harden

name	harden
compatibility	Built for Claude Code (subagents). Installs on any Agent Skills client.
allowed-tools	Bash, Read, Grep, Glob, Write, Task, AskUserQuestion
description	Stress-test a change against production-only failure modes: edge cases, concurrency, scale, security. Run /harden after the code works and is tested, typically the last step before merge on medium/full tier. A systems-level subagent audits the diff against a threat rubric and writes a prioritized hardening checklist; nothing is edited without approval.

Read ../conventions.md first (once per session). It carries the session start gate, model routing (this skill: mid tier), subagent rules, and output style. Apply the start gate before anything below.

What this skill does

The pre-merge stress test. A subagent reads the actual diff, thinks like production (concurrency, partial failure, malicious input, scale, secrets), and writes docs/hardening/<date>-<branch>.md: must-fix, should-harden, watch/accept, each with file:line. It finds and ranks; it does not fix (approve a specific item and it re-spawns with Edit for that one), write tests (/test), or root-cause bugs (/debug).

Execution

1. Scope the change set (names only, cheap)

Base = main else master; current branch via git rev-parse --abbrev-ref HEAD. On the base (mode uncommitted): git diff --name-only HEAD plus untracked (git ls-files --others --exclude-standard). On a branch (mode branch): merge base via git merge-base "$BASE" HEAD, then git diff --name-only <merge-base> plus untracked. De-duplicate, drop lock/generated files. Empty → say there is nothing to harden and stop; do not spawn.

2. Lightweight pointers (never read heavy files here)

Paths and cheap signals: the 3 most recent ADR paths under docs/adr/ · the latest docs/hardening/ file if any (prior known risks) · root AGENTS.md contents (short, inline) · the test signal: configured (test-preferences.json names a framework; "add a test" is valid advice) · none-by-design (a recorded gate with no framework; frame "verify with" as the typecheck + prove-it-runs gate, never as a missing harness) · none-yet.

3. Spawn the subagent

Read agent-prompt.md and harden-guide.md (lazy) and inline the full guide into the prompt (the subagent cannot resolve skill paths). Spawn: mid-tier model (strongest tier only for a critical, high-blast-radius change) · tools Read, Bash, Grep, Glob, Write, no Edit (it produces a checklist, not edits) · prompt carries the guide, the diff scope (mode, base, merge base, file list, the exact git diff command), the project context inline, the ADR and prior-checklist paths, the test signal, and the output path docs/hardening/<date>-<branch>.md.

4. Relay

Subagent errored or wrote nothing → report the failure, offer a re-run, never relay a fabricated result. Otherwise relay its compact summary verbatim shape:

## /harden complete
**Scope**: <N> files, <branch vs base | uncommitted>
**Checklist**: docs/hardening/<date>-<branch>.md
**Risk posture**: <Ship as-is | Harden before merge | Do not ship>
**Must-fix before merge** (<count>): <category, one line each, file:line>
**Should-harden** (<count>): <one line each>
**Watch / accept** (<count>)

On approval of a specific fix: re-spawn with Edit scoped to that item. Close: "Next: /clear, then /sync (record what shipped) or merge."

Reference files (lazy)

agent-prompt.md (spawn template) · harden-guide.md (the threat rubric, inlined at spawn).