repo-harness 0.5.2 → 0.6.0

package/README.es.md

@@ -56,12 +56,17 @@ En un repositorio adoptado, la superficie se mantiene pequeña:
 | `tasks/contracts/`, `tasks/reviews/` y `.ai/harness/checks/` | Scope, verificación y evidencia de review para probar que el trabajo terminó. |
 | `.ai/harness/handoff/` y `tasks/current.md` | Session journal y estado resumible, derivados de workflow artifacts en vez de chat memory. |
 
-## Novedades en 0.5.2
-
-- **Tooling advisories más silenciosos.** Los update checks de SessionStart usan por defecto un timestamp cache semanal, para que los avisos de Waza y CodeGraph no aparezcan en cada sesión.
-- **Safety hooks locales revisados.** `repo-harness security scan` separa active findings y reviewed exceptions; los hooks user-level warning-only necesitan exact command match, y los comandos de alto riesgo siguen activos.
-- **Setup checks más limpios.** `repo-harness setup check --check-updates` trata el skip de DB de gbrain fast-mode como readiness aceptado, pero mantiene visibles los warnings reales de gbrain.
-- **Cross-review más resistente.** El skill bundled `claude-review` puede recuperar resultados print-mode con stdout vacío desde los transcripts de sesión de Claude Code.
+## Novedades en 0.6.0
+
+- **Transactional adoption plans.** `repo-harness adopt --dry-run --json` ahora
+  emite un operation plan protocol v1 con IDs estables, summary, content hashes
+  y rollback metadata.
+- **Bootstrap files gestionados por el manifest.** Los templates iniciales
+  `docs/spec.md`, `tasks/todos.md`, `tasks/current.md` y `tasks/lessons.md`
+  ahora salen del workflow contract manifest, no de strings locales del planner.
+- **Apply TypeScript experimental.** `repo-harness adopt --experimental-ts-apply`
+  puede aplicar el safe operation subset con atomic writes, target locks,
+  backups y preflight rejection para boundaries self-host no soportadas.
 
 ## Qué hace el producto
 
@@ -378,8 +383,8 @@ Guards habituales:
 
 ## Release actual
 
-- npm package: `repo-harness@0.5.2`
-- Generated workflow stamp: `repo-harness@0.5.2+template@0.5.2`
+- npm package: `repo-harness@0.6.0`
+- Generated workflow stamp: `repo-harness@0.6.0+template@0.6.0`
 - GitHub repository: `Ancienttwo/repo-harness`
 - Release history: [`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/README.fr.md

@@ -56,12 +56,18 @@ Dans un dépôt adopté, la surface à comprendre reste volontairement réduite
 | `tasks/contracts/`, `tasks/reviews/` et `.ai/harness/checks/` | Scope, vérification et preuves de review pour démontrer que le travail est terminé. |
 | `.ai/harness/handoff/` et `tasks/current.md` | Session journal et état resumable dérivés des workflow artifacts plutôt que de la chat memory. |
 
-## Nouveautés de la 0.5.2
-
-- **Tooling advisories plus calmes.** Les checks update de SessionStart utilisent désormais un cache timestamp d'une semaine par défaut, afin que les advisories Waza et CodeGraph restent utiles sans apparaître à chaque session.
-- **Safety hooks locaux reviewés.** `repo-harness security scan` sépare les active findings des reviewed exceptions, avec exact command match pour les hooks user-level warning-only ; les commandes à haut risque restent actives.
-- **Setup checks plus propres.** `repo-harness setup check --check-updates` traite le skip DB de gbrain fast-mode comme un état readiness accepté, tout en gardant les vrais warnings gbrain visibles.
-- **Cross-review plus robuste.** Le skill bundled `claude-review` peut récupérer les résultats print-mode à stdout vide depuis les transcripts de session Claude Code.
+## Nouveautés de la 0.6.0
+
+- **Transactional adoption plans.** `repo-harness adopt --dry-run --json` émet
+  maintenant un operation plan protocol v1 avec IDs stables, summary, content
+  hashes et rollback metadata.
+- **Bootstrap files gérés par le manifest.** Les templates initiaux
+  `docs/spec.md`, `tasks/todos.md`, `tasks/current.md` et `tasks/lessons.md`
+  viennent désormais du workflow contract manifest plutôt que de strings locales
+  au planner.
+- **Apply TypeScript expérimental.** `repo-harness adopt --experimental-ts-apply`
+  peut appliquer le safe operation subset avec atomic writes, target locks,
+  backups et preflight rejection des boundaries self-host non prises en charge.
 
