mishkan-cc-harness

How Baruch records the terminal output of a research run — the contract-bound research-log shape, when to write a Cognee node and when not to, the curated-library-match short circuit, and the discipline of being a faithful carrier. Invoke when emitting a research-log entry, when the Cognee write decision is in scope, or when an upstream stage returned malformed input.

Promote knowledge into Cognee by blast radius. Routes a learning to the right tier — agent-private (stays in MEMORY.md), team-level (team rules + topic files, Team Lead decides), or cross-harness (Cognee project graph, Nehemiah + Bezalel at sprint close). Use when an agent has a learning worth keeping.

How Ezra turns clarified intent into a research brief — the curated-library-first rule, the sub-question decomposition, source prioritisation, acceptance criteria for "good answer," and the short-circuit when the curated library already holds the answer. Invoke as the second stage of the research pipeline after Jakin clarifies.

How Shemaiah judges the summarised research for signal vs noise — the cross-reference against the curated library, the verdict shape (resolved / partial / blocked), confidence calibration anchored to source quality and coverage, gap identification, and the rule that an evaluation never produces new content. Invoke as the fifth stage of the research pipeline.

Set up Cognee for MISHKAN — choose the install path, create a clean Python env, configure LLM/embedding providers and (optionally) PostgreSQL/Neo4j backends, and wire it to the harness. Use before first bringing up the knowledge graph, or when Cognee setup hits friction (Python version, venv, API keys, optional extras). Mirrors Cognee's official LLM quickstart skill.

Initialise a project under MISHKAN. Runs the SWE-BASICS-BEFORE-CODE sequence through the right specialists (PRD → SRS → CONTRACT → ARCHITECTURE → THREAT_MODEL → C4 → docs scaffold), seeds Cognee, writes the project CLAUDE.md, and begins Sprint S0. Use once per project, triggered by /mishkan-init.

Selectively ingest specific documents into the project's cognee work store. Use to deliberately add docs to memory instead of bulk-ingesting a whole tree — the default is "nothing enters memory unless tagged or invoked", which prevents PII bleed (e.g. real addresses in incident reports) and oversized-doc embedding failures. Walks ./docs/ filtered by a `mishkan: ingest` YAML frontmatter tag, or accepts explicit paths. Always runs cognify → memify after adding.

How the six Team Leads (aholiab, huram, zerubbabel, phinehas, eliashib, jehoshaphat) lead a team without imploding it — the routing-within-team discipline, the planning-before-handoff rule, the do-not-implement-yourself rule, and the seams to other teams. Same shape; six team-specific notes per Lead. Invoke when leading team work, planning a cross-team handoff, or routing within a team.

Use `graphify query "<question>"` to traverse the project's code-structure graph for structural questions ("who calls X", "what depends on Y", "where is the entry point") at ~1.8k tokens per query — 88.1× cheaper than lifting the full source tree into context (verified on MISHKAN harness, POC 2026-06-07). Use BEFORE grep / Read on source files whenever the question is about code STRUCTURE rather than code SEMANTICS. For every code-touching agent across the dev teams (per D-009 amended scope, 2026-06-07): Yasad backend (Hizkiah, Nathan, Zadok, Shallum, Uriah), Panim frontend (Salma, Oholiab, Asaph, Jahaziel), Chosheb UI (Hiram), Mishmar code-security (Ira, Joab, Hushai), Migdal infra-code (Palal, Meshullam, Meremoth, Hanun), Sefer documentation (Joah, Shevna, Jehonathan).

Universal skill-discovery layer for the main session. Routes a task to the most relevant installed skills across MISHKAN, the user's ~/.claude/skills, plugin-bundled skills, and project-local skills. Returns three buckets — must_load, should_consider, adjacent — capped at 13 entries total. Advisory only; the model decides what to actually load. Use when a task arrives and you suspect a relevant skill exists but you cannot remember its name, when the surface of installed skills has grown past what fits in working memory, or when /skills is invoked explicitly.

How Bezalel sets and enforces the technical bar — what is and is not an architectural decision, the quality bar applied on every review, the escalation contract from Team Leads, and the seam with Nehemiah. Invoke when an architectural decision is on the table, when a /plan needs technical review, when a Team Lead escalates, or when the quality bar is being negotiated.

