Borrowing it
Nothing to install: this file belongs to Ecro/harness-maker. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Ecro/harness-maker/main/CLAUDE.mdgit clone --depth 1 https://github.com/Ecro/harness-makerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/ecro/harness-maker/claude-md)<a href="https://agentmods.dev/instructions/ecro/harness-maker/claude-md"><img src="https://agentmods.dev/badge/instructions/ecro/harness-maker/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/ecro/harness-maker/claude-md"><img src="https://agentmods.dev/badge/instructions/ecro/harness-maker/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.07089 | $0.07089 |
| Opus 5.5 | $0.02836 | $0.02836 |
| Sonnet 5.5 | $0.01418 | $0.01418 |
| Haiku 4.5 | $0.00709 | $0.00709 |
Grade C, and why
harness-maker CLAUDE.md scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
- Main-session `settings.json` deny is opt-in (default OFF, `permissions.deny_dangerous`). `Write(<path>)` and `Bash(curl * | sh)` are dead syntax. `curl|sh` is caught by the `permission_gate` hook. Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- Main-session `settings.json` deny is opt-in (default OFF, `permissions.deny_dangerous`). `Write(<path>)` and `Bash(curl * | sh)` are dead syntax. `curl|sh` is caught by the `permission_gate` hook. How it starts
The opening of the file, as written. The whole thing — 308 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md — harness-maker
이 파일은 Claude / autoloop CODER agent 가 본 프로젝트에서 작업할 때 따라야 하는 규칙·관례 모음. 모든 결정은 사용자가 사전에 lock-in 했음. autoloop 빌드 중에는 AskUserQuestion 호출 금지 — 모호하면 본 문서 + TECH_SPEC.md 우선.
제1목표
harness-maker 의 제1목표는 기본 품질을 지키면서 빠르고 효율적인 워크플로를 만드는 것이며, 복잡한 설계를 지양하고 단순하고 효율적인 쪽을 택한다. HOW 는 AI 가 최대한 가져가되 WHY·WHAT·트레이드오프는 사람이 소유하고, 작업이 끝나면 코드와 함께 사람의 시스템 이해도 갱신되게 한다.
아래의 모든 원칙·게이트·에이전트는 이 목표에 종속된다. 어떤 장치가 품질을 지키는 것보다 워크플로를 느리고 복잡하게 만드는 데 더 기여한다면, 그 장치를 줄이거나 없애는 것이 옳은 방향이다.
대상은 1인 시니어 개발자다. 시니어에게 필요한 건 설명이 아니라 바뀐 가정과 위험을 드러내는 것이다. 그래서 학습·코칭 모드, 역량 평가, 팀 협업 기능은 만들지 않는다. 결정 주체 규칙과 지표는
.claude/intent.yaml에 있다.
LLM 활용 원칙 (최우선)
harness-maker 는 Claude Code + Codex 의 플러그인으로, LLM 판단력을 최대한 활용하여 품질을 극대화한다.
- 규칙 기반 대신 LLM 판단: 패턴 매칭·키워드 필터로 해결할 수 있는 것도, LLM 이 더 정확하게 판단할 수 있으면 LLM 에 위임
- 모호함 감지: 답변이 충분히 actionable 한지 판정은 LLM 이 직접 수행 (regex 로 vague 판정 금지)
- 질문 생성: 인터뷰 follow-up 질문은 LLM 이 컨텍스트를 읽고 동적으로 생성 (고정 스크립트 금지)
- 추출·요약: 소스 문서에서 목적·불변조건·우선순위 등을 뽑는 작업은 LLM 이 전체 문서를 읽고 추출
- 수렴 판단: stopping criteria 만족 여부는 LLM 이 현재 상태를 읽고 판단
템플릿(.j2)이 생성하는 슬래시 명령 안에서 Claude 가 직접 판단·추출·생성하도록 프롬프트를 설계할 것. Python 레이어는 타입 계약·저장·안전 레일만 담당.
