ssheleg · sshlg · Sep 21, 2026 · Sep 21, 2026 · Sep 21, 2026 · Sep 21, 2026
diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
@@ -12,7 +12,7 @@
       "displayName": "Agent Stack",
       "source": "./plugins/agent-stack",
       "description": "Four skills: agent-orchestrator — tool-calling loops, pipelines with checkpoints, provider routing with fallback, memory architecture, plus the wallet side of reselling LLM access; agent-evals — run/trace/thread evals, LLM judges, and fixtures grown from production; agent-interop — MCP servers and clients, A2A agent cards, the MCP Registry, and gateways; agent-harness — system prompts, tool shaping, workflow-vs-agent, and auditing an agent system.",
-      "version": "0.24.3",
+      "version": "0.25.1",
       "author": {
         "name": "ssheleg",
         "url": "https://x.com/sshlg93"

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,3 +1,21 @@
+## 0.25.1 — workbench harness contracts, with a bounded ECC transfer
+
+- Distinguish a kernel harness from the operating layer around an existing agent.
+  The family is the latter; skills are components, not an OS security boundary.
+- Add an on-demand `agent-harness` reference for install ownership and loaded
+  state, bounded hooks and failure policy, evidence-bearing handoff, artifact-bound
+  eval receipts, replay limits and scoped learning. Existing family owners remain
+  authoritative; no duplicate runtime, schemas or receipt store is introduced.
+- Attribute the selective ECC review to commit
+  `2b6e839771e53096d8451a213d40dc64ec8acac0`; retain the adoption matrix,
+  source digests, acceptance cases and explicit limits in the research ledger.
+- Version 0.25.0 was not released: its protected tag was mistakenly created
+  at the previous revision after GitHub rejected a merge method. The queued
+  release was cancelled. Version 0.25.1 preserves the tag history and publishes
+  the reviewed change from its actual merged commit.
+- No new hook, network dependency, telemetry or service is installed. Structural
+  checks are not represented as measured improvements in agent outcomes.
+
 ## 0.24.3 — the budget stops being estimated, and two skills stop naming a file they do not ship
 
 Hygiene from the 2026-09-13 family audit (HK-11).

diff --git a/README.md b/README.md
@@ -25,7 +25,10 @@ add` puts this pack — at rank 500.
 Production patterns for building AI agent orchestrators — and for billing the
 LLM access they burn.
 
-Part of the [ssheleg skill family](https://github.com/ssheleg/sshlg-skills).
+Part of the [ssheleg agent harness](https://github.com/ssheleg/sshlg-skills):
+a workbench layer of routing, delivery contracts and evidence around existing
+agent hosts. This pack provides its agent-engineering skills. It does not replace
+the host runtime or provide an OS security boundary.
 
 ---
 
@@ -88,7 +91,7 @@ ACP, AGNTCY, AP2, Agent Skills — so an agent stops guessing.
 model, and the one where most agent bugs actually live: *the biggest performance
 improvements often come from clearly explaining tool usage in the system prompt*, and *even
 small refinements to tool descriptions can yield dramatic improvements*. Before adding a
-retry or a sub-agent, it asks four questions about the text. Seven references —
+retry or a sub-agent, it asks four questions about the text. Eight references —
 `system-prompt.md` (right altitude, enumerated vocabulary, and the three things reasoning
 models changed — starting with **do not add chain-of-thought**), `tools.md` (the
 agent–computer interface, with a worked before/after and poka-yoke), `techniques.md`
@@ -98,6 +101,10 @@ environment's job), `audit.md` (seven tracks, evidence tiers, a plan instead of
 plus **`pi.md` and `pi-sdk.md`, the doctrine as a worked implementation**: Pi read end to
 end, each mechanism matched to the rule it instantiates, its divergences named, and the
 eight extension seams where a permission gate or a context rewrite can actually live.
+`workbench-contracts.md` adds the operating layer around a host: managed install
+ownership, bounded hooks, evidence-bearing handoff, artifact-bound evaluation and
+observation limits, adapted selectively from a pinned ECC review. These are design
+contracts; the pack installs no new hook, service or telemetry collector.
 
