What is project-contract-harness?

A persistent delivery framework for large or long-running software projects. It stores plans, tasks, decisions, risks, validation evidence, and handoff details in the project so another agent can continue later.

Analyzing a repository, defining project-specific checks, tracking work and risks, controlling secret access, recording evidence, and handing unfinished work to another agent.

It prevents important project context from living only in chat history and makes the delivery requirements easier to check.

project-contract-harness — Skill for Codex by cyberflax2020

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add cyberflax2020/project-contract-harness --skill project-contract-harness

Clone the repo

git clone --depth 1 https://github.com/cyberflax2020/project-contract-harness

Made for: Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/cyberflax2020/project-contract-harness/project-contract-harness/github.svg)](https://agentmods.dev/skills/cyberflax2020/project-contract-harness/project-contract-harness)

Your own site

<a href="https://agentmods.dev/skills/cyberflax2020/project-contract-harness/project-contract-harness"><img src="https://agentmods.dev/badge/skills/cyberflax2020/project-contract-harness/project-contract-harness/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/cyberflax2020/project-contract-harness/project-contract-harness"><img src="https://agentmods.dev/badge/skills/cyberflax2020/project-contract-harness/project-contract-harness.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 119 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,598 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin 100% copy Near-identical to another mod in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00119	$0.02598
Opus 5.5	$0.00048	$0.01039
Sonnet 5.5	$0.00024	$0.00520
Haiku 4.5	$0.00012	$0.00260

Measured 2mo ago against content hash a4da334b3e2f, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

project-contract-harness scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

The scan reads SKILL.md. This mod also ships 4 executable files (scripts/check_contract.py, scripts/init_contract.py, scripts/privacy_scan.py, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

This is a copy

100% identical to project-contract-harness — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

deploy/dsh-plugin/project-contract-harness/skills/project-contract-harness/SKILL.md · 163 lines

How it starts

The opening of the file, as written. The whole thing — 163 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Project Contract Harness

Overview

Use this skill to turn a broad engineering objective into a local, enforceable delivery contract. The contract persists the plan, tasks, decisions, risks, secret-access contract, resource guard, evaluation matrix, gaps, evidence, autonomy boundary, and handoff state on disk so a fresh agent can resume without relying on chat history.

This skill is intentionally product-agnostic. Do not copy customer names, private paths, internal service names, credentials, host details, or reference-project specifics into generated artifacts.

First Actions

Identify SKILL_ROOT as the directory containing this SKILL.md.
Identify REPO_ROOT as the target project root. If the user did not specify it, use the current working directory.
Probe for an existing REPO_ROOT/.project-contract-harness/. If it exists, recover from it first: read status, tasks, gaps, gates, evidence, tooling, secret access, artifact index, and handoff before proposing or editing.
Analyze the project before editing, even for a single module or small request: repo shape, existing docs, test framework, package/build commands, runtime constraints, active concurrent work, and user-visible success criteria.
If REPO_ROOT/.project-contract-harness/ does not exist, run:

python3 "$SKILL_ROOT/scripts/init_contract.py" --project-root "$REPO_ROOT"

If the directory exists but lacks current required files, run the initializer without --force to add missing files while preserving existing state.
Convert that analysis into the project harness: update STARTUP.md, CONTRACT.md, PLAN.md, TASKS.md, TOOLING.md, SECRET_ACCESS.md, ARTIFACTS.md, RESOURCE_GUARD.md, EVAL_MATRIX.md, and gates.json before broad code changes.
Read the existing contract files in this order: STARTUP.md, CONTRACT.md, PLAN.md, TASKS.md, STATUS.md, DECISIONS.md, RISKS.md, AUTONOMY.md, TOOLING.md, SECRET_ACCESS.md, ARTIFACTS.md, RESOURCE_GUARD.md, EVAL_MATRIX.md, GAPS.md, EVIDENCE.md, HANDOFF.md.
Check whether another active writer is working in the same repo. If there is a reasonable signal of active concurrent development, stay read-only or restrict edits to explicitly owned files.
Run the contract checker before major edits:

Read the full file on GitHub · 163 lines

Files

What ships with it

17 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2mo ago First seen · 163 lines · 119 tokens per session scan A a4da334b3e2f

Subscribe to this mod's changes

project-contract-harness is a skill published in the GitHub repository cyberflax2020/project-contract-harness (2 stars, last pushed 2mo ago), licensed Apache-2.0. It adds 119 tokens to every session and 2,598 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 100% identical to project-contract-harness, differing in 0 lines, and is treated as a copy.

Building agents Claude Code Planning agent-skills ai-agents ai-coding automation codex-cli

antigravity-cli

Delegate bounded investigation, review, or implementation tasks to Antigravity CLI from a supervising agent. Includes a background client for task progress, follow-up prompts, conversation recovery, cancellation, and visible failures.

scarletkc/agents · 45 tokens

devin-cli

Delegate bounded coding tasks to the local Devin CLI over ACP from a supervising agent such as Claude Code or Codex. Use when the user asks to hand work to Devin, when an independent implementation, port, review, or investigation can run in parallel with your own work, or when an earlier Devin session needs a…

scarletkc/agents · 91 tokens

grok-cli

Delegate bounded tasks to Grok Build from a supervising agent such as Codex. Use when the user asks Grok to investigate, review, implement, or provide another perspective, or when a distinct coding agent would materially help. Includes a background ACP client for progress, follow-up prompts, permissions, and…

scarletkc/agents · 66 tokens

ubiquitous-language

Maintain a project thesaurus (domain glossary) following DDD ubiquitous language principles. Use PROACTIVELY when naming anything: variables, functions, classes, modules, database fields, API endpoints, events, files, or directories. Also use when the user asks to "create thesaurus", "update glossary", "add term"…

CodeAlive-AI/ai-driven-development · 179 tokens

maintaining-macos-health

Hands-on playbook for macOS disk cleanup, dev-machine optimization, and proactive health alerting. Use when the Mac is full or slow, when a process persistently burns CPU, when a kernel panic / watchdog timeout / vm-compressor-space-shortage / Jetsam event happened, when the user asks to free disk space, audit…

CodeAlive-AI/ai-driven-development · 157 tokens

skills-management

Search, find, discover, install, remove, update, review, deduplicate, list, move, optimise, and iterate on skills for AI coding agents. Use when user asks "find a skill for X", "install skill", "remove skill", "update skills", "list skills", "deduplicate skills", "why are two skills shown", "choose the canonical…

CodeAlive-AI/ai-driven-development · 151 tokens