harness-kit

Repository-as-system-of-record protocol for multi-step or decision-heavy work. Invoke when a task spans >=3 tracked tasks, changes architecture/module boundaries, introduces or reverses important technical decisions, affects release/governance docs, audits AGENTS.md/CLAUDE.md, sets up docs/, or asks where durable project context should live. Do not invoke for small single-task edits unless the user asks for doc hygiene.

End-to-end release workflow for repositories using Conventional Commits. Use when preparing a new version, tagging a release, generating changelog/release notes, bumping version, or when the user asks "release", "new version", "bump version", "publish release", "chuẩn bị release", or "tạo tag release".

Repository-as-system-of-record protocol for multi-step or decision-heavy work. Invoke when a task spans >=3 tracked tasks, changes architecture/module boundaries, introduces or reverses important technical decisions, affects release/governance docs, audits AGENTS.md/CLAUDE.md, sets up docs/, or asks where durable project context should live. Do not invoke for small single-task edits unless the user asks for doc hygiene.

Repository-as-system-of-record protocol for multi-step or decision-heavy work. Invoke when a task spans >=3 tracked tasks, changes architecture/module boundaries, introduces or reverses important technical decisions, affects release/governance docs, audits AGENTS.md/CLAUDE.md, sets up docs/, or asks where durable project context should live. Do not invoke for small single-task edits unless the user asks for doc hygiene.

Guide for using Brave Search MCP tools (`brave_web_search`, `brave_news_search`, `brave_image_search`, `brave_video_search`, `brave_local_search`, `brave_summarizer`). Invoke when the user asks to search the web, news, images, videos, or local results AND Brave Search MCP is available. Do NOT trigger for generic lookups when other search tools (Tavily, built-in WebSearch) are more appropriate. Requires `BRAVE_API_KEY`.

Terminal-driven browser automation via the Playwright CLI — invoke when the agent needs to open a page, interact with a form, click through a flow, or verify UI state. Use this (not the test framework, not screenshot-only scraping) for live browser work. Triggers on "open the browser", "click through", "fill the form", "reproduce the UI bug", "check what the page shows".

Use when editing .ts/.tsx/.js/.jsx files. Loads TypeScript/JavaScript coding style, patterns, testing, and security rules from .claude/rules/stack-typescript/ before making changes.

Branch naming and PR sizing conventions — invoke before creating a branch, opening a PR, or when a diff exceeds 400 lines. Do NOT trigger on read-only questions about current branch/PR state (e.g. "what branch am I on", "link to the PR").

Self-review, PR review, and review-response protocols. Invoke proactively before any commit, push, or PR action; when reviewing someone else's diff; and when responding to review feedback.

Context hygiene and task decomposition for long AI sessions — invoke when planning a large feature, when context-fatigue signs appear (same file read 3+ times, errors accumulating, task spanning multiple sessions), before starting a multi-session task, or when the user asks how to break down a complex task. Use this proactively when a task looks too large to finish in one shot.

Conventional Commits format guide — invoke before any git commit, when writing a commit message, or when the user asks how to format a commit. Use this proactively whenever you're about to run git commit, suggest a commit message, or help with git history. Also covers semantic versioning implications (feat = minor bump, fix = patch bump, feat! = major bump).

Resolve conflicts and consolidate duplicate memories in .claude/memory/. Invoke after git pull surfaces conflict markers in memory files, when two memory files cover overlapping topics, when project.md hot cache has grown past ~100 lines, or when the user asks to "clean up memory" / "merge memories". Do not run proactively without a trigger — merging rewrites team-shared files.

Write, recall, and maintain long-term memory across sessions. Invoke when the user shares a preference or correction worth remembering, when they reference something they told you before, when you make a decision future sessions will need, or when MEMORY.md or .claude/memory/ files need to be updated. Use proactively — don't wait for "remember this."

Protocol for dispatching parallel subagents — invoke when a task splits into 2+ independent domains, when research would flood main context with noise, or when the user says "in parallel", "fan out", "spawn agents", "delegate", "split this up". Run this before firing Task/Agent tool calls so the brief, scope, and output contract are right the first time.

