Shows the implemented command list.
Creates .harness/ in the current project.
Options:
--dry-run: show planned creates/skips without writing files.--force: rewrite known managed.harness/files only.--agent none|codex|claude-code|gemini-cli|both: record a requested adapter. Init records the request but does not install adapters.
Read-only workflow resolver for the current project.
Options:
--task <task-slug>: inspect one explicit existing task. When more than one task exists, omitting this option returns task-selection guidance instead of choosing implicitly.--json: emit deterministic machine-readable workflow status.
The command derives the selected task, current phase, one outcome (NEXT, REVIEW_REQUIRED, BLOCKED, or COMPLETE), the next valid command or human action, four Lineage freshness states, generated-handoff state, validation currentness, integrity state, and bounded findings. It does not persist an active task or modify files. COMPLETE means the Harness workflow record is complete; it is not correctness, security, compliance, approval, or release readiness.
A developer may inspect status directly. Repository Agent Skills use --json as a workflow navigator and can repeat routine bounded NEXT actions without requesting approval after each command. The coding agent, not Harness, performs those actions; it must stop for human authority decisions, unavailable required information, consequential ambiguity, or BLOCKED.
Installs one or all native repository Agent Skills generated by the Python package.
Options:
--dry-run: show planned adapter changes without writing files.--force: restore or refresh only an existing Harness-managed adapter skill.
The managed paths are .agents/skills/ai-sdlc-harness/SKILL.md, .claude/skills/ai-sdlc-harness/SKILL.md, and .gemini/skills/ai-sdlc-harness/SKILL.md. Installation requires an initialized Harness, refuses unmanaged-file collisions before writing, and never modifies root AGENTS.md, CLAUDE.md, or GEMINI.md.
The generated skill guides an already-running coding agent; it does not make Harness launch or orchestrate Codex, Claude Code, or Gemini CLI. The skill preserves human authority and tells the agent when routine progression must stop for the developer.
Read-only integrity check for .harness/ structure, parseable files, selected optional pack records, and protected file hashes.
verify checks manifest and file integrity only. It does not inspect implementation semantics, run tests, scan for security issues, validate compliance, prove correctness, approve work, or determine release readiness.
Creates a task-readiness report at .harness/tasks/<task-slug>/preflight.md.
Options:
--task <task-slug>: required existing task slug created bytask start.--dry-run: print the report path and summary without writing files.--force: rewrite only manifest-managedpreflight.mdfor the selected task.
The command requires ai-sdlc init first and an existing task folder. It checks shallow repository markers, selected pack records, and task artifact readiness. It does not perform semantic validation, security scanning, pack enforcement, AI review, or application code changes.
Existing unmanaged preflight.md files are not overwritten, even with --force.
Creates a deterministic Markdown implementation-intent spec at .harness/tasks/<task-slug>/spec.md and an advisory structured requirements projection at .harness/tasks/<task-slug>/requirements.yaml.
Options:
--task <task-slug>: required existing task slug created bytask start.--dry-run: print the spec and requirements paths and summary without writing files.--force: rewrite only manifest-managedspec.mdandrequirements.yamlfor the selected task.
The command requires ai-sdlc init first and an existing task folder. It consolidates existing task artifacts and readable preflight.md findings into blocker, warning, and info signals. Missing, unreadable, empty, or TODO-only task sections are recorded as findings in the generated Markdown instead of stopping report generation.
requirements.yaml is generated from explicit list items in acceptance.md and is advisory, not authoritative. To change requirements, edit source task artifacts and rerun spec.
Existing unmanaged spec.md or requirements.yaml files are not claimed or overwritten, even with --force. Hash-drifted manifest-managed spec artifacts are refused unless --force is used. The command never overwrites task input files, root AGENTS.md, root CLAUDE.md, root GEMINI.md, .harness/generated/agent-instructions.md, generated handoff files, evidence reports, validation reports, packs, or adapter skills.
The command does not ask interactive questions, call AI models, import requirements, run tests, inspect target code deeply, scan security, validate compliance, enforce packs, prove correctness, determine approval, or determine release-readiness.
Creates a test-contract readiness review at .harness/tasks/<task-slug>/test-contract-review.md.
Options:
--task <task-slug>: required existing task slug created bytask start.--dry-run: print the report path and summary without writing files.--force: rewrite only manifest-managedtest-contract-review.mdfor the selected task.
The command requires ai-sdlc init first and an existing task folder. It reviews existing acceptance and planned test intent from test-contract.md, together with any verification results recorded in verification.md, using shallow marker-based checks. It does not generate tests, run tests, enforce pack semantics, determine compliance, execute packs, call AI models, or change application code.
