Harness Kit 0.8.0

Fixed

• db-verify covered only the first detected data store. Detection is additive
  (a repo can report mongodb + postgres + redis), but the renderer used
  data_layer[0], silently dropping guidance for every other store. render.sh now
  emits per-store verification idioms for all detected stores (deduped, so a store
  detected twice is not repeated); single-store output is unchanged.
• The agentic-engine Claude Code hook adapters were broken two ways. (1)
  rag-feedback and intent-router imported the engine from $PROJECT_DIR, which does
  not exist when the kit is installed as a plugin in another repo — the same silent
  no-op fixed for verify-evidence in 761c26e; all three now resolve the module via
  CLAUDE_PLUGIN_ROOT and stand down when it is unset. (2) All three interpolated
  ${JSON.stringify(...)} into a double-quoted bun -e string, which bash parses as a
  fatal "bad substitution" that killed the hook under set -euo pipefail before it
  could run. Values now pass through the environment into a single-quoted bun script
  (engine path resolved by dynamic import), so the adapters run to completion.
• Spec/ADR/worktree slugs collapsed non-ASCII names to a generic fallback.
  tr -cd 'a-z0-9-' stripped Korean (and other non-ASCII) entirely, so 라이브 스케줄러
  became spec/decision/empty and collided across tasks. Slugification now runs in
  python3, preserving unicode word characters (a pure-underscore input still falls
  back).
• The protected-branch guard matched git commit/git push as bare substrings, so
  it fired on mentions like legit commit and git pushed. It now parses the command
  with shlex and fires only when git's actual subcommand is commit/push —
  ignoring look-alikes, quoted mentions (echo 'git commit'), and argument-position
  matches (git log --grep push, git stash push, git diff commit.txt), while still
  catching git-level-flag forms (git -c k=v commit, git -C dir push,
  git --no-pager commit).
• The OpenCode branch guard carried the identical substring bug.
  adapters/opencode/src/git.ts isGitMutation used cmd.includes("git commit"); it
  now uses the same subcommand-aware match as the CC guard.
• update-block.sh wrote CLAUDE.md non-atomically. An interruption mid-write
  could truncate the user's file. It now writes to a temp file in the same directory
  and os.replaces it into place (atomic on POSIX).

Added

• Regression tests for the fixes above: multi-store and duplicate-store db-verify
  (render_test.sh) and a non-ASCII slug (spec_test.sh). (The guard look-alike and
  isGitMutation classification cases live in the cross-runtime conformance matrix
  below — one shared table, not per-runtime duplicates.)
• Deterministic offline embedding provider (local, alias hash). Feature-hashing
  over unicode tokens — no API key, no network — selectable with
  HARNESS_EMBEDDING_PROVIDER=local. An opt-in, zero-dependency offline provider for
  rag-feedback / intent-router (not an automatic fallback — the default is still
  openai), it also makes their retrieval/routing pipeline self-testable in CI without
  a live model.
• CI now runs the engine and adapter test suites it previously skipped. The
  agentic-engine bun suites (rag-feedback, intent-router, verify-evidence),
  cross-vendor's shell test, and the OpenCode adapter tests + typecheck existed but CI
  ran only the top-level tests/*_test.sh. A Bun toolchain step plus a new integration
  test (tests/agentic_adapters_test.sh, skips where Bun is absent) exercise the three
  Claude Code hook adapters end-to-end with the deterministic local provider — the
  layer the bun unit suites (which cover src/ only) never touched.
• detect.sh surfaces a warnings[] channel. Partial/failed detection was silent
  (a set -u but not -e script fails soft to empty), so a malformed package.json,
  a monorepo whose member list hit the depth-3/20 cap, or a stackless repo produced a
  quietly degraded harness that looked fully detected. Those now emit a warning in the
  JSON summary and on stderr (surfaced by render.sh).
• The verify→feedback loop is now closed. verify-evidence has always written a
  .harness-kit/evidence.jsonl log of what critics proved/refuted, but nothing consumed
  it. rag-feedback now ingests that log as retrievable memory (alongside curated
  feedback/*.md), so past verification outcomes surface in future sessions. Decoupled —
  it reads the JSONL by its public shape, no import of the verify-evidence module; bounded
  to the 50 most recent entries; opt out with HARNESS_RAG_EVIDENCE_OFF=1. The CC
  rag adapter now also runs when only the evidence log exists (no curated feedback dir).
• Cross-runtime conformance matrix (tests/runtime_conformance_test.sh). The
  git-commit/push classification that gates the protected-branch guard is implemented
  separately per runtime (CC shell parser vs OpenCode isGitMutation), and drifted
  before — the CC guard was hardened while OpenCode kept a substring match. One shared
  case table is now asserted against every runtime's real implementation and fails on
  any disagreement (Codex is asserted as a deliberate no-guard non-participant). The
  previously duplicated per-runtime classification cases (in guard_test.sh and the
  OpenCode dogfood.test.ts) were folded into this single source of truth.
• Monorepo per-member harness generation (render.sh <target> --members). The root
  scan already NAMED a monorepo's members, but only the root stack was rendered — a
  polyglot repo left every sub-package without a tailored architect/critics. --members
  now renders each member's OWN <stack>-architect and conditional db-verify/ui-verify
  into its <member>/.claude/agents, driven by that member's own detection (one level
  deep, deterministic). The introspect skill invokes it for monorepos; a member's agents
  load when that member is opened as the working root (the norm for per-package work).

Documentation

• Corrected the harness-kit.json precedence claim: env override > file > default
  holds for protected_branches only. verify_command is read from the file alone —
  its sole env control is the HARNESS_VERIFY_OFF=1 off switch (no env override, no
  built-in default command).
• pickup now searches the active spec's context.md resume block before
  .claude/handoff.md (mirroring where handoff writes) and prefers the most
  recently modified when both exist; the spec context.md template gained the
  Don't redo: field that handoff already required.