0.9.2 — assess duplication + Cargo workspace parsing

Added: assess duplication signal (language-agnostic rolling-hash clone scan). Fixed: D5 — Cargo [workspace] members/exclude parsing. See CHANGELOG [0.9.2].

0.9.1 — MCP + SCIP conformance (portable scope)

Completes roadmap #6: MCP guidance (which server each critic needs; least-privilege + host-enforced consent; auto .mcp.json rejected as consent theater) + SCIP consume-if-present in blast-radius (shipping an indexer rejected → enterprise adapter). See CHANGELOG [0.9.1].

0.9.0 — agent-maintainability + AGENTS.md conformance

Agent-maintainability wave (shell detection, blast-radius, localize, repo-map, context discipline, assess) + vendor-neutral AGENTS.md conformance (ADR 0001). Fresh-install e2e + research-backed roadmap. Deferred (not stubbed): MCP + SCIP. See CHANGELOG [0.9.0].

Harness Kit 0.8.0

Fixed

• db-verify covered only the first detected data store. Detection is additive
  (a repo can report mongodb + postgres + redis), but the renderer used
  data_layer[0], silently dropping guidance for every other store. render.sh now
  emits per-store verification idioms for all detected stores (deduped, so a store
  detected twice is not repeated); single-store output is unchanged.
• The agentic-engine Claude Code hook adapters were broken two ways. (1)
  rag-feedback and intent-router imported the engine from $PROJECT_DIR, which does
  not exist when the kit is installed as a plugin in another repo — the same silent
  no-op fixed for verify-evidence in 761c26e; all three now resolve the module via
  CLAUDE_PLUGIN_ROOT and stand down when it is unset. (2) All three interpolated
  ${JSON.stringify(...)} into a double-quoted bun -e string, which bash parses as a
  fatal "bad substitution" that killed the hook under set -euo pipefail before it
  could run. Values now pass through the environment into a single-quoted bun script
  (engine path resolved by dynamic import), so the adapters run to completion.
• Spec/ADR/worktree slugs collapsed non-ASCII names to a generic fallback.
  tr -cd 'a-z0-9-' stripped Korean (and other non-ASCII) entirely, so 라이브 스케줄러
  became spec/decision/empty and collided across tasks. Slugification now runs in
  python3, preserving unicode word characters (a pure-underscore input still falls
  back).
• The protected-branch guard matched git commit/git push as bare substrings, so
  it fired on mentions like legit commit and git pushed. It now parses the command
  with shlex and fires only when git's actual subcommand is commit/push —
  ignoring look-alikes, quoted mentions (echo 'git commit'), and argument-position
  matches (git log --grep push, git stash push, git diff commit.txt), while still
  catching git-level-flag forms (git -c k=v commit, git -C dir push,
  git --no-pager commit).
• The OpenCode branch guard carried the identical substring bug.
  adapters/opencode/src/git.ts isGitMutation used cmd.includes("git commit"); it
  now uses the same subcommand-aware match as the CC guard.
• update-block.sh wrote CLAUDE.md non-atomically. An interruption mid-write
  could truncate the user's file. It now writes to a temp file in the same directory
  and os.replaces it into place (atomic on POSIX).

