chore(test): install audit-harness v0.1.0 (P6 batch)

Per IS Testing SOP and VPS-as-the-home Priority 6 (OPS-z9b).
Vendored install + CLAUDE.md § Testing baseline + 000-docs entry.
Pattern matches the canonical pilot in jeremylongshore/
Hybrid-ai-stack-intent-solutions PR #4.

Worktree-based install: main checkout had uncommitted work; install
performed via git worktree at /tmp/ai-devops-intent-solutions-p6 to avoid disturbing
operator's in-progress changes.Refs jeremylongshore/intentsolutions-vps-runbook#2

jeremylongshore.com made me do it
  -claude
intentsolutions.io

Author: jeremylongshore

.audit-harness/CHANGELOG.md

@@ -0,0 +1,28 @@
+# Changelog
+
+All notable changes to `@intentsolutions/audit-harness` are documented here.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.1.0] — 2026-04-21
+
+Initial release. Extracted from the `audit-tests` Claude Code skill v7.0.0 to enable in-repo enforcement without global skill installation.
+
+### Added
+
+- `audit-harness verify` — SHA-256 hash verification for pinned policy files
+- `audit-harness init` — initialize/re-init the `.harness-hash` manifest
+- `audit-harness list` — list pinned files
+- `audit-harness escape-scan` — detect AI escape patterns in a diff (coverage threshold lowering, test deletion, architecture bypasses, test skip markers)
+- `audit-harness arch` — dispatch language-appropriate architecture checker (dependency-cruiser / import-linter / ArchUnit / deptrac / arch-go)
+- `audit-harness bias` — count common test-bias patterns
+- `audit-harness gherkin-lint` — advisory Gherkin quality check
+- `audit-harness crap` — CRAP (Complexity × Coverage) scorer for Python, JS/TS, Go, Rust
+
+### Key design decisions
+
+- **Scripts stay as shell/python.** Not a TypeScript port — battle-tested implementations, language-portable, minimal dependencies.
+- **Thin Node CLI.** `bin/audit-harness.js` is a dispatcher only; all logic lives in `scripts/`.
+- **Policy-driven thresholds.** `escape-scan.sh` reads floors from `tests/TESTING.md` in the target repo, not from the script source.
+- **Zero runtime dependencies** beyond Node 18+, bash, and Python 3 (only if using `crap` command).

.audit-harness/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jeremy Longshore / Intent Solutions
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

