zob-harness 0.1.0

package/.pi/factories/opencode-pattern-canonizer/factory.json

@@ -0,0 +1,86 @@
+{
+  "name": "opencode-pattern-canonizer",
+  "version": "0.2.0",
+  "description": "Convert OpenCode/meta-analysis batches into canonical workflow pattern, risk, instruction, and quality-gate artifacts.",
+  "defaultMode": "smoke",
+  "requiredStages": [
+    "manifest_loaded",
+    "agentic_plan_written",
+    "item_processed",
+    "patterns_canonicalized",
+    "risks_canonicalized",
+    "quality_gates_written",
+    "validation",
+    "sentinel"
+  ],
+  "expectedArtifacts": [
+    "patterns.canonical.json",
+    "risks.canonical.json",
+    "workflow-rules.md",
+    "agent-instructions.md",
+    "quality-gates.json",
+    "dashboard-summary.md"
+  ],
+  "stages": [
+    {
+      "name": "map-extract-patterns",
+      "type": "map",
+      "agent": "explore",
+      "outputContract": "explore.v1",
+      "requiredTools": ["read", "grep", "find", "ls"],
+      "expectedOutcome": "Extract workflow patterns, anti-patterns, evidence, and gaps from one input item.",
+      "promptTemplate": "Analyze factory item {item.id} at {item.path} for canonical ZOB workflow patterns. Return literal_request, actual_need, success_looks_like, files, answer, gaps, next_steps, evidence, risks/blockers, compliance, and deliverable_delivered.",
+      "mustDo": [
+        "Read the item path before conclusions.",
+        "Map freeform observations to canonical pattern/risk ids when possible.",
+        "Cite concrete evidence from the file."
+      ],
+      "mustNotDo": [
+        "No edits.",
+        "No secrets.",
+        "No broad commands."
+      ],
+      "context": "Factory {factory.name} run {run.id}; map stage for {item.id} at {item.path}. Outputs directory: {outputs.dir}."
+    },
+    {
+      "name": "reduce-synthesize-taxonomy",
+      "type": "reduce",
+      "agent": "synthesis",
+      "outputContract": "synthesis.v1",
+      "requiredTools": ["read", "grep", "find", "ls"],
+      "expectedOutcome": "Merge mapped item outputs into consensus taxonomy, conflicts, missing evidence, and rerun tasks.",
+      "promptTemplate": "Synthesize map outputs for factory {factory.name} run {run.id}. Read outputs from {outputs.dir}. Produce consensus, conflicts, missing_evidence, recommended_next_action, tasks_to_rerun, evidence, risks/blockers, compliance, and deliverable_delivered.",
+      "mustDo": [
+        "Separate consensus from conflicts.",
+        "Identify missing evidence and rerun tasks.",
+        "Preserve canonical pattern/risk ids."
+      ],
+      "mustNotDo": [
+        "No edits outside the run directory.",
+        "No invented evidence.",
+        "No secrets."
+      ],
+      "context": "Factory {factory.name} reduce stage for run {run.id}."
+    },
+    {
+      "name": "validate-no-ship",
+      "type": "validate",
+      "agent": "oracle-merge",
+      "outputContract": "oracle-merge.v1",
+      "requiredTools": ["read", "grep", "find", "ls"],
+      "expectedOutcome": "Validate factory outputs and produce global PASS/FAIL/WARN with no_ship decision.",
+      "promptTemplate": "Validate factory {factory.name} run {run.id}. Check manifest, outputs, checkpoints, validation.json, final-report.md, and DONE.sentinel under {run.dir}. Return verdict, confidence, no_ship, blockers, notes, evidence, merged_lanes, risks/blockers, compliance, and deliverable_delivered.",
+      "mustDo": [
+        "Fail if sentinel or validation evidence is missing.",
+        "Warn if evidence is incomplete.",
+        "Cite exact artifact paths."
+      ],
+      "mustNotDo": [
+        "No patches.",
+        "No commits.",
+        "No secrets."
+      ],
+      "context": "Factory {factory.name} validation stage for run {run.id}."
+    }
+  ]
+}

