toga-ai 1.0.0

package/.claude/settings.json

@@ -0,0 +1,119 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}/scripts/hooks/session-start.js\"",
+            "timeout": 5000
+          }
+        ]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "if echo \"${CLAUDE_TOOL_INPUT}\" | grep -qE 'rm -rf|DROP TABLE|DROP DATABASE'; then echo 'BLOCKED: Destructive command detected. If intentional, run the command manually outside Claude Code.'; exit 2; fi",
+            "timeout": 3000
+          }
+        ]
+      },
+      {
+        "matcher": "Write|Edit|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "if echo \"${CLAUDE_TOOL_INPUT}\" | grep -q '\"file_path\":.*INDEX\\.md'; then echo 'BLOCKED: INDEX.md is auto-generated. Run `node knowledge.js index` to regenerate it instead of editing directly.'; exit 2; fi",
+            "timeout": 3000
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Write|Edit|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}/scripts/hooks/post-edit-validate.js\"",
+            "timeout": 15000
+          }
+        ]
+      },
+      {
+        "matcher": "Write|Edit|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "if echo \"${CLAUDE_TOOL_INPUT}\" | grep -qE '\"file_path\".*\\.php'; then echo 'PHP file edited. Consider running /code-review on this file, or use the php-reviewer agent to check for security and framework pattern issues.'; fi",
+            "timeout": 3000
+          }
+        ]
+      },
+      {
+        "matcher": "Write|Edit|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "SCOPE_FILE=\"/tmp/toga-scope-${PPID:-$$}.count\"; COUNT=$(cat \"$SCOPE_FILE\" 2>/dev/null || echo 0); COUNT=$((COUNT+1)); echo $COUNT > \"$SCOPE_FILE\"; if [ $COUNT -ge 20 ]; then echo \"SCOPE WARNING: ${COUNT} files modified this session. Consider whether changes are too scattered.\"; fi",
+            "timeout": 3000
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}/scripts/hooks/session-end.js\"",
+            "timeout": 5000
+          }
+        ]
+      },
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}/scripts/hooks/evaluate-session.js\"",
+            "timeout": 5000
+          }
+        ]
+      },
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "SCOPE_FILE=\"/tmp/toga-scope-${PPID:-$$}.count\"; if [ -f \"$SCOPE_FILE\" ] && [ \"$(cat $SCOPE_FILE 2>/dev/null)\" -gt 0 ] 2>/dev/null; then echo 'Reminder: run `php -l <file>` on any edited PHP files to check for syntax errors.'; fi",
+            "timeout": 3000
+          }
+        ]
+      }
+    ]
+  },
+  "permissions": {
+    "allow": [
+      "Bash(node knowledge.js *)",
+      "Bash(node sync-skills.js *)",
+      "Bash(node scripts/harness.js *)",
+      "Bash(node scripts/install.js *)",
+      "Bash(node scripts/hooks/*.js)",
+      "Bash(php -l *)",
+      "Bash(git status)",
+      "Bash(git diff *)",
+      "Bash(git log *)",
+      "Bash(git add *)",
+      "Bash(git commit *)",
+      "Bash(git checkout *)",
+      "Bash(git branch *)",
+      "Bash(git push *)",
+      "Bash(git pull *)",
+      "Bash(npm *)",
+      "Bash(npx *)"
+    ]
+  }
+}