 ## Ce que fait le produit
 
@@ -382,8 +388,8 @@ Guards courants :
 
 ## Release actuelle
 
-- npm package : `repo-harness@0.5.2`
-- Generated workflow stamp : `repo-harness@0.5.2+template@0.5.2`
+- npm package : `repo-harness@0.6.0`
+- Generated workflow stamp : `repo-harness@0.6.0+template@0.6.0`
 - GitHub repository : `Ancienttwo/repo-harness`
 - Release history : [`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/README.ja.md

@@ -47,12 +47,11 @@ Agent に完全な PRD または Sprint を渡せば、あとは review and `nex
 | `tasks/contracts/`, `tasks/reviews/`, `.ai/harness/checks/` | 作業完了を証明する scope、verification、review evidence。 |
 | `.ai/harness/handoff/` と `tasks/current.md` | chat memory ではなく workflow artifacts から派生する session journal と resumable status。 |
 
-## 0.5.2 の新機能
+## 0.6.0 の新機能
 
-- **静かな tooling advisory。** SessionStart update check はデフォルトで 1 週間の timestamp cache を使い、Waza と CodeGraph の advisory が毎 session で出続けないようにしました。
-- **Reviewed local safety hooks。** `repo-harness security scan` は active findings と reviewed exceptions を分離し、user-level warning-only hook は exact command match の場合だけ reviewed 扱いにします。高リスク command は引き続き active です。
-- **Cleaner setup checks。** `repo-harness setup check --check-updates` は gbrain fast-mode DB skip を受け入れ済み readiness として扱い、実際の gbrain warning はそのまま表示します。
-- **Resilient cross-review。** bundled `claude-review` skill は Claude Code print-mode の stdout が空でも session transcript から最終出力を復旧できます。
+- **Transactional adoption plans。** `repo-harness adopt --dry-run --json` は、安定した ID、summary、content hash、rollback metadata を含む protocol v1 operation plan を出力します。
+- **Manifest-owned bootstrap files。** 初期 `docs/spec.md`、`tasks/todos.md`、`tasks/current.md`、`tasks/lessons.md` templates は、planner-local strings ではなく workflow contract manifest から来るようになりました。
+- **Experimental TypeScript apply。** `repo-harness adopt --experimental-ts-apply` は、atomic writes、target locks、backups、unsupported self-host boundary の preflight rejection を使って safe operation subset を適用できます。
 
 ## repo-harness は何をするか
 
@@ -352,8 +351,8 @@ hook がブロックしたときは、まず terminal の構造化された出
 
 ## 現在の Release
 
-- npm package：`repo-harness@0.5.2`
-- Generated workflow stamp：`repo-harness@0.5.2+template@0.5.2`
+- npm package：`repo-harness@0.6.0`
+- Generated workflow stamp：`repo-harness@0.6.0+template@0.6.0`
 - GitHub repository：`Ancienttwo/repo-harness`
 - Release history：[`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/README.md

@@ -50,19 +50,17 @@ In an adopted repo, the surface area is intentionally small:
 | `tasks/contracts/`, `tasks/reviews/`, and `.ai/harness/checks/` | Scope, verification, and review evidence for proving the work is done. |
 | `.ai/harness/handoff/` and `tasks/current.md` | Session journal and resumable status, derived from workflow artifacts instead of chat memory. |
 
