tink-harness 1.9.22 → 1.11.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "tink",
   "description": "A small harness layer for Claude Code and Codex.",
-  "version": "1.9.22",
+  "version": "1.11.0",
   "author": {
     "name": "dotori"
   }

package/CHANGELOG.md

@@ -2,9 +2,20 @@
 
 All notable changes to Tink are tracked here.
 
-## [Unreleased]
+## [1.11.0] - 2026-06-12
 
-No unreleased changes yet.
+- **Fixed: update wiped run history.** `.tink/maintenance/` record files (`ledger.jsonl`, `friction.jsonl`, `weave-queue.json`) were in the always-overwrite set, so every npx `update` replaced the user's approval ledger and weave/friction signals with empty seeds - silently resetting dashboard usage history. They are now seed-only: created when missing, never overwritten.
+- Fixed: update resurrected harnesses the user removed via an approved `/tink:frog` operation. The updater now reads `ledger.jsonl` frog entries and skips re-creating those files and index entries (other missing defaults are still restored; `--force` restores everything).
+- Fixed: `dashboard` reported "opened in browser" even when the opener failed (e.g. no `xdg-open`); it now detects failure and tells you to open the file manually. Also fixed the installer's harness count including the human catalog file, and a `/tink:list` example that contradicted its own category rules.
+- New `dashboard` subcommand: `npx tink-harness dashboard` generates the harness health report (lifecycle summary + HTML) from local `.tink` records and opens it in the default browser - no more memorizing the two `node .tink/tools/...` commands. `--no-open` generates the file only. Falls back to the packaged tools when `.tink/tools/` is missing, and finds `.tink` in the current or home directory.
+
+## [1.10.0] - 2026-06-12
+
+- update: previously the npx `update` reset install scope and git policy to defaults; it now reuses the choices stored at install time (`.tink/config.json` gains `git_policy`). Choosing "커밋 안 함" (commit no .tink files) now means `.gitignore` is never created or edited - by install or by update - and a legacy whole-directory `.tink/` ignore line is left untouched.
+- **Default harness set is specialized-only.** The generic task-type harnesses `code-change`, `bug-fix`, `research`, `review`, and `docs` are retired: ordinary code/bug/research/review/docs work now runs as a **base run** (기본 절차) on the run state contract alone, and a harness is selected only when a specialized procedure genuinely fits. `npx tink-harness@latest update` removes unmodified retired harnesses automatically (user-woven copies are preserved), prunes their index entries and rule-graph nodes, and now also appends newly shipped default harnesses to an existing `index.json`.
+- frog: when invoked without a target, the harness health summary's judgment (weave/frog/merge candidates, overlap groups) becomes the default cleanup agenda; retired-generic leftovers and stale `.tink/memory/candidate/` entries are also reviewed. weave: run-only drafts repeated across 2+ runs and supported memory candidates can now be promoted (임시 초안 → 하네스, candidate → approved) through the Save Gate.
+- README: "How it works" rewritten as a compact file map plus three driving rules; the long design-docs paragraph moved into a collapsible contributors index (EN/KO).
+- cast: overlay selection is now rule-bound - `goal-checkpoint` is required for runs with 2+ goals, sequential harnesses, 4+ expected steps, or multi-component scope, and `plan-consensus` must be explicitly considered (with a reason when skipped) for from-scratch/reimplementation/migration work. The approval payload gained a mandatory `오버레이 점검` line, and the synthesis-probe verdict wording no longer reads as "default harnesses are sufficient" for the whole set.
 
 ## [1.9.22] - 2026-06-11
 

package/README.ko.md

@@ -10,7 +10,7 @@ Tink는 사소하지 않은 모든 에이전트 작업을 눈에 보이는 파
 
 <sub>Claude Code와 Codex를 위한 작은 하네스 레이어</sub>
 
-**최신 패키지:** v1.9.22 — 로컬 건강 리포트가 탭형 대시보드로 바뀌었습니다. 3D 하네스 지도, 쉬운 말 건강 요약, Claude Code와 Codex 양쪽 복사-붙여넣기 명령이 포함된 다음 행동 제안을 제공합니다. 전체 변경 이력은 [CHANGELOG](CHANGELOG.md)를 확인하세요.
+**최신 패키지:** v1.11.0 — 한 줄 대시보드: `npx tink-harness dashboard`로 하네스 건강 리포트를 만들고 브라우저로 바로 엽니다. update가 승인 이력·신호 기록을 지우던 심각한 버그와 frog로 삭제한 하네스가 부활하던 문제도 고쳤습니다. 전체 변경 이력은 [CHANGELOG](CHANGELOG.md)를 확인하세요.
 
 [English](README.md) · **한국어** · [변경 이력](CHANGELOG.md)
 
@@ -101,14 +101,14 @@ $tink:cast 인증 모듈 리팩터링     # Codex
 
 ## 하네스 건강을 눈으로 확인
 
-몇 번의 run이 쌓이면, 읽기 전용 helper 두 개가 기록을 로컬 대시보드로 바꿔 줍니다:
+몇 번의 run이 쌓이면, 명령 하나로 기록을 로컬 대시보드로 만들어 브라우저까지 열어 줍니다:
 
 ```bash
-node .tink/tools/generate-harness-lifecycle-summary.mjs
-node .tink/tools/render-harness-health-report.mjs
-# .tink/maintenance/harness-health-report.html 열기
+npx tink-harness dashboard          # 파일만 만들려면 --no-open 추가
 ```
 
+내부적으로는 읽기 전용 helper 두 개(`node .tink/tools/generate-harness-lifecycle-summary.mjs` → `node .tink/tools/render-harness-health-report.mjs`)를 실행한 뒤 `.tink/maintenance/harness-health-report.html`을 엽니다.
+
 ![Tink 대시보드 데모 — 건강 그룹 클릭, 하네스 카드 탐색, 3D 지도 조작](.github/assets/demo.gif)
 