Added

• Regression tests for the fixes above: multi-store and duplicate-store db-verify
  (render_test.sh) and a non-ASCII slug (spec_test.sh). (The guard look-alike and
  isGitMutation classification cases live in the cross-runtime conformance matrix
  below — one shared table, not per-runtime duplicates.)
• Deterministic offline embedding provider (local, alias hash). Feature-hashing
  over unicode tokens — no API key, no network — selectable with
  HARNESS_EMBEDDING_PROVIDER=local. An opt-in, zero-dependency offline provider for
  rag-feedback / intent-router (not an automatic fallback — the default is still
  openai), it also makes their retrieval/routing pipeline self-testable in CI without
  a live model.
• CI now runs the engine and adapter test suites it previously skipped. The
  agentic-engine bun suites (rag-feedback, intent-router, verify-evidence),
  cross-vendor's shell test, and the OpenCode adapter tests + typecheck existed but CI
  ran only the top-level tests/*_test.sh. A Bun toolchain step plus a new integration
  test (tests/agentic_adapters_test.sh, skips where Bun is absent) exercise the three
  Claude Code hook adapters end-to-end with the deterministic local provider — the
  layer the bun unit suites (which cover src/ only) never touched.
• detect.sh surfaces a warnings[] channel. Partial/failed detection was silent
  (a set -u but not -e script fails soft to empty), so a malformed package.json,
  a monorepo whose member list hit the depth-3/20 cap, or a stackless repo produced a
  quietly degraded harness that looked fully detected. Those now emit a warning in the
  JSON summary and on stderr (surfaced by render.sh).
• The verify→feedback loop is now closed. verify-evidence has always written a
  .harness-kit/evidence.jsonl log of what critics proved/refuted, but nothing consumed
  it. rag-feedback now ingests that log as retrievable memory (alongside curated
  feedback/*.md), so past verification outcomes surface in future sessions. Decoupled —
  it reads the JSONL by its public shape, no import of the verify-evidence module; bounded
  to the 50 most recent entries; opt out with HARNESS_RAG_EVIDENCE_OFF=1. The CC
  rag adapter now also runs when only the evidence log exists (no curated feedback dir).
• Cross-runtime conformance matrix (tests/runtime_conformance_test.sh). The
  git-commit/push classification that gates the protected-branch guard is implemented
  separately per runtime (CC shell parser vs OpenCode isGitMutation), and drifted
  before — the CC guard was hardened while OpenCode kept a substring match. One shared
  case table is now asserted against every runtime's real implementation and fails on
  any disagreement (Codex is asserted as a deliberate no-guard non-participant). The
  previously duplicated per-runtime classification cases (in guard_test.sh and the
  OpenCode dogfood.test.ts) were folded into this single source of truth.
• Monorepo per-member harness generation (render.sh <target> --members). The root
  scan already NAMED a monorepo's members, but only the root stack was rendered — a
  polyglot repo left every sub-package without a tailored architect/critics. --members
  now renders each member's OWN <stack>-architect and conditional db-verify/ui-verify
  into its <member>/.claude/agents, driven by that member's own detection (one level
  deep, deterministic). The introspect skill invokes it for monorepos; a member's agents
  load when that member is opened as the working root (the norm for per-package work).

Documentation

• Corrected the harness-kit.json precedence claim: env override > file > default
  holds for protected_branches only. verify_command is read from the file alone —
  its sole env control is the HARNESS_VERIFY_OFF=1 off switch (no env override, no
  built-in default command).
• pickup now searches the active spec's context.md resume block before
  .claude/handoff.md (mirroring where handoff writes) and prefers the most
  recently modified when both exist; the spec context.md template gained the
  Don't redo: field that handoff already required.

v0.7.0 — Codex tracer + runtime-safe Stop feedback

Harness Kit 0.7.0 adds first-class Codex plugin packaging and a shared runtime-aware Stop verification loop.

Highlights:

• Codex marketplace/plugin manifest and Stop-only adapter
• one-shot Stop continuation with loop prevention
• repository-root resolution for sessions launched from monorepo subdirectories
• root-anchored verify commands for Claude Code and Codex
• model-free Codex installation smoke in CI

Verified by 192 contract tests, ShellCheck, strict Claude plugin validation, and the real Codex install smoke.

v0.6.1 — align plugin.json manifest with release tag

Version-manifest alignment. The v0.6.0 release tag was cut with .claude-plugin/plugin.json still reporting 0.5.2, so installers of harness-kit@0.6.0 saw a manifest that mis-reported its own version. This patch bumps the manifest to match the release and closes the drift.

Fixed

• plugin.json version bumped 0.5.2 → 0.6.1 to align the plugin manifest with the published release tag and CHANGELOG (the CI version-coherence gate now passes).

v0.6.0 — dual-runtime (OpenCode) + agentic engine

Dual-runtime support + agentic engine. The kit now works with both Claude Code and OpenCode — same skills, same discipline, your runtime. This release also adds the first four modules of the agentic engine layer.

OpenCode adapter (adapters/opencode/)

Plugin entry point with three hooks: verify-loop (feedback), branch-guard (protected branch), and compaction (resume). Config resolved from .opencode/harness-kit.json, falling back to .claude/harness-kit.json. 13 dogfood tests (mock shell, all pass).

Agentic engine (agentic-engine/)

Four modules, 83 tests total, all passing:

Module	What it does	Tests
cross-vendor	N-vendor parallel verification core (pure bash). Vendor registry pattern, 3-state exit, durable capture. CC Stop hook + OC adapter.	21
rag-feedback	Embedding-based retrieval of past feedback memory. 3 providers (OpenAI / Google / ollama). Cosine similarity, hash-based cache. CC adapter works fully; OC stubbed.	20
intent-router	Embedding-based SKILL.md classification. Reuses rag-feedback providers. CC adapter works fully; OC stubbed.	12
verify-evidence	JSONL evidence capture from critic agents. Regex parser, append-only store. CC + OC adapters.	17

Known limitations

• OC adapters for rag-feedback and intent-router are stubbed — experimental.chat.system.transform doesn't expose the user's latest message. Full OC adapters wait for a chat.prompt.before hook.
• OpenCode adapter tested with mock shell only; not yet dogfooded in a live OC session.