package/.pi/factories/opencode-pattern-canonizer/pilot-manifest.json

@@ -0,0 +1,39 @@
+{
+  "factory": "opencode-pattern-canonizer",
+  "description": "Pilot manifest for deterministic factory_run validation across multiple safe local documentation inputs. Cap remains max 10 items in mode=pilot.",
+  "items": [
+    {
+      "id": "harness-plan-pilot",
+      "path": "docs/AGENTIC_HARNESS_IMPLEMENTATION_PLAN.md",
+      "metadata": { "source": "local-doc", "pilot": true }
+    },
+    {
+      "id": "operating-model-pilot",
+      "path": "docs/OPERATING_MODEL.md",
+      "metadata": { "source": "local-doc", "pilot": true }
+    },
+    {
+      "id": "roadmap-pilot",
+      "path": "docs/ROADMAP.md",
+      "metadata": { "source": "local-doc", "pilot": true }
+    },
+    {
+      "id": "roadmap-lots-pilot",
+      "path": "docs/ROADMAP_FACTORY_LOTS.md",
+      "metadata": { "source": "local-doc", "pilot": true }
+    },
+    {
+      "id": "architecture-pilot",
+      "path": "docs/ARCHITECTURE.md",
+      "metadata": { "source": "local-doc", "pilot": true }
+    }
+  ],
+  "expectedArtifacts": [
+    "patterns.canonical.json",
+    "risks.canonical.json",
+    "workflow-rules.md",
+    "agent-instructions.md",
+    "quality-gates.json",
+    "dashboard-summary.md"
+  ]
+}

package/.pi/factories/opencode-pattern-canonizer/smoke-manifest.json

@@ -0,0 +1,26 @@
+{
+  "factory": "opencode-pattern-canonizer",
+  "description": "Smoke manifest for deterministic factory_run validation using the local harness plan as a safe input artifact.",
+  "items": [
+    {
+      "id": "harness-plan-smoke",
+      "path": "docs/AGENTIC_HARNESS_IMPLEMENTATION_PLAN.md",
+      "metadata": {
+        "source": "local-doc",
+        "expected_signals": [
+          "delegation.contract.structured",
+          "verification.evidence_required",
+          "factory.workflow.manifest_checkpoint"
+        ]
+      }
+    }
+  ],
+  "expectedArtifacts": [
+    "patterns.canonical.json",
+    "risks.canonical.json",
+    "workflow-rules.md",
+    "agent-instructions.md",
+    "quality-gates.json",
+    "dashboard-summary.md"
+  ]
+}

