repo-harness 0.8.3 → 0.8.5

package/AGENTS.md

@@ -63,35 +63,38 @@ bash scripts/migrate-project-template.sh --repo . --dry-run
 <!-- BEGIN ARCHITECTURE CONTRACT -->
 ## Architecture Contract
 
-- Functional block: `.ai/hooks`
-- Capability ID: `runtime-harness-hook-adapters`
-- Matched prefix: `.ai/hooks`
-- Architecture domain: `runtime-harness`
-- Architecture capability: `hook-adapters`
-- Architecture module: `docs/architecture/modules/runtime-harness/hook-adapters.md`
-- Last architecture event: 2026-05-29T09:44:46+0800
-- Last changed path: `.ai/hooks/session-start-context.sh`
+- Functional block: `scripts/inspect-project-state.ts`
+- Capability ID: `workflow-engine-inspection-migration`
+- Matched prefix: `scripts/inspect-project-state.ts`
+- Architecture domain: `workflow-engine`
+- Architecture capability: `inspection-migration`
+- Architecture module: `docs/architecture/modules/workflow-engine/inspection-migration.md`
+- Last architecture event: 2026-07-03T15:44:54+0800
+- Last changed path: `docs/architecture/requests/archive/2026/workflow-engine-inspection-migration.md`
 - Severity: high
-- Change type: workflow-surface
+- Change type: architecture-closeout
 - Module responsibility: Keep this block aligned with the local boundary described by surrounding human-owned context.
-- Entrypoints: `.ai/hooks`
+- Entrypoints: `scripts/inspect-project-state.ts`
 - Allowed dependencies: Follow root `AGENTS.md` / `CLAUDE.md` and this local contract.
 - Forbidden dependencies: Do not cross sibling app/service/package boundaries without an architecture snapshot or explicit plan.
-- Runtime path: `.ai/hooks`
+- Runtime path: `scripts/inspect-project-state.ts`
 - LSP/tooling profile: `typescript-lsp`
 - Verification: Use root required checks plus local commands recorded in this capability contract.
 - Latest snapshot: `(none yet)`
-- Semantic diagram source: `docs/architecture/modules/runtime-harness/hook-adapters.md`
+- Semantic diagram source: `docs/architecture/modules/workflow-engine/inspection-migration.md`
 - Latest human diagram: `(none yet)`
 - Pending architecture request: `(none)`
 
 ## Active Workstreams
 
-- (none yet)
+- `tasks/workstreams/workflow-engine/inspection-migration/20260703-inspection-migration.md`
+  - status: active
+  - current_slice: completed-20260703-architecture-closeout
+  - source_plan: (none)
 
 ## Current Session Projection
 
-- Durable progress lives under `tasks/workstreams/runtime-harness/hook-adapters`.
+- Durable progress lives under `tasks/workstreams/workflow-engine/inspection-migration`.
 - `tasks/current.md` is the tracked derived status snapshot; it is not a live lock or task source.
 - `tasks/todos.md` is the deferred-goal ledger; current execution slices stay in the active plan's `## Task Breakdown`.
 <!-- END ARCHITECTURE CONTRACT -->

package/CLAUDE.md

@@ -63,35 +63,38 @@ bash scripts/migrate-project-template.sh --repo . --dry-run
 <!-- BEGIN ARCHITECTURE CONTRACT -->
 ## Architecture Contract
 
-- Functional block: `.ai/hooks`
-- Capability ID: `runtime-harness-hook-adapters`
-- Matched prefix: `.ai/hooks`
-- Architecture domain: `runtime-harness`
-- Architecture capability: `hook-adapters`
-- Architecture module: `docs/architecture/modules/runtime-harness/hook-adapters.md`
-- Last architecture event: 2026-05-29T09:44:46+0800
-- Last changed path: `.ai/hooks/session-start-context.sh`
+- Functional block: `scripts/inspect-project-state.ts`
+- Capability ID: `workflow-engine-inspection-migration`
+- Matched prefix: `scripts/inspect-project-state.ts`
+- Architecture domain: `workflow-engine`
+- Architecture capability: `inspection-migration`
+- Architecture module: `docs/architecture/modules/workflow-engine/inspection-migration.md`
+- Last architecture event: 2026-07-03T15:44:54+0800
+- Last changed path: `docs/architecture/requests/archive/2026/workflow-engine-inspection-migration.md`
 - Severity: high
-- Change type: workflow-surface
+- Change type: architecture-closeout
 - Module responsibility: Keep this block aligned with the local boundary described by surrounding human-owned context.
-- Entrypoints: `.ai/hooks`
+- Entrypoints: `scripts/inspect-project-state.ts`
 - Allowed dependencies: Follow root `AGENTS.md` / `CLAUDE.md` and this local contract.
 - Forbidden dependencies: Do not cross sibling app/service/package boundaries without an architecture snapshot or explicit plan.
-- Runtime path: `.ai/hooks`
+- Runtime path: `scripts/inspect-project-state.ts`
 - LSP/tooling profile: `typescript-lsp`
 - Verification: Use root required checks plus local commands recorded in this capability contract.
 - Latest snapshot: `(none yet)`
-- Semantic diagram source: `docs/architecture/modules/runtime-harness/hook-adapters.md`
+- Semantic diagram source: `docs/architecture/modules/workflow-engine/inspection-migration.md`
 - Latest human diagram: `(none yet)`
 - Pending architecture request: `(none)`
 
 ## Active Workstreams
 
-- (none yet)
+- `tasks/workstreams/workflow-engine/inspection-migration/20260703-inspection-migration.md`
+  - status: active
+  - current_slice: completed-20260703-architecture-closeout
+  - source_plan: (none)
 
 ## Current Session Projection
 
-- Durable progress lives under `tasks/workstreams/runtime-harness/hook-adapters`.
+- Durable progress lives under `tasks/workstreams/workflow-engine/inspection-migration`.
 - `tasks/current.md` is the tracked derived status snapshot; it is not a live lock or task source.
 - `tasks/todos.md` is the deferred-goal ledger; current execution slices stay in the active plan's `## Task Breakdown`.
 <!-- END ARCHITECTURE CONTRACT -->

package/README.es.md

@@ -85,7 +85,7 @@ artifacts.
 ## Novedades
 
 Las notas de versión viven en [`docs/CHANGELOG.md`](docs/CHANGELOG.md). La línea
-actual es `0.8.3`.
+actual es `0.8.5`.
 