How Hizkiah implements backend features against an existing contract — the layered shape (controller → service → repository), transaction boundaries, idempotency, error mapping, the no-redesign rule. Stack-neutral principles with concrete examples in Python (FastAPI), TypeScript (Hono / NestJS), and PHP (Laravel). Invoke when implementing a backend feature against a fixed contract, or when a routine implementation is starting to drift toward redesign.

How Nehemiah holds scope, runs /plan, routes work, and refuses scope expansion — the rules behind the routing map, the discipline of exploration vs execution mode, the shape of a /plan, and the worked examples of holding the line. Invoke when scope is being negotiated, when /plan is in scope, when a new request lands and needs routing, or when an in-flight task is drifting.

How Benaiah handles infrastructure-level and supply-chain security — STRIDE threat modeling, container hardening, secrets architecture (SOPS/age), dependency vetting + portfolio auditing, the SLSA + provenance discipline, and the asymmetric-delegation boundary on prod ops. Invoke when threat-modeling, vetting a dependency, hardening infra, or auditing the supply chain.

How Hanun wires hardening overlays, secrets ops, and observability (Prometheus / Grafana / Loki / Sentry / GlitchTip / OpenTelemetry) — the always-reapply-on-recreate rule, the metric / log / trace separation, the alerting discipline, and the no-prod-execution boundary. Invoke when observability wiring or hardening setup is in scope.

How Hushai advises on security trade-offs without implementing — ASVS-level prioritisation, control selection given threat model, delivery vs security balance, the no-blocking-no-implementation boundary. Invoke when a security trade-off needs counsel rather than a finding.

How Jehonathan publishes finished documentation from the knowledge graph — Cognee query discipline, the Stripe-API-docs quality bar, Docusaurus / MkDocs site shape, the source-grounded-only rule, and the docs-only boundary. Invoke when documentation is being published from the knowledge graph.

How Joab reviews application-layer security across web, mobile, and desktop clients — auth flow analysis (JWT / OAuth2 / session), CSRF / XSS prevention at the surface, the OWASP API Top 10 patterns, client-side storage hygiene, mobile/desktop client hardening. Invoke when an application-surface security review is needed.

How Meremoth builds CI/CD pipelines — GitLab CI / GitHub Actions stages, secret marshalling via SOPS, hash-based config drift detection, SSH-direct deploy patterns, the prepare-not-execute rule, and the "check the CI AND the remote script" diverge-silently rule. Invoke when a pipeline or release-automation change is in scope.

How Meshullam designs infrastructure topology — C4 diagrams, Docker Compose / Terraform / Helm structure, network layout, service connections, the no-:latest rule and resource-tagging discipline, the explicit-trade-off requirement on every topology decision. Invoke when an IaC change or topology decision is in scope.

How Palal works the structural intersection — OS, virtualisation, networking, container runtime, Traefik routing, IPv4/IPv6, iptables, systemd, the two-root-causes rule on infra incidents, and the no-prod-execution boundary. Invoke when OS-level, network, or virtualisation work is in scope.

How Rehum advises on SRE practice — SLI/SLO definition, error budgets and burn-rate alerts, capacity planning, the no-implementation boundary, and the cite-the-framework rule. Invoke when SLO design, reliability risk review, or capacity advice is needed.

How Asaph audits accessibility and SEO at the markup layer — semantic-first markup, WCAG 2.2 AA criteria, ARIA-only-when-needed rule, SEO structured data, the cite-the-success-criterion discipline, and the remediation boundary (markup yes, application logic no). Invoke when accessibility or SEO is being audited or remediated.

How Deborah evaluates UX through cognitive and emotional lenses — Hick / Miller / Fitts applied honestly, decision architecture, emotional response calibration, the no-fabricated-user-research rule, and the advisory-only boundary. Invoke when a design needs cognitive or emotional UX evaluation.

How Hiram designs UI and builds prototypes — the design-system-first rule, the prototype-as-decision discipline, layout / hierarchy / typography craft, the dark-mode and motion contracts, and the prototype-to-handoff package shape. Invoke when designing a UI surface or building a prototype.

