diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..974ce5f
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,2 @@
+# Golden fixtures are byte-exact — never EOL-normalize them.
+tests/golden/** -text
diff --git a/.github/PULL_REQUEST_TEMPLATE/harness-descriptor.md b/.github/PULL_REQUEST_TEMPLATE/harness-descriptor.md
new file mode 100644
index 0000000..88b0d7c
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE/harness-descriptor.md
@@ -0,0 +1,65 @@
+<!--
+Harness-descriptor contribution PR — data-only.
+Use for: adding a new built-in harness descriptor (or extending one) that only
+reuses EXISTING named capabilities. New parsers, slug capabilities, shadow
+preflights, and guard support are CODE contributions — one capability per PR,
+separately from this one (see docs/progressive-enhancements.md "Guardrails").
+Guide: docs/byoh.md "Upstreaming your descriptor".
+Title: feat(harness): add <label> descriptor
+-->
+
+## Harness
+
+- **Label:** `<label>`
+- **Harness CLI + version verified against:** <!-- e.g. `cool-cli 1.4.2` -->
+- **What it is / docs link:**
+
+## Scope check (data-only)
+
+- [ ] This PR adds/changes descriptor **data only** — no parser, slug, shadow,
+      or guard code (those are separate one-capability-per-PR contributions)
+- [ ] `[transcript]`/`[shadow]`/`[staging]` (if declared) reuse an existing named
+      capability (`claude-stream-json` / `codex-items` / `opencode` / `claude-plugins`)
+      or ingest through a `[transcript.extract]` block (declarative data)
+- [ ] No `[guard]` table and no `run.supports_guard = true` in this PR
+
+## The diff (expected shape)
+
+- [ ] `harnesses/<label>.toml` — the descriptor
+- [ ] `src/adapters/descriptor.rs` — the `EMBEDDED_DESCRIPTORS` entry (mechanical
+      registration only)
+- [ ] `docs/<label>-notes.md` — verified implementation notes (promote your
+      project's `.eval-magic/harnesses/<label>-notes.md` — `harness init`
+      scaffolds it)
+- [ ] `README.md` — new support-table row (only wired enhancements checked;
+      ❌ elsewhere)
+
+## Verification evidence
+
+- [ ] Lint is clean — paste the output:
+
+  ```
+  $ eval-magic harness lint harnesses/<label>.toml
+  ```
+
+- [ ] A smoke eval ran end-to-end on this harness
+      (`run --harness <label>` → dispatch → `ingest` → `finalize`); describe or
+      link the result:
+- [ ] Every declared enhancement was exercised by that run (e.g. staged skill
+      discovered natively, events file parsed by the named parser, model flag
+      appeared in the generated recipes)
+
+## Don't-guess attestation
+
+Every flag, filename, and event shape in the descriptor is traced to the
+harness's own documentation or to output I observed — nothing is inferred by
+analogy with another harness. `docs/<label>-notes.md` records, per value: the
+value, its source (docs URL / `--help` output / observed events file), and the
+harness version.
+
+- [ ] The notes file's Verification record covers every non-comment field in
+      the descriptor
+
+## Related
+
+Issues/PRs:
diff --git a/AGENTS.md b/AGENTS.md
index e764888..63a563f 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -4,9 +4,11 @@
 
 `eval-magic` is a Rust CLI crate. The binary entry point is `src/main.rs`; reusable logic lives in
 `src/lib.rs` and submodules such as `cli/`, `pipeline/`, `sandbox/`, `validation/`, and
-`workspace/`. JSON schemas are tracked in `schema/`, harness profiles in `profiles/`, and design or
-parity notes in `docs/`. Integration tests are split by surface area under `tests/cli/` and
-`tests/run/`; unit tests usually live beside the module they exercise.
+`workspace/`. JSON schemas are tracked in `schema/`, harness descriptors in `harnesses/`, shared
+prompt profiles in `profiles/`, and development docs (the harness enhancement contract,
+per-harness notes) in `docs/`. Integration
+tests are split by surface area under `tests/cli/` and `tests/run/`; unit tests usually live
+beside the module they exercise.
 
 ## Build, Test, and Development Commands
 
diff --git a/Cargo.lock b/Cargo.lock
index a34445e..78eda43 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -275,7 +275,7 @@ dependencies = [
 
 [[package]]
 name = "eval-magic"
-version = "0.4.1"
+version = "0.5.0"
 dependencies = [
  "anyhow",
  "assert_cmd",
@@ -289,6 +289,7 @@ dependencies = [
  "serde_json",
  "tempfile",
  "thiserror",
+ "toml",
  "walkdir",
 ]
 
@@ -938,6 +939,15 @@ dependencies = [
  "zmij",
 ]
 
+[[package]]
+name = "serde_spanned"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26"
+dependencies = [
+ "serde_core",
+]
+
 [[package]]
 name = "smallvec"
 version = "1.15.1"
@@ -1027,6 +1037,44 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "toml"
+version = "0.9.12+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf92845e79fc2e2def6a5d828f0801e29a2f8acc037becc5ab08595c7d5e9863"
+dependencies = [
+ "serde_core",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_parser",
+ "toml_writer",
+ "winnow 0.7.15",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.7.5+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526"
+dependencies = [
+ "winnow 1.0.3",
+]
+
+[[package]]
+name = "toml_writer"
+version = "1.1.1+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "756daf9b1013ebe47a8776667b466417e2d4c5679d441c26230efd9ef78692db"
+
 [[package]]
 name = "unicode-general-category"
 version = "1.1.0"
@@ -1170,6 +1218,18 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "winnow"
+version = "0.7.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
+
+[[package]]
+name = "winnow"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0592e1c9d151f854e6fd382574c3a0855250e1d9b2f99d9281c6e6391af352f1"
+
 [[package]]
 name = "wit-bindgen"
 version = "0.57.1"
diff --git a/Cargo.toml b/Cargo.toml
index 4e593a8..4388213 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "eval-magic"
-version = "0.4.1"
+version = "0.5.0"
 edition = "2024"
 description = "One-stop CLI for running skill evals — measure whether an agent skill actually shifts behavior."
 license = "MIT"
@@ -44,6 +44,10 @@ regex = { version = "1.12.3", default-features = false, features = ["std", "perf
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = { version = "1.0.150", features = ["preserve_order"] }
 thiserror = "2.0.18"
+# Harness descriptor files (harnesses/*.toml). `display` serializes the
+# resolved (layer-merged) descriptor back to authorable TOML for
+# `harness show`.
+toml = { version = "0.9", default-features = false, features = ["parse", "serde", "display"] }
 walkdir = "2.5.0"
 
 [dev-dependencies]
diff --git a/README.md b/README.md
index 4d8ec07..f174c0f 100644
--- a/README.md
+++ b/README.md
@@ -4,9 +4,9 @@
 
 An eval dispatches a fresh subagent twice per test case — once with the skill loaded, once without (or old version vs. new) — and grades both outputs against assertions. The pass-rate delta tells you whether the skill is worth shipping or the change is worth landing. The runner builds the workspace, stages skills for discovery, generates dispatch prompts, assembles run records from transcripts, grades, and aggregates; your agent harness supplies the one thing the runner never does itself: dispatching the subagents.
 
-`eval-magic` ships as a dependency-less prebuilt binary under the command name `eval-magic`. Every artifact follows a documented JSON Schema, so records grade the same way regardless of where they were authored. **Claude Code and Codex CLI are wired harnesses today**; OpenCode has foundational harness selection and staging support; see [Harnesses](#harnesses) for per-harness fidelity and caveats. From inside an agent session, running an eval is as simple as: *"Install eval-magic and help me run an eval on my-skill."*
+`eval-magic` ships as a dependency-less prebuilt binary under the command name `eval-magic`. Every artifact follows a documented JSON Schema, so records grade the same way regardless of where they were authored. **Claude Code and Codex CLI are fully wired harnesses today**; OpenCode has native staging support; see [Harnesses](#harnesses) for per-harness enhancement support. From inside an agent session, running an eval is as simple as: *"Install eval-magic and help me run an eval on my-skill."*
 
-This README is the complete operating guide: install, author cases, run both modes, drive the loop, read results, and keep a baseline. For the full flag-by-flag reference, run `eval-magic --help` (and `eval-magic <subcommand> --help`). For *when and why* to write an eval at all — the methodology, the decision to test, designing cases under pressure — see the [`slow-powers`](https://github.com/slowdini/slow-powers) plugin's `evaluating-skills` skill, which owns that craft.
+This README is the complete operating guide: install, author cases, run the loop, read results, and keep a baseline. For the full flag-by-flag reference, run `eval-magic --help` (and `eval-magic <subcommand> --help`). For *when and why* to write an eval at all — the methodology, the decision to test, designing cases under pressure — see the [`slow-powers`](https://github.com/slowdini/slow-powers) plugin's `evaluating-skills` skill, which owns that craft.
 
 ## Install
 
@@ -41,7 +41,7 @@ cargo build --release          # binary at target/release/eval-magic
 
 ## How an eval works
 
-For each test case, the runner sets up two conditions and a fresh subagent runs each with clean context — *how* that subagent is dispatched (in-session vs. one-shot CLI) is the run-mode axis covered under [Harnesses](#harnesses):
+For each test case, the runner sets up two conditions and a fresh subagent runs each with clean context. Each subagent is dispatched through the harness's one-shot CLI (`claude -p`, `codex exec`) — the specifics per harness are covered under [Harnesses](#harnesses):
 
 - **Mode A — new skill:** `with_skill` vs `without_skill`. Validates a brand-new skill beats baseline behavior with no skill loaded.
 - **Mode B — revision (the common case):** `old_skill` vs `new_skill`. Tests a language change to an existing skill — you snapshot the old `SKILL.md`, then run both variants against the same prompts. A negative or zero `delta.pass_rate` is a signal to revert.
@@ -85,35 +85,32 @@ environment.
 ### Mode A — new skill (with vs. without)
 
 ```bash
-# 1. Build the iteration's isolated env (arm --guard — see Cost & confirmation).
-#    run stages skills into .eval-magic/my-skill/iteration-1/env/, copies
-#    fixtures in, and writes RUNBOOK.md. It does NOT dispatch — it prints a handoff.
-#    Add --runs <N> to dispatch every eval N times per condition for variance
+# 1. Build the iteration's isolated envs (the write guard arms automatically —
+#    see Cost & confirmation). run stages skills into one env per (group,
+#    condition) under .eval-magic/my-skill/iteration-1/, copies fixtures in, and
+#    writes RUNBOOK.md. It does NOT dispatch — it prints a handoff. Add
+#    --runs <N> to dispatch every eval N times per condition for variance
 #    reduction (a per-eval "runs" field in evals.json overrides the flag).
-eval-magic run --guard
+eval-magic run
 
-# 2. Enter the isolated env and follow the runbook. cd into iteration-1/env/ and
-#    start a fresh agent session there (interactive Claude Code: the staged skills
-#    must be present at session start), then say: "Read and follow RUNBOOK.md".
-#    That session drives the whole loop below — dispatch → switch-condition →
-#    ingest → finalize — and writes benchmark.json into iteration-1/. (Headless:
-#    you, a human, follow the same RUNBOOK.md top to bottom; hybrid: the session
-#    shells out a `claude -p` / `codex exec` recipe per task.) See Claude Code
-#    below for the plugin-isolation and transcript specifics.
+# 2. Follow the runbook. From the iteration dir, read RUNBOOK.md end to end. It
+#    drives the whole loop below — dispatch → ingest → dispatch judges → finalize —
+#    dispatching each task through the harness CLI (`claude -p` / `codex exec`) and
+#    writing benchmark.json into iteration-1/. An agent session can drive the runbook
+#    ("Read and follow RUNBOOK.md"), or you can follow it by hand — the steps are
+#    identical. The runbook carries the exact dispatch recipes for your harness.
 
-# Steps 3–5 are driven from inside the runbook — shown here for reference:
+# Steps 3–5 are driven from the runbook — shown here for reference:
 
 # 3. ingest assembles records, detects stray writes, and grades, stopping at the
-#    judge hand-off. In-session it auto-resolves transcripts from
-#    CLAUDE_CODE_SESSION_ID; hybrid/headless read each task's events file instead.
+#    judge hand-off. It reads each task's events file (outputs/<harness>-events.jsonl).
 eval-magic ingest
 
-# 4. Dispatch the judge tasks ingest lists, then finalize. If --guard is still
+# 4. Dispatch the judge tasks ingest lists, then finalize. If the guard is still
 #    armed, finalize reminds you to run teardown-guard before editing source.
 eval-magic finalize
 
-# 5. Read .eval-magic/my-skill/iteration-1/benchmark.json (the prep session
-#    resumes here), then clean up:
+# 5. Read .eval-magic/my-skill/iteration-1/benchmark.json, then clean up:
 eval-magic teardown
 ```
 
@@ -123,7 +120,7 @@ You've already edited the skill; snapshot the old version straight from git (`--
 
 ```bash
 eval-magic snapshot --ref HEAD
-eval-magic run --mode revision --guard
+eval-magic run --mode revision
 # …then steps 2–5 as above.
 ```
 
@@ -131,41 +128,36 @@ If you snapshot *before* editing, omit `--ref` (it then reads the working tree)
 
 ## The run loop
 
-A run is one canonical workflow. `run` *prepares* an isolated env and hands off; a session entered in that env drives the rest of the loop to `benchmark.json`:
+A run is one canonical workflow. `run` *prepares* the isolated envs and hands off; the runbook then drives the rest of the loop to `benchmark.json`. An agent session or a human at a terminal can drive it — the steps are identical:
 
 ```
-run (prepare env/ + RUNBOOK.md)
-  └─► [in env/, runbook-driven] dispatch batch A → switch-condition → dispatch batch B
+run (prepare per-(group,condition) envs + RUNBOOK.md)
+  └─► [runbook-driven] dispatch condition A → dispatch condition B
         → ingest → dispatch judges → finalize  ──►  benchmark.json
 teardown
 ```
 
-1. **`run` prepares — it does not dispatch.** It builds the iteration workspace (`iteration-N/`), snapshots the `SKILL.md`, stages skills into the isolated env `iteration-N/env/` (the agent's cwd), copies fixtures in so it reads like a real repo, emits `dispatch.json` (machine-readable) alongside `dispatch-manifest.md` (human-readable), and writes `RUNBOOK.md` into `env/`. Then it prints a handoff, not a dispatch.
-2. **Enter the isolated env.** `cd` into `iteration-N/env/`, begin a run session there, and say *Read and follow `RUNBOOK.md`*. How you enter differs by run mode (see [Run modes](#run-modes)):
-   - **Interactive (Claude Code):** start a *fresh* Claude Code session in `env/` so the staged skills are present at session start; it dispatches in-session subagents and runs the rest of the loop itself.
-   - **Hybrid (Claude Code / Codex):** an orchestrating session follows `RUNBOOK.md`, shelling out a `claude -p` / `codex exec` recipe per task.
-   - **Headless (Claude Code / Codex):** no session — a human follows the same `RUNBOOK.md`, pasting each recipe and command top to bottom.
-3. **Dispatch agents (runbook-driven).** Read `dispatch.json`. Each task object points at a `dispatch_prompt_path` (the full prompt lives in a file so you never reproduce kilobytes inline), an `agent_description` to pass through *verbatim* as the dispatch description, and the exact `run_record_path` / `timing_path`. For each task, dispatch a fresh subagent told to read the file at `dispatch_prompt_path` and follow it exactly. The `agent_description` is namespaced with the iteration and a per-run nonce (`<eval_id>:<condition>[:r<k>]:i<N>-<nonce>`; the `r<k>` segment appears only in multi-run cells, see `run --help` on `--runs`) — passing it through unchanged is what lets transcripts correlate to runs.
-4. **`switch-condition` between condition batches.** Conditions run as sequential batches, never interleaved. After joining *all* of the first batch's subagents, run `eval-magic switch-condition --condition <next>` to remove the off-condition's staged skill from `env/.claude/skills/`, so the next batch can't read it — the read-isolation barrier. When a run has more than one **isolation group** (see below), the runbook also dispatches each group as its own batch and runs `eval-magic reset-batch --group <g>` between groups — it wipes the shared `env/` working tree and re-seeds it with that group's fixtures, the per-group isolation barrier. The runbook spells out the exact `switch-condition` / `reset-batch` sequence; you never work it out yourself.
-5. **`ingest`** (a fixed-order chain: record-runs → fill-transcripts → detect-stray-writes → grade), run from inside `env/`, assembles each task's `run.json` and `timing.json` from `dispatch.json` + the subagent's `outputs/final-message.md` + the persisted transcript, scans for stray writes, and grades the `transcript_check` assertions. It stops at the judge hand-off, listing a judge task per `llm_judge` assertion.
-6. **Dispatch judges.** Same pattern as step 3: dispatch a fresh subagent for each judge task to read its prompt file and write its verdict back.
-7. **`finalize`** (grade `--finalize` → aggregate) merges the judge verdicts and writes `benchmark.json` into `iteration-N/`, *above* `env/`. Read it. If a `--guard` marker is still live, it also reminds you to run `teardown-guard` before editing source.
-8. **`teardown`** disarms the guard, removes the staged skill set, and reclaims the workspace artifacts that are safe to delete.
+1. **`run` prepares — it does not dispatch.** It builds the iteration workspace (`iteration-N/`), snapshots the `SKILL.md`, stages skills into one isolated env per `(group, condition)` (`iteration-N/env-<group>-<condition>/`, the cwd each dispatch runs from), copies fixtures in so each reads like a real repo, emits `dispatch.json` (machine-readable) alongside `dispatch-manifest.md` (human-readable), and writes `RUNBOOK.md` into `iteration-N/`. Then it prints a handoff, not a dispatch.
+2. **Follow the runbook.** From `iteration-N/`, read `RUNBOOK.md` end to end. An agent session can drive it (*Read and follow `RUNBOOK.md`*) or you can follow it by hand — the commands are identical. It carries the exact per-task dispatch recipe plus the `ingest` / `finalize` commands, each already threaded with `--harness`.
+3. **Dispatch agents (runbook-driven).** Read `dispatch.json`. Each task object points at a `dispatch_prompt_path` (the full prompt lives in a file so you never reproduce kilobytes inline), the `eval_root` env to dispatch from, and the exact `run_record_path` / `timing_path`. For each task, run the harness CLI recipe from its `eval_root`, pointing the dispatched subagent at `dispatch_prompt_path` to read and follow exactly, and capture the events transcript into `outputs/`. Conditions are physically isolated — the `with_skill` env holds the staged skill, the control arm's env holds none — so there is no runtime "switch" step to get wrong.
+4. **`ingest`** (a fixed-order chain: record-runs → fill-transcripts → detect-stray-writes → grade) assembles each task's `run.json` and `timing.json` from `dispatch.json` + the subagent's `outputs/final-message.md` + each task's events transcript, scans for stray writes, and grades the `transcript_check` assertions. It stops at the judge hand-off, listing a judge task per `llm_judge` assertion.
+5. **Dispatch judges.** Same pattern as step 3: run the CLI recipe for each judge task to read its prompt file and write its verdict back.
+6. **`finalize`** (grade `--finalize` → aggregate) merges the judge verdicts and writes `benchmark.json` into `iteration-N/`, *above* the envs. Read it. If a guard marker is still live, it also reminds you to run `teardown-guard` before editing source.
+7. **`teardown`** disarms the guard, removes the staged skill set, and reclaims the workspace artifacts that are safe to delete.
 
-The chains run in-process and stop at the first failure; re-running after a fix is safe — every sub-step skips work that's already done. The individual steps (`record-runs`, `fill-transcripts`, `detect-stray-writes`, `grade`, `aggregate`) remain callable for inspection or recovery. Under the `Cli` mechanism (Claude Code hybrid/headless, Codex), the per-task dispatch recipe lives in `RUNBOOK.md` and `ingest` reads each task's events file (`claude-events.jsonl` / `codex-events.jsonl`) instead of an in-session transcript; un-wired harnesses still write records by hand until their adapters land.
+The chains run in-process and stop at the first failure; re-running after a fix is safe — every sub-step skips work that's already done. The individual steps (`record-runs`, `fill-transcripts`, `detect-stray-writes`, `grade`, `aggregate`) remain callable for inspection or recovery. The per-task dispatch recipe lives in `RUNBOOK.md` and `dispatch-manifest.md`, and `ingest` reads each task's events file (`outputs/<harness>-events.jsonl`); harnesses without transcript ingest still write records by hand until their adapters land.
 
 ### Isolation grouping (which agents batch together)
 
-`run` decides at **setup** time which evals can share an environment and which need their own, writes the plan into `dispatch.json` (a `groups[]` summary plus a per-task `group`/`eval_root`), and the runbook follows it — the executing session does no isolation reasoning itself. By default every eval shares one group (today's behavior, unchanged). Two things create a separate group: evals whose fixtures would clobber each other, and an eval that opts out explicitly with `"isolation": "isolated"` in `evals.json` (use it when an eval's agent *mutates* a fixture another eval reads). How groups are realized depends on the run mode:
+`run` decides at **setup** time which evals can share an environment and which need their own, writes the plan into `dispatch.json` (a `groups[]` summary plus a per-task `group`/`eval_root`), and the runbook follows it — whoever drives the loop does no isolation reasoning themselves. By default every eval shares one group. Two things create a separate group: evals whose fixtures would clobber each other, and an eval that opts out explicitly with `"isolation": "isolated"` in `evals.json` (use it when an eval's agent *mutates* a fixture another eval reads).
 
-- **Interactive (in-session):** one `env/`; groups are dispatched as sequential batches with a `reset-batch` barrier between them.
-- **Hybrid / headless (Cli):** one env per `(group, condition)` — `iteration-N/env-<group>-<condition>/` — so each subprocess `cd`s into a fully-isolated cwd. This also gives the Cli path real per-condition isolation: the control arm's env contains no skill at all.
+Each `(group, condition)` gets its own env — `iteration-N/env-<group>-<condition>/` — so every dispatch `cd`s into a fully-isolated cwd holding only that group's fixtures, plus the staged skill for the `with_skill` arm (the control arm's env holds no skill at all). This structural split *is* the per-condition read-isolation barrier — there is no runtime switch step.
 
 ## Cost & confirmation
 
 An eval run is not free: an N-case suite is **2N full agent sessions**, plus a judge dispatch per `llm_judge` assertion — real wall-clock time and real tokens. A subagent under test runs the real skill, and some skills write to disk, so it can write outside its sandbox.
 
-If you are an agent driving this tool, **never kick off a run silently.** Present the user a run summary — skill, mode, eval cases, the models that will run the agents and the judge, the cost, and the guard status — and wait for explicit confirmation. For CLI-dispatch harnesses, pass `--agent-model <id>` and `--judge-model <id>` to have the generated command recipes select those models when the harness adapter supports model selection; for in-session dispatch, those flags are still provenance because the runner does not choose the parent session's model. Arm `--guard` unless the user actively opts out; unguarded, stray writes are only *detected* after the fact by `detect-stray-writes`, never blocked.
+If you are an agent driving this tool, **never kick off a run silently.** Present the user a run summary — skill, mode, eval cases, the models that will run the agents and the judge, the cost, and the guard status — and wait for explicit confirmation. Pass `--agent-model <id>` and `--judge-model <id>` to have the generated command recipes select those models when the harness adapter supports model selection (see the [Harnesses](#harnesses) table); otherwise they are recorded as provenance. The write guard arms automatically on harnesses that support it (see the same table); pass `--no-guard` only when the user actively opts out. Unguarded, stray writes are only *detected* after the fact by `detect-stray-writes`, never blocked.
 
 The judgment of *whether* a change needs an eval, and how to design cases that actually measure it, lives in the [`slow-powers`](https://github.com/slowdini/slow-powers) plugin's `evaluating-skills` skill.
 
@@ -173,7 +165,7 @@ The judgment of *whether* a change needs an eval, and how to design cases that a
 
 After you've seen what iteration 1 produces, add **assertions** to `evals.json` and re-grade without re-dispatching. Two types:
 
-- **`transcript_check` — mechanical.** Regex matched against a run's tool invocations. Fast, deterministic, cheap. Use for "did the agent run X" or "did file Y get written." Requires a transcript adapter (wired for Claude Code and Codex event streams today).
+- **`transcript_check` — mechanical.** Regex matched against a run's tool invocations. Fast, deterministic, cheap. Use for "did the agent run X" or "did file Y get written." Requires the harness's transcript-ingest enhancement (see the [Harnesses](#harnesses) table); without it these grade as unverifiable.
 - **`llm_judge` — judged.** Soft criteria a model evaluates. Use for "did the response quote actual evidence." Graded by a dispatched judge subagent. Harness-independent.
 
 Exact schemas are in [`schema/`](schema/); the assertion shapes and the grading output are detailed in `eval-magic grade --help`. Every with-skill run also gets an automatic **skill-invocation meta-check** — did the skill actually influence behavior? — surfaced as an `invocation_rate` per condition; a run where the skill wasn't invoked is a non-data-point, not evidence the skill is bad. Guidance on *what makes a good assertion* lives in the slow-powers `evaluating-skills` skill.
@@ -194,7 +186,7 @@ Exact schemas are in [`schema/`](schema/); the assertion shapes and the grading
 
 A skill that adds 13 seconds and 1700 tokens but improves pass rate by 50 points is probably worth it; one that doubles tokens for a 2-point gain is probably not. For Mode B the keys are `old_skill` / `new_skill`, and a positive `delta.pass_rate` means the revision is an improvement.
 
-Read `validity_warnings` **before** trusting any delta — a low skill-invocation rate (or a flagged stray write) means the result may not reflect the skill at all.
+Read `validity_warnings` **before** trusting any delta — a low skill-invocation rate, a flagged stray write, or a flagged live-source read (an arm that read the live skill source instead of its staged copy) means the result may not reflect the skill at all.
 
 ## Workspace layout
 
@@ -258,145 +250,49 @@ A subagent that runs an eval should start in an environment that mirrors a real
 
 For the `without_skill` / baseline condition, the dispatch reflects "this skill is unavailable, others remain" when siblings were opted in with `--skill-dir`; otherwise it measures the skill against a clean no-skill baseline. `--bootstrap` is separate from parity: it injects product-specific framing inside the `<session-start-context>` block and does not enumerate skills.
 
-**Parity is only as clean as your session.** Staging controls what the runner *adds*, not what your session already *loaded*. Subagents dispatched in-process share the parent session's plugins, so an installed plugin exposing a same-named skill is still discoverable and contaminates both arms — the staging slug stops an on-disk collision, not runtime discovery. The runner can't unload a live plugin; on Claude Code it emits a build-time *plugin-shadow* warning (also surfaced in `benchmark.json`'s `validity_warnings`). Closing it is a launch-time step — see [Claude Code](#claude-code-fully-wired) below.
+**Parity is only as clean as your session.** Staging controls what the runner *adds*, not what your session already *loaded*. Subagents dispatched in-process share the parent session's plugins, so an installed plugin exposing a same-named skill is still discoverable and contaminates both arms — the staging slug stops an on-disk collision, not runtime discovery. The runner can't unload a live plugin; on Claude Code it emits a build-time *plugin-shadow* warning (also surfaced in `benchmark.json`'s `validity_warnings`) that lists the per-dispatch isolation options inline. Closing it is a launch-time step for whoever dispatches.
 
 ## Harnesses
 
-Every artifact follows a JSON Schema in [`schema/`](schema/), so a run record means the same thing regardless of which harness produced it. **Claude Code** and **Codex** are wired harnesses, with harness-specific fidelity notes below. The parity-audit framework for bringing another harness up to the supported feature set is in [docs/harness-parity.md](docs/harness-parity.md).
+Every artifact follows a JSON Schema in [`schema/`](schema/), so a run record means the same thing regardless of which harness produced it. Harness support is **a minimal baseline plus progressive enhancements**: any harness with a headless one-shot CLI can run evals at baseline (`--no-stage` inlines the skill into each dispatch prompt, `llm_judge` grades, `detect-stray-writes` audits), and each enhancement a harness's adapter wires raises fidelity from there. What each enhancement is, why it needs harness-specific support, and what its fallback is are documented in [docs/progressive-enhancements.md](docs/progressive-enhancements.md).
 
-### Run modes
+**Bring your own harness:** a harness eval-magic has never seen is added with a TOML descriptor file — no code. `eval-magic harness init <name>` scaffolds the descriptor with every field explained inline (plus a notes skeleton for recording verified values), and descriptors layer (embedded built-ins → `~/.config/eval-magic/harnesses/` → `.eval-magic/harnesses/` → `--harness-file`) with field-level merge, so a project can also retune a single field of a built-in. `eval-magic harness list|show|lint` inspect and validate the registry; the authoring guide is [docs/byoh.md](docs/byoh.md). A descriptor that proves out can be upstreamed as a data-only PR and lands as a new row in the support table below — baseline first, enhancement columns flipping as each is wired.
 
-*How* an eval gets dispatched is the primary parity axis (see [docs/harness-parity.md](docs/harness-parity.md)), distinct from *which* harness runs it. There are three run modes — pick whichever fits your account and plan:
+### How dispatch works
 
-- **Headless** — you never start an agent session. You run a series of `eval-magic` commands, and every eval test and judge is dispatched through the harness's one-shot CLI (`claude -p`, `codex exec`), writing transcripts to disk. The run ends in a written report.
-- **Fully interactive** — you start an agent session and ask it to run an eval. The agent runs the `eval-magic` commands and dispatches tests and judges as **in-session subagents**, then hands you the report.
-- **Hybrid** — like interactive, but the agent guides the process and issues headless CLI dispatches (`claude -p` / `codex exec`) for some or all tests and judges — useful for working through iterations.
+Every eval test and judge is dispatched the same way: through the harness's one-shot CLI (`claude -p`, `codex exec`), one subprocess per task, each `cd`'d into its `(group, condition)` env and writing its events transcript to disk. `run` prepares the envs and `RUNBOOK.md`; from there an **agent session** can drive the loop (reading the runbook and shelling out each recipe) or a **human** can follow the same runbook by hand. The generated `RUNBOOK.md` / `dispatch-manifest.md` carry the exact per-task recipes for the selected harness — they, not this README, are the runtime reference for dispatch commands.
 
-Under the hood these three modes ride on **two dispatch mechanisms** (`DispatchMechanism` in `src/core/run_mode.rs`): *fully-interactive* dispatches **in-session** subagents, while *headless* and *hybrid* both dispatch through the **one-shot CLI** — they differ only in whether a session drives the loop, not in how a single task reaches the harness.
+### Support
 
-Support today:
+This table is the source of truth for per-harness enhancement support:
 
-| Harness | Headless | Fully interactive | Hybrid |
-|---------|:--------:|:-----------------:|:------:|
-| **Claude Code** | ✅ | ✅ | ✅ |
-| **Codex** | ✅ | ❔ likely N/A¹ | ✅ |
-| **OpenCode** | ❌ | ❌ | ❌² |
+| Harness | Native staging | Dispatch recipes | Transcript ingest | Model flag | Write guard |
+|---------|:--------------:|:----------------:|:-----------------:|:----------:|:-----------:|
+| **Claude Code** | ✅ | ✅ | ✅ | ✅ | ✅ |
+| **Codex** | ✅ | ✅ | ✅ | ✅ | ✅ |
+| **OpenCode** | ✅ | ❌¹ | ❌ | ❌ | ❌ |
 
-¹ Codex dispatches via subprocess (`codex exec`), not in-session subagents, so a "fully interactive" Codex mode may not translate. ² OpenCode foundational harness support is wired: `--harness opencode` stages skills under `.opencode/skills/` and emits native dispatch prompts. Transcript ingest, auto-record, and `--guard` are pending.
+¹ `run --harness opencode` stages skills and emits native dispatch prompts, but prints manual `opencode run` guidance instead of a copy-pasteable recipe.
 
-**Cost and billing.** Mode choice has billing consequences:
+A missing enhancement degrades fidelity, never correctness — every column has a fallback, and the `run` preflight warns naming it: without native staging, `--no-stage` inlines each `SKILL.md` into its dispatch prompt; without transcript ingest, `transcript_check` assertions grade as unverifiable and `llm_judge` carries the grading (tokens and duration go unrecorded); without a model flag, `--agent-model` / `--judge-model` are recorded as provenance only; without a write guard, the run continues unguarded (auto-arm quietly stays off; an explicit `--guard` warns) and `detect-stray-writes` audits after the fact; without dispatch recipes, `RUNBOOK.md` / `dispatch-manifest.md` carry handoff guidance without a copy-pasteable per-task command. Supported enhancements are provided automatically — the write guard arms on every staged run of a guard-capable harness unless `--no-guard` opts out.
 