 ## Cómo funciona
 
@@ -419,8 +419,8 @@ Guards habituales:
 
 ## Release actual
 
-- npm package: `repo-harness@0.8.3`
-- Generated workflow stamp: `repo-harness@0.8.3+template@0.8.3`
+- npm package: `repo-harness@0.8.5`
+- Generated workflow stamp: `repo-harness@0.8.5+template@0.8.5`
 - GitHub repository: `Ancienttwo/repo-harness`
 - Release history: [`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/README.fr.md

@@ -85,7 +85,7 @@ l'emportent.
 ## Nouveautés
 
 Les notes de version vivent dans [`docs/CHANGELOG.md`](docs/CHANGELOG.md). La
-ligne actuelle est `0.8.3`.
+ligne actuelle est `0.8.5`.
 
 ## Comment ça marche
 
@@ -424,8 +424,8 @@ Guards courants :
 
 ## Release actuelle
 
-- npm package : `repo-harness@0.8.3`
-- Generated workflow stamp : `repo-harness@0.8.3+template@0.8.3`
+- npm package : `repo-harness@0.8.5`
+- Generated workflow stamp : `repo-harness@0.8.5+template@0.8.5`
 - GitHub repository : `Ancienttwo/repo-harness`
 - Release history : [`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/README.ja.md

@@ -75,7 +75,7 @@ review、checks、handoff と食い違う場合は、source artifacts を優先
 ## What's New
 
 リリースノートは [`docs/CHANGELOG.md`](docs/CHANGELOG.md) にあります。現在の
-ラインは `0.8.3` です。
+ラインは `0.8.5` です。
 
 ## 仕組み
 
@@ -398,8 +398,8 @@ hook がブロックしたときは、まず terminal の構造化された出
 
 ## 現在の Release
 
-- npm package：`repo-harness@0.8.3`
-- Generated workflow stamp：`repo-harness@0.8.3+template@0.8.3`
+- npm package：`repo-harness@0.8.5`
+- Generated workflow stamp：`repo-harness@0.8.5+template@0.8.5`
 - GitHub repository：`Ancienttwo/repo-harness`
 - Release history：[`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/README.md

@@ -79,7 +79,7 @@ active plan, contract, review, checks, or handoff, the source artifacts win.
 ## What's New
 
 Release notes live in [`docs/CHANGELOG.md`](docs/CHANGELOG.md). The current line
-is `0.8.3`.
+is `0.8.5`.
 
 ## How It Works
 
@@ -599,8 +599,8 @@ Most common guards:
 
 ## Current Release
 
-- npm package: `repo-harness@0.8.3`
-- Generated workflow stamp: `repo-harness@0.8.3+template@0.8.3`
+- npm package: `repo-harness@0.8.5`
+- Generated workflow stamp: `repo-harness@0.8.5+template@0.8.5`
 - GitHub repository: `Ancienttwo/repo-harness`
 - Release history: [`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/README.zh-CN.md

@@ -69,7 +69,7 @@ review、checks 或 handoff 冲突，以 source artifacts 为准。
 
 ## What's New
 
-Release notes 见 [`docs/CHANGELOG.md`](docs/CHANGELOG.md)，当前版本线是 `0.8.3`。
+Release notes 见 [`docs/CHANGELOG.md`](docs/CHANGELOG.md)，当前版本线是 `0.8.5`。
 
 ## 工作原理
 
@@ -445,8 +445,8 @@ hook block 工作时，先看 terminal 里的结构化输出。核心字段是
 
 ## 当前 Release
 
-- npm package：`repo-harness@0.8.3`
-- Generated workflow stamp：`repo-harness@0.8.3+template@0.8.3`
+- npm package：`repo-harness@0.8.5`
+- Generated workflow stamp：`repo-harness@0.8.5+template@0.8.5`
 - GitHub repository：`Ancienttwo/repo-harness`
 - Release history：[`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/assets/reference-configs/global-working-rules.md

@@ -29,6 +29,14 @@ Before changing behavior, infer why the current shape exists: compatibility boun
 
 Do not introduce a new abstraction unless it removes real complexity, matches an existing local pattern, or protects a cross-module invariant.
 
+## No Compatibility Fallbacks in Product Code
+
+Do not add fallback, compatibility, heuristic, defensive, or "best effort" code paths unless the current task or a human-approved migration/release contract explicitly demands that path. Prefer fail-closed behavior with a clear error over silently inventing output.
+
+When the source of truth is an LLM/provider/external authority/user input contract, do not re-derive the same semantic data with local deterministic rules, regexes, multilingual pattern lists, shadow parsers, or compatibility shims. If the authoritative value is missing, malformed, unauthenticated, or unavailable, surface that failure and stop; do not synthesize a replacement to make the flow continue.
+
+Product-logic compatibility is harmful by default. Do not preserve old product semantics, accept multiple semantic shapes, infer missing fields, or translate one domain meaning into another unless the user explicitly requested that compatibility in the current task or a human-approved migration/release contract names it. Compatibility for old wire formats, legacy clients, or migration windows is allowed only when it is explicit, covered by tests, and bounded by a removal or ownership path. Validation, security checks, data-safety checks, and error handling remain required, but they must reject or report invalid states instead of changing semantics.
+
 ## Reporting
 
 For small tasks, keep P1/P2/P3 internal and report only the conclusion.
@@ -43,12 +51,10 @@ Reports must be concise and grounded in files, commands, runtime behavior, obser
 
 ## Completion Summary Rule
 
-For non-trivial completed tasks, include a short `下一刀` section at the end of the final delivery report unless there is genuinely no meaningful follow-up.
 For non-trivial completed tasks, include a short `下一刀` section only when verified state shows a concrete next bottleneck, unresolved risk, failing check, deployment gap, review gap, or active-plan item that materially affects the user's stated goal.
 
 Do not manufacture follow-up work just to keep slicing. If the task is reasonably complete and the remaining work would be speculative, low-value polish, or over-engineering, omit `下一刀` and stop at the completion report.
 
-The recommendation is not a question. It must be one concrete, bounded next slice derived from verified state: active plan, todo, handoff, failing checks, review gaps, deployment state, unresolved risk, or observed system behavior.
 When included, the recommendation is not a question. It must be one concrete, bounded next slice derived from verified state: active plan, todo, handoff, failing checks, review gaps, deployment state, unresolved risk, or observed system behavior.
 
