the full
 profile (the default for `init`) and provide the peer acceptance gate surface
 for the typed `AcceptanceReceipt`; the review section is projection only.
 
+Reverse Skill is registered from `zhaoxuya520/reverse-skill` as the recommended
+but explicit-only `reverse-skill-router`. It is not part of either install
+profile because the upstream pack requires agents to read
+`field-journal/precedent-auth.md`, which treats merely mentioning a target as
+authorization. That assumption cannot replace a real scope or RoE boundary.
+The catalog pins upstream commit
+`539899ddc7608d63dc66e08e794d572e080f1a55` and the selected tree digest
+`sha256:7aafee6c0dec684d410af6864ab77da4d88b9d442142c0efb91b235ce9793dda`;
+repo-harness verifies the full staged tree before projecting it into either
+host root.
+After independent review, install it explicitly:
+
+```bash
+repo-harness install --with-reverse-skill
+repo-harness update --with-reverse-skill
+```
+
+Add `--no-external-skills` to the install command when Reverse Skill should be
+the only marketplace Skill added. The Skills CLI copies the router pack into
+the selected host Skill roots; repo-harness does not execute its workflows or
+bootstrap its optional analysis/security toolchains during install.
+
 The review scope is the current reviewable diff, not just committed branch
 history: branch diff against the default base, staged changes, unstaged tracked
 changes, and untracked files are all in scope. A timeout or missing peer CLI is
@@ -411,7 +438,7 @@ diff -qr ~/.agents/skills/geju ~/.codex/skills/geju
 ### CodeGraph
 
 ```bash
-bun add -g @colbymchenry/codegraph@latest && codegraph sync . && codegraph status .
+bun add -g @colbymchenry/codegraph@1.5.0 && codegraph sync . && codegraph status .
 ```
 
 ## Agent Fleet
@@ -475,17 +502,26 @@ description (for example, `Opus at max effort` or `Sonnet at high effort`) to th
 mapped GPT-5.6 model and reasoning level. A missing label fails closed so the
 installed metadata cannot claim a different model from the TOML settings.
 
-These files define the desired installed role configuration and feed both Codex
-dispatch surfaces: native MultiAgentV2 `agent_type` selection, and Codex App
-Thread dispatch, where `model` and `model_reasoning_effort` are read back out of
-the installed TOML and passed explicitly to `codex_app__create_thread`. App
-Thread dispatch is the default Codex path because the flat native spawn schema
-carries only a task name, a message, and `fork_turns`: it cannot select a model
-per role, so a `gpt-5.6-luna` role dispatched natively silently inherits the
-parent model. These files do not by themselves prove that either surface honored
-the configured model; keep runtime selection claims behind a real canary — a
-SubagentStart observation on the native path, an official thread read on the
-thread path.
+These files define the desired installed role configuration for Codex native
+MultiAgent `agent_type` selection. On Codex CLI 0.147, the live native spawn
+surface accepts `agent_type`; that field is the only fleet identity/lifecycle
+authority. A dispatch packet must also pass `fork_turns="none"` and remain
+self-contained. If the live schema cannot accept the requested installed
+`agent_type`, the fleet dispatch fails closed instead of selecting an App
+thread, `codex-exec`, or the main thread.
+
+Installed files do not by themselves prove that Codex honored the configured
+model. Runtime selection claims stay behind official `SubagentStart`
+`agent_type`/`model` evidence. `SubagentStart` does not expose reasoning effort,
+so that field remains `configured_unverified` and is never promoted to a runtime
+claim.
+
+A 2026-08-11 Codex CLI 0.147 canary recorded `explorer` on its configured
+`gpt-5.6-luna` model and `deep-reasoner` on its configured `gpt-5.6-terra`
+model in one session. The strict tooling check aggregated both official
+observations as `verified`. This closes the older flat-V2 limitation for the
+versioned native surface; it does not turn missing future `agent_type` or model
+readback into a compatibility fallback.
 
 ### Local merge gate
 
@@ -525,55 +561,38 @@ and CI remain the remote merge authority.
 For Codex, repo-harness keeps configuration readiness and runtime routing
 readiness separate:
 