package/.pi/factories/project-dna/README.md

@@ -0,0 +1,182 @@
+# ProjectDNA Factory
+
+Status: **P0 scaffold**.
+
+This factory implements the first safe surface for ProjectDNA: a code-first reference-project workflow that can be planned and validated before any real project scan, sample generation, or external knowledge-backend write. It is agents-first: agents own scope, capture goals, safety gates, validation, oracle, and promotion posture; deterministic scripts are tools that produce cited evidence.
+
+## What this factory does now
+
+- Registers a `project-dna` factory under `.pi/factories/project-dna/`.
+- Defines map/reduce/validate stages for ProjectDNA planning and oracle review.
+- Provides smoke/pilot/batch manifests that use repo-local docs/skill/prompt/factory artifacts as safe inputs.
+- Produces factory-run evidence through the existing `factory_run` tool.
+- Keeps promotion and writeback proposal-only.
+- Frames npm scripts as deterministic tools used by agents, not as the primary control plane.
+- Captures operator intent through `capture_mode`, `capture_goal`, and optional `user_note` metadata without treating notes as evidence.
+
+## What this factory does not do yet
+
+- It does not scan arbitrary external projects by default.
+- It does not read `.env`, keys, credentials, generated/vendor folders, or private raw data.
+- It does not generate a sample project outside quarantine/sandbox.
+- It does not import/sync/embed/write into external knowledge backend.
+- It does not claim ProjectDNA retrieval is production-ready.
+
+## Safe smoke command
+
+Use the harness tool or equivalent:
+
+```text
+factory_run(
+  factory="project-dna",
+  input_manifest=".pi/factories/project-dna/smoke-manifest.json",
+  mode="smoke",
+  execution="deterministic"
+)
+```
+
+Local scaffold validator:
+
+```bash
+npm run validate:project-dna
+```
+
+Metadata-only compute profile preview for the safe ProjectDNA smoke target:
+
+```bash
+npm run preview:compute-profile:project-dna-smoke
+npm run validate:compute-profile:project-dna-smoke
+npm run plan:compute-workflow:project-dna-smoke
+npm run validate:compute-workflow:project-dna-smoke
+npm run validate:compute-profile-policy
+npm run smoke:compute-profile-regression
+npm run snapshot:compute-profile:project-dna-smoke
+```
+
+These write `compute-preview.json`, `compute-profile-resolution.json`, and `compute-workflow-shape.json` under `reports/project-dna-scans/project-dna-factory-smoke/`; they do not dispatch children, read secrets, use network, modify source projects, or write to an external knowledge backend.
+
+Read-only scanner smoke against this factory scaffold:
+
+```bash
+npm run smoke:project-dna-scan
+```
+
+Equivalent manifest-driven scanner example:
+
+```bash
+node scripts/project-dna/scan.mjs \
+  --manifest .pi/factories/project-dna/example-project-dna-manifest.json \
+  --out-dir reports/project-dna-scans/project-dna-manifest-smoke
+```
+
+These write only metadata artifacts under `reports/project-dna-scans/` and do not touch any external project or external knowledge backend corpus.
+
+Validate scanner artifacts, source/read-only posture, and citation line ranges:
+
+```bash
+npm run validate:project-dna-scan:smoke
+```
+
+Build pointer capsules from the scanner smoke metadata:
+
+```bash
+npm run build:project-dna-capsules:smoke
+```
+
+This reads scan artifacts only and writes capsules under `reports/project-dna-scans/project-dna-factory-smoke/capsules/`.
+
+Build a neutral sample-project spec, without generating code:
+
+```bash
+npm run build:project-dna-sample-spec:smoke
+```
+
+This writes `reports/project-dna-scans/project-dna-factory-smoke/sample-spec.json` with `generation_status=spec_only_no_code_generated`.
+
+Generate and validate a dependency-free neutral sample project in quarantine:
+
+```bash
+npm run generate:project-dna-sample:smoke
