Set Up Engineering Harness
Configure one existing Project in a single approved pass. Keep AGENTS.md thin and load detailed
Playbooks only when routed.
One-shot workflow
Resolve the target Project; never target this Skill directory.
Resolve the current provider as codex or claude-code. If the host is
unclear, ask one objective provider choice. Run the read-only preview:
python3 <skill-dir>/scripts/setup_harness.py plan \
--provider <provider> --repo <project>
Present detected facts and unresolved decisions together. Make every choice objectively
comparable; put recommendations in a separate section with their criteria and rationale.
Show the planned file and host-state changes. Obtain one approval for that exact scope.
Install, run the normal-provider canary, then audit:
python3 <skill-dir>/scripts/setup_harness.py install \
--provider <provider> --repo <project>
python3 <skill-dir>/scripts/setup_harness.py verify-provider \
--provider <provider> --repo <project>
python3 <skill-dir>/scripts/setup_harness.py audit --repo <project>
verify-provider starts one constrained fresh provider session and proves
that its PreToolUse hook denies a reserved write canary. If the provider
has not reviewed the exact Project hooks, tell the user to open it in the
Project, run /hooks, review and trust the two Engineering Harness entries,
then rerun verify-provider. Persisted hook trust is a provider/user
security decision; do not forge or edit it.
Report PASS, INCOMPLETE, or FAIL exactly. INCOMPLETE means a provider or integrity
prerequisite is still unverified.
Install, repair, audit, and uninstall use the Python 3.12-or-newer standard library only. They never run
Project commands, read secrets, change application code, or install packages. verify-provider
runs only the reserved write-deny canary and binds its receipt to the current manifest checksum.
The seeded default is write_gate.mode = "assistive": normal reads, research tools, shell
commands, verification, and app writes use the provider's ordinary permissions. The Hook protects
secrets, Harness-owned paths, provider Hook configuration, and the reserved canary. strict is an
explicit compatibility mode for the scoped-lease protocol.
Ownership and recovery
- Preserve every existing provider instruction file byte outside the stable
managed block (
AGENTS.md for Codex or CLAUDE.md for Claude Code).
- Treat
.agent-harness/config.json and .agent-harness/local.md as user-owned seed-once files.
- Treat the manifest, repository profile, Router, Playbooks, checker, and broker as
installer-owned.
- Preserve unrelated provider hooks in
.codex/hooks.json or
.claude/settings.json. Manage exactly one PreToolUse and one
UserPromptSubmit entry.
- Stop
install on owned drift without writing. Use repair only after explicit approval; it
writes content-addressed recovery copies before replacement.
- Repeated
install must be byte-identical. Use uninstall only after explicit approval; it
removes managed content while retaining user-owned and unknown files.
Commands:
python3 <skill-dir>/scripts/setup_harness.py plan --provider <provider> --repo <project>
python3 <skill-dir>/scripts/setup_harness.py install --provider <provider> --repo <project>
python3 <skill-dir>/scripts/setup_harness.py verify-provider --provider <provider> --repo <project>
python3 <skill-dir>/scripts/setup_harness.py audit --repo <project>
python3 <skill-dir>/scripts/setup_harness.py repair --provider <provider> --repo <project>
python3 <skill-dir>/scripts/setup_harness.py uninstall --repo <project>
Do not manually copy assets or edit managed files. The installer owns merge, hashing, atomic
rollback, and host-state placement.
1---2name: setup-engineering-harness3description: Inspect a repository and deterministically plan, install, audit, repair, or uninstall its adaptive coding workflow. Use when asked to configure one coding agent to align requirements naturally, batch independent questions, research exact and current dependency behavior, select a suitable stack without framework bias, plan proportionately, verify claims, and preserve only durable documentation without replacing user instructions.4---56# Set Up Engineering Harness78Configure one existing Project in a single approved pass. Keep `AGENTS.md` thin and load detailed9Playbooks only when routed.1011## One-shot workflow12131. Resolve the target Project; never target this Skill directory.142. Resolve the current provider as `codex` or `claude-code`. If the host is15 unclear, ask one objective provider choice. Run the read-only preview:1617 ```bash18 python3 <skill-dir>/scripts/setup_harness.py plan \19 --provider <provider> --repo <project>20 ```21223. Present detected facts and unresolved decisions together. Make every choice objectively23 comparable; put recommendations in a separate section with their criteria and rationale.244. Show the planned file and host-state changes. Obtain one approval for that exact scope.255. Install, run the normal-provider canary, then audit:2627 ```bash28 python3 <skill-dir>/scripts/setup_harness.py install \29 --provider <provider> --repo <project>30 python3 <skill-dir>/scripts/setup_harness.py verify-provider \31 --provider <provider> --repo <project>32 python3 <skill-dir>/scripts/setup_harness.py audit --repo <project>33 ```3435 `verify-provider` starts one constrained fresh provider session and proves36 that its `PreToolUse` hook denies a reserved write canary. If the provider37 has not reviewed the exact Project hooks, tell the user to open it in the38 Project, run `/hooks`, review and trust the two Engineering Harness entries,39 then rerun `verify-provider`. Persisted hook trust is a provider/user40 security decision; do not forge or edit it.41426. Report `PASS`, `INCOMPLETE`, or `FAIL` exactly. `INCOMPLETE` means a provider or integrity43 prerequisite is still unverified.4445Install, repair, audit, and uninstall use the Python 3.12-or-newer standard library only. They never run46Project commands, read secrets, change application code, or install packages. `verify-provider`47runs only the reserved write-deny canary and binds its receipt to the current manifest checksum.4849The seeded default is `write_gate.mode = "assistive"`: normal reads, research tools, shell50commands, verification, and app writes use the provider's ordinary permissions. The Hook protects51secrets, Harness-owned paths, provider Hook configuration, and the reserved canary. `strict` is an52explicit compatibility mode for the scoped-lease protocol.5354## Ownership and recovery5556- Preserve every existing provider instruction file byte outside the stable57 managed block (`AGENTS.md` for Codex or `CLAUDE.md` for Claude Code).58- Treat `.agent-harness/config.json` and `.agent-harness/local.md` as user-owned seed-once files.59- Treat the manifest, repository profile, Router, Playbooks, checker, and broker as60 installer-owned.61- Preserve unrelated provider hooks in `.codex/hooks.json` or62 `.claude/settings.json`. Manage exactly one `PreToolUse` and one63 `UserPromptSubmit` entry.64- Stop `install` on owned drift without writing. Use `repair` only after explicit approval; it65 writes content-addressed recovery copies before replacement.66- Repeated `install` must be byte-identical. Use `uninstall` only after explicit approval; it67 removes managed content while retaining user-owned and unknown files.6869Commands:7071```bash72python3 <skill-dir>/scripts/setup_harness.py plan --provider <provider> --repo <project>73python3 <skill-dir>/scripts/setup_harness.py install --provider <provider> --repo <project>74python3 <skill-dir>/scripts/setup_harness.py verify-provider --provider <provider> --repo <project>75python3 <skill-dir>/scripts/setup_harness.py audit --repo <project>76python3 <skill-dir>/scripts/setup_harness.py repair --provider <provider> --repo <project>77python3 <skill-dir>/scripts/setup_harness.py uninstall --repo <project>78```7980Do not manually copy assets or edit managed files. The installer owns merge, hashing, atomic81rollback, and host-state placement.
Mrbaeksang