-- `UserPromptSubmit.delegation` initializes
-  `.ai/harness/delegation/latest.json` with
-  `native_role_routing.status = "unverified"` and a repo-scoped evidence
-  directory for that delegation.
+- `UserPromptSubmit.delegation` is an explicit command adapter only: `/delegate`
+  or `/parallel` injects the bounded dispatch contract. Natural-language prompt
+  classification and SessionStart standing authorization are not authorities.
 - `SubagentStart.context` consumes Codex's official `agent_type` and `model`
   fields plus `turn_id` and `agent_id`. It enumerates project custom-agent TOML
   files first, then user files, parses them with `Bun.TOML.parse`, selects by
   the schema-authoritative `name`, and writes one atomic observation per child
-  without reading Codex transcripts. The filename is only a convention; an
-  unrelated valid profile may inherit its model, while the selected profile
+  under the event-scoped directory referenced by
+  `.ai/harness/delegation/native-role-routing.json`, even when no prompt advisor
+  state exists. It does not read Codex transcripts. The filename is only a
+  convention; an unrelated valid profile may inherit its model, while the selected profile
   must pin one before repo-harness can verify model routing.
-- `check-agent-tooling.sh` deterministically aggregates every child observation
-  in the current delegation. An empty current delegation retains the latest
-  completed canary instead of erasing negative evidence. Each verified or
-  mismatched observation carries the selected TOML SHA-256, so later config
-  drift invalidates stale evidence. `--strict-readiness`
-  fails after `unavailable`, `mismatch`, `invalid`, or structurally malformed
-  evidence; only a genuinely absent canary remains advisory `unverified`.
-
-SubagentStart does not expose `model_reasoning_effort`, so repo-harness never
-claims that per-role reasoning effort is verified from this gate.
-
-`native_role_routing` evidence stays scoped to the native fallback path; it says
-nothing about App Thread dispatch, and an absent native canary is not a failure
-of the default thread path. Thread-path model evidence comes from official
-thread reads instead: the requested `model`/`thinking` passed to
-`codex_app__create_thread` and the model observed on the materialized thread are
-recorded separately, and a thread whose runtime model was never read back stays
-unverified. A post-merge live canary on 2026-08-02 requested
-`gpt-5.6-luna`/`max`, materialized a worktree thread, and completed a bounded
-read-only task at the shipped main SHA. The host-owned rollout `turn_context`
-observed `model = gpt-5.6-luna` and `effort = max`, which proves the host-local
-execution matched the request. It does not close the orchestrator contract: the
-current `codex_app__read_thread` response omitted model and effort fields, so
-portable runtime readiness remains unverified and must not be inferred from
-create-call acceptance or private rollout parsing.
-
-The readback contract is version-bound and fail-closed. On Codex CLI
-`0.146.0-alpha.9.2`, `codex app-server generate-json-schema` shows that
-`ThreadReadResponse` contains only `thread`, while its `Thread` object exposes
-`modelProvider` but neither `model` nor `reasoningEffort`. The same generated
-schema exposes `model` and nullable `reasoningEffort` on `ThreadStartResponse`
-and `ThreadResumeResponse`, but the App Thread tools do not propagate those
-fields across the pending-worktree materialization path. Runtime readiness is
-closed only when a public App Thread response exposes the materialized thread's
-observed `model` and reasoning effort separately from the requested tuple. A
-missing or mismatched observed tuple keeps the role-routed result unverified and
-selects the declared fallback; repo-harness must not scrape rollout JSONL or
-SQLite as a compatibility path.
+- `check-agent-tooling.sh` deterministically aggregates the current native
+  event scope only; it never revives a historical scope. The hook retains at
+  most 32 observations in that scope and removes older managed scope evidence
+  under a dedicated native-evidence lock. Each verified or mismatched
+  observation carries the selected TOML SHA-256, so later config drift
+  invalidates stale evidence. `--strict-readiness` fails after `unverified`,
+  `unavailable`, `mismatch`, `invalid`, structurally malformed evidence, an
+  empty current scope, or a missing current pointer target.
+
+The official [Codex Subagents documentation](https://developers.openai.com/codex/subagents)
+documents `model_reasoning_effort` in each agent file, and the official
+[Configuration Reference](https://developers.openai.com/codex/config-reference)
+also documents `agents.default_subagent_reasoning_effort` plus explicit spawn
+effort precedence. `SubagentStart` does not expose the effective
+`model_reasoning_effort`, so repo-harness records `reasoning_effort_status =
+"configured_unverified"` and never promotes a configured or requested value to
+runtime proof. A missing, default,
+mismatched, invalid, or unverified native observation blocks a role-routing
+claim and authorizes no alternate fleet runner. repo-harness must not scrape
+rollout JSONL or SQLite as a compatibility path.
 