 <sub>당신의 워크플로와 맞는다면, ⭐ 하나가 다른 개발자들이 찾는 데 도움이 됩니다.</sub>
@@ -147,7 +147,7 @@ Standalone / Codex:
 npx tink-harness@latest update
 ```
 
-업데이트는 질문 하나 — 어떤 agent surface를 갱신할지 — 만 묻고 나머지는 자동으로 처리합니다. Tink가 관리하는 파일(commands, skills, maintenance, 런타임 tools)은 항상 최신으로 덮어쓰고, 사용자가 수정한 하네스·메모리·설정은 보존합니다.
+업데이트는 질문 하나 — 어떤 agent surface를 갱신할지 — 만 묻고 나머지는 자동으로 처리합니다. 언어·설치 범위·git 정책은 설치 때 선택한 값을 그대로 재사용하며, ".tink 커밋 안 함"을 선택했다면 업데이트가 `.gitignore`를 절대 건드리지 않습니다. Tink가 관리하는 파일(commands, skills, 런타임 tools)은 항상 최신으로 덮어쓰고, 사용자가 수정한 하네스·메모리·설정과 `.tink/maintenance/`의 모든 기록(ledger 등)은 보존합니다.
 
 `CODEX_HOME`을 지정하지 않으면 Windows에서는 `%USERPROFILE%\.codex`, macOS/Linux에서는 `~/.codex`에 Codex skill이 설치됩니다.
 
@@ -199,27 +199,38 @@ Tink는 이제 비단순 작업에 대해 `.tink/current/contract.json`도 만
 
 ## 작동 방식
 
-Tink는 직접 볼 수 있는 파일을 씁니다.
+Tink가 아는 모든 것은 직접 읽고, diff 보고, 지울 수 있는 평범한 파일입니다.
 
-- `.tink/harnesses/`: 재사용 가능한 작업 하네스
-- `.tink/rules/`: 계약 내용에 맞춰 필요한 하네스, 체크, guard 후보만 고르는 작은 rule graph
-- `.tink/schemas/`: `contract.json` 같은 구조화 파일의 스키마
-- `.tink/current/`: 현재 실행 상태
-- `.tink/runs/`: 완료, 중단, 취소, 교체된 실행 기록
-- `.tink/maintenance/`: 검증, friction, weave 신호 기록
-- `.tink/memory/`: 승인된 실수, 선호, 교훈
+| 경로 | 내용 |
+| --- | --- |
+| `.tink/harnesses/` | 하네스 세트 — 기능 특화 절차만 |
+| `.tink/current/` | 현재 실행: 계획, 단계, 계약, 검증 체크 |
+| `.tink/runs/` | 끝난 실행의 간결한 기록 |
+| `.tink/memory/` | 승인된 교훈·선호. 초안은 `memory/candidate/`에서 대기 |
+| `.tink/rules/` + `.tink/schemas/` | 하네스 선택용 작은 rule graph와 파일 스키마 |
+| `.tink/maintenance/` + `.tink/tools/` | 사용 신호와 로컬 대시보드를 만드는 읽기 전용 helper |
 
-Tink는 이 기록을 읽어 하네스 건강 요약도 만들 수 있습니다. 요약은 어떤 하네스가 쓰였는지, 어디서 check가 실패하거나 막혔는지, 어떤 하네스가 자주 함께 쓰였는지, 어떤 하네스가 weave 개선 후보인지, frog 정리 검토 후보인지, 병합 검토 후보인지, 오래 쉬어서 보관 검토 후보인지, 더 지켜봐야 하는지를 보여줍니다. 후보 점수, 생애주기 상태, graph 관계, 최근 run timeline도 함께 제공합니다. 이것은 여전히 제안일 뿐입니다. 하네스 수정, 병합, 보관, 삭제, memory 저장, rule 업데이트는 Tink의 기존 명시적 승인 절차를 거쳐야 합니다.
+이 전부를 움직이는 원칙은 세 가지입니다.
 
-읽기 전용 helper 두 개가 이 기록을 [빠른 시작](#하네스-건강을-눈으로-확인)에서 본 로컬 대시보드로 바꿔 줍니다. 리포트는 정적 로컬 페이지입니다 — 서버, 파일 감시, hidden cache, public `tink index` 명령이 없습니다. 제안만 준비하며, 재사용 상태 변경은 기존 승인 절차를 그대로 따릅니다.
+1. **일반 작업에는 하네스가 필요 없습니다.** 평범한 코드 변경·리뷰·문서 작업은 기본 절차(계획 → 단계 → 검증 증거)만으로 진행합니다. 하네스는 특화된 절차가 실제로 결과를 바꿀 때만 로드됩니다 — 출시 안전판, 목표 체크포인트, 계획 비평, 요구사항 인터뷰, 도메인 워크플로.
+2. **제안만 합니다.** 대시보드·`frog`·`weave`는 실제 사용 신호로 제안을 준비할 뿐입니다. 재사용되는 것(하네스, 메모리, 삭제)은 반드시 별도 명시 승인을 거칩니다. 오늘 실행의 승인이 미래 실행이 물려받을 변경을 허가하지 않습니다.
+3. **느낌이 아니라 증거.** 실행 기록, 실패한 체크, friction 이벤트가 무엇을 개선하고(`weave`), 초안에서 하네스로 승격하고, 정리할지(`frog`)를 결정합니다. 증거가 약하면 삭제가 아니라 유지·관찰이 기본입니다.
 
-선택된 하네스에 따라 `.tink/current/goals.json`에는 현재 실행의 목표 체크포인트가, `.tink/current/delegation.md`에는 인수인계 패킷이 추가될 수 있습니다. Tink는 이런 브리프를 보이는 상태로 준비하지만, 별도 승인된 워크플로가 아니면 worker, tmux pane, worktree를 시작하지 않습니다.
+대시보드는 이 파일들로 만든 정적 로컬 페이지입니다 — 서버, 파일 감시, hidden cache, public `tink index` 명령이 없습니다.
 
-Rule graph는 작게 유지합니다. Tink는 먼저 필수 규칙을 고르고, 작업 사실이나 keyword에 맞는 선택 규칙만 가져오며, phase별로 이미 읽은 rule id를 기록해 같은 안내를 반복하지 않습니다.
+<details>
+<summary><strong>설계 문서 색인</strong> — 기여자용 세부 내용</summary>
 
-설계 메모는 `docs/`에 둡니다. 기본 호환성 기준은 `docs/compatibility-policy.md`에 있으며, 새 작업은 Claude Code와 Codex, macOS와 Windows를 함께 고려해야 합니다. Repo Signal 동작은 `docs/repo-signals.ko.md` 또는 `docs/repo-signals.md`에 정리되어 있고, 가벼운 graph 규칙 적용 계획은 `docs/graph-rule-adoption-plan.ko.md`에 정리되어 있습니다. 하네스 건강 요약은 `docs/harness-lifecycle-signals.ko.md` 또는 `docs/harness-lifecycle-signals.md`에 정리되어 있습니다. 외부 context 안전 기준은 `docs/mcp-safe-profile.md`와 `docs/external-context-policy.md`에 정리되어 있습니다. `.tink/current/` 상태를 읽거나 검토할 때는 `docs/work-state.ko.md` 또는 `docs/work-state.md`부터 보면 됩니다. 다음 업데이트 안정화 계획은 `docs/phase-5-update-confidence.ko.md`와 `docs/phase-5-update-confidence.md`에 정리되어 있습니다. Context 효율 관련 문서는 `docs/context-budget-ledger.ko.md`, `docs/context-budget-ledger.md`, `docs/context-metrics-evaluator.ko.md`, `docs/context-metrics-evaluator.md`, `docs/context-run-history-rollup.ko.md`, `docs/context-run-history-rollup.md`, `docs/context-threshold-status.ko.md`, `docs/context-threshold-status.md`, `docs/context-run-record-policy.ko.md`, `docs/context-run-record-policy.md`에서 확인할 수 있습니다. 남은 작업 단위는 `docs/planned-work-units.ko.md` 또는 `docs/planned-work-units.md`에 정리되어 있습니다. 더 큰 아이디어 구현 점검과 로드맵은 `docs/tink-idea-implementation-plan.ko.md`에 정리되어 있습니다.