 Format:

package/assets/skill-version.json

@@ -1,6 +1,6 @@
 {
-  "version": "0.8.3",
-  "templateVersion": "0.8.3",
+  "version": "0.8.5",
+  "templateVersion": "0.8.5",
   "skillName": "repo-harness",
   "contractId": "tasks-first-harness-v1",
   "compatibility": {
@@ -179,6 +179,14 @@
     {
       "version": "0.8.3",
       "description": "Keeps adopt and migration helper runtime package-only, removes local compatibility wrapper generation, and refreshes dependency lines to latest"
+    },
+    {
+      "version": "0.8.4",
+      "description": "Lets package-dispatched workstream sync resolve bundled helper siblings when downstream repos do not vendor legacy scripts"
+    },
+    {
+      "version": "0.8.5",
+      "description": "Repairs workspace-source Bun global installs that hit DependencyLoop by reinstalling from a packed tarball and adds packaged sprint-backlog target-root smoke coverage"
     }
   ],
   "generatedProjectStamp": {

package/assets/templates/helpers/sprint-backlog.sh

@@ -2,7 +2,22 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-if REPO_ROOT="$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null)"; then
+if [[ -n "${REPO_HARNESS_TARGET_REPO_ROOT:-}" ]]; then
+  if [[ "$REPO_HARNESS_TARGET_REPO_ROOT" != /* ]]; then
+    echo "sprint-backlog: REPO_HARNESS_TARGET_REPO_ROOT must be an absolute path" >&2
+    exit 2
+  fi
+  if ! REPO_ROOT="$(cd "$REPO_HARNESS_TARGET_REPO_ROOT" 2>/dev/null && pwd -P)"; then
+    echo "sprint-backlog: REPO_HARNESS_TARGET_REPO_ROOT does not resolve to a directory" >&2
+    exit 2
+  fi
+  CURRENT_ROOT="$(pwd -P)"
+  if [[ "$REPO_ROOT" != "$CURRENT_ROOT" ]]; then
+    echo "sprint-backlog: REPO_HARNESS_TARGET_REPO_ROOT must match the current helper cwd" >&2
+    exit 2
+  fi
+  cd "$REPO_ROOT"
+elif REPO_ROOT="$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null)"; then
   cd "$REPO_ROOT"
 else
   cd "$SCRIPT_DIR/.."

package/assets/templates/helpers/workstream-sync.sh

@@ -83,6 +83,47 @@ validate_block() {
   [[ -e "$block" ]]
 }
 
+helper_sibling() {
+  local helper_name="$1"
+  local helper_dir=""
+  if [[ -n "${REPO_HARNESS_HELPER_SOURCE_PATH:-}" ]]; then
+    helper_dir="$(dirname "$REPO_HARNESS_HELPER_SOURCE_PATH")"
+  fi
+  if [[ -n "$helper_dir" && -f "$helper_dir/$helper_name" ]]; then
+    printf '%s\n' "$helper_dir/$helper_name"
+    return 0
+  fi
+  return 1
+}
+
+capability_resolver() {
+  local sibling=""
+  if command -v bun >/dev/null 2>&1 && [[ -f "scripts/capability-resolver.ts" ]]; then
+    bun scripts/capability-resolver.ts "$@"
+    return $?
+  fi
+  sibling="$(helper_sibling capability-resolver.ts || true)"
+  if command -v bun >/dev/null 2>&1 && [[ -n "$sibling" ]]; then
+    bun "$sibling" "$@"
+    return $?
+  fi
+  return 127
+}
+
+context_contract_sync() {
+  local sibling=""
+  if [[ -x "scripts/context-contract-sync.sh" ]]; then
+    bash "scripts/context-contract-sync.sh" "$@"
+    return $?
+  fi
+  sibling="$(helper_sibling context-contract-sync.sh || true)"
+  if [[ -n "$sibling" ]]; then
+    bash "$sibling" "$@"
+    return $?
+  fi
+  return 127
+}
+
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --block)
@@ -139,12 +180,12 @@ if ! validate_block "$functional_block"; then
   exit 2
 fi
 
-if [[ ! -f "scripts/capability-resolver.ts" ]] || ! command -v bun >/dev/null 2>&1; then
-  echo "workstream-sync: scripts/capability-resolver.ts and bun are required" >&2
+if ! command -v bun >/dev/null 2>&1 || ! capability_resolver list --format json >/dev/null 2>&1; then
+  echo "workstream-sync: capability-resolver.ts and bun are required" >&2
   exit 2
 fi
 
-if ! resolver_json="$(bun scripts/capability-resolver.ts match --path "$functional_block" --format json 2>&1)"; then
+if ! resolver_json="$(capability_resolver match --path "$functional_block" --format json 2>&1)"; then
   echo "$resolver_json" >&2
   exit 1
 fi
@@ -257,8 +298,6 @@ fi
 event_json="{\"ts\":\"$(json_escape "$iso_timestamp")\",\"file_path\":\"$(json_escape "$workstream_file")\",\"severity\":\"medium\",\"functional_block\":\"$(json_escape "$functional_block")\",\"capability_id\":\"$(json_escape "$capability_id")\",\"matched_prefix\":\"$(json_escape "$matched_prefix")\",\"architecture_domain\":\"$(json_escape "$architecture_domain")\",\"architecture_capability\":\"$(json_escape "$architecture_capability")\",\"architecture_module\":\"$(json_escape "$architecture_module")\",\"workstream_dir\":\"$(json_escape "$workstream_dir")\",\"contract_agents\":\"$(json_escape "$contract_agents")\",\"contract_claude\":\"$(json_escape "$contract_claude")\",\"active_workstream\":\"$(json_escape "$workstream_file")\",\"change_type\":\"workstream-sync\",\"spawn_recommended\":false,\"contract_sync_required\":true,\"request_file\":\"$(json_escape "$request_file")\"}"
 printf '%s\n' "$event_json" >> "$event_file"
 
