The CRS-served harnesses still carried `secrets_files: [{encrypted: true}]`
which now hard-fails on H-SECRET-1 ("SOPS-encrypted secrets_files entries
are no longer permitted") in the dispatcher's harness validator. Sync the
8 provider harnesses with the agent-runtimes copies: same `secrets_required`
shape, same `init.sh` (ESO-mounted file paths), same `bin/` wrappers.
Use bare `account_ref: "<provider>"` (not `<provider>.cp:cp` — that
scope-kind isn't valid per SR-DISP-1-FIELD).
Provider key names follow the per-provider schema as emitted by the CP
provisioner: minimax/airouter/z-ai → api_key; gitea-https/gitea-admin →
{token,base_url,username}; gitea-ssh* → {host,private_key}.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
planning/v1 is a bare context with no provider credentials; any review node
using it fails with "Not logged in". The correct composite is
planning-minimax-repo/v1 which includes minimax/v1 auth.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
AR-27b filters clone pre_actions when agent-repo is active, so the source
repo was never cloned and the spec was unreachable. Use reference_branches
instead: the source repo is cloned read-only to /workspace/reference/main/
by agent-repo/v1/init.sh.
Both write_tests and review_coverage nodes now declare:
reference_branches:
- repo_url: "{{ repo_url }}"
branch: main
name: main
Prompts updated to read from /workspace/reference/main/{{ spec_file }}
and write output to /workspace/project/{{ test_output_dir }}.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Single-node airouter workflow for one-requirement/one-test tasks.
Optional test_target param focuses the agent on a specific pytest
node ID. Cost-optimised: labels=[airouter], cost_efficiency≥9.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- minimax.yaml: scores copied from Opus (placeholder until real benchmark),
cost 0.0/0.0 (subscription), provider=minimax. Now auto-selectable by
min_scores routing (smart-agent at complexity≥9 will reach it).
- tdd-impl → write-code-following-tdd (name field updated)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Two agents (impl_a: airouter, impl_b: best-complexity model) implement
in parallel against pre-written tests using TDD composites. An audit
node compares both outputs and emits a JSON verdict (pass/more_work_needed,
winner: a/b/neither, gaps). Harnesses are param-overridable for
provider flexibility. F-WE-PDIV note in description for future
unique_providers enforcement.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds the tdd-gate harness context (TEST_PASS_REQUIRED=true + CLAUDE.md
methodology) and five provider-specific TDD composites that layer
tdd-protect + tdd-gate + python-dev + tdd-file-lock on top of the
existing code-* layer stacks. Matching task templates for sonnet, opus,
haiku, minimax, and airouter. allowed_failing_tests support noted in
warnings pending M19 pre-test hook implementation.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add optional provider field (anthropic, openai, alibaba, github,
openrouter, opencode) as groundwork for F-WE-PDIV provider diversity
enforcement in auto-model selection.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Mount best-practices context at /workspace/best-practices/ (was
/opt/harness/context/best-practices/) for consistent agent access
- Fix /workspace/working/ → /workspace/project/ in all CLAUDE.md files
(planning, spec-writing, security-review, code-methodology,
qwen-code-methodology, test-writing)
- Update best-practices path references in all CLAUDE.md files to
/workspace/best-practices/
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
