harness-improve — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited harness-improve (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
BLUF: improvements to the harness are the highest-slop-risk artifact in this repo — plausible protocol text detached from incidents is neuroslop about neuroslop. Entry requires a live anchor; every change class has its own gate; a null measurement result is information, not failure.
Admissible anchors, in order of strength:
.github/ISSUE_TEMPLATE/harness-gap.yml).«Would be nice» without an anchor → record as a ROADMAP row candidate or drop. Do not proceed to implementation on an unanchored idea: critique of the harness demands the same evidence bar as critique of code.
ROADMAP.md and open issues for an existing row or tracker. A recorded decision (ADR, ROADMAP status, protocol doc) must be quoted before re-opening, and re-opening requires new evidence — not repeated association.| Class | Typical diff | Gate before merge |
|---|---|---|
| Mechanical | hooks/, scripts/ | bash -n + python3 -m json.tool on JSON + the matching scripts/selftest_*.sh (extend it with the new behavior — a test of a hand-copied reimplementation is decorative coverage) |
| Behavioral text | invariants.txt, agents/, references/, CLAUDE.md | single-line invariant format (selftest_random_invariant.sh); role-subset inheritance ONLY via the eval-gated N8 path (ROADMAP) |
| Calibration | eval/criteria.md, judge prompts, role subsets, agent system prompts | eval run (label run-eval); reconcile every consumer of changed counts/contracts (ci_eval.py, docs — the 16-vs-17 drift class); expect judge noise — report null results as-is |
All classes pass the critic gate at push (auto-critic.sh); protocol paths additionally pass the human-token gate (PR #59). One concern per branch and PR.
Counter: when the owner explicitly orders an unanchored exploratory change («try it, we'll see»), the anchor requirement converts into a measurement obligation after landing — exploration is allowed; unmeasured persistence is not.
Provenance: codifies the pipeline executed manually in the 2026-06-11/12 issue revision (#55/#56, PR #57–#60): verify-against-main caught an already-done item; per-class gates landed across #44, #51–#53, #59.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.