What is project-contract-harness?

A persistent delivery framework for large or long-running software projects. It stores plans, tasks, decisions, risks, validation evidence, and handoff details in the project so another agent can continue later.

Analyzing a repository, defining project-specific checks, tracking work and risks, controlling secret access, recording evidence, and handing unfinished work to another agent.

It prevents important project context from living only in chat history and makes the delivery requirements easier to check.

project-contract-harness — Skill for Codex by cyberflax2020

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add cyberflax2020/project-contract-harness --skill project-contract-harness

Clone the repo

git clone --depth 1 https://github.com/cyberflax2020/project-contract-harness

Made for: Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/cyberflax2020/project-contract-harness/project-contract-harness/github.svg)](https://agentmods.dev/skills/cyberflax2020/project-contract-harness/project-contract-harness)

Your own site

<a href="https://agentmods.dev/skills/cyberflax2020/project-contract-harness/project-contract-harness"><img src="https://agentmods.dev/badge/skills/cyberflax2020/project-contract-harness/project-contract-harness/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/cyberflax2020/project-contract-harness/project-contract-harness"><img src="https://agentmods.dev/badge/skills/cyberflax2020/project-contract-harness/project-contract-harness.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 119 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,598 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin 100% copy Near-identical to another mod in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00119	$0.02598
Opus 5	$0.00060	$0.01299
Sonnet 5	$0.00024	$0.00520
Haiku 4.5	$0.00012	$0.00260

Measured 12d ago against content hash a4da334b3e2f, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade A, and why

project-contract-harness scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.

The scan reads SKILL.md. This mod also ships 4 executable files (scripts/check_contract.py, scripts/init_contract.py, scripts/privacy_scan.py, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

This is a copy

100% identical to project-contract-harness — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

deploy/dsh-plugin/project-contract-harness/skills/project-contract-harness/SKILL.md · 163 lines

How it starts

The opening of the file, as written. The whole thing — 163 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Project Contract Harness

Overview

Use this skill to turn a broad engineering objective into a local, enforceable delivery contract. The contract persists the plan, tasks, decisions, risks, secret-access contract, resource guard, evaluation matrix, gaps, evidence, autonomy boundary, and handoff state on disk so a fresh agent can resume without relying on chat history.

This skill is intentionally product-agnostic. Do not copy customer names, private paths, internal service names, credentials, host details, or reference-project specifics into generated artifacts.

First Actions

Identify SKILL_ROOT as the directory containing this SKILL.md.
Identify REPO_ROOT as the target project root. If the user did not specify it, use the current working directory.
Probe for an existing REPO_ROOT/.project-contract-harness/. If it exists, recover from it first: read status, tasks, gaps, gates, evidence, tooling, secret access, artifact index, and handoff before proposing or editing.
Analyze the project before editing, even for a single module or small request: repo shape, existing docs, test framework, package/build commands, runtime constraints, active concurrent work, and user-visible success criteria.
If REPO_ROOT/.project-contract-harness/ does not exist, run:

python3 "$SKILL_ROOT/scripts/init_contract.py" --project-root "$REPO_ROOT"

If the directory exists but lacks current required files, run the initializer without --force to add missing files while preserving existing state.
Convert that analysis into the project harness: update STARTUP.md, CONTRACT.md, PLAN.md, TASKS.md, TOOLING.md, SECRET_ACCESS.md, ARTIFACTS.md, RESOURCE_GUARD.md, EVAL_MATRIX.md, and gates.json before broad code changes.
Read the existing contract files in this order: STARTUP.md, CONTRACT.md, PLAN.md, TASKS.md, STATUS.md, DECISIONS.md, RISKS.md, AUTONOMY.md, TOOLING.md, SECRET_ACCESS.md, ARTIFACTS.md, RESOURCE_GUARD.md, EVAL_MATRIX.md, GAPS.md, EVIDENCE.md, HANDOFF.md.
Check whether another active writer is working in the same repo. If there is a reasonable signal of active concurrent development, stay read-only or restrict edits to explicitly owned files.
Run the contract checker before major edits:

Read the full file on GitHub · 163 lines

Files

What ships with it

17 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

12d ago First seen · 163 lines · 119 tokens per session scan A a4da334b3e2f

Subscribe to this mod's changes

project-contract-harness is a skill published in the GitHub repository cyberflax2020/project-contract-harness (2 stars, last pushed 21d ago), licensed Apache-2.0. It adds 119 tokens to every session and 2,598 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. It is 100% identical to project-contract-harness, differing in 0 lines, and is treated as a copy.

Building agents Claude Code Planning agent-skills ai-agents ai-coding automation codex-cli

swarm-pr-review

Run a graph-guided, tool-augmented PR review using context packing, parallel exploration, mandatory repository-agnostic risk-family coverage with dispatch scaled to diff size and risk, independent reviewer validation, critic challenge, and metrics writeback. Use for deep pull request review with low false-positive…

ZaxbyHub/opencode-swarm · 91 tokens

loop

Full execution protocol for MODE: LOOP — the compound-engineering loop: brainstorm → plan → build → review → improve, iterating under defense-in-depth stop conditions with generator/critic separation, durable resumable state, and mandatory compounding learning capture. Loaded on demand by the architect when the loop…

ZaxbyHub/opencode-swarm · 72 tokens

project-contract-harness