+- 호환성 기준 (Claude Code + Codex, macOS + Windows): `docs/compatibility-policy.md`
+- Repo Signal: `docs/repo-signals.ko.md`, `docs/repo-signals.md` · graph 규칙 적용 계획: `docs/graph-rule-adoption-plan.ko.md`
+- 하네스 건강 요약: `docs/harness-lifecycle-signals.ko.md`, `docs/harness-lifecycle-signals.md`
+- 외부 context 안전: `docs/mcp-safe-profile.md`, `docs/external-context-policy.md`
+- `.tink/current/` 상태 읽기: `docs/work-state.ko.md`, `docs/work-state.md`
+- 업데이트 안정화: `docs/phase-5-update-confidence.ko.md`, `docs/phase-5-update-confidence.md`
+- Context 효율: `docs/context-budget-ledger.ko.md`, `docs/context-budget-ledger.md`, `docs/context-metrics-evaluator.ko.md`, `docs/context-metrics-evaluator.md`, `docs/context-run-history-rollup.ko.md`, `docs/context-run-history-rollup.md`, `docs/context-threshold-status.ko.md`, `docs/context-threshold-status.md`, `docs/context-run-record-policy.ko.md`, `docs/context-run-record-policy.md`
+- 남은 작업 단위: `docs/planned-work-units.ko.md`, `docs/planned-work-units.md` · 로드맵·아이디어 점검: `docs/tink-idea-implementation-plan.ko.md`
 
-중요한 원칙은 승인입니다. 현재 작업을 진행하는 승인과, 미래에도 재사용될 상태를 저장하는 승인은 별개입니다. 새 하네스, 메모리, rule graph, hook guard 저장은 항상 별도 승인이 필요합니다.
+</details>
 
 ## 계획된 작업 단위
 

package/README.md

@@ -17,14 +17,14 @@
 <p><sub>A small harness layer for Claude Code and Codex</sub></p>
 
 <p>
-  <a href="https://github.com/dotoricode/tink-harness/releases/tag/v1.9.22"><img src="https://img.shields.io/github/v/release/dotoricode/tink-harness?label=release&color=2ea44f" alt="GitHub release"></a>
+  <a href="https://github.com/dotoricode/tink-harness/releases/tag/v1.11.0"><img src="https://img.shields.io/github/v/release/dotoricode/tink-harness?label=release&color=2ea44f" alt="GitHub release"></a>
   <a href="https://www.npmjs.com/package/tink-harness"><img src="https://img.shields.io/npm/v/tink-harness?label=npm&color=cb3837" alt="npm version"></a>
   <a href="https://github.com/dotoricode/tink-harness/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/dotoricode/tink-harness/ci.yml?branch=main&label=ci" alt="CI"></a>
   <a href="https://github.com/dotoricode/tink-harness/blob/main/LICENSE"><img src="https://img.shields.io/github/license/dotoricode/tink-harness" alt="License"></a>
   <a href="https://github.com/dotoricode/tink-harness/stargazers"><img src="https://img.shields.io/github/stars/dotoricode/tink-harness?style=social" alt="GitHub stars"></a>
 </p>
 
-<p><strong>Latest package:</strong> v1.9.22 - The local health report is now a tabbed dashboard with a 3D harness map, plain-language health summaries, and next-action suggestions with copy-paste commands for both Claude Code and Codex. See <a href="CHANGELOG.md">CHANGELOG</a> for release history.</p>
+<p><strong>Latest package:</strong> v1.11.0 - One-line dashboard: <code>npx tink-harness dashboard</code> generates the harness health report and opens it in your browser. Also fixes a serious update bug that wiped approval-ledger and signal history, and stops update from resurrecting harnesses you removed via frog. See <a href="CHANGELOG.md">CHANGELOG</a> for release history.</p>
 
 **English** · [한국어](README.ko.md) · [Changelog](CHANGELOG.md)
 
@@ -115,14 +115,14 @@ $tink:cast refactor the auth module     # Codex
 
 ## See your harness health
 
-After a few runs, two read-only helpers turn your records into a local dashboard:
+After a few runs, one command turns your records into a local dashboard and opens it in your browser:
 
