feat(stage7d): decode + gate + generate — the second half of setup-harness

[thomasluizon]

Stage 7d of the harness-upgrade plan (agentic-dev-workflow). Completes /setup-harness from the interview record onward: decode every rule to its tier → the editable decomposition-table gate → generate a tailored, self-verified harness. Read-only until the gate; nothing enforcing is written before sign-off. Builds on 7a (#1) / 7b (#2) / 7c (#3), all merged.

What lands

New machinery under core/setup/ (dependency-free, cross-platform Node):

Module	Role
decode.mjs	Classify EVERY answer + doc normative statement + adopt candidate to its tier — enforcement→HOOK (git-action/content, or a real LINT rule at the strongest layer), procedure→SKILL, facts→CLAUDE.md/RULE, tool-default→unscoped RULE. Conflicts (interview vs config vs doc) flagged inline, always-ask, never auto-resolved.
gate.mjs	Render ONE editable decomposition table (harness.decomposition.md), parse Tier/Action edits back, apply enforce/soften/drop, refuse to proceed while a conflict is unsettled.
generate.mjs	Build every artifact from the approved rows: hooks.policy.json (dual-target — CC hooks and opencode plugin read it), workflow.config.yaml, CLAUDE.md, .claude/rules/*, lint scaffolds (strongest layer), machine-specialized (investigate/ship) + new bespoke skills.
adopt.mjs	Adopt-vs-reset: back up existing CLAUDE.md/hooks/rules to a timestamped folder, then decompose old prose into decode candidates — nothing lost.
manifest.mjs	Versioned harness.manifest.json — each artifact traced to its answers rows + hashed, so re-run/sync preserve hand-edits.
verify.mjs	Post-generation self-verify: config/policy parse, skills load, and a guardrail dry-run (a protected-branch push must BLOCK against the real logic core) + gaps report. Never throws.

The runbook setup-harness.md gains phases 6–10 (adopt → decode → gate → generate → self-verify), replacing the read-only STOP handoff. READMEs + the skill description + regenerated adapters updated.

Worked-example acceptance table (proven, zero Orbit leakage)

em-dash → hook · TB-#### branch → git-guardrails regex · never co-author → forbidden-trailer hook + omit fact · Confluence docs → decompose-each into its own tier · AWS CLI → tool-default rule · Jira MCP → rule + config. Every value comes from the interview/config — no SDLC constant is baked (a machine that BANS a trailer and one that REQUIRES it decode to opposite rows).

Proof + gates

scripts/test-generate.mjs (wired into CI): the acceptance table, conflict flagging, the gate round-trip, the generators, lint routing, adopt, manifest hand-edit detection, the self-verify guardrail dry-run, a regex answers-YAML round-trip, and never-block. All five gates green locally: genericity · hook-engine · setup (7c) · generate (7d) · adapters-sync.

Bugs surfaced + fixed by the proof: value-less doc rows no longer clobber concrete interview values; conflict detection ignores same-stance and multi-instance subjects; the guardrail dry-run passes policy.git to the logic core (matching the real hook); buildHooksPolicy deep-clones DEFAULT_POLICY (no shared mutation).

7d stops at a generated, self-verified harness. Pipeline wiring = 7e, bootstrap/lifecycle = 7f, /update-harness = 7g, dogfood = 7i.

🤖 Generated with Claude Code