package/.claude-plugin/marketplace.json

@@ -0,0 +1,87 @@
+{
+  "marketplace": {
+    "id": "toga-team-knowledge",
+    "name": "TOGA Team Knowledge System",
+    "version": "1.0.0",
+    "author": "TOGA Technology",
+    "description": "Complete Claude Code harness for TOGA Technology's PHP development teams. Includes kickoff/capture session workflow, session persistence, PHP framework patterns for both App_ (1.0) and _underscore (2.0) frameworks, SQL and security review agents, and a living knowledge base system.",
+    "tags": ["php", "team-knowledge", "session-workflow", "code-review", "security"],
+    "install": "node scripts/install.js",
+    "source": "self-hosted",
+    "skills": [
+      {
+        "name": "kickoff",
+        "command": "/kickoff",
+        "description": "Prime Claude with repo architecture, framework standards, and client context at session start."
+      },
+      {
+        "name": "capture",
+        "command": "/capture",
+        "description": "Save session learnings (features, bugs, patterns, decisions) to the shared knowledge base."
+      },
+      {
+        "name": "session-save",
+        "command": "/session-save [name]",
+        "description": "Persist current session state for resuming in a future session."
+      },
+      {
+        "name": "session-resume",
+        "command": "/session-resume [name|latest]",
+        "description": "Reload a previously saved session state."
+      },
+      {
+        "name": "php-patterns",
+        "command": "/php-patterns [1.0|2.0|pdo|queue|api]",
+        "description": "Reference for TOGA PHP patterns across both frameworks."
+      },
+      {
+        "name": "code-review",
+        "command": "/code-review [file]",
+        "description": "PHP-focused security and framework pattern code review."
+      },
+      {
+        "name": "harness-audit",
+        "command": "/harness-audit",
+        "description": "Audit knowledge base and harness health, score 0-100."
+      }
+    ],
+    "agents": [
+      {
+        "name": "php-reviewer",
+        "description": "Expert PHP code reviewer for both TOGA frameworks."
+      },
+      {
+        "name": "planner",
+        "description": "Feature planning agent — produces phased implementation plans."
+      },
+      {
+        "name": "sql-reviewer",
+        "description": "SQL injection and query quality reviewer."
+      },
+      {
+        "name": "knowledge-writer",
+        "description": "Writes correctly-formatted docs into the knowledge base."
+      },
+      {
+        "name": "framework-pattern-checker",
+        "description": "Validates App_ and _underscore framework conventions."
+      },
+      {
+        "name": "php-build-resolver",
+        "description": "Resolves PHP fatal and parse errors with surgical fixes."
+      },
+      {
+        "name": "session-capture",
+        "description": "Extracts and categorizes session learnings for capture."
+      },
+      {
+        "name": "harness-optimizer",
+        "description": "Audits harness configuration and reports top improvements."
+      }
+    ],
+    "requirements": {
+      "node": ">=16.0.0",
+      "claudeCode": ">=1.0.0"
+    }
+  }
+}

package/.claude-plugin/plugin.json

@@ -0,0 +1,22 @@
+{
+  "name": "toga",
+  "version": "1.0.0",
+  "description": "TOGA Technology team Claude harness — kickoff/capture workflow, PHP framework patterns, session persistence, and team knowledge base",
+  "author": {
+    "name": "TOGA Technology"
+  },
+  "repository": "https://github.com/TOGATechnology/claude",
+  "license": "UNLICENSED",
+  "keywords": [
+    "claude-code",
+    "skills",
+    "php",
+    "knowledge-base",
+    "team-workflow"
+  ],
+  "mcpServers": {},
+  "skills": [
+    "./skills/"
+  ],
+  "commands": []
+}