-## What's New in 0.5.2
-
-- **Quieter tooling advisories.** SessionStart update checks now use a weekly
-  timestamp cache by default, so Waza and CodeGraph advisories stay useful
-  without firing on every new agent session.
-- **Reviewed local safety hooks.** `repo-harness security scan` separates
-  active findings from reviewed exceptions, using exact command matches for
-  user-level warning-only hooks while keeping high-risk commands blocking.
-- **Cleaner setup checks.** `repo-harness setup check --check-updates` now
-  treats gbrain fast-mode DB skips as accepted readiness and keeps real gbrain
-  warnings visible.
-- **More resilient cross-review.** The bundled `claude-review` skill can recover
-  empty-stdout print-mode results from Claude Code session transcripts.
+## What's New in 0.6.0
+
+- **Transactional adoption plans.** `repo-harness adopt --dry-run --json` now
+  emits a protocol v1 operation plan with stable IDs, summaries, content hashes,
+  and rollback metadata.
+- **Manifest-owned bootstrap files.** The initial `docs/spec.md`,
+  `tasks/todos.md`, `tasks/current.md`, and `tasks/lessons.md` templates now
+  come from the workflow contract manifest instead of planner-local strings.
+- **Experimental TypeScript apply.** `repo-harness adopt --experimental-ts-apply`
+  can apply the safe operation subset with atomic writes, target locks, backups,
+  and preflight rejection for unsupported self-host boundaries.
 
 ## What repo-harness Does
 
@@ -238,10 +236,10 @@ irm https://raw.githubusercontent.com/Ancienttwo/repo-harness/main/install.ps1 |
 ```bash
 # Bun
 bun add -g repo-harness
-repo-harness init
+repo-harness install
 
 # Node/npm, with Bun already on PATH because the CLI runs on Bun
-npx -y repo-harness init
+npx -y repo-harness install
 ```
 
 </details>
@@ -249,14 +247,15 @@ npx -y repo-harness init
 ### 2. Bootstrap the host runtime once
 
 ```bash
-repo-harness init
+repo-harness install
 ```
 
-`init` is the first-run global bootstrap path. It installs the current npm
+`install` is the first-run global bootstrap path. It installs the current npm
 package as the global CLI, refreshes repo-harness skill aliases, installs
 user-level hook adapters, configures Waza runtime skills, persists a brain root
 under `~/.repo-harness/config.json`, and configures CodeGraph MCP. It does not
-apply repo-local workflow files to the current directory.
+apply repo-local workflow files to the current directory. `repo-harness init`
+remains a compatibility alias for existing scripts.
 
 For an Agent-owned, read-only bootstrap audit, run `npx -y repo-harness setup
 check --json` or add `--check-updates` for version advisories. `setup check` is
@@ -269,11 +268,17 @@ optional command, and verification surface for the Agent to execute deliberately
 
 ```bash
 # First machine bootstrap after installing the CLI: skills, host adapters, Waza, brain, CodeGraph.
-repo-harness init
+repo-harness install
 
 # Refresh user-level CLI/runtime pieces after a package update.
 repo-harness update
 
+# Remove repo-harness managed host adapters without deleting sibling hooks or third-party tools.
+repo-harness uninstall
+
+# Install only the host hook adapters, preserving the older adapter-only surface.
+repo-harness install --target both --location global
+
 # Ask for read-only repair guidance without writing files.
 repo-harness update --check
 
@@ -459,8 +464,8 @@ Most common guards:
 
 ## Current Release
 
-- npm package: `repo-harness@0.5.2`
-- Generated workflow stamp: `repo-harness@0.5.2+template@0.5.2`
+- npm package: `repo-harness@0.6.0`
+- Generated workflow stamp: `repo-harness@0.6.0+template@0.6.0`
 - GitHub repository: `Ancienttwo/repo-harness`
 - Release history: [`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/README.zh-CN.md

@@ -43,17 +43,16 @@ handoff、检查结果和 review evidence 写回项目文件，让下一个 agen
 | `tasks/contracts/`、`tasks/reviews/`、`.ai/harness/checks/` | 证明完成所需的 scope、verification 和 review evidence。 |
 | `.ai/harness/handoff/` 和 `tasks/current.md` | session journal 与可恢复状态，从 workflow artifacts 派生，而不是依赖聊天记忆。 |
 
-## 0.5.2 新特性
-
-- **更安静的 tooling advisory。** SessionStart update check 默认使用一周
-  timestamp cache，Waza 和 CodeGraph advisory 不会每个新 session 都触发。
-- **可审阅的本地 safety hooks。** `repo-harness security scan` 会把 active
-  findings 与 reviewed exceptions 分开；user-level warning-only hooks 必须 exact
-  command match，高风险命令仍然保持 active。
-- **更干净的 setup check。** `repo-harness setup check --check-updates` 会把
-  gbrain fast-mode DB skip 当成已接受的 readiness 状态，同时保留真实 gbrain warning。
-- **更稳的 cross-review。** bundled `claude-review` skill 可以从 Claude Code
-  session transcript 恢复 print-mode 空 stdout 的最终输出。
+## 0.6.0 新特性
+
+- **事务型 adoption plan。** `repo-harness adopt --dry-run --json` 现在输出
+  protocol v1 operation plan，包含稳定 ID、summary、content hash 和 rollback metadata。
+- **Manifest-owned bootstrap 文件。** 初始 `docs/spec.md`、`tasks/todos.md`、
+  `tasks/current.md`、`tasks/lessons.md` 模板改由 workflow contract manifest 管理，
+  不再放在 planner 本地字符串里。
+- **实验性 TypeScript apply。** `repo-harness adopt --experimental-ts-apply`
+  可以执行 safe operation subset，并使用 atomic write、target lock、backup 和
+  unsupported self-host boundary preflight。
 
 ## 产品做什么
 
@@ -207,10 +206,10 @@ irm https://raw.githubusercontent.com/Ancienttwo/repo-harness/main/install.ps1 |
 ```bash
 # Bun
 bun add -g repo-harness
-repo-harness init
+repo-harness install
 