 `developer_instructions` is the packaged `.md` body plus the canonical
 EXECUTION_BOUNDARY anti-extras clause, kept byte-identical to the

package/assets/reference-configs/harness-overview.md

@@ -220,8 +220,9 @@ Maintainer-facing detail on how the initializer and runtime defaults are wired.
   `.ai/hooks/lib/workflow-state.sh` is an operator helper projection, not a
   second host-event runtime.
 - Generated and migrated repos keep discovery and complex/design planning in the parent agent: `geju` opens the pre-contract frame, then the parent completes P1/P2/P3 and freezes the accepted direction. Daily small/medium work uses Waza with Codex-first runtime copies in `~/.codex/skills`; durable knowledge stays in repo-authored research and lessons.
-- `repo-harness install` bootstraps the Codex/Claude runtime pieces for the default workflow: refreshes `repo-harness` skill aliases, installs global Codex/Claude hook adapters, installs Waza skills (`think`, `hunt`, `check`, `health`) and Mermaid through the skills CLI, persists the brain root in `~/.repo-harness/config.json`, and configures CodeGraph MCP for selected host agents. `repo-harness init` remains a compatibility alias for existing automation.
-- Other external tooling stays advisory-only: `repo-harness run check-agent-tooling --host both --check-updates`; Waza update checks compare upstream `tw93/Waza` `SKILL.md` hashes without running `npx skills check`; no automatic CodeGraph daemon or provider setup.
+- `repo-harness install` bootstraps the package-owned Codex/Claude runtime pieces for the default workflow: refreshes `repo-harness` skill aliases, installs global Codex/Claude hook adapters, persists the brain root in `~/.repo-harness/config.json`, and configures CodeGraph MCP for selected host agents. Mutable Waza and Mermaid providers are installed only after explicit selection. `repo-harness init` remains a compatibility alias for existing automation.
+- The recommended `reverse-skill-router` remains explicit-only through `--with-reverse-skill` because its upstream authorization assumption cannot replace independently verified scope; the pinned selected tree is integrity-checked before host projection.
+- Read-only external-tooling audit stays advisory: `repo-harness run check-agent-tooling --host both --check-updates`. The explicit mutating boundary is `repo-harness update`, which reconciles mandatory ArchContext packages and runtime and updates the global CodeGraph CLI/MCP; mutable Waza/Mermaid providers require `--with-external-skills`. It does not initialize or sync a repository CodeGraph index.
 - Manual distillation stays repo-local: repeated corrections -> `tasks/lessons.md`; deep findings and hidden contracts -> topic-scoped `docs/researches/*.md`; sprint verification evidence -> `tasks/reviews/*.review.md`; durable capability progress -> `tasks/workstreams/`; release history -> `docs/CHANGELOG.md`.
 
 ### Package Manager Defaults

package/assets/skill-commands/manifest.json

@@ -298,6 +298,24 @@
       "mutatesRepoByDefault": false,
       "summary": "Diagram-design skill. Fetched from BfdCampos/dotfiles via bunx skills add.",
       "retirementCandidate": null
+    },
+    {
+      "name": "reverse-skill-router",
+      "kind": "external",
+      "source": null,
+      "provider": "zhaoxuya520/reverse-skill@539899ddc7608d63dc66e08e794d572e080f1a55",
+      "integrity": "sha256:7aafee6c0dec684d410af6864ab77da4d88b9d442142c0efb91b235ce9793dda",
+      "hosts": [
+        "claude",
+        "codex"
+      ],
+      "profiles": [],
+      "discoverability": "external-marketplace",
+      "component": "adaptive-workflow",
+      "requires": [],
+      "mutatesRepoByDefault": false,
+      "summary": "Explicit-opt-in reverse-engineering and security-task router pack. Fetched from zhaoxuya520/reverse-skill via bunx skills add after independent authorization review.",
+      "retirementCandidate": null
     }
   ],
   "expectedProjections": {

package/assets/skill-commands/repo-harness-architecture/SKILL.md

@@ -19,8 +19,7 @@ architecture documentation, drift-request, or diagram pass.
    - umbrella status in `docs/architecture/index.md`
    - module or snapshot docs under `docs/architecture/`
    - Mermaid fenced block in the relevant module or snapshot Markdown when a visual flow materially helps
-   - optional human-readable diagram artifact under `docs/architecture/diagrams/`
-5. Use Markdown Mermaid as the semantic diagram source; use `mermaid` only for optional human-readable HTML renderings grounded in observed repo files.
+5. Use Markdown Mermaid as the only architecture diagram artifact. Do not generate standalone HTML; use the external `mermaid` skill only to review layout and renderability before shipping the Markdown source.
 6. Archive handled requests with:
    - `repo-harness run archive-architecture-request --request <request> --status <resolved|superseded|rejected|no-change> --artifact <path> --note <text>`
    - For `resolved`, the live `Pending` request must declare `> **Architecture Module**:` and that exact existing module path must be supplied as an `--artifact`.
@@ -34,12 +33,12 @@ architecture documentation, drift-request, or diagram pass.
 - If no pending architecture request exists, report `no-change` and do not invent one.
 - If capability resolution is ambiguous, stop at the matching paths and ask for a narrower scope.
 - If `check-architecture-sync.sh` blocks in strict mode, resolve or archive the pending request card for the touched capability before finishing the worktree.
-- If diagram rendering fails, keep the Mermaid Markdown source and report the render failure.
+- If diagram validation fails, fix the Mermaid Markdown source or report the validation failure; do not substitute HTML.
 