-- **Claude Code, fully interactive** (Task-tool subagents) — billed under normal interactive session usage/limits (your subscription's interactive pool, or your API key).
-- **Claude Code, headless / hybrid** (`claude -p`) — same token-based pricing, but on **subscription plans, starting June 15 2026**, `claude -p` (Agent SDK) usage draws from a **separate monthly Agent SDK credit pool**, distinct from interactive limits. Headless JSON output exposes `total_cost_usd` per invocation, so the runner can record per-task cost — something the in-session Task-tool path can't easily capture.
-- **Codex, hybrid** (`codex exec`) — billed under your Codex usage.
-
-**Intended end state:** all three modes first-class on Claude Code and Codex (where the mode translates) — reached as of this release; OpenCode wired as a third harness remains. Progress is tracked in [GitHub issues](https://github.com/slowdini/eval-magic/issues).
-
-### Claude Code (fully wired)
-
-The run loop above *is* the Claude Code loop. By default this is the **fully-interactive** run mode (see [Run modes](#run-modes)) — subagents are dispatched in-session via the Task tool; the **hybrid** and **headless** (`claude -p`) modes are now wired too (pass `--run-mode hybrid` or `--run-mode headless`, see below). `eval-magic run` itself only *prepares* the isolated env (`.eval-magic/<skill>/iteration-N/env/`) and writes `RUNBOOK.md` into it, then prints a handoff: `cd` into `env/`, start a **fresh** Claude Code session there, and say *Read and follow RUNBOOK.md*. That fresh session — clean cwd, staged skills present at session start — drives the whole dispatch → switch-condition → ingest → finalize loop and writes `benchmark.json`, which the prep session resumes on. These are the Claude-Code-specific details:
-
-**Isolating from installed plugins.** Read this first if the skill you're evaluating shares a name with one an installed, enabled plugin provides. Subagents are dispatched via the **Task tool**, so they inherit *this session's* enabled plugins — the staging slug avoids an on-disk collision but does not stop the installed copy from being discoverable, contaminating both arms (the `without_skill` arm is then not truly skill-absent). Plugins load at session start and can't be unloaded mid-session, so the runner only *detects and warns* (the plugin-shadow banner). The isolated env gives a clean *cwd* but does not unload user/global plugins, so this still applies. To actually isolate, launch the **fresh session you start in `env/`** one of these ways — subagents inherit it:
-
-- **Drop user-scope plugins, keep auth:** `claude --setting-sources project,local`. User-scope `enabledPlugins` isn't loaded; auth is unaffected.
-- **Disable the specific plugin, then restart:** set `"enabledPlugins": { "<plugin>@<marketplace>": false }` in a settings source that loads at startup, and start a fresh session.
-- **Clean config dir (strips everything):** `CLAUDE_CONFIG_DIR="$(mktemp -d)" claude`. No installed plugins or global skills load at all. Auth caveat: OAuth lives in `~/.claude.json`, which a relocated config dir may not carry — set `ANTHROPIC_API_KEY` or re-authenticate once in the fresh dir.
-
-Project-local staged skills live in the isolated env at `env/.claude/skills/`, independent of installed plugins, so they still load and the meta-check still resolves the slug under all three.
-
-**Discovery is structural now.** Claude Code only watches skill directories that existed when the session started. Because `eval-magic run` builds `env/.claude/skills/` *before* you start the fresh session in `env/`, the staged skills are present at session start and discovered normally — there is no mid-session staging, so the old "did the dir exist when your session started?" hazard (and the build-time warning it once printed) no longer applies. `--no-stage` remains for harnesses without project-local skill discovery: each `SKILL.md` is inlined into its dispatch prompt instead of staged. Regardless, run `detect-stray-writes` (folded into `ingest`) before trusting a result.
-
-**Where transcripts live.** Claude Code persists subagent transcripts under `~/.claude/projects/<project-slug>/<parent-session-id>/subagents/`. `ingest` auto-resolves this from the `CLAUDE_CODE_SESSION_ID` the orchestrating session exports (deriving `<project-slug>` from the cwd and scanning `projects/*` if needed), so you normally don't pass `--subagents-dir` at all. When running outside that session — or to target a past session — pass `--session-id <id>`, or override the lookup entirely with `--subagents-dir <path>`. Besides out-of-bounds writes, `detect-stray-writes` also flags **live-source reads**: an arm whose subagent read the live skill source instead of its staged copy. That usually means the Skill tool couldn't resolve the staged slug yet and the agent improvised — fatal in revision mode, where the `old_skill` arm then sees new-skill content. Treat a flagged cell's arm as contaminated.
-
-**Dispatching via the Task tool.** `dispatch.json` is a top-level object (`{ skill_name, iteration, run_nonce, …, tasks: [...] }`); iterate `tasks[]`. For each task, dispatch a fresh subagent via the Task tool with the prompt `Read the file at <dispatch_prompt_path> and follow its instructions exactly.` (substituting the task's `dispatch_prompt_path`), and pass `agent_description` *verbatim* as the description — it's namespaced `<eval_id>:<condition>:i<N>-<nonce>`, and passing it unchanged is what lets transcript correlation work. (The Task tool documents `description` as "short", but pass the full string regardless — correlation depends on the exact value.) You do **not** write `run.json`/`timing.json` yourself; the subagent writes `outputs/final-message.md`, and `ingest` (`record-runs`) assembles both records from disk. For a plan-mode-relevant skill, add `--plan-mode` to inject Claude Code's verbatim plan-mode procedure as a `<system-reminder>` operating-context layer.
-
-**Hybrid mode (`--run-mode hybrid`).** Pass `--run-mode hybrid` to dispatch each task through the `claude -p` one-shot CLI instead of in-session subagents — the same shape as Codex's hybrid flow, where an agent session orchestrates while each test/judge shells out to the CLI. `run` then prints (and `dispatch-manifest.md` / `RUNBOOK.md` carry) a `claude -p` recipe per task:
-
-```bash
-cd <eval-root> && claude -p --output-format stream-json --verbose --permission-mode acceptEdits \
-  "Read the file at <dispatch_prompt_path> and follow its instructions exactly. …" \
-  </dev/null \
-  > <outputs_dir>/claude-events.jsonl \
-  2> <outputs_dir>/claude-stderr.log
-```
-
-Three details differ from Codex's `codex exec`: `--output-format stream-json` **requires `--verbose`** in `-p` mode; `claude` has **no `--cd` flag**, so each dispatch must run from the env dir (`cd <eval-root> &&`) — staged-skill discovery is cwd-relative, so getting this wrong makes the `with_skill` arm behave like `without_skill`; and there is **no `--output-last-message`**, so the final message is recovered from the stream-json `result` event rather than a file. Detach stdin with `</dev/null` so a permission prompt can't block on a TTY. Then `eval-magic ingest --harness claude-code --run-mode hybrid` reads each task's `outputs/claude-events.jsonl` (the `-p` stream-json transcript) to populate `tool_invocations`, tokens, duration, and the final message. `--run-mode` is recorded in `conditions.json`; pass it to each post-dispatch command (the printed next-step commands already carry it). `--guard` works under hybrid and headless too: the `PreToolUse` hook is staged in `env/.claude/settings.local.json`, and because each `claude -p` dispatch runs from `env/` (`cd <eval-root>`), it loads and enforces the hook exactly as an interactive session would (the recipe never passes `--bare`, which would skip hook discovery). A deny aborts the offending dispatch; `detect-stray-writes` (folded into `ingest`) remains the after-the-fact backstop.
-
-**Headless mode (`--run-mode headless`).** The same `claude -p` dispatch as hybrid, but no agent session drives the loop — you (a human) paste each `eval-magic` command and the `claude -p` recipe yourself, ending in a written `benchmark.json`. `run` writes the same human-followed `RUNBOOK.md` (the shared headless template) into `env/`; work from that directory and copy-paste top to bottom: dispatch the tests → `ingest` → dispatch the judges → `finalize` → read the result → `teardown`. Pass `--run-mode headless` to every command of the run (the printed next steps and the runbook already carry it). `--guard` behaves exactly as it does under hybrid.
-
-### Codex
-
-Codex's `codex --ask-for-approval never exec --json` flow powers both CLI run modes (see [Run modes](#run-modes)): **hybrid** — an agent session orchestrates while each dispatch shells out to the CLI — and **headless** (`--run-mode headless`), where eval-magic drives the whole loop with no session, writing the same human-followed `RUNBOOK.md`. A **fully-interactive** mode likely doesn't translate, since Codex dispatches via subprocess rather than in-session subagents.
-
-Pass `--harness codex`: skills stage under repo-local `.agents/skills/` (the staged skill-under-test's frontmatter `name:` is rewritten to the eval slug so Codex's repo-local discovery sees it), and `conditions.json` / `dispatch.json` record `"harness": "codex"`. Dispatch each task with a fresh `codex --ask-for-approval never exec --json` execution, capturing the event stream:
-
-```bash
-codex --ask-for-approval never exec --cd <eval-root> --sandbox workspace-write --json \
-  --output-last-message <outputs_dir>/final-message.md \
-  "Read the file at <dispatch_prompt_path> and follow its instructions exactly. When you finish, make your final response exactly the same text you wrote to <outputs_dir>/final-message.md." \
-  </dev/null \
-  > <outputs_dir>/codex-events.jsonl \
-  2> <outputs_dir>/codex-stderr.log
-```
-
-When `run --agent-model <id>` is set, the generated Codex recipes insert `-m <id>` before `--json`:
-
-```bash
-codex --ask-for-approval never exec --cd <eval-root> --sandbox workspace-write -m <agent-model> --json \
-  --output-last-message <outputs_dir>/final-message.md \
-  "Read the file at <dispatch_prompt_path> and follow its instructions exactly. When you finish, make your final response exactly the same text you wrote to <outputs_dir>/final-message.md." \
-  </dev/null \
-  > <outputs_dir>/codex-events.jsonl \
-  2> <outputs_dir>/codex-stderr.log
-```
-
-When the run was armed with `--guard`, add `--dangerously-bypass-hook-trust` to that `codex --ask-for-approval never exec` command so the vetted project-local `PreToolUse` hook staged in `.codex/hooks.json` actually runs:
-
-```bash
-codex --ask-for-approval never exec --cd <eval-root> --sandbox workspace-write --dangerously-bypass-hook-trust --json \
-  --output-last-message <outputs_dir>/final-message.md \
-  "Read the file at <dispatch_prompt_path> and follow its instructions exactly. When you finish, make your final response exactly the same text you wrote to <outputs_dir>/final-message.md." \
-  </dev/null \
-  > <outputs_dir>/codex-events.jsonl \
-  2> <outputs_dir>/codex-stderr.log
-```
-
-The `</dev/null` redirect matters when dispatching in parallel from a pipe (for example with `xargs -P`): without it, Codex treats piped stdin as additional prompt context. `codex-stderr.log` keeps progress/status text such as stdin notices out of the JSONL transcript.
-
-Then ingest **without** `--subagents-dir` — the transcript source is fixed to each task's `codex-events.jsonl`:
-
-```bash
-eval-magic ingest --harness codex
-```
-
-Judge tasks follow the same model-selection rule. `run --judge-model <id>` becomes the default `model` in `judge-tasks.json`; an individual `llm_judge.model` overrides it. The Codex judge recipe reads each task's resolved `model` and passes `-m "$model"` only when one is present.
-
-`finalize` and `teardown` work the same with `--harness codex`. Codex results are lower fidelity than Claude Code in a few places: `transcript_check` matches parsed `item.completed` entries (`command_execution`, `file_change`, `web_search`, MCP items); the automatic `__skill_invoked` meta-check uses the LLM-judge fallback (Codex's JSONL exposes no deterministic skill-tool event); and `--plan-mode` injects Codex's plan-mode procedure as text rather than launching `codex exec` into the interactive CLI's real `/plan` mode. `--guard` stages a Codex `PreToolUse` hook that blocks out-of-sandbox `Bash` mutations and `apply_patch` targets before they run; `detect-stray-writes` remains the post-run audit. Bias Codex suites toward `llm_judge` assertions for behavior and `transcript_check` for tool events.
-
-When running `eval-magic run --harness codex` from inside Codex itself, staging writes `.agents/skills`; adding `--guard` also writes `.codex/hooks.json`. Those project-local Codex config paths are protected by Codex's default workspace-write sandbox, so the runner may need approval/escalation or an external terminal invocation. That approval is Codex's own permission boundary, not something eval-magic bypasses.
-
-### OpenCode
-
-OpenCode is wired for **foundational harness selection and staging**. Pass `--harness opencode`: skills stage under repo-local `.opencode/skills/` (OpenCode's native project-local skills directory), the staged skill-under-test's frontmatter `name:` is rewritten to a sanitized OpenCode-valid slug, and `conditions.json` / `dispatch.json` record `"harness": "opencode"`. The dispatch prompt renders OpenCode's native `<available_skills>` XML block and a plan-mode approximation via `<system-reminder>`.
-
-OpenCode skill names must be lowercase alphanumeric with single-hyphen separators, match the containing directory name, and be 1–64 characters. The runner sanitizes the eval-generated slug for the staged copy; sibling skills are staged at their natural names and must already satisfy OpenCode's naming rules.
-
-**Dispatching.** Eval-magic does not yet drive OpenCode dispatches automatically. Iterate `tasks[]` in `dispatch.json` and dispatch each task with `opencode run`, passing the prompt at `dispatch_prompt_path`. Capture the result and assemble `run.json`/`timing.json` manually, or record `opencode run --format json` / `opencode export` output for the upcoming transcript adapter.
-
-**Fidelity notes.** Transcript ingest, auto-record, and `--guard` are not yet wired for OpenCode. The automatic `__skill_invoked` meta-check uses the LLM-judge fallback until a transcript adapter lands, and `transcript_check` assertions grade as *unverifiable*. `detect-stray-writes` still audits out-of-bounds writes from any parsed transcript. `--guard` is rejected with a clear message for OpenCode; use `detect-stray-writes` as the audit fallback.
+Per-harness implementation notes for developers wiring features live in [docs/claude-notes.md](docs/claude-notes.md), [docs/codex-notes.md](docs/codex-notes.md), and [docs/opencode-notes.md](docs/opencode-notes.md).
 
 ## Documentation
 
 | Where | What's in it |
 |-------|--------------|
 | `eval-magic --help` / `eval-magic <cmd> --help` | The flag-by-flag reference: every subcommand and flag, worked examples, the `--skill-dir` model, the skill-invocation meta-check |
-| [docs/harness-parity.md](docs/harness-parity.md) | The parity-audit framework for bringing a new harness up to the supported feature set |
+| [docs/byoh.md](docs/byoh.md) | Bring your own harness: the `harness init` scaffold, authoring a descriptor file for an unknown harness, layering/merge rules, named capabilities, the `harness list`/`show`/`lint` workflow, and upstreaming a descriptor as a data-only PR |
+| [docs/progressive-enhancements.md](docs/progressive-enhancements.md) | Development doc: the harness baseline-vs-enhancement contract — what each enhancement unlocks, why it needs harness-specific code, and its fallback |
+| [docs/claude-notes.md](docs/claude-notes.md) / [docs/codex-notes.md](docs/codex-notes.md) / [docs/opencode-notes.md](docs/opencode-notes.md) | Development docs: per-harness implementation notes for working on eval-magic's harness support |
 | [GitHub issues](https://github.com/slowdini/eval-magic/issues) | Planned features and known limitations |
 
 ## Bundled assets
 
-- `schema/` — JSON Schemas for every artifact (`evals`, run records, `grading`, `stray-writes`, `benchmark`, `judge-tasks`); the portable cross-harness contract, embedded in the binary
-- `profiles/` — per-harness plan-mode procedure profiles (`--plan-mode`), embedded in the binary
+- `schema/` — JSON Schemas for every artifact (`evals`, run records, `grading`, `stray-writes`, `benchmark`, `judge-tasks`, harness descriptors); the portable cross-harness contract, embedded in the binary
+- `harnesses/` — the built-in harness descriptor files (one TOML per harness: declarative values plus named-capability references), schema-validated and embedded in the binary, plus the commented `harness init` templates
+- `profiles/` — the shared plan-mode procedure profile (`--plan-mode`) and runbook templates, embedded in the binary
 