Full changelog: https://github.com/jhlee0409/claude-harness-kit/blob/main/CHANGELOG.md#060---2026-06-30

v0.5.2 — sanitize untrusted manifest content

Security hardening — the kit's job is scanning an untrusted target repo, so this closes the content-injection sibling of the RCE vector already fixed in v0.4.x.

Security

• Untrusted manifest content is now sanitized before it is embedded in a generated agent. A target repo's package.json name (or a Cargo.toml / pyproject.toml field, or a script command) previously flowed verbatim into the rendered <stack>-architect body — a crafted name like app](http://evil) **SYSTEM: …** landed as live markdown / a link / a prompt-injection string inside an agent definition a user later loads. render.sh now strips control chars + newlines (no multi-line / YAML-key breakout) and the markdown-structural chars (` []()<>{}|*#) from these untrusted scalars, and caps length. YAML frontmatter was already safe (the name key uses the fixed stack slug, never the untrusted string); this neutralizes the agent body too. languages / frameworks / store come from detect.sh's fixed vocabulary and were never a vector.

New render_test.sh case [12] proves the payload is neutralized and the frontmatter stays valid YAML. Full suite: 175 passed, 0 failed; shellcheck clean; claude plugin validate --strict passes.

Full changelog: https://github.com/jhlee0409/claude-harness-kit/blob/main/CHANGELOG.md

v0.5.1 — end-to-end gap-sweep fixes

Final end-to-end gap sweep — the install→introspect→render→hooks→workflow spine was
confirmed clean, but running the WHOLE kit once on ordinary input surfaced scaffolder
bugs. All fixed.

Fixed

• ADR / spec title with / or & crashed or corrupted the scaffolder.
  new-adr.sh / new-spec.sh filled the template with sed, so a perfectly ordinary
  title — CI/CD, A/B test, Q&A — hit sed: bad flag (crash + a 0-byte ADR
  occupying the number) or silently mangled the &. Now filled with python3
str.replace (metacharacter-safe). The most likely first-run failure, gone.
• new-adr.sh used ls | grep (SC2010, fragile on odd filenames) → replaced with a
  glob loop. CI shellcheck now covers ALL scripts (the scaffolders were unchecked)
  and is blocking (was || true).
• render.sh orphaned a stale <old-stack>-architect.md when the stack slug changed
  on re-run (e.g. typescript → node) — now reaped, like db-verify/ui-verify.
• detect.sh silently failed (empty stdout, exit 0) when python3 was missing — now
  emits {"error":"python3 not found"} and exits non-zero.
• README test-count claim made version-agnostic (was a stale "83").

Added

• tests/resume_loop_test.sh pins the handoff ↔ context.md ↔ pickup marker contract (a
  1-char drift in any of the three now fails CI instead of silently breaking resume).
• Regression tests for the metacharacter titles + the architect reap. → 172 tests.

v0.5.0 — user-diversity coverage (Ruby/JVM, greenfield, fallback)

User-diversity coverage — handle the tails of the real-user distribution
(greenfield / unknown stack / non-Node-Python) that the detector previously left
silently under-served.

Added

• Ruby + JVM detection — detect.sh now implements the Gemfile (Ruby: rspec /
  minitest, rails / sinatra, bundler) and pom.xml / build.gradle[.kts] (Java /
  Kotlin: Maven / Gradle test+build commands, name from <artifactId>) markers that
  SKILL §2 already promised — closing a doc-over-promise where a Ruby/JVM repo was
  silently treated as stackless. render.sh renders their architects unchanged (it's
  stack-agnostic). Added to the monorepo member markers too.
• Edge-of-distribution guidance (SKILL §3): a blank/greenfield repo (no
  manifest) now gets only the universal §0 discipline spine + a "re-run once you add a
  stack" note (no fabricated stack); a manifest detect.sh doesn't cover
  (composer.json / mix.exs / *.csproj / deno.json …) gets a documented LLM fallback —
  read the manifest, hand-write a basic architect from the template — so an uncovered
  stack degrades gracefully instead of getting nothing.
• README documents stack coverage + that the generated harness is English (no
  localization of rules/structure).
• +9 tests (→ 159): Ruby, JVM, blank-slate detection + blank-slate render.