-if [[ -f "$helper_dir/context-contract-sync.sh" ]]; then
-  bash "$helper_dir/context-contract-sync.sh" sync-event --json "$event_json"
-fi
+context_contract_sync sync-event --json "$event_json" >/dev/null 2>&1 || true
 
 echo "[WorkstreamSync] Ensured $workstream_file for $capability_id."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "repo-harness",
-  "version": "0.8.3",
+  "version": "0.8.5",
   "description": "Installs, migrates, audits, and repairs repo-local agentic development harnesses",
   "license": "MIT",
   "repository": {

package/scripts/AGENTS.md

@@ -0,0 +1,68 @@
+# Functional Block Agent Context
+
+Keep this file focused on the local contract for this primary functional block.
+
+<!-- BEGIN CAPABILITY CONTEXT -->
+## Capability Context
+
+- Capability ID: `workflow-engine-inspection-migration`
+- Domain: `workflow-engine`
+- Name: `inspection-migration`
+- Primary prefix: `scripts/inspect-project-state.ts`
+- Architecture module: `docs/architecture/modules/workflow-engine/inspection-migration.md`
+- Workstream: `tasks/workstreams/workflow-engine/inspection-migration`
+
+## Positioning
+
+Owns the workflow-engine-inspection-migration capability boundary declared in .ai/context/capabilities.json.
+
+## Source Map
+
+- Primary prefix: `scripts/inspect-project-state.ts` (entrypoint)
+- Architecture module: `docs/architecture/modules/workflow-engine/inspection-migration.md` (design-source)
+- Workstream: `tasks/workstreams/workflow-engine/inspection-migration` (durable-progress)
+
+## Refresh Hints
+
+- `bun test tests/migration-script.test.ts tests/create-project-dirs.runtime.test.ts tests/workflow-contract.test.ts`
+- `bash scripts/migrate-project-template.sh --repo . --dry-run`
+<!-- END CAPABILITY CONTEXT -->
+
+<!-- BEGIN ARCHITECTURE CONTRACT -->
+## Architecture Contract
+
+- Functional block: `scripts/inspect-project-state.ts`
+- Capability ID: `workflow-engine-inspection-migration`
+- Matched prefix: `scripts/inspect-project-state.ts`
+- Architecture domain: `workflow-engine`
+- Architecture capability: `inspection-migration`
+- Architecture module: `docs/architecture/modules/workflow-engine/inspection-migration.md`
+- Last architecture event: 2026-07-03T15:45:36+0800
+- Last changed path: `docs/architecture/requests/archive/2026/workflow-engine-inspection-migration.md`
+- Severity: high
+- Change type: architecture-closeout
+- Module responsibility: Keep this block aligned with the local boundary described by surrounding human-owned context.
+- Entrypoints: `scripts/inspect-project-state.ts`
+- Allowed dependencies: Follow root `AGENTS.md` / `CLAUDE.md` and this local contract.
+- Forbidden dependencies: Do not cross sibling app/service/package boundaries without an architecture snapshot or explicit plan.
+- Runtime path: `scripts/inspect-project-state.ts`
+- LSP/tooling profile: `typescript-lsp`
+- Verification: Use root required checks plus local commands recorded in this capability contract.
+- Latest snapshot: `(none yet)`
+- Semantic diagram source: `docs/architecture/modules/workflow-engine/inspection-migration.md`
+- Latest human diagram: `(none yet)`
+- Pending architecture request: `(none)`
+
+## Active Workstreams
+
+- `tasks/workstreams/workflow-engine/inspection-migration/20260703-inspection-migration.md`
+  - status: active
+  - current_slice: completed-20260703-architecture-closeout
+  - source_plan: (none)
+
+## Current Session Projection
+
+- Durable progress lives under `tasks/workstreams/workflow-engine/inspection-migration`.
+- `tasks/current.md` is the tracked derived status snapshot; it is not a live lock or task source.
+- `tasks/todos.md` is the deferred-goal ledger; current execution slices stay in the active plan's `## Task Breakdown`.
+<!-- END ARCHITECTURE CONTRACT -->

package/scripts/CLAUDE.md

@@ -0,0 +1,68 @@
+# Functional Block Agent Context
+
+Keep this file focused on the local contract for this primary functional block.
+
+<!-- BEGIN CAPABILITY CONTEXT -->
+## Capability Context
+
+- Capability ID: `workflow-engine-inspection-migration`
+- Domain: `workflow-engine`
+- Name: `inspection-migration`
+- Primary prefix: `scripts/inspect-project-state.ts`
+- Architecture module: `docs/architecture/modules/workflow-engine/inspection-migration.md`
+- Workstream: `tasks/workstreams/workflow-engine/inspection-migration`
+
+## Positioning
+
+Owns the workflow-engine-inspection-migration capability boundary declared in .ai/context/capabilities.json.
+
+## Source Map
+
+- Primary prefix: `scripts/inspect-project-state.ts` (entrypoint)
+- Architecture module: `docs/architecture/modules/workflow-engine/inspection-migration.md` (design-source)
+- Workstream: `tasks/workstreams/workflow-engine/inspection-migration` (durable-progress)
+
+## Refresh Hints
+
+- `bun test tests/migration-script.test.ts tests/create-project-dirs.runtime.test.ts tests/workflow-contract.test.ts`
+- `bash scripts/migrate-project-template.sh --repo . --dry-run`
+<!-- END CAPABILITY CONTEXT -->
+
+<!-- BEGIN ARCHITECTURE CONTRACT -->
+## Architecture Contract
+
+- Functional block: `scripts/inspect-project-state.ts`
+- Capability ID: `workflow-engine-inspection-migration`
+- Matched prefix: `scripts/inspect-project-state.ts`
+- Architecture domain: `workflow-engine`
+- Architecture capability: `inspection-migration`
+- Architecture module: `docs/architecture/modules/workflow-engine/inspection-migration.md`
+- Last architecture event: 2026-07-03T15:45:36+0800
+- Last changed path: `docs/architecture/requests/archive/2026/workflow-engine-inspection-migration.md`
+- Severity: high
+- Change type: architecture-closeout
+- Module responsibility: Keep this block aligned with the local boundary described by surrounding human-owned context.
+- Entrypoints: `scripts/inspect-project-state.ts`
+- Allowed dependencies: Follow root `AGENTS.md` / `CLAUDE.md` and this local contract.
+- Forbidden dependencies: Do not cross sibling app/service/package boundaries without an architecture snapshot or explicit plan.
+- Runtime path: `scripts/inspect-project-state.ts`
+- LSP/tooling profile: `typescript-lsp`
+- Verification: Use root required checks plus local commands recorded in this capability contract.
+- Latest snapshot: `(none yet)`
+- Semantic diagram source: `docs/architecture/modules/workflow-engine/inspection-migration.md`
+- Latest human diagram: `(none yet)`
+- Pending architecture request: `(none)`
+
+## Active Workstreams
+
+- `tasks/workstreams/workflow-engine/inspection-migration/20260703-inspection-migration.md`
+  - status: active
+  - current_slice: completed-20260703-architecture-closeout
+  - source_plan: (none)
+
+## Current Session Projection
+
+- Durable progress lives under `tasks/workstreams/workflow-engine/inspection-migration`.
+- `tasks/current.md` is the tracked derived status snapshot; it is not a live lock or task source.
+- `tasks/todos.md` is the deferred-goal ledger; current execution slices stay in the active plan's `## Task Breakdown`.
+<!-- END ARCHITECTURE CONTRACT -->