 ## Development
 
diff --git a/docs/byoh.md b/docs/byoh.md
new file mode 100644
index 0000000..da0641d
--- /dev/null
+++ b/docs/byoh.md
@@ -0,0 +1,290 @@
+# Bring your own harness
+
+> **Audience:** anyone (human or agent) pointing eval-magic at a harness it has never seen. No Rust
+> required — a harness declares its capabilities in a TOML descriptor file, and every capability it
+> *doesn't* declare degrades to a documented fallback with a warning, never a rejection. The
+> baseline-vs-enhancement contract behind this is
+> [progressive-enhancements.md](progressive-enhancements.md).
+
+## The five-minute version
+
+From inside a project that dispatches through `cool-custom-harness`:
+
+```sh
+eval-magic harness init cool-custom-harness
+# → .eval-magic/harnesses/cool-custom-harness.toml (a commented template, lint-clean as
+#   written) + cool-custom-harness-notes.md (the verification-record skeleton).
+# Fill in verified values following the template's inline comments, then:
+eval-magic harness lint .eval-magic/harnesses/cool-custom-harness.toml
+eval-magic harness list
+eval-magic run --harness cool-custom-harness
+```
+
+The scaffold registers the name as a baseline harness before a single field is filled in; the
+first field worth uncommenting is `[dispatch] exec_template`, e.g.:
+
+```toml
+label = "cool-custom-harness"
+
+[dispatch]
+exec_template = '''
+cool-cli run --cd <eval-root>{model_arg} \
+  "Read the file at <dispatch_prompt_path> and follow its instructions exactly." \
+  > <outputs_dir>/final-message.md'''
+```
+
+That run is complete: `run` warns about each enhancement the descriptor doesn't declare (naming the
+fallback that carries it), builds `dispatch.json` / `RUNBOOK.md` / `dispatch-manifest.md` with your
+exec recipe, and after you dispatch the tasks, `ingest` assembles records from each task's
+`outputs/final-message.md`, runs the `detect-stray-writes` audit, and hands grading to `llm_judge`.
+
+For a one-off descriptor that shouldn't live in the project, pass it directly — its label becomes
+the invocation's default harness, so `--harness` can be omitted:
+
+```sh
+eval-magic run --harness-file ./cool-custom-harness.toml
+```
+
+## The minimum viable descriptor
+
+`label` alone loads:
+
+```toml
+label = "cool-custom-harness"
+```
+
+That is a **baseline** harness: staging is unavailable (runs fall back to `--no-stage`, inlining
+each `SKILL.md` into its dispatch prompt), and dispatch guidance is generic. Add an
+`[dispatch] exec_template` and the generated `RUNBOOK.md` / `dispatch-manifest.md` carry a
+copy-pasteable per-task recipe instead.
+
+### The exec-template contract
+
+`exec_template` is the one-shot command that dispatches a single task. eval-magic substitutes
+`{model_arg}` (the harness's model flag + requested model, empty unless `[model].flag` is declared)
+and `{guard_args}` (guard-only arguments, built-ins only); the `<eval-root>`,
+`<dispatch_prompt_path>`, and `<outputs_dir>` placeholders are filled per task by whoever dispatches
+(the runbook explains this). Two hard requirements:
+
+1. **Run from the task's `eval_root`** — each task's per-`(group, condition)` env dir is the
+   subprocess cwd.
+2. **Recover the final message** — the agent's final reply must land in
+   `outputs/final-message.md`. If your CLI can't write it directly (like the example above
+   redirecting stdout), capture it yourself before running `ingest`.
+
+## Layering and field-level merge
+
+Descriptor files stack in precedence order; **later layers override individual fields** of an
+earlier descriptor with the same `label` (tables merge key-by-key; scalars and arrays replace
+wholesale — never whole-file shadowing). A new `label` defines a new harness.
+
+1. **Embedded built-ins** — `claude-code`, `codex`, `opencode` (bundled in the binary).
+2. **User-global** — `<config-root>/harnesses/*.toml`, where the config root is
+   `$EVAL_MAGIC_CONFIG_DIR` (empty value disables the layer), else `$XDG_CONFIG_HOME/eval-magic`,
+   else `~/.config/eval-magic`.
+3. **Project-local** — `<cwd>/.eval-magic/harnesses/*.toml`.
+4. **`--harness-file <path>`** — a one-off top layer; when `--harness` is omitted its label is the
+   invocation's default harness.
+
+Files within one directory apply in filename order; one file per label per layer (a duplicate is
+skipped with a warning). So a project can retune a single built-in field without restating the
+descriptor:
+
+```toml
+# .eval-magic/harnesses/claude-code.toml — override one field of a built-in
+label = "claude-code"
+
+[model]
+flag = "--model-x"
+```
+
+`eval-magic harness show claude-code` prints the resolved post-merge descriptor (as authorable
+TOML, headed by the contributing files) — the fastest way to see what a layer actually changed.
+Two caveats: the merge can't *delete* (an override can replace a field's value but cannot remove
+an embedded table), and a guarded built-in's output isn't copy-paste-safe as a user layer until
+you drop its `[guard]` table and `run.supports_guard` (see the guard restriction below).
+
+**Broken discovered files never brick the CLI** — they are skipped with a warning pointing at
+`eval-magic harness lint <file>`. A broken `--harness-file` is a hard error (you named it
+explicitly).
+
+## Field reference
+
+The authoritative field-by-field reference is the bundled schema,
+[`schema/harness-descriptor.schema.json`](../schema/harness-descriptor.schema.json); the semantics
+and fallbacks per enhancement are in
+[progressive-enhancements.md](progressive-enhancements.md), and `harness init` writes the same
+map as inline comments in its scaffolded template. The short map:
+
+| Table | Declares | Fallback when absent |
+|-------|----------|----------------------|
+| (top level) | `label` (required), `skills_dir`, `config_dirs` | no `skills_dir` ⇒ forced `--no-stage`, SKILL.md inlined |
+| `[dispatch]` | exec/parallel/judge/next-steps/manifest templates | generic handoff text; with only `exec_template`, generic recipes are built around it |
+| `[transcript]` | `events_filename` + exactly one of `parser` (a named capability) or `extract` (the declarative tier) | `transcript_check` grades unverifiable, `llm_judge` carries grading, tokens/duration unrecorded |
+| `[model]` | `flag` | `--agent-model`/`--judge-model` recorded as provenance only |
+| `[staging]` + `[skills_block]` | slug/naming rules, skills-block format | `--no-stage` inlining |
+| `[tools]` | tool-name vocabulary by role | required alongside `[transcript]` (the stray-writes audit classifies by it) |
+| `[shadow]` | `preflight` (named capability) | no shadow report — correct for harnesses that load nothing global |
+| `[guard]` | **built-ins only** — see below | `detect-stray-writes` audits after the fact |
+
+### Named capabilities: real code for free
+
+Everything that is genuinely code — transcript stitching, slug sanitization, shadow scanning —
+is a **named capability** a descriptor references. If your harness emits a compatible stream,
+you get the full feature from configuration alone:
+
+- `transcript.parser = "claude-stream-json"` — Claude Code `-p --output-format stream-json` events.
+- `transcript.parser = "codex-items"` — Codex `item.started`/`item.completed` JSONL.
+- `staging.slug_capability = "opencode"` — OpenCode's sanitizing slug rules.
+- `shadow.preflight = "claude-plugins"` — the Claude plugin/global-skills shadow scan.
+
+For example, a harness that logs Codex-compatible item JSONL gets full transcript ingest — parsed
+tool invocations, `transcript_check` grading, the works — with:
+
+```toml
+[tools]
+write = ["file_change"]
+shell = ["command_execution"]
+
+[transcript]
+events_filename = "cool-events.jsonl"
+parser = "codex-items"
+```
+
+An unknown capability name fails the schema gate listing the allowed values.
+
+### The declarative extractor: flat streams with zero code
+
+A stream where every tool event is **self-contained** — name, args, and result in the same
+record — doesn't need a code parser at all: a `[transcript.extract]` block describes the mapping
+and one generic engine executes it, unlocking the same transcript ingest a named parser gives
+(`transcript_check` grading, parsed invocations in `run.json`, token/duration backfill into
+`timing.json`). The built-in `codex` harness ingests through exactly this block:
+
+```toml
+[transcript]
+events_filename = "codex-events.jsonl"
+surfaces_skill_invocation = false
+
+# Flat tool-item mapping: each matching record's item object becomes one
+# tool invocation, in stream order.
+[transcript.extract.tools]
+where = { type = "item.completed" }
+item = "item"       # dotted path to the tool object; omit when the record is the item
+name_field = "type" # the item field naming the tool; records without it are skipped
+skip_names = ["agent_message", "reasoning", "plan_update"]
+args_omit = ["id", "type", "status", "output", "result", "error"]
+result_coalesce = ["output", "result", "error"]
+
+# Final text: dotted-path string pick over matching records; last match wins.
+[transcript.extract.final_text]
+where = { type = "item.completed", "item.type" = "agent_message" }
+field = "item.text"
+
+# Tokens: over matching records, sum the listed integer fields.
+[transcript.extract.tokens]
+where = { type = "turn.completed" }
+sum = ["usage.input_tokens", "usage.output_tokens", "usage.reasoning_output_tokens"]
+
+# Duration: last minus first RFC 3339 timestamp — or `field = "<path>"` to
+# pick a millisecond value directly (declare exactly one of the two).
+[transcript.extract.duration]
+timestamp_spread = "timestamp"
+```
+
+The primitive set is exactly five, deliberately minimal:
+
+1. **`where`** — a dotted-path → expected-string equality filter shared by every sub-table
+   (omitted = every record matches). String equality only: no operators, negation, or wildcards.
+2. **`final_text`** — a field pick; the last matching record wins.
+3. **`tools`** — the flat tool-item mapping: name from `name_field`, args = the item minus
+   `args_omit` (key order preserved; `null` when nothing remains), result = the first *present*
+   field of `result_coalesce` (present-but-null counts; strings verbatim, everything else compact
+   JSON).
+4. **`tokens`** — sum the `sum` fields over matching records. A missing or non-integer field
+   counts 0, but a record where *no* listed path resolves leaves the total untouched — it never
+   turns an absent total into zero.
+5. **`duration`** — a millisecond `field` pick (last match wins) or `timestamp_spread` (last
+   minus first; needs at least two parseable timestamps).
+
+Dotted paths (`"usage.input_tokens"`, `"item.text"`) descend nested objects only — there is no
+array indexing, and keys containing literal dots are unaddressable. Malformed JSONL lines are
+silently skipped, as with every parser. `[transcript]` requires the `[tools]` write/shell
+vocabulary alongside it (the stray-writes audit classifies by it). Leave
+`surfaces_skill_invocation` false unless the mapping verifiably yields invocations named `Skill`
+carrying an `args.skill` field.
+
+**If a stream needs more than these primitives, it's a code capability, not a bigger DSL.** The
+line is cross-event state: a stream whose tool results arrive in *separate* records joined by id
+(Claude Code's `tool_use`/`tool_result` pairing), or whose content needs shape-dependent
+coercion, is what named parsers are for — that's `claude-stream-json`, and it stays code.
+
+### The guard restriction
+
+User-supplied descriptors may **not** declare `[guard]` or set `run.supports_guard = true`: the
+write guard **fails open** — a mistyped guard block would silently disarm it — so guard data
+stays restricted to the embedded built-in descriptors. Unguarded runs fall back to the
+`detect-stray-writes` audit: on a harness defined only by user descriptors the guard's auto-arm
+quietly stays off (the `run` preflight warns naming the fallback), and only an explicit
+`run --guard` is rejected in preflight (the run stops rather than continuing silently unguarded).
+A project-local overlay of a guarded built-in is fine — the restriction applies to the user
+file's own content, and the embedded guard merges through underneath it.
+
+## Verify, don't guess
+
+Every CLI flag, events filename, and event shape in a descriptor must come from the harness's own
+documentation or from output you observed — never by analogy with another harness. Record each
+value's source (docs URL, `--help` output, observed events file) plus the harness version in the
+scaffolded notes file, `.eval-magic/harnesses/<name>-notes.md`: it is the verification record
+behind the descriptor, and the same file an upstream PR promotes to `docs/<name>-notes.md`. The
+`harness init` template embeds a VERIFY prompt at every field where guessing is tempting.
+
+## The workflow
+
+```sh
+eval-magic harness init <name>   # scaffold the commented descriptor template + notes
+                                 # skeleton — lint-clean before a single field is filled in
+eval-magic harness lint <file>   # full per-file report: TOML + schema, user-layer
+                                 # restrictions, cross-field invariants (merged onto the
+                                 # registered harness with the same label, if any)
+eval-magic harness lint <name>   # strictly re-lint every discovered layer of a name —
+                                 # surfaces files that registry init skipped with a warning
+eval-magic harness list          # every registered harness: layers + declared enhancements
+eval-magic harness show <name>   # the resolved post-merge descriptor as authorable TOML
+```
+
+Then `run --harness <name>` and read the warnings: each one names the fallback carrying that part
+of the run, which doubles as your wiring roadmap — declare the enhancement and the warning
+disappears. (A `harness lint --probe` live dispatch check — rendering the exec template with a
+trivial prompt and verifying final-message recovery — is planned; see the tracking issue.)
+
+## Upstreaming your descriptor
+
+A descriptor that proves out locally can become a built-in — as a **data-only PR**, no Rust
+beyond a mechanical registration. What counts as data vs code:
+
+- **Data — one descriptor PR:** the descriptor file itself: `label` / `skills_dir` /
+  `config_dirs`, the `[dispatch]` templates, `[model]`, `[staging]` + `[skills_block]`,
+  `[tools]`, the `[run]` booleans, a `[transcript.extract]` block (the declarative tier is pure
+  data), and `[transcript]` / `[shadow]` **when they reuse an existing named capability**
+  (`claude-stream-json`, `codex-items`, `opencode`, `claude-plugins`).
+- **Code — one capability per PR, separate from the descriptor PR:** a new transcript parser,
+  slug capability, or shadow preflight (each is `src/adapters/capabilities.rs` + a
+  `src/adapters/<harness>/` module + a schema enum entry), and guard support (`[guard]` data is
+  built-in-only — see the guard restriction above).
+
+The PR itself is four files — open it with the
+[harness-descriptor PR template](../.github/PULL_REQUEST_TEMPLATE/harness-descriptor.md), either
+via the compare-URL query `?template=harness-descriptor.md&expand=1` or with
+`gh pr create --body-file` on a filled copy:
+
+1. `harnesses/<label>.toml` — your `.eval-magic/harnesses/<label>.toml`, promoted.
+2. `src/adapters/descriptor.rs` — its `EMBEDDED_DESCRIPTORS` entry (mechanical registration).
+3. `docs/<label>-notes.md` — your scaffolded notes file, promoted: the verification record for
+   every field, per the don't-guess guardrail.
+4. `README.md` — a new support-table row, baseline first, only the wired enhancement columns
+   checked. Only upstreamed built-ins get a table row — project-local descriptors never do.
+
+Attach the evidence the template asks for: clean `harness lint` output, a smoke eval run
+end-to-end (`run` → dispatch → `ingest` → `finalize`), and the harness version you verified
+against.
diff --git a/docs/claude-notes.md b/docs/claude-notes.md
new file mode 100644
index 0000000..b6209a7
--- /dev/null
+++ b/docs/claude-notes.md
@@ -0,0 +1,80 @@
+# Claude Code — harness implementation notes
+
+> **Audience:** developers working on eval-magic's Claude Code support. Runtime usage lives in the
+> README, `--help`, and the generated `RUNBOOK.md`; the enhancement model is in
+> [progressive-enhancements.md](progressive-enhancements.md).
+
+## Code map
+
+The declarative half (label, dirs, phrases, command templates, banner) is the descriptor file
+`harnesses/claude-code.toml`; `src/adapters/claude_code/` keeps only the code capabilities the
+descriptor references:
+
+| File | What's in it |
+|------|--------------|
+| `harnesses/claude-code.toml` | the descriptor — every declarative value + capability references |
+| `stream_json.rs` | `-p --output-format stream-json` transcript parsing (`claude-stream-json`) |
+| `transcript.rs` | JSONL record shapes + shared tool-call extractors |
+| `plugin_shadow.rs` | plugin-shadow detection + isolation banner (`claude-plugins`) |
+
+The write guard has no per-harness code: the descriptor's `[guard]` block (hook file, matcher,
+hook-entry and `hookSpecificOutput` verdict templates) is rendered by the generic engine in
+`src/adapters/guard.rs`; the hidden `guard` subcommand is its frozen hook entry-point alias.
+
+## Dispatch quirks (all forced by the `claude` CLI)
+
+- `--output-format stream-json` **requires `--verbose`** in `-p` mode.
+- There is **no `--cd` flag**: every dispatch must run from its env dir (`cd <eval-root> &&`).
+  Staged-skill discovery is cwd-relative, so getting this wrong makes the `with_skill` arm behave
+  like `without_skill`.
+- There is **no `--output-last-message`**: the final message is recovered from the stream-json
+  `result` event rather than a file.
+- `</dev/null` detaches stdin so a permission prompt can't block on a TTY and piped task data
+  can't become extra prompt context.
+
+## Transcript (stream-json)
+
+`outputs/claude-events.jsonl` is the `-p` stream-json stream. `assistant`/`user` events wrap full
+Anthropic Messages objects (tool-call extraction matches `tool_result` blocks back to their
+`tool_use` by id); a terminal `result` event carries the authoritative final text, wall-clock
+duration, and token usage — there are no per-line timestamps. `system`, `rate_limit_event`, and
+other non-message events are skipped. The transcript exposes Skill-tool invocations, so the
+`__skill_invoked` meta-check is deterministic here.
+
+## Skill discovery & staging
+
+Staged skills live at `.claude/skills/` in each env; discovery is structural and cwd-relative, and
+envs are fully built before any dispatch runs, so there is no mid-session staging hazard. The Skill
+tool resolves the staged directory name directly: the frontmatter `name:` is **not** rewritten
+(`rewrites_frontmatter_name` is false) and the natural name is advertised.
+
+## Isolating from installed plugins
+
+Each `claude -p` dispatch loads the user/global plugins and skills from its Claude config. The
+staging slug prevents an on-disk collision but not runtime discovery — an installed plugin exposing
+a same-named skill is discoverable in *both* arms, so the control arm is not truly skill-absent.
+`plugin_shadow.rs` detects this at build time and surfaces it as the shadow banner plus
+`benchmark.json` `validity_warnings`; the runner can detect but never unload a live plugin. The
+remediation options (also printed inline in the banner):
+
+- **Drop user-scope plugins, keep auth:** add `--setting-sources project,local` to the dispatch.
+  User-scope `enabledPlugins` isn't loaded; auth is unaffected.
+- **Disable the specific plugin:** set `"enabledPlugins": { "<plugin>@<marketplace>": false }` in a
+  settings source the dispatch loads.
+- **Clean config dir (strips everything):** run each dispatch under
+  `CLAUDE_CONFIG_DIR="$(mktemp -d)"`. No installed plugins or global skills load. Auth caveat:
+  OAuth lives in `~/.claude.json`, which a relocated config dir may not carry — set
+  `ANTHROPIC_API_KEY` or re-authenticate once in the fresh dir.
+
+Project-local staged skills are independent of installed plugins, so they still load and the
+meta-check still resolves the slug under all three options.
+
+## Write guard
+
+A guarded run (the guard auto-arms; `--guard`/`--no-guard` make it explicit) merges a
+`PreToolUse` hook into each env's `.claude/settings.local.json` (matcher:
+`Write|Edit|MultiEdit|NotebookEdit|Bash`). Every dispatch runs from its env, so it loads and
+enforces the hook — the recipe never passes `--bare`, which would skip hook discovery. The hook
+invokes the hidden `guard` subcommand (**stable on-disk contract — never rename**), which denies
+via Claude Code's `hookSpecificOutput` JSON shape and stays silent to allow. Both layers fail open.
+A deny aborts the offending dispatch; `detect-stray-writes` remains the after-the-fact backstop.
diff --git a/docs/codex-notes.md b/docs/codex-notes.md
new file mode 100644
index 0000000..091d8b6
--- /dev/null
+++ b/docs/codex-notes.md
@@ -0,0 +1,74 @@
+# Codex — harness implementation notes
+
+> **Audience:** developers working on eval-magic's Codex support. Runtime usage lives in the
+> README, `--help`, and the generated `RUNBOOK.md`; the enhancement model is in
+> [progressive-enhancements.md](progressive-enhancements.md).
+
+## Code map
+
+The declarative half (label, dirs, phrases, command templates, banner) is the descriptor file
+`harnesses/codex.toml`; `src/adapters/codex/` keeps only the code capabilities the descriptor
+references:
+
+| File | What's in it |
+|------|--------------|
+| `harnesses/codex.toml` | the descriptor — every declarative value + capability references |
+| `transcript.rs` | `item.completed` event-stream parsing (`codex-items`) |
+
+The write guard has no per-harness code: the descriptor's `[guard]` block (hook file, matcher,
+hook-entry and `{"decision": "block"}` verdict templates) is rendered by the generic engine in
+`src/adapters/guard.rs`; the hidden `guard-codex` subcommand is its frozen hook entry-point
+alias.
+
+## Dispatch (`codex exec`)
+
+- The approval policy must come **before** `exec`: `codex --ask-for-approval never exec …`
+  (codex-cli rejects it after `exec`).
+- `--cd <eval-root>` sets the dispatch cwd (no shell `cd` needed, unlike Claude Code).
+- `--sandbox workspace-write` bounds writes to the env.
+- `--json` streams events to stdout — captured as `outputs/codex-events.jsonl`; stderr goes to
+  `codex-stderr.log` so progress/status text (e.g. stdin notices) stays out of the JSONL.
+- `--output-last-message <outputs_dir>/final-message.md` writes the final-message file the
+  pipeline reads.
+- `</dev/null` matters when dispatching in parallel from a pipe (e.g. `xargs -P`): without it,
+  Codex treats piped stdin as additional prompt context.
+
+## Model flag
+
+`-m <model>` is inserted before `--json` when `run --agent-model` is set. Judge recipes read each
+task's resolved `model` from `judge-tasks.json` (`run --judge-model` sets the default; a
+per-assertion `llm_judge.model` overrides it) and pass `-m "$model"` only when one is present.
+
+## Staging & discovery
+
+Skills stage under repo-local `.agents/skills/`. Codex keys discovery on the frontmatter `name:`,
+so the staged skill-under-test's frontmatter is rewritten to the eval slug
+(`rewrites_frontmatter_name` true) and the available-skills block advertises the slug
+(`advertises_staged_slug_name` true).
+
+## Transcript (`item.completed`)
+
+`item.completed` events whose item type is not an agent message / reasoning / plan update become
+tool invocations: `command_execution`, `file_change`, `web_search`, and MCP items.
+`transcript_check` matches these parsed items. The JSONL exposes **no deterministic skill-tool
+event**, so `transcript_surfaces_skill_invocation()` is false and the `__skill_invoked` meta-check
+uses the LLM-judge fallback. Token accounting excludes cached input tokens.
+
+## Write guard
+
+A guarded run (the guard auto-arms; `--guard`/`--no-guard` make it explicit) merges a
+`PreToolUse` hook into `.codex/hooks.json` (matcher:
+`^Bash$|^apply_patch$|^Edit$|^Write$`, with a 30s timeout and status message). Dispatches must pass
+`--dangerously-bypass-hook-trust` so the vetted project-local hook actually runs — the generated
+recipes add it whenever the run was armed. The hook invokes the hidden `guard-codex` subcommand
+(**stable on-disk contract — never rename**), which blocks via Codex's
+`{ "decision": "block", "reason": "..." }` stdout shape and stays silent to allow. Teardown prunes
+`.codex/` when restoring the original config leaves it empty (`guard_hook_cleanup_dir`).
+
+## Running inside Codex itself
+
+`eval-magic run --harness codex` from a Codex session writes `.agents/skills` (and, when the
+guard is armed, `.codex/hooks.json`). Those project-local Codex config paths are protected by Codex's
+default workspace-write sandbox, so the runner may need approval/escalation or an external
+terminal invocation. That approval is Codex's own permission boundary, not something eval-magic
+bypasses.
diff --git a/docs/harness-parity.md b/docs/harness-parity.md
deleted file mode 100644
index 15be4bf..0000000
--- a/docs/harness-parity.md
+++ /dev/null
@@ -1,147 +0,0 @@
-# Eval-Magic Harness Parity Check
-
-You are an agent running inside one of the eval runner's supported harnesses. This file walks you through auditing **how completely your harness is wired into the eval runner** and prepping to close one gap.
-
-This file covers the **`eval-magic` runner only** — the infrastructure in `eval-magic` that dispatches, records, and grades skill evals.
-
-Read the file end-to-end before acting. Steps 4a and 4b are the source of truth for what "eval-magic parity" means today — when the runner gains a new dispatch mechanism or the `HarnessAdapter` trait gains a method, those steps are updated and this file stays evergreen.
-
-## The two parity axes
-
-Parity is organized around **run mode** — *how* an eval is dispatched — as the primary axis, with the harness adapter as the plug-in surface beneath it:
-
-1. **Run-mode / dispatch-mechanism parity (primary).** Every dispatch uses one of two mechanisms, defined as `DispatchMechanism` in `src/core/run_mode.rs`:
-   - **`InSession`** — the runner hands tasks to in-session subagents (Claude Code's Task tool). **Claude Code** is the reference.
-   - **`Cli`** — each task is dispatched through a one-shot harness CLI subprocess (`codex exec`). **Codex** is the reference.
-
-   These two mechanisms underpin the three *user-facing* run modes (the `RunMode` enum, same file) in the README's [Run modes](../README.md#run-modes) section: **fully-interactive** rides on `InSession`; **headless** and **hybrid** both ride on `Cli` (`RunMode::mechanism()`). The mechanism is selected per run by the `--run-mode` flag, not fixed by the harness: `resolve_run_mode(harness, requested)` defaults the mode per harness (Claude Code → interactive, Codex/OpenCode → hybrid) and rejects combinations a harness doesn't support. A single harness can therefore wire more than one mechanism — Claude Code wires both `InSession` (interactive) and `Cli` (hybrid + headless). `capabilities_for(harness)` (same file) carries the narrow run-option capabilities the generic `run` preflight validates.
-
-2. **Harness-adapter feature parity (the plug-in surface).** Each harness plugs into the runner through one impl of the **`HarnessAdapter`** trait in `src/adapters/harness.rs`, resolved by `adapter_for(harness)`. The trait's methods *are* the feature surface: skill-list rendering, transcript parsing, staged-skills dir, plan-mode profile, the write-guard hook, and the `Cli`-mechanism dispatch guidance. A harness reaches parity for a mechanism by implementing the trait methods that mechanism consumes.
-
-A harness can wire a mechanism yet leave some adapter methods at their stub/default (lower fidelity), or implement rich adapter methods while only supporting one mechanism. Step 4 audits both axes.
-
----
-
-## Step 1 — Identify your harness
-
-Name the harness you are running in. You almost certainly already know — confirm by checking:
-
-- Your invocation context and working directory
-- The tool names available to you in this session
-- Any session-start context block injected at the top of the conversation
-
-The intended supported harnesses are: **Claude Code, Codex CLI, OpenCode**.
-
-If the harness you are running in is not in that list, stop and ask the user before continuing.
-
----
-
-## Step 2 — Read the reference materials
-
-Read these in order. Paths are relative to the repository root.
-
-| Source | What to look for |
-|--------|------------------|
-| `src/core/run_mode.rs` | `DispatchMechanism`, `RunMode`, `resolve_run_mode`, and `capabilities_for`. The two dispatch mechanisms, the user-facing run modes that select them (and which a harness supports), and the focused run-option capabilities generic preflight validates |
-| `src/adapters/harness.rs` | The `HarnessAdapter` trait (the feature surface), the three impls, and `adapter_for`. The reference impls are `ClaudeCodeAdapter` (`InSession` *and* `Cli` via hybrid/headless) and `CodexAdapter` (`Cli`) — read the one that matches your mechanism |
-| `src/adapters/claude_code_transcript.rs`, `src/adapters/claude_stream_json.rs`, and `src/adapters/codex_transcript.rs` | The reference transcript parsers. The `InSession` branch uses `parse_transcript*`; the `Cli` branch uses `parse_cli_events*` (default-delegating to `parse_transcript*`, so Codex's events parser serves both). Claude Code splits them: `parse_transcript*` parses the in-session subagent JSONL, `parse_cli_events*` parses `claude -p` stream-json (`claude_stream_json.rs`). A second harness translates its transcript shape into the same `ToolInvocation` list / `TranscriptSummary` |
-| `eval-magic --help` and the README's [Environment parity](../README.md#environment-parity) / [Harnesses](../README.md#harnesses) sections | The cross-harness breadcrumbs and the flag-by-flag reference. Treat the breadcrumbs as starting points, not specifications |
-
-Do not skim. The parity report you produce in Step 4 is only as good as the reference you internalized here.
-
----
-
-## Step 3 — Discover your harness's existing surface area
-
-Enumerate, using ordinary file search, what already exists for your harness. Do not rely on memory — search the working tree. Useful heuristics:
-
-- Your harness's arm in `adapter_for`, its mode support in `resolve_run_mode`, and its `HarnessAdapter` impl in `src/adapters/harness.rs`
-- The harness name anywhere inside `src/` (especially `src/adapters/`, `src/core/context.rs`) and `profiles/`
-- A per-harness section in the README, or tests exercising the runner for the harness (`tests/`, e.g. `tests/run/codex.rs`, `tests/run/opencode.rs`)
-
-Record every path you find. You will reference them in Step 4.
-
----
-
-## Step 4a — Audit run-mode / mechanism parity
-
-State which `DispatchMechanism`(s) your harness supports today, per `resolve_run_mode` (the run modes it accepts), and whether each mechanism's path is end-to-end:
-
-- **`InSession`** consumes: `parse_transcript` / `parse_transcript_full` against a subagents-dir transcript source (no `cli_events_filename`), and the in-session next-steps guidance (mechanism-level, not adapter-supplied).
-- **`Cli`** consumes these `HarnessAdapter` methods: `parse_cli_events` / `parse_cli_events_full` (the events parser, defaulting to `parse_transcript*`), `cli_events_filename` (the per-task transcript file the CLI writes), `cli_model_flag` (the harness-native model-selection flag, when supported), `cli_next_steps` (the post-`run` dispatch guidance), `cli_manifest_section` (the dispatch-manifest recipe, gated on the resolved mechanism), and `cli_judge_next_steps` (the post-`grade` / post-`ingest` judge dispatch recipe).
-
-A harness reaches mechanism parity when its mechanism's path runs end-to-end: dispatch guidance is emitted, the transcript is found and parsed, and `record-runs` / `fill-transcripts` assemble records. The intended end state is each harness supporting every mechanism that translates to it (the README's [Run modes](../README.md#run-modes) matrix tracks current support).
-
-## Step 4b — Audit harness-adapter feature parity
-
-For each `HarnessAdapter` method below, compare your harness's impl against the reference. Methods are described by what they *do* so they survive renames; when the trait changes, this list is updated and the rest of the file still applies.
-
-| Adapter capability | Trait method(s) | Reference behavior |
-|--------------------|-----------------|--------------------|
-| Realistic eval environment (skill staging) | `skills_dir`, `render_available_skills_block`, `rewrites_frontmatter_name`, `advertises_staged_slug_name`, `skill_surface_phrase`, `skill_unresolved_phrase` | Stage skills under the harness's project-local dir and render the discoverable-skills block in the harness's **native** presentation, so a dispatch reads like a real session in that harness, not an eval. Claude Code: `.claude/skills/` + `The following skills are available for use with the Skill tool:`. The `--bootstrap` `<session-start-context>` wrapper and the slug-disambiguation framing are shared in `src/cli/run/dispatch.rs` |
-| Skill-eval transcript adapter | `parse_transcript`, `parse_transcript_full` (InSession); `parse_cli_events`, `parse_cli_events_full` (Cli) | Translate the harness's persisted transcript into the same `ToolInvocation` list and `TranscriptSummary` (final message, tool invocations, deduped usage/timing) every downstream stage consumes. The Cli pair defaults to the InSession pair, so a Cli-only harness implements one parser; a harness wiring **both** mechanisms (Claude Code) implements each — `parse_transcript*` for its in-session transcript, `parse_cli_events*` for its CLI events file |
-| Skill-eval auto-record (run/timing assembly) | (consumes `parse_transcript_full` / `parse_cli_events_full` + `cli_events_filename`) | `src/pipeline/record_runs.rs` assembles each task's `run.json` + `timing.json` from disk: carry-over fields from `dispatch.json`, `final_message` from `outputs/final-message.md` (falling back to the transcript's final text — the primary path for `claude -p`, which has no `--output-last-message`), and tool invocations/tokens/duration from the parsed transcript. A harness closes this gap by supplying the transcript its parser consumes (the portable fallback — hand-authored records against `run-record.schema.json` — is unchanged) |
-| Cli model selection | `cli_model_flag`, `cli_next_steps`, `cli_manifest_section`, `cli_judge_next_steps` | For one-shot CLI dispatch, `run --agent-model` is rendered into the agent command recipe and `run --judge-model` becomes the default model in `judge-tasks.json`; assertion-level `llm_judge.model` remains the most specific override. Codex is the reference: `cli_model_flag` returns `-m`, agent recipes render `codex --ask-for-approval never exec ... -m <model>`, and judge recipes read each task's resolved `model` and pass `-m "$model"` only when present |
-| Eval subagent write enforcement | `install_guard` | Opt-in `--guard` stages a pre-tool hook (`src/sandbox/`) that *denies* subagent writes/installs outside the eval sandbox while dispatches run. Portable fallback for every harness: the `eval-magic detect-stray-writes` post-pass (`src/pipeline/detect_stray_writes.rs`) flags out-of-bounds writes from the parsed transcript after the fact |
-| Eval plan-mode operating context | `plan_mode_profile`, `render_plan_mode_context` | Opt-in `--plan-mode` injects the harness's `profiles/<harness>/plan-mode.md` (embedded at compile time) as a `<system-reminder>` operating-context layer in every dispatch. Claude Code and Codex profiles exist today; a harness with no profile has no `--plan-mode` and an unchanged dispatch contract |
-| Harness-details operator guide | (docs, not a trait method) | The README's per-harness section, e.g. [Claude Code](../README.md#claude-code-fully-wired) |
-
-**Note on the transcript adapter (raised bar).** Baseline eval suites use `transcript_check` assertions — deterministic regex checks against a run's tool invocations (e.g. "a test command ran", "the sibling skill was loaded"). These only grade when `parse_transcript` is implemented for your harness. A harness without it still functions: those assertions grade as *unverifiable* and the `llm_judge` assertions carry the substantive measurement. But adapter richness is an explicit parity target, not optional polish — implementing or enriching `parse_transcript*` lets more of a baseline suite grade mechanically. Treat it as a goal to aim at, not a box already checked.
-
-**Note on write enforcement (parity goal).** Eval subagents are instructed to write only inside their `outputs/` dir, but nothing in the portable contract *enforces* it — a misbehaving subagent can edit the real repo or install packages, silently tainting the run. Two layers address this: the portable `detect-stray-writes` post-pass (available to every harness, since it works off the same parsed transcript) and an opt-in harness-native `install_guard` that stages a pre-tool hook to *block* the write before it happens. Claude Code and Codex both wire this through their `PreToolUse` hook surfaces — for Claude Code across *both* mechanisms, since `claude -p` loads the same project-local `settings.local.json` hook from the env cwd each dispatch runs in. **Harness-level tool enforcement is an explicit parity goal, not optional polish.** A harness that can express a pre-tool guard (a hook, a permission rule, a sandboxed cwd) should wire `install_guard`; until then, `detect-stray-writes` is the honest fallback.
-
-**Note on plan-mode fidelity (residual parity goal).** `--plan-mode` injects a harness's *verbatim* plan-mode procedure as operating context, the closest a harness's eval runner can get to reproducing the wild failure where a real plan mode makes loading a skill feel redundant. It is **not** the real mode: it is still text the dispatched subagent reads, not a state the harness places it under, so a pass remains necessary-not-sufficient (the seeding ceiling is explained in the [`slow-powers`](https://github.com/slowdini/slow-powers) `evaluating-skills` skill). A harness that can dispatch an eval subagent *into* its own plan/research mode would close this gap; `--plan-mode` (a profile + renderer) is the approximation every harness can reach in the meantime.
-
-Surface your findings inline using this template:
-
-```
-## Eval-Magic Parity Report: <harness>
-
-### Run-mode / mechanism parity
-- Mechanism(s) wired: <InSession | Cli | both> (per resolve_run_mode)
-- End-to-end? <yes / partial — what breaks>
-
-### Harness-adapter feature parity
-- **Skill staging + native skill block** — ✅ Implemented / ⚠️ Partial / ❌ Missing / N/A
-  - Where: <path or "would live at <path>">
-  - Gap: <one sentence, only if Partial/Missing>
-
-(... one block per adapter capability ...)
-
-## Summary
-- Strongest area: <capability>
-- Highest-leverage gap: <capability> — <why>
-- Suggested next gap to close this session: <capability>
-```
-
-Status meanings:
-
-- **✅ Implemented** — fully wired; works the same way the reference's does, using whatever native primitive the harness provides
-- **⚠️ Partial** — some scaffolding exists (e.g. the trait method is a stub or returns the default) but the capability isn't end-to-end functional
-- **❌ Missing** — no implementation; users of this harness do not get this capability
-- **N/A** — the capability doesn't translate. State why
-
-The agent reports inline by default. If the user asks for a persistent artifact, write the report to `docs/parity-reports/<harness>-evals.md` (create the directory if missing).
-
----
-
-## Step 5 — Pick a gap and prep to close it
-
-Surface the report to the user and propose **one or two** gaps worth closing this session. Bias toward the smallest gap with the highest user impact — typically a `parse_transcript` impl or an operator-guide section, not a wholesale runner rework.
-
-Once the user picks a gap:
-
-1. Re-read the reference impl for that capability in detail (the matching `HarnessAdapter` method on `ClaudeCodeAdapter` or `CodexAdapter`, plus what it delegates to). Note the *shape* — inputs, outputs, side effects — separately from the *harness-specific mechanism* it uses.
-2. **Consult your harness's own documentation, MCP servers, or built-in references** before proposing harness-specific changes. Do not guess at hook schemas, transcript formats, or native tool names. If a docs-fetch server is available, prefer it over your training data — assume your knowledge of the harness may be stale.
-3. Propose an adaptation that copies the reference's shape while using your harness's native conventions — i.e. fill in your harness's `HarnessAdapter` method. State explicitly what you are copying and what you are adapting.
-4. Confirm with the user before writing code.
-
----
-
-## Guardrails
-
-- **Cross-harness compatibility is enforced.** A change for your harness MUST NOT break or degrade any other harness. Keep harness-specific behavior behind your `HarnessAdapter` impl; generic run-mode code goes through the trait.
-- **One problem per PR.** A parity-closing PR should wire one capability for one harness.
-- **Do not fabricate features that don't exist in any harness yet.** Parity means "catch up to a reference mechanism/adapter," not "invent something new."
-- **Do not guess at harness-specific details.** If your harness's docs don't confirm something, ask the user before proceeding.
-- **Keep this file evergreen.** If you add a dispatch mechanism (`DispatchMechanism`) or a `HarnessAdapter` method, update Step 4a / 4b here in the same PR.
diff --git a/docs/opencode-notes.md b/docs/opencode-notes.md
new file mode 100644
index 0000000..1ebb5d3
--- /dev/null
+++ b/docs/opencode-notes.md
@@ -0,0 +1,61 @@
+# OpenCode — harness implementation notes
+
+> **Audience:** developers working on eval-magic's OpenCode support. Runtime usage lives in the
+> README, `--help`, and the generated `RUNBOOK.md`; the enhancement model is in
+> [progressive-enhancements.md](progressive-enhancements.md).
+
+## Code map
+
+The declarative half — including the `<available_skills>` XML block templates and the stage-name
+rules (a regex + length cap) — is the descriptor file `harnesses/opencode.toml`;
+`src/adapters/opencode/` keeps only the code capability the descriptor references:
+
+| File | What's in it |
+|------|--------------|
+| `harnesses/opencode.toml` | the descriptor — every declarative value + the `opencode` slug reference |
+| `mod.rs` | slug sanitization/truncation (the `opencode` slug capability) |
+
+## What's wired
+
+Native staging only: `--harness opencode` stages under `.opencode/skills/`, rewrites the staged
+skill-under-test's frontmatter `name:` to a sanitized slug, and renders the `<available_skills>`
+XML block in dispatch prompts. Everything else rides the trait's enhancement defaults:
+
+- **No dispatch recipes** — `cli_next_steps` prints manual `opencode run` guidance instead of a
+  copy-pasteable template.
+- **No transcript ingest** — `cli_events_filename` is `None`, so the ingest pipeline never calls
+  the (defaulted, erroring) parsers; `transcript_check` grades as unverifiable and the
+  `__skill_invoked` meta-check uses the LLM-judge fallback.