Existing unmanaged test-contract-review.md files are not claimed or overwritten, even with --force. The command never overwrites test-contract.md.
Creates a deterministic generated pair at .harness/tasks/<task-slug>/generated/agent-workset.md and .harness/tasks/<task-slug>/generated/context-manifest.yaml.
Options:
--task <task-slug>: required existing task slug created bytask start.--dry-run: print the workset path and summary without writing files.--force: rewrite only the two manifest-managed generate-owned outputs for the selected task.
The command requires ai-sdlc init first and an existing task folder. It compiles bounded excerpts from required task artifacts, optional readiness reports when present, optional spec.md, optional requirements.yaml, optional selected pack records, repository signals, coding-agent instructions, warnings, and a completion evidence checklist.
Required task inputs:
task.mdacceptance.mdarchitecture-notes.mdcoupling-notes.mdtest-contract.mdverification.mdevidence.md
The command fails if a required input is missing or unreadable. It does not fail only because preflight.md or test-contract-review.md is missing; missing readiness reports are recorded as warnings in the workset.
Existing unmanaged generate-owned outputs are not claimed or overwritten, even with --force. The command never overwrites task input files, root AGENTS.md, root CLAUDE.md, root GEMINI.md, or .harness/generated/agent-instructions.md.
The workset is the human-readable pre-implementation handoff. The context manifest records the exact selected context, budgets, hashes, findings, and workset linkage for the same generation snapshot. The command does not call AI models, generate code, generate tests, run tests, install adapters, enforce packs, determine compliance, execute packs, or perform semantic validation.
Creates a deterministic task-scoped evidence report at .harness/tasks/<task-slug>/evidence-report.md.
Options:
--task <task-slug>: required existing task slug created bytask start.--dry-run: print the report path and summary without writing files.--force: rewrite only manifest-managedevidence-report.mdfor the selected task.
The command requires ai-sdlc init first and an existing task folder. It summarizes recorded task artifacts, readiness reports when present, manifest-managed task artifact signals, evidence.md, and verification.md. Missing, unreadable, empty, or TODO-only evidence notes are reported as review readiness signals in the generated report.
Existing unmanaged evidence-report.md files are not claimed or overwritten, even with --force. The command never overwrites task input files, root AGENTS.md, root CLAUDE.md, root GEMINI.md, .harness/generated/agent-instructions.md, or the generated handoff pair.
The command summarizes recorded evidence only. It does not run tests, prove correctness, validate compliance, scan for security issues, perform AI review, execute packs, enforce packs, call AI models, generate code, generate tests, or change application code.
Creates a deterministic task workflow validation report at .harness/tasks/<task-slug>/validation-report.md.
Options:
--task <task-slug>: required existing task slug created bytask start.--dry-run: print the report path and summary without writing files.--force: rewrite only manifest-managedvalidation-report.mdfor the selected task.
The command requires ai-sdlc init first and an existing task folder. It summarizes task artifacts, generated reports, manifest-managed task artifact signals, open blocker and warning lines from generated reports, workflow consistency checks, and findings for human review. Missing, unreadable, empty, or TODO-only task artifacts are recorded as blocker findings in the generated report instead of stopping report generation.
Existing unmanaged validation-report.md files are not claimed or overwritten, even with --force. A hash-drifted manifest-managed validation-report.md is refused unless --force is used. The command may report missing or hash-drifted manifest-managed task artifacts, but it only creates or refreshes validation-report.md.
The command never overwrites task input files, root AGENTS.md, root CLAUDE.md, root GEMINI.md, .harness/generated/agent-instructions.md, the generated handoff pair, preflight.md, test-contract-review.md, or evidence-report.md.
The command reports review readiness signals for human review. It does not approve work, run tests, prove correctness, validate compliance, scan for security issues, perform AI review, execute packs, enforce packs, call AI models, generate code, generate tests, or change application code.
Creates task-level template artifacts under .harness/tasks/<task-slug>/.
Options:
--dry-run: show planned creates/skips without writing files.--force: rewrite only task files already recorded as manifest-managed for that task.
The command requires ai-sdlc init first. It generates a safe slug from the human-readable title and never uses the raw title as a path. Normal titles may include / or \; clearly unsafe path-like values such as traversal, absolute paths, Windows drive paths, NUL-containing input, or titles that produce an empty unsafe slug are rejected.
Created files:
task.mdacceptance.mdarchitecture-notes.mdcoupling-notes.mdtest-contract.mdverification.mdevidence.md
Existing unmanaged task files are not overwritten, even with --force.
These commands require v1.1.0 or later. They are advisory additions to the existing workflow; a reviewer record does not approve a task or change the outcome of status or validate.