 # Node/npm；仍要求 Bun 已在 PATH 上，因为 CLI runtime 是 Bun
-npx -y repo-harness init
+npx -y repo-harness install
 ```
 
 </details>
@@ -218,13 +217,13 @@ npx -y repo-harness init
 ### 2. 先做一次 host runtime bootstrap
 
 ```bash
-repo-harness init
+repo-harness install
 ```
 
-`init` 是首次全局引导入口。它把当前 npm 包安装成全局 CLI，刷新 repo-harness
+`install` 是首次全局引导入口。它把当前 npm 包安装成全局 CLI，刷新 repo-harness
 skill aliases，安装 user-level hook adapters，配置 Waza runtime skills，把 brain
 root 持久化到 `~/.repo-harness/config.json`，并配置 CodeGraph MCP。它不会把当前目录
-默认迁移成 repo-local workflow。
+默认迁移成 repo-local workflow。`repo-harness init` 保留为兼容 alias，给已有脚本用。
 
 如果要让 Agent 做只读 bootstrap audit，运行 `npx -y repo-harness setup check
 --json`；需要版本提示时加 `--check-updates`。`setup check` 不是 runtime hook：
@@ -236,11 +235,17 @@ targets、可选 command 和 verification 的 `agent_actions`，由 Agent 再显
 
 ```bash
 # 安装 CLI 后做首次机器级 bootstrap：skills、host adapters、Waza、brain、CodeGraph。
-repo-harness init
+repo-harness install
 
 # 包更新后刷新 user-level CLI/runtime。
 repo-harness update
 
+# 移除 repo-harness 管理的 host adapters，不删除 sibling hooks 或第三方工具。
+repo-harness uninstall
+
+# 只安装 host hook adapters，保留旧版 adapter-only surface。
+repo-harness install --target both --location global
+
 # 只读检查需要 agent 修复什么，不写文件。
 repo-harness update --check
 
@@ -413,8 +418,8 @@ hook block 工作时，先看 terminal 里的结构化输出。核心字段是
 
 ## 当前 Release
 
-- npm package：`repo-harness@0.5.2`
-- Generated workflow stamp：`repo-harness@0.5.2+template@0.5.2`
+- npm package：`repo-harness@0.6.0`
+- Generated workflow stamp：`repo-harness@0.6.0+template@0.6.0`
 - GitHub repository：`Ancienttwo/repo-harness`
 - Release history：[`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/assets/reference-configs/external-tooling.md

@@ -14,11 +14,17 @@ source, while `~/.agents/skills` is only the skills CLI staging/cache path used
 to receive upstream `tw93/Waza` updates before syncing verified copies into
 Codex.
 