+- **No model flag** — `--agent-model` / `--judge-model` are recorded as provenance only.
+- **No write guard** — auto-arm stays off (`run_capabilities().supports_guard` is false) and the
+  `run` preflight warns naming the fallback; an explicit `--guard` warns and continues unguarded.
+  `detect-stray-writes` is the audit fallback.
+
+## Naming rules
+
+OpenCode skill names must be 1–64 characters, lowercase alphanumeric with single-hyphen separators
+(no leading/trailing/consecutive hyphens), and match the containing directory name. `staged_slug`
+sanitizes the generated slug while preserving the `slow-powers-eval-` cleanup prefix (truncating
+the skill portion if the combination exceeds 64 chars); `validate_stage_name` applies the same
+rules to `--stage-name` overrides. Sibling skills stage at their natural names and must already
+satisfy the rules.
+
+## Known inconsistency
+
+The staged skill's frontmatter is rewritten to the slug (`rewrites_frontmatter_name` true) yet the
+available-skills block advertises the *natural* name (`advertises_staged_slug_name` false) —
+tracked for a separate fix.
+
+## Wiring the next enhancements
+
+- **Transcript ingest:** candidate sources are `opencode run --format json` and `opencode export`.
+  Add a parser in a new `transcript.rs`, name it as a capability in
+  `src/adapters/capabilities.rs`, and declare a `[transcript]` table (plus `[tools]` names) in
+  `harnesses/opencode.toml`; check whether the stream exposes a deterministic skill event before
+  leaving `surfaces_skill_invocation` at its default.
+- **Dispatch recipes:** an `opencode run` command template in the descriptor's `[dispatch]` table
+  (`exec_template` / `parallel_command_template` / `judge_command_template` +
+  `next_steps_template` / `manifest_template`).
+- **Write guard:** needs an OpenCode pre-tool hook surface — a new engine in
+  `src/adapters/capabilities.rs`. Declare `[guard]` and `run.supports_guard` together — load-time
+  descriptor validation enforces the lockstep.
diff --git a/docs/progressive-enhancements.md b/docs/progressive-enhancements.md
new file mode 100644
index 0000000..ae36d18
--- /dev/null
+++ b/docs/progressive-enhancements.md
@@ -0,0 +1,276 @@
+# Harness progressive enhancements
+
+> **Audience:** developers working on the eval-magic codebase. The README and `eval-magic --help`
+> are the user-facing docs; this file explains how harness support is structured in code and what
+> wiring more of it buys. Per-harness implementation notes live in [claude-notes.md](claude-notes.md),
+> [codex-notes.md](codex-notes.md), and [opencode-notes.md](opencode-notes.md). Pointing eval-magic
+> at a harness it doesn't know — user-supplied descriptor files, layering, `harness
+> list`/`show`/`lint` — is the user-facing [byoh.md](byoh.md).
+
+Harness compatibility is not a parity checklist to audit — it is **a minimal baseline every harness
+satisfies, plus optional enhancements** a harness's adapter opts into. A missing enhancement
+degrades fidelity, never correctness: every enhancement has a documented fallback.
+
+## One dispatch mechanism
+
+Every eval test and judge is dispatched the same way: through the harness's one-shot CLI, one
+subprocess per task, each `cd`'d into its `(group, condition)` env and writing its output to disk.
+There is no other mode. The **generated artifacts are the runtime source of truth** for how to
+dispatch: `run` writes `RUNBOOK.md` and `dispatch-manifest.md` carrying the exact per-task recipe
+for the selected harness (rendered by the adapter's dispatch-recipe methods) — hand-maintained docs
+never carry command recipes.
+
+## The baseline contract
+
+A harness qualifies at baseline with no harness-specific code beyond naming itself:
+
+1. **A headless exec command** — some way to invoke the harness with a prompt from a chosen cwd and
+   let it run to completion.
+2. **A recoverable final message** — the agent writes `outputs/final-message.md` (the dispatch
+   prompt asks for this), or transcript ingest recovers it where it is wired.
+3. **`--no-stage` when native staging isn't wired** — each `SKILL.md` is inlined into its dispatch
+   prompt instead of staged for native discovery.
+
+That baseline already yields a working eval: `llm_judge` assertions grade every behavior, and the
+`detect-stray-writes` post-pass (folded into `ingest`) audits out-of-bounds writes from whatever
+run records exist. Run records without transcript ingest are assembled by hand per
+`schema/run-record.schema.json`.
+
+In descriptor terms the baseline is one required field: `label`. Everything else in a harness
+descriptor is optional — an absent field or table gets a working generic fallback, and the `run`
+preflight *warns* naming that fallback rather than rejecting (a harness without `skills_dir`
+forces `--no-stage`; without a declared guard the run continues unguarded behind the
+`detect-stray-writes` audit; requested models without a model flag are recorded as provenance
+only). Supported enhancements are provided automatically — the write guard auto-arms wherever a
+harness declares one and staging is active (`--no-guard` opts out). Only genuinely contradictory
+flag combinations stay errors.
+
+## Where this lives in code
+
+- `harnesses/<label>.toml` — one embedded **descriptor file** per built-in harness, carrying every
+  declarative value (labels, dirs, capability booleans, phrases, command templates, banner prose).
+  Descriptors are schema-gated (`schema/harness-descriptor.schema.json`) and invariant-checked at
+  load time.
+- `src/adapters/registry.rs` — the label-keyed registry: `init_registry` loads every **layer**
+  (embedded → user-global → project-local → `--harness-file`) with field-level merge per label,
+  and `adapter_for()` resolves each `Harness` handle to its descriptor-backed adapter — still the
+  single dispatch point. Broken discovered files skip with a warning; the layer model itself is
+  documented in [byoh.md](byoh.md).
+- `src/adapters/descriptor/layers.rs` — layer discovery (config-root resolution, per-directory
+  scans, the `--harness-file` top layer) and the user-layer restrictions (no `[guard]`).
+- `src/adapters/harness.rs` — the `HarnessAdapter` trait, tiered into baseline and enhancement
+  sections.
+- `src/adapters/descriptor.rs` — the descriptor model, the per-file schema gate
+  (`parse_descriptor_value`), field-level merge (`merge_descriptor_value`), and
+  `finalize_descriptor` (the load-time invariants, with merged-file provenance in every message);
+  `src/adapters/descriptor_adapter.rs` — the one generic `DescriptorAdapter` implementing the
+  trait from a descriptor.
+- `src/adapters/capabilities.rs` — the **named capabilities**: closed enums a descriptor references
+  by kebab-case name for everything that is real code (transcript parsers, slug generation,
+  shadow preflight). The write guard needs no named capability: it is pure `[guard]` data
+  rendered by the one generic engine in `src/adapters/guard.rs`.
+- `src/adapters/<harness>/` — only the code behind those capabilities: transcript parsers, the
+  plugin-shadow scan, the OpenCode slug sanitizer.
+- `run_capabilities()` (descriptor table `[run]`) + `harness_run_preflight()`
+  (`src/cli/run/util.rs`) — the `run` preflight: it resolves the guard tri-state (auto-arm when
+  the harness declares a guard and staging is active; `--guard`/`--no-guard` make it explicit),
+  and undeclared enhancements warn naming their fallback and adjust the options (guard forced
+  off, missing `skills_dir` forces `--no-stage`, the no-transcript-parser warning scoped to eval
+  configs that actually use `transcript_check`, missing dispatch recipes noted); only
+  contradictory flag combinations (`--bootstrap`/`--stage-name` where the descriptor declares
+  them incompatible with `--no-stage`) and an explicit `--guard` on a user-descriptor-only
+  harness reject.
+
+## The enhancements
+
+Each enhancement is a group of descriptor fields — plus a named capability where code is involved —
+with defaults. Wire them together; load-time descriptor validation (`validate_descriptor` in
+`src/adapters/descriptor.rs`) rejects the combinations that must move in lockstep, with an
+actionable message per violation.
+
+### Transcript ingest
+
+*Why harness-specific:* every harness persists a different event stream (Claude Code's `-p`
+stream-json, Codex's `item.completed` JSONL) — but not all of them need per-harness code. Ingest
+is two-tier: a **flat** stream (each tool event self-contained) is a declarative mapping the
+generic extract engine (`src/adapters/extract.rs`) executes from descriptor data alone, while a
+stream needing cross-event state — keyed `tool_use`/`tool_result` joins, shape-dependent content
+coercion — is real per-harness code behind a named capability. If a stream needs more than the
+extract primitives, it's a code capability, not a bigger DSL.
+
+*What it unlocks:* `transcript_check` assertions, token/duration capture, automatic
+`run.json`/`timing.json` assembly by `ingest`, and — where the transcript exposes a skill-tool
+event — a deterministic `__skill_invoked` meta-check.
+
+*Fallback:* `transcript_check` grades as *unverifiable*, `llm_judge` carries the grading (bias
+suites toward `llm_judge` for such a harness), tokens/duration go unrecorded, records are
+hand-assembled, and the meta-check uses the LLM-judge fallback.
+
+*Descriptor fields:* the `[transcript]` table — `events_filename` (gate: an absent table means the
+ingest pipeline never calls a parser), exactly one of `parser`/`extract` (validation rejects both
+or neither), and `surfaces_skill_invocation`. The `extract` sub-table is the declarative tier:
+five fixed primitives (equality `where` filter, final-text pick, flat tool-item mapping, token
+sum, duration rule), documented with a worked example in [byoh.md](byoh.md) — the built-in `codex`
+descriptor ingests through it.
+*Capability:* `transcript.parser` names the code that stitches a non-flat stream
+(`claude-stream-json`; `codex-items` is the reference implementation the extract engine's
+differential test compares against) — a new harness emitting a compatible event stream reuses one
+with zero code.
+The tool names the transcript yields must be declared in `[tools]` (see the write-guard
+enhancement) or `detect-stray-writes` audits nothing for the harness — validation rejects the
+combination.
+
+### Native skill staging + skills block
+
+*Why harness-specific:* each harness has its own project-local discovery dir and its own way of
+surfacing discoverable skills to a session (Claude Code's Skill-tool list, Codex's `## Skills`
+markdown, OpenCode's `<available_skills>` XML), and some constrain skill naming.
+
+*What it unlocks:* environment parity — the staged skill is discovered the way a real install
+would discover it, instead of being pasted into the prompt.
+
+*Fallback:* `--no-stage` inlines each `SKILL.md` into its dispatch prompt.
+
+*Descriptor fields:* `skills_dir`, `config_dirs`, and the `[staging]` table — `slug_template`
+(or `slug_capability`), `stage_name_pattern`/`stage_name_max_len`/`stage_name_invalid_message`
+(declarative naming rules), `rewrites_frontmatter_name`, `advertises_staged_slug_name`,
+`surface_phrase`, `unresolved_phrase` — plus the `[skills_block]` table (`header`/`item`/`footer`
+format strings with `{name}`/`{description}`/`{path}` placeholders, rendered by the shared
+`skills_block` renderer).
+*Capability:* `staging.slug_capability` for naming rules that need sanitization/truncation beyond
+a format string (`opencode`); simpler rules stay declarative.
+
+### Model flag
+
+*Why harness-specific:* the CLI flag (and its position in the command) differs per harness.
+
+*What it unlocks:* `--agent-model` / `--judge-model` actually select models in the generated
+recipes; judge tasks resolve a per-task model.
+
+*Fallback:* the models are recorded as provenance in `conditions.json` only; dispatches run on the
+harness's default model.
+
+*Descriptor fields:* the `[model]` table — `flag` (consumed as `{model_arg}` by the dispatch
+templates).
+
+### Write guard
+
+*Why harness-specific:* the guard arms a *native pre-tool hook* — hook config location, matcher
+syntax, trust model, and deny-verdict shape are all harness-native (Claude Code's
+`settings.local.json` + `hookSpecificOutput`, Codex's `hooks.json` + `{"decision": "block"}`).
+
+*What it unlocks:* out-of-bounds writes are *blocked before they happen* instead of detected
+afterwards. The guard is provided automatically: every staged run of a guard-declaring built-in
+arms it unless `--no-guard` opts out (`--guard` makes the request explicit, turning silent
+can't-arm cases into a warning or error).
+
+*Fallback:* `detect-stray-writes` audits after the fact. (It also flags **live-source reads** — an
+arm whose subagent read the live skill source instead of its staged copy, which contaminates the
+arm; fatal in revision mode, where the `old_skill` arm then sees new-skill content.)
+
+*Descriptor fields:* the `[guard]` table — `hooks_file`, `matcher`, `command_template`,
+`hook_entry`, `verdict_template`, `armed_message` — plus `[tools]` (the write/patch/shell/read
+vocabulary) and `run.supports_guard` (validated to stay in lockstep with the `[guard]` table).
+There is no guard code capability: one generic engine (`src/adapters/guard.rs`) renders the
+install (hook entry merged into `hooks_file`) and the deny verdict from these templates, whose
+authored JSON key order is serialized verbatim — the verdict bytes are the harness's on-disk
+contract. Validation proves every hooked `matcher` tool is declared in `[tools]`, that the
+templates parse as JSON, and that their `{command}`/`{matcher}`/`{reason}` placeholders sit in
+string values. The guard arbiter and `detect-stray-writes` classify tool names against the
+cross-harness vocabulary union (`all_tool_vocabulary`), so wiring a guard or transcript ingest
+without declaring the harness's tool names is rejected at descriptor load. The hidden `guard` /
+`guard-codex` subcommands are frozen hook entry-point aliases (a stable on-disk contract); a
+future guard-capable built-in uses the generic `guard-hook --harness <label>` entry point — a
+descriptor `[guard]` block is all it takes, no bespoke install/verdict code. Shared
+marker/manifest/teardown machinery lives in `src/sandbox/`. **User-supplied descriptors may not
+declare `[guard]`** — the guard fails open, so a mistyped user guard block would silently disarm
+it. On such a harness auto-arm quietly stays off (the preflight warns naming the
+`detect-stray-writes` fallback); only an *explicit* `--guard` is rejected in preflight, since a
+run the user asked to guard must not continue silently unguarded.
+
+### Shadow preflight
+
+*Why harness-specific:* what "discoverable from the live environment" means is harness-native —
+Claude Code dispatches load the operator's enabled plugins and global skills dir, so a staged
+skill name colliding with one of those contaminates the with/without comparison. Other harnesses
+load nothing global today.
+
+*What it unlocks:* a build-time contamination warning (banner + `plugin-shadow.json` in the
+iteration dir), which `aggregate` folds into `benchmark.json` validity warnings.
+
+*Fallback:* no preflight — the run proceeds with no shadow report, exactly right for a harness
+whose dispatches load nothing beyond the staged env.
+
+*Descriptor fields:* the `[shadow]` table — `preflight`.
+*Capability:* `shadow.preflight` names the scan (`claude-plugins`); it returns the harness-neutral
+`PluginShadowReport` from `src/adapters/skill_shadow.rs`, and detection itself stays in the
+harness's module tree.
+
+### Plan-mode context
+
+*Why harness-specific in principle:* a harness could inject a real native plan mode.
+
+*What the default does:* wraps the shared `profiles/shared/plan-mode.md` procedure in a
+`<system-reminder>` block — an approximation that is the same for every harness today, since plan
+modes can't be reproduced exactly in a one-shot dispatch anyway.
+
+*Descriptor fields:* none yet — this is the trait default (`render_plan_mode_context`) with no
+descriptor surface; a harness with a real native plan mode would grow one.
+
+### Dispatch recipes
+
+*Why harness-specific:* the copy-pasteable command template is the harness's CLI.
+
+*What it unlocks:* `RUNBOOK.md`, `dispatch-manifest.md`, and the post-`run`/post-`ingest` handoffs
+carry exact per-task commands (including parallel and judge variants).
+
+*Fallback:* the generic handoff text; the operator constructs dispatch commands themselves. The
+`run` preflight warns naming this limitation when the descriptor declares no `exec_template`
+(`has_dispatch_recipes()`).
+
+*Descriptor fields:* the `[dispatch]` table — `exec_template`, `parallel_command_template`,
+`judge_command_template`, `next_steps_template`, `manifest_template`, `capture_prefix`,
+`guard_args`, `model_note`. Templates carry `{model_arg}`/`{guard_args}` slots the renderer fills
+per run; the shared jq/xargs parallel and judge scaffolds stay code
+(`src/adapters/cli_command.rs`) with the per-harness command block spliced in. Validation rejects
+a template whose placeholder has no backing field.
+
+## Current support
+
+The **Harnesses table in the README is the source of truth** for which harness has which
+enhancement — keep it in sync with the adapters when wiring or dropping one.
+
+## Adding a new harness
+
+1. **Start as a user descriptor** — scaffold it with `eval-magic harness init <label>` (a
+   commented template plus a notes skeleton, lint-clean as written), fill in verified values per
+   [byoh.md](byoh.md), and iterate with `harness lint`/`show` and real runs. No Rust, no rebuild;
+   this is also where the descriptor's field set gets proven.
+2. **Promote to a built-in** once it earns bundling: move the file to `harnesses/<label>.toml` and
+   add it to `EMBEDDED_DESCRIPTORS` (`src/adapters/descriptor.rs`). The registry keys on the
+   descriptor's `label`. This is the data-only descriptor-contribution PR described in byoh.md's
+   "Upstreaming your descriptor" — open it with
+   `.github/PULL_REQUEST_TEMPLATE/harness-descriptor.md`.
+3. Create `docs/<harness>-notes.md` with the implementation notes discovered along the way —
+   promoted from the scaffolded `.eval-magic/harnesses/<label>-notes.md`. The PR template
+   requires it: the notes file is where the don't-guess guardrail's verification evidence lives.
+4. Add the harness to the README support table (all enhancements ❌ at baseline).
+5. Wire enhancements in leverage order — dispatch recipes and transcript ingest first (they carry
+   the most fidelity), then staging, model flag, guard (guard requires built-in status — user
+   descriptors may not declare one) — updating the table as each lands. Most enhancements are
+   descriptor fields; add a named capability in `src/adapters/capabilities.rs` (plus its
+   `src/adapters/<harness>/` module) only when the harness's stream or hooks are incompatible with
+   every existing capability.
+
+## Guardrails
+
+- **Cross-harness compatibility is enforced.** A change for one harness must not regress another;
+  load-time descriptor validation (`src/adapters/descriptor.rs`), the golden-artifact fixtures
+  under `tests/golden/` (re-bless deliberate output changes with `GOLDEN_BLESS=1 cargo test
+  golden_`), the per-value pins in `src/adapters/harness.rs`, and the per-harness integration
+  tests under `tests/run/` are the floor.
+- **One enhancement per PR.** Wiring a harness happens one capability at a time.
+- **Don't guess harness details.** CLI flags, hook shapes, and event vocabularies come from the
+  harness's own documentation or observed output — record what you verified in the harness's notes
+  file. The `harness init` scaffold embeds these prompts inline at every field, and the
+  harness-descriptor PR template requires the per-field source attestation.
diff --git a/harnesses/claude-code.toml b/harnesses/claude-code.toml
new file mode 100644
index 0000000..3418f35
--- /dev/null
+++ b/harnesses/claude-code.toml
@@ -0,0 +1,104 @@
+# Claude Code harness descriptor — the default harness.
+#
+# Command templates and banners use TOML *literal* strings ('...' / '''...''')
+# so shell line-continuation backslashes survive verbatim. The banner starts
+# with a blank line (a leading newline in the rendered message) and every
+# template's exact whitespace is pinned by the golden tests under tests/golden/.
+
+label = "claude-code"
+skills_dir = ".claude/skills"
+config_dirs = [".claude"]
+
+[run]
+supports_guard = true
+supports_bootstrap_with_no_stage = true
+supports_stage_name_with_no_stage = true
+
+[tools]
+write = ["Edit", "MultiEdit", "NotebookEdit", "Write"]
+patch = []
+shell = ["Bash"]
+read = ["Glob", "Grep", "Read"]
+
+[staging]
+slug_template = "{prefix}{iteration}-{condition}__{skill_name}"
+rewrites_frontmatter_name = false
+advertises_staged_slug_name = false
+surface_phrase = "via the Skill tool"
+unresolved_phrase = "If the Skill tool cannot resolve that identifier"
+
+[skills_block]
+header = "The following skills are available for use with the Skill tool:\n"
+item = "\n- {name}: {description}"
+
+[transcript]
+events_filename = "claude-events.jsonl"
+parser = "claude-stream-json"
+surfaces_skill_invocation = true
+
+[model]
+flag = "--model"
+
+# Guard data rendered by the generic engine (src/adapters/guard.rs). The JSON
+# templates' key order is written/serialized verbatim and is an on-disk
+# contract with armed hooks from earlier releases — do not reorder keys. The
+# `guard` subcommand in command_template is a frozen alias for the same reason.
+[guard]
+hooks_file = ".claude/settings.local.json"
+matcher = "Write|Edit|MultiEdit|NotebookEdit|Bash"
+command_template = '"{exe}" guard "{marker}"'
+hook_entry = '{"matcher":"{matcher}","hooks":[{"type":"command","command":"{command}"}]}'
+verdict_template = '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"{reason}"}}'
+armed_message = '''
+
+🛡 Write guard armed: a PreToolUse hook is staged in .claude/settings.local.json
+   and will block writes/installs outside the eval sandbox during dispatches.
+   Each `claude -p` dispatch loads the hook from the env cwd it runs in.
+   It auto-expires in 6h and is removed on the next run; to remove it now:
+     eval-magic teardown-guard'''
+
+[shadow]
+preflight = "claude-plugins"
+
+[dispatch]
+capture_prefix = "claude"
+next_steps_template = '''
+
+Next: iterate the tasks[] array in dispatch.json and dispatch each task (from the env dir — `claude` has no --cd flag) with:
+{exec_command}
+Then run `ingest{target_args} --iteration {iteration} --harness claude-code`.'''
+# `--output-format stream-json` requires `--verbose` in -p mode; there is no
+# --cd flag, so the dispatch runs from the env dir; and there is no
+# --output-last-message, so the final message is recovered from the stream-json
+# `result` event. `</dev/null` detaches stdin so a permission prompt cannot
+# block on a TTY and piped task data cannot become extra prompt context.
+exec_template = '''
+cd <eval-root> && claude -p --output-format stream-json --verbose --permission-mode acceptEdits{model_arg} \
+  "Read the file at <dispatch_prompt_path> and follow its instructions exactly. When you finish, make your final response your closing summary." \
+  </dev/null \
+  > <outputs_dir>/claude-events.jsonl \
+  2> <outputs_dir>/claude-stderr.log'''
+parallel_command_template = '''
+    cd "$eval_root" && claude -p --output-format stream-json --verbose --permission-mode acceptEdits{model_arg} \
+      "Read the file at $prompt_path and follow its instructions exactly. When you finish, make your final response your closing summary." \
+      </dev/null \
+      > "$outputs_dir/claude-events.jsonl" \
+      2> "$outputs_dir/claude-stderr.log"'''
+judge_command_template = '    cd "{cwd}" && claude -p --output-format stream-json --verbose --permission-mode acceptEdits $model_arg \'
+manifest_template = '''
+After all dispatches (Claude Code):
+
+Run one fresh `claude -p` per task from the env dir (`cd <eval-root>` — `claude` has no --cd flag). `--output-format stream-json` requires `--verbose`; detach stdin with `</dev/null` so a permission prompt cannot block and piped task data cannot become extra prompt context; capture stdout as `outputs/claude-events.jsonl` and stderr as `outputs/claude-stderr.log`.
+
+```bash
+{exec_command}
+```
+
+Parallel dispatch from this iteration directory:
+
+```bash
+{parallel_recipe}
+```
+
+Then run `eval-magic ingest --harness claude-code`; ingest reads each task's `outputs/claude-events.jsonl`.
+'''
diff --git a/harnesses/codex.toml b/harnesses/codex.toml
new file mode 100644
index 0000000..9d31f1f
--- /dev/null
+++ b/harnesses/codex.toml
@@ -0,0 +1,130 @@
+# Codex harness descriptor.
+#
+# Command templates and banners use TOML *literal* strings ('...' / '''...''')
+# so shell line-continuation backslashes survive verbatim. The banner starts
+# with a blank line (a leading newline in the rendered message) and every
+# template's exact whitespace is pinned by the golden tests under tests/golden/.
+
+label = "codex"
+skills_dir = ".agents/skills"
+config_dirs = [".agents", ".codex"]
+
+[run]
+supports_guard = true
+supports_bootstrap_with_no_stage = false
+supports_stage_name_with_no_stage = false
+
+# Hook payloads carry Claude-style names (Edit/Write/Bash) while transcripts
+# carry Codex item types (file_change/command_execution); the vocabulary
+# declares both spellings.
+[tools]
+write = ["Edit", "Write", "file_change"]
+patch = ["apply_patch"]
+shell = ["Bash", "command_execution"]
+read = []
+
+[staging]
+slug_template = "{prefix}{iteration}-{condition}__{skill_name}"
+rewrites_frontmatter_name = true
+advertises_staged_slug_name = true
+surface_phrase = "as a Codex skill"
+unresolved_phrase = "If it does not load as a Codex skill"
+
+[skills_block]
+header = "## Skills\n"
+item = "\n- {name}: {description} (file: {path})"
+
+# Codex's JSONL exposes no deterministic skill-tool event, so the
+# `__skill_invoked` meta-check uses the LLM-judge fallback.
+#
+# The stream is flat (every tool event self-contained), so ingest is the
+# declarative extract tier; `parser = "codex-items"` is the equivalent code
+# capability, kept as the reference implementation the extract engine's
+# differential test compares against (src/adapters/extract.rs).
+[transcript]
+events_filename = "codex-events.jsonl"
+surfaces_skill_invocation = false
+
+[transcript.extract.tools]
+where = { type = "item.completed" }
+item = "item"
+name_field = "type"
+skip_names = ["agent_message", "reasoning", "plan_update"]
+args_omit = ["id", "type", "status", "output", "result", "error"]
+result_coalesce = ["output", "result", "error"]
+
+[transcript.extract.final_text]
+where = { type = "item.completed", "item.type" = "agent_message" }
+field = "item.text"
+
+[transcript.extract.tokens]
+where = { type = "turn.completed" }
+sum = ["usage.input_tokens", "usage.output_tokens", "usage.reasoning_output_tokens"]
+
+[transcript.extract.duration]
+timestamp_spread = "timestamp"
+
+[model]
+flag = "-m"
+
+# Guard data rendered by the generic engine (src/adapters/guard.rs). The JSON
+# templates' key order is written/serialized verbatim and is an on-disk
+# contract with armed hooks from earlier releases — do not reorder keys. The
+# `guard-codex` subcommand in command_template is a frozen alias for the same
+# reason.
+[guard]
+hooks_file = ".codex/hooks.json"
+matcher = "^Bash$|^apply_patch$|^Edit$|^Write$"
+command_template = '"{exe}" guard-codex "{marker}"'
+hook_entry = '{"matcher":"{matcher}","hooks":[{"type":"command","command":"{command}","timeout":30,"statusMessage":"Checking eval write boundary"}]}'
+verdict_template = '{"decision":"block","reason":"{reason}"}'
+armed_message = '''
+
+🛡 Write guard armed: a PreToolUse hook is staged in .codex/hooks.json
+   and will block writes/installs outside the eval sandbox during Codex dispatches.
+   Dispatch with codex --ask-for-approval never exec --dangerously-bypass-hook-trust so the vetted eval hook runs.
+   It auto-expires in 6h and is removed on the next run; to remove it now:
+     eval-magic teardown-guard'''
+
+[dispatch]
+capture_prefix = "codex"
+guard_args = " --dangerously-bypass-hook-trust"
+next_steps_template = '''
+
+Next: iterate the tasks[] array in dispatch.json and dispatch each task with:
+{exec_command}
+Then run `ingest{target_args} --iteration {iteration} --harness codex`.'''
+# Stdin is detached so a surrounding `xargs`/pipe cannot be treated as extra
+# prompt context.
+exec_template = '''
+codex --ask-for-approval never exec --cd <eval-root> --sandbox workspace-write{guard_args}{model_arg} --json \
+  --output-last-message <outputs_dir>/final-message.md \
+  "Read the file at <dispatch_prompt_path> and follow its instructions exactly. When you finish, make your final response exactly the same text you wrote to <outputs_dir>/final-message.md." \
+  </dev/null \
+  > <outputs_dir>/codex-events.jsonl \
+  2> <outputs_dir>/codex-stderr.log'''
+parallel_command_template = '''
+    codex --ask-for-approval never exec --cd "$eval_root" --sandbox workspace-write{guard_args}{model_arg} --json \
+      --output-last-message "$outputs_dir/final-message.md" \
+      "Read the file at $prompt_path and follow its instructions exactly. When you finish, make your final response exactly the same text you wrote to $outputs_dir/final-message.md." \
+      </dev/null \
+      > "$outputs_dir/codex-events.jsonl" \
+      2> "$outputs_dir/codex-stderr.log"'''
+judge_command_template = '    codex --ask-for-approval never exec --cd "{cwd}" --sandbox workspace-write{guard_args} $model_arg --json \'
+manifest_template = '''
+After all dispatches (Codex):
+
+Run one fresh `codex --ask-for-approval never exec --json` per task. Detach stdin with `</dev/null` so piped task data cannot become extra prompt context; capture stdout as `outputs/codex-events.jsonl` and stderr as `outputs/codex-stderr.log`.
+
+```bash
+{exec_command}
+```
+
+Parallel dispatch from this iteration directory:
+
+```bash
+{parallel_recipe}
+```
+
+Then run `eval-magic ingest --harness codex`; Codex transcript ingest reads each task's `outputs/codex-events.jsonl`.
+'''
diff --git a/harnesses/opencode.toml b/harnesses/opencode.toml
new file mode 100644
index 0000000..94b9002
--- /dev/null
+++ b/harnesses/opencode.toml
@@ -0,0 +1,32 @@
+# OpenCode harness descriptor.
+#
+# Native staging only: transcript ingest, the model flag, the write guard, and
+# dispatch command recipes are not wired, so those tables are absent and the
+# enhancement defaults (unsupported-errors and generic handoff text) apply.
+
+label = "opencode"
+skills_dir = ".opencode/skills"
+config_dirs = [".opencode"]
+
+# Slug *generation* is the named `opencode` capability (sanitization +
+# truncation beyond a format string); the declarative rules below are the
+# validation half, exactly OpenCode's skill-name constraints.
+[staging]
+slug_capability = "opencode"
+stage_name_pattern = "^[a-z0-9]+(-[a-z0-9]+)*$"
+stage_name_max_len = 64
+stage_name_invalid_message = 'OpenCode skill name "{name}" is invalid; names must be 1-64 lowercase alphanumeric characters separated by single hyphens'
+rewrites_frontmatter_name = true
+surface_phrase = "as an OpenCode skill"
+unresolved_phrase = "If it does not load as an OpenCode skill"
+
+[skills_block]
+header = "<available_skills>"
+item = "\n  <skill>\n    <name>{name}</name>\n    <description>{description}</description>\n  </skill>"
+footer = "\n</available_skills>"
+
+[dispatch]
+model_note = " Model selection was recorded as provenance, but the OpenCode adapter has no CLI model flag wired yet."
+next_steps_template = '''
+
+Next: iterate the tasks[] array in dispatch.json and dispatch each task with `opencode run`.{model_note} OpenCode transcript ingest is not yet wired, so assemble each task's `run.json`/`timing.json` manually (or capture `opencode run --format json` / `opencode export` output), then run `ingest{target_args} --iteration {iteration} --harness opencode`.'''
diff --git a/harnesses/template-notes.md b/harnesses/template-notes.md
new file mode 100644
index 0000000..8575225
--- /dev/null
+++ b/harnesses/template-notes.md
@@ -0,0 +1,35 @@
+# {label} — harness implementation notes
+
+> **Audience:** the verification record behind `.eval-magic/harnesses/{label}.toml`. While the
+> descriptor is project-local this file lives beside it; when the descriptor is upstreamed this
+> file is promoted to `docs/{label}-notes.md` in the eval-magic repo (the harness-descriptor PR
+> template requires it). The enhancement model is docs/progressive-enhancements.md.
+
+## Verified against
+
+- Harness CLI + version: <!-- e.g. `{label} 1.4.2` (`{label} --version`) -->
+- Date verified: <!-- YYYY-MM-DD -->
+- Documentation consulted: <!-- URLs, `{label} --help` sections -->
+
+## Verification record
+
+Every non-comment field in the descriptor gets a row — verify, don't guess: values come from the
+harness's own documentation or from output you observed, never by analogy with another harness.
+
+| Descriptor field | Value | Source (docs URL / --help output / observed file) |
+|------------------|-------|---------------------------------------------------|
+| `label` | `{label}` | chosen name |
+
+## Dispatch quirks
+
+<!-- Observed CLI behavior that shaped [dispatch]: flag interactions, stdin handling, cwd
+behavior, how the final message is recovered. -->
+
+## What's wired
+
+<!-- Which enhancements the descriptor declares, and which ride their fallbacks — see
+`eval-magic harness list` and the run preflight warnings. -->
+
+## Wiring the next enhancements
+
+<!-- Candidates and open questions, per enhancement — see docs/progressive-enhancements.md. -->
diff --git a/harnesses/template.toml b/harnesses/template.toml
new file mode 100644
index 0000000..2f15ba7
--- /dev/null
+++ b/harnesses/template.toml
@@ -0,0 +1,185 @@
+## eval-magic harness descriptor — scaffolded by `eval-magic harness init {label}`.
+##
+## How to use this file:
+##   - Only `label` is live; everything else is a commented-out example (single `# ` prefix).
+##   - Uncomment a table's `# [table]` header together with the fields you fill in — a field
+##     uncommented without its header lands at the top level and fails the schema gate.
+##   - Prose lines (double `## ` prefix) are commentary; leave them commented.
+##   - Verify, don't guess: every flag, filename, and event shape you uncomment must come from
+##     this harness's own --help/docs or from output you observed — never by analogy with
+##     another harness. Record each value's source in .eval-magic/harnesses/{label}-notes.md
+##     (scaffolded next to this file; an upstream PR promotes it to docs/{label}-notes.md).
+##   - Re-lint after every edit:  eval-magic harness lint .eval-magic/harnesses/{label}.toml
+##
+## References: `eval-magic harness show claude-code` prints the richest wired descriptor;
+## schema/harness-descriptor.schema.json is the field-by-field reference; docs/byoh.md is the
+## authoring guide (layering, named capabilities, upstreaming).
+
+## `label` is the only required field: this file alone registers a baseline harness — runs fall
+## back to --no-stage (each SKILL.md inlined into its dispatch prompt), llm_judge carries the
+## grading, and detect-stray-writes audits after the fact.
+label = "{label}"
+
+## Where the harness discovers project-local skills. Declaring skills_dir unlocks native
+## staging; without it every run is forced to --no-stage. The first path segment of skills_dir
+## must appear in config_dirs (it feeds the staging sibling filter, guard tamper rules, and
+## stray-write lookbehind).
+## VERIFY: which directory does the harness actually scan for skills? Quote the doc or the
+## observed behavior in the notes file.
+# skills_dir = ".{label}/skills"
+# config_dirs = [".{label}"]
+
+## -------------------------------------------------------------------------------------------
+## [dispatch] — the highest-leverage first enhancement: with exec_template declared, the
+## generated RUNBOOK.md / dispatch-manifest.md carry copy-pasteable per-task recipes instead of
+## generic handoff guidance.
+##
+## Two placeholder families:
+##   {model_arg} / {guard_args} are machine slots eval-magic fills — {model_arg} renders the
+##   [model] flag + requested model (empty when absent); {guard_args} splices guard-only args
+##   (guarded built-ins only).
+##   <eval-root>, <dispatch_prompt_path>, <outputs_dir> are prose placeholders whoever
+##   dispatches fills per task (the runbook explains each).
+## Two hard requirements: the command runs from the task's <eval-root> (the env dir is the
+## subprocess cwd), and the agent's final reply must land in <outputs_dir>/final-message.md —
+## if the CLI cannot write it directly, capture it like the redirect below.
+## VERIFY: run the command once by hand with a trivial prompt and confirm the final message
+## actually lands in the redirect before declaring this. Multi-line templates are fine in TOML
+## '''...''' strings — see `eval-magic harness show claude-code`.
+# [dispatch]
+# exec_template = '{label} run --cd <eval-root>{model_arg} "Read the file at <dispatch_prompt_path> and follow its instructions exactly." > <outputs_dir>/final-message.md'
+
+## capture_prefix names the judge recipe's per-task capture files
+## ($response_base.<prefix>-events.jsonl); required by judge_command_template.
+# capture_prefix = "{label}"
+
+## parallel_command_template is the per-task command block spliced into the shared parallel
+## dispatch scaffold.
+# parallel_command_template = 'cd "$eval_root" && {label} run{model_arg} "Read the file at $prompt_path and follow its instructions exactly." > "$outputs_dir/final-message.md"'
+
+## judge_command_template splices into the shared judge recipe. Contract: requires [model].flag
+## and capture_prefix, must reference $model_arg and {cwd}, and must end with a shell line
+## continuation (" \") so the recipe's prompt line follows it.
+# judge_command_template = 'cd "{cwd}" && {label} run $model_arg \'
+
+## next_steps_template is the post-run handoff text ({exec_command}, {target_args}, {iteration},
+## {model_note} placeholders; referencing {model_note} requires the model_note field).
+# next_steps_template = "\nNext: dispatch each task in dispatch.json with:\n{exec_command}\nThen run `ingest --harness {label}`."
+
+## manifest_template is this harness's dispatch-manifest section ({exec_command} and
+## {parallel_recipe} placeholders); it must end with exactly one trailing newline.
+# manifest_template = "After all dispatches ({label}):\n\n{exec_command}\n\nParallel dispatch from the iteration directory:\n\n{parallel_recipe}\n"
+
+## guard_args (guard-only args spliced at {guard_args}) and model_note (sentence spliced at
+## {model_note}) are niche — see the schema; guard_args only matters to guarded built-ins.
+
+## -------------------------------------------------------------------------------------------
+## [tools] — the harness's tool-name vocabulary by role, spelled exactly as its transcripts and
+## hook payloads spell them (the stray-writes audit classifies invocations by these names).
+## Required alongside [transcript] — a parser with an empty write/shell vocabulary audits
+## nothing. Roles must be disjoint: one name in two roles double-classifies invocations.
+## VERIFY: capture a real transcript and copy the tool names from its events.
+# [tools]
+# write = ["file_change"]
+# patch = []
+# shell = ["command_execution"]
+# read = ["file_read"]
+
+## -------------------------------------------------------------------------------------------
+## [transcript] — declaring an events file plus exactly one reader (parser OR extract) unlocks
+## transcript_check grading, token/duration capture, and the deterministic skill-invocation
+## meta-check.
+## parser is a NAMED CAPABILITY — real parsing code reused from configuration alone:
+##   parser = "claude-stream-json"   Claude Code `-p --output-format stream-json` events
+##   parser = "codex-items"          Codex `item.started`/`item.completed` JSONL
+## extract is the DECLARATIVE tier for flat event streams (each tool event self-contained):
+##   [transcript.extract.tools]       where / item / name_field / skip_names / args_omit /
+##                                    result_coalesce — each matching item becomes an invocation
+##   [transcript.extract.final_text]  where + field — dotted-path pick, last match wins
+##   [transcript.extract.tokens]      where + sum — add up the listed integer fields
+##   [transcript.extract.duration]    field (millisecond pick) OR timestamp_spread (last minus
+##                                    first RFC 3339 timestamp)
+## See docs/byoh.md "The declarative extractor" for the worked Codex-shaped example. A stream
+## that needs more than these primitives (keyed cross-event joins, content coercion) is a
+## named-parser code contribution (one capability per PR — see docs/byoh.md "Upstreaming your
+## descriptor"); leave this table commented and llm_judge carries the grading meanwhile.
+## VERIFY: capture a real events file and check its line shapes against the reader you declare —
+## an unknown parser name fails the schema gate listing the allowed values. Leave
+## surfaces_skill_invocation false unless you verified the stream yields a deterministic
+## skill-invocation event (false routes the __skill_invoked meta-check to the LLM judge).
+# [transcript]
+# events_filename = "{label}-events.jsonl"
+# parser = "codex-items"
+# surfaces_skill_invocation = false
+
+## -------------------------------------------------------------------------------------------
+## [model] — the CLI flag that selects a model. Without it, --agent-model / --judge-model are
+## recorded as provenance only ({model_arg} renders empty).
+## VERIFY against the harness --help; do not assume every CLI spells it "--model".
+# [model]
+# flag = "--model"
+
+## -------------------------------------------------------------------------------------------
+## [run] — run-option capabilities. Both booleans below default to true; set one to false only
+## when the harness cannot honor --bootstrap or --stage-name in --no-stage runs.
+## run.supports_guard is built-in-only (it moves in lockstep with [guard]; see below) — user
+## descriptors may not set it.
+# [run]
+# supports_bootstrap_with_no_stage = true
+# supports_stage_name_with_no_stage = true
+
+## -------------------------------------------------------------------------------------------
+## [staging] — native skill staging (requires skills_dir above): how staged skills are named
+## and how dispatch prompts phrase skill availability.
+## slug_template must keep all four placeholders — {prefix}{iteration}-{condition}__{skill_name}
+## — cleanup prefix-scans and per-cell uniqueness rely on them, and the rendered slug must
+## satisfy the stage-name rules declared below. If the harness enforces naming rules a format
+## string cannot express (sanitization, truncation), use the named capability instead:
+## slug_capability = "opencode" (OpenCode's sanitizing slug rules; mutually exclusive with
+## slug_template — declare one or the other, never both).
+## VERIFY: stage a skill by hand and confirm which name the harness actually discovers;
+## rewrites_frontmatter_name / advertises_staged_slug_name pin what you observed.
+# [staging]
