phase-h step 5: skills + embed; delete vendored Python harness

- packages/bcode-browser/skills/ — browsercode-owned. BROWSER.md (the
  agent's prompt for browser_execute, centered on the no-magic /
  workspace-as-plain-code model) + interaction-skills/*.md (verbatim
  initial copy from browser-harness-js@95b7a22a; ours after).
- packages/bcode-browser/script/embed-skills.ts — smaller cousin of the
  retired embed-harness.ts. Walks skills/, emits bcode-skills.gen.ts
  with file map + content-hash buildHash sentinel.
- packages/bcode-browser/src/skills.ts — runtime resolver. Dev: in-tree
  path. Compiled: extracts to <dataDir>/skills/ once per build hash;
  baseline-overwrite (no agent-editable surface; the agent's editable
  surface is per-project <projectDir>/.bcode/agent-workspace/).

- packages/opencode/script/build.ts — swap createEmbeddedHarnessBundle
  for createEmbeddedSkillsBundle; rename bcode-harness.gen.ts ->
  bcode-skills.gen.ts in the Bun.build files map and entrypoints.
- packages/opencode/src/agent/agent.ts — drop harnessGlob/harnessArchive*
  (already dropped in step 2); add browserSkillsGlob pointing at
  Skills.skillsDir(Global.Path.data).
- packages/opencode/src/tool/browser-execute.{ts,txt} — substitute
  {{SKILLS_DIR}} at make-time; prompt points at <skillsDir>/BROWSER.md
  and <skillsDir>/interaction-skills/.

- packages/bcode-browser/{README.md,src/index.ts} — refreshed to reflect
  the new contents; harness column gone.

- DELETE packages/bcode-browser/harness/ entirely (~3400 LOC; the
  largest single deletion of the port). Net hand-written code drop from
  this step alone is ~-2000 LOC even after adding ~600 LOC of TS for
  cdp/, browser-execute.ts, cloud-browser.ts, skills.ts, session-store.ts,
  embed-skills.ts.
- DELETE harness-sync.md (retired with the harness vendoring).
- DELETE script/check-harness-diff.sh; trim harness branch from
  script/check-upstream.sh.
- UPSTREAM.md retitled to track only anomalyco/opencode; old harness
  sync log preserved as historical archaeology.
- memory side: created memory/browsercode/harness_watchlist.md (Phase H
  hard rule #2 mechanism — patterns to track for possible porting later,
  no sync cadence).

Typecheck clean across all browsercode packages. workspace-import
smoke tests still pass.

Author: bcode

UPSTREAM.md

@@ -1,13 +1,12 @@
 # Upstream
 
-This doc tracks BrowserCode's relationship to its two upstream sources:
+This doc tracks BrowserCode's relationship to upstream:
 
 1. **anomalyco/opencode** — forked in as the bulk of this repo. Sync runbook: `opencode-sync.md`.
-2. **browser-use/browser-harness** — vendored into `packages/bcode-browser/harness/`. Sync runbook: `harness-sync.md`.
 
-The two are deliberately independent — different upstreams, different cadences, different sync mechanisms (merge vs file-copy). One agent pulls one upstream at a time; never both in the same PR.
+(Phase H retired the `browser-use/browser-harness` vendoring relationship — see §3 below for the historical record. Browser code now lives in TS at `packages/bcode-browser/src/cdp/`, owned by us, no sync cadence.)
 
-Sections: **modification zones** (where is it safe to change upstream code?), **sync log** (when did we last pull each upstream and to what commit?), **harness divergences** (per-file deliberate-deltas list, used during harness sync).
+Sections: **modification zones** (where is it safe to change upstream code?), **sync log** (when did we last pull upstream and to what commit?), **harness retirement** (what happened to the vendored Python harness).
 
 ---
 
@@ -54,7 +53,7 @@ Future Yellow modifications (per ROADMAP):
 
 Every Yellow modification should be evaluated for conversion to a Green extension point via upstream PR. See decisions.md §1c and ROADMAP F8.
 
