Add tdd-gate context, *-code-tdd-repo composites, and TDD task templates

Adds the tdd-gate harness context (TEST_PASS_REQUIRED=true + CLAUDE.md
methodology) and five provider-specific TDD composites that layer
tdd-protect + tdd-gate + python-dev + tdd-file-lock on top of the
existing code-* layer stacks. Matching task templates for sonnet, opus,
haiku, minimax, and airouter. allowed_failing_tests support noted in
warnings pending M19 pre-test hook implementation.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

harnesses/composites/code-airouter-tdd-repo/v1/harness.yaml

@@ -0,0 +1,15 @@
+kind: composite
+name: code-airouter-tdd-repo
+version: 1
+description: "Airouter Qwen3.6 code agent with TDD enforcement — tests locked read-only, must pass before finish"
+
+layers:
+  - context: qwen-code-methodology/v1
+  - context: best-practices/v1
+  - context: airouter/v1
+  - context: gitea-ssh/v1
+  - context: agent-repo/v1
+  - context: tdd-protect/v1
+  - context: tdd-gate/v1
+  - capability: python-dev/v1
+  - capability: tdd-file-lock/v1

harnesses/composites/code-haiku-tdd-repo/v1/harness.yaml

@@ -0,0 +1,14 @@
+kind: composite
+name: code-haiku-tdd-repo
+version: 1
+description: "Haiku code agent with TDD enforcement — tests locked read-only, must pass before finish"
+
+layers:
+  - context: code-methodology/v1
+  - context: anthropic-cloud/v1
+  - context: gitea-ssh/v1
+  - context: agent-repo/v1
+  - context: tdd-protect/v1
+  - context: tdd-gate/v1
+  - capability: python-dev/v1
+  - capability: tdd-file-lock/v1

harnesses/composites/code-minimax-tdd-repo/v1/harness.yaml

@@ -0,0 +1,14 @@
+kind: composite
+name: code-minimax-tdd-repo
+version: 1
+description: "MiniMax code agent with TDD enforcement — tests locked read-only, must pass before finish"
+
+layers:
+  - context: minimax-code-methodology/v1
+  - context: minimax/v1
+  - context: gitea-ssh/v1
+  - context: agent-repo/v1
+  - context: tdd-protect/v1
+  - context: tdd-gate/v1
+  - capability: python-dev/v1
+  - capability: tdd-file-lock/v1

harnesses/composites/code-opus-tdd-repo/v1/harness.yaml

@@ -0,0 +1,14 @@
+kind: composite
+name: code-opus-tdd-repo
+version: 1
+description: "Opus code agent with TDD enforcement — tests locked read-only, must pass before finish"
+
+layers:
+  - context: code-methodology/v1
+  - context: anthropic-cloud/v1
+  - context: gitea-ssh/v1
+  - context: agent-repo/v1
+  - context: tdd-protect/v1
+  - context: tdd-gate/v1
+  - capability: python-dev/v1
+  - capability: tdd-file-lock/v1

harnesses/composites/code-sonnet-tdd-repo/v1/harness.yaml

@@ -0,0 +1,14 @@
+kind: composite
+name: code-sonnet-tdd-repo
+version: 1
+description: "Sonnet code agent with TDD enforcement — tests locked read-only, must pass before finish"
+
+layers:
+  - context: code-methodology/v1
+  - context: anthropic-cloud/v1
+  - context: gitea-ssh/v1
+  - context: agent-repo/v1
+  - context: tdd-protect/v1
+  - context: tdd-gate/v1
+  - capability: python-dev/v1
+  - capability: tdd-file-lock/v1

harnesses/contexts/tdd-gate/v1/CLAUDE.md

@@ -0,0 +1,34 @@
+# TDD Gate — Tests Must Pass
+
+You are operating in TDD mode. The test suite defines correctness. **You must not finish until all tests pass.**
+
+## Rules
+
+1. **Run the full test suite before committing.** Every change must be followed by a test run.
+2. **A red test suite is not acceptable output.** If tests fail, keep working.
+3. **Never skip, comment out, or delete tests.** Tests are read-only (OS-enforced). Any attempt to modify them will fail.
+4. **Never use `pytest --ignore`, `-k "not ..."`, or `--deselect` to hide failures.** The passing criterion is `pytest` with no filters.
+5. **Fix the implementation, not the tests.** If a test looks wrong, you are wrong.
+6. **Commit only when green.** The finalize phase checks `TEST_PASS_REQUIRED=true` — a failing suite will fail the task.
+
+## Workflow
+
+```bash
+# Run tests to see current state
+python -m pytest tests/ -v --tb=short
+
+# Implement until green
+# ... edit source files ...
+
+python -m pytest tests/ -v --tb=short
+
+# Only when all green:
+# finalize will commit and push via agent-repo
+```
+
+## If you are stuck
+
+- Read the failing test to understand exactly what it expects
+- Read the spec (if present at `/workspace/project/spec/`) for the subsystem under test
+- Check the error message carefully — most failures have a clear root cause
+- Do not attempt workarounds that hide failures; fix the underlying behaviour

harnesses/contexts/tdd-gate/v1/harness.yaml

@@ -0,0 +1,13 @@
+kind: context
+name: tdd-gate
+version: 1
+description: "TDD enforcement: agent must get all tests passing before finishing. Compose on top of code-methodology."
+requires: []
+provides: [tdd-gate]
+
+env:
+  TEST_PASS_REQUIRED: "true"
+
+context_files:
+  - source: ./CLAUDE.md
+    target: /opt/harness/context/tdd-gate/CLAUDE.md