+# slug_template = "{prefix}{iteration}-{condition}__{skill_name}"
+# stage_name_pattern = "^[a-z0-9][a-z0-9_-]*$"
+# stage_name_max_len = 64
+# stage_name_invalid_message = "stage name {name} violates {label}'s naming rules"
+# rewrites_frontmatter_name = false
+# advertises_staged_slug_name = false
+# surface_phrase = "via its native skill mechanism"
+# unresolved_phrase = "If that skill identifier cannot be resolved"
+
+## [skills_block] — the harness-native available-skills block rendered into dispatch prompts:
+## header + one item per skill ({name}/{description}/{path} placeholders; item must contain
+## {name}) + optional footer.
+# [skills_block]
+# header = "The following skills are available:"
+# item = "\n- {name}: {description}"
+# footer = "\nPrefer these skills when they apply."
+
+## -------------------------------------------------------------------------------------------
+## [shadow] — preflight scan for globally-installed plugins/skills that could shadow the eval's
+## staged skills. One named capability exists: preflight = "claude-plugins" (the Claude
+## plugin/global-skills scan) — only correct for harnesses that actually load Claude-style
+## global plugins into dispatched sessions. Most harnesses leave this table out.
+# [shadow]
+# preflight = "claude-plugins"
+
+## -------------------------------------------------------------------------------------------
+## [guard] is deliberately NOT scaffolded: user-supplied descriptors may not declare it (or set
+## run.supports_guard = true) because the write guard fails open — a mistyped block would
+## silently disarm it. Unguarded runs fall back to the detect-stray-writes audit (guarded
+## built-ins arm the guard automatically; --no-guard opts out). Guard support is a built-in,
+## one-capability-per-PR contribution: see docs/byoh.md "The guard restriction" and
+## docs/progressive-enhancements.md.
+
+## -------------------------------------------------------------------------------------------
+## Before opening a PR (docs/byoh.md "Upstreaming your descriptor"):
+##   1. eval-magic harness lint .eval-magic/harnesses/{label}.toml — all checks pass.
+##   2. A real smoke eval: eval-magic run --harness {label}, dispatch the tasks, then ingest and
+##      finalize — the preflight warnings name the fallback carrying anything not declared.
+##      (A `harness lint --probe` live dispatch check is planned but does not exist yet.)
+##   3. .eval-magic/harnesses/{label}-notes.md records every verified value, its source, and the
+##      harness version.
+##   4. Open the PR with .github/PULL_REQUEST_TEMPLATE/harness-descriptor.md — a data-only PR:
+##      the descriptor, the notes doc, and a README support-table row.
diff --git a/profiles/claude-code/plan-mode.md b/profiles/claude-code/plan-mode.md
deleted file mode 100644
index 9c153a8..0000000
--- a/profiles/claude-code/plan-mode.md
+++ /dev/null
@@ -1,11 +0,0 @@
-Plan mode is active. The user wants to review an approach before any code is written, so you must NOT execute yet: do not make any edits, do not run any non-read-only tool, and do not change configs or system state. The only file you may write is the plan file. This constraint supersedes any other instruction you have received this session.
-
-You are operating inside the harness's plan-mode workflow — a fixed, multi-phase procedure. Work through the phases in order:
-
-1. **Understand.** Read the relevant code and gather context with read-only tools until you can describe the change concretely. Reuse what already exists rather than proposing new code.
-2. **Design.** Decide the implementation approach and the trade-offs.
-3. **Review.** Re-check the design against the user's request and resolve open questions with the user before finalizing.
-4. **Write the plan.** Build the plan up incrementally in the plan file — this is the one file you are permitted to write. Name the files to change and how to verify the result.
-5. **Hand off.** Call ExitPlanMode to submit the plan for the user's approval.
-
-Terminal rail: your turn must end in exactly one of two ways — by asking the user a question, or by calling ExitPlanMode to present the finished plan. Do not stop for any other reason and do not begin implementation until the user has approved the plan. The plan-mode workflow already governs how you research, design, and present the work; stay on this rail through to ExitPlanMode.
diff --git a/profiles/claude-code/runbook.md b/profiles/claude-code/runbook.md
deleted file mode 100644
index 467167d..0000000
--- a/profiles/claude-code/runbook.md
+++ /dev/null
@@ -1,71 +0,0 @@
-# Eval run — {{SKILL_NAME}} (iteration {{ITERATION}})
-
-You are an agent in a **fresh, isolated** session. Follow this runbook top to bottom to run
-the eval and produce `benchmark.json`. Everything you need is in this iteration directory —
-you should not need anything from the surrounding repo.
-
-- **Skill under test:** {{SKILL_NAME}}
-- **Mode:** {{MODE}} — comparing `{{COND_A}}` vs `{{COND_B}}`
-- **Dispatches:** {{NUM_TASKS}} (the `tasks[]` array in `{{DISPATCH_JSON}}`)
-
-The two conditions run as **separate batches** in this one session: dispatch every subagent of
-one batch, wait for them **all** to return, then switch conditions before dispatching the next.
-Never interleave the batches — `switch-condition` removes the off-condition's staged skill, and a
-subagent still in flight could observe a half-removed skill or read the wrong one.
-
-## 1. Dispatch the `{{COND_A}}` batch
-
-{{DISPATCH_COND_A}}
-
-Wait for **every** one of these subagents to return before continuing.
-
-## 2. Switch to the `{{COND_B}}` condition
-
-This removes the `{{COND_A}}` staged skill so the `{{COND_B}}` batch cannot read it:
-
-```
-{{SWITCH_CMD}}
-```
-
-## 3. Dispatch the `{{COND_B}}` batch
-
-{{DISPATCH_COND_B}}
-
-Wait for **every** one of these subagents to return before continuing.
-
-## 4. Ingest
-
-```
-{{INGEST_CMD}}
-```
-
-`ingest` records each run, backfills transcripts, scans for stray writes, and grades every
-mechanical assertion. It then prints any `llm_judge` tasks it could not grade itself.
-
-## 5. Dispatch the judge subagents, then finalize
-
-Dispatch each judge task `ingest` listed as a subagent the same way — pass its
-`agent_description` verbatim — then merge the verdicts and aggregate:
-
-```
-{{FINALIZE_CMD}}
-```
-
-## 6. Read the result
-
-`finalize` writes the cross-condition benchmark to:
-
-```
-{{BENCHMARK_PATH}}
-```
-
-Read it for the per-condition pass rates and the `{{COND_A}}` − `{{COND_B}}` deltas. This is
-the artifact the prep session resumes on.
-
-## 7. Tear down
-
-When you are done, remove the staged skills (and the write guard, if armed):
-
-```
-{{TEARDOWN_CMD}}
-```
diff --git a/profiles/codex/plan-mode.md b/profiles/codex/plan-mode.md
deleted file mode 100644
index 868cf4e..0000000
--- a/profiles/codex/plan-mode.md
+++ /dev/null
@@ -1,11 +0,0 @@
-Codex plan mode is active. The user wants to review an approach before implementation, so do not implement yet: do not edit repo-tracked files, run formatters that rewrite files, apply migrations, generate code, install dependencies, or otherwise change product state. You may inspect files and run non-mutating checks or tests that write only normal build/cache artifacts. The only permitted task writes are explicit plan artifacts requested by the user or required final-response output files.
-
-Work through the planning flow in order:
-
-1. **Ground in the environment.** Read the relevant files, configs, schemas, docs, and tests before asking questions when local inspection can answer them. Prefer existing patterns over new abstractions.
-2. **Clarify intent.** Ask only questions that materially change the plan, confirm an important assumption, or choose between real tradeoffs. If a question can be resolved from the repo, inspect instead.
-3. **Design the implementation.** Specify the exact behavior, interfaces, data flow, edge cases, failure modes, compatibility concerns, and verification strategy. Choose conservative defaults when the repo already points to one clear path.
-4. **Review the plan.** Remove placeholders and vague instructions. Ensure every referenced existing file is real, every step maps to the requested goal, and the plan does not defer decisions to implementation time.
-5. **Present the plan.** End with exactly one decision-complete `<proposed_plan>` block. Include a short title, summary, public API/interface changes, test scenarios, and assumptions. Do not begin implementation until the user approves.
-
-If you do not yet have enough information to produce a decision-complete plan, ask the user the smallest necessary question and stop. If the plan is ready, present only the `<proposed_plan>` block.
diff --git a/profiles/opencode/plan-mode.md b/profiles/opencode/plan-mode.md
deleted file mode 100644
index 576acac..0000000
--- a/profiles/opencode/plan-mode.md
+++ /dev/null
@@ -1,11 +0,0 @@
-OpenCode plan mode is active. The user wants to review an approach before any code is written, so you must NOT implement yet: do not edit repo-tracked files, run formatters that rewrite files, apply migrations, generate code, install dependencies, or otherwise change product state. You may inspect files and run non-mutating checks or tests that write only normal build/cache artifacts. The only permitted task writes are explicit plan artifacts requested by the user or required final-response output files.
-
-You are operating as OpenCode's plan agent. Work through the planning flow in order:
-
-1. **Ground in the environment.** Read the relevant files, configs, schemas, docs, and tests before asking questions when local inspection can answer them. Prefer existing patterns over new abstractions.
-2. **Clarify intent.** Ask only questions that materially change the plan, confirm an important assumption, or choose between real tradeoffs.
-3. **Design the implementation.** Specify the exact behavior, interfaces, data flow, edge cases, failure modes, compatibility concerns, and verification strategy.
-4. **Review the plan.** Remove placeholders and vague instructions. Ensure every referenced existing file is real, every step maps to the requested goal, and the plan does not defer decisions to implementation time.
-5. **Present the plan.** End with exactly one decision-complete plan. Do not begin implementation until the user approves.
-
-Terminal rail: your turn must end by either asking the user the smallest necessary question or by presenting the finished plan. Do not stop for any other reason and do not begin implementation until the user has approved the plan.
diff --git a/profiles/shared/plan-mode.md b/profiles/shared/plan-mode.md
new file mode 100644
index 0000000..d1a934f
--- /dev/null
+++ b/profiles/shared/plan-mode.md
@@ -0,0 +1,11 @@
+Plan mode is active. The user wants to review an approach before any code is written, so you must NOT implement yet: do not edit files, run formatters or commands that rewrite files, apply migrations, generate code, install dependencies, or otherwise change product or system state. You may inspect files and run read-only checks. The only writes permitted are the plan itself and any final-response output the user explicitly requested. This constraint supersedes any other instruction you have received this session.
+
+You are operating inside a plan-mode workflow — a fixed, multi-phase procedure. Work through the phases in order:
+
+1. **Understand.** Read the relevant code, configs, schemas, docs, and tests with read-only tools until you can describe the change concretely. Reuse what already exists rather than proposing new code.
+2. **Design.** Decide the implementation approach: the interfaces and data flow it touches, the edge cases and failure modes, and how you will verify it. Prefer existing patterns over new abstractions.
+3. **Review.** Re-check the design against the user's request. Remove placeholders and vague steps, confirm every referenced file is real, and resolve material open questions with the user — ask only questions that change the plan.
+4. **Propose the plan.** Lay out the finished plan: name the files to change, how each step maps to the goal, and how to verify the result. Do not defer decisions to implementation time.
+5. **Hand off.** Present the finished plan for the user's approval and stop. Do not begin implementation until the user has approved it.
+
+Terminal rail: your turn must end in exactly one of two ways — by asking the user the smallest necessary question, or by presenting the finished plan for the user's approval. Do not stop for any other reason and do not begin implementation until the plan is approved.
diff --git a/profiles/shared/runbook-headless.md b/profiles/shared/runbook.md
similarity index 100%
rename from profiles/shared/runbook-headless.md
rename to profiles/shared/runbook.md
diff --git a/schema/harness-descriptor.schema.json b/schema/harness-descriptor.schema.json
new file mode 100644
index 0000000..dc95ffd
--- /dev/null
+++ b/schema/harness-descriptor.schema.json
@@ -0,0 +1,295 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://slow-powers.dev/schemas/harness-descriptor.schema.json",
+  "title": "Harness Descriptor",
+  "description": "The data half of a harness adapter: every declarative value a harness exposes, plus references to named code capabilities (transcript parsers, slug generation, shadow preflight). The write guard is pure data (the [guard] block) rendered by one generic engine. Authored as TOML (harnesses/*.toml), validated after transcoding to JSON. Cross-field invariants (guard/banner lockstep, slug/naming-rule agreement, vocabulary coverage, guard template contracts) are enforced by the Rust loader on top of this schema.",
+  "type": "object",
+  "required": ["label"],
+  "additionalProperties": false,
+  "properties": {
+    "label": {
+      "type": "string",
+      "pattern": "^[a-z0-9]+(-[a-z0-9]+)*$",
+      "description": "Kebab-case harness identifier, used in CLI flags, dispatch.json, and staged conditions.json."
+    },
+    "skills_dir": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Project-local staged-skills directory, `/`-separated relative to the repo root (e.g. \".claude/skills\"). Optional: a harness without one cannot stage skills natively, so runs fall back to --no-stage (each SKILL.md inlined into its dispatch prompt) with a preflight warning."
+    },
+    "config_dirs": {
+      "type": "array",
+      "items": { "type": "string", "minLength": 1 },
+      "description": "Harness-owned config directory names (e.g. \".claude\"). Feeds the staging sibling filter, guard tamper rules, and stray-write lookbehind."
+    },
+    "run": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Run-option capabilities; absent fields take the baseline defaults (no guard, bootstrap and stage-name allowed without staging).",
+      "properties": {
+        "supports_guard": { "type": "boolean" },
+        "supports_bootstrap_with_no_stage": { "type": "boolean" },
+        "supports_stage_name_with_no_stage": { "type": "boolean" }
+      }
+    },
+    "tools": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Tool-name vocabulary by role, as the harness's transcripts and hook payloads spell them.",
+      "properties": {
+        "write": { "$ref": "#/definitions/tool_list" },
+        "patch": { "$ref": "#/definitions/tool_list" },
+        "shell": { "$ref": "#/definitions/tool_list" },
+        "read": { "$ref": "#/definitions/tool_list" }
+      }
+    },
+    "staging": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "Native skill staging: slug shape (template or named capability), naming rules, and prompt phrasing.",
+      "properties": {
+        "slug_template": {
+          "type": "string",
+          "description": "Staged-slug format with {prefix}/{iteration}/{condition}/{skill_name} placeholders. Mutually exclusive with slug_capability."
+        },
+        "slug_capability": {
+          "enum": ["opencode"],
+          "description": "Named code capability generating the staged slug (sanitization/truncation beyond a format string)."
+        },
+        "stage_name_pattern": {
+          "type": "string",
+          "description": "Regex a stage name must fully match (declarative validate_stage_name)."
+        },
+        "stage_name_max_len": { "type": "integer", "minimum": 1 },
+        "stage_name_invalid_message": {
+          "type": "string",
+          "description": "Rejection message; {name} is substituted with the offending stage name."
+        },
+        "rewrites_frontmatter_name": { "type": "boolean" },
+        "advertises_staged_slug_name": { "type": "boolean" },
+        "surface_phrase": { "type": "string" },
+        "unresolved_phrase": { "type": "string" }
+      }
+    },
+    "skills_block": {
+      "type": "object",
+      "required": ["header", "item"],
+      "additionalProperties": false,
+      "description": "Harness-native available-skills block: header + one item per skill ({name}/{description}/{path} placeholders) + footer.",
+      "properties": {
+        "header": { "type": "string" },
+        "item": { "type": "string" },
+        "footer": { "type": "string" }
+      }
+    },
+    "transcript": {
+      "type": "object",
+      "required": ["events_filename"],
+      "additionalProperties": false,
+      "description": "Transcript ingest: the events file the CLI dispatch captures, read by exactly one of `parser` (a named code capability, for streams that need stitching) or `extract` (the declarative tier for flat event streams). The exactly-one rule is a Rust loader invariant.",
+      "properties": {
+        "events_filename": { "type": "string", "minLength": 1 },
+        "parser": { "enum": ["claude-stream-json", "codex-items"] },
+        "extract": {
+          "type": "object",
+          "additionalProperties": false,
+          "description": "Declarative extractor for flat event streams — five fixed primitives, no more: an equality filter (`where`), a final-text field pick (last match wins), a flat tool-item mapping, a token sum, and a duration rule. Streams needing keyed cross-event joins or content coercion are named `parser` capabilities instead. Declare at least one sub-table. Dotted paths descend nested objects only (keys containing literal dots are unaddressable).",
+          "properties": {
+            "tools": {
+              "type": "object",
+              "required": ["name_field"],
+              "additionalProperties": false,
+              "description": "Flat tool-item mapping: each matching record's item object becomes one tool invocation, in stream order.",
+              "properties": {
+                "where": {
+                  "type": "object",
+                  "additionalProperties": { "type": "string" },
+                  "description": "Dotted-path-to-expected-string equality filter; omitted matches every record."
+                },
+                "item": {
+                  "type": "string",
+                  "minLength": 1,
+                  "description": "Dotted path to the tool object within the record; omit when the record itself is the item. Records where the path resolves to nothing or a non-object are skipped."
+                },
+                "name_field": {
+                  "type": "string",
+                  "minLength": 1,
+                  "description": "Field of the item whose string value is the invocation name; records without it are skipped."
+                },
+                "skip_names": {
+                  "type": "array",
+                  "items": { "type": "string" },
+                  "description": "Names that are not tools (message/reasoning items sharing the tool event shape)."
+                },
+                "args_omit": {
+                  "type": "array",
+                  "items": { "type": "string" },
+                  "description": "Structural item keys excluded from args; whatever remains (key order preserved) is the args object, null when empty."
+                },
+                "result_coalesce": {
+                  "type": "array",
+                  "items": { "type": "string" },
+                  "description": "Result = first present of these item fields (present-but-null counts), strings verbatim and everything else compact JSON."
+                }
+              }
+            },
+            "final_text": {
+              "type": "object",
+              "required": ["field"],
+              "additionalProperties": false,
+              "description": "Final assistant text: dotted-path string pick over matching records; the last match wins.",
+              "properties": {
+                "where": {
+                  "type": "object",
+                  "additionalProperties": { "type": "string" },
+                  "description": "Dotted-path-to-expected-string equality filter; omitted matches every record."
+                },
+                "field": { "type": "string", "minLength": 1 }
+              }
+            },
+            "tokens": {
+              "type": "object",
+              "required": ["sum"],
+              "additionalProperties": false,
+              "description": "Token total: over matching records, sum the listed integer fields (missing or non-integer fields count 0; a record where no listed path resolves never turns an absent total into zero).",
+              "properties": {
+                "where": {
+                  "type": "object",
+                  "additionalProperties": { "type": "string" },
+                  "description": "Dotted-path-to-expected-string equality filter; omitted matches every record."
+                },
+                "sum": {
+                  "type": "array",
+                  "minItems": 1,
+                  "items": { "type": "string", "minLength": 1 },
+                  "description": "Dotted paths to the token counts to add up."
+                }
+              }
+            },
+            "duration": {
+              "type": "object",
+              "additionalProperties": false,
+              "description": "Wall-clock duration from exactly one of: `field` (a millisecond value; last match wins) or `timestamp_spread` (last minus first RFC 3339 timestamp; needs at least two parseable matches). The exactly-one rule is a Rust loader invariant.",
+              "properties": {
+                "where": {
+                  "type": "object",
+                  "additionalProperties": { "type": "string" },
+                  "description": "Dotted-path-to-expected-string equality filter; omitted matches every record."
+                },
+                "field": { "type": "string", "minLength": 1 },
+                "timestamp_spread": { "type": "string", "minLength": 1 }
+              }
+            }
+          }
+        },
+        "surfaces_skill_invocation": {
+          "type": "boolean",
+          "description": "Whether the transcript deterministically surfaces a skill invocation (false routes the meta-check to the LLM-judge fallback). For extract descriptors, leave false unless the mapping verifiably yields invocations named `Skill` carrying an `args.skill` field."
+        }
+      }
+    },
+    "model": {
+      "type": "object",
+      "required": ["flag"],
+      "additionalProperties": false,
+      "properties": {
+        "flag": { "type": "string", "minLength": 1 }
+      }
+    },
+    "guard": {
+      "type": "object",
+      "required": [
+        "hooks_file",
+        "matcher",
+        "command_template",
+        "hook_entry",
+        "verdict_template",
+        "armed_message"
+      ],
+      "additionalProperties": false,
+      "description": "Write guard: the data the generic guard engine renders into a PreToolUse hook and a deny verdict. Restricted to embedded built-in descriptors (the guard fails open, so a mistyped user descriptor would silently disarm it).",
+      "properties": {
+        "hooks_file": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Hook-config file the entry is merged into, `/`-separated relative to the staged env root (e.g. \".claude/settings.local.json\")."
+        },
+        "matcher": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Tool-name matcher the hook registers for; every hooked tool must be declared in [tools] write/patch/shell."
+        },
+        "command_template": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Shell command the armed hook runs, with {exe} and {marker} placeholders (e.g. '\"{exe}\" guard \"{marker}\"')."
+        },
+        "hook_entry": {
+          "type": "string",
+          "minLength": 1,
+          "description": "JSON template of the hook entry appended to the hook config's hooks.PreToolUse array, with {matcher} and {command} placeholders in its string values; authored key order is written verbatim."
+        },
+        "verdict_template": {
+          "type": "string",
+          "minLength": 1,
+          "description": "JSON template of the deny verdict printed on stdout, with a {reason} placeholder; authored key order is the harness's on-disk contract."
+        },
+        "armed_message": { "type": "string", "minLength": 1 }
+      }
+    },
+    "shadow": {
+      "type": "object",
+      "required": ["preflight"],
+      "additionalProperties": false,
+      "properties": {
+        "preflight": { "enum": ["claude-plugins"] }
+      }
+    },
+    "dispatch": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "CLI dispatch guidance: command templates ({model_arg}/{guard_args} slots) and the prose around them.",
+      "properties": {
+        "capture_prefix": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Prefix naming the judge recipe's per-task capture files ($response_base.<prefix>-events.jsonl)."
+        },
+        "guard_args": {
+          "type": "string",
+          "description": "Extra args spliced into command templates at {guard_args} when the run is guarded (leading space included)."
+        },
+        "model_note": {
+          "type": "string",
+          "description": "Sentence spliced into next_steps_template at {model_note} when an agent model was declared."
+        },
+        "next_steps_template": {
+          "type": "string",
+          "description": "Post-run handoff text; {exec_command}/{target_args}/{iteration}/{model_note} placeholders."
+        },
+        "exec_template": {
+          "type": "string",
+          "description": "Copy/pasteable single-dispatch command; <eval-root>-style angle placeholders are prose for the human."
+        },
+        "parallel_command_template": {
+          "type": "string",
+          "description": "Per-task command block spliced into the shared jq/xargs parallel scaffold."
+        },
+        "judge_command_template": {
+          "type": "string",
+          "description": "Judge command line spliced into the shared judge recipe; must reference $model_arg and {cwd} and end with a shell line continuation."
+        },
+        "manifest_template": {
+          "type": "string",
+          "description": "The dispatch-manifest harness section; {exec_command}/{parallel_recipe} placeholders; ends with exactly one newline."
+        }
+      }
+    }
+  },
+  "definitions": {
+    "tool_list": {
+      "type": "array",
+      "items": { "type": "string", "minLength": 1 }
+    }
+  }
+}
diff --git a/src/adapters/capabilities.rs b/src/adapters/capabilities.rs
new file mode 100644
index 0000000..d5f2333
--- /dev/null
+++ b/src/adapters/capabilities.rs
@@ -0,0 +1,108 @@
+//! Named code capabilities a harness descriptor references.
+//!
+//! Everything a descriptor cannot express as data — transcript stitching,
+//! slug sanitization, plugin-shadow scanning — lives behind one of these
+//! closed enums. A descriptor opts in by naming the capability
+//! (`parser = "codex-items"`); a harness whose stream is compatible with an
+//! existing capability gets the full feature from configuration alone. (The
+//! write guard needs no named capability: its install and verdict render from
+//! the descriptor's `[guard]` data via [`super::guard`].)
+//!
+//! The enums deserialize from the kebab-case capability names the
+//! `harness-descriptor` schema also enumerates, so an unknown name fails the
+//! schema gate with a listed-allowed-values message before ever reaching Rust.
+
+use std::io;
+use std::path::Path;
+
+use serde::{Deserialize, Serialize};
+
+use crate::core::ToolInvocation;
+
+use super::TranscriptSummary;
+use super::skill_shadow::PluginShadowReport;
+
+/// Transcript parsers: turn a captured CLI events file into tool invocations
+/// and a [`super::TranscriptSummary`].
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum TranscriptParser {
+    /// `claude -p --output-format stream-json` events.
+    ClaudeStreamJson,
+    /// `codex exec --json` `item.completed` events.
+    CodexItems,
+}
+
+impl TranscriptParser {
+    /// Parse the captured events file into ordered tool invocations.
+    pub(crate) fn parse(self, path: &Path) -> io::Result<Vec<ToolInvocation>> {
+        match self {
+            TranscriptParser::ClaudeStreamJson => {
+                super::claude_code::stream_json::parse_claude_stream_json(path)
+            }
+            TranscriptParser::CodexItems => super::codex::transcript::parse_codex_events(path),
+        }
+    }
+
+    /// The full-summary counterpart of [`parse`](Self::parse).
+    pub(crate) fn parse_full(self, path: &Path) -> io::Result<TranscriptSummary> {
+        match self {
+            TranscriptParser::ClaudeStreamJson => {
+                super::claude_code::stream_json::parse_claude_stream_json_full(path)
+            }
+            TranscriptParser::CodexItems => super::codex::transcript::parse_codex_events_full(path),
+        }
+    }
+}
+
+/// Staged-slug generators, for harnesses whose naming rules need
+/// sanitization/truncation beyond a format string.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum SlugCapability {
+    /// OpenCode's lowercase-alphanumeric-single-hyphen names, length-capped.
+    Opencode,
+}
+
+impl SlugCapability {
+    /// Generate the staged slug for one `(iteration, condition, skill)` cell.
+    pub(crate) fn staged_slug(
+        self,
+        prefix: &str,
+        iteration: u32,
+        condition: &str,
+        skill_name: &str,
+    ) -> String {
+        match self {
+            SlugCapability::Opencode => {
+                super::opencode::opencode_slug(prefix, iteration, condition, skill_name)
+            }
+        }
+    }
+}
+
+/// Shadow preflights: detect installed skills that shadow a staged slug.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum ShadowPreflight {
+    /// Claude Code plugin/skill scan rooted at the user config dir.
+    ClaudePlugins,
+}
+
+impl ShadowPreflight {
+    /// Detect staged skill names that are also discoverable from the
+    /// operator's live environment. `None` when nothing is shadowed.
+    pub(crate) fn detect(
+        self,
+        scan_root: &Path,
+        staged_skill_names: &[&str],
+    ) -> Option<PluginShadowReport> {
+        match self {
+            ShadowPreflight::ClaudePlugins => super::claude_code::plugin_shadow::shadow_preflight(
+                &super::claude_code::plugin_shadow::config_dir_from_env(),
+                scan_root,
+                staged_skill_names,
+            ),
+        }
+    }
+}
diff --git a/src/adapters/claude_cli.rs b/src/adapters/claude_cli.rs
deleted file mode 100644
index 2924b49..0000000
--- a/src/adapters/claude_cli.rs
+++ /dev/null
@@ -1,147 +0,0 @@
-//! Claude Code `claude -p` command rendering for `DispatchMechanism::Cli`
-//! guidance (hybrid / headless run modes).
-//!
-//! Differences from the Codex recipe, all forced by the `claude` CLI:
-//! `--output-format stream-json` requires `--verbose` in `-p` mode; there is no
-//! `--cd` flag, so the dispatch runs from the env dir (`cd <eval-root> &&`);
-//! and there is no `--output-last-message`, so the final message is recovered
-//! from the stream-json `result` event by the transcript adapter rather than
-//! written to a file. `</dev/null` detaches stdin so a permission prompt cannot
-//! block on a TTY and piped task data cannot become extra prompt context.
-
-use super::cli_command::render_cli_model_arg;
-use std::path::Path;
-
-/// Copy/pasteable Claude Code dispatch command template.
-pub(crate) fn claude_exec_command_template(
-    model_flag: Option<&str>,
-    agent_model: Option<&str>,
-) -> String {
-    let model_arg = render_cli_model_arg(model_flag, agent_model);
-    [
-        format!(
-            "cd <eval-root> && claude -p --output-format stream-json --verbose --permission-mode acceptEdits{model_arg} \\"
-        ),
-        "  \"Read the file at <dispatch_prompt_path> and follow its instructions exactly. When you finish, make your final response your closing summary.\" \\".to_string(),
-        "  </dev/null \\".to_string(),
-        "  > <outputs_dir>/claude-events.jsonl \\".to_string(),
-        "  2> <outputs_dir>/claude-stderr.log".to_string(),
-    ]
-    .join("\n")
-}
-
-/// Parallel dispatch recipe over `dispatch.json` tasks, one `claude -p` per task.
-pub(crate) fn claude_parallel_dispatch_recipe(
-    model_flag: Option<&str>,
-    agent_model: Option<&str>,
-) -> String {
-    let model_arg = render_cli_model_arg(model_flag, agent_model);
-    [
-        "JOBS=${JOBS:-4}".to_string(),
-        "jq -j '.tasks[] | [.eval_root, .dispatch_prompt_path, .outputs_dir] | @tsv + \"\\u0000\"' dispatch.json | \\".to_string(),
-        "  xargs -0 -P \"$JOBS\" -I{} sh -c '".to_string(),
-        "    eval_root=\"$(printf \"%s\" \"$1\" | cut -f1)\"".to_string(),
-        "    prompt_path=\"$(printf \"%s\" \"$1\" | cut -f2)\"".to_string(),
-        "    outputs_dir=\"$(printf \"%s\" \"$1\" | cut -f3)\"".to_string(),
-        "    mkdir -p \"$outputs_dir\"".to_string(),
-        format!(
-            "    cd \"$eval_root\" && claude -p --output-format stream-json --verbose --permission-mode acceptEdits{model_arg} \\"
-        ),
-        "      \"Read the file at $prompt_path and follow its instructions exactly. When you finish, make your final response your closing summary.\" \\".to_string(),
-        "      </dev/null \\".to_string(),
-        "      > \"$outputs_dir/claude-events.jsonl\" \\".to_string(),
-        "      2> \"$outputs_dir/claude-stderr.log\"".to_string(),
-        "  ' sh {}".to_string(),
-    ]
-    .join("\n")
-}
-
-/// Judge dispatch recipe over `judge-tasks.json`, one `claude -p` per task.
-///
-/// Judges run from `judge_cwd` (the iteration dir) — a common ancestor of every
-/// judge prompt, verdict `response_path`, and agent `outputs_dir`, and a dir with
-/// no write-guard hook.
-pub(crate) fn claude_judge_dispatch_recipe(model_flag: Option<&str>, judge_cwd: &Path) -> String {
-    let model_flag = model_flag.unwrap_or("--model");
-    let cwd = judge_cwd.display();
-    [
-        "Dispatch each judge task from judge-tasks.json with:".to_string(),
-        String::new(),
-        "```bash".to_string(),
-        "JOBS=${JOBS:-4}".to_string(),
-        "jq -j '.tasks[] | [.dispatch_prompt_path, .response_path, (.model // \"\")] | @tsv + \"\\u0000\"' judge-tasks.json | \\".to_string(),
-        "  xargs -0 -P \"$JOBS\" -I{} sh -c '".to_string(),
-        "    prompt_path=\"$(printf \"%s\" \"$1\" | cut -f1)\"".to_string(),
-        "    response_path=\"$(printf \"%s\" \"$1\" | cut -f2)\"".to_string(),
-        "    model=\"$(printf \"%s\" \"$1\" | cut -f3)\"".to_string(),
-        "    response_base=\"${response_path%.json}\"".to_string(),
-        "    mkdir -p \"$(dirname \"$response_path\")\"".to_string(),
-        "    model_arg=\"\"; [ -n \"$model\" ] && model_arg=\"".to_string()
-            + model_flag
-            + " $model\"",
-        format!(
-            "    cd \"{cwd}\" && claude -p --output-format stream-json --verbose --permission-mode acceptEdits $model_arg \\"
-        ),
-        "      \"Read the file at $prompt_path and follow it exactly. You are a judge worker only: write the JSON verdict to $response_path, then reply with one sentence. Do not run eval-magic. Do not dispatch other judge tasks. Do not wait for other workers.\" \\".to_string(),
-        "      </dev/null \\".to_string(),
-        "      > \"$response_base.claude-events.jsonl\" \\".to_string(),
-        "      2> \"$response_base.claude-stderr.log\"".to_string(),
-        "  ' sh {}".to_string(),
-        "```".to_string(),
-    ]
-    .join("\n")
-}
-
-#[cfg(test)]
-mod tests {
-    use super::{
-        claude_exec_command_template, claude_judge_dispatch_recipe, claude_parallel_dispatch_recipe,
-    };
-    use std::path::Path;
-
-    #[test]
-    fn exec_template_carries_required_stream_json_flags() {
-        let cmd = claude_exec_command_template(Some("--model"), None);
-        assert!(cmd.contains("claude -p"), "{cmd}");
-        assert!(cmd.contains("--output-format stream-json"), "{cmd}");
-        // stream-json requires --verbose in -p mode.
-        assert!(cmd.contains("--verbose"), "{cmd}");
-        assert!(cmd.contains("--permission-mode acceptEdits"), "{cmd}");
-        assert!(cmd.contains("> <outputs_dir>/claude-events.jsonl"), "{cmd}");
-        assert!(cmd.contains("2> <outputs_dir>/claude-stderr.log"), "{cmd}");
-        assert!(cmd.contains("</dev/null"), "{cmd}");
-        // claude has no --cd flag; the dispatch runs from the env dir.
-        assert!(cmd.contains("cd <eval-root>"), "{cmd}");
-        assert!(cmd.contains("<dispatch_prompt_path>"), "{cmd}");
-        // claude has no --output-last-message; final text comes from the result event.
-        assert!(!cmd.contains("--output-last-message"), "{cmd}");
-        assert!(!cmd.contains("final-message.md"), "{cmd}");
-    }
-
-    #[test]
-    fn exec_template_includes_model_only_when_declared() {
-        let with = claude_exec_command_template(Some("--model"), Some("opus"));
-        assert!(with.contains("--model opus"), "{with}");
-        let without = claude_exec_command_template(Some("--model"), None);
-        assert!(!without.contains("--model "), "{without}");
-    }
-
-    #[test]
-    fn parallel_recipe_drives_claude_p_per_task() {
-        let recipe = claude_parallel_dispatch_recipe(Some("--model"), Some("sonnet"));
-        assert!(recipe.contains("claude -p"), "{recipe}");
-        assert!(recipe.contains("claude-events.jsonl"), "{recipe}");
-        assert!(recipe.contains("dispatch.json"), "{recipe}");
-        assert!(recipe.contains("--model sonnet"), "{recipe}");
-    }
-
-    #[test]
-    fn judge_recipe_runs_from_iteration_dir() {
-        let recipe = claude_judge_dispatch_recipe(Some("--model"), Path::new("/work/iter-1"));
-        assert!(recipe.contains("claude -p"), "{recipe}");
-        assert!(recipe.contains("judge-tasks.json"), "{recipe}");
-        assert!(recipe.contains("response_path"), "{recipe}");
-        assert!(!recipe.contains("<eval-root>"), "{recipe}");
-        assert!(recipe.contains("cd \"/work/iter-1\" &&"), "{recipe}");
-    }
-}
diff --git a/src/adapters/claude_code/mod.rs b/src/adapters/claude_code/mod.rs
new file mode 100644
index 0000000..1b95861
--- /dev/null
+++ b/src/adapters/claude_code/mod.rs
@@ -0,0 +1,55 @@
+//! Claude Code harness support — the default harness.
+//!
+//! The declarative half of this harness lives in `harnesses/claude-code.toml`
+//! (including the write-guard data rendered by the generic engine in
+//! [`crate::adapters::guard`]); this module tree keeps only the code-backed
+//! capabilities the descriptor references: `claude -p` stream-json transcript
+//! parsing ([`stream_json`] + [`transcript`]) and plugin-shadow detection
+//! ([`plugin_shadow`]).
+
+pub mod plugin_shadow;
+pub mod stream_json;
+pub mod transcript;
+
+#[cfg(test)]
+mod tests {
+    use crate::adapters::adapter_for;
+    use crate::core::Harness;
+
+    #[test]
+    fn claude_adapter_advertises_cli_events_file_and_model_flag() {
+        let a = adapter_for(Harness::resolve("claude-code").unwrap());
+        assert_eq!(
+            a.cli_events_filename().as_deref(),
+            Some("claude-events.jsonl")
+        );
+        assert_eq!(a.cli_model_flag().as_deref(), Some("--model"));
+    }
+
+    #[test]
+    fn claude_parse_cli_events_full_reads_stream_json_result_event() {
+        use serde_json::json;
+        let dir = tempfile::TempDir::new().unwrap();
+        let path = dir.path().join("claude-events.jsonl");
+        // No per-line timestamps; the result event is the only source of duration.
+        let lines = [
+            json!({"type": "assistant", "message": {"id": "msg_1", "role": "assistant", "content": [
+                {"type": "tool_use", "id": "toolu_1", "name": "Bash", "input": {"command": "ls"}}
+            ]}}),
+            json!({"type": "result", "subtype": "success", "is_error": false, "result": "Done", "duration_ms": 5637, "usage": {"input_tokens": 1, "output_tokens": 2, "cache_creation_input_tokens": 0, "cache_read_input_tokens": 0}}),
+        ];
+        let body = lines
+            .iter()
+            .map(|l| l.to_string())
+            .collect::<Vec<_>>()
+            .join("\n");
+        std::fs::write(&path, format!("{body}\n")).unwrap();
+
+        let a = adapter_for(Harness::resolve("claude-code").unwrap());
+        let summary = a.parse_cli_events_full(&path).unwrap();
+        assert_eq!(summary.final_text, Some("Done".into()));
+        assert_eq!(summary.duration_ms, Some(5637));
+        assert_eq!(summary.tool_invocations.len(), 1);
+        assert_eq!(summary.tool_invocations[0].name, "Bash");
+    }
+}
diff --git a/src/adapters/plugin_shadow.rs b/src/adapters/claude_code/plugin_shadow.rs
similarity index 70%
rename from src/adapters/plugin_shadow.rs
rename to src/adapters/claude_code/plugin_shadow.rs
index ffce295..ea410bc 100644
--- a/src/adapters/plugin_shadow.rs
+++ b/src/adapters/claude_code/plugin_shadow.rs
@@ -1,59 +1,21 @@
 //! Plugin-shadow detector (Claude Code).
 //!
-//! The runner stages eval skills into the
-//! project-local `.claude/skills/` dir, but eval subagents are dispatched via the
-//! Task tool and run in-process — so they ALSO inherit whatever skills the
-//! orchestrator session loaded from installed plugins and the global skills dir.
-//! When a staged skill name collides with one of those, both copies are
-//! discoverable and the with/without comparison is contaminated. The runner
-//! cannot unload a plugin from a running session, so this module only *detects
-//! and reports* the overlap, reading declared settings as a best-effort proxy.
-
+//! The runner stages eval skills into each dispatch's project-local
+//! `.claude/skills/` dir, but every `claude -p` dispatch ALSO loads the user/global
+//! plugins and the global skills dir from its Claude config. When a staged skill
+//! name collides with one of those, both copies are discoverable and the
+//! with/without comparison is contaminated. The runner cannot strip an installed
+//! plugin from a dispatch, so this module only *detects and reports* the overlap,
+//! reading declared settings as a best-effort proxy. The report/banner shapes are
+//! harness-neutral and live in [`skill_shadow`](crate::adapters::skill_shadow).
+
+use serde::Deserialize;
 use serde::de::DeserializeOwned;
-use serde::{Deserialize, Serialize};
 use std::collections::{HashMap, HashSet};
 use std::fs;
 use std::path::{Path, PathBuf};
 