package/scripts/check-tarball-install-smoke.sh

@@ -79,6 +79,33 @@ if ! "$CLI" run check-task-workflow --help >/dev/null; then
   echo "[tarball-smoke] ERROR: packaged 'repo-harness run check-task-workflow --help' failed (run dispatcher / helper lookup / bin startup broken)" >&2
   exit 1
 fi
+
+mkdir -p "$TARGET_REPO/plans/sprints" "$TARGET_REPO/.ai/harness/sprint"
+cat > "$TARGET_REPO/plans/sprints/20991231-2359-tarball-root.sprint.md" <<'SPRINT_EOF'
+# Sprint: Tarball Root
+
+> **Status**: Approved
+
+## Backlog
+
+| # | Status | Task | Mode | Acceptance | Plan |
+|---|--------|------|------|------------|------|
+| 1 | [ ] | task-a | inline | packaged helper reads target repo | (pending) |
+| 2 | [ ] | task-b | inline | packaged helper reads target repo | (pending) |
+| 3 | [ ] | task-c | inline | packaged helper reads target repo | (pending) |
+| 4 | [ ] | task-d | inline | packaged helper reads target repo | (pending) |
+| 5 | [ ] | task-e | inline | packaged helper reads target repo | (pending) |
+SPRINT_EOF
+printf '%s' 'plans/sprints/20991231-2359-tarball-root.sprint.md' > "$TARGET_REPO/.ai/harness/sprint/active-sprint"
+
+(cd "$TARGET_REPO" && "$CLI" run sprint-backlog status) >"$TMP_DIR/sprint-status.txt"
+if ! grep -qx 'sprint: plans/sprints/20991231-2359-tarball-root.sprint.md' "$TMP_DIR/sprint-status.txt" \
+  || ! grep -qx 'tasks_total: 5' "$TMP_DIR/sprint-status.txt"; then
+  echo "[tarball-smoke] ERROR: packaged sprint-backlog helper did not read the target repo sprint state" >&2
+  cat "$TMP_DIR/sprint-status.txt" >&2
+  exit 1
+fi
+
 printf '{"prompt":"review release readiness"}\n' | "$HOOK" prompt-guard-decide >/dev/null
 
 FAKE_HOME="$TMP_DIR/home"

package/scripts/inspect-project-state.ts

@@ -175,6 +175,15 @@ export function inspectRepo(repo: string): InspectionResult {
   if (hasAnyPath(repo, generatedClaudeHookPaths)) {
     driftSignals.push("stale-generated-claude-hook-shims");
   }
+  const rootClaudeFile = join(repo, "CLAUDE.md");
+  const rootAgentsFile = join(repo, "AGENTS.md");
+  if (
+    existsSync(rootClaudeFile) &&
+    existsSync(rootAgentsFile) &&
+    readFileSync(rootClaudeFile, "utf-8") !== readFileSync(rootAgentsFile, "utf-8")
+  ) {
+    driftSignals.push("root-agent-context-divergent");
+  }
 
   if (driftSignals.includes("missing-runtime-contract-manifest")) {
     requiredDecisions.push("Install runtime workflow contract manifest");
@@ -200,6 +209,9 @@ export function inspectRepo(repo: string): InspectionResult {
   if (driftSignals.includes("stale-generated-claude-hook-shims")) {
     requiredDecisions.push("Remove manifest-owned generated .claude/hooks shims and keep .ai/hooks as source of truth");
   }
+  if (driftSignals.includes("root-agent-context-divergent")) {
+    requiredDecisions.push("Root CLAUDE.md and AGENTS.md have diverged; reconcile by hand — repo-harness never overwrites user-authored root files.");
+  }
 
   const upgradeSignals = new Set(driftSignals);
   if (hasCustomClaudeHooks(repo)) {

package/scripts/lib/project-init-lib.sh

@@ -2160,19 +2160,44 @@ pi_root_context_content() {
   cat <<'EOF_ROOT_CONTEXT'
 # Repo Agent Context
 
-This is the root routing contract for Claude Code and Codex.
+This is the root routing contract for Claude Code and Codex. Keep it short:
+load this first, then follow the repo-owned artifacts it names.
 
 ## Root Workflow Contract
 
 - Keep sibling `CLAUDE.md` and `AGENTS.md` files aligned. Claude Code consumes `CLAUDE.md`; Codex consumes `AGENTS.md`.
+- Prefer repo-local workflow artifacts over tool-specific chat memory.
 - Treat `docs/spec.md` as stable product truth, `tasks/current.md` as a derived status snapshot, and `tasks/todos.md` as the deferred-goal ledger; current execution stays in the active plan's `## Task Breakdown`.
-- Treat `docs/researches/`, `tasks/lessons.md`, and `.ai/harness/policy.json` as durable workflow context.
-- Use `.ai/context/context-map.json` and `.ai/context/capabilities.json` to discover functional-block contracts.
+- Treat `docs/researches/`, `tasks/lessons.md`, `tasks/notes/`, `.ai/harness/policy.json`, and `.ai/harness/handoff/current.md` as durable workflow context.
+- Use `.ai/context/context-map.json` and `.ai/context/capabilities.json` to discover functional-block contracts before adding local agent files.
 - Do not infer local `CLAUDE.md` or `AGENTS.md` files from broad physical layouts such as `apps/*`, `packages/*`, or `services/*`.
 - Put capability-specific ownership, entrypoints, and verification commands in explicitly selected functional-block contracts.
 - Keep root context concise; route deep implementation detail into plans, task notes, research, workstreams, or architecture docs.
 - Treat `_ref/` as ignored external reference material and `_ops/` as ignored local operations state.
-- Prefer repo-local workflow artifacts over tool-specific chat memory.
+
+## Agent Context Scaffolding
+
+- Before creating or changing agent context files, inspect existing high-context files, repo manifests, CI workflows, Makefiles, generated outputs, generators, and high-risk directories.
+- Treat scanners as leads, not authority. Verify commands, ownership, and generated-file boundaries against actual repo files before writing instructions.
+- Choose the smallest instruction stack that changes behavior: root context for repo-wide routing, scoped context only where local rules differ, and no nested file for ordinary implementation directories.
+- Preserve existing high-context files unless the user explicitly approved a rewrite; add pointers or scoped complements instead of normalizing names.
+- Pair every prohibition with the concrete alternative: source of truth, helper, generator, command, or verification surface.
+
+## Decision Protocol
+
+- For non-trivial engineering work, complete P1/P2/P3 before design decisions or code edits: P1 map the real system boundary, P2 trace one concrete data/control path, and P3 state the design rationale and invariant being preserved.
+- For planning requests, produce one decision-complete recommendation with scope, non-scope, tradeoffs, tests, rollback/failure handling, and the most fragile assumption; do not implement until the user approves.
+- If the user says `implement this plan`, first check for obvious repo drift, then execute the approved plan without re-litigating the direction.
+- For bug hunts, trace the failing path and name the root cause before changing code.
+- For bundles of requests, classify items before accepting scope; do not treat every item as automatic implementation work.
+- Do not add fallback, compatibility, or "best effort" product code that re-derives an authority's semantics (LLM/provider/external/user-input) with local rules, regexes, or shadow parsers; fail closed with a clear error unless the current task or a human-approved migration/release contract explicitly requires that path.
+
+## Execution And Verification
+
+- Prefer existing repo patterns, scripts, and standard-library/platform features before adding dependencies, files, or abstractions.
+- Preserve user-authored files; do not overwrite existing `CLAUDE.md` or `AGENTS.md` except when explicitly applying an approved scaffold or syncing the controlled architecture block.
+- After substantive changes, run focused checks for the touched area plus `bash scripts/check-task-sync.sh` and `bash scripts/check-task-workflow.sh --strict` when those scripts exist.
+- Report what changed, why it was the smallest coherent change, verification evidence, and any concrete residual risk.
 EOF_ROOT_CONTEXT
 }
 