task-templates/airouter-code-tdd.yaml

@@ -0,0 +1,27 @@
+name: airouter-code-tdd
+description: "Airouter Qwen3.6 code agent with TDD enforcement — agentic runner, tests read-only, must pass before finish"
+harness: code-airouter-tdd-repo/v1
+model: Qwen3.6
+runtime_cli: agentic
+requires_tags: [agentic-runner, coding-agent, git-access, project-repo, best-practices, tdd-gate]
+required_params: [repo_url, agent_repo_url]
+labels: [airouter]
+defaults:
+  timeout: 3600
+  max_turns: 100
+pre_actions:
+  - type: clone
+    repo: "{{ repo_url }}"
+    branch: main
+    depth: 1
+blocked_combinations:
+  - field: on_success
+    contains_type: commit_pr
+    message: "Use agent_repo instead of commit_pr — avoids F77 SSH alias URL bug"
+warnings:
+  - "Airouter agents have no web search — all context must be in the repo or prompt"
+  - "Hard cap: 3 concurrent airouter tasks (DISPATCHER_MAX_TASKS=3 on airouter dispatcher)"
+  - "Test files are locked read-only at the OS level — agent cannot modify them"
+  - "Task will be marked failed if the test suite is not green on completion"
+  - "Use narrow, single-file or single-requirement tasks for best results"
+  - "allowed_failing_tests support requires M19 (pre-test hook) to be deployed"

task-templates/haiku-code-tdd.yaml

@@ -0,0 +1,22 @@
+name: haiku-code-tdd
+description: "Haiku code agent with TDD enforcement — tests are read-only and must pass before the task finishes"
+model: haiku
+harness: code-haiku-tdd-repo/v1
+requires_tags: [claude-code, coding-agent, git-access, project-repo, tdd-gate]
+required_params: [repo_url, agent_repo_url]
+defaults:
+  timeout: 1800
+pre_actions:
+  - type: clone
+    repo: "{{ repo_url }}"
+    branch: main
+    depth: 1
+blocked_combinations:
+  - field: on_success
+    contains_type: commit_pr
+    message: "Use agent_repo instead of commit_pr — avoids F77 SSH alias URL bug"
+warnings:
+  - "Test files are locked read-only at the OS level — agent cannot modify them"
+  - "Task will be marked failed if the test suite is not green on completion"
+  - "Haiku is best for narrow, well-scoped TDD tasks — avoid broad refactors"
+  - "allowed_failing_tests support requires M19 (pre-test hook) to be deployed"

task-templates/minimax-code-tdd.yaml

@@ -0,0 +1,23 @@
+name: minimax-code-tdd
+description: "MiniMax code agent with TDD enforcement — tests are read-only and must pass before the task finishes"
+model: minimax
+harness: code-minimax-tdd-repo/v1
+requires_tags: [coding-agent, git-access, project-repo, tdd-gate]
+required_params: [repo_url, agent_repo_url]
+defaults:
+  timeout: 3600
+pre_actions:
+  - type: clone
+    repo: "{{ repo_url }}"
+    branch: main
+    depth: 1
+blocked_combinations:
+  - field: on_success
+    contains_type: commit_pr
+    message: "Use agent_repo instead of commit_pr — avoids F77 SSH alias URL bug"
+warnings:
+  - "MiniMax agents have no web search — all context must be in the repo or prompt"
+  - "Test files are locked read-only at the OS level — agent cannot modify them"
+  - "Task will be marked failed if the test suite is not green on completion"
+  - "Keep prompts directive and specific — MiniMax works best with tightly scoped tasks"
+  - "allowed_failing_tests support requires M19 (pre-test hook) to be deployed"

task-templates/opus-code-tdd.yaml

@@ -0,0 +1,21 @@
+name: opus-code-tdd
+description: "Opus code agent with TDD enforcement — tests are read-only and must pass before the task finishes"
+model: opus
+harness: code-opus-tdd-repo/v1
+requires_tags: [claude-code, coding-agent, git-access, project-repo, tdd-gate]
+required_params: [repo_url, agent_repo_url]
+defaults:
+  timeout: 3600
+pre_actions:
+  - type: clone
+    repo: "{{ repo_url }}"
+    branch: main
+    depth: 1
+blocked_combinations:
+  - field: on_success
+    contains_type: commit_pr
+    message: "Use agent_repo instead of commit_pr — avoids F77 SSH alias URL bug"
+warnings:
+  - "Test files are locked read-only at the OS level — agent cannot modify them"
+  - "Task will be marked failed if the test suite is not green on completion"
+  - "allowed_failing_tests support requires M19 (pre-test hook) to be deployed"

task-templates/sonnet-code-tdd.yaml

@@ -0,0 +1,21 @@
+name: sonnet-code-tdd
+description: "Sonnet code agent with TDD enforcement — tests are read-only and must pass before the task finishes"
+model: sonnet
+harness: code-sonnet-tdd-repo/v1
+requires_tags: [claude-code, coding-agent, git-access, project-repo, tdd-gate]
+required_params: [repo_url, agent_repo_url]
+defaults:
+  timeout: 3600
+pre_actions:
+  - type: clone
+    repo: "{{ repo_url }}"
+    branch: main
+    depth: 1
+blocked_combinations:
+  - field: on_success
+    contains_type: commit_pr
+    message: "Use agent_repo instead of commit_pr — avoids F77 SSH alias URL bug"
+warnings:
+  - "Test files are locked read-only at the OS level — agent cannot modify them"
+  - "Task will be marked failed if the test suite is not green on completion"
+  - "allowed_failing_tests support requires M19 (pre-test hook) to be deployed"