프로젝트 정체성
- 이름: harness-maker (Claude Code + Codex 플러그인)
- 단일 메타 명령:
/harness-maker:make(audit/add/remove/promote 플래그) - 사용자 명령은
/hm:prefix — Claude Code 는/hm:<name>, Codex 는$hm-<name> - 언어: English-default (locale=en 디폴트). interview 첫 질문이 locale (free-text). 한국어 등 다른 locale 도 입력 가능, unknown locale 은 en 으로 silent fallback
- 타깃 IDE:
targets축으로 사용자가 명시 선택 (아래 §Targets 정책 참조)
Targets 정책
harness.yaml.targets: list[Target] — 사용자 하네스가 어느 IDE 에서 작동할지 결정하는 축. preset 과 직교.
- 값:
claude-code|codex(multi-select) - 인터뷰 정책: 명시 multi-select 강제. auto-detect 금지 (디렉토리 존재 여부 등으로 추론하지 않음). 사용자 의도 확인 필수.
- Default fallback: 옛 harness.yaml 에
targets키 없을 때만[claude-code]silent fallback + 경고 로그. 신규 인터뷰는 항상 명시 선택. - Cursor 제거 (0.63.0, SPEC-hm-overhaul-p1 IRR-001): harness.yaml 또는
--targets의cursor는make1회당 경고 1줄 후 제거 (빈 목록 →[claude-code]),agent_models.*.cursor는 경고 후 tier alias 일 때만 Claude 모델로 쓰임 (0.62 동작). 남은.cursor/파일은 pristine (manifest + 0.62 출하 entry 그대로) 일 때만 삭제, 그 외는 KEPT (cursor_retire).hook_host는 hook 별로 판단 — kept 파일이 그 모듈을 살아있는--with로 돌릴 때만 Claude 사본이 물러남. - Codex dual role (PLAN-codex-second-llm-integration ADR-009):
codex는 IDE asset 렌더링 (.codex/) 뿐 아니라 second-LLM provider 역할도 한다. 이 provider 축은harness.yaml.second_opinion(PLAN-second-opinion-multi-model 이 옛codex_second_opinion을 대체) 로 제어된다 —targets와 직교. 자세한 건 아래 Cross-model second opinion (multi-model).- Cross-model second opinion (multi-model) — full rules:
docs/reference/second-opinion.md. Load-bearing rules:harness.yaml.second_opinion.models(codex/antigravity, orthogonal totargets). Every CLI call goes throughharness_maker.second_opinion_invoke; never inline a raw CLI in a recipe (four silent-skip bugs shipped that way).- k-of-N consensus with K=2 fixed; PIDA acceptance gate plus a vote freeze (one model call per review in
/hm:execute); every failure mode is warn-and-proceed. - Never hand-compute ledger rates. Use
hm verifier_discrimination report --ledger .claude/observability/second-opinion.jsonl. It applies.ledger-exclusions.json; a hand count was 30× off. - A green
/hm:healthsmoke proves the base path only, not the worktree path.
- Cross-model second opinion (multi-model) — full rules:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago Changed · +9 lines · +137 tokens per session 728c14b2e52f
- 9d ago Changed · -26 lines · -817 tokens per session 7395d52a213a
- 11d ago Changed · +94 tokens per session e2e8e97dc8c9
- 22d ago Changed · +9 lines · +413 tokens per session 26902f317b71
- 26d ago Changed · -114 lines · -10,406 tokens per session 67df1f1f0c4d
- 28d ago Changed 222346436474
- 29d ago Changed · +2 lines · +122 tokens per session 5213d8b8139d
- 1mo ago Changed · +4 tokens per session c408a6daca0f
- 1mo ago Changed · +1 lines · +137 tokens per session f74255dbc0a0
- 1mo ago First seen · 427 lines · 17,405 tokens per session scan C 9766c6e69524
harness-maker CLAUDE.md is an instructions file published in the GitHub repository Ecro/harness-maker (4 stars, last pushed 5d ago), licensed MIT. It adds 7,089 tokens to every session, about $0.0284 per session on Opus 5.5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode copilot-instructions.md
Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).
deno copilot-instructions.md
Copilot instructions for denoland/deno, covering deno development guide for github copilot, network access, high level overview, key directories and key files to understand first.