package/CLAUDE.md

@@ -0,0 +1,161 @@
+# CLAUDE.md — TOGA Technology Team Knowledge Repo
+
+This **is** the shared team knowledge repo for TOGA Technology. It is the canonical
+source of truth for framework architecture, coding standards, feature documentation,
+client knowledge, and project registry.
+
+Every developer on the team uses this repo. The skills in `skills/` power a Claude Code
+workflow: prime context at session start, capture learnings at session end, and sync
+skills into any project repository.
+
+---
+
+## Skills (Claude Code slash commands)
+
+Install them into any project with `node sync-skills.js <project-path>`, then call them
+as `/skill-name` inside Claude Code.
+
+| Skill | Command | When to use |
+|-------|---------|-------------|
+| **kickoff** | `/kickoff` | **Start of every session.** Primes Claude with the right framework architecture, coding standards, repo knowledge, and client context before writing any code. Always run this first — do not code without it. |
+| **capture** | `/capture` | **End of every session.** Records what was built or changed into the knowledge base. Proposes creates/updates/deletes for one-tap approval, then writes docs and re-indexes. |
+| **sync-team-skills** | `/sync-team-skills` | Copies all skills from this repo into a project's `.claude/skills/`. Run after adding or updating a skill, or when onboarding a new project. |
+| **create-elastic-beanstalk** | `/create-elastic-beanstalk` | AWS Elastic Beanstalk environment setup wizard for TOGA projects. Run when provisioning a new cloud environment. |
+| **session-save** | `/session-save [name]` | Persists current session state to `~/.claude/session-data/`. Run before closing a long session you intend to resume later. |
+| **session-resume** | `/session-resume [name\|latest]` | Loads a previously saved session. Run at the start of a session that continues prior work — run this **before** `/kickoff`. |
+| **harness-audit** | `/harness-audit` | Audits the health of this knowledge repo: validates docs, checks registry completeness, scores 0-100. Run periodically or before a PR. |
+
+---
+
+## Knowledge Directory Structure
+
+```
+knowledge/
+├── CONVENTIONS.md         ← canonical doc-format spec (READ THIS FIRST)
+├── registry.json          ← all repos: name ↔ project ↔ framework ↔ role ↔ dependsOn
+├── INDEX.md               ← AUTO-GENERATED — do NOT hand-edit
+├── 1.0/
+│   ├── apps/<repo>/
+│   │   ├── INDEX.md       ← AUTO-GENERATED
+│   │   ├── architecture.md
+│   │   └── features/*.md
+│   └── standards/*.md     ← 1.0 (App_ framework) coding standards
+├── 2.0/
+│   ├── apps/<repo>/
+│   │   ├── INDEX.md       ← AUTO-GENERATED
+│   │   ├── architecture.md
+│   │   └── features/*.md
+│   └── standards/*.md     ← 2.0 (_underscore framework) coding standards
+└── clients/<client>/
+    ├── INDEX.md           ← AUTO-GENERATED
+    ├── profile.md
+    ├── features/*.md      ← client-specific overrides (link back to apps/)
+    └── workflows/*.md     ← client business processes
+```
+
+### Key files
+
+- **`knowledge/CONVENTIONS.md`** — the complete doc-format spec: frontmatter schema,
+  document types, INDEX rules, integrity requirements, and local-path policy. Read this
+  before writing or modifying any knowledge file.
+- **`knowledge/registry.json`** — maps every repo to its project name, framework,
+  role (core or app), and dependsOn list. The skills maintain this; do not hand-edit it.
+- **`knowledge/INDEX.md`** — auto-generated master index. Never hand-edit it.
+
+---
+
+## The Two PHP Frameworks
+
+TOGA Technology runs two parallel PHP frameworks. The framework determines which
+`knowledge/` subtree a repo lives in and which coding standards apply.
+
+### Framework 1.0 — `App_` framework
+- **Core repo:** `library`
+- **On-disk root (Windows):** `C:\WWW\1.0`
+- **Pattern:** classes prefixed with `App_` (e.g. `App_Controller`, `App_Model`)
+- **Knowledge path:** `knowledge/1.0/`
+- **Standards:** `knowledge/1.0/standards/`
+
+### Framework 2.0 — `_underscore` framework
+- **Core repo:** `_underscore`
+- **On-disk root (Windows):** `C:\WWW\2.0`
+- **Pattern:** leading underscore naming (e.g. `_Controller`, `_Model`, `_Worker`)
+- **Knowledge path:** `knowledge/2.0/`
+- **Standards:** `knowledge/2.0/standards/`
+
+If you are unsure which framework a repo belongs to, look it up in `registry.json` or
+run `node knowledge.js search --repo=<name>`.
+
+---
+
+## Rules for Claude
+
+### After ANY write to `knowledge/` files
+Always run:
+```sh
+node knowledge.js validate
+```
+The `PostToolUse` hook in `.claude/settings.json` does this automatically for writes
+in this repo. If validation fails (any `ERROR` line in output), **stop and fix the
+error before continuing** — do not report success on an inconsistent knowledge base.
+
+### INDEX.md files — NEVER hand-edit
+`INDEX.md` files (master, per-repo, per-client) are **auto-generated** by:
+```sh
+node knowledge.js index
+```
+The `capture` skill runs this automatically. If you hand-edit an INDEX.md, the next
+`index` run will overwrite your changes. Treat INDEX.md as read-only output.
+
+### Local repo paths — NEVER commit
+Absolute local paths (e.g. `C:\WWW\2.0\worker2`) are **machine-specific**. They are
+stored only in each developer's Claude memory as `reference` entries named
+`repo-path-<repo>` (e.g. `repo-path-worker2`) and `team-repo-path`. They are never
+stored in `registry.json`, any knowledge doc, or any committed file. If you ever see
+a local path in a committed file, remove it.
+
+### Document format
+All knowledge docs follow the frontmatter schema defined in `knowledge/CONVENTIONS.md`.
+Required fields: `title`, `framework`, `type`, `status`, `project`. See CONVENTIONS.md
+for the full template for each doc type (feature, architecture, standard, etc.).
+
+---
+
+## CLI Reference
+
+```sh
+# Validate knowledge base integrity
+node knowledge.js validate
+
+# Rebuild all INDEX.md files
+node knowledge.js index
+
+# Search docs
+node knowledge.js search --framework=2.0 --repo=worker2 --q=<keywords>
+
+# Resolve dependency load order for a repo
+node knowledge.js deps --repo=worker2
+
+# Sync skills into a project
+node sync-skills.js [project-path]
+
+# Harness utilities (audit, status, new-repo wizard)
+node scripts/harness.js audit
+node scripts/harness.js status
+node scripts/harness.js new-repo
+node scripts/harness.js sync [project-path]
+```
+
+---
+
+## npm Package
+
+This repo is published as `toga-harness`. To install skills into a new project:
+
+```sh
+npx toga-harness
+# or after npm install -g toga-harness:
+toga-harness
+```
+
+See `package.json` for full details.