 It runs in both directions: **building a harness and auditing somebody else's are one
 checklist read forwards and backwards.** `scripts/audit_agent.py` is the mechanical half —

diff --git a/SKILL-CARD.md b/SKILL-CARD.md
@@ -5,7 +5,7 @@
 | Field | Value |
 |---|---|
 | Pack | `agent-stack` |
-| Version | `0.24.3` |
+| Version | `0.25.1` |
 | Skills | `agent-orchestrator`, `agent-evals`, `agent-interop`, `agent-harness` |
 | License | MIT |
 | Source | https://github.com/ssheleg/agent-stack |

diff --git a/docs/evidence/research/2026-09-21-ecc-handoff.md b/docs/evidence/research/2026-09-21-ecc-handoff.md
@@ -0,0 +1,76 @@
+# Agent-stack ECC transfer — handoff
+
+Objective: improve the agent-engineering component of the ssheleg harness with
+selective ECC methods, keeping existing family contracts and runtime boundaries.
+
+Entry point: [research and transfer matrix](2026-09-21-ecc-harness.md).
+Task packet: [scope, dependencies and checks](../specs/2026-09-21-ecc-harness-brief.md).
+
+## Completed
+
+Implementation commit:
+[`3456965577a19ee3b44816b593304a8c8a0970cc`](https://github.com/ssheleg/agent-stack/commit/3456965577a19ee3b44816b593304a8c8a0970cc).
+Branch: `codex/ecc-harness-contracts`. Prepared version: **0.25.0**.
+The commit link becomes remotely accessible only after the parent pushes it.
+
+- New workbench contract reference with install ownership, hook bounds and
+  failure semantics, durable handoff, artifact-bound eval evidence and observation
+  limits; linked from the skill and layers reference.
+- README positions this pack within the ssheleg agent harness; all release version
+  surfaces synchronized, including the skill card and changelog.
+- ECC pinned with 15 file digests, selected-read scope, attribution and a
+  borrow/adapt/reject matrix. No ECC executable code or runtime dependency added.
+
+## Checks actually run
+
+| Check | Observed result |
+|---|---|
+| `npm test` | EXIT=0: structural checks, plant guard 9 cases, installer 11 cases, audit regressions green |
+| `python3 test/validate.py` after final reference TOC correction | EXIT=0, 15 checks, v0.25.0 |
+| `claude plugin validate . --strict` | EXIT=0, marketplace passed |
+| `claude plugin validate ./plugins/agent-stack --strict` | EXIT=0, plugin passed |
+| make-skill `audit_skill.py plugins/agent-stack/skills/agent-harness --house --quiet` | First run reported missing reference TOC; corrected; final 0 GAP, 19 PASS |
+| `npm pack --dry-run --json` | 40 files; new reference included; research, `.env`, `.agent-sync` and `.git` absent |
+| SHA-256 ledger comparison | All 15 pinned source hashes matched |
+| Relative-link inspection of brief/research | All Markdown relative links resolved |
+| `git diff --check` | EXIT=0 |
+
+The repository validator reports one unavailable check: strict family front-matter
+reader is not found above this standalone checkout. The make-skill house auditor
+ran separately. No behavioral model evaluation was run; structural checks do not
+prove improved outcomes. The nine review cases are contract criteria, not executed
+new-adapter tests. No deployment or npm publication has occurred in this packet.
+
+## Decisions and open work
+
+- Reuse task-pipeline packets, agent-sync coordination and family lifecycle
+  receipts; do not create another session store or global observer.
+- Distinguish kernel and workbench harness meanings. Host capabilities and
+  missing enforcement stay visible.
+- Observatory remains an optional integration proposal here. Its open-source
+  readiness, actual features and publication belong to the parent program.
+- Parent owns independent semantic/security review, push/integration policy,
+  version release, installed-skill refresh, website edits and umbrella pin.
+
+**Exact next task:** independently review the new workbench reference and transfer
+matrix against the pinned sources, then push/integrate the reviewed branch under
+repository policy. Release 0.25.0 only after that review; update the umbrella pin
+and verify the installed/loaded version separately. The prepared change does not