+npm run validate:project-dna-sample:smoke
+```
+
+This writes only under `reports/project-dna-scans/project-dna-factory-smoke/quarantine/sample-project/`; the validator runs local `node --check` and a dependency-free sample test.
+
+Query ProjectDNA scan metadata for a bounded cited context pack:
+
+```bash
+npm run query:project-dna:smoke
+```
+
+This writes `reports/project-dna-scans/project-dna-factory-smoke/query-result-smoke.json`; raw query text is hashed and not persisted.
+
+Run 5/5 agents-first ontology, Query Steward, golden benchmark, and structural oracle smoke gates:
+
+```bash
+npm run emit:project-dna-ontology:smoke
+npm run validate:project-dna-ontology:smoke
+npm run emit:project-dna-golden-cases:smoke
+npm run validate:project-dna-golden-cases:smoke
+npm run steward:project-dna-query:smoke
+npm run bench:project-dna:smoke
+npm run oracle:project-dna:smoke
+npm run validate:project-dna-5of5:smoke
+```
+
+These write ontology/golden/query-steward/benchmark/oracle artifacts under `reports/project-dna-scans/project-dna-factory-smoke/`; the oracle review covers scaffold readiness only and keeps durable promotion disabled until human approval. Query Steward hashes the raw query and persists controlled intent metadata only.
+
+## Capture and compute profile gates
+
+ProjectDNA manifests may include optional `capture_mode`, `semantic_capture_mode`, `capture_goal`, `user_note`, `compute_profile`, and `compute_caps` fields.
+
+Capture posture:
+
+```text
+plan_only                        → plan/manifest from approved inputs; no source scan
+read_only_scan                   → scan only explicit allowed_paths; source remains read-only
+sandbox_sample_generation         → write only under approved quarantine/sandbox outputs
+runtime_query_existing_artifacts  → query existing scan artifacts only; no new external scan
+```
+
+Semantic capture posture:
+
+```text
+full_capture      → small/medium repo reusable across major domains
+architecture_only → large repo or architecture/scaffold-only user note
+targeted_capture  → named domains/features from capture_goal or user_note
+sample_first      → prioritize neutral sample design from cited architecture facts
+context_only      → return bounded cited context packs; no sample generation
+```
+
+`capture_goal` bounds the pattern/question being captured. `user_note` records operator intent or constraints, but it is not source evidence and must not replace citations. For very large repos, default semantic posture should be `architecture_only` or `targeted_capture` unless the user approves deeper compute.
+
+Profile stage mapping is:
+
+```text
+auto   → metadata-only preview/resolve, then apply the resolved low/medium/high/xhigh/max row
+low    → scan + scan validation
+medium → scan + validation + capsules + sample spec + one query
+high   → medium + quarantine sample + sample validation + benchmark + oracle
+xhigh  → high + specialist lanes + richer query suite + adversarial review
+max    → xhigh + approval-gated multi-reference/symbol/callgraph/promotion packet work
+```
+
+Profile selection never bypasses secrets, sandbox, oracle, budget, quarantine/proposal-only output policy, external backend-write restrictions, or parent-owned dispatch gates.
+
+## Promotion gates
+
+Do not promote ProjectDNA artifacts to durable knowledge/sample locations unless all are true:
+
+1. Scanner/sample implementation exists and ran in a sandbox/quarantine.
+2. Validation commands passed.
+3. Secret/leakage checks passed.
+4. Citations and line ranges are valid.
+5. Oracle returned `PASS` with `no_ship=false`.
+6. Human approval is present for any durable writeback/promotion.
+
+## Related files
+
+- Plan: `docs/ZOB_PROJECT_DNA_CODE_KNOWLEDGE_GRAPH_PLAN.md`
+- Skill: `.pi/skills/zob-project-dna/SKILL.md`
+- Prompt: `.pi/prompts/project-dna.md`
+- Schemas: `.pi/factories/project-dna/schemas/`

