epic-harness

Ring 3 evolution engine. Analyzes session observations, generates and improves evolved skills, shows metrics dashboard. Subcommands: status, history, rollback, reset. Use for post-session review and skill improvement.

State-persisted autonomous pipeline: spec → go → audit → eval → ship → evolve in one command. Auto-detects direct/council/interactive mode. Crash-recoverable via PIPELINE-*.json. Hands-off until PR.

Core router. Always active. Auto-invokes matching skill before every response. Runs confusion protocol on high-risk ambiguity.

Loop-breaking self-diagnosis. Use when 3+ consecutive failures occur, circular retries persist, or context overwhelms the session.

Audit phase. Parallel review: code quality + security + tests. Semantic dedup of cross-mode findings. Outputs PASS/WARN/FAIL per dimension. Validates spec coverage.

Conventional Commits 1.0 generator. Stages relevant files, infers type(scope): description, never uses --no-verify.

Context window manager. Snapshots session state, compacts conversation, and resumes via hook. Use when context exceeds 70% or a large new task begins.

4-voice parallel deliberation (Architect · Skeptic · Pragmatist · Critic) for architecture, tech selection, or design decisions with no clear answer. Anti-anchoring: each voice gets independent context. Records decision in harness-mem.

HarnessX Critic (Tier 2.1) — adversarial review of evolved-skill proposals against trace evidence. Detects reward hacking and manifest/evidence contradictions. Out-of-band LLM counterpart to the in-loop deterministic critic in src/evolve/critic.rs.

Systematic root-cause isolation for test failures, runtime errors, or unexpected behavior. Narrow hypothesis → verify → fix.

Trigger: vague/unfocused request or solution-without-problem. Also invoked via /discover command. Reframes goal before acting.

Documentation generator for public APIs, functions, and modules. Use when exports, signatures, or new modules are added or changed.

Quality and performance evaluation with baseline comparison. Sub-modes: correctness, performance, quality, regression. Outputs PASS/WARN/FAIL per dimension. Use for pre-ship evaluation or regression checks.

Go phase. Reads the approved SPEC file, maps Requirements to tasks (plan), executes via TDD (build), and integrates results verifying all Acceptance Criteria.

Trigger: active multi-agent run. Handles inbox reading, dep resolution, message formatting, handoffs. Also provides status dashboard and intervention control via internal modes.

Performance optimizer for loops, DB queries, rendering, and batch operations. Catches N+1 queries, missing indexes, and unnecessary re-renders.

On-demand human self-assessment of AI usage quality. Scores 5 dimensions from session data. Not agent performance review.

Security review checklist with optional engagement scoping. Use when auth, DB, API, infra, or secrets code is touched.

Ship phase. Runs isolated integration test in a fresh worktree, creates a PR with full spec + audit report in the body, watches CI, and auto-fixes failures.

Code simplification for high-complexity files. Targets deep nesting, copy-paste patterns, god functions, and files over 200 lines.

Spec phase. Converts user requirements into a numbered Requirements + Acceptance Criteria document saved as SPEC-{timestamp}.md. Prompts /team suggestion when 3+ requirements are detected.

Test-Driven Development enforcer. Red→Green→Refactor cycle with no production code without a failing test first. Use for new features and bug fixes.

Org-level agent team designer via `epic team` CLI (cross-project, append-merge). Subcommands: list, show, sync, link, unlink, history. Use when setting up agents, designing teams, or /spec yields 3+ requirements.

Threat modeling and attack surface analysis. Use when assessing security boundaries, modeling threat actors, or generating threat scenarios.

Adversarial validation of vulnerability findings. Use when triaging security findings, validating vulnerabilities, or prioritizing remediation.

Pre-merge verification gate. Build, test, and lint must all pass before marking done or shipping.

Systematic vulnerability scanner across injection, auth, data exposure, and dependencies. Use when scanning for vulnerabilities, reviewing security, or validating threat models.