+claim those follow-up operations have happened.
+
+Local-only residue: a read-only temporary ECC clone and package inventory JSON
+used for research remain outside Git. No credential or private project inventory
+was read for this packet. Local advisory coordination claims are released when
+this subtask hands back; the pre-existing foreign expired lease is left untouched.
+
+## Release correction
+
+Parent independently reviewed the new reference and authorized publication. PR
+#33 checks passed at 331f7eb. The initial merge method was rejected by GitHub,
+but a shell command sequence incorrectly continued and tagged the old c681ef3
+commit as v0.25.0. The queued release run 35584412545 was cancelled before
+publication. Repository rules refused deletion; no rules were bypassed and no
+force push was used. The immutable incorrect tag is preserved. Publication now
+targets **0.25.1** with the same reviewed content and this explicit correction.
+Future merge, head verification, tag creation and tag push are separate checked
+operations; a failed step cannot continue to the next mutation.
diff --git a/docs/evidence/research/2026-09-21-ecc-harness.md b/docs/evidence/research/2026-09-21-ecc-harness.md
@@ -0,0 +1,120 @@
+<sub>ssheleg skills — agent-harness · make-skill · task-pipeline · agent-sync</sub>
+
+# ECC → ssheleg harness: selective adoption ledger
+
+Research date: 2026-09-21. Owner: agent-stack / agent-harness. Task packet:
+[bounded brief](../specs/2026-09-21-ecc-harness-brief.md).
+
+## Source boundary
+
+ECC was cloned read-only from `https://github.com/affaan-m/ECC` at
+[`2b6e839771e53096d8451a213d40dc64ec8acac0`](https://github.com/affaan-m/ECC/tree/2b6e839771e53096d8451a213d40dc64ec8acac0).
+Its package declares 2.2.2. The source ledger below names exact files and SHA-256
+values. Source observations are **static inspection**, not execution results.
+No ECC installer, hook, test, package installation or background observer ran.
+The wider repository was inventoried by paths; it was not audited in full.
+
+ECC root LICENSE: MIT, Copyright (c) 2026 Affaan Mustafa. The selected files show
+no separate license headers overriding it. This change adapts methods in newly
+written prose; no implementation, schema, command text or substantial upstream
+text is copied. Do not infer the same review for uninspected assets/subtrees.
+
+Local baseline: agent-stack
+[`c681ef3af6157d13becf53250373b418cca6c919`](https://github.com/ssheleg/agent-stack/tree/c681ef3af6157d13becf53250373b418cca6c919).
+Family comparison: sshlg-skills
+[`564d1f42a895abb8f0f53417695414b74dbf91a5`](https://github.com/ssheleg/sshlg-skills/tree/564d1f42a895abb8f0f53417695414b74dbf91a5),
+README and `lib/lifecycle.js` read. This is a selected-contract comparison, not a
+whole-project audit or a benchmark between the two projects.
+
+## Narrative recommendation
+
+**The ssheleg harness is an operating layer for agent work.** It routes work to
+specialist skills, carries tasks through explicit contracts, preserves evidence
+and resume context, and exposes what is installed and actually loaded. The skill
+family is its expertise layer. Project Observatory can be its optional observation
+component once its own readiness and privacy checks pass.
+
+The host owns model execution and tool permissions. The harness does not promise
+sandboxing, universal hook support or complete leak prevention. Observatory's
+credential requirements and private state are separate from the skills' runtime
+requirements. Avoid calling this a replacement for Claude Code, Codex or other
+agent hosts. Avoid publishing vendor leak counts without reviewed evidence.
+
+## Borrow / adapt / reject
+
+| Method | Verdict and reason | Family owner / destination | Evidence |
+|---|---|---|---|
+| Explicit managed install state, preservation of unowned files | **Adapt.** A skipped write must not grant uninstall ownership. Keep user changes visible. | Installer owner + make-skill; contract in new reference | ECC ownership guard; lifecycle inspection |