package/.pi/factories/project-dna/batch-manifest.json

@@ -0,0 +1,37 @@
+{
+  "factory": "project-dna",
+  "description": "Batch manifest template for ProjectDNA. Keep plan_only until scanner/sample-generation implementation has smoke and pilot evidence.",
+  "items": [
+    {
+      "id": "project-dna-plan",
+      "path": "docs/ZOB_PROJECT_DNA_CODE_KNOWLEDGE_GRAPH_PLAN.md",
+      "metadata": { "source": "local-plan-doc" }
+    },
+    {
+      "id": "project-dna-skill",
+      "path": ".pi/skills/zob-project-dna/SKILL.md",
+      "metadata": { "source": "skill" }
+    },
+    {
+      "id": "project-dna-prompt",
+      "path": ".pi/prompts/project-dna.md",
+      "metadata": { "source": "prompt-template" }
+    },
+    {
+      "id": "project-dna-factory",
+      "path": ".pi/factories/project-dna/factory.json",
+      "metadata": { "source": "factory-definition" }
+    },
+    {
+      "id": "project-dna-readme",
+      "path": ".pi/factories/project-dna/README.md",
+      "metadata": { "source": "factory-readme" }
+    }
+  ],
+  "expectedArtifacts": [
+    "project-dna-summary.json",
+    "project-dna-context-pack.json",
+    "project-dna-readiness.json",
+    "project-dna-capsules.md"
+  ]
+}