-`repo-harness init` is allowed to bootstrap the workflow-owned global runtime in
-one pass: the `repo-harness` CLI, repo-harness runtime aliases, user-level
+`repo-harness install` is allowed to bootstrap the workflow-owned global runtime
+in one pass: the `repo-harness` CLI, repo-harness runtime aliases, user-level
 Codex/Claude hook adapters, Waza (`think`, `hunt`, `check`, `health`), brain
-root persistence, Mermaid, and CodeGraph CLI/MCP configuration. It must not
-silently install unrelated toolchains or Claude marketplace plugins.
+root persistence, Mermaid, and CodeGraph CLI/MCP configuration.
+`repo-harness init` remains a compatibility alias for existing automation. The
+bootstrap path must not silently install unrelated toolchains or Claude
+marketplace plugins.
+
+`repo-harness uninstall` removes repo-harness managed Codex/Claude hook
+adapters. It intentionally does not uninstall Waza, Mermaid, CodeGraph, gbrain,
+brain config, package-manager globals, or user-authored sibling hook entries.
 
 `repo-harness update` refreshes only the CLI and repo-harness-owned user-level
 runtime by default. Third-party tooling and CodeGraph registration stay
@@ -30,7 +36,7 @@ The cross-review skills are **harness-owned and self-contained** — their sourc
 lives in `assets/skills/<skill>/` and they wrap the peer CLI (`codex exec` /
 `claude -p`) in a read-only sandbox with no gstack dependency, so installing them
 is a workflow-owned runtime concern, not an unrelated toolchain. They install
-host-aware during `repo-harness init` and explicit external-skill refreshes:
+host-aware during `repo-harness install`/`init` and explicit external-skill refreshes:
 `codex-review` only into `~/.claude/skills` (a Claude session asking
 Codex for an independent review) and `claude-review` only into `~/.codex/skills`
 (a Codex session asking Claude). When gstack is present, its `/codex` and

package/assets/skill-version.json

@@ -1,6 +1,6 @@
 {
-  "version": "0.5.2",
-  "templateVersion": "0.5.2",
+  "version": "0.6.0",
+  "templateVersion": "0.6.0",
   "skillName": "repo-harness",
   "contractId": "tasks-first-harness-v1",
   "retiredAliases": [
@@ -135,6 +135,14 @@
     {
       "version": "0.5.2",
       "description": "Adds weekly tooling-update advisory caching, reviewed security exceptions, gbrain fast-doctor warning handling, and Claude review transcript recovery"
+    },
+    {
+      "version": "0.5.3",
+      "description": "Fixes repo-harness update --version so the update command can install a pinned package version without being intercepted by the top-level CLI version flag"
+    },
+    {
+      "version": "0.6.0",
+      "description": "Adds the transactional adoption planner foundation with protocol v1 dry-run plans, manifest-owned bootstrap templates, experimental TypeScript apply, atomic writes, and rollback metadata"
     }
   ],
   "generatedProjectStamp": {

package/assets/templates/helpers/workflow-contract.ts

@@ -75,12 +75,23 @@ export type WorkflowContract = {
   };
   documents: {
     spec: string;
+    currentStatus?: string;
     planDirectory: string;
     taskChecklist?: string;
     deferredGoalLedger?: string;
     researchReportsDirectory: string;
     lessonsLog: string;
   };
+  adoptionTemplates?: {
+    files?: Record<
+      string,
+      {
+        document: string;
+        reason: string;
+        lines: string[];
+      }
+    >;
+  };
   migrations: {
     legacyVersions: string[];
     legacyPaths: string[];