+| Installed versus loaded status | **Retain existing family contract.** ECC doctor diagnoses managed files; family already distinguishes disk and reload receipts. No second store. | sshlg-skills lifecycle | ECC doctor; local `lib/lifecycle.js` |
+| Hook profiles and per-hook disable | **Adapt.** Make effective capabilities, effects and failure behavior inspectable. | Host adapter; contract in agent-harness | ECC hook-flags |
+| Input caps and subprocess timeout | **Adapt with stronger bounds.** Input bytes alone do not bound stream duration; subprocess timeout does not bound in-process awaits. | Host adapter | ECC hook-input; run-with-flags lines 249–287 |
+| Fail-open generic hook exception | **Reject as a universal policy.** A required gate must not silently pass when its check failed. This is a design assessment, not an exploit claim. | Host adapter | run-with-flags lines 267–270 and 303–306 |
+| Evidence-bearing save/resume | **Adapt content, retain local format.** Confirmed work, failures and next task are useful; a new global session store would duplicate task-pipeline. | task-pipeline existing handoff | save-session and resume-session |
+| Hash-bound eval receipts and fixture-only replay | **Adapt contract.** Bind candidate, taskset and checker; integrity is distinct from correctness. | agent-evals / existing result envelopes | eval-harness receipt, capsule and architecture |
+| Arbitrary candidate execution | **Do not import.** ECC itself disables it without verified OS containment. Keep that limitation explicit. | Host/environment security boundary | eval-harness gate opening contract |
+| Instinct learning/background observer | **Defer.** Scope, consent, retention, cost and proven improvement need evaluation; do not auto-promote session content globally. | agent-orchestrator memory owner | continuous-learning-v2 SKILL |
+| Entire ECC installer, hook bundle and host configs | **Reject wholesale import.** Adds parallel orchestration and unreviewed dependency closure. | Existing family routers remain entry points | Inventory plus bounded task scope |
+
+ECC observations above are grounded in the source files below. Family policy
+choices (adapt/reject) are author judgment and await parent review; they are not
+measured performance findings. No claim of superiority or outcome improvement.
+
+## Implemented delta and dependency closure
+
+- [Workbench contracts](../../../plugins/agent-stack/skills/agent-harness/references/workbench-contracts.md):
+  new on-demand doctrine and nine review cases.
+- [Harness entry point](../../../plugins/agent-stack/skills/agent-harness/SKILL.md):
+  reference routing and kernel/workbench checklist distinction.
+- [Layer reference](../../../plugins/agent-stack/skills/agent-harness/references/layers.md):
+  explicit broader workbench meaning, preserving kernel responsibilities.
+- README, skill card and synchronized 0.25.0 manifests/changelog.
+
+Runtime additions: none. No new packages, interpreters, services, credentials,
+telemetry, foreign scripts, schema stores or automatic downloads. Existing
+agent-stack audit script still needs Python as before. Research files are Git
+artifacts; only the reference ships inside the skill package.
+
+## Verification limits and next work
+
+Repository tests establish structural/reference/installer regressions. Strict
+plugin validation checks manifest conformance. Package inspection confirms the
+new reference is included and research/private machine state are not. These do
+not measure agent behavior. The nine adapter review cases are design acceptance
+criteria; no new adapter is implemented by this prose change.
+
+Before a future runtime transfer: implement in the existing owning module,
+freeze representative baseline tasks, exercise no-op/conflict/unsupported-host
+and tampered-evidence paths, and record real outcomes under agent-evals. Parent
+review and release evidence are recorded in the adjacent handoff.
+
+## Source digest ledger
+
+`sha256(file bytes)` at the pinned ECC commit; line references above resolve there.