 ```bash
-node .tink/tools/generate-harness-lifecycle-summary.mjs
-node .tink/tools/render-harness-health-report.mjs
-# then open .tink/maintenance/harness-health-report.html
+npx tink-harness dashboard          # add --no-open to just generate the file
 ```
 
+Under the hood it runs the two read-only helpers (`node .tink/tools/generate-harness-lifecycle-summary.mjs`, then `node .tink/tools/render-harness-health-report.mjs`) and opens `.tink/maintenance/harness-health-report.html`.
+
 ![Tink dashboard demo - clicking a health group, browsing harness cards, and inspecting the 3D map](.github/assets/demo.gif)
 
 <sub>If this matches your workflow, a ⭐ helps others find it.</sub>
@@ -187,7 +187,7 @@ To update an existing standalone install (Claude Code or Codex):
 npx tink-harness@latest update
 ```
 
-Update asks one question - which agent surface to refresh - and handles the rest automatically. Tink-owned files (commands, skills, maintenance, runtime tools) are always brought to the latest version; your customized harnesses, memory, and config are preserved.
+Update asks one question - which agent surface to refresh - and handles the rest automatically. Language, install scope, and git policy are reused from the choices you made at install time; if you chose not to commit `.tink`, update never touches your `.gitignore`. Tink-owned files (commands, skills, runtime tools) are always brought to the latest version; your customized harnesses, memory, config, and all `.tink/maintenance/` history records are preserved.
 
 If `CODEX_HOME` is not set, Codex skills default to `%USERPROFILE%\.codex` on Windows and `~/.codex` on macOS/Linux.
 
@@ -253,29 +253,38 @@ Use it when a harness is useful but slightly wrong.
 
 ## How it works
 
-Tink uses files you can inspect:
-
-- `.tink/harnesses/`: reusable task harnesses
-- `.tink/rules/`: a small rule graph that chooses only relevant harnesses, checks, and opt-in guard candidates
-- `.tink/schemas/`: structured file schemas, including the current run contract
-- `.tink/current/`: the current run state
-- `.tink/runs/`: compact records from finished, blocked, canceled, or replaced runs
-- `.tink/maintenance/`: verification, friction, and weave signals that help repeated failures become approved improvements
-- `.tink/memory/`: approved mistakes, preferences, and lessons
+Everything Tink knows lives in plain files you can read, diff, and delete:
 
-Tink can also read those records into a harness health summary. The summary shows which harnesses were used, where checks failed or got blocked, which harnesses often appear together, and which ones may deserve a weave improvement, frog cleanup review, merge review, dormant archive review, or more observation. It also includes an explainable candidate score, lifecycle state, graph relationships, and recent run timeline. It only prepares suggestions. Tink does not edit, merge, archive, delete, save memory, or update rules without the same explicit approval gates as the rest of Tink.
+| Path | What it holds |
+| --- | --- |
+| `.tink/harnesses/` | the harness set — specialized procedures only |
+| `.tink/current/` | the active run: plan, steps, contract, verification checks |
+| `.tink/runs/` | compact records of finished runs |
+| `.tink/memory/` | approved lessons and preferences; drafts wait in `memory/candidate/` |
+| `.tink/rules/` + `.tink/schemas/` | a small rule graph for harness selection, plus file schemas |
+| `.tink/maintenance/` + `.tink/tools/` | usage signals and the read-only helpers that render the local dashboard |
 
-Two read-only helpers turn those records into the local dashboard shown in [Install & quick start](#install--quick-start). The report is a static local page - no server, no file watching, no hidden cache, no public `tink index` command. It only prepares suggestions; reusable-state changes keep their approval gates.
+Three rules drive all of it:
 
-When selected, current-run artifacts may also include `.tink/current/goals.json` for goal checkpoints or `.tink/current/delegation.md` for handoff packets. Tink prepares those briefs as visible state; it does not start workers, tmux panes, or worktrees unless a separate approved workflow does so.
+1. **Generic work runs without a harness.** An ordinary code change, review, or doc edit runs on the base run contract alone — plan, steps, verification evidence. A harness is loaded only when a specialized procedure actually changes what happens: release gates, goal checkpoints, plan critique, requirements interviews, domain workflows.
+2. **Suggestions only.** The dashboard, `frog`, and `weave` prepare proposals from real usage signals. Nothing reusable — a harness, a memory entry, a deletion — is saved without its own explicit approval. Approving today's run never authorizes changes that future runs would inherit.
+3. **Evidence over vibes.** Run records, failed checks, and friction events decide what gets improved (`weave`), promoted from draft to harness, or cleaned up (`frog`). Weak evidence defaults to keep-and-observe, never to delete.
 
-The rule graph stays small on purpose. Tink loads matching mandatory rules first, retrieves only relevant optional rules by task facts or keywords, and records loaded rule ids by phase so the same guidance is not repeated in one run.
+The dashboard is a static local page rendered from those files — the harness health summary behind it shows usage, failed checks, and weave/frog candidates. No server, no file watching, no hidden cache, no public `tink index` command. It only prepares suggestions; acting on them keeps the approval gates above.
 