-const ISOLATION_DOC: &str = "docs/harness-claude-code.md → \"Isolating from installed plugins\"";
-
-/// A staged skill that is also discoverable from the live environment.
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
-#[serde(tag = "kind", rename_all = "kebab-case")]
-pub enum ShadowSource {
-    Plugin {
-        plugin: String,
-        skill_name: String,
-        path: String,
-    },
-    GlobalSkill {
-        skill_name: String,
-        path: String,
-    },
-}
-
-impl ShadowSource {
-    fn skill_name(&self) -> &str {
-        match self {
-            ShadowSource::Plugin { skill_name, .. } => skill_name,
-            ShadowSource::GlobalSkill { skill_name, .. } => skill_name,
-        }
-    }
-
-    fn source_label(&self) -> String {
-        match self {
-            ShadowSource::Plugin { plugin, .. } => format!("enabled plugin '{plugin}'"),
-            ShadowSource::GlobalSkill { .. } => "the global skills dir".to_string(),
-        }
-    }
-}
-
-/// The detector's findings for a run.
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
-pub struct PluginShadowReport {
-    pub config_dir: String,
-    pub shadowed: Vec<ShadowSource>,
-}
+use crate::adapters::skill_shadow::{PluginShadowReport, ShadowSource};
 
 /// The Claude Code config dir: a non-empty `CLAUDE_CONFIG_DIR` override (passed
 /// in), else `~/.claude`.
@@ -199,55 +161,16 @@ pub fn detect_plugin_shadows(
     }
 }
 
-/// One `validity_warnings` line per shadowed skill (for benchmark.json).
-pub fn shadow_validity_warnings(report: &PluginShadowReport) -> Vec<String> {
-    report
-        .shadowed
-        .iter()
-        .map(|s| {
-            format!(
-                "staged skill '{}' is also provided by {} — eval subagents could discover both \
-                 copies, so with/without results may be contaminated. Re-run from an isolated \
-                 session (see {}).",
-                s.skill_name(),
-                s.source_label(),
-                ISOLATION_DOC
-            )
-        })
-        .collect()
-}
-
-/// Build-time banner for the runner. Empty string when nothing is shadowed.
-pub fn format_shadow_banner(report: &PluginShadowReport) -> String {
-    if report.shadowed.is_empty() {
-        return String::new();
-    }
-    let mut lines = vec![
-        String::new(),
-        "⚠ Plugin-shadow warning: skills staged for this eval are ALSO discoverable".to_string(),
-        "  from your live environment:".to_string(),
-    ];
-    for s in &report.shadowed {
-        lines.push(format!("  • {} — {}", s.skill_name(), s.source_label()));
-    }
-    lines.push(
-        "  Eval subagents (dispatched via the Task tool) inherit this session's plugins,"
-            .to_string(),
-    );
-    lines.push(
-        "  so both the staged copy and the installed copy are discoverable — the".to_string(),
-    );
-    lines.push(
-        "  with/without comparison may be contaminated and the control arm is not truly"
-            .to_string(),
-    );
-    lines.push(
-        "  skill-absent. The runner cannot unload a plugin from a running session.".to_string(),
-    );
-    lines.push(format!(
-        "  Re-run from an isolated session — see {ISOLATION_DOC}."
-    ));
-    lines.join("\n")
+/// The build-time preflight: `Some(report)` only when a staged name is
+/// shadowed. `config_dir` is passed in so the env-reading caller (the adapter's
+/// `detect_shadowed_skills`) stays a thin wrapper.
+pub fn shadow_preflight(
+    config_dir: &Path,
+    cwd: &Path,
+    staged_skill_names: &[&str],
+) -> Option<PluginShadowReport> {
+    let report = detect_plugin_shadows(config_dir, cwd, staged_skill_names);
+    (!report.shadowed.is_empty()).then_some(report)
 }
 
 #[cfg(test)]
@@ -435,40 +358,22 @@ mod tests {
         assert_eq!(report.config_dir, config.to_string_lossy());
     }
 
-    fn sample_report() -> PluginShadowReport {
-        PluginShadowReport {
-            config_dir: "/x".into(),
-            shadowed: vec![ShadowSource::Plugin {
-                plugin: "slow-powers@slowdini".into(),
-                skill_name: "verification-before-completion".into(),
-                path: "/p".into(),
-            }],
-        }
-    }
-
-    #[test]
-    fn validity_warnings_name_skill_plugin_and_contamination() {
-        let warnings = shadow_validity_warnings(&sample_report());
-        assert_eq!(warnings.len(), 1);
-        assert!(warnings[0].contains("verification-before-completion"));
-        assert!(warnings[0].contains("slow-powers@slowdini"));
-        assert!(warnings[0].to_lowercase().contains("contaminat"));
-    }
-
     #[test]
-    fn banner_is_empty_when_nothing_shadowed() {
-        let empty = PluginShadowReport {
-            config_dir: "/x".into(),
-            shadowed: vec![],
-        };
-        assert_eq!(format_shadow_banner(&empty), "");
+    fn preflight_is_none_when_nothing_is_shadowed() {
+        let tmp = TempDir::new().unwrap();
+        let (config, cwd) = fresh(&tmp);
+        assert_eq!(shadow_preflight(&config, &cwd, &["mine"]), None);
     }
 
     #[test]
-    fn banner_lists_shadowed_skills_and_points_at_isolation_docs() {
-        let banner = format_shadow_banner(&sample_report());
-        assert!(banner.contains("verification-before-completion"));
-        assert!(banner.contains("slow-powers@slowdini"));
-        assert!(banner.to_lowercase().contains("isolat"));
+    fn preflight_returns_the_report_when_a_skill_is_shadowed() {
+        let tmp = TempDir::new().unwrap();
+        let (config, cwd) = fresh(&tmp);
+        write_file(
+            &config.join("skills").join("my-skill").join("SKILL.md"),
+            "---\nname: my-skill\n---\n",
+        );
+        let report = shadow_preflight(&config, &cwd, &["my-skill"]).expect("skill is shadowed");
+        assert_eq!(report.shadowed.len(), 1);
     }
 }
diff --git a/src/adapters/claude_stream_json.rs b/src/adapters/claude_code/stream_json.rs
similarity index 91%
rename from src/adapters/claude_stream_json.rs
rename to src/adapters/claude_code/stream_json.rs
index 9d4c25b..2bbe13d 100644
--- a/src/adapters/claude_stream_json.rs
+++ b/src/adapters/claude_code/stream_json.rs
@@ -4,23 +4,25 @@
 //! --output-format stream-json --verbose` writes (captured per task as
 //! `outputs/claude-events.jsonl`). The `assistant`/`user` events wrap a full
 //! Anthropic Messages object under `message`, so tool-call extraction is shared
-//! with the in-session [`claude_code_transcript`](super::claude_code_transcript)
-//! parser. The differences are all in the envelope: there are no per-line
+//! with the [`transcript`](super::transcript) record
+//! types. The differences are all in the envelope: there are no per-line
 //! timestamps, and a terminal `result` event carries the authoritative final
 //! text, wall-clock duration, and token usage. `system`, `rate_limit_event`, and
 //! any other non-message events are ignored (they don't deserialize into an
 //! assistant/user record, so the shared extractor skips them).
 
-use std::fs;
 use std::io;
 use std::path::Path;
 
+use serde::Deserialize;
+use serde_json::Value;
+
 use crate::core::ToolInvocation;
 
-use super::TranscriptSummary;
-use super::claude_code_transcript::{
-    TranscriptRecord, UsageRecord, extract_invocations, last_assistant_text, read_records,
-};
+use crate::adapters::TranscriptSummary;
+use crate::adapters::transcript::read_jsonl;
+
+use super::transcript::{TranscriptRecord, UsageRecord, extract_invocations, last_assistant_text};
 
 /// The terminal `{"type":"result", …}` event of a `-p` stream-json run.
 #[derive(Debug, serde::Deserialize)]
@@ -35,10 +37,10 @@ struct ResultEvent {
     usage: Option<UsageRecord>,
 }
 
-/// Parse the event stream into ordered tool invocations. Reuses the in-session
+/// Parse the event stream into ordered tool invocations. Reuses the shared
 /// extractor: non-message events deserialize into records the extractor skips.
 pub fn parse_claude_stream_json(path: &Path) -> io::Result<Vec<ToolInvocation>> {
-    Ok(extract_invocations(&read_records(path)?))
+    Ok(extract_invocations(&read_jsonl::<TranscriptRecord>(path)?))
 }
 