package/.pi/factories/project-dna/example-project-dna-manifest-v2.json

@@ -0,0 +1,80 @@
+{
+  "schema": "zob.project-dna-manifest.v2",
+  "run_id": "project-dna-factory-smoke",
+  "user_note": "Metadata-only high-profile 5/5 agentic smoke plan for the repo-local ProjectDNA factory scaffold.",
+  "capture_goal": {
+    "source_id": "project-dna-factory",
+    "objective": "Plan a safe ProjectDNA capture workflow for the factory scaffold without dispatching child agents or mutating source files.",
+    "bounded_context_only": true,
+    "citation_required": true,
+    "allowed_artifact_level": "metadata_only"
+  },
+  "requested_compute_profile": "high",
+  "compute_caps": {
+    "maxAgents": 12,
+    "maxDelegationDepth": 1,
+    "maxParallel": 2,
+    "maxIterations": 2,
+    "maxDurationMs": 300000,
+    "maxContextTokens": 8000,
+    "strictBudgetRequired": true,
+    "oracleRequired": true
+  },
+  "capture_mode_policy": {
+    "mode": "metadata_workflow",
+    "semantic_mode": "architecture_only",
+    "targeted_domains": ["architecture", "config", "tests"],
+    "large_repo_fallback": "architecture_only",
+    "metadata_only": true,
+    "parent_owned_dispatch": true,
+    "child_direct_dispatch_allowed": false,
+    "network_access_allowed": false,
+    "source_mutation_allowed": false,
+    "knowledge_backend_write_allowed": false,
+    "durable_promotion_allowed": false
+  },
+  "source_project": {
+    "source_id": "project-dna-factory",
+    "path": ".pi/factories/project-dna",
+    "description": "Safe repo-local ProjectDNA factory scaffold used for smoke planning."
+  },
+  "read_policy": {
+    "allowed_paths": [".pi/factories/project-dna"],
+    "forbidden_patterns": [
+      ".env",
+      ".env.*",
+      "*.pem",
+      "*.key",
+      "*.p12",
+      "*.pfx",
+      "id_rsa",
+      "id_ed25519",
+      "secrets",
+      "credentials",
+      "node_modules",
+      "dist",
+      "build",
+      "coverage",
+      ".next",
+      ".nuxt",
+      "out",
+      ".git"
+    ],
+    "forbid_secret_like_paths": true,
+    "max_file_bytes": 262144,
+    "external_project_scan_allowed": false
+  },
+  "sample_project": {
+    "name": "project-dna-factory-sample-plan",
+    "neutral_domain": "factory-scaffold",
+    "generation_policy": "plan_only",
+    "copy_policy": "no_copy_plan_only",
+    "quarantine_required": true
+  },
+  "promotion": {
+    "writeback_policy": "proposal_only",
+    "requires_oracle_pass": true,
+    "requires_human_approval": true,
+    "durable_promotion_allowed": false
+  }
+}

package/.pi/factories/project-dna/example-project-dna-manifest.json

@@ -0,0 +1,58 @@
+{
+  "schema": "zob.project-dna-manifest.v1",
+  "run_id": "project-dna-factory-example",
+  "compute_profile": "auto",
+  "compute_caps": {
+    "maxAgents": 10,
+    "maxDelegationDepth": 2,
+    "maxParallel": 4,
+    "maxDurationMs": 600000,
+    "maxContextTokens": 12000,
+    "strictBudgetRequired": true,
+    "oracleRequired": true
+  },
+  "source_project": {
+    "source_id": "project-dna-factory",
+    "path": ".pi/factories/project-dna",
+    "owner": "zob-harness",
+    "description": "Safe repo-local ProjectDNA factory scaffold used as a scanner example."
+  },
+  "sample_project": {
+    "name": "project-dna-factory-sample-plan",
+    "neutral_domain": "factory-scaffold",
+    "target_stack_policy": "plan_only",
+    "copy_policy": "no_copy_plan_only"
+  },
+  "read_policy": {
+    "allowed_paths": [".pi/factories/project-dna"],
+    "forbidden_patterns": [
+      ".env",
+      ".env.*",
+      "*.pem",
+      "*.key",
+      "*.p12",
+      "*.pfx",
+      "id_rsa",
+      "id_ed25519",
+      "secrets",
+      "credentials",
+      "node_modules",
+      "dist",
+      "build",
+      "coverage",
+      ".next",
+      ".nuxt",
+      "out",
+      ".git"
+    ]
+  },
+  "validation": {
+    "commands": ["npm run validate:project-dna", "npm run smoke:project-dna-scan"],
+    "allow_command_substitution": false
+  },
+  "promotion": {
+    "requires_oracle_pass": true,
+    "requires_human_approval": true,
+    "writeback_policy": "proposal_only"
+  }
+}