+Sources marked “selected sections” were not semantically audited end to end.
+
+| Source | SHA-256 | Read scope |
+|---|---|---|
+| [LICENSE](https://github.com/affaan-m/ECC/blob/2b6e839771e53096d8451a213d40dc64ec8acac0/LICENSE) | `326146379f01bb137c0a5d3c54770c1aa31076705c8b88a7f6b26a460f6221b2` | full |
+| [package.json](https://github.com/affaan-m/ECC/blob/2b6e839771e53096d8451a213d40dc64ec8acac0/package.json) | `650eaa8de580a3c8eadbc658aa5ffe3f8d50ba2be075dd327a62e1d70e1d7a69` | selected sections |
+| [scripts/lib/install/ownership-guard.js](https://github.com/affaan-m/ECC/blob/2b6e839771e53096d8451a213d40dc64ec8acac0/scripts/lib/install/ownership-guard.js) | `000d8de192edceb32169b8725a797f908256f5a7e124c1803c29328eb07a36cc` | selected sections |
+| [scripts/lib/install-lifecycle.js](https://github.com/affaan-m/ECC/blob/2b6e839771e53096d8451a213d40dc64ec8acac0/scripts/lib/install-lifecycle.js) | `4814affb0f3ffd3648e62a4987ce21d3a5318f6c8d4f5e2069b01e5ecbe5dfe5` | selected sections |
+| [scripts/doctor.js](https://github.com/affaan-m/ECC/blob/2b6e839771e53096d8451a213d40dc64ec8acac0/scripts/doctor.js) | `4ec5a1c7fe9124ebeea5d3d939270a16b0974b789558a8a9cc313cf73ec70b6e` | selected sections |
+| [scripts/lib/hook-flags.js](https://github.com/affaan-m/ECC/blob/2b6e839771e53096d8451a213d40dc64ec8acac0/scripts/lib/hook-flags.js) | `1f5fbf2d2ebd0ab07a3e54406db18c2932ae7bf965513ec12c521da1be54425d` | full |
+| [scripts/hooks/hook-input.js](https://github.com/affaan-m/ECC/blob/2b6e839771e53096d8451a213d40dc64ec8acac0/scripts/hooks/hook-input.js) | `edae519f794befa4cf1dcbfb3c985d0db6f589342b7036ffb7ace61a9c3868b0` | full |
+| [scripts/hooks/run-with-flags.js](https://github.com/affaan-m/ECC/blob/2b6e839771e53096d8451a213d40dc64ec8acac0/scripts/hooks/run-with-flags.js) | `a5b3c3f4ed27f1d9d9c607d6819aab9985ad446239ea7d2825d4b040d2d8d87e` | selected sections |
+| [commands/save-session.md](https://github.com/affaan-m/ECC/blob/2b6e839771e53096d8451a213d40dc64ec8acac0/commands/save-session.md) | `a9488a8819d6c65fe4777f07ea72de6b0c4ee94f90c6bb33b3b8841916222db4` | selected sections |
+| [commands/resume-session.md](https://github.com/affaan-m/ECC/blob/2b6e839771e53096d8451a213d40dc64ec8acac0/commands/resume-session.md) | `b09bcb22feb10adbba50accd5dd97d09b60897aa94d05c6c12b6e579cb69cbac` | full |
+| [scripts/lib/eval-harness/receipt.js](https://github.com/affaan-m/ECC/blob/2b6e839771e53096d8451a213d40dc64ec8acac0/scripts/lib/eval-harness/receipt.js) | `eacacccf8a6d06f38e83c8cee1bb3a6c608e9125115a989fd7f8a7f7e371d5e7` | selected sections |
+| [scripts/lib/eval-harness/capsule.js](https://github.com/affaan-m/ECC/blob/2b6e839771e53096d8451a213d40dc64ec8acac0/scripts/lib/eval-harness/capsule.js) | `fd0bbbde8f383226fbcb093210e0f16594acd9f6ea0ae209e47a37cc39834b0c` | selected sections |
+| [scripts/lib/eval-harness/gate.js](https://github.com/affaan-m/ECC/blob/2b6e839771e53096d8451a213d40dc64ec8acac0/scripts/lib/eval-harness/gate.js) | `76d6613aa7aacb9863c61859d20e554826c6f08e71c10221f0b6fea4d04e3c4f` | selected sections |
+| [docs/architecture/eval-harness-frameworks.md](https://github.com/affaan-m/ECC/blob/2b6e839771e53096d8451a213d40dc64ec8acac0/docs/architecture/eval-harness-frameworks.md) | `eec9ad255f71f68feb4d5e2ee9b2ececef6cd4dc4d1b246d015f3cc047406a61` | selected sections |
+| [skills/continuous-learning-v2/SKILL.md](https://github.com/affaan-m/ECC/blob/2b6e839771e53096d8451a213d40dc64ec8acac0/skills/continuous-learning-v2/SKILL.md) | `ddad12451a0d582c6ef1b197b7be193bef613cbc74eba4117fcb74fc7a4ecd00` | selected sections |
+
+---
+
+**Made with [ssheleg skills](https://github.com/ssheleg/sshlg-skills)**
+
+- [`agent-harness`](https://github.com/ssheleg/agent-stack) — workbench contracts and ECC comparison
+- [`make-skill`](https://github.com/ssheleg/make-skill) — attribution and package checks
+- [`task-pipeline`](https://github.com/ssheleg/task-pipeline) — bounded brief and handoff
+- [`agent-sync`](https://github.com/ssheleg/agent-sync) — local claims for shared metadata