-Design notes live in `docs/`. The compatibility baseline is `docs/compatibility-policy.md`: every new slice should consider Claude Code and Codex, plus macOS and Windows. Repo signal behavior is described in `docs/repo-signals.md` or `docs/repo-signals.ko.md`. The lightweight graph-rule adoption plan is `docs/graph-rule-adoption-plan.ko.md`. Harness health summaries are described in `docs/harness-lifecycle-signals.md` or `docs/harness-lifecycle-signals.ko.md`. External context safety is described in `docs/mcp-safe-profile.md` and `docs/external-context-policy.md`. To read or review `.tink/current/` state, start with `docs/work-state.md` or `docs/work-state.ko.md`. Update confidence is still documented in `docs/phase-5-update-confidence.md` or `docs/phase-5-update-confidence.ko.md`. Context efficiency docs live in `docs/context-budget-ledger.md`, `docs/context-budget-ledger.ko.md`, `docs/context-metrics-evaluator.md`, `docs/context-metrics-evaluator.ko.md`, `docs/context-run-history-rollup.md`, `docs/context-run-history-rollup.ko.md`, `docs/context-threshold-status.md`, `docs/context-threshold-status.ko.md`, `docs/context-run-record-policy.md`, and `docs/context-run-record-policy.ko.md`. The planned work-unit list is `docs/planned-work-units.md` or `docs/planned-work-units.ko.md`, with details in the verification evidence, memory decision, context change, and update diagnosis docs. The broader Korean idea audit and roadmap is `docs/tink-idea-implementation-plan.ko.md`.
+<details>
+<summary><strong>Design docs index</strong> — details for contributors</summary>
 
-The important rule is approval.
+- Compatibility baseline (Claude Code + Codex, macOS + Windows): `docs/compatibility-policy.md`
+- Repo signals: `docs/repo-signals.md`, `docs/repo-signals.ko.md` · graph-rule adoption plan: `docs/graph-rule-adoption-plan.ko.md`
+- Harness health summary: `docs/harness-lifecycle-signals.md`, `docs/harness-lifecycle-signals.ko.md`
+- External context safety: `docs/mcp-safe-profile.md`, `docs/external-context-policy.md`
+- Reading `.tink/current/` state: `docs/work-state.md`, `docs/work-state.ko.md`
+- Update confidence: `docs/phase-5-update-confidence.md`, `docs/phase-5-update-confidence.ko.md`
+- Context efficiency: `docs/context-budget-ledger.md`, `docs/context-budget-ledger.ko.md`, `docs/context-metrics-evaluator.md`, `docs/context-metrics-evaluator.ko.md`, `docs/context-run-history-rollup.md`, `docs/context-run-history-rollup.ko.md`, `docs/context-threshold-status.md`, `docs/context-threshold-status.ko.md`, `docs/context-run-record-policy.md`, `docs/context-run-record-policy.ko.md`
+- Planned work units: `docs/planned-work-units.md`, `docs/planned-work-units.ko.md` · roadmap and idea audit: `docs/tink-idea-implementation-plan.ko.md`
 
-Tink may suggest a harness, a memory entry, a cleanup, or an improvement. Before each run is committed, Tink runs one quick sanity check and surfaces a proposal only when something important is at stake. Low-risk steps let you continue with recorded assumptions; irreversible or externally visible actions (publish, deploy, deletions, broad changes) require explicit approval. Saving anything reusable — a new harness, a memory entry, a `.claude/` workflow file — always needs its own separate approval; approving the current run does not authorize saves that future installs would inherit.
+</details>
 
 ## What Tink is not
 

package/VERSIONING.md

@@ -1,6 +1,6 @@
 # Versioning
 
-Current version: `1.9.22`
+Current version: `1.11.0`
 
 Tink follows semver from `1.0.0` onward.
 

package/bin/install.js

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+import { spawnSync } from 'node:child_process';
+import crypto from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -124,7 +126,70 @@ function argValue(name) {
 }
 