How Obed prepares and ships frontend assets — image format selection, responsive image discipline, font subsetting, SVG sprite hygiene, the Core Web Vitals budget anchoring, and the no-application-logic boundary. Invoke when frontend assets are being prepared or optimised.

How Oholiab architects the frontend design system — design tokens, theming infrastructure, component contracts, the no-one-off rule, the cost-of-extension discipline, and the seam between Chosheb's handoff and Panim's implementation. Invoke when a design-system decision is in scope — token additions, component contracts, theming, or extension proposals from Hiram.

How Salma implements the visible product against the design system and the API contract — the no-raw-fetch rule, TanStack Query / Router patterns, component co-location, the design-system-only styling rule, state-management discipline, and the responsive/dark-mode/motion implementation contracts. Invoke when implementing frontend features.

How Shallum designs schemas, indexes, and migrations — the read-shape-vs-write-shape rule, indexing discipline, EXPLAIN-as-the-test, zero-downtime migration patterns, the never-execute boundary, and the SQL safety rules. Invoke when a schema decision, indexing question, or migration is in scope.

How Caleb executes a research brief against the web — the curated-URLs-first rule, source attribution discipline, the unverified flag, coverage honesty, and the /plan trigger for multi-source briefs. Invoke as the third stage of the research pipeline after Ezra produces a brief.

How Jakin clarifies a raw research query into a precise, answerable intent — the threshold-establishing rule, the discipline of returning open questions instead of guessing, when to pass intent through unchanged, and the failure modes of intent ambiguity. Invoke at the start of any research-pipeline run.

How Shaphan compresses Caleb's findings without losing signal — the source-preservation rule, what is dropped (redundancy) versus what is kept (every claim and source), the key-points discipline, and the no-judgement boundary. Invoke as the fourth stage of the research pipeline.

How the three Sefer scope-layer specialists (seraiah, joah, shevna) reason about documentation — the Diátaxis quadrant rule, the pull-based discipline, source-grounded writing, the layered-scope split (org / project / team), and the writes-to-docs-only boundary. Same shape; three scope-levels with distinctive concerns. Invoke when documentation at a specific scope is in scope.

How the QA roles (uriah for backend, jahaziel for frontend) evaluate work against the contract, the tests, and the standards — the evaluate-only rule, the anchor-every-finding rule, severity calibration, the structured-findings output, and the discipline of not arguing the implementation. Invoke when a piece of work is being QA-evaluated. Same shape, two scopes.

How Team Reporters (ahikam, elasah, igal, maaseiah, zaccur, huldah) collect and assemble team-report.json at milestone — the silent-collection discipline, the structured-summary rule, the no-decisions boundary, and the schema-bound output. Invoke at every milestone where a Team Reporter is assembling the report. Same shape, six scoped instances.

How Ira reviews code for security at the moment of write — the pre-block rubric, the false-positive guard list that prevents noise, severity calibration anchored to OWASP/CWE, and the durable remediation patterns. Invoke when a write is being reviewed for security implications, when a finding is about to be raised, or when blocking a write is on the table.

How Zadok reasons about backend contracts and invariants — what CONTRACT.md actually fixes, the error model, naming and pagination rules, and the discipline around contract evolution. Invoke when authoring or modifying a CONTRACT.md, debating an invariant, or deciding whether a proposed change is a backward-compatible evolution or a breaking change.

How Nathan reasons about software architecture decisions. Invoke when a design decision is in scope — module boundaries, service decomposition, data flow, sync/async, consistency model, state placement, contract evolution. Long-form craft skill; loads only when Nathan reaches for it.

MISHKAN shared research pipeline. Use when any agent faces an unknown and must research it. Orchestrates Jakin (clarify) → Ezra (formulate) → Caleb (web research) → Shaphan (summarise) → Shemaiah (evaluate) → Baruch (report). Produces a research-log.json entry and, on resolve, a Cognee node. Invokable by any agent at any time.

Cognee offloading helper. Writes a full artifact (research output, decision record, long finding) to the Cognee graph and returns a compact summary plus the node id for the context window. Use to keep context lean — full content in the graph, summaries in context.