.audit-harness/README.md

@@ -0,0 +1,135 @@
+# @intentsolutions/audit-harness
+
+Deterministic test-enforcement toolkit. Companion to the `audit-tests` and `implement-tests` Claude Code skills — but usable standalone in any repo that wants hash-pinned, escape-scanned, AI-proof quality gates.
+
+## What it is
+
+A small CLI wrapping 6 deterministic scripts:
+
+| Command | Purpose |
+|---|---|
+| `audit-harness verify` | Verify hash-pinned artifacts haven't changed since `--init` |
+| `audit-harness init` | Pin the current state of engineer-owned policy files |
+| `audit-harness list` | Show pinned files |
+| `audit-harness escape-scan --staged` | Detect AI attempts to lower test thresholds, delete tests, bypass architecture rules |
+| `audit-harness arch` | Run language-appropriate architecture-rule checker (dependency-cruiser / import-linter / ArchUnit / deptrac / arch-go) |
+| `audit-harness bias` | Count common test-bias patterns |
+| `audit-harness gherkin-lint` | Advisory Gherkin quality check |
+| `audit-harness crap` | CRAP (Complexity × Coverage) scorer — Python, Go, JS/TS, Rust |
+
+## Install
+
+```bash
+pnpm add -D @intentsolutions/audit-harness
+# or: npm install --save-dev @intentsolutions/audit-harness
+# or: yarn add --dev @intentsolutions/audit-harness
+```
+
+## Quick usage
+
+### Pre-commit hook (`.husky/pre-commit`)
+
+```bash
+#!/usr/bin/env sh
+pnpm exec audit-harness escape-scan --staged
+pnpm exec audit-harness verify
+```
+
+### CI workflow (`.github/workflows/ci.yml`)
+
+```yaml
+  containment:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v5
+      - uses: actions/setup-node@v6
+        with: { node-version: '20', cache: 'pnpm' }
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm exec audit-harness verify
+      - run: pnpm exec audit-harness escape-scan --range origin/main..HEAD
+```
+
+### Engineer workflow — change a policy threshold
+
+```bash
+# 1. Edit tests/TESTING.md to change coverage.line from 80 to 75
+# 2. Re-init to accept the change
+pnpm exec audit-harness init
+# 3. Commit the updated manifest alongside the policy change
+git add tests/TESTING.md .harness-hash
+git commit -m "chore(test): lower coverage floor to 75"
+```
+
+## The containment model
+
+The harness enforces this rule: **policy changes must be conscious, not silent.**
+
+Engineer-owned files (`tests/TESTING.md`, `features/*.feature`, `.dependency-cruiser.cjs`, `stryker.conf.json`, etc.) are hashed into a manifest. Any diff that changes their content without a fresh `audit-harness init` is caught by pre-commit / CI and **REFUSED**.
+
+AI agents remain useful (they can read policy, they can implement within constraints). What they can't do is silently weaken the constraints. That's the entire design.
+
+See `audit-tests/references/philosophy.md` in the companion skill for the full rationale.
+
+## The 7-layer testing taxonomy
+
+This harness sits inside a larger framework:
+
+```
+L7  Acceptance / RTM / Personas / Journeys     ← WHAT are we proving?
+L6  E2E / BDD / Visual regression              ← User-level guarantees
+L5  Perf / Security (SAST/DAST) / A11y / Chaos ← Non-functional
+L4  Integration / Contract / Migration         ← Infrastructure wiring
+L3  Unit + Coverage + Mutation + Arch + CRAP   ← Code-level correctness  ← audit-harness lives here
+L2  Static analysis / Lint / Types / Secrets   ← Read-only scanning
+L1  Git hooks / CI enforcement                 ← The cheapest gate       ← audit-harness enables this
+```
+
+The harness commands serve L1 (escape-scan in pre-commit + CI) and L3 (CRAP, architecture, bias, hash-pin).
+
+## Exit codes
+
+Important for CI scripting:
+
+| Exit | Command | Meaning |
+|---|---|---|
+| 0 | any | Clean |
+| 1 | escape-scan | CHALLENGE — requires engineer-approved comment |
+| 2 | verify | `HARNESS_TAMPERED` — pinned file changed |
+| 2 | escape-scan | REFUSE — pipeline halted |
+| 3 | verify | No manifest (fresh repo, not an error) |
+
+## Language support
+
+Most scripts are language-agnostic (shell + regex). CRAP has per-language backends:
+
+| Language | CRAP | Arch | Notes |
+|---|---|---|---|
+| Python | radon + coverage.py | import-linter | full support |
+| JS/TS | complexity-report + c8 | dependency-cruiser | full support |
+| Go | gocyclo + go test -cover | arch-go | full support |
+| Rust | rust-code-analysis + tarpaulin | (custom) | coverage integration pending |
+| Java/Kotlin | — | ArchUnit | via language-native tooling |
+| .NET | — | ArchUnitNET | via language-native tooling |
+| PHP | — | deptrac | via language-native tooling |
+
+## License
+
+MIT — see [LICENSE](./LICENSE).
+
+## Related
+
+- [`audit-tests` Claude Code skill](https://github.com/jeremylongshore/audit-harness#related) — diagnostic pipeline that uses this harness
+- [`implement-tests` Claude Code skill](https://github.com/jeremylongshore/audit-harness#related) — filesystem-mutating installer that installs this harness as part of L1/L3 setup
+
+## Versioning
+
+SemVer. Breaking changes to the CLI surface bump major; new commands bump minor; bug fixes bump patch.
+
+## Contributing
+
+This is infrastructure code. Changes need to be conservative. Before opening a PR:
+
+1. Read `audit-tests/references/philosophy.md` (in the companion skill) to understand the escape-grammar design
+2. Run `bash scripts/escape-scan.sh --staged` on your own diff — yes, the harness tests itself
+3. Add test cases if you're adding a new pattern to escape-scan or a new command to the CLI

