MetaHarness integration — surfaces score/genome/mint/mcp-scan/threat-model via skills; pairs with @metaharness/router (ADR-148/149) for cost-optimal model routing; honors ADR-150 optional-augmentation constraint
5 on GitHubby ruvnetv0.4.0MITupdated 5 days agoupstream
/
Plugin ruflo-metaharness from marketplace moaa in ahmadhammoud56/MOAA. Commands read from the repo's manifest — 5 days ago.
This plugin runs code on your machine — its hooks fire automatically on events like tool use. The exact commands are listed below; read them before installing.
What it installs
Skills (13)
harness-bench
Create (`bench create {repo}`) or verify (`bench verify {suite.json}`) a @metaharness/darwin bench suite, the fixed corpus `harness-evolve --bench` scores variants against. Use when preparing an evolution benchmark. Degrades gracefully without darwin.
harness-drift-from-history
One-command drift detection: run a fresh metaharness audit, diff it against the latest stored audit by ADR-152 similarity, and alert when the distance crosses `--threshold`. Use when checking whether a harness has drifted since its last audit.
harness-evolve
Run `@metaharness/darwin evolve {repo}`: mutate a harness's seven policy surfaces, sandbox-score each variant and promote only measured wins. Use when evolving a harness against its tests or a bench suite. Degrades gracefully without darwin (ADR-150/153).
Load, validate or render a GEPA genome, or classify failure modes in a run transcript, via @metaharness/darwin/gepa. Use when inspecting or auditing a genome; use harness-evolve for sandbox-scored evolution. Degrades gracefully without darwin.
harness-learn
Run a GEPA learning cycle via `metaharness learn`, optimizing a harness genome against a SWE-bench-style slice. Use when training a harness genome. $0 dry-run by default; `--run` opts into spend. Needs a metaharness checkout (--repo or $METAHARNESS_REPO).
harness-mcp-scan
Static security scan of a harness's declared MCP surface via `harness mcp-scan {path}`. Reads `.mcp/servers.json` + `.harness/claims.json`. Pure-read, no dispatch. Exits 1 on findings at or above `--fail-on` severity.
harness-mint
Scaffold a custom AI agent harness via `metaharness new {name} --template {id} --host {id}`. Use when the user wants a new standalone harness. Dry-run unless --confirm is passed, and refuses to write inside the calling repo.
harness-oia-audit
Composite Phase-2 audit worker (ADR-150). Bundles harness oia-manifest + threat-model + mcp-scan into one timestamped audit record stored in the `metaharness-audit` memory namespace. Designed for cron-scheduled drift detection.
harness-score
5-dimension harness readiness scorecard from `metaharness score {path}` (harnessFit, compileConfidence, taskCoverage, toolSafety, memoryUsefulness, plus cost per run). Use when rating a repo as an agent harness. Pure-read; degrades gracefully without MetaHarness.
harness-security-bench
Run `@metaharness/darwin security bench` (Darwin Shield): evolve a security-detection harness on a 10-vuln/9-decoy corpus and grade TPR/FPR/patch/repro against four baselines. Use when benchmarking security-harness detection. Degrades gracefully without darwin.
harness-similarity
Weighted similarity (ADR-152) between two harness fingerprints (genome + score JSON): an overall score in [0,1] plus per-component breakdown. Use when comparing two harnesses or detecting drift between them. Pure TypeScript; needs no @metaharness package.
harness-threat-model
Enterprise-review-grade threat model from `harness threat-model {path}`. Categorizes MCP-surface threats; emits `worst: 'clean'|'low'|'medium'|'high'` + per-threat findings. Pure-read.
A four-tier memory ladder for Claude Code where promotion is earned by recurrence, not asserted by confidence. L0 raw transcripts are never injected; L1 candidate atoms are gitignored and recalled on lexical relevance per prompt; L2 project context loads each session start; L3 stable persona is always loaded. L1 to L2 needs three distinct sessions spanning two distinct calendar days (a stated claim needs two; a verified claim is the only single-observation path); L2 to L3 needs two projects and thirty days. Two gates refuse rather than guess: a claim altered by the redaction pass never promotes on evidence alone, and a contradicted claim freezes until a human resolves it. Three hooks run the loop unattended and every one fails open. Nothing reaches a committed CLAUDE.md without an explicit human adopt. Ships 5 stdlib scripts, 3 hooks, a cs-memory-curator agent, /cs-memory, a JSON schema, and a 69-check validator. Concept from TencentCloud/TencentDB-Agent-Memory (MIT); no upstream code included.
Audit a project's npm, PyPI, and Go dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned upstreams, npm publisher concentration, and install scripts
Ships pull requests to open-source projects you don't maintain — CONTRIBUTING compliance, PR-size/scope checks, minimal-diff implementation, AI-disclosure PR descriptions, and rebase or bot-review replies. Use for 提 PR / 上游 PR / 贡献代码, "open a PR", "fix this upstream", "rebase against main", "respond to the bot review". Not for reviewing PRs as maintainer (use github-review-pr) or general GitHub CRUD (use github-ops).
Assess compliance with the EU General-Purpose AI (GPAI) Code of Practice under the AI Act (Regulation (EU) 2024/1689), Articles 51-56. Covers GPAI model identification (Art. 3(63)), systemic risk model designation (Art. 3(65), Art. 51, 10^25 FLOP training compute threshold), upstream provider obligations under Art. 53 (transparency, technical documentation, copyright policy, training data summary), additional systemic risk obligations under Art. 55 (model evaluation, adversarial testing, AI Office incident notification, cybersecurity), systemic-risk notification and Commission designation under Art. 52, downstream Art. 25 quasi-provider duties, and Art. 53(2) open-source exemption. Built for in-house counsel and AI governance teams reviewing LLM or foundation model deployments, drafting GPAI compliance plans, or assessing systemic risk thresholds. DACH: BaFin, BSI, BNetzA. Pairs with the EU AI Act System Classifier, High-Risk Readiness, FRIA, and Serious Incident Reporting skills.
Research-augmented fork of obra/superpowers. Ships 13 workflow skills (brainstorming, planning, code review, debugging, verification, worktrees, parallel agents) standalone, with no dependency on the upstream superpowers plugin.
13 skills
jamditis/claude-skills-journalism 452
Maintain ruflo-metaharness?
This page updates itself from your repo. Add the badge to your README, or get it Featured to pin it above the organic results with a followed link to your site.