 function usage() {
-  console.log(`Tink installer for Claude Code and Codex\n\nUsage:\n  tink-harness [install] [--scope=repo|global] [--global] [--lang=en|ko|zh] [--yes] [--with-hook] [--clean-codex-picker] [--dry-run] [--force]\n  tink-harness update [--scope=repo|global] [--global] [--lang=en|ko|zh] [--yes] [--clean-codex-picker] [--dry-run] [--force]\n\nIf the command is not installed yet, use:\n  npx tink-harness@latest [install]\n  npx tink-harness@latest update\n\nCommands:\n  install  Install Tink.\n  update   Update Tink to the latest templates. Asks only the agent surface; Tink-owned files always refresh, user-modified harness/memory/config files are kept.\n\nDefault interactive flow:\n  1. Select language\n  2. Show TINK wizard\n  3. Select Claude Code, Codex, or both\n  4. Select components\n  5. Select repo/global installation scope\n  6. Select Advanced options\n  7. Select git tracking policy for project state\n\nAdvanced options:\n  --dry-run             Preview only. Show what would be written or removed, but do not change files.\n  --force               Overwrite user-modified files. Use only when you want official templates to replace local edits.\n  --clean-codex-picker  Codex-only cleanup. Remove repo-local Claude Tink surfaces that show as Source Command Tink entries.\n\nEnvironment:\n  TINK_INSTALL_SURFACES=claude|codex|all\n  TINK_CLEAN_CODEX_PICKER=1\n\nScopes:\n  repo    Install shared .tink files into the current project.\n  global  Install shared .tink files into your home directory.\n`);
+  console.log(`Tink installer for Claude Code and Codex\n\nUsage:\n  tink-harness [install] [--scope=repo|global] [--global] [--lang=en|ko|zh] [--yes] [--with-hook] [--clean-codex-picker] [--dry-run] [--force]\n  tink-harness update [--scope=repo|global] [--global] [--lang=en|ko|zh] [--yes] [--clean-codex-picker] [--dry-run] [--force]\n  tink-harness dashboard [--no-open]\n\nIf the command is not installed yet, use:\n  npx tink-harness@latest [install]\n  npx tink-harness@latest update\n\nCommands:\n  install  Install Tink.\n  update   Update Tink to the latest templates. Asks only the agent surface; Tink-owned files always refresh, user-modified harness/memory/config files are kept.\n  dashboard  Generate the harness health report from local .tink records and open it in your browser. Use --no-open to skip opening.\n\nDefault interactive flow:\n  1. Select language\n  2. Show TINK wizard\n  3. Select Claude Code, Codex, or both\n  4. Select components\n  5. Select repo/global installation scope\n  6. Select Advanced options\n  7. Select git tracking policy for project state\n\nAdvanced options:\n  --dry-run             Preview only. Show what would be written or removed, but do not change files.\n  --force               Overwrite user-modified files. Use only when you want official templates to replace local edits.\n  --clean-codex-picker  Codex-only cleanup. Remove repo-local Claude Tink surfaces that show as Source Command Tink entries.\n\nEnvironment:\n  TINK_INSTALL_SURFACES=claude|codex|all\n  TINK_CLEAN_CODEX_PICKER=1\n\nScopes:\n  repo    Install shared .tink files into the current project.\n  global  Install shared .tink files into your home directory.\n`);
+}
+
+function findTinkRoot() {
+  for (const dir of [process.cwd(), os.homedir()]) {
+    if (fs.existsSync(path.join(dir, '.tink'))) return dir;
+  }
+  return null;
+}
+
+function openInBrowser(file) {
+  let result;
+  if (process.platform === 'win32') {
+    result = spawnSync('cmd', ['/c', 'start', '', file], { stdio: 'ignore' });
+  } else if (process.platform === 'darwin') {
+    result = spawnSync('open', [file], { stdio: 'ignore' });
+  } else {
+    result = spawnSync('xdg-open', [file], { stdio: 'ignore' });
+  }
+  return !result.error && result.status === 0;
+}
+
+function runDashboard() {
+  const target = findTinkRoot();
+  const language = detectInstalledLanguage() || detectLanguage();
+  if (!target) {
+    console.error(language === 'ko'
+      ? '.tink 디렉토리를 찾을 수 없습니다(현재 디렉토리·홈 디렉토리 확인). 먼저 `npx tink-harness@latest install`을 실행하세요.'
+      : 'No .tink directory found in the current or home directory. Run `npx tink-harness@latest install` first.');
+    process.exit(1);
+  }
+  const toolFor = (name) => {
+    const installed = path.join(target, '.tink/tools', name);
+    return fs.existsSync(installed) ? installed : path.join(root, 'templates/tink/tools', name);
+  };
+  const steps = [
+    toolFor('generate-harness-lifecycle-summary.mjs'),
+    toolFor('render-harness-health-report.mjs')
+  ];
+  for (const tool of steps) {
+    const result = spawnSync(process.execPath, [tool], { cwd: target, stdio: 'inherit' });
+    if (result.status !== 0) {
+      console.error(language === 'ko'
+        ? `대시보드 생성 실패: ${path.basename(tool)}`
+        : `Dashboard step failed: ${path.basename(tool)}`);
+      process.exit(result.status || 1);
+    }
+  }
+  const reportPath = path.join(target, '.tink/maintenance/harness-health-report.html');
+  if (!fs.existsSync(reportPath)) {
+    console.error(language === 'ko'
+      ? `리포트 파일이 없습니다: ${reportPath}`
+      : `Report not found: ${reportPath}`);
+    process.exit(1);
+  }
+  console.log(language === 'ko' ? `대시보드: ${reportPath}` : `Dashboard: ${reportPath}`);
+  if (args.includes('--no-open')) return;
+  if (openInBrowser(reportPath)) {
+    console.log(language === 'ko' ? '기본 브라우저에서 열었습니다.' : 'Opened in your default browser.');
+  } else {
+    console.log(language === 'ko'
+      ? '브라우저 자동 열기에 실패했습니다. 위 경로의 파일을 직접 열어주세요.'
+      : 'Could not open a browser automatically. Open the file above manually.');
+  }
 }
 
 function normalizeSurfaces(surfaces) {
@@ -365,7 +430,8 @@ function handleCancel(value) {
 
 function readHarnessCount() {
   const dir = path.join(root, 'templates/tink/harnesses');
-  return fs.readdirSync(dir).filter((name) => name.endsWith('.md')).length;
+  // HARNESS.md is the human catalog, not a harness
+  return fs.readdirSync(dir).filter((name) => name.endsWith('.md') && name !== 'HARNESS.md').length;
 }
 
 function displayPath(base, filePath) {
@@ -383,15 +449,14 @@ function shortList(items, emptyText = '- none') {
   return shown.join('\n');
 }
 
-function detectInstalledLanguage() {
+function readInstalledConfig() {
   const candidates = [
     path.join(process.cwd(), '.tink/config.json'),
     path.join(os.homedir(), '.tink/config.json')
   ];
   for (const configPath of candidates) {
     try {
-      const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
-      if (['en', 'ko', 'zh'].includes(config.language)) return config.language;
+      return JSON.parse(fs.readFileSync(configPath, 'utf8'));
     } catch {
       // keep looking
     }
@@ -399,15 +464,165 @@ function detectInstalledLanguage() {
   return null;
 }
 
+function detectInstalledLanguage() {
+  const config = readInstalledConfig();
+  if (config && ['en', 'ko', 'zh'].includes(config.language)) return config.language;
+  return null;
+}
+
 function isAlwaysUpdatePath(src) {
   const rel = path.relative(root, src).replace(/\\/g, '/');
   return rel.startsWith('templates/claude/commands/') ||
     rel.startsWith('templates/claude/skills/') ||
     rel.startsWith('templates/codex/skills/') ||
-    rel.startsWith('templates/tink/maintenance/') ||
     rel.startsWith('templates/tink/tools/');
 }
 