.audit-harness/VERSION

@@ -0,0 +1 @@
+v0.1.0

.audit-harness/scripts/arch-check.sh

@@ -0,0 +1,143 @@
+#!/usr/bin/env bash
+# arch-check.sh — Wall 7 architecture-constraint dispatcher.
+#
+# Detects the primary language of the repo, invokes the appropriate
+# dependency / architecture checker with the project's rule pack, and
+# normalizes the exit code.
+#
+# Exit codes:
+#   0 — all rules pass
+#   1 — rule violations detected
+#   2 — no tool installed / no config / unsupported language
+#
+# Usage:
+#   bash arch-check.sh              # run from repo root
+#   bash arch-check.sh --json       # emit JSON summary to stdout
+#   bash arch-check.sh --help
+
+set -euo pipefail
+
+ROOT="${ROOT:-$(pwd)}"
+JSON_OUT=0
+REPORT_DIR="${ROOT}/reports/arch"
+
+usage() {
+  sed -n '2,20p' "$0"
+  exit 0
+}
+
+for arg in "$@"; do
+  case "$arg" in
+    --json) JSON_OUT=1 ;;
+    --help|-h) usage ;;
+    *) echo "arch-check: unknown flag $arg" >&2; exit 2 ;;
+  esac
+done
+
+mkdir -p "$REPORT_DIR"
+
+emit_result() {
+  local tool="$1" status="$2" violations="$3" log="$4"
+  if [[ "$JSON_OUT" -eq 1 ]]; then
+    printf '{"tool":"%s","status":"%s","violations":%s,"log":"%s"}\n' \
+      "$tool" "$status" "$violations" "$log"
+  else
+    echo "arch-check: tool=$tool status=$status violations=$violations"
+    echo "           log=$log"
+  fi
+}
+
+# 1. dependency-cruiser (JS/TS)
+if [[ -f "${ROOT}/.dependency-cruiser.js" || -f "${ROOT}/.dependency-cruiser.cjs" ]]; then
+  LOG="${REPORT_DIR}/dep-cruiser.log"
+  if command -v npx >/dev/null 2>&1; then
+    if npx --no-install dependency-cruiser --validate --output-type err "${ROOT}/src" > "$LOG" 2>&1; then
+      emit_result dependency-cruiser pass 0 "$LOG"
+      exit 0
+    else
+      VIOL=$(grep -c "error" "$LOG" || echo 0)
+      emit_result dependency-cruiser fail "$VIOL" "$LOG"
+      exit 1
+    fi
+  else
+    emit_result dependency-cruiser missing-tool 0 "$LOG"
+    exit 2
+  fi
+fi
+
+# 2. import-linter (Python)
+if [[ -f "${ROOT}/.importlinter" ]] || grep -q "^\[importlinter\]" "${ROOT}/pyproject.toml" 2>/dev/null; then
+  LOG="${REPORT_DIR}/import-linter.log"
+  if command -v lint-imports >/dev/null 2>&1; then
+    if (cd "$ROOT" && lint-imports) > "$LOG" 2>&1; then
+      emit_result import-linter pass 0 "$LOG"
+      exit 0
+    else
+      VIOL=$(grep -c "BROKEN" "$LOG" || echo 0)
+      emit_result import-linter fail "$VIOL" "$LOG"
+      exit 1
+    fi
+  else
+    emit_result import-linter missing-tool 0 "$LOG"
+    exit 2
+  fi
+fi
+
+# 3. deptrac (PHP)
+if [[ -f "${ROOT}/deptrac.yaml" ]]; then
+  LOG="${REPORT_DIR}/deptrac.log"
+  if [[ -x "${ROOT}/vendor/bin/deptrac" ]]; then
+    if (cd "$ROOT" && vendor/bin/deptrac analyse --no-progress) > "$LOG" 2>&1; then
+      emit_result deptrac pass 0 "$LOG"
+      exit 0
+    else
+      VIOL=$(grep -Ec "violation" "$LOG" || echo 0)
+      emit_result deptrac fail "$VIOL" "$LOG"
+      exit 1
+    fi
+  else
+    emit_result deptrac missing-tool 0 "$LOG"
+    exit 2
+  fi
+fi
+
+# 4. arch-go
+if [[ -f "${ROOT}/arch-go.yml" ]]; then
+  LOG="${REPORT_DIR}/arch-go.log"
+  if command -v arch-go >/dev/null 2>&1; then
+    if (cd "$ROOT" && arch-go) > "$LOG" 2>&1; then
+      emit_result arch-go pass 0 "$LOG"
+      exit 0
+    else
+      VIOL=$(grep -c "Violation" "$LOG" || echo 0)
+      emit_result arch-go fail "$VIOL" "$LOG"
+      exit 1
+    fi
+  else
+    emit_result arch-go missing-tool 0 "$LOG"
+    exit 2
+  fi
+fi
+
+# 5. ArchUnit (Java/Kotlin) — run via build tool
+if [[ -f "${ROOT}/build.gradle" || -f "${ROOT}/build.gradle.kts" ]] && \
+   grep -rq "com.tngtech.archunit" "${ROOT}" --include="*.gradle*" 2>/dev/null; then
+  LOG="${REPORT_DIR}/archunit.log"
+  if [[ -x "${ROOT}/gradlew" ]]; then
+    if (cd "$ROOT" && ./gradlew test --tests '*ArchitectureTest*' --tests '*ArchTest*') > "$LOG" 2>&1; then
+      emit_result archunit pass 0 "$LOG"
+      exit 0
+    else
+      VIOL=$(grep -Ec "violated|FAILED" "$LOG" || echo 0)
+      emit_result archunit fail "$VIOL" "$LOG"
+      exit 1
+    fi
+  else
+    emit_result archunit missing-tool 0 "$LOG"
+    exit 2
+  fi
+fi
+
+# No tool / config found
+emit_result none not-configured 0 "$REPORT_DIR/none.log"
+exit 2