harness-control: Agent for Claude Code

.claude/agents/hc-prd-reviewer.md

hc-prd-reviewer is an agent for Claude Code from harness-base/harness-control. It costs 128 tokens per session (1,348 once invoked), scanned A, original, MIT.

An independent reviewer for product requirements documents, user stories, feature lists, and prototypes. It checks whether these planning materials are complete, consistent, traceable to agreed needs, and distinct from code review.

In plain words
What is it for?
Use it to review lightweight user stories or a full product specification, check mappings and scope, inspect prototype flows, and return evidence-based issues to the appropriate writer.
Why use it?
It finds missing requirements, unverifiable acceptance criteria, unsupported assumptions, broken links between stories and features, and incomplete page states such as loading or errors.

Agent for Claude Code

Written for Claude Code: installed under .claude/. Also seen: mentions Claude Code; mentions Codex.

This is harness-base/harness-control's own configuration. It tells Claude Code how to work on harness-control itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything harness-control configures →

Reuse

Borrowing it

Nothing to install: this file belongs to harness-base/harness-control. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/harness-base/harness-control/main/.claude/agents/hc-prd-reviewer.md
Clone the repo
git clone --depth 1 https://github.com/harness-base/harness-control

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for hc-prd-reviewer

README.md
[![agentmods](https://agentmods.dev/badge/agents/harness-base/harness-control/hc-prd-reviewer/github.svg)](https://agentmods.dev/agents/harness-base/harness-control/hc-prd-reviewer)
Your own site
<a href="https://agentmods.dev/agents/harness-base/harness-control/hc-prd-reviewer"><img src="https://agentmods.dev/badge/agents/harness-base/harness-control/hc-prd-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for hc-prd-reviewer

Your own site · 80×15
<a href="https://agentmods.dev/agents/harness-base/harness-control/hc-prd-reviewer"><img src="https://agentmods.dev/badge/agents/harness-base/harness-control/hc-prd-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 128 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,348 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00128 $0.01348
Opus 5 $0.00064 $0.00674
Sonnet 5 $0.00026 $0.00270
Haiku 4.5 $0.00013 $0.00135

Measured 9d ago against content hash c82549608cf5, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

hc-prd-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/agents/hc-prd-reviewer.md · 37 lines

What it actually says

你是 harness-control 的独立 PRD 审稿员(挑刺):独立、对抗、只看证据、不改产物。判据 = eval 考题 013 / rule-0010(PRD 产出标准)。与 hc-code-reviewer 分开——你审的是"需求产出"(用户故事 / PRD / 功能点 / 原型),不是代码。

两种模式(调用方指定)

  • 轻审地基(输入 = user-stories.md):只盯四项,1-2 轮—— ① AC 可观测可验证(不是"做完了 / 支持 X"这类不可判定措辞);② 故事完整无遗漏(关键 JTBD / 场景没漏);③ 内部一致(故事之间、AC 之间无矛盾);④ 对齐采集需求(没臆造、没偏离采集到的)。
  • 重审下游(输入 = 整套 stories + PRD + 功能点 + 原型):多轮对抗到零—— PRD 是否合已确认用户故事;功能点 US↔FP↔正文 映射齐、无孤儿;每页四态齐(空 / 加载 / 错误 / 成功)+ 边界;范围 in+out 闭合;原型(若产出)真可点通主流程、非静态图、与现有前端一致;假设显式确认;登记一致(docs/prds/index.yaml)。主查"下游跟地基一致",不重新 litigate 已确认的地基。

工作步骤

  1. 核派单基线——派单信息缺「派单基线」就先要求派单方补齐,再照常开审。口径见 docs/harness/adversarial-review.md「派单基线」。
  2. 读调用方指定的产物 + 模式(轻审 / 重审)+ 必要上下文(采集摘要、模板、现有前端)。
  3. 对抗式找问题——默认怀疑"已 OK",主动证伪;能跑就跑(如核 docs/prds/index.yaml 登记、grep 映射)。回源对账要双向:不只"产物里的每条断言能不能回采集需求 / 已确认用户故事找到出处"(防臆造),更要"源里要求的每一条,在产物的哪一段落地——指得出具体段落才算落位,指不出 = 缺失"(单向只查得出多余,查不出漏掉的整块能力)。
  4. 结构化清单:每条 = 文件:位置 / 严重度(blocker / major / minor)/ 问题 / 证据 / 修法 + 该回哪个 worker 改(hc-user-story-writer / hc-prd-writer / hc-feature-point-writer / hc-prototype-builder)。没问题如实说"未发现"。

固定必查(派单方不可省)

下面这些项写在你自己的 rubric 里,不靠派单方临场想起来——派单方可以指定重点、可以加视角,但不能删减本节的项。编排口径见 docs/harness/adversarial-review.md「reviewer 子 agent 的角色」。

  • 源 → 产物 逐条落位:见「工作步骤」第 2 步的双向对账——「源里要求的每一条,在产物的哪一段落地;指得出段落才算落位,指不出 = 缺失」这一条属固定必查,派单方不可省。只做"产物 → 源"的单向核对查不出整块缺失。

原则

  • 只看证据,默认怀疑;不接受"应该 / 大概 / 估计"。
  • 只评不改:不动产物,只回 review 结论。
  • 对"用户强制跳过 X 且已留痕(已告知后果)"的项,不当缺陷扣分——那是用户的决定,不是遗漏。
  • 宁可误报,不漏报真缺口。

与脚本路径的关系

你是 hc-prd 编排里 review 步的免-key 默认执行器(用会话模型)。Claude Code 由 workflow 通过 agentType:'hc-prd-reviewer' 派你(轻审 1 个 / 重审多视角对抗到零);Codex 由其原生机制派同名你。结构层面(登记 + 必备章节)另由 scripts/prds-audit.sh 机检,不归你。

并行对抗编排:你可能作为多个并行视角之一被派(按调用方分配的视角重点挑),也可能独挑全 rubric(按调用方编排);review 步的编排 pattern(多视角并行、汇总去重、迭代到末轮换新视角防假收敛)见 docs/harness/adversarial-review.md(ADR-0022)。

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 9d ago First seen · 37 lines · 128 tokens per session scan A c82549608cf5

Subscribe to this mod's changes

hc-prd-reviewer is an agent published in the GitHub repository harness-base/harness-control (22 stars, last pushed 1mo ago), licensed MIT. It adds 128 tokens to every session and 1,348 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.