package/scripts/sprint-backlog.sh

@@ -2,7 +2,22 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-if REPO_ROOT="$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null)"; then
+if [[ -n "${REPO_HARNESS_TARGET_REPO_ROOT:-}" ]]; then
+  if [[ "$REPO_HARNESS_TARGET_REPO_ROOT" != /* ]]; then
+    echo "sprint-backlog: REPO_HARNESS_TARGET_REPO_ROOT must be an absolute path" >&2
+    exit 2
+  fi
+  if ! REPO_ROOT="$(cd "$REPO_HARNESS_TARGET_REPO_ROOT" 2>/dev/null && pwd -P)"; then
+    echo "sprint-backlog: REPO_HARNESS_TARGET_REPO_ROOT does not resolve to a directory" >&2
+    exit 2
+  fi
+  CURRENT_ROOT="$(pwd -P)"
+  if [[ "$REPO_ROOT" != "$CURRENT_ROOT" ]]; then
+    echo "sprint-backlog: REPO_HARNESS_TARGET_REPO_ROOT must match the current helper cwd" >&2
+    exit 2
+  fi
+  cd "$REPO_ROOT"
+elif REPO_ROOT="$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null)"; then
   cd "$REPO_ROOT"
 else
   cd "$SCRIPT_DIR/.."

package/scripts/workstream-sync.sh

@@ -83,6 +83,47 @@ validate_block() {
   [[ -e "$block" ]]
 }
 
+helper_sibling() {
+  local helper_name="$1"
+  local helper_dir=""
+  if [[ -n "${REPO_HARNESS_HELPER_SOURCE_PATH:-}" ]]; then
+    helper_dir="$(dirname "$REPO_HARNESS_HELPER_SOURCE_PATH")"
+  fi
+  if [[ -n "$helper_dir" && -f "$helper_dir/$helper_name" ]]; then
+    printf '%s\n' "$helper_dir/$helper_name"
+    return 0
+  fi
+  return 1
+}
+
+capability_resolver() {
+  local sibling=""
+  if command -v bun >/dev/null 2>&1 && [[ -f "scripts/capability-resolver.ts" ]]; then
+    bun scripts/capability-resolver.ts "$@"
+    return $?
+  fi
+  sibling="$(helper_sibling capability-resolver.ts || true)"
+  if command -v bun >/dev/null 2>&1 && [[ -n "$sibling" ]]; then
+    bun "$sibling" "$@"
+    return $?
+  fi
+  return 127
+}
+
+context_contract_sync() {
+  local sibling=""
+  if [[ -x "scripts/context-contract-sync.sh" ]]; then
+    bash "scripts/context-contract-sync.sh" "$@"
+    return $?
+  fi
+  sibling="$(helper_sibling context-contract-sync.sh || true)"
+  if [[ -n "$sibling" ]]; then
+    bash "$sibling" "$@"
+    return $?
+  fi
+  return 127
+}
+
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --block)
@@ -139,12 +180,12 @@ if ! validate_block "$functional_block"; then
   exit 2
 fi
 
-if [[ ! -f "scripts/capability-resolver.ts" ]] || ! command -v bun >/dev/null 2>&1; then
-  echo "workstream-sync: scripts/capability-resolver.ts and bun are required" >&2
+if ! command -v bun >/dev/null 2>&1 || ! capability_resolver list --format json >/dev/null 2>&1; then
+  echo "workstream-sync: capability-resolver.ts and bun are required" >&2
   exit 2
 fi
 
-if ! resolver_json="$(bun scripts/capability-resolver.ts match --path "$functional_block" --format json 2>&1)"; then
+if ! resolver_json="$(capability_resolver match --path "$functional_block" --format json 2>&1)"; then
   echo "$resolver_json" >&2
   exit 1
 fi
@@ -257,8 +298,6 @@ fi
 event_json="{\"ts\":\"$(json_escape "$iso_timestamp")\",\"file_path\":\"$(json_escape "$workstream_file")\",\"severity\":\"medium\",\"functional_block\":\"$(json_escape "$functional_block")\",\"capability_id\":\"$(json_escape "$capability_id")\",\"matched_prefix\":\"$(json_escape "$matched_prefix")\",\"architecture_domain\":\"$(json_escape "$architecture_domain")\",\"architecture_capability\":\"$(json_escape "$architecture_capability")\",\"architecture_module\":\"$(json_escape "$architecture_module")\",\"workstream_dir\":\"$(json_escape "$workstream_dir")\",\"contract_agents\":\"$(json_escape "$contract_agents")\",\"contract_claude\":\"$(json_escape "$contract_claude")\",\"active_workstream\":\"$(json_escape "$workstream_file")\",\"change_type\":\"workstream-sync\",\"spawn_recommended\":false,\"contract_sync_required\":true,\"request_file\":\"$(json_escape "$request_file")\"}"
 printf '%s\n' "$event_json" >> "$event_file"
 