package/README.md

@@ -0,0 +1,72 @@
+# claude
+
+Shared Claude Code skills, configuration, and the team **knowledge base** for TOGA Technology projects.
+
+## Skills
+
+| Skill | Description |
+|-------|-------------|
+| [kickoff](skills/kickoff/SKILL.md) | **Start of session.** Asks what you're working on (framework 1.0/2.0/both, front/back/hybrid, repo/project, client) and loads the matching coding standards, framework-core architecture, repo knowledge, and client knowledge from `knowledge/`. |
+| [capture](skills/capture/SKILL.md) | **End of session.** Figures out what you worked on, matches it against existing knowledge, and proposes create/update/retire changes for one-tap approval — then writes them and keeps `registry.json`, frontmatter, and INDEX files consistent. |
+| [create-elastic-beanstalk](skills/create-elastic-beanstalk/SKILL.md) | Interview for a new Elastic Beanstalk environment, then emit a ready-to-paste CloudShell `create-environment` command. |
+
+## The knowledge base (`knowledge/`)
+
+The team's feature, workflow, client, and architecture knowledge lives under `knowledge/`,
+managed **entirely by the `kickoff` and `capture` skills**. **Developers never hand-edit
+these files** — run `kickoff` to start a session and `capture` to finish one.
+
+- **Framework partitions everything:** `1.0/` (the `App_` framework, core repo `library`)
+  and `2.0/` (the `_underscore` framework, core repo `_underscore`). Each owns its `apps/`
+  and `standards/`.
+- App folders are keyed by **repo name** (`2.0/apps/worker2/`, …); the project name lives in
+  `registry.json` and doc frontmatter.
+- **Clients are shared** at the top level (`clients/<client>/`), each doc tagging its framework.
+- [`registry.json`](knowledge/registry.json) maps **repo ↔ project ↔ framework ↔ role ↔
+  dependsOn**. Every repo implicitly depends on its framework core; `dependsOn` adds more.
+- See [`knowledge/CONVENTIONS.md`](knowledge/CONVENTIONS.md) for the full structure spec
+  (the same spec is embedded in both skills).
+
+### `knowledge.js`
+
+A dependency-free Node helper that keeps the mechanical parts deterministic (the skills call it):
+
+```
+node knowledge.js search --framework= --repo= --project= --client= --file= --q=   # find docs
+node knowledge.js index                                                            # rebuild all INDEX.md
+node knowledge.js deps --repo=<repo>                                               # resolve load set (core + deps)
+node knowledge.js validate                                                         # integrity check
+```
+
+`validate` enforces that `registry.json`, the folder layout, and every doc's frontmatter
+agree, and runs after every `capture` write.
+
+### Where local paths live
+
+Absolute repo paths are machine-specific and are **not** stored in this repo. The skills keep
+them in **Claude memory** (`reference` entries `team-repo-path` and `repo-path-<repo>`),
+resolved lazily and asked for by repo name only when a session needs them. The first time a
+developer references a repo on a new machine, the skill asks "What is the path to the
+`<repo>` repository?" and remembers the answer.
+
+## How skills are deployed
+
+Claude Code loads skills from `.claude/skills/` at the project root. The skills in this repo
+are the source of truth — run the sync script to copy them into that directory.
+
+## Syncing skills
+
+After pulling new skills from this repo, run:
+
+```
+node claude/sync-skills.js
+```
+
+Works on Mac and PC. Run it from anywhere inside the project.
+
+## Adding a skill
+
+1. Create a directory under `skills/` with your skill name.
+2. Add a `SKILL.md` with YAML frontmatter (`name`, `description`) and the instructions.
+3. Run `node claude/sync-skills.js` to deploy it.
+4. Update the table above.