-The harness has its own narrower zone policy (see §3 below): `agent-workspace/agent_helpers.py` is editable, the `src/browser_harness/` core package is protected, deliberate divergences are logged per-file.
+(The harness's narrower zone policy retired with Phase H — see §3.)
 
 ---
 
@@ -98,9 +97,11 @@ Each upstream has its own append-only table. Add a row every time you pull.
 
 ---
 
-## 3. Harness divergences and excluded paths
+## 3. Harness retirement (historical)
 
-Per-file record of where `packages/bcode-browser/harness/` deliberately differs from upstream, plus the list of paths excluded from the vendored tree entirely. Read this *before* a sync diff so intentional differences aren't mistaken for missing features and excluded paths aren't accidentally re-imported.
+Phase H (TS port, v0.1.0) retired the `browser-use/browser-harness` vendoring. The Python harness was deleted; the CDP layer was ported to TS at `packages/bcode-browser/src/cdp/` (initial copy from `browser-use/browser-harness-js@95b7a22a`, ours after — see `packages/bcode-browser/src/cdp/PROVENANCE.md`). There is no sync cadence with either harness repo; behaviors of interest from either are tracked in `memory/browsercode/harness_watchlist.md` and ported individually as needed.
+
+The historical sync log of the Python harness vendoring (Apr 26 – May 6, 2026) is preserved below for archaeology only; do not pull from those rows.
 
 Path-allowlist policy (decisions.md §3.7, §4.5; updated for upstream PR #229 src-layout reorg):
 

harness-sync.md

@@ -4,17 +4,19 @@ Level-1 BrowserCode package: substantial, self-contained code with zero upstream
 
 See `decisions.md §1c` (three-level model) and `§1d` (this package) in the BrowserCode project memory.
 
-## Contents (planned)
+## Contents
 
-| Path | Purpose | Roadmap phase |
-|---|---|---|
-| `harness/` | Vendored `browser-use/browser-harness` | A2 (vendored; tracking via `UPSTREAM.md`) |
-| `src/browser-execute/` | `browser_execute` tool body | A4 |
-| `src/fetch-use/` | `FetchUse.Service` implementation | B1 |
-| `src/cloud/` | Cloud deploy, skillbase, judge clients | D3–D4 |
+| Path | Purpose |
+|---|---|
+| `src/cdp/` | Vendored CDP layer (`session.ts`, `gen.ts`, `generated.ts`, protocol JSONs). Initial copy from `browser-use/browser-harness-js`; ours after — see `src/cdp/PROVENANCE.md`. |
+| `src/browser-execute.ts` | In-process JS-eval `browser_execute` body. |
+| `src/cloud-browser.ts` | Browser Use cloud-browser provision + attach. |
+| `src/session-store.ts` | Per-opencode-session CDP `Session` map shared by both browser tools. |
+| `src/skills.ts` | Runtime resolver for embedded skills (extract on first call in compiled mode; in-tree path in dev). |
+| `skills/` | `BROWSER.md` (the agent's prompt for `browser_execute`) plus `interaction-skills/*.md` (UI mechanic reference docs). Embedded into the binary by `script/embed-skills.ts`. |
+| `script/embed-skills.ts` | Build-time embed; emits `bcode-skills.gen.ts` consumed by the compiled binary. |
+| `test/` | `bun test` smoke coverage for the workspace dynamic-import pattern. |
 
-Integration into `packages/opencode` (tool registration, service wiring, CLI commands) is Level 2 and lives in `packages/opencode/src`. Per the one-line-hook rule, those hooks are pointers only — all logic lives here.
-
-## Upstream tracking
+Planned (per ROADMAP phase): `src/fetch-use/` (B1), `src/cloud/` deploy/skillbase/judge clients (D3–D4).
 
-Single source of truth: root-level `UPSTREAM.md`. Sync log across both upstreams (opencode + harness), modification zones, and per-file harness divergences. Sync runbook: `harness-sync.md` at repo root.
+Integration into `packages/opencode` (tool registration, service wiring, CLI commands) is Level 2 and lives in `packages/opencode/src`. Per the one-line-hook rule, those hooks are pointers only — all logic lives here.