+function isSeedOnlyPath(src) {
+  // Runtime record files (ledger, friction, weave queue): the template only
+  // seeds them. Once they exist they hold user history and must never be
+  // overwritten by install or update.
+  const rel = path.relative(root, src).replace(/\\/g, '/');
+  return rel.startsWith('templates/tink/maintenance/');
+}
+
+// Generic task-type harnesses retired from the default set: generic work now
+// runs on the base run contract alone. Values are normalized (CR-stripped)
+// sha256 hashes of every version ever shipped, so update can tell shipped
+// content (safe to remove) from user-woven content (preserved).
+const RETIRED_HARNESSES = {
+  'code-change': [
+    '883396f8a7c69f097476ffd23288597814c5eabfae4ada2ef8a643afb3a80345',
+    'b9320a0fc7f89a7e8898107f0e289758b7265c1fddce3497fc9297703a3edb44'
+  ],
+  'bug-fix': [
+    '94f747e2cd299ae84fa82b8c54954e518fcca1e95a30edfe571fbf504dd70906',
+    'e2fe201b3de7d7ec748ebd6b7f8f11bb1f702d0deda21c87d21d7ce82867ce1f'
+  ],
+  research: [
+    '57fc4446a0e7d831a1fbd8047f45ad1b3bb595606cb4e643a7fce97308d38197',
+    '8e36fa4e3f5f2cb87b5357b33c46a9f9428038f344a12a5b46c79dee0c474aa1'
+  ],
+  review: [
+    '9f0c3f093885b9cf2d796bf60b8f1e5e08805273343a42b1bc87c06d36b7a2a0',
+    '3b46487689af1a19e436ea672ccfa78cbf82ffcce4540b826ee95239c968c889'
+  ],
+  docs: [
+    '25e6a8fc0c7ba3b4c50519c91157172f8b551ff847f30cc96a5b3ef64cb2c530',
+    '3e42f06aad78f2b18cb5c0c1a0efca17f86cbba9d189f5dbf64efe1c8c75d9b0'
+  ]
+};
+
+function normalizedSha256(content) {
+  return crypto.createHash('sha256').update(content.replace(/\r/g, '')).digest('hex');
+}
+
+// Default harnesses the user explicitly removed via an approved /tink:frog
+// operation. Update must not resurrect them.
+const retiredByFrog = new Set();
+
+function harnessNameFromDest(dest) {
+  const match = String(dest).replace(/\\/g, '/').match(/\.tink\/harnesses\/([^/]+)\.md$/);
+  return match ? match[1] : '';
+}
+
+function loadFroggedHarnessNames(target) {
+  retiredByFrog.clear();
+  const ledgerPath = path.join(target, '.tink/maintenance/ledger.jsonl');
+  if (!fs.existsSync(ledgerPath)) return;
+  let lines;
+  try {
+    lines = fs.readFileSync(ledgerPath, 'utf8').split('\n');
+  } catch {
+    return;
+  }
+  for (const line of lines) {
+    const text = line.replace(/^/, '').trim();
+    if (!text) continue;
+    try {
+      const entry = JSON.parse(text);
+      if (entry && entry.type === 'frog' && entry.result === 'applied' && Array.isArray(entry.files)) {
+        for (const file of entry.files) {
+          const name = harnessNameFromDest(file);
+          if (name && name !== 'index') retiredByFrog.add(name);
+        }
+      }
+    } catch {
+      // skip malformed ledger lines
+    }
+  }
+}
+
+function removeRetiredHarnesses(templateRoot, target) {
+  const harnessDir = path.join(target, '.tink/harnesses');
+  if (!fs.existsSync(harnessDir)) return;
+  const cleared = [];
+  for (const [name, hashes] of Object.entries(RETIRED_HARNESSES)) {
+    const file = path.join(harnessDir, `${name}.md`);
+    if (!fs.existsSync(file)) {
+      cleared.push(name);
+      continue;
+    }
+    if (hashes.includes(normalizedSha256(fs.readFileSync(file, 'utf8')))) {
+      log.message(`${dryRun ? 'would remove retired' : 'remove retired'} ${displayPath(target, file)}`);
+      recordOperation('removedLegacy', target, file);
+      if (!dryRun) fs.rmSync(file, { force: true });
+      cleared.push(name);
+    } else {
+      log.message(`keep user-modified retired harness ${displayPath(target, file)}`);
+      recordOperation('preserved', target, file);
+    }
+  }
+  syncHarnessIndex(templateRoot, target, cleared);
+  pruneRetiredRuleNodes(target, cleared);
+}
+
+function syncHarnessIndex(templateRoot, target, cleared) {
+  const indexPath = path.join(target, '.tink/harnesses/index.json');
+  const templateIndexPath = path.join(templateRoot, 'tink/harnesses/index.json');
+  if (!fs.existsSync(indexPath) || !fs.existsSync(templateIndexPath)) return;
+  try {
+    const installed = JSON.parse(fs.readFileSync(indexPath, 'utf8'));
+    const template = JSON.parse(fs.readFileSync(templateIndexPath, 'utf8'));
+    if (!Array.isArray(installed) || !Array.isArray(template)) return;
+    // keep user entries and metadata; drop entries whose retired file is gone;
+    // append default entries the installed index does not know yet
+    const kept = installed.filter((entry) => !(entry && cleared.includes(entry.name)));
+    const knownNames = new Set(kept.map((entry) => entry && entry.name));
+    const added = template.filter((entry) =>
+      entry && !knownNames.has(entry.name) && !retiredByFrog.has(entry.name));
+    const next = [...kept, ...added];
+    if (next.length === installed.length && added.length === 0) return;
+    log.message(`${dryRun ? 'would sync' : 'sync'} ${displayPath(target, indexPath)} (${installed.length - kept.length} retired removed, ${added.length} default added)`);
+    recordOperation('updated', target, indexPath);
+    if (!dryRun) fs.writeFileSync(indexPath, `${JSON.stringify(next, null, 2)}\n`);
+  } catch {
+    // unreadable index: leave it untouched
+  }
+}
+
+function pruneRetiredRuleNodes(target, cleared) {
+  const rulesPath = path.join(target, '.tink/rules/index.json');
+  if (!fs.existsSync(rulesPath)) return;
+  try {
+    const rules = JSON.parse(fs.readFileSync(rulesPath, 'utf8'));
+    if (!rules || !Array.isArray(rules.nodes)) return;
+    const nodes = rules.nodes.filter((node) =>
+      !(node && node.type === 'harness' && cleared.includes(node.target)));
+    if (nodes.length === rules.nodes.length) return;
+    const removedIds = new Set(rules.nodes.filter((node) => !nodes.includes(node)).map((node) => node.id));
+    rules.nodes = nodes;
+    if (Array.isArray(rules.edges)) {
+      rules.edges = rules.edges.filter((edge) => !removedIds.has(edge.from) && !removedIds.has(edge.to));
+    }
+    log.message(`${dryRun ? 'would prune' : 'prune'} retired rule nodes from ${displayPath(target, rulesPath)}`);
+    recordOperation('updated', target, rulesPath);
+    if (!dryRun) fs.writeFileSync(rulesPath, `${JSON.stringify(rules, null, 2)}\n`);
+  } catch {
+    // unreadable rule graph: leave it untouched
+  }
+}
+
 function isGeneratedLegacyRuleGraph(src, dest) {
   const rel = path.relative(root, src).replace(/\\/g, '/');
   if (rel !== 'templates/tink/rules/index.json') return false;
@@ -443,6 +658,13 @@ function isGeneratedLegacyRuleGraph(src, dest) {
 