package/agents/framework-pattern-checker.md

@@ -0,0 +1,67 @@
+---
+name: framework-pattern-checker
+description: Checks that new PHP code follows the correct TOGA framework conventions for either the 1.0 (App_) or 2.0 (_underscore) framework.
+model: haiku
+tools: Read, Grep, Glob, Bash
+---
+
+# Framework Pattern Checker
+
+Lightweight, fast checker that validates new code follows TOGA's exact framework conventions. Designed for pre-commit or pre-review use. Detects framework automatically and checks naming, inheritance, method signatures, and structural rules. Reports violations only — does not suggest style improvements.
+
+## Trigger phrases
+- "check framework patterns"
+- "does this follow conventions?"
+- "validate my new class"
+- "is this the right way to do X in 1.0/2.0?"
+
+## Behavior
+
+1. **Detect framework** from file path or class name:
+   - File under `C:\WWW\1.0` or class starts with `App_` → **Framework 1.0**
+   - File under `C:\WWW\2.0` or class starts with `_` → **Framework 2.0**
+   - If still ambiguous: check `knowledge/registry.json` by repo name.
+
+2. **Framework 1.0 checks** (`App_` rules):
+   - Every class name begins with `App_` — e.g. `App_Controller_Orders`, `App_Model_User`.
+   - Controllers extend `App_Controller` (directly or via intermediate base class that itself extends `App_Controller`).
+   - Models extend `App_Model`.
+   - No direct model instantiation in controllers — must use the registry or factory: `App_Registry::get('ModelName')` or equivalent.
+   - Method names follow `camelCase`. No `snake_case` public methods.
+   - Class file is named to match the class: `App_Controller_Orders` → `Orders.php` under `controllers/`.
+   - Check `knowledge/1.0/apps/<repo>/architecture.md` for repo-specific patterns before flagging.
+
+3. **Framework 2.0 checks** (`_underscore` rules):
+   - All framework classes use leading underscore: `_Controller`, `_Model`, `_Worker`, `_Api`.
+   - Workers must extend `_Worker` and implement a `run()` method.
+   - Workers must NOT be called directly from controllers or other workers — dispatch via queue.
+   - Controllers extend `_Controller`.
+   - For `api2` repo: every action method must return an array with keys `success`, `data`, `errors` — never a raw string or bare array.
+   - `dependsOn` in `registry.json` means shared base classes exist — check `knowledge/2.0/apps/<shared-repo>/architecture.md` before adding new methods to inherited classes.
+
+4. **Cross-framework checks** (both):
+   - No `eval()` usage.
+   - No direct `$_GET`/`$_POST` access without validation wrapper.
+   - No raw string SQL (`"SELECT * FROM users WHERE id = " . $id`).
+
+5. **Report only violations** — not style preferences. Each violation must cite the rule source.
+
+## Output format
+
+```
+## Framework Pattern Check — <filename>
+Framework: 1.0 (App_) | 2.0 (_underscore)
+
+VIOLATIONS (must fix):
+  [line 14] Class 'OrderProcessor' missing App_ prefix — should be 'App_Model_OrderProcessor'
+  [line 47] Direct model instantiation: `new App_Model_User()` — use App_Registry::get('User')
+
+PASSES:
+  ✓ Controller extends App_Controller
+  ✓ No direct SQL string concatenation found
+  ✓ No eval() usage
+
+Result: 2 violation(s) found.
+```
+
+If no violations: "All framework pattern checks passed."

