phrazzld/harness-engineering
skills/harness-engineering/SKILL.md
Harness engineering for Harness Kit primitives: skills, shared doctrine, provider roster, harness configs, gates, evals, bootstrap, and sync logic. Use for "improve the harness", "harness engineering", "bootstrap is wrong", "AGENTS.md is stale", "skill health", "eval skill", "sync primitives", "roster defaults". Trigger: /harness-engineering, /harness, /skill.
$ install --global
skillsauthnpx skillsauth add phrazzld/agent-skills harness-engineeringInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 5, 2026, 5:55 AM161.5s10 files scanned
SKILL.md
- name:
- harness-engineering
- description:
- |
- Harness engineering for Harness Kit primitives:
- skills, shared doctrine,
- "roster defaults". Trigger:
- /harness-engineering, /harness, /skill.
- argument-hint:
- [create|eval|lint|convert|sync|engineer|audit|models] [target]
/harness-engineering
Engineer the harness. Keep it thin.
Route
| Need | Load |
|---|---|
| create global skill/agent | references/mode-create.md |
| eval skill | references/mode-eval.md |
| lint skill | references/mode-lint.md |
| clean Codex skill catalog | external steipete-skill-cleaner |
| convert agent/skill | references/mode-convert.md |
| sync externals | references/mode-sync.md |
| engineer doctrine/gates/hooks | references/mode-engineer.md |
| audit catalog | references/mode-audit.md |
| open-model defaults | references/open-model-roster.md |
Use /create-repo-skill for generated repository-local skills such as bespoke
QA and persona acceptance probes. Use this skill when changing Harness Kit
itself. Use /skill-cleaner before catalog deletions, duplicate cleanup, or
description-budget work when the external steipete-skill-cleaner skill is
synced locally.
Contract
- Fix root cause in the highest-leverage layer: type/test/hook/gate/skill/ AGENTS, in that order.
- Prefer deletion. Harness prose is context tax.
- Cross-harness first: Claude, Codex, Pi. Filesystem +
SKILL.mdis primary. - Skills stay self-contained: scripts/references under the skill; state roots from invoking repo.
- Harness Kit source skills live in
skills/; repo-local.agents/skills/and harness-specific skill bridge dirs are/seedoutput for consumer repos. - Generated/root
AGENTS.mdis a router, not a manual. Keep non-obvious facts only. - System bootstrap exposes the full first-party skill catalog; repo-local vendoring is exceptional and must earn its complexity.
- Provider CLIs are tools. Do not wrap them in semantic orchestration unless a shaped ticket explicitly asks.
Delegation Floor
Delegation floor applies: probe the roster first; dispatch two or more
providers for substantive work; direct solo only for mechanical, emergency,
user-forbidden, or fewer-than-two-providers cases. See
harnesses/shared/AGENTS.md (Roster).
Local lane guidance: Use lanes for doctrine critique, runtime compatibility, gate design, and regression risk; native in-thread subagents may supplement but do not satisfy the roster floor. Do not treat a missing repo-local roster as a waiver; use the resolver-backed probe.
Quality Bar
SKILL.mdencodes judgment, not a procedure the model already knows.- Instruction prose is compression, not literature. Sacrifice grammar before clarity; keep terse imperatives, named failure modes, and concrete oracles.
- Put long mode detail in
references/; keep the entry file short. - Ad-hoc roster lanes beat static project subagents unless tool permissions must be isolated.
- New mechanisms include a gate, eval, or smoke path.
- Every run ends clean: no untracked or modified files.
Post-Sync Acceptance
After changing skills, shared doctrine, generated docs, bootstrap, roster, or harness projections, prove the output is repo-fit, not merely structurally valid.
## Acceptance Evidence
- Live repo evidence read: source skill, shared doctrine, generated docs, bootstrap output, roster, or harness projection inspected.
- Acceptance source: backlog oracle, skill contract, generated index/docs contract, bootstrap contract, or explicit absence.
- Evidence that proves it: command output, diff, generated artifact, bootstrap transcript, eval result, or Dagger output.
- Exact command/path/route exercised: check, generator, bootstrap, smoke path, projection path, or route run.
- Oracle / acceptance artifact hash: sha256 digest for any fixture, generated artifact, transcript, or contract used as the oracle, or state that no artifact-backed oracle exists.
- Contract-change acknowledgment: reason when the change alters an acceptance contract, generated source, or assertion surface, or state that no contract changed.
- Repo-fit check: source/generator/projection agree; no stale generated docs, wrong skill root, stale command, or copied bridge remains.
- Structural gate: frontmatter, roster, evidence-block, docs, index, eval, or Dagger gate result.
- Residual risk: skipped harness, external dependency, or none with reason.
Gotchas
- Stale AGENTS prose is worse than missing prose.
- Duplicated repo-local skill copies are usually stale context unless a repo needs checked-in vendored harness state.
- Regexes over agent prose are usually the wrong boundary.
- If a rule matters, enforce it outside prose.
Related Skills
phrazzld/debrief
development
VerifiedTrustedCommunity
Lightweight evidence-backed retro and catch-up reports for a current repo, branch, PR, backlog slice, or recent agent session. Use when the user asks for a debrief, catch me up, what changed, why it matters, product implications, end-user implications, developer experience implications, current app state, backlog state, workspace state, alternatives considered, or context rebuild after losing the thread. Trigger: /debrief.
13SKILL.mdUpdated Jun 5, 2026
phrazzld/trace
testing
VerifiedTrustedCommunity
Capture agent-session work records as local JSONL audit evidence. Links a backlog/spec, branch, commits, review verdicts, QA/demo evidence, transcript refs, and shipped ref without storing raw private transcripts. Use when: "trace this work", "write work record", "agent session trace", "journal this delivery", "link transcript evidence". Trigger: /trace, /journal.
13SKILL.mdUpdated Jun 4, 2026
phrazzld/skillify
data-ai
VerifiedTrustedCommunity
Turn proven agent-session patterns into first-party Harness Kit skills. Use when: "skillify this conversation", "make this into a skill", "generate a skill from current transcript", "extract reusable workflow". Trigger: /skillify.
13SKILL.mdUpdated Jun 4, 2026
phrazzld/critique
testing
VerifiedTrustedCommunity
Run one targeted, read-only architecture or quality critique through a named lens from the shared rubric. Use when: "critique this module", "run an Ousterhout pass", "lens critique", "architecture critique". Trigger: /critique.
13SKILL.mdUpdated Jun 4, 2026