-if [[ -f "$helper_dir/context-contract-sync.sh" ]]; then
-  bash "$helper_dir/context-contract-sync.sh" sync-event --json "$event_json"
-fi
+context_contract_sync sync-event --json "$event_json" >/dev/null 2>&1 || true
 
 echo "[WorkstreamSync] Ensured $workstream_file for $capability_id."

package/src/cli/commands/global-runtime.ts

@@ -129,6 +129,34 @@ function packageVersion(sourceRoot: string): string | null {
   }
 }
 
+function packageName(sourceRoot: string): string | null {
+  try {
+    const pkg = JSON.parse(readFileSync(join(sourceRoot, "package.json"), "utf-8"));
+    return typeof pkg.name === "string" ? pkg.name : null;
+  } catch (_error) {
+    return null;
+  }
+}
+
+function isBunDependencyLoop(step: GlobalRuntimeStep): boolean {
+  return /DependencyLoop|dependency loop/i.test(`${step.stdout ?? ""}\n${step.stderr ?? ""}`);
+}
+
+function parsePackedTarballFilename(stdout: string): string | null {
+  try {
+    const parsed = JSON.parse(stdout);
+    const entry = Array.isArray(parsed) ? parsed[0] : parsed;
+    return typeof entry?.filename === "string" ? entry.filename : null;
+  } catch (_error) {
+    return null;
+  }
+}
+
+function appendOutput(...values: Array<string | undefined>): string | undefined {
+  const output = values.filter((value) => value && value.trim()).join("\n");
+  return output || undefined;
+}
+
 function bunGlobalPackageRoot(env?: NodeJS.ProcessEnv): string | null {
   const bunInstall = env?.BUN_INSTALL ?? process.env.BUN_INSTALL;
   const home = env?.HOME ?? process.env.HOME ?? process.env.USERPROFILE;
@@ -149,6 +177,7 @@ function isBunGlobalPackageSource(sourceRoot: string, env?: NodeJS.ProcessEnv):
 
 function installCli(sourceRoot: string, cwd: string, env?: NodeJS.ProcessEnv, installSpec?: string): GlobalRuntimeStep {
   const version = packageVersion(sourceRoot);
+  const name = packageName(sourceRoot);
   if (installSpec === undefined && isBunGlobalPackageSource(sourceRoot, env)) {
     return {
       step: "install repo-harness CLI",
@@ -160,6 +189,9 @@ function installCli(sourceRoot: string, cwd: string, env?: NodeJS.ProcessEnv, in
   }
   const spec = installSpec ?? (existsSync(join(sourceRoot, "package.json")) ? sourceRoot : "repo-harness");
   const step = runProcess("bun", ["add", "-g", spec], cwd, env);
+  if (installSpec === undefined && name === "repo-harness" && step.status === "failed" && isBunDependencyLoop(step)) {
+    return installCliFromPackedTarball(sourceRoot, cwd, env, version, step);
+  }
   return withStepName(
     step,
     "install repo-harness CLI",
@@ -167,6 +199,55 @@ function installCli(sourceRoot: string, cwd: string, env?: NodeJS.ProcessEnv, in
   );
 }
 
+function installCliFromPackedTarball(
+  sourceRoot: string,
+  cwd: string,
+  env: NodeJS.ProcessEnv | undefined,
+  version: string | null,
+  dependencyLoopStep: GlobalRuntimeStep,
+): GlobalRuntimeStep {
+  const packDir = join(homeDir(env), ".repo-harness", "packages");
+  const detailPrefix = version ? `version=${version}; ` : "";
+  mkdirSync(packDir, { recursive: true });
+
+  const pack = runProcess("npm", ["pack", "--json", "--pack-destination", packDir], sourceRoot, env);
+  if (pack.status !== "ok") {
+    return withStepName(
+      {
+        ...pack,
+        stderr: appendOutput(dependencyLoopStep.stderr, pack.stderr),
+      },
+      "install repo-harness CLI",
+      `${detailPrefix}dependency-loop repair pack failed`,
+    );
+  }
+  const filename = parsePackedTarballFilename(pack.stdout ?? "");
+  if (filename === null) {
+    return {
+      step: "install repo-harness CLI",
+      status: "failed",
+      command: pack.command,
+      detail: `${detailPrefix}dependency-loop repair pack output invalid`,
+      stdout: dependencyLoopStep.stdout,
+      stderr: appendOutput(dependencyLoopStep.stderr, pack.stderr, "npm pack --json did not return a tarball filename"),
+    };
+  }
+  const remove = runProcess("bun", ["remove", "-g", "repo-harness"], cwd, env);
+  if (remove.status !== "ok") {
+    return withStepName(
+      {
+        ...remove,
+        stdout: appendOutput(dependencyLoopStep.stdout, remove.stdout),
+        stderr: appendOutput(dependencyLoopStep.stderr, pack.stderr, remove.stderr),
+      },
+      "install repo-harness CLI",
+      `${detailPrefix}dependency-loop repair remove failed`,
+    );
+  }
+  const add = runProcess("bun", ["add", "-g", join(packDir, filename)], cwd, env);
+  return withStepName(add, "install repo-harness CLI", `${detailPrefix}repaired=packed-tarball`);
+}
+
 function syncRuntimeSkill(sourceRoot: string, env?: NodeJS.ProcessEnv): GlobalRuntimeStep {
   const script = join(sourceRoot, "scripts", "sync-codex-installed-copies.sh");
   if (!existsSync(script)) {

package/src/cli/commands/init.ts

@@ -40,6 +40,8 @@ const WAZA_SHARED_RULES = ["anti-patterns.md", "chinese.md", "durable-context.md
 const GBRAIN_INSTALL_ARGS = ["install", "-g", "github:garrytan/gbrain"] as const;
 const GLOBAL_RULES_BEGIN = "<!-- BEGIN: repo-harness global-working-rules -->";
 const GLOBAL_RULES_END = "<!-- END: repo-harness global-working-rules -->";
+const GLOBAL_RULES_SELF_NOTE =
+  "<!-- repo-harness manages this block; edits inside are overwritten on sync. Keep personal rules outside the markers. -->";
 
 export type InitBrainMode = "manifest-only" | "install-gbrain-cli" | "skip";
 export type ReportingLanguagePreset = "follow" | "zh-CN" | "en" | "custom";
@@ -234,16 +236,42 @@ function renderGlobalRules(sourceRoot: string, instruction: string): string {
     /^- Use the user's language for reports; keep technical terms in English\.$/m,
     `- ${instruction}`,
   );
-  return `${GLOBAL_RULES_BEGIN}\n${rendered.trim()}\n${GLOBAL_RULES_END}\n`;
+  return `${GLOBAL_RULES_BEGIN}\n${GLOBAL_RULES_SELF_NOTE}\n${rendered.trim()}\n${GLOBAL_RULES_END}\n`;
 }
 