package/.pi/factories/project-dna/factory.json

@@ -0,0 +1,131 @@
+{
+  "name": "project-dna",
+  "version": "0.1.0",
+  "description": "P0/P1 ProjectDNA agents-first workflow scaffold for code-first reference-project analysis, neutral sample planning, code knowledge graph capsules, bounded context-pack readiness, and 5/5 agentic golden-case evaluation. Deterministic scripts are tools for agents, not the primary control plane. The scaffold is safe by default: no source writes, no secrets, no external knowledge-backend import/sync/embed/write.",
+  "agenticModel": {
+    "controlPlane": "agents_first",
+    "scriptRole": "deterministic_tools_for_cited_evidence",
+    "defaultSafetyPosture": "read_only_source_quarantine_outputs_proposal_only_writeback",
+    "noAutonomousExternalProjectScanningByDefault": true,
+    "noBackendImportSyncEmbedWriteByDefault": true,
+    "fiveOfFiveRequires": [
+      "ontology_steward",
+      "query_steward",
+      "test_linker",
+      "golden_evaluator",
+      "oracle_pass_no_ship_false"
+    ]
+  },
+  "captureModes": {
+    "plan_only": "Plan or manifest from approved inputs; no source scan.",
+    "read_only_scan": "Scan only explicit allowed_paths while preserving read-only source posture.",
+    "sandbox_sample_generation": "Generate only under approved quarantine/sandbox outputs from existing facts/specs.",
+    "runtime_query_existing_artifacts": "Return bounded cited context from existing scan artifacts; no new external-project scan."
+  },
+  "captureInputs": {
+    "capture_goal": "Bounded pattern/question that drives scanner, capsule, and query priority.",
+    "user_note": "Optional operator intent or constraints; guidance only, never citation evidence."
+  },
+  "computeDepthPolicy": {
+    "auto": "Metadata-only preview/resolve, then apply the resolved low/medium/high/xhigh/max row.",
+    "low": "Scan + scan validation.",
+    "medium": "Scan + validation + capsules + sample spec + one bounded query.",
+    "high": "Medium + quarantine sample + sample validation + benchmark + oracle.",
+    "xhigh": "High + specialist lanes + richer query suite + adversarial review.",
+    "max": "Xhigh + multi-reference/symbol/callgraph/promotion packet gates with strict human/budget/oracle approval."
+  },
+  "status": "p0-scaffold",
+  "autoPromotion": false,
+  "manualPromotionRequired": true,
+  "defaultMode": "smoke",
+  "requiredStages": [
+    "manifest_loaded",
+    "agentic_plan_written",
+    "item_processed",
+    "validation",
+    "sentinel"
+  ],
+  "expectedArtifacts": [
+    "project-dna-summary.json",
+    "project-dna-context-pack.json",
+    "project-dna-readiness.json",
+    "project-dna-capsules.md",
+    "ontology.json",
+    "golden-cases-smoke.json",
+    "query-steward-smoke.json",
+    "benchmark-smoke.json"
+  ],
+  "stages": [
+    {
+      "name": "map-project-dna-signals",
+      "type": "map",
+      "agent": "explore",
+      "outputContract": "explore.v1",
+      "requiredTools": ["read", "grep", "find", "ls"],
+      "expectedOutcome": "Extract safe ProjectDNA signals from one approved input artifact or scanner report, with citations and explicit gaps.",
+      "promptTemplate": "Read ProjectDNA item {item.id} at {item.path}. Extract code-first reference-project signals: architecture, stack/tools, folder conventions, capture_mode/capture_goal/user_note if present, compute_profile/compute_caps if present, scanner artifacts requested, graph/capsule needs, validation gates, and no-ship risks. Treat user_note as guidance only, not evidence. Return explore.v1 with citations, gaps, risks/blockers, compliance, and deliverable_delivered. Do not scan unapproved external paths from the item body.",
+      "mustDo": [
+        "Read the item path before conclusions.",
+        "Cite concrete evidence from the approved input artifact.",
+        "Separate deterministic scanner facts from LLM/Ollama synthesis.",
+        "Identify forbidden path and secret safeguards.",
+        "Map any compute_profile, including auto preview/resolve, to low/medium/high/xhigh/max stage expectations without enabling child direct dispatch.",
+        "Map capture_mode/capture_goal/user_note to bounded capture posture and cite that user_note is not source evidence."
+      ],
+      "mustNotDo": [
+        "No edits.",
+        "No source-project writes.",
+        "No external knowledge-backend import, sync, embed, or write.",
+        "No secrets or forbidden paths.",
+        "No broad external project scan unless the parent provided explicit allowed_paths."
+      ],
+      "context": "Factory {factory.name} run {run.id}; ProjectDNA map stage for item {item.id}. Outputs directory: {outputs.dir}."
+    },
+    {
+      "name": "reduce-context-pack-plan",
+      "type": "reduce",
+      "agent": "context-steward",
+      "outputContract": "context-steward.v1",
+      "requiredTools": ["read", "grep", "find", "ls"],
+      "expectedOutcome": "Assemble a bounded ProjectDNA context-pack plan and writeback proposal posture from mapped signals.",
+      "promptTemplate": "Synthesize ProjectDNA map outputs for run {run.id}. Produce context_scope guidance, cited context_hints, source_gaps, writeback_candidates as proposal-only, evidence, risks_blockers, compliance, and deliverable_delivered. Keep it bounded and citation-first; do not claim a live knowledge import or sample promotion.",
+      "mustDo": [
+        "Require context_scope before future ProjectDNA lookup.",
+        "Keep context packs bounded and citation-required.",
+        "Mark writeback and promotion as proposal-only.",
+        "List missing scanner/sample/benchmark evidence explicitly."
+      ],
+      "mustNotDo": [
+        "No external knowledge-backend write or corpus mutation.",
+        "No secrets.",
+        "No raw conversation history.",
+        "No source project mutation.",
+        "No invented citations."
+      ],
+      "context": "Factory {factory.name} reduce stage for ProjectDNA run {run.id}."
+    },
+    {
+      "name": "validate-project-dna-gates",
+      "type": "validate",
+      "agent": "oracle-merge",
+      "outputContract": "oracle-merge.v1",
+      "requiredTools": ["read", "grep", "find", "ls"],
+      "expectedOutcome": "Validate ProjectDNA scaffold/run evidence, no-ship gates, sentinel posture, and proposal-only promotion.",
+      "promptTemplate": "Validate ProjectDNA run {run.id}. Check manifest, agentic-plan.json, outputs, validation.json, final-report.md, and sentinels under {run.dir}. Return oracle-merge.v1 sections: verdict, confidence, no_ship, blocking_issues, merged_lanes, evidence, risks/blockers, compliance, and deliverable_delivered. Fail if secrets, source writes, unapproved external knowledge-backend writes, invalid citations, missing validation, or premature promotion are observed.",
+      "mustDo": [
+        "Verify validation.json exists before accepting DONE.sentinel.",
+        "Verify promotion remains proposal-only unless explicit oracle/human gates exist.",
+        "Treat missing scanner/sample evidence as a gap, not as completed implementation.",
+        "Cite exact run-directory artifacts."
+      ],
+      "mustNotDo": [
+        "No patches.",
+        "No commits.",
+        "No secrets.",
+        "No external knowledge-backend import, sync, embed, or write.",
+        "No sample promotion."
+      ],
+      "context": "Factory {factory.name} validation stage for ProjectDNA run {run.id}."
+    }
+  ]
+}