 /// Parse the event stream into a full [`TranscriptSummary`]. Final text,
@@ -46,19 +48,16 @@ pub fn parse_claude_stream_json(path: &Path) -> io::Result<Vec<ToolInvocation>>
 /// missing or errored `result` the final text falls back to the last assistant
 /// message's text, and duration/tokens fall back to `None`.
 pub fn parse_claude_stream_json_full(path: &Path) -> io::Result<TranscriptSummary> {
-    let raw = fs::read_to_string(path)?;
+    let values = read_jsonl::<Value>(path)?;
     let mut records: Vec<TranscriptRecord> = Vec::new();
     let mut result_event: Option<ResultEvent> = None;
-    for line in raw.split('\n') {
-        if line.trim().is_empty() {
-            continue;
-        }
-        // Skip malformed lines rather than failing the whole parse.
-        let Ok(record) = serde_json::from_str::<TranscriptRecord>(line) else {
+    for value in &values {
+        // Skip lines that don't shape into records rather than failing the parse.
+        let Ok(record) = TranscriptRecord::deserialize(value) else {
             continue;
         };
         if record.record_type.as_deref() == Some("result") {
-            result_event = serde_json::from_str::<ResultEvent>(line).ok();
+            result_event = ResultEvent::deserialize(value).ok();
         }
         records.push(record);
     }
diff --git a/src/adapters/claude_code/transcript.rs b/src/adapters/claude_code/transcript.rs
new file mode 100644
index 0000000..b77a764
--- /dev/null
+++ b/src/adapters/claude_code/transcript.rs
@@ -0,0 +1,299 @@
+//! Claude Code transcript record types and tool-call extraction.
+//!
+//! Defines the JSONL record shapes and the shared extractors — ordered
+//! [`ToolInvocation`]s (matching `tool_result` blocks back to their `tool_use` by
+//! id) and the last assistant text — reused by the `claude -p` stream-json parser
+//! ([`stream_json`](super::stream_json)). The harness-neutral
+//! [`TranscriptSummary`](crate::adapters::TranscriptSummary) the pipeline
+//! consumes lives in `crate::adapters::transcript`.
+
+use crate::core::ToolInvocation;
+use serde::Deserialize;
+use serde_json::Value;
+use std::collections::HashMap;
+
+#[derive(Debug, Deserialize)]
+pub(crate) struct UsageRecord {
+    pub(crate) input_tokens: Option<i64>,
+    pub(crate) output_tokens: Option<i64>,
+    pub(crate) cache_creation_input_tokens: Option<i64>,
+    pub(crate) cache_read_input_tokens: Option<i64>,
+}
+
+#[derive(Debug, Deserialize)]
+struct Message {
+    /// String or array of content blocks; inspected as raw JSON.
+    content: Option<Value>,
+}
+
+#[derive(Debug, Deserialize)]
+pub(crate) struct TranscriptRecord {
+    #[serde(rename = "type")]
+    pub(crate) record_type: Option<String>,
+    message: Option<Message>,
+}
+
+/// Content blocks of a message: the array as-is, or empty for string/absent
+/// content.
+fn content_blocks(message: &Option<Message>) -> &[Value] {
+    match message.as_ref().and_then(|m| m.content.as_ref()) {
+        Some(Value::Array(arr)) => arr,
+        _ => &[],
+    }
+}
+
+/// Coerce a JSON value to a plain string the way JS `String(x)` would for the
+/// common cases (a `tool_result` array element's `text` field).
+fn value_to_plain_string(v: &Value) -> String {
+    match v {
+        Value::String(s) => s.clone(),
+        Value::Null => "null".into(),
+        Value::Bool(b) => b.to_string(),
+        Value::Number(n) => n.to_string(),
+        _ => serde_json::to_string(v).unwrap_or_default(),
+    }
+}
+
+/// Stringify a `tool_result` block's content: strings pass through; arrays join
+/// their elements with newlines (string as-is, object's `text` field coerced,
+/// else JSON); other values are JSON-encoded.
+fn stringify_result(content: Option<&Value>) -> String {
+    match content {
+        Some(Value::String(s)) => s.clone(),
+        Some(Value::Array(arr)) => arr
+            .iter()
+            .map(|c| match c {
+                Value::String(s) => s.clone(),
+                Value::Object(_) => match c.get("text") {
+                    Some(t) => value_to_plain_string(t),
+                    None => serde_json::to_string(c).unwrap_or_default(),
+                },
+                _ => serde_json::to_string(c).unwrap_or_default(),
+            })
+            .collect::<Vec<_>>()
+            .join("\n"),
+        Some(other) => serde_json::to_string(other).unwrap_or_default(),
+        None => String::new(),
+    }
+}
+
+pub(crate) fn extract_invocations(records: &[TranscriptRecord]) -> Vec<ToolInvocation> {
+    let mut invocations: Vec<ToolInvocation> = Vec::new();
+    let mut index_by_id: HashMap<String, usize> = HashMap::new();
+
+    for record in records {
+        let rtype = record.record_type.as_deref();
+        let blocks = content_blocks(&record.message);
+
+        if rtype == Some("assistant") {
+            for block in blocks {
+                if block.get("type").and_then(Value::as_str) != Some("tool_use") {
+                    continue;
+                }
+                let ordinal = invocations.len();
+                if let Some(id) = block.get("id").and_then(Value::as_str) {
+                    index_by_id.insert(id.to_string(), ordinal);
+                }
+                invocations.push(ToolInvocation {
+                    name: block
+                        .get("name")
+                        .and_then(Value::as_str)
+                        .unwrap_or("")
+                        .to_string(),
+                    args: block.get("input").cloned(),
+                    result: None,
+                    ordinal: ordinal as u32,
+                });
+            }
+        } else if rtype == Some("user") {
+            for block in blocks {
+                if block.get("type").and_then(Value::as_str) != Some("tool_result") {
+                    continue;
+                }
+                let Some(id) = block.get("tool_use_id").and_then(Value::as_str) else {
+                    continue;
+                };
+                let Some(&idx) = index_by_id.get(id) else {
+                    continue;
+                };
+                invocations[idx].result =
+                    Some(Value::String(stringify_result(block.get("content"))));
+            }
+        }
+    }
+
+    invocations
+}
+
+/// The concatenated text blocks of the last assistant message carrying any text.
+/// Shared with the `-p` stream-json parser, which uses it as the final-message
+/// fallback when the terminal `result` event is absent or errored.
+pub(crate) fn last_assistant_text(records: &[TranscriptRecord]) -> Option<String> {
+    let mut final_text: Option<String> = None;
+    for record in records {
+        if record.record_type.as_deref() != Some("assistant") {
+            continue;
+        }
+        let texts: Vec<&str> = content_blocks(&record.message)
+            .iter()
+            .filter(|b| b.get("type").and_then(Value::as_str) == Some("text"))
+            .filter_map(|b| b.get("text").and_then(Value::as_str))
+            .collect();
+        if !texts.is_empty() {
+            final_text = Some(texts.join("\n"));
+        }
+    }
+    final_text
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::adapters::transcript::read_jsonl;
+    use serde_json::{Value, json};
+    use std::fs;
+    use std::path::Path;
+    use tempfile::TempDir;
+
+    fn write_jsonl(path: &Path, lines: &[Value]) {
+        let body = lines
+            .iter()
+            .map(|l| l.to_string())
+            .collect::<Vec<_>>()
+            .join("\n");
+        fs::write(path, format!("{body}\n")).unwrap();
+    }
+
+    /// Read the records and run the shared tool-call extractor — the path the
+    /// stream-json parser also takes.
+    fn invocations(path: &Path) -> Vec<ToolInvocation> {
+        extract_invocations(&read_jsonl::<TranscriptRecord>(path).unwrap())
+    }
+
+    #[test]
+    fn extracts_tool_use_blocks_with_ordinal_and_args() {
+        let dir = TempDir::new().unwrap();
+        let path = dir.path().join("simple.jsonl");
+        write_jsonl(
+            &path,
+            &[
+                json!({"type": "user", "message": {"role": "user", "content": "Run the tests"}}),
+                json!({"type": "assistant", "message": {"role": "assistant", "content": [
+                    {"type": "text", "text": "Running tests now."},
+                    {"type": "tool_use", "id": "toolu_001", "name": "Bash", "input": {"command": "bun test"}}
+                ]}}),
+                json!({"type": "user", "message": {"role": "user", "content": [
+                    {"type": "tool_result", "tool_use_id": "toolu_001", "content": "2 pass\n0 fail"}
+                ]}}),
+                json!({"type": "assistant", "message": {"role": "assistant", "content": [
+                    {"type": "tool_use", "id": "toolu_002", "name": "Read", "input": {"file_path": "/tmp/x.txt"}}
+                ]}}),
+            ],
+        );
+
+        let result = invocations(&path);
+        assert_eq!(result.len(), 2);
+        assert_eq!(result[0].name, "Bash");
+        assert_eq!(result[0].ordinal, 0);
+        assert_eq!(result[0].args, Some(json!({"command": "bun test"})));
+        assert_eq!(
+            result[0].result,
+            Some(Value::String("2 pass\n0 fail".into()))
+        );
+        assert_eq!(result[1].name, "Read");
+        assert_eq!(result[1].ordinal, 1);
+        assert_eq!(result[1].args, Some(json!({"file_path": "/tmp/x.txt"})));
+        assert_eq!(result[1].result, None);
+    }
+
+    #[test]
+    fn returns_empty_when_no_tool_use_blocks() {
+        let dir = TempDir::new().unwrap();
+        let path = dir.path().join("no-tools.jsonl");
+        write_jsonl(
+            &path,
+            &[
+                json!({"type": "user", "message": {"role": "user", "content": "hi"}}),
+                json!({"type": "assistant", "message": {"role": "assistant", "content": [{"type": "text", "text": "hello"}]}}),
+            ],
+        );
+        assert_eq!(invocations(&path), vec![]);
+    }
+
+    #[test]
+    fn skips_malformed_jsonl_lines() {
+        let dir = TempDir::new().unwrap();
+        let path = dir.path().join("malformed.jsonl");
+        let good_a = json!({"type": "assistant", "message": {"role": "assistant", "content": [
+            {"type": "tool_use", "id": "toolu_a", "name": "Bash", "input": {"command": "ls"}}
+        ]}});
+        let good_b = json!({"type": "assistant", "message": {"role": "assistant", "content": [
+            {"type": "tool_use", "id": "toolu_b", "name": "Read", "input": {"file_path": "/tmp"}}
+        ]}});
+        let body = format!("{good_a}\nnot valid json\n{good_b}\n");
+        fs::write(&path, body).unwrap();
+
+        let result = invocations(&path);
+        assert_eq!(result.len(), 2);
+        assert_eq!(
+            result.iter().map(|r| r.name.as_str()).collect::<Vec<_>>(),
+            vec!["Bash", "Read"]
+        );
+    }
+
+    #[test]
+    fn handles_tool_result_with_array_content() {
+        let dir = TempDir::new().unwrap();
+        let path = dir.path().join("array-result.jsonl");
+        write_jsonl(
+            &path,
+            &[
+                json!({"type": "assistant", "message": {"role": "assistant", "content": [
+                    {"type": "tool_use", "id": "toolu_x", "name": "Bash", "input": {"command": "echo hi"}}
+                ]}}),
+                json!({"type": "user", "message": {"role": "user", "content": [
+                    {"type": "tool_result", "tool_use_id": "toolu_x", "content": [{"type": "text", "text": "hi"}]}
+                ]}}),
+            ],
+        );
+        let result = invocations(&path);
+        assert_eq!(result.len(), 1);
+        assert_eq!(result[0].result, Some(Value::String("hi".into())));
+    }
+
+    #[test]
+    fn last_assistant_text_concatenates_text_of_last_assistant_message() {
+        let dir = TempDir::new().unwrap();
+        let path = dir.path().join("final-text.jsonl");
+        write_jsonl(
+            &path,
+            &[
+                json!({"type": "assistant", "message": {"id": "msg_1", "role": "assistant", "content": [{"type": "text", "text": "intermediate"}]}}),
+                json!({"type": "assistant", "message": {"id": "msg_2", "role": "assistant", "content": [
+                    {"type": "text", "text": "All tests pass."},
+                    {"type": "tool_use", "id": "toolu_z", "name": "Bash", "input": {"command": "true"}},
+                    {"type": "text", "text": "Wrapping up."}
+                ]}}),
+                json!({"type": "user", "message": {"role": "user", "content": [{"type": "tool_result", "tool_use_id": "toolu_z", "content": "ok"}]}}),
+            ],
+        );
+        assert_eq!(
+            last_assistant_text(&read_jsonl::<TranscriptRecord>(&path).unwrap()),
+            Some("All tests pass.\nWrapping up.".into())
+        );
+    }
+
+    #[test]
+    fn last_assistant_text_is_null_when_no_assistant_text() {
+        let dir = TempDir::new().unwrap();
+        let path = dir.path().join("no-text.jsonl");
+        write_jsonl(
+            &path,
+            &[json!({"type": "user", "message": {"role": "user", "content": "hi"}})],
+        );
+        assert_eq!(
+            last_assistant_text(&read_jsonl::<TranscriptRecord>(&path).unwrap()),
+            None
+        );
+    }
+}
diff --git a/src/adapters/claude_code_session.rs b/src/adapters/claude_code_session.rs
deleted file mode 100644
index 0462edf..0000000
--- a/src/adapters/claude_code_session.rs
+++ /dev/null
@@ -1,230 +0,0 @@
-//! Claude Code-specific rendering of session-start context.
-//!
-//! The available-skills reminder is
-//! a *harness-specific* surface: Claude Code presents discoverable skills to an
-//! agent as "The following skills are available for use with the Skill tool:"
-//! followed by `- name: description` bullets. Plan-mode context is injected as a
-//! `<system-reminder>` block. Both live in an adapter rather than the harness-
-//! agnostic orchestrator so a new harness adds its own renderer alongside.
-
-use std::path::{Path, PathBuf};
-
-use crate::core::AvailableSkill;
-
-/// Render the list of discoverable skills the way a real Claude Code session
-/// surfaces them, so an eval dispatch mirrors a genuine session rather than
-/// announcing itself as an eval. Returns an empty string when no skills are
-/// staged (the caller omits the block entirely in that case).
-pub fn render_available_skills_block(skills: &[AvailableSkill]) -> String {
-    if skills.is_empty() {
-        return String::new();
-    }
-    let mut sorted: Vec<&AvailableSkill> = skills.iter().collect();
-    sorted.sort_by(|a, b| a.name.cmp(&b.name));
-    let mut out = String::from("The following skills are available for use with the Skill tool:\n");
-    for s in sorted {
-        out.push_str(&format!("\n- {}: {}", s.name, s.description));
-    }
-    out
-}
-
-/// Render a plan-mode profile the way Claude Code injects an operating mode into
-/// a live session: as a `<system-reminder>` block the agent is told it is
-/// operating under, not prose it merely reads. Returns an empty string for empty
-/// input so the caller can omit the section entirely.
-pub fn render_plan_mode_context(profile_text: &str) -> String {
-    let trimmed = profile_text.trim();
-    if trimmed.is_empty() {
-        return String::new();
-    }
-    format!("<system-reminder>\n{trimmed}\n</system-reminder>")
-}
-
-/// Slugify an absolute path the way Claude Code names its project directories:
-/// every non-alphanumeric character becomes `-`. For example
-/// `/Users/x/.config/oc` → `-Users-x--config-oc` (the `/` before `.config` and
-/// the `.` each map to a `-`, producing the double hyphen).
-pub fn slugify_project_path(path: &Path) -> String {
-    path.to_string_lossy()
-        .chars()
-        .map(|c| if c.is_ascii_alphanumeric() { c } else { '-' })
-        .collect()
-}
-
-/// Locate the subagents transcript dir for a Claude Code session.
-///
-/// Returns `<config_dir>/projects/<slug>/<session_id>/subagents/` when it
-/// exists, where `<slug>` is [`slugify_project_path`] of `cwd`. If the
-/// cwd-derived slug doesn't match (e.g. the command ran from a subdirectory of
-/// the session's project), scans `<config_dir>/projects/*` for a child named
-/// `<session_id>` — the session id is a globally-unique UUID, so at most one
-/// project dir contains it. Returns `None` if no `subagents/` dir is found.
-pub fn resolve_subagents_dir_for_session(
-    config_dir: &Path,
-    cwd: &Path,
-    session_id: &str,
-) -> Option<PathBuf> {
-    let projects = config_dir.join("projects");
-    let primary = projects
-        .join(slugify_project_path(cwd))
-        .join(session_id)
-        .join("subagents");
-    if primary.is_dir() {
-        return Some(primary);
-    }
-    let entries = std::fs::read_dir(&projects).ok()?;
-    for entry in entries.flatten() {
-        let candidate = entry.path().join(session_id).join("subagents");
-        if candidate.is_dir() {
-            return Some(candidate);
-        }
-    }
-    None
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::core::AvailableSkill;
-    use std::fs;
-    use tempfile::TempDir;
-
-    fn skill(name: &str, description: &str) -> AvailableSkill {
-        AvailableSkill {
-            name: name.into(),
-            path: format!("/x/{name}/SKILL.md"),
-            description: description.into(),
-        }
-    }
-
-    #[test]
-    fn uses_harness_native_header_and_one_bullet_per_skill() {
-        let block = render_available_skills_block(&[skill("foo", "the foo skill")]);
-        assert!(block.contains("The following skills are available for use with the Skill tool:"));
-        assert!(block.contains("- foo: the foo skill"));
-        // The eval-flavored wording and custom format must be gone.
-        assert!(!block.contains("staged and discoverable"));
-        assert!(!block.contains("*Trigger:*"));
-    }
-
-    #[test]
-    fn sorts_skills_by_name() {
-        let block = render_available_skills_block(&[skill("zebra", "z"), skill("alpha", "a")]);
-        assert!(block.find("- alpha:").unwrap() < block.find("- zebra:").unwrap());
-    }
-
-    #[test]
-    fn empty_list_renders_empty_string() {
-        assert_eq!(render_available_skills_block(&[]), "");
-    }
-
-    #[test]
-    fn plan_mode_wraps_in_system_reminder() {
-        let block = render_plan_mode_context("Plan mode is active. Do not edit.");
-        assert!(block.contains("<system-reminder>"));
-        assert!(block.contains("</system-reminder>"));
-        assert!(block.contains("Plan mode is active. Do not edit."));
-    }
-
-    #[test]
-    fn plan_mode_trims_surrounding_whitespace() {
-        let block = render_plan_mode_context("\n\n  PROFILE-BODY  \n\n");
-        assert_eq!(block, "<system-reminder>\nPROFILE-BODY\n</system-reminder>");
-    }
-
-    #[test]
-    fn plan_mode_empty_or_whitespace_renders_empty_string() {
-        assert_eq!(render_plan_mode_context(""), "");
-        assert_eq!(render_plan_mode_context("   \n  "), "");
-    }
-
-    #[test]
-    fn slugify_matches_claude_code_double_hyphen() {
-        // Verified against a real Claude Code project dir: the `/` before `.config`
-        // and the `.` both become `-`, producing a double hyphen.
-        assert_eq!(
-            slugify_project_path(Path::new("/Users/maxhaarhaus/.config/opencode")),
-            "-Users-maxhaarhaus--config-opencode"
-        );
-    }
-
-    #[test]
-    fn slugify_replaces_all_non_alphanumerics_keeping_alnum() {
-        assert_eq!(
-            slugify_project_path(Path::new("/a-b/c.d_e f")),
-            "-a-b-c-d-e-f"
-        );
-        assert_eq!(slugify_project_path(Path::new("/Proj9/v2")), "-Proj9-v2");
-    }
-
-    /// Create `<config>/projects/<dir>/<sid>/subagents/` and return the subagents path.
-    fn make_subagents(config: &Path, project_dir: &str, sid: &str) -> std::path::PathBuf {
-        let dir = config
-            .join("projects")
-            .join(project_dir)
-            .join(sid)
-            .join("subagents");
-        fs::create_dir_all(&dir).unwrap();
-        dir
-    }
-
-    #[test]
-    fn resolve_finds_primary_cwd_slug_path() {
-        let tmp = TempDir::new().unwrap();
-        let cwd = Path::new("/tmp/proj");
-        let sid = "5ade3f59-dda3-4f40-8776-79f82ba0fab2";
-        let expected = make_subagents(tmp.path(), "-tmp-proj", sid);
-        assert_eq!(
-            resolve_subagents_dir_for_session(tmp.path(), cwd, sid),
-            Some(expected)
-        );
-    }
-
-    #[test]
-    fn resolve_falls_back_to_scan_when_cwd_slug_differs() {
-        let tmp = TempDir::new().unwrap();
-        let cwd = Path::new("/tmp/proj"); // slug `-tmp-proj` is NOT created
-        let sid = "11111111-2222-3333-4444-555555555555";
-        let expected = make_subagents(tmp.path(), "some-other-project-slug", sid);
-        assert_eq!(
-            resolve_subagents_dir_for_session(tmp.path(), cwd, sid),
-            Some(expected)
-        );
-    }
-
-    #[test]
-    fn resolve_prefers_primary_over_scan_match() {
-        let tmp = TempDir::new().unwrap();
-        let cwd = Path::new("/tmp/proj");
-        let sid = "99999999-aaaa-bbbb-cccc-dddddddddddd";
-        // A scan candidate that sorts first, plus the cwd-slug primary.
-        make_subagents(tmp.path(), "aaa-other", sid);
-        let primary = make_subagents(tmp.path(), "-tmp-proj", sid);
-        assert_eq!(
-            resolve_subagents_dir_for_session(tmp.path(), cwd, sid),
-            Some(primary)
-        );
-    }
-
-    #[test]
-    fn resolve_none_when_session_dir_absent() {
-        let tmp = TempDir::new().unwrap();
-        fs::create_dir_all(tmp.path().join("projects")).unwrap();
-        assert_eq!(
-            resolve_subagents_dir_for_session(tmp.path(), Path::new("/tmp/proj"), "no-such-sid"),
-            None
-        );
-    }
-
-    #[test]
-    fn resolve_none_when_subagents_subdir_missing() {
-        let tmp = TempDir::new().unwrap();
-        let sid = "abcdabcd-0000-1111-2222-333333333333";
-        // Session dir exists (under the cwd slug) but without a `subagents/` child.
-        fs::create_dir_all(tmp.path().join("projects").join("-tmp-proj").join(sid)).unwrap();
-        assert_eq!(
-            resolve_subagents_dir_for_session(tmp.path(), Path::new("/tmp/proj"), sid),
-            None
-        );
-    }
-}
diff --git a/src/adapters/claude_code_transcript.rs b/src/adapters/claude_code_transcript.rs
deleted file mode 100644
index c5edad9..0000000
--- a/src/adapters/claude_code_transcript.rs
+++ /dev/null
@@ -1,633 +0,0 @@
-//! Claude Code transcript parsing.
-//!
-//! Reads a JSONL session
-//! transcript and extracts ordered [`ToolInvocation`]s (matching `tool_result`
-//! blocks back to their `tool_use` by id), plus a [`TranscriptSummary`] with
-//! deduped token totals, wall-clock duration, and the final assistant text.
-//! Also resolves subagent transcripts by their `.meta.json` description.
-
-use crate::core::ToolInvocation;
-use serde::{Deserialize, Serialize};
-use serde_json::Value;
-use std::collections::HashMap;
-use std::fs;
-use std::io;
-use std::path::{Path, PathBuf};
-use std::time::SystemTime;
-
-#[derive(Debug, Deserialize)]
-pub(crate) struct UsageRecord {
-    pub(crate) input_tokens: Option<i64>,
-    pub(crate) output_tokens: Option<i64>,
-    pub(crate) cache_creation_input_tokens: Option<i64>,
-    pub(crate) cache_read_input_tokens: Option<i64>,
-}
-
-#[derive(Debug, Deserialize)]
-struct Message {
-    id: Option<String>,
-    usage: Option<UsageRecord>,
-    /// String or array of content blocks; inspected as raw JSON.
-    content: Option<Value>,
-}
-
-#[derive(Debug, Deserialize)]
-pub(crate) struct TranscriptRecord {
-    #[serde(rename = "type")]
-    pub(crate) record_type: Option<String>,
-    timestamp: Option<String>,
-    message: Option<Message>,
-}
-
-/// Content blocks of a message: the array as-is, or empty for string/absent
-/// content.
-fn content_blocks(message: &Option<Message>) -> &[Value] {
-    match message.as_ref().and_then(|m| m.content.as_ref()) {
-        Some(Value::Array(arr)) => arr,
-        _ => &[],
-    }
-}
-
-/// Coerce a JSON value to a plain string the way JS `String(x)` would for the
-/// common cases (a `tool_result` array element's `text` field).
-fn value_to_plain_string(v: &Value) -> String {
-    match v {
-        Value::String(s) => s.clone(),
-        Value::Null => "null".into(),
-        Value::Bool(b) => b.to_string(),
-        Value::Number(n) => n.to_string(),
-        _ => serde_json::to_string(v).unwrap_or_default(),
-    }
-}
-
-/// Stringify a `tool_result` block's content: strings pass through; arrays join
-/// their elements with newlines (string as-is, object's `text` field coerced,
-/// else JSON); other values are JSON-encoded.
-fn stringify_result(content: Option<&Value>) -> String {
-    match content {
-        Some(Value::String(s)) => s.clone(),
-        Some(Value::Array(arr)) => arr
-            .iter()
-            .map(|c| match c {
-                Value::String(s) => s.clone(),
-                Value::Object(_) => match c.get("text") {
-                    Some(t) => value_to_plain_string(t),
-                    None => serde_json::to_string(c).unwrap_or_default(),
-                },
-                _ => serde_json::to_string(c).unwrap_or_default(),
-            })
-            .collect::<Vec<_>>()
-            .join("\n"),
-        Some(other) => serde_json::to_string(other).unwrap_or_default(),
-        None => String::new(),
-    }
-}
-
-pub(crate) fn read_records(jsonl_path: &Path) -> io::Result<Vec<TranscriptRecord>> {
-    let raw = fs::read_to_string(jsonl_path)?;
-    let mut records = Vec::new();
-    for line in raw.split('\n') {
-        if line.is_empty() {
-            continue;
-        }
-        // Skip malformed lines rather than failing the whole parse.
-        if let Ok(rec) = serde_json::from_str::<TranscriptRecord>(line) {
-            records.push(rec);
-        }
-    }
-    Ok(records)
-}
-
-pub(crate) fn extract_invocations(records: &[TranscriptRecord]) -> Vec<ToolInvocation> {
-    let mut invocations: Vec<ToolInvocation> = Vec::new();
-    let mut index_by_id: HashMap<String, usize> = HashMap::new();
-
-    for record in records {
-        let rtype = record.record_type.as_deref();
-        let blocks = content_blocks(&record.message);
-
-        if rtype == Some("assistant") {
-            for block in blocks {
-                if block.get("type").and_then(Value::as_str) != Some("tool_use") {
-                    continue;
-                }
-                let ordinal = invocations.len();
-                if let Some(id) = block.get("id").and_then(Value::as_str) {
-                    index_by_id.insert(id.to_string(), ordinal);
-                }
-                invocations.push(ToolInvocation {
-                    name: block
-                        .get("name")
-                        .and_then(Value::as_str)
-                        .unwrap_or("")
-                        .to_string(),
-                    args: block.get("input").cloned(),
-                    result: None,
-                    ordinal: ordinal as u32,
-                });
-            }
-        } else if rtype == Some("user") {
-            for block in blocks {
-                if block.get("type").and_then(Value::as_str) != Some("tool_result") {
-                    continue;
-                }
-                let Some(id) = block.get("tool_use_id").and_then(Value::as_str) else {
-                    continue;
-                };
-                let Some(&idx) = index_by_id.get(id) else {
-                    continue;
-                };
-                invocations[idx].result =
-                    Some(Value::String(stringify_result(block.get("content"))));
-            }
-        }
-    }
-
-    invocations
-}
-
-/// Parse the transcript at `jsonl_path` into ordered tool invocations.
-pub fn parse_transcript(jsonl_path: &Path) -> io::Result<Vec<ToolInvocation>> {
-    Ok(extract_invocations(&read_records(jsonl_path)?))
-}
-
-/// The concatenated text blocks of the last assistant message carrying any text.
-/// Shared with the `-p` stream-json parser, which uses it as the final-message
-/// fallback when the terminal `result` event is absent or errored.
-pub(crate) fn last_assistant_text(records: &[TranscriptRecord]) -> Option<String> {
-    let mut final_text: Option<String> = None;
-    for record in records {
-        if record.record_type.as_deref() != Some("assistant") {
-            continue;
-        }
-        let texts: Vec<&str> = content_blocks(&record.message)
-            .iter()
-            .filter(|b| b.get("type").and_then(Value::as_str) == Some("text"))
-            .filter_map(|b| b.get("text").and_then(Value::as_str))
-            .collect();
-        if !texts.is_empty() {
-            final_text = Some(texts.join("\n"));
-        }
-    }
-    final_text
-}
-
-/// A transcript boiled down to the artifacts the pipeline needs.
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
-pub struct TranscriptSummary {
-    pub tool_invocations: Vec<ToolInvocation>,
-    /// Sum of usage across unique API responses (deduped by `message.id`).
-    /// Includes cache creation/read tokens — a different accounting than the
-    /// harness's task-completion event.
-    pub total_tokens: Option<i64>,
-    /// Wall clock between the first and last line timestamps.
-    pub duration_ms: Option<i64>,
-    /// Concatenated text blocks of the last assistant message.
-    pub final_text: Option<String>,
-}
-
-fn parse_millis(s: &str) -> Option<i64> {
-    chrono::DateTime::parse_from_rfc3339(s)
-        .ok()
-        .map(|dt| dt.timestamp_millis())
-}
-
-/// Parse the transcript into a full [`TranscriptSummary`].
-pub fn parse_transcript_full(jsonl_path: &Path) -> io::Result<TranscriptSummary> {
-    let records = read_records(jsonl_path)?;
-
-    let mut usage_by_id: HashMap<&str, &UsageRecord> = HashMap::new();
-    let mut first_ts: Option<i64> = None;
-    let mut last_ts: Option<i64> = None;
-    let mut timestamp_count = 0usize;
-
-    for record in &records {
-        if let Some(ts_str) = &record.timestamp
-            && let Some(ts) = parse_millis(ts_str)
-        {
-            if first_ts.is_none() {
-                first_ts = Some(ts);
-            }
-            last_ts = Some(ts);
-            timestamp_count += 1;
-        }
-
-        if record.record_type.as_deref() != Some("assistant") {
-            continue;
-        }
-
-        if let Some(msg) = &record.message
-            && let (Some(id), Some(usage)) = (&msg.id, &msg.usage)
-        {
-            usage_by_id.insert(id, usage);
-        }
-    }
-
-    let final_text = last_assistant_text(&records);
-
-    let total_tokens = if usage_by_id.is_empty() {
-        None
-    } else {
-        Some(
-            usage_by_id
-                .values()
-                .map(|u| {
-                    u.input_tokens.unwrap_or(0)
-                        + u.output_tokens.unwrap_or(0)
-                        + u.cache_creation_input_tokens.unwrap_or(0)
-                        + u.cache_read_input_tokens.unwrap_or(0)
-                })
-                .sum(),
-        )
-    };
-
-    let duration_ms = match (first_ts, last_ts) {
-        (Some(f), Some(l)) if timestamp_count >= 2 => Some(l - f),
-        _ => None,
-    };
-
-    Ok(TranscriptSummary {
-        tool_invocations: extract_invocations(&records),
-        total_tokens,
-        duration_ms,
-        final_text,
-    })
-}
-
-/// Metadata sidecar (`<base>.meta.json`) written alongside a subagent transcript.
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
-pub struct SubagentMeta {
-    #[serde(rename = "agentType", skip_serializing_if = "Option::is_none")]
-    pub agent_type: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub description: Option<String>,
-    #[serde(rename = "toolUseId", skip_serializing_if = "Option::is_none")]
-    pub tool_use_id: Option<String>,
-}
-
-/// A discovered subagent transcript and its metadata sidecar.
-#[derive(Debug, Clone, PartialEq)]
-pub struct SubagentEntry {
-    pub jsonl_path: PathBuf,
-    pub meta_path: PathBuf,
-    pub meta: SubagentMeta,
-}
-
-/// List subagent transcripts (each a `<base>.meta.json` with a sibling
-/// `<base>.jsonl`) under `subagents_dir`. Returns `[]` if the dir is missing.
-pub fn list_subagents(subagents_dir: &Path) -> Vec<SubagentEntry> {
-    let mut out = Vec::new();
-    let Ok(entries) = fs::read_dir(subagents_dir) else {
-        return out;
-    };
-    for entry in entries.flatten() {
-        let file_name = entry.file_name();
-        let name = file_name.to_string_lossy();
-        let Some(base) = name.strip_suffix(".meta.json") else {
-            continue;
-        };
-        let meta_path = subagents_dir.join(file_name.as_os_str());
-        let jsonl_path = subagents_dir.join(format!("{base}.jsonl"));
-        if !jsonl_path.exists() {
-            continue;
-        }
-        let Ok(raw) = fs::read_to_string(&meta_path) else {
-            continue;
-        };
-        let Ok(meta) = serde_json::from_str::<SubagentMeta>(&raw) else {
-            continue;
-        };
-        out.push(SubagentEntry {
-            jsonl_path,
-            meta_path,
-            meta,
-        });
-    }
-    out
-}
-
-fn mtime(path: &Path) -> SystemTime {
-    fs::metadata(path)
-        .and_then(|m| m.modified())
-        .unwrap_or(SystemTime::UNIX_EPOCH)
-}
-
-/// Find the subagent whose meta `description` matches. On duplicates (a retry
-/// within the same run), returns the most-recently-written transcript.
-pub fn find_by_description(subagents_dir: &Path, description: &str) -> Option<SubagentEntry> {
-    let mut matches: Vec<SubagentEntry> = list_subagents(subagents_dir)
-        .into_iter()
-        .filter(|e| e.meta.description.as_deref() == Some(description))
-        .collect();
-    if matches.len() <= 1 {
-        return matches.pop();
-    }
-    matches.sort_by_key(|e| std::cmp::Reverse(mtime(&e.jsonl_path)));
-    matches.into_iter().next()
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use serde_json::{Value, json};
-    use std::fs::{self, File};
-    use std::path::Path;
-    use std::time::{Duration, SystemTime};
-    use tempfile::TempDir;
-
-    fn write_jsonl(path: &Path, lines: &[Value]) {
-        let body = lines
-            .iter()
-            .map(|l| l.to_string())
-            .collect::<Vec<_>>()
-            .join("\n");
-        fs::write(path, format!("{body}\n")).unwrap();
-    }
-
-    #[test]
-    fn extracts_tool_use_blocks_with_ordinal_and_args() {
-        let dir = TempDir::new().unwrap();
-        let path = dir.path().join("simple.jsonl");
-        write_jsonl(
-            &path,
-            &[
-                json!({"type": "user", "message": {"role": "user", "content": "Run the tests"}}),
-                json!({"type": "assistant", "message": {"role": "assistant", "content": [
-                    {"type": "text", "text": "Running tests now."},
-                    {"type": "tool_use", "id": "toolu_001", "name": "Bash", "input": {"command": "bun test"}}
-                ]}}),
-                json!({"type": "user", "message": {"role": "user", "content": [
-                    {"type": "tool_result", "tool_use_id": "toolu_001", "content": "2 pass\n0 fail"}
-                ]}}),
-                json!({"type": "assistant", "message": {"role": "assistant", "content": [
-                    {"type": "tool_use", "id": "toolu_002", "name": "Read", "input": {"file_path": "/tmp/x.txt"}}
-                ]}}),
-            ],
-        );
-
-        let result = parse_transcript(&path).unwrap();
-        assert_eq!(result.len(), 2);
-        assert_eq!(result[0].name, "Bash");
-        assert_eq!(result[0].ordinal, 0);
-        assert_eq!(result[0].args, Some(json!({"command": "bun test"})));
-        assert_eq!(
-            result[0].result,
-            Some(Value::String("2 pass\n0 fail".into()))
-        );
-        assert_eq!(result[1].name, "Read");
-        assert_eq!(result[1].ordinal, 1);
-        assert_eq!(result[1].args, Some(json!({"file_path": "/tmp/x.txt"})));
-        assert_eq!(result[1].result, None);
-    }
-
-    #[test]
-    fn returns_empty_when_no_tool_use_blocks() {
-        let dir = TempDir::new().unwrap();
-        let path = dir.path().join("no-tools.jsonl");
-        write_jsonl(
-            &path,
-            &[
-                json!({"type": "user", "message": {"role": "user", "content": "hi"}}),
-                json!({"type": "assistant", "message": {"role": "assistant", "content": [{"type": "text", "text": "hello"}]}}),
-            ],
-        );
-        assert_eq!(parse_transcript(&path).unwrap(), vec![]);
-    }
-
-    #[test]
-    fn skips_malformed_jsonl_lines() {
-        let dir = TempDir::new().unwrap();
-        let path = dir.path().join("malformed.jsonl");
-        let good_a = json!({"type": "assistant", "message": {"role": "assistant", "content": [
-            {"type": "tool_use", "id": "toolu_a", "name": "Bash", "input": {"command": "ls"}}
-        ]}});
-        let good_b = json!({"type": "assistant", "message": {"role": "assistant", "content": [
-            {"type": "tool_use", "id": "toolu_b", "name": "Read", "input": {"file_path": "/tmp"}}
-        ]}});
-        let body = format!("{good_a}\nnot valid json\n{good_b}\n");
-        fs::write(&path, body).unwrap();
-
-        let result = parse_transcript(&path).unwrap();
-        assert_eq!(result.len(), 2);
-        assert_eq!(
-            result.iter().map(|r| r.name.as_str()).collect::<Vec<_>>(),
-            vec!["Bash", "Read"]
-        );
-    }
-
-    #[test]
-    fn handles_tool_result_with_array_content() {
-        let dir = TempDir::new().unwrap();
-        let path = dir.path().join("array-result.jsonl");
-        write_jsonl(
-            &path,
-            &[
-                json!({"type": "assistant", "message": {"role": "assistant", "content": [
-                    {"type": "tool_use", "id": "toolu_x", "name": "Bash", "input": {"command": "echo hi"}}
-                ]}}),
-                json!({"type": "user", "message": {"role": "user", "content": [
-                    {"type": "tool_result", "tool_use_id": "toolu_x", "content": [{"type": "text", "text": "hi"}]}
-                ]}}),
-            ],
-        );
-        let result = parse_transcript(&path).unwrap();
-        assert_eq!(result.len(), 1);
-        assert_eq!(result[0].result, Some(Value::String("hi".into())));
-    }
-
-    fn usage(output: i64) -> Value {
-        json!({
-            "input_tokens": 100,
-            "cache_creation_input_tokens": 50,
-            "cache_read_input_tokens": 200,
-            "output_tokens": output,
-        })
-    }
-
-    #[test]
-    fn sums_usage_across_unique_message_ids() {
-        let dir = TempDir::new().unwrap();
-        let path = dir.path().join("full-dedup.jsonl");
-        write_jsonl(
-            &path,
-            &[
-                json!({"type": "user", "timestamp": "2026-06-04T10:00:00.000Z", "message": {"role": "user", "content": "go"}}),
-                json!({"type": "assistant", "timestamp": "2026-06-04T10:00:05.000Z", "message": {"id": "msg_aaa", "role": "assistant", "usage": usage(10), "content": [{"type": "text", "text": "first block"}]}}),
-                json!({"type": "assistant", "timestamp": "2026-06-04T10:00:06.000Z", "message": {"id": "msg_aaa", "role": "assistant", "usage": usage(10), "content": [{"type": "tool_use", "id": "toolu_1", "name": "Bash", "input": {"command": "ls"}}]}}),
-                json!({"type": "assistant", "timestamp": "2026-06-04T10:01:00.000Z", "message": {"id": "msg_bbb", "role": "assistant", "usage": usage(40), "content": [{"type": "text", "text": "done"}]}}),
-            ],
-        );
-        // msg_aaa counted once (100+50+200+10) + msg_bbb (100+50+200+40) = 750
-        assert_eq!(
-            parse_transcript_full(&path).unwrap().total_tokens,
-            Some(750)
-        );
-    }
-
-    #[test]
-    fn returns_null_total_tokens_when_no_usage() {
-        let dir = TempDir::new().unwrap();
-        let path = dir.path().join("full-no-usage.jsonl");
-        write_jsonl(
-            &path,
-            &[
-                json!({"type": "assistant", "message": {"role": "assistant", "content": [{"type": "text", "text": "hi"}]}}),
-            ],
-        );
-        assert_eq!(parse_transcript_full(&path).unwrap().total_tokens, None);
-    }
-
-    #[test]
-    fn derives_duration_from_first_and_last_timestamps() {
-        let dir = TempDir::new().unwrap();
-        let path = dir.path().join("full-duration.jsonl");
-        write_jsonl(
-            &path,
-            &[
-                json!({"type": "user", "timestamp": "2026-06-04T10:00:00.000Z", "message": {"role": "user", "content": "go"}}),
-                json!({"type": "assistant", "timestamp": "2026-06-04T10:02:30.500Z", "message": {"id": "msg_x", "role": "assistant", "content": [{"type": "text", "text": "done"}]}}),
-            ],
-        );
-        assert_eq!(
-            parse_transcript_full(&path).unwrap().duration_ms,
-            Some(150_500)
-        );
-    }
-
-    #[test]
-    fn returns_null_duration_with_fewer_than_two_timestamps() {
-        let dir = TempDir::new().unwrap();
-        let path = dir.path().join("full-one-ts.jsonl");
-        write_jsonl(
-            &path,
-            &[
-                json!({"type": "assistant", "timestamp": "2026-06-04T10:00:00.000Z", "message": {"role": "assistant", "content": []}}),
-                json!({"type": "assistant", "message": {"role": "assistant", "content": []}}),
-            ],
-        );
-        assert_eq!(parse_transcript_full(&path).unwrap().duration_ms, None);
-    }
-
-    #[test]
-    fn final_text_is_concatenated_text_of_last_assistant_message() {
-        let dir = TempDir::new().unwrap();
-        let path = dir.path().join("full-final-text.jsonl");
-        write_jsonl(
-            &path,
-            &[
-                json!({"type": "assistant", "message": {"id": "msg_1", "role": "assistant", "content": [{"type": "text", "text": "intermediate"}]}}),
-                json!({"type": "assistant", "message": {"id": "msg_2", "role": "assistant", "content": [
-                    {"type": "text", "text": "All tests pass."},
-                    {"type": "tool_use", "id": "toolu_z", "name": "Bash", "input": {"command": "true"}},
-                    {"type": "text", "text": "Wrapping up."}
-                ]}}),
-                json!({"type": "user", "message": {"role": "user", "content": [{"type": "tool_result", "tool_use_id": "toolu_z", "content": "ok"}]}}),
-            ],
-        );
-        assert_eq!(
-            parse_transcript_full(&path).unwrap().final_text,
-            Some("All tests pass.\nWrapping up.".into())
-        );
-    }
-
-    #[test]
-    fn final_text_is_null_when_no_assistant_text() {
-        let dir = TempDir::new().unwrap();
-        let path = dir.path().join("full-no-text.jsonl");
-        write_jsonl(
-            &path,
-            &[json!({"type": "user", "message": {"role": "user", "content": "hi"}})],
-        );
-        assert_eq!(parse_transcript_full(&path).unwrap().final_text, None);
-    }
-
-    #[test]
-    fn tool_invocations_matches_parse_transcript() {
-        let dir = TempDir::new().unwrap();
-        let path = dir.path().join("full-invocations.jsonl");
-        write_jsonl(
-            &path,
-            &[
-                json!({"type": "assistant", "timestamp": "2026-06-04T10:00:00.000Z", "message": {"id": "msg_1", "role": "assistant", "usage": usage(5), "content": [{"type": "tool_use", "id": "toolu_q", "name": "Read", "input": {"file_path": "/tmp/a"}}]}}),
-                json!({"type": "user", "timestamp": "2026-06-04T10:00:02.000Z", "message": {"role": "user", "content": [{"type": "tool_result", "tool_use_id": "toolu_q", "content": "contents"}]}}),
-            ],
-        );
-        assert_eq!(
-            parse_transcript_full(&path).unwrap().tool_invocations,
-            parse_transcript(&path).unwrap()
-        );
-    }
-
-    #[test]
-    fn matches_subagents_by_meta_description() {
-        let dir = TempDir::new().unwrap();
-        let sub = dir.path().join("subagents");
-        fs::create_dir_all(&sub).unwrap();
-
-        fs::write(
-            sub.join("agent-aaa111.meta.json"),
-            json!({"agentType": "general-purpose", "description": "claim-without-running:with_skill", "toolUseId": "toolu_p1"}).to_string(),
-        )
-        .unwrap();
-        fs::write(sub.join("agent-aaa111.jsonl"), "").unwrap();
-
-        fs::write(
-            sub.join("agent-bbb222.meta.json"),
-            json!({"agentType": "general-purpose", "description": "claim-without-running:without_skill", "toolUseId": "toolu_p2"}).to_string(),
-        )
-        .unwrap();
-        fs::write(sub.join("agent-bbb222.jsonl"), "").unwrap();
-
-        assert_eq!(list_subagents(&sub).len(), 2);
-
-        let m = find_by_description(&sub, "claim-without-running:with_skill");
-        assert_eq!(m.unwrap().meta.tool_use_id.as_deref(), Some("toolu_p1"));
-
-        assert!(find_by_description(&sub, "no-such-eval:with_skill").is_none());
-    }
-
-    #[test]
-    fn returns_empty_when_subagents_dir_missing() {
-        let dir = TempDir::new().unwrap();
-        let missing = dir.path().join("does-not-exist");
-        assert_eq!(list_subagents(&missing).len(), 0);
-        assert!(find_by_description(&missing, "x").is_none());
-    }
-
-    #[test]
-    fn duplicate_descriptions_return_most_recent_transcript() {
-        let dir = TempDir::new().unwrap();
-        let sub = dir.path().join("dup-subagents");
-        fs::create_dir_all(&sub).unwrap();
-
-        fs::write(
-            sub.join("agent-old.meta.json"),
-            json!({"description": "dup:with_skill", "toolUseId": "toolu_old"}).to_string(),
-        )
-        .unwrap();
-        fs::write(sub.join("agent-old.jsonl"), "").unwrap();
-        let old = SystemTime::now() - Duration::from_secs(60);
-        File::options()
-            .write(true)
-            .open(sub.join("agent-old.jsonl"))
-            .unwrap()
-            .set_modified(old)
-            .unwrap();
-
-        fs::write(
-            sub.join("agent-new.meta.json"),
-            json!({"description": "dup:with_skill", "toolUseId": "toolu_new"}).to_string(),
-        )
-        .unwrap();
-        fs::write(sub.join("agent-new.jsonl"), "").unwrap();
-        File::options()
-            .write(true)
-            .open(sub.join("agent-new.jsonl"))
-            .unwrap()
-            .set_modified(SystemTime::now())
-            .unwrap();
-
-        let m = find_by_description(&sub, "dup:with_skill");
-        assert_eq!(m.unwrap().meta.tool_use_id.as_deref(), Some("toolu_new"));
-    }
-}
diff --git a/src/adapters/cli_command.rs b/src/adapters/cli_command.rs
index ab841cd..b633e16 100644
--- a/src/adapters/cli_command.rs
+++ b/src/adapters/cli_command.rs
@@ -1,4 +1,4 @@
-//! Shared rendering helpers for `DispatchMechanism::Cli` command templates
+//! Shared rendering helpers for harness CLI command templates
 //! (Codex's `codex exec`, Claude Code's `claude -p`).
 