package/agents/harness-optimizer.md

@@ -0,0 +1,102 @@
+---
+name: harness-optimizer
+description: Audits the Claude harness configuration in this repo and reports a 0-100 health score with the top 3 highest-leverage improvements.
+model: sonnet
+tools: Read, Grep, Glob, Bash
+---
+
+# Harness Optimizer
+
+Audits the TOGA Team Knowledge System harness and scores its completeness and health from 0 to 100. Runs actual validation commands when available. Reports concisely: score, what's working, what's missing, and the three changes that would have the highest impact.
+
+## Trigger phrases
+- "audit the harness"
+- "how healthy is the harness?"
+- "harness score"
+- "/harness-audit"
+- "what should I improve in the harness?"
+
+## Behavior
+
+1. **Run existing audit tooling** (if available):
+   - `node knowledge.js validate` — knowledge base integrity
+   - `node scripts/harness.js audit` — harness-level checks
+   - Note the output and exit codes.
+
+2. **Check hooks coverage** (25 points):
+   - Read `.claude/settings.json`.
+   - Check for `SessionStart` hook → context priming (5 pts)
+   - Check for `PreToolUse` hooks → dangerous command protection (5 pts)
+   - Check for `PostToolUse` hooks → validation after writes (5 pts)
+   - Check for `Stop` hooks → session-end reminders (5 pts)
+   - Each hook that has a real implementation (not just an echo) = full points. (5 pts total for quality)
+
+3. **Check rules completeness** (20 points):
+   - `rules/common/coding-style.md` exists (4 pts)
+   - `rules/common/security.md` exists (4 pts)
+   - `rules/common/git-workflow.md` exists (4 pts)
+   - `rules/php/app-framework.md` exists (4 pts)
+   - `rules/php/underscore-framework.md` exists (4 pts)
+
+4. **Check agent coverage** (20 points):
+   - `agents/php-reviewer.md` exists (4 pts)
+   - `agents/planner.md` exists (4 pts)
+   - `agents/sql-reviewer.md` exists (4 pts)
+   - `agents/knowledge-writer.md` exists (4 pts)
+   - `agents/harness-optimizer.md` (self) exists (4 pts)
+
+5. **Check skills completeness** (20 points):
+   - `skills/kickoff/SKILL.md` (4 pts)
+   - `skills/capture/SKILL.md` (4 pts)
+   - `skills/session-save/SKILL.md` (4 pts)
+   - `skills/session-resume/SKILL.md` (4 pts)
+   - `skills/php-patterns/SKILL.md` OR `skills/code-review/SKILL.md` (4 pts)
+
+6. **Check knowledge base** (15 points):
+   - `knowledge/CONVENTIONS.md` exists (3 pts)
+   - `knowledge/registry.json` exists and is valid JSON (3 pts)
+   - At least one architecture.md per registered repo (3 pts)
+   - No validation errors from `node knowledge.js validate` (3 pts)
+   - INDEX.md files are present for all app directories (3 pts)
+
+7. **Identify top 3 improvements**: Rank missing items by impact × ease. Prioritize:
+   - Security rules (highest impact if missing)
+   - Hooks that validate/protect (high impact)
+   - Agent coverage for the team's core workflow (php-reviewer, planner)
+
+## Output format
+
+```
+## Harness Audit — TOGA Team Knowledge System
+
+### Score: 73 / 100
+
+### What's Working
+- ✓ SessionStart hook primes context
+- ✓ PostToolUse validates knowledge/ writes
+- ✓ kickoff, capture, session-save, session-resume skills present
+- ✓ knowledge/CONVENTIONS.md and registry.json present
+- ✓ Architecture docs for all 5 registered repos
+
+### What's Missing
+- ✗ rules/common/security.md — (-4 pts)
+- ✗ rules/php/ directory — (-8 pts)
+- ✗ agents/sql-reviewer.md — (-4 pts)
+- ✗ PreToolUse hook for dangerous commands — (-5 pts)
+- ✗ skills/php-patterns/SKILL.md — (-4 pts)
+- ⚠ PostToolUse hook exists but does not call a real script — (-3 pts quality)
+
+### Top 3 Improvements (highest leverage)
+
+1. **Add rules/common/security.md and rules/php/** (+12 pts)
+   Security rules are always-loaded context — they prevent the most expensive bugs.
+   Add 5 rule files: common/security.md, common/coding-style.md, common/git-workflow.md,
+   php/app-framework.md, php/underscore-framework.md.
+
+2. **Add PreToolUse hook for rm -rf / DROP TABLE** (+5 pts, prevents data loss)
+   Single hook entry in settings.json blocks the two most destructive accidental commands.
+   Run: add matcher `Bash` with command grep for `rm -rf` or `DROP TABLE`.
+
+3. **Add skills/php-patterns/SKILL.md** (+4 pts)
+   The team's most frequent task is PHP feature work. A patterns skill accelerates every session.
+```