Creates a new .harness/tasks/<task-slug>/reviews/<review-id>/ folder containing:
handoff.md: instructions for a fresh review session, explicit file scope, requirements, protected behavior, verification expectations, and implementation evidence labeled as claims.snapshot.json: exact-byte hashes of selected files and all seven task source files, plus a combined candidate digest. Do not edit it.result.json: a pending result template for the reviewer to complete.
Repeat --file for every relevant source, test, and configuration file. Use repository-relative paths with forward slashes. Scope is explicit: unselected files, new unselected files, runtime dependencies, and the external environment are not covered. A selected missing file is recorded as absent so its later creation is detected. Include the paths of relevant deleted files too. Files must be UTF-8 text, at most 256 KB each, with up to 100 selected paths and 4 MB of total candidate content. Known secret-file names, linked paths, and internal Harness paths cannot be selected.
Preparation never launches a model or executes checks. Open the handoff using your existing tools in a fresh session; another model is optional. Record only observed results and explicit limitations. Hashes establish currentness, not authenticity; the reviewer identity, check execution, and fresh-context declaration are self-reported. The local records are editable and are not a signed audit trail.
Example completed result.json (retain the actual candidate_digest from your template):
{
"schema_version": 1,
"candidate_digest": "<retain the digest from your template>",
"reviewer": {
"name": "Reviewer name",
"model": "Model used, or empty for a human review",
"session": "Your session reference, if available",
"fresh_context": "yes"
},
"verdict": "changes_requested",
"summary": "The timeout boundary needs a regression check.",
"checks": [
{
"command": "python -m pytest tests/test_example.py",
"mode": "executed",
"outcome": "passed",
"observation": "Observed 4 passed in this review session."
},
{
"command": "Integration test log",
"mode": "reviewed",
"outcome": "unknown",
"observation": "Read an earlier log; did not repeat its checks."
}
],
"findings": [
{
"severity": "warning",
"message": "Confirm the timeout boundary and add the missing case.",
"path": "src/example.py",
"line": 12
}
],
"limitations": ["Integration checks were not rerun."]
}Use the exact fields shown; additional fields are rejected. fresh_context accepts yes, no, or unknown. Verdicts are pending, changes_requested, no_findings, or inconclusive. Completed records need a reviewer name and summary. Each check has mode executed, reviewed, or not_run and outcome passed, failed, skipped, or unknown; not_run requires skipped and an omission reason in observation. A reviewed check records an assessment of existing evidence, never a rerun. Findings use severity info, warning, or blocker; path must be in the candidate scope or null, and line must be a positive integer with a path, or null. no_findings cannot accompany findings or failed checks. Lists are limited to 100 entries and text fields to 10,000 characters; the entire result must fit the 256 KB read limit.
Reads the most recent 50 review records, newest first, and reports omitted older records. States are not_requested, pending, missing, invalid, stale, and current. Current means the completed record still matches its selected inputs; it is not approval or a correctness verdict. Edits to selected code or any of the seven task inputs make a valid record stale. Unsafe, malformed, or unreadable records remain invalid. Prepare a new handoff after relevant edits; existing folders are never overwritten. These human-owned review records are separate from manifest-managed generated artifacts.
Starts a read-only report on 127.0.0.1, using a free port by default. Open the private session URL printed in the terminal. Keep the command running; press Ctrl+C to stop it. --port selects a port from 0 through 65535, where 0 chooses a free one. --json prints a single redacted inspection instead of starting the server. Without --task, selection follows normal Harness status behavior; the page also offers a task selector.
The page has four views: Overview, Needs your attention, Verification & evidence, and Changes & artifacts. Refresh rereads existing files without generating reports, running checks, modifying records, or making decisions. Changes made while inspecting are retried within a bound; if a consistent inspection cannot be obtained, refresh fails visibly and the page labels the previous snapshot outdated.
Code references open bounded local excerpts in the page with line numbers and a copyable repository-relative reference for your editor. They do not launch an editor or expose an arbitrary file endpoint. Stale findings do not point to a line in newly edited code as if it were still the reviewed candidate. Excerpts are limited to 120 lines and 20,000 characters; missing, unsafe, oversized, and unresolved files are labeled explicitly. Workflow findings reuse the existing bounded status summary; inspect the original artifacts for complete details. There is no inferred execution timeline or percentage-complete claim.
The server uses a random session URL, loopback binding, host/origin checks, no cross-origin API access, no external page assets, and a restrictive content policy. Keep the URL local; anyone able to use the session URL on your machine can inspect its permitted report. Obvious secret tokens and credential assignments are redacted, but this is not a comprehensive secret scanner. Inspect your task inputs before sharing them with a reviewer. The report is intended for your trusted local workspace, not for hosting untrusted projects or publishing on the network.