harness-studio

Load when building or reviewing a FastAPI backend service — endpoints, persistence, concurrency, transactions, testing.

Drive an hssd-governed repo as the interactive MAESTRO — run the governed engagement loop (intake → iteration → the 6 phases → adversarial verification) conversationally, using Claude Code's native subagents for the AI work and the `hssd` CLI for state. Use whenever the user wants to drive any phase of the loop in a repo that has `hssd.yaml` + `.harness/`.

Load for any Python work — project setup, typing, async, testing, style. Base layer under fastapi and other Python skills.

Load for any TypeScript/React frontend work — dashboards and web UIs, project setup, components, data fetching, styling.

Drive an hssd-governed repo as the interactive MAESTRO — run the governed engagement loop (intake → iteration → engineering loop → adversarial verification) conversationally, using Claude Code's native subagents for the AI work and the `hssd` CLI for state. Use whenever the user wants to drive any phase of the loop in a repo that has `hssd.yaml` + `.harness/`.

Behavior guards for the Story Writer — testable AC in Gherkin, stress tests for guarantees, no happy-path-only coverage.

Load when building or reviewing a FastAPI backend service — endpoints, project structure, Annotated style, return types, async/sync rules, persistence, concurrency, transactions, testing.

Load when designing, building, or reviewing APIs — versioning, auth patterns, rate limiting, idempotency, webhooks, breaking vs non-breaking changes, and long-running operations. Extends api-conventions.

Load when setting up or reviewing any project — Makefile as the universal command interface. Standard targets that delegate to the stack runner (uv, npm, etc.), so the developer always types `make <target>` regardless of the underlying technology.

Load for any Python work — project setup, typing, async, testing, style. Base layer under fastapi and other Python skills.

Behavior guards for the Backend Dev — implement until green, own only backend files, report design gaps, never declare done without evidence.

Behavior guards for the Frontend Dev — implement UI per spec, handle all states, own only frontend files, provide demonstrable evidence.

Load for any TypeScript/React frontend work — dashboards and web UIs, project setup, components, data fetching, styling.

Load when designing, building, or reviewing any feature — guards against overengineering, unnecessary abstraction, and speculative generalization. The "do you actually need this?" filter.

Behavior guards for the AC Adversary — attack all AC systematically, stress test for guarantees, always propose concrete fixes.

Behavior guards for the Architect — simplest design that satisfies AC, every decision justified, no code, read-only.

Behavior guards for the Architecture Adversary — tear down the design, find failure modes, always propose alternatives. Advisory, never blocking.

Behavior guards for the Completion Challenger — prove it is NOT done, compare brief × AC × what exists, PASS only when genuinely nothing is missing.

Behavior guards for the Definition Skeptic — attack all five criteria, always propose a way forward, never approve with known gaps.

Behavior guards for the Independent Verifier — run every AC's covering test, never accept claims, evidence only.

Behavior guards for the Janitor — discover and file, never fix. High-signal findings only. Stable fingerprints to prevent duplicates.

Behavior guards for the Product Analyst — separate problem from solution, surface open questions, never invent requirements.

Behavior guards for the Regression Hunter — run the full suite, check all callers, write characterization tests for untested callers before approving.

Behavior guards for the Security Adversary — actively attack, not politely review. Injection, auth abuse, secret leakage, hostile input.

Behavior guards for the Test Adversary — fire real concurrent requests, hunt vacuous tests, find races nobody saw.

Behavior guards for the Test Author — red step is mandatory, tests must fail before implementation, one test per AC, never write production code.

Load when designing, building, or reviewing any HTTP/REST API — response shapes, HTTP status codes, filtering/range semantics, pagination, and error bodies. The blessed contract so every endpoint answers the same recurring questions the same way.

Load when designing, building, or reviewing ANY application that handles time — backend, database, data lake, or frontend. The universal rule: everything is UTC; only the frontend localizes. Applies to every stack, every project.

Load when designing, building, or reviewing how data or change-events move between components — client/server, service/service, or source/system. The blessed preference: event-driven PUSH (WebSockets, SSE, pub/sub, Kafka, message queues, webhooks) over PULL (polling). Pulling is a justified exception, not a default.

Load when designing, building, or reviewing ANY application that does I/O or calls a dependency — timeouts, retry limits, backoff, idempotency, fail-fast. Every app needs defense against hangs and infinite retries. This is the harness instinct applied to runtime.

Load when designing, building, or reviewing any SQL schema or query path — index strategy for foreign keys, filter/range queries, and append-only tables that grow without bound. Index analysis is mandatory for any SQL system.

Load when designing, building, or reviewing any Python service backed by SQLite — concurrency, transactions, upserts, single-writer ownership, atomic counters. The blessed correctness rules for FastAPI + SQLite under concurrent writes.