harness-eval

harness-eval is a command for Claude Code from hahaxiang27/FlowHarness. It costs 28 tokens per session (1,525 once invoked), scanned A, original, MIT.

A four-level verification command for completed software tasks. It checks whether the code builds, matches its documented contracts, works end to end, and follows the project's governing rules.

In plain words
What is it for?
Use it on a task, a range of tasks, or a recent batch to run selected checks such as tests, builds, linting, contract comparisons, data-model reviews, end-to-end tests, and a full Constitution review.
Why use it?
It catches different classes of problems: technical failures, mismatches with specifications, broken user workflows, and violations of project requirements.

Command for Claude Code

Written for Claude Code: $ARGUMENTS substitution.

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/hahaxiang27/flowharness/harness.eval
Clone the repo
git clone --depth 1 https://github.com/hahaxiang27/FlowHarness

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for harness-eval

README.md
[![agentmods](https://agentmods.dev/badge/commands/hahaxiang27/flowharness/harness.eval.svg)](https://agentmods.dev/commands/hahaxiang27/flowharness/harness.eval)
Your own site
<a href="https://agentmods.dev/commands/hahaxiang27/flowharness/harness.eval"><img src="https://agentmods.dev/badge/commands/hahaxiang27/flowharness/harness.eval.svg" alt="Measured on agentmods" height="20"></a>
Per session 28 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,525 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00028 $0.01525
Opus 5 $0.00014 $0.00763
Sonnet 5 $0.00006 $0.00305
Haiku 4.5 $0.00003 $0.00153

Measured 5d ago against content hash bc8058462eb6, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-06, from the pricing page.

Security

Grade A, and why

harness-eval scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

commands/harness.eval.md · 127 lines

How it starts

The opening of the file, as written. The whole thing — 127 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Harness 任务验证(Evaluator)

上下文管理: ✅ 保持当前上下文(紧跟 /harness.exec 之后执行)

指令

对已完成的任务执行质量验证。验证必须参照 .harness/prompts/evaluator.md 中的模板严格执行。

输入参数

$ARGUMENTS — 验证级别和范围,格式: {level} {任务ID或范围}

  • /harness.eval L2 T014 — 对任务 T014 执行 Level 2 契约验证
  • /harness.eval L4 — 执行 Constitution 全面合规审查
  • /harness.eval all — 执行全部四级验证(Sprint Checkpoint 时使用)
  • 不带参数 — 默认对最近完成的批次执行 L1 + L2(高风险任务自动加 L4)

验证级别

验证是分层递进的。每一层解决不同的问题:

Level 1 — CI 门禁(技术正确性)

回答问题:代码能不能跑?

Step 1: 单元测试 — [TEST_COMMAND](门禁,不通过则阻断)
Step 2: 构建/编译 — [BUILD_COMMAND]
Step 3: Lint — [LINT_COMMAND] 无 ERROR
Step 4: 应用启动+集成验证(批次完成时) — [APP_START_COMMAND] + [UI_START_COMMAND] + 真实接口调用链验证

⛔ L1 不通过 → 后续层级不执行,进入 Corrector。 ⚠️ Step 4 在每个批次完成后和 Sprint Checkpoint 时执行,不是每个任务都跑。

Level 2 — 契约与规格对照(功能正确性)

回答问题:代码做的对不对?

读取 .harness/prompts/evaluator.md Level 2 模板,对每个接口入口/数据模型任务执行:

  1. 读取 [API_CONTRACT_ROOT] → 逐项对照实际代码(路径、方法、字段、状态码)
  2. 读取 [DATA_MODEL_DOC] → 逐字段对照数据模型
  3. 读取 spec.md 验收场景 → 检查业务逻辑覆盖度
  4. 输出四维评分表(契约一致/模型一致/场景覆盖/代码质量,各10分,门槛32/40)
Level 3 — [E2E_TOOL] E2E(用户体验正确性)

回答问题:用户能不能用?

在用户故事完成后执行:

  1. 根据 spec.md 验收场景编写/运行 [E2E_TOOL] 测试
  2. 测试文件: [TEST_ROOT]/e2e/{story-name}[TEST_FILE_SUFFIX]
  3. 执行: [E2E_COMMAND]
  4. 重跑3次验证稳定性
Level 4 — Constitution 合规(架构正确性)

回答问题:有没有违反项目宪法?

读取 .harness/prompts/evaluator.md Level 4 模板,逐条检查:

原则 检查重点
I. 架构边界 服务端、用户界面和其他运行时边界符合 Constitution
II. 契约驱动 实现与项目接口契约一致,无未定义接口
III. 测试纪律 高风险业务逻辑具备要求的分支覆盖
IV. 外部服务抽象层 [EXTERNAL_SERVICE_NAME] 调用通过项目定义接口,Prompt/配置外置,有超时降级
V. 可观测性 结构化日志,外部服务调用有指标
VI. 简单优先 无不必要的抽象
VII. 安全合规 接口认证+权限控制,敏感操作审计日志

硬约束违反数必须为 0。

默认行为(不带参数)

不指定参数时,执行 L1 + L2,对高风险任务自动追加 L4

  1. L1 CI 门禁 → 全部测试/编译/Lint
  2. L2 契约对照 → 对所有含接口入口/数据模型的任务逐项检查
  3. L4 Constitution → 仅对高风险任务自动触发(认证、权限、高风险业务规则、外部服务、安全相关)

高风险判定规则:任务描述包含 认证、auth、安全、RBAC、权限、评分、scoring、等级变更、外部服务、[EXTERNAL_SERVICE_NAME]、接口入口 之一。 非高风险任务的 L4 审查延迟到 Sprint Checkpoint(/harness.checkpoint)批量执行。

Read the full file on GitHub · 127 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 5d ago First seen · 127 lines · 28 tokens per session scan A bc8058462eb6

Subscribe to this mod's changes

harness-eval is a command published in the GitHub repository hahaxiang27/FlowHarness (4 stars, last pushed 2mo ago), licensed MIT. It adds 28 tokens to every session and 1,525 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.