package/assets/workflow-contract.v1.json

@@ -266,12 +266,79 @@
   },
   "documents": {
     "spec": "docs/spec.md",
+    "currentStatus": "tasks/current.md",
     "planDirectory": "plans",
     "deferredGoalLedger": "tasks/todos.md",
     "implementationNotesDirectory": "tasks/notes",
     "lessonsLog": "tasks/lessons.md",
     "researchReportsDirectory": "docs/researches"
   },
+  "adoptionTemplates": {
+    "files": {
+      "spec": {
+        "document": "spec",
+        "reason": "Create deterministic product spec placeholder when missing",
+        "lines": [
+          "# Product Spec: {{repoName}}",
+          "",
+          "> **Status**: Draft",
+          "",
+          "Describe the product intent, users, workflows, acceptance scenarios, and constraints before implementation.",
+          ""
+        ]
+      },
+      "deferredGoalLedger": {
+        "document": "deferredGoalLedger",
+        "reason": "Create deferred-goal ledger when missing",
+        "lines": [
+          "# Deferred Goal Ledger",
+          "",
+          "> **Status**: Backlog",
+          "> **Updated**: (initial)",
+          "> **Scope**: Medium/long-term goals deferred from active plan execution",
+          "",
+          "Current plan tasks live in the active plan's `## Task Breakdown`.",
+          "Do not duplicate that execution checklist here. Record only work intentionally deferred beyond this slice, with the tradeoff and revisit trigger.",
+          "",
+          "## Deferred Goals",
+          "",
+          "| Goal | Why Deferred | Tradeoff | Revisit Trigger |",
+          "|------|--------------|----------|-----------------|",
+          "| (none) | No deferred medium/long-term goal recorded yet. | Keep the first sprint bounded. | Add a row when a real follow-up is postponed. |",
+          ""
+        ]
+      },
+      "currentStatus": {
+        "document": "currentStatus",
+        "reason": "Create tracked current-status snapshot when missing",
+        "lines": [
+          "# Current Status Snapshot",
+          "",
+          "<!-- generated-by: repo-harness refresh-current-status v1 -->",
+          "",
+          "> **Status**: Idle",
+          "> **Reason**: repo-harness adoption bootstrap",
+          "",
+          "This file is a tracked mainline snapshot derived from repo artifacts. It is not a live lock, not a kanban board, and not an implementation gate.",
+          ""
+        ]
+      },
+      "lessonsLog": {
+        "document": "lessonsLog",
+        "reason": "Create correction-derived lessons ledger when missing",
+        "lines": [
+          "# Lessons",
+          "",
+          "Correction-derived rules that should influence future repo work.",
+          "",
+          "## Active Lessons",
+          "",
+          "- (none yet)",
+          ""
+        ]
+      }
+    }
+  },
   "migrations": {
     "legacyVersions": [
       "pre-tasks-first",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "repo-harness",
-  "version": "0.5.2",
+  "version": "0.6.0",
   "description": "Installs, migrates, audits, and repairs repo-local agentic development harnesses",
   "license": "MIT",
   "repository": {
@@ -32,6 +32,7 @@
     "benchmark:skills": "bun scripts/run-skill-evals.ts",
     "test": "bun test",
     "test:coverage": "bun test --coverage",
+    "check:type": "tsc --noEmit",
     "check:ci": "bash scripts/check-ci.sh",
     "check:release": "bash scripts/check-npm-release.sh",
     "check:brain-manifest": "bash scripts/check-brain-manifest.sh",
@@ -46,7 +47,8 @@
   },
   "devDependencies": {
     "@colbymchenry/codegraph": "1.0.1",
-    "@types/bun": "latest"
+    "@types/bun": "latest",
+    "typescript": "^6.0.3"
   },
   "dependencies": {
     "commander": "^14.0.3"

package/scripts/check-ci.sh

@@ -10,6 +10,9 @@ BUN_TEST_MAX_CONCURRENCY="${BUN_TEST_MAX_CONCURRENCY:-4}"
 echo "[ci] install"
 bun install --frozen-lockfile
 
+echo "[ci] typecheck"
+bun run check:type
+
 echo "[ci] tests"
 bun test --timeout "$BUN_TEST_TIMEOUT_MS" --max-concurrency "$BUN_TEST_MAX_CONCURRENCY"
 

package/scripts/workflow-contract.ts

@@ -75,12 +75,23 @@ export type WorkflowContract = {
   };
   documents: {
     spec: string;
+    currentStatus?: string;
     planDirectory: string;
     taskChecklist?: string;
     deferredGoalLedger?: string;
     researchReportsDirectory: string;
     lessonsLog: string;
   };
+  adoptionTemplates?: {
+    files?: Record<
+      string,
+      {
+        document: string;
+        reason: string;
+        lines: string[];
+      }
+    >;
+  };
   migrations: {
     legacyVersions: string[];
     legacyPaths: string[];