 function writeFileFromTemplate(src, dest, base) {
   const exists = fs.existsSync(dest);
+  if (exists && !force && isSeedOnlyPath(src)) {
+    return;
+  }
+  if (isUpdate && !exists && retiredByFrog.has(harnessNameFromDest(dest))) {
+    log.message(`skip frog-removed ${displayPath(base, dest)}`);
+    return;
+  }
   if (exists && !force) {
     if (isUpdate) {
       const srcContent = fs.readFileSync(src);
@@ -677,12 +899,14 @@ function copySelected(scope, components, agent) {
     }
   }
   if (components.includes('harnesses')) {
+    if (isUpdate) loadFroggedHarnessNames(target);
     copyDir(path.join(templateRoot, 'tink/harnesses'), path.join(target, '.tink/harnesses'), target);
     copyDir(path.join(templateRoot, 'tink/rules'), path.join(target, '.tink/rules'), target);
     copyDir(path.join(templateRoot, 'tink/schemas'), path.join(target, '.tink/schemas'), target);
     copyDir(path.join(templateRoot, 'tink/maintenance'), path.join(target, '.tink/maintenance'), target);
     copyDir(path.join(templateRoot, 'tink/tools'), path.join(target, '.tink/tools'), target);
     writeFileFromTemplate(path.join(templateRoot, 'tink/config.json'), path.join(target, '.tink/config.json'), target);
+    if (isUpdate) removeRetiredHarnesses(templateRoot, target);
   }
   if (components.includes('memory')) {
     copyDir(path.join(templateRoot, 'tink/memory'), path.join(target, '.tink/memory'), target);
@@ -700,13 +924,21 @@ function updateGitignore(target, policy) {
     log.message('skip .gitignore update: tracking all .tink files');
     return;
   }
+  if (policy === 'none') {
+    // the user chose to keep .tink out of git; do not touch their .gitignore
+    log.message('skip .gitignore update: .tink stays untracked by your choice');
+    return;
+  }
   const gitignorePath = path.join(target, '.gitignore');
-  const ignoreBlock = policy === 'none'
-    ? ['.tink/']
-    : ['.tink/current/', '.tink/runs/', '.tink/cache/'];
+  const ignoreBlock = ['.tink/current/', '.tink/runs/', '.tink/cache/'];
 
   if (fs.existsSync(gitignorePath)) {
     const existing = fs.readFileSync(gitignorePath, 'utf8');
+    if (/^\.tink\/\s*$/m.test(existing)) {
+      // a legacy install already ignores the whole directory; nothing to add
+      log.message('skip .gitignore update: .tink/ already ignored');
+      return;
+    }
     const missing = ignoreBlock.filter((line) => !existing.includes(line));
     if (missing.length) {
       log.message(`${dryRun ? 'would update' : 'update'} .gitignore`);
@@ -718,7 +950,7 @@ function updateGitignore(target, policy) {
   }
 }
 
-function patchConfig(target, scope, hookScope, language) {
+function patchConfig(target, scope, hookScope, language, gitPolicy) {
   const configPath = path.join(target, '.tink/config.json');
   if (!fs.existsSync(configPath) || dryRun) return;
   const rel = displayPath(target, configPath).replace(/\\/g, '/');
@@ -727,6 +959,7 @@ function patchConfig(target, scope, hookScope, language) {
   config.install_scope = scope;
   config.hook_scope = hookScope;
   config.language = language;
+  if (gitPolicy) config.git_policy = gitPolicy;
   fs.writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`);
 }
 
@@ -817,6 +1050,14 @@ async function resolveChoices() {
     components = defaultComponentValues(agent, language);
     if (includesClaude(agent) && args.includes('--with-hook')) components.push('hook');
   }
+  if (isUpdate) {
+    // reuse the choices stored at install time; only the agent surface is asked
+    const stored = readInstalledConfig();
+    if (stored) {
+      if (!scope && ['repo', 'global'].includes(stored.install_scope)) scope = stored.install_scope;
+      if (['harnesses', 'all', 'none'].includes(stored.git_policy)) gitPolicy = stored.git_policy;
+    }
+  }
 
   if (!interactive) {
     scope = scope || 'repo';
@@ -975,6 +1216,11 @@ async function main() {
     process.exit(0);
   }
 
+  if (command === 'dashboard') {
+    runDashboard();
+    return;
+  }
+
   if (command !== 'install' && command !== 'update') {
     console.error(`Unknown command: ${command}`);
     usage();
@@ -1001,7 +1247,7 @@ async function main() {
   } else if (scope === 'global') {
     log.message('skip .gitignore for global install');
   }
-  patchConfig(targets.installTarget, scope, hookScope, language);
+  patchConfig(targets.installTarget, scope, hookScope, language, gitPolicy);
 
   const summary = [
     `Language: ${language}`,