-function mergeManagedBlock(current: string, block: string): string {
-  const start = current.indexOf(GLOBAL_RULES_BEGIN);
-  const end = current.indexOf(GLOBAL_RULES_END);
-  if (start >= 0 && end >= start) {
+type ManagedBlockStatus = "written" | "blocked-unbalanced" | "skipped-legacy";
+
+interface MergedManagedBlock {
+  content: string;
+  status: ManagedBlockStatus;
+}
+
+function countOccurrences(haystack: string, needle: string): number {
+  let count = 0;
+  let index = haystack.indexOf(needle);
+  while (index !== -1) {
+    count += 1;
+    index = haystack.indexOf(needle, index + needle.length);
+  }
+  return count;
+}
+
+function mergeManagedBlock(current: string, block: string): MergedManagedBlock {
+  const beginCount = countOccurrences(current, GLOBAL_RULES_BEGIN);
+  const endCount = countOccurrences(current, GLOBAL_RULES_END);
+
+  if (beginCount > 0 || endCount > 0) {
+    const start = current.indexOf(GLOBAL_RULES_BEGIN);
+    const end = current.indexOf(GLOBAL_RULES_END);
+    const balanced = beginCount === 1 && endCount === 1 && start >= 0 && end >= start;
+    if (!balanced) {
+      return { content: current, status: "blocked-unbalanced" };
+    }
     const afterEnd = end + GLOBAL_RULES_END.length;
-    return `${current.slice(0, start)}${block.trimEnd()}${current.slice(afterEnd).replace(/^\n?/, "\n")}`;
+    const merged = `${current.slice(0, start)}${block.trimEnd()}${current.slice(afterEnd).replace(/^\n?/, "\n")}`;
+    return { content: merged, status: "written" };
   }
+
   if (
     /^# Global Working Rules\s*$/m.test(current) ||
     (
@@ -253,10 +281,10 @@ function mergeManagedBlock(current: string, block: string): string {
       current.includes("### P3: Design Decision")
     )
   ) {
-    return current;
+    return { content: current, status: "skipped-legacy" };
   }
   const trimmed = current.trimEnd();
-  return `${trimmed}${trimmed ? "\n\n" : ""}${block}`;
+  return { content: `${trimmed}${trimmed ? "\n\n" : ""}${block}`, status: "written" };
 }
 
 export function writeGlobalContextFiles(
@@ -276,19 +304,29 @@ export function writeGlobalContextFiles(
   if (target === "claude" || target === "both") targets.push(join(home, ".claude", "CLAUDE.md"));
 
   const changes: string[] = [];
+  let blocked = false;
   for (const filePath of targets) {
     mkdirSync(dirname(filePath), { recursive: true });
     const current = existsSync(filePath) ? readFileSync(filePath, "utf-8") : "";
-    const next = mergeManagedBlock(current, block);
-    if (next === current) {
+    const merged = mergeManagedBlock(current, block);
+    if (merged.status === "blocked-unbalanced") {
+      blocked = true;
+      changes.push(`blocked:${filePath} (unbalanced repo-harness markers; repair manually, then re-run)`);
+      continue;
+    }
+    if (merged.status === "skipped-legacy") {
+      changes.push(`skipped-legacy:${filePath} (unmanaged Global Working Rules present; add the repo-harness markers to enable managed sync)`);
+      continue;
+    }
+    if (merged.content === current) {
       changes.push(`unchanged:${filePath}`);
       continue;
     }
-    writeFileSync(filePath, next, "utf-8");
+    writeFileSync(filePath, merged.content, "utf-8");
     changes.push(`${current ? "updated" : "created"}:${filePath}`);
   }
 
-  return { step: "global working rules", status: "ok", detail: changes.join(", ") };
+  return { step: "global working rules", status: blocked ? "failed" : "ok", detail: changes.join(", ") };
 }
 
 /**

package/src/cli/hook/minimal-change-context.ts

@@ -14,6 +14,7 @@ const SESSION_CONTEXT = [
   '3. Prefer the smallest direct implementation over new wrappers or extension points.',
   '4. Delete or shrink obsolete code before adding layers.',
   '5. Preserve explicit requirements, security, validation, data safety, error handling, accessibility, and runnable tests.',
+  '6. No compatibility fallbacks in product code: do not re-derive an LLM/provider/authority-owned value with local rules or regexes; if the authoritative value is missing or malformed, fail closed with a clear error instead of synthesizing a replacement.',
   'Before completion, justify each new dependency, file, and abstraction.',
 ].join('\n');
 

package/assets/templates/AGENTS.md

@@ -1,13 +0,0 @@
-# Functional Block Agent Context
-
-Keep this file focused on the local contract for this primary functional block.
-
-## Local Context Contract
-
-- Describe only the ownership, boundaries, stable entrypoints, and local verification commands for this functional block.
-- Keep sibling `CLAUDE.md` and `AGENTS.md` files aligned. Claude Code consumes `CLAUDE.md`; Codex consumes `AGENTS.md`.
-- Record the local LSP/tooling profile here when it differs from the repo default.
-- Route deep implementation detail into nearby docs instead of inflating root agent context files.
-- Treat `.ai/context/context-map.json` as the index of discoverable context files.
-- Do not keep pushing context files deeper by default; add lower-level files only for a separately owned functional block with its own commands and invariants.
-- Prefer repo-local workflow artifacts over tool-specific chat memory.

package/assets/templates/CLAUDE.md

@@ -1,13 +0,0 @@
-# Functional Block Agent Context
-
-Keep this file focused on the local contract for this primary functional block.
-
-## Local Context Contract
-
-- Describe only the ownership, boundaries, stable entrypoints, and local verification commands for this functional block.
-- Keep sibling `CLAUDE.md` and `AGENTS.md` files aligned. Claude Code consumes `CLAUDE.md`; Codex consumes `AGENTS.md`.
-- Record the local LSP/tooling profile here when it differs from the repo default.
-- Route deep implementation detail into nearby docs instead of inflating root agent context files.
-- Treat `.ai/context/context-map.json` as the index of discoverable context files.
-- Do not keep pushing context files deeper by default; add lower-level files only for a separately owned functional block with its own commands and invariants.
-- Prefer repo-local workflow artifacts over tool-specific chat memory.