 ## Boundaries
 
 - Does not run `repo-harness init`.
 - Does not install or refresh the full harness.
 - Does not let hooks rewrite architecture prose; hooks only record drift requests.
-- Does not vendor `mermaid`; it remains an external installed skill for optional human-readable HTML.
+- Does not vendor `mermaid`; it remains an external authoring/review skill and never owns a product artifact.
 - Keeps `docs/architecture/requests/` pending-only by archiving handled requests.

package/assets/skill-version.json

@@ -1,6 +1,6 @@
 {
-  "version": "0.14.0",
-  "templateVersion": "0.14.0",
+  "version": "0.14.2",
+  "templateVersion": "0.14.2",
   "skillName": "repo-harness",
   "contractId": "tasks-first-harness-v1",
   "compatibility": {

package/assets/skills/repo-harness-cross-review/SKILL.md

@@ -33,5 +33,5 @@ how to interpret findings, and the boundaries below.
 ## Boundaries
 
 - Read-only: the provider never edits code (no Bash/Edit/Write for Claude; read-only sandbox for Codex).
-- A provider failure (timeout, empty output, malformed transcript, auth failure, nonzero exit, degraded scope) is explicit. Never a fallback, never a synthesized pass.
+- Bounded: 2 provider attempts, then `SKIPPED` -- advisory, non-blocking (exit 0). Do not re-run it or narrow the diff to retry. Only `degraded_scope` blocks (exit 1). Never a synthesized pass.
 - Never produces or verifies a `merge-gate` receipt; that judge is separate.

package/assets/skills/repo-harness-cross-review/references/claude-mode.md

@@ -11,12 +11,16 @@ in the prompt since Claude has no Bash access to inspect the repo itself.
 
 - Pinned to the `fable` alias so the external opinion does not silently
   follow the host's default model.
-- If the fable route emits its explicit capacity-limit signal, retries exactly once on `opus`
-  -- one fallback step, never a loop, and never a fallback to a
-  different provider. Other nonzero exits remain failures even if they wrote
-  stdout.
-- Per-attempt default budget: 330 seconds; the bounded two-attempt capacity
-  route therefore has a 660-second worst-case budget.
+- Exactly two attempts, whatever went wrong: any failed attempt (timeout,
+  nonzero exit, auth failure, empty or malformed output) consumes one, and
+  attempt 2 always re-runs on `opus` -- never a third attempt, never a
+  fallback to a different provider. A nonzero exit is a failed attempt even
+  when it wrote stdout.
+- Per-attempt default budget: 330 seconds; the bounded two-attempt route
+  therefore has a 660-second worst-case budget.
+- Both attempts spent without a usable transcript -> `skipped`: advisory and
+  non-blocking (exit 0). Proceed on your own review; do not re-run the review
+  or narrow the diff to retry it.
 - Claude Code must support `--safe-mode`; an older CLI fails closed instead of
   loading host hooks or silently dropping isolation.
 
@@ -26,8 +30,8 @@ Claude Code persists print-mode sessions to
 `~/.claude/projects/<project>/<session-id>.jsonl`. If stdout is empty, the
 runner recovers the last assistant message from the most recent matching
 session file started after the run began. If a session file is found but no
-usable assistant text can be extracted from it, the result is an explicit
-`malformed_transcript` failure -- recovered text is never treated as a
+usable assistant text can be extracted from it, that attempt fails with the
+explicit `malformed_transcript` code -- recovered text is never treated as a
 passing review when the run itself timed out or exited nonzero.
 
 ## Command
@@ -40,5 +44,7 @@ repo-harness cross-review --provider claude
 
 - No merge-gate: this mode never produces or verifies a `merge-gate` receipt.
 - No semantic fallback: timeout, empty output, malformed transcript, and
-  auth failure are reported as distinct, explicit outcomes -- never
-  silently retried against Codex instead.
+  auth failure are reported as distinct, explicit codes -- never
+  silently retried against Codex instead, and a `skipped` run is never a pass.
+- Only `degraded_scope` (the harness could not observe what to review) is
+  blocking, with exit 1. Provider unavailability is advisory.