Brainstorm → spec → approval → plan → execute. Invoke before any multi-step, multi-file, or architecturally-novel task, and whenever the user says "implement X", "build Y", "add a feature", "refactor Z". Also invoke when executing an already-approved plan — the execution phase has its own discipline (critique before exec, verify after each task, stop on failure).

Fresh verification before any completion claim. Invoke after implementation, after bug fixes, before saying "done", "fixed", "ready", or "safe to merge", and before commit/PR handoff. Do not infer success from code inspection or an old test run.

Dedicated security review for risky changes. Invoke before merging or approving changes that touch auth, permissions, secrets, shell commands, file or network boundaries, MCP/hooks/agent config, payments, or PII. Also invoke when the user asks for a security audit, threat review, or OWASP-style review.

Spec before plan for non-trivial work. Invoke when the user asks for a feature, refactor, workflow change, API change, or any multi-step task where the why, scope, or acceptance criteria could drift. Do not let implementation become the de facto spec.

Root-cause-first debugging for bugs, failing tests, flaky behavior, broken builds, and integrations. Invoke whenever something is failing or behaving unexpectedly. Do not patch symptoms, stack fixes, or guess under time pressure.

Test-driven development for new behavior and bug fixes. Invoke before implementing user-visible logic, API changes, business rules, and regressions. Do not write production code for non-trivial behavior before a failing test or repro exists.

Create a complete harness-kit bundle from scratch — manifest, artifacts, README, and test. Invoke when adding a new bundle to the registry, extending an existing bundle with new artifact types, or when the user says "add a bundle for X", "create a bundle", "I want to package X as a bundle". Always use this skill for any bundle contribution to harness-kit — it ensures nothing gets missed (manifest, registry registration, artifacts, test).

Use when editing .go files. Loads Go coding style, patterns, testing, and security rules from .claude/rules/stack-go/ before making changes.

Use when editing .java files. Loads Java coding style, patterns, testing, and security rules from .claude/rules/stack-java/ before making changes.

Use when editing .py files. Loads Python coding style, patterns, testing, and security rules from .claude/rules/stack-python/ before making changes.

Use when editing .rs files. Loads Rust coding style, patterns, testing, and security rules from .claude/rules/stack-rust/ before making changes.

Guide for using mem0 MCP tools — invoke whenever you add, search, or recall long-term memory across sessions. Use this before answering any user turn that references "last time", "we decided", or "my preferences".

crawl4ai web scraping — invoke when scraping a known URL, extracting structured data from pages, crawling docs/sites deeply, or processing YouTube transcripts / PDFs / Office files. Use AFTER you already have URLs (e.g. from a search tool); crawl4ai fetches and extracts content, it does not search the web. Picks the right tool from the full set and avoids context overflow on large results.

Provider-agnostic audit to reduce LLM token usage — prompts, system prompts, agent history, RAG, tool schemas. Trigger on "reduce tokens", "cut LLM cost", "prompt too long", "context too big", "context rot", "optimize prompt", or when the user shares a verbose prompt / costly agent trace asking how to make it cheaper or faster. DO NOT trigger on Anthropic SDK implementation work (`cache_control` placement, cache-hit debugging, batch/files/memory APIs) — defer to `claude-api`.

GPG and SSH commit signing setup, verification, and troubleshooting — invoke when the user asks about commit signing, signed commits, GPG keys, SSH signing, "verified" badges on GitHub, or when a git commit fails with a signing error. Run this proactively when setting up a new machine or new repo that requires signed commits.

Web search, content extraction, site mapping, crawling, and deep research via Tavily — use whenever the user needs current web information, wants to pull clean content from a URL, discover pages on a large site, bulk-extract documentation, or produce a cited multi-source research report. Prefer this skill for any agentic web-research workflow; do not fall back to ad-hoc browsing when Tavily can answer the question more cleanly.

GPG and SSH commit signing setup, verification, and troubleshooting — invoke when the user asks about commit signing, signed commits, GPG keys, SSH signing, "verified" badges on GitHub, or when a git commit fails with a signing error. Run this proactively when setting up a new machine or new repo that requires signed commits.