harness-oia-audit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited harness-oia-audit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The 13th worker (ADR-150 Phase 2) — runs three MetaHarness static surfaces in one shot, computes a composite worst-severity signal, and persists the audit record to memory so drift over time is visible.
Implementation: scripts/oia-audit.mjs.
harness oia-manifest <path> — Open Infrastructure Architecturelayer alignment (L1-L9).
harness threat-model <path> — categorized MCP-surface threatreport with worst: clean|low|medium|high.
harness mcp-scan <path> — per-server/tool policy + permissions+ dep findings.
max(threatModel.worst, max(mcpScan.findings.severity)).metaharness-audit with keyaudit-<iso-timestamp> (unless --dry-run).
--alert-on-worst <severity>: exit 1 if composite worst ≥ threshold.When ALL three components report metaharness-not-available, the script emits the standard degraded payload and exits 0. When only some are degraded, each individual component carries its own degraded: true flag in the audit record — the audit still runs and persists what it could gather.
Designed for weekly cron in .github/workflows/:
on:
schedule:
- cron: '17 4 * * 0' # Sundays at 04:17 UTC
jobs:
oia-audit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
- run: node plugins/ruflo-metaharness/scripts/oia-audit.mjs --alert-on-worst high--alert-on-worst high fails the job on any HIGH-severity finding; drift below HIGH is logged but doesn't block.
Each audit run stores under metaharness-audit:audit-<iso-ts>. To list recent audits:
npx @claude-flow/cli@latest memory list --namespace metaharness-audit --limit 10To diff two audits (drift detection):
A=$(npx ... memory retrieve --key audit-2026-06-01... --namespace metaharness-audit)
B=$(npx ... memory retrieve --key audit-2026-06-15... --namespace metaharness-audit)
# Compare composite.worst, components.threatModel.worst, etc.A future ADR can wire this into a dedicated cost-diff-style diff viewer specifically for audit drift.
harness-threat-model — the underlying threat-model componentharness-mcp-scan — the underlying MCP-scan componentharness-score + harness-genome — readiness metrics (orthogonal to audit)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.