Reusable harness engineering workflow for AI-assisted engineering — agent context files, sprint contracts, and review loops that work with any LLM or coding tool.
Runs a periodic whole-subsystem code quality audit against a declared commit or tag, producing prioritised findings with severity, confidence and regression risk while preserving existing behaviour exactly. Changes no code. Use for a milestone, quarterly or pre-hardening review, before a large refactor, or when the…
Runs the per-diff code quality gate at VERIFY for service, http-api and solidity-build work: runs the repo's declared linter, checks complexity, length, coupling, magic values, duplication, dead code and error handling on the changed code, and blocks PENDINGREVIEW on violations. Use before setting PENDINGREVIEW, or…
Open a GitHub pull request using the kit PR template. Use when the user asks to open/create a PR, push and PR, or publish a branch. Write a detailed, product-facing description. Contracts and harness review stay local — never put feature IDs, contract paths, or harness sections in the PR title or body.
Turns a brief or PRD into an Engineering Requirements Document and its architecture companion, through five human-gated stages — frame, decisions, design, contracts, slices — then seeds FEATURES.json so each slice becomes a sprint contract. Work-type profile product-erd. Use when defining a new product, service or…
Bootstraps a repository into the harness process: scaffolds AGENTS.md with the embedded agent process, FEATURES.json, STATE.md and a slim README pointer, then verifies the wiring. Use when adopting the harness kit into a new or existing repo, when the user says onboard, bootstrap, set up the harness, adopt the kit, or…
Reviews a pull request as a production merge gate, starting with contract compliance: scope met or missing, impact map versus changed files, each success criterion pass or fail, quality gates, then correctness, architecture, reliability, performance, security, testing and operational readiness. Use when reviewing a…
Runs the pre-merge security self-check over a diff — workflow safety, auth and authorization, input validation and injection, secrets and configuration, rate limiting, error handling and data leakage, dependencies, and a Solidity section. Use before asking for a merge on anything touching money, authentication, user…
Runs a Solidity contract security audit against a declared commit or tag: scope, assets, actors and trust boundaries, a severity rubric, a tooling plan, and findings where High and Critical require a reproducible proof of concept. Use when auditing smart contracts, reviewing contract security, or when the user asks…
Writes a sprint contract before any test or production code — work-type profile, scope in and out, feature branch, locked decisions, tests-first plan, grounded impact map, falsifiable success criteria, quality gates and blocking questions. Use when starting any non-trivial change, when the user says write a contract…