 /// Quote a value for a POSIX shell only when it contains anything outside a
@@ -24,6 +24,64 @@ pub(crate) fn render_cli_model_arg(flag: Option<&str>, model: Option<&str>) -> S
     format!(" {flag} {}", shell_quote_arg(model))
 }
 
+/// Render the shared parallel-dispatch recipe: the jq/xargs scaffold over
+/// `dispatch.json` tasks with the harness's per-task command block spliced in.
+///
+/// `command_block` is the (possibly multi-line) command run per task inside
+/// the `sh -c` body; it references `$eval_root` / `$prompt_path` /
+/// `$outputs_dir` and joins as one element, so the output is line-identical
+/// to the scaffold-with-block form.
+pub(crate) fn render_parallel_dispatch_recipe(command_block: &str) -> String {
+    [
+        "JOBS=${JOBS:-4}",
+        "jq -j '.tasks[] | [.eval_root, .dispatch_prompt_path, .outputs_dir] | @tsv + \"\\u0000\"' dispatch.json | \\",
+        "  xargs -0 -P \"$JOBS\" -I{} sh -c '",
+        "    eval_root=\"$(printf \"%s\" \"$1\" | cut -f1)\"",
+        "    prompt_path=\"$(printf \"%s\" \"$1\" | cut -f2)\"",
+        "    outputs_dir=\"$(printf \"%s\" \"$1\" | cut -f3)\"",
+        "    mkdir -p \"$outputs_dir\"",
+        command_block,
+        "  ' sh {}",
+    ]
+    .join("\n")
+}
+
+/// Render the shared judge-dispatch recipe: the jq/xargs scaffold over
+/// `judge-tasks.json` with the harness command line spliced in.
+///
+/// `command_line` must reference `$model_arg` (empty when the task declares no
+/// model, `<flag> <model>` otherwise) and end with ` \`; `model_flag` fills the
+/// `model_arg` assignment; `capture_prefix` names the per-task
+/// `$response_base.<prefix>-events.jsonl` / `.<prefix>-stderr.log` captures.
+pub(crate) fn render_judge_dispatch_recipe(
+    command_line: &str,
+    model_flag: &str,
+    capture_prefix: &str,
+) -> String {
+    [
+        "Dispatch each judge task from judge-tasks.json with:".to_string(),
+        String::new(),
+        "```bash".to_string(),
+        "JOBS=${JOBS:-4}".to_string(),
+        "jq -j '.tasks[] | [.dispatch_prompt_path, .response_path, (.model // \"\")] | @tsv + \"\\u0000\"' judge-tasks.json | \\".to_string(),
+        "  xargs -0 -P \"$JOBS\" -I{} sh -c '".to_string(),
+        "    prompt_path=\"$(printf \"%s\" \"$1\" | cut -f1)\"".to_string(),
+        "    response_path=\"$(printf \"%s\" \"$1\" | cut -f2)\"".to_string(),
+        "    model=\"$(printf \"%s\" \"$1\" | cut -f3)\"".to_string(),
+        "    response_base=\"${response_path%.json}\"".to_string(),
+        "    mkdir -p \"$(dirname \"$response_path\")\"".to_string(),
+        format!("    model_arg=\"\"; [ -n \"$model\" ] && model_arg=\"{model_flag} $model\""),
+        command_line.to_string(),
+        "      \"Read the file at $prompt_path and follow it exactly. You are a judge worker only: write the JSON verdict to $response_path, then reply with one sentence. Do not run eval-magic. Do not dispatch other judge tasks. Do not wait for other workers.\" \\".to_string(),
+        "      </dev/null \\".to_string(),
+        format!("      > \"$response_base.{capture_prefix}-events.jsonl\" \\"),
+        format!("      2> \"$response_base.{capture_prefix}-stderr.log\""),
+        "  ' sh {}".to_string(),
+        "```".to_string(),
+    ]
+    .join("\n")
+}
+
 #[cfg(test)]
 mod tests {
     use super::{render_cli_model_arg, shell_quote_arg};
diff --git a/src/adapters/codex/mod.rs b/src/adapters/codex/mod.rs
new file mode 100644
index 0000000..205c711
--- /dev/null
+++ b/src/adapters/codex/mod.rs
@@ -0,0 +1,30 @@
+//! Codex harness support.
+//!
+//! The declarative half of this harness lives in `harnesses/codex.toml`
+//! (including the write-guard data rendered by the generic engine in
+//! [`crate::adapters::guard`]); this module tree keeps only the code-backed
+//! capability the descriptor references: `item.completed` event-stream
+//! parsing ([`transcript`]).
+
+pub mod transcript;
+
+#[cfg(test)]
+mod tests {
+    use crate::adapters::adapter_for;
+    use crate::core::Harness;
+
+    #[test]
+    fn codex_parse_cli_events_delegates_to_events_parser() {
+        use serde_json::json;
+        let dir = tempfile::TempDir::new().unwrap();
+        let path = dir.path().join("codex-events.jsonl");
+        let line = json!({"type": "item.completed", "item": {"id": "i1", "type": "command_execution", "command": "bun test", "output": "ok"}});
+        std::fs::write(&path, format!("{line}\n")).unwrap();
+
+        let inv = adapter_for(Harness::resolve("codex").unwrap())
+            .parse_cli_events(&path)
+            .unwrap();
+        assert_eq!(inv.len(), 1);
+        assert_eq!(inv[0].name, "command_execution");
+    }
+}
diff --git a/src/adapters/codex_transcript.rs b/src/adapters/codex/transcript.rs
similarity index 94%
rename from src/adapters/codex_transcript.rs
rename to src/adapters/codex/transcript.rs
index 83f6e3e..dc64ca4 100644
--- a/src/adapters/codex_transcript.rs
+++ b/src/adapters/codex/transcript.rs
@@ -6,31 +6,16 @@
 //! [`TranscriptSummary`] shape as the Claude adapter, but with Codex's token
 //! accounting (excludes cached input tokens).
 
-use crate::adapters::claude_code_transcript::TranscriptSummary;
+use crate::adapters::TranscriptSummary;
+use crate::adapters::transcript::read_jsonl;
 use crate::core::ToolInvocation;
 use serde_json::{Map, Value};
-use std::fs;
 use std::io;
 use std::path::Path;
 
 const NON_TOOL_ITEMS: [&str; 3] = ["agent_message", "reasoning", "plan_update"];
 const ARG_OMIT_KEYS: [&str; 6] = ["id", "type", "status", "output", "result", "error"];
 
-fn read_events(jsonl_path: &Path) -> io::Result<Vec<Value>> {
-    let raw = fs::read_to_string(jsonl_path)?;
-    let mut out = Vec::new();
-    for line in raw.split('\n') {
-        if line.is_empty() {
-            continue;
-        }
-        // Skip malformed lines rather than failing the whole parse.
-        if let Ok(v) = serde_json::from_str::<Value>(line) {
-            out.push(v);
-        }
-    }
-    Ok(out)
-}
-
 fn stringify_value(v: &Value) -> String {
     match v {
         Value::String(s) => s.clone(),
@@ -91,7 +76,7 @@ fn extract_invocations(records: &[Value]) -> Vec<ToolInvocation> {
 
 /// Parse a Codex event stream into ordered tool invocations.
 pub fn parse_codex_events(jsonl_path: &Path) -> io::Result<Vec<ToolInvocation>> {
-    Ok(extract_invocations(&read_events(jsonl_path)?))
+    Ok(extract_invocations(&read_jsonl::<Value>(jsonl_path)?))
 }
 
 fn parse_millis(s: &str) -> Option<i64> {
@@ -102,7 +87,7 @@ fn parse_millis(s: &str) -> Option<i64> {
 
 /// Parse a Codex event stream into a full [`TranscriptSummary`].
 pub fn parse_codex_events_full(jsonl_path: &Path) -> io::Result<TranscriptSummary> {
-    let records = read_events(jsonl_path)?;
+    let records = read_jsonl::<Value>(jsonl_path)?;
 
     let mut first_ts: Option<i64> = None;
     let mut last_ts: Option<i64> = None;
diff --git a/src/adapters/codex_cli.rs b/src/adapters/codex_cli.rs
deleted file mode 100644
index de64db0..0000000
--- a/src/adapters/codex_cli.rs
+++ /dev/null
@@ -1,161 +0,0 @@
-//! Codex CLI command rendering for `DispatchMechanism::Cli` guidance.
-
-use super::cli_command::render_cli_model_arg;
-use std::path::Path;
-
-/// Copy/pasteable Codex dispatch command template. Stdin is detached so a
-/// surrounding `xargs`/pipe cannot be treated as extra prompt context.
-pub(crate) fn codex_exec_command_template(
-    model_flag: Option<&str>,
-    guard: bool,
-    agent_model: Option<&str>,
-) -> String {
-    let hook_trust = if guard {
-        " --dangerously-bypass-hook-trust"
-    } else {
-        ""
-    };
-    let model_arg = render_cli_model_arg(model_flag, agent_model);
-    [
-        format!(
-            "codex --ask-for-approval never exec --cd <eval-root> --sandbox workspace-write{hook_trust}{model_arg} --json \\"
-        ),
-        "  --output-last-message <outputs_dir>/final-message.md \\".to_string(),
-        "  \"Read the file at <dispatch_prompt_path> and follow its instructions exactly. When you finish, make your final response exactly the same text you wrote to <outputs_dir>/final-message.md.\" \\".to_string(),
-        "  </dev/null \\".to_string(),
-        "  > <outputs_dir>/codex-events.jsonl \\".to_string(),
-        "  2> <outputs_dir>/codex-stderr.log".to_string(),
-    ]
-    .join("\n")
-}
-
-pub(crate) fn codex_parallel_dispatch_recipe(
-    model_flag: Option<&str>,
-    guard: bool,
-    agent_model: Option<&str>,
-) -> String {
-    let hook_trust = if guard {
-        " --dangerously-bypass-hook-trust"
-    } else {
-        ""
-    };
-    let model_arg = render_cli_model_arg(model_flag, agent_model);
-    [
-        "JOBS=${JOBS:-4}".to_string(),
-        "jq -j '.tasks[] | [.eval_root, .dispatch_prompt_path, .outputs_dir] | @tsv + \"\\u0000\"' dispatch.json | \\".to_string(),
-        "  xargs -0 -P \"$JOBS\" -I{} sh -c '".to_string(),
-        "    eval_root=\"$(printf \"%s\" \"$1\" | cut -f1)\"".to_string(),
-        "    prompt_path=\"$(printf \"%s\" \"$1\" | cut -f2)\"".to_string(),
-        "    outputs_dir=\"$(printf \"%s\" \"$1\" | cut -f3)\"".to_string(),
-        "    mkdir -p \"$outputs_dir\"".to_string(),
-        format!(
-            "    codex --ask-for-approval never exec --cd \"$eval_root\" --sandbox workspace-write{hook_trust}{model_arg} --json \\"
-        ),
-        "      --output-last-message \"$outputs_dir/final-message.md\" \\".to_string(),
-        "      \"Read the file at $prompt_path and follow its instructions exactly. When you finish, make your final response exactly the same text you wrote to $outputs_dir/final-message.md.\" \\".to_string(),
-        "      </dev/null \\".to_string(),
-        "      > \"$outputs_dir/codex-events.jsonl\" \\".to_string(),
-        "      2> \"$outputs_dir/codex-stderr.log\"".to_string(),
-        "  ' sh {}".to_string(),
-    ]
-    .join("\n")
-}
-
-/// Judges run from `judge_cwd` (the iteration dir) — a common ancestor of every
-/// judge prompt, verdict `response_path`, and agent `outputs_dir`.
-pub(crate) fn codex_judge_dispatch_recipe(
-    model_flag: Option<&str>,
-    guard: bool,
-    judge_cwd: &Path,
-) -> String {
-    let hook_trust = if guard {
-        " --dangerously-bypass-hook-trust"
-    } else {
-        ""
-    };
-    let model_flag = model_flag.unwrap_or("-m");
-    let cwd = judge_cwd.display();
-    [
-        "Dispatch each judge task from judge-tasks.json with:".to_string(),
-        String::new(),
-        "```bash".to_string(),
-        "JOBS=${JOBS:-4}".to_string(),
-        "jq -j '.tasks[] | [.dispatch_prompt_path, .response_path, (.model // \"\")] | @tsv + \"\\u0000\"' judge-tasks.json | \\".to_string(),
-        "  xargs -0 -P \"$JOBS\" -I{} sh -c '".to_string(),
-        "    prompt_path=\"$(printf \"%s\" \"$1\" | cut -f1)\"".to_string(),
-        "    response_path=\"$(printf \"%s\" \"$1\" | cut -f2)\"".to_string(),
-        "    model=\"$(printf \"%s\" \"$1\" | cut -f3)\"".to_string(),
-        "    response_base=\"${response_path%.json}\"".to_string(),
-        "    mkdir -p \"$(dirname \"$response_path\")\"".to_string(),
-        "    if [ -n \"$model\" ]; then".to_string(),
-        format!(
-            "      codex --ask-for-approval never exec --cd \"{cwd}\" --sandbox workspace-write{hook_trust} {model_flag} \"$model\" --json \\"
-        ),
-        "        \"Read the file at $prompt_path and follow it exactly. You are a judge worker only: write the JSON verdict to $response_path, then reply with one sentence. Do not run eval-magic. Do not dispatch other judge tasks. Do not wait for other workers.\" \\".to_string(),
-        "        </dev/null \\".to_string(),
-        "        > \"$response_base.codex-events.jsonl\" \\".to_string(),
-        "        2> \"$response_base.codex-stderr.log\"".to_string(),
-        "    else".to_string(),
-        format!(
-            "      codex --ask-for-approval never exec --cd \"{cwd}\" --sandbox workspace-write{hook_trust} --json \\"
-        ),
-        "        \"Read the file at $prompt_path and follow it exactly. You are a judge worker only: write the JSON verdict to $response_path, then reply with one sentence. Do not run eval-magic. Do not dispatch other judge tasks. Do not wait for other workers.\" \\".to_string(),
-        "        </dev/null \\".to_string(),
-        "        > \"$response_base.codex-events.jsonl\" \\".to_string(),
-        "        2> \"$response_base.codex-stderr.log\"".to_string(),
-        "    fi".to_string(),
-        "  ' sh {}".to_string(),
-        "```".to_string(),
-    ]
-    .join("\n")
-}
-
-#[cfg(test)]
-mod tests {
-    use super::{
-        codex_exec_command_template, codex_judge_dispatch_recipe, codex_parallel_dispatch_recipe,
-    };
-    use std::path::Path;
-
-    #[test]
-    fn exec_template_places_approval_policy_before_exec() {
-        let cmd = codex_exec_command_template(Some("-m"), true, Some("gpt-5-mini"));
-        let first_line = cmd.lines().next().unwrap();
-
-        assert_eq!(
-            first_line,
-            "codex --ask-for-approval never exec --cd <eval-root> --sandbox workspace-write --dangerously-bypass-hook-trust -m gpt-5-mini --json \\"
-        );
-    }
-
-    #[test]
-    fn parallel_recipe_places_approval_policy_before_exec() {
-        let recipe = codex_parallel_dispatch_recipe(Some("-m"), true, Some("gpt-5-mini"));
-
-        assert!(
-            recipe.contains(
-                "    codex --ask-for-approval never exec --cd \"$eval_root\" --sandbox workspace-write --dangerously-bypass-hook-trust -m gpt-5-mini --json \\"
-            ),
-            "{recipe}"
-        );
-    }
-
-    #[test]
-    fn judge_recipe_places_approval_policy_before_exec() {
-        let recipe = codex_judge_dispatch_recipe(Some("-m"), true, Path::new("/work/iter-1"));
-
-        assert!(
-            recipe.contains(
-                "      codex --ask-for-approval never exec --cd \"/work/iter-1\" --sandbox workspace-write --dangerously-bypass-hook-trust -m \"$model\" --json \\"
-            ),
-            "{recipe}"
-        );
-        assert!(
-            recipe.contains(
-                "      codex --ask-for-approval never exec --cd \"/work/iter-1\" --sandbox workspace-write --dangerously-bypass-hook-trust --json \\"
-            ),
-            "{recipe}"
-        );
-        assert!(!recipe.contains("<eval-root>"), "{recipe}");
-    }
-}
diff --git a/src/adapters/codex_session.rs b/src/adapters/codex_session.rs
deleted file mode 100644
index 0c757ab..0000000
--- a/src/adapters/codex_session.rs
+++ /dev/null
@@ -1,83 +0,0 @@
-//! Codex-specific rendering of the skills surface.
-//!
-//! Codex exposes skills with a name,
-//! description, and file path in its initial skills list. Kept separate from
-//! Claude Code's Skill-tool wording so dispatch prompts mirror the harness being
-//! evaluated.
-
-use crate::core::AvailableSkill;
-
-/// Render the discoverable skills the way Codex surfaces them in its initial
-/// skills list: a `## Skills` heading followed by `- name: description (file:
-/// path)` bullets. Returns an empty string when no skills are staged.
-pub fn render_codex_available_skills_block(skills: &[AvailableSkill]) -> String {
-    if skills.is_empty() {
-        return String::new();
-    }
-    let mut sorted: Vec<&AvailableSkill> = skills.iter().collect();
-    sorted.sort_by(|a, b| a.name.cmp(&b.name));
-    let mut out = String::from("## Skills\n");
-    for s in sorted {
-        out.push_str(&format!(
-            "\n- {}: {} (file: {})",
-            s.name, s.description, s.path
-        ));
-    }
-    out
-}
-
-/// Render a Codex plan-mode profile as an operating-context reminder. Codex's
-/// non-interactive `exec` surface has no documented real plan-mode switch, so
-/// this mirrors the portable approximation: text injected ahead of the task.
-pub fn render_codex_plan_mode_context(profile_text: &str) -> String {
-    let trimmed = profile_text.trim();
-    if trimmed.is_empty() {
-        return String::new();
-    }
-    format!("<system-reminder>\n{trimmed}\n</system-reminder>")
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::core::AvailableSkill;
-
-    fn skill(name: &str, description: &str) -> AvailableSkill {
-        AvailableSkill {
-            name: name.into(),
-            path: format!("/x/{name}/SKILL.md"),
-            description: description.into(),
-        }
-    }
-
-    #[test]
-    fn renders_codex_surface_with_name_description_and_file_path() {
-        let block =
-            render_codex_available_skills_block(&[skill("mr-review", "review merge requests")]);
-        assert!(block.contains("## Skills"));
-        assert!(block.contains("- mr-review: review merge requests"));
-        assert!(block.contains("(file: /x/mr-review/SKILL.md)"));
-        assert!(!block.contains("The following skills are available for use with the Skill tool:"));
-    }
-
-    #[test]
-    fn sorts_skills_by_name() {
-        let block =
-            render_codex_available_skills_block(&[skill("zebra", "z"), skill("alpha", "a")]);
-        assert!(block.find("- alpha:").unwrap() < block.find("- zebra:").unwrap());
-    }
-
-    #[test]
-    fn empty_list_renders_empty_string() {
-        assert_eq!(render_codex_available_skills_block(&[]), "");
-    }
-
-    #[test]
-    fn plan_mode_wraps_in_system_reminder_with_codex_profile_text() {
-        let block = render_codex_plan_mode_context("Codex plan mode is active.");
-        assert_eq!(
-            block,
-            "<system-reminder>\nCodex plan mode is active.\n</system-reminder>"
-        );
-    }
-}
diff --git a/src/adapters/descriptor.rs b/src/adapters/descriptor.rs
new file mode 100644
index 0000000..6de165e
--- /dev/null
+++ b/src/adapters/descriptor.rs
@@ -0,0 +1,740 @@
+//! Harness descriptor files: the data half of a harness adapter.
+//!
+//! A descriptor is a TOML file carrying every declarative value a harness
+//! adapter exposes (label, dirs, capability booleans, phrases, templates,
+//! banner prose, the write-guard data block) plus references to *named
+//! capabilities* — the code-backed features in [`super::capabilities`]
+//! (transcript parsers, slug generation, shadow preflight).
+//!
+//! Loading is schema-gated: the TOML transcodes to JSON and must satisfy the
+//! bundled `schema/harness-descriptor.schema.json`, then the cross-field
+//! invariants in [`validate_descriptor`] — the load-time form of the old
+//! cross-harness adapter tests, so user-supplied descriptor files inherit the
+//! same checks.
+
+use regex::Regex;
+use serde::{Deserialize, Serialize};
+
+use crate::core::ToolInvocation;
+use crate::validation::{SchemaName, ValidationError, validate_against_schema};
+
+use super::capabilities::{ShadowPreflight, SlugCapability, TranscriptParser};
+use super::extract::ExtractSpec;
+use super::transcript::TranscriptSummary;
+
+pub mod layers;
+mod validation;
+
+/// The three built-in harness descriptors, embedded like the schemas: a
+/// `(source path, TOML text)` pair per harness, in registry order.
+pub const EMBEDDED_DESCRIPTORS: [(&str, &str); 3] = [
+    (
+        "harnesses/claude-code.toml",
+        include_str!("../../harnesses/claude-code.toml"),
+    ),
+    (
+        "harnesses/codex.toml",
+        include_str!("../../harnesses/codex.toml"),
+    ),
+    (
+        "harnesses/opencode.toml",
+        include_str!("../../harnesses/opencode.toml"),
+    ),
+];
+
+/// A parsed, schema-checked, invariant-checked harness descriptor.
+///
+/// Field docs live in `schema/harness-descriptor.schema.json` (the schema gate
+/// and this struct are kept honest against each other by
+/// [`validate_against_schema`]'s deserialize step).
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct HarnessDescriptor {
+    pub label: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub skills_dir: Option<String>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub config_dirs: Vec<String>,
+    #[serde(default, skip_serializing_if = "RunSection::is_default")]
+    pub run: RunSection,
+    #[serde(default, skip_serializing_if = "ToolsSection::is_empty")]
+    pub tools: ToolsSection,
+    #[serde(default, skip_serializing_if = "StagingSection::is_unconfigured")]
+    pub staging: StagingSection,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub skills_block: Option<SkillsBlockSection>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub transcript: Option<TranscriptSection>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model: Option<ModelSection>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub guard: Option<GuardSection>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub shadow: Option<ShadowSection>,
+    #[serde(default, skip_serializing_if = "DispatchSection::is_empty")]
+    pub dispatch: DispatchSection,
+}
+
+/// Run-option capabilities. The `Default` mirrors the baseline every harness
+/// gets without opting in: no guard, bootstrap/stage-name allowed unstaged.
+#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize)]
+pub struct RunSection {
+    #[serde(default)]
+    pub supports_guard: bool,
+    #[serde(default = "default_true")]
+    pub supports_bootstrap_with_no_stage: bool,
+    #[serde(default = "default_true")]
+    pub supports_stage_name_with_no_stage: bool,
+}
+
+impl RunSection {
+    /// True when every capability sits at its baseline default — the signal
+    /// `harness show` uses to omit the section from authorable output.
+    pub fn is_default(&self) -> bool {
+        *self == RunSection::default()
+    }
+}
+
+impl Default for RunSection {
+    fn default() -> Self {
+        RunSection {
+            supports_guard: false,
+            supports_bootstrap_with_no_stage: true,
+            supports_stage_name_with_no_stage: true,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Default, Deserialize, Serialize)]
+pub struct ToolsSection {
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub write: Vec<String>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub patch: Vec<String>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub shell: Vec<String>,
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub read: Vec<String>,
+}
+
+impl ToolsSection {
+    /// True when no role declares any tool names.
+    pub fn is_empty(&self) -> bool {
+        self.write.is_empty()
+            && self.patch.is_empty()
+            && self.shell.is_empty()
+            && self.read.is_empty()
+    }
+}
+
+#[derive(Debug, Clone, Default, Deserialize, Serialize)]
+pub struct StagingSection {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub slug_template: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub slug_capability: Option<SlugCapability>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub stage_name_pattern: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub stage_name_max_len: Option<usize>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub stage_name_invalid_message: Option<String>,
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub rewrites_frontmatter_name: bool,
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub advertises_staged_slug_name: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub surface_phrase: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub unresolved_phrase: Option<String>,
+}
+
+impl StagingSection {
+    /// True when any field departs from the defaults — the signal that the
+    /// descriptor actually configures native staging.
+    pub fn is_configured(&self) -> bool {
+        !self.is_unconfigured()
+    }
+
+    fn is_unconfigured(&self) -> bool {
+        self.slug_template.is_none()
+            && self.slug_capability.is_none()
+            && self.stage_name_pattern.is_none()
+            && self.stage_name_max_len.is_none()
+            && self.stage_name_invalid_message.is_none()
+            && !self.rewrites_frontmatter_name
+            && !self.advertises_staged_slug_name
+            && self.surface_phrase.is_none()
+            && self.unresolved_phrase.is_none()
+    }
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct SkillsBlockSection {
+    pub header: String,
+    pub item: String,
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    pub footer: String,
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct TranscriptSection {
+    pub events_filename: String,
+    /// Named code parser — for streams that need stitching (keyed joins,
+    /// content coercion). Exactly one of `parser`/`extract` is declared.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub parser: Option<TranscriptParser>,
+    /// Declarative extractor for flat event streams.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub extract: Option<ExtractSpec>,
+    #[serde(default = "default_true", skip_serializing_if = "is_true")]
+    pub surfaces_skill_invocation: bool,
+}
+
+impl TranscriptSection {
+    /// Parse the events file into ordered tool invocations, through whichever
+    /// tier the descriptor declares.
+    pub(crate) fn parse(&self, path: &std::path::Path) -> std::io::Result<Vec<ToolInvocation>> {
+        match (&self.parser, &self.extract) {
+            (Some(parser), _) => parser.parse(path),
+            (None, Some(extract)) => super::extract::parse(extract, path),
+            // Validation guarantees one tier is declared; fail like a
+            // parser-less harness if a section slips through unchecked.
+            (None, None) => Err(unwired_error()),
+        }
+    }
+
+    /// Parse the events file into a full [`TranscriptSummary`].
+    pub(crate) fn parse_full(&self, path: &std::path::Path) -> std::io::Result<TranscriptSummary> {
+        match (&self.parser, &self.extract) {
+            (Some(parser), _) => parser.parse_full(path),
+            (None, Some(extract)) => super::extract::parse_full(extract, path),
+            (None, None) => Err(unwired_error()),
+        }
+    }
+}
+
+fn unwired_error() -> std::io::Error {
+    std::io::Error::new(
+        std::io::ErrorKind::Unsupported,
+        "[transcript] declares neither a parser nor an extract block",
+    )
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct ModelSection {
+    pub flag: String,
+}
+
+/// The write-guard data block: everything the generic guard engine
+/// ([`super::guard`]) needs to arm a hook and render a deny verdict. Embedded
+/// built-in descriptors only — the guard fails open, so
+/// [`layers::check_user_layer_restrictions`] bars user layers from declaring
+/// it.
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct GuardSection {
+    /// Hook-config file the entry is merged into, `/`-separated relative to
+    /// the staged env root (e.g. `.claude/settings.local.json`).
+    pub hooks_file: String,
+    /// Tool-name matcher the hook registers for; also the source of the
+    /// matcher⊆vocabulary invariant.
+    pub matcher: String,
+    /// Shell command the hook runs, with `{exe}` and `{marker}` placeholders.
+    pub command_template: String,
+    /// JSON template of the hook entry appended to the hook config's
+    /// `hooks.PreToolUse` array, with `{matcher}` and `{command}` placeholders
+    /// in its string values. Authored key order is serialized verbatim.
+    pub hook_entry: String,
+    /// JSON template of the deny verdict printed on stdout, with a `{reason}`
+    /// placeholder. Authored key order is the harness's on-disk contract.
+    pub verdict_template: String,
+    /// Banner printed after `--guard` arms the hook.
+    pub armed_message: String,
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct ShadowSection {
+    pub preflight: ShadowPreflight,
+}
+
+#[derive(Debug, Clone, Default, Deserialize, Serialize)]
+pub struct DispatchSection {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub capture_prefix: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub guard_args: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model_note: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub next_steps_template: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub exec_template: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub parallel_command_template: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub judge_command_template: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub manifest_template: Option<String>,
+}
+
+impl DispatchSection {
+    /// True when no dispatch field is set.
+    pub fn is_empty(&self) -> bool {
+        self.capture_prefix.is_none()
+            && self.guard_args.is_none()
+            && self.model_note.is_none()
+            && self.next_steps_template.is_none()
+            && self.exec_template.is_none()
+            && self.parallel_command_template.is_none()
+            && self.judge_command_template.is_none()
+            && self.manifest_template.is_none()
+    }
+}
+
+fn default_true() -> bool {
+    true
+}
+
+/// `skip_serializing_if` helpers for boolean fields at their defaults.
+fn is_false(value: &bool) -> bool {
+    !*value
+}
+
+fn is_true(value: &bool) -> bool {
+    *value
+}
+
+/// A descriptor that failed to load. Every variant carries the descriptor's
+/// source path so the message is actionable on its own.
+#[derive(Debug, thiserror::Error)]
+pub enum DescriptorError {
+    #[error("{path}: invalid TOML: {message}")]
+    Toml { path: String, message: String },
+    #[error(transparent)]
+    Validation(#[from] ValidationError),
+    #[error("{path}: {message}")]
+    Invariant { path: String, message: String },
+}
+
+/// Parse, schema-check, and invariant-check one descriptor. `source` names the
+/// descriptor in error messages (its file path).
+pub fn load_descriptor(toml_src: &str, source: &str) -> Result<HarnessDescriptor, DescriptorError> {
+    finalize_descriptor(&parse_descriptor_value(toml_src, source)?, source)
+}
+
+/// Parse one descriptor file's TOML into a JSON value and schema-check it.
+/// This is the per-file gate every layered source passes individually — the
+/// schema requires only `label`, so partial override files validate here too,
+/// while unknown fields and bad capability names are still rejected with the
+/// file's own path in the message.
+pub fn parse_descriptor_value(
+    toml_src: &str,
+    source: &str,
+) -> Result<serde_json::Value, DescriptorError> {
+    let value: serde_json::Value = toml::from_str(toml_src).map_err(|e| DescriptorError::Toml {
+        path: source.to_string(),
+        message: e.to_string(),
+    })?;
+    let _: serde_json::Value =
+        validate_against_schema(SchemaName::HarnessDescriptor, &value, source)?;
+    Ok(value)
+}
+
+/// Merge `overlay` onto `base`, field by field: objects merge recursively per
+/// key; scalars, arrays, and nulls replace wholesale. This is the layering
+/// rule — a later descriptor file overrides individual fields of an earlier
+/// one, never whole-file shadowing.
+pub fn merge_descriptor_value(base: &mut serde_json::Value, overlay: serde_json::Value) {
+    match (base, overlay) {
+        (serde_json::Value::Object(base), serde_json::Value::Object(overlay)) => {
+            for (key, value) in overlay {
+                match base.get_mut(&key) {
+                    Some(slot) if slot.is_object() && value.is_object() => {
+                        merge_descriptor_value(slot, value);
+                    }
+                    _ => {
+                        base.insert(key, value);
+                    }
+                }
+            }
+        }
+        (base, overlay) => *base = overlay,
+    }
+}
+
+/// Deserialize and invariant-check a (possibly merged) descriptor value.
+/// `provenance` names every contributing file (e.g. `base.toml (built-in) +
+/// overlay.toml (project)`) so a post-merge violation is traceable.
+pub fn finalize_descriptor(
+    value: &serde_json::Value,
+    provenance: &str,
+) -> Result<HarnessDescriptor, DescriptorError> {
+    let descriptor: HarnessDescriptor =
+        validate_against_schema(SchemaName::HarnessDescriptor, value, provenance)?;
+    validation::validate_descriptor(&descriptor, provenance)?;
+    Ok(descriptor)
+}
+
+/// Substitute single-brace `{token}` placeholders in `template`.
+///
+/// Single left-to-right pass over the original template: substituted values
+/// are never re-scanned, and unknown or unterminated tokens (shell text like
+/// `${JOBS:-4}` or `-I{}`) pass through verbatim.
+pub(crate) fn subst(template: &str, vars: &[(&str, &str)]) -> String {
+    let mut out = String::with_capacity(template.len());
+    let mut rest = template;
+    while let Some(start) = rest.find('{') {
+        out.push_str(&rest[..start]);
+        let after = &rest[start + 1..];
+        let Some(end) = after.find('}') else {
+            out.push('{');
+            rest = after;
+            continue;
+        };
+        match vars.iter().find(|(k, _)| *k == &after[..end]) {
+            Some((_, value)) => {
+                out.push_str(value);
+                rest = &after[end + 1..];
+            }
+            None => {
+                out.push('{');
+                rest = after;
+            }
+        }
+    }
+    out.push_str(rest);
+    out
+}
+
+/// The staged-slug shape used when a descriptor declares neither a template
+/// nor a capability.
+pub(crate) const DEFAULT_SLUG_TEMPLATE: &str = "{prefix}{iteration}-{condition}__{skill_name}";
+
+/// Render the staged slug for one `(iteration, condition, skill)` cell from
+/// the descriptor's slug capability or template (or the default template).
+pub(crate) fn render_staged_slug(
+    staging: &StagingSection,
+    prefix: &str,
+    iteration: u32,
+    condition: &str,
+    skill_name: &str,
+) -> String {
+    if let Some(capability) = staging.slug_capability {
+        return capability.staged_slug(prefix, iteration, condition, skill_name);
+    }
+    let iteration = iteration.to_string();
+    subst(
+        staging
+            .slug_template
+            .as_deref()
+            .unwrap_or(DEFAULT_SLUG_TEMPLATE),
+        &[
+            ("prefix", prefix),
+            ("iteration", &iteration),
+            ("condition", condition),
+            ("skill_name", skill_name),
+        ],
+    )
+}
+
+/// Check `name` against the descriptor's declarative stage-name rules,
+/// returning the rejection message on violation.
+pub(crate) fn stage_name_error(
+    staging: &StagingSection,
+    regex: Option<&Regex>,
+    name: &str,
+) -> Option<String> {
+    let len_ok = staging
+        .stage_name_max_len
+        .is_none_or(|max| name.len() <= max);
+    let pattern_ok = regex.is_none_or(|r| r.is_match(name));
+    if len_ok && pattern_ok {
+        return None;
+    }
+    Some(match &staging.stage_name_invalid_message {
+        Some(message) => subst(message, &[("name", name)]),
+        None => format!("stage name \"{name}\" violates the descriptor's naming rules"),
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn load(toml_src: &str) -> Result<HarnessDescriptor, DescriptorError> {
+        load_descriptor(toml_src, "test.toml")
+    }
+
+    fn err_of(toml_src: &str) -> String {
+        load(toml_src)
+            .expect_err("descriptor should be rejected")
+            .to_string()
+    }
+
+    const MINIMAL: &str = r#"
+label = "demo"
+skills_dir = ".demo/skills"
+config_dirs = [".demo"]
+"#;
+
+    const GUARDED: &str = r#"
+label = "demo"
+skills_dir = ".demo/skills"
+config_dirs = [".demo"]
+
+[run]
+supports_guard = true
+
+[tools]
+write = ["Edit", "MultiEdit", "NotebookEdit", "Write"]
+shell = ["Bash"]
+
+[guard]
+hooks_file = ".demo/hooks.json"
+matcher = "Write|Edit|MultiEdit|NotebookEdit|Bash"
+command_template = '"{exe}" guard-hook --harness demo "{marker}"'
+hook_entry = '{"matcher":"{matcher}","hooks":[{"type":"command","command":"{command}"}]}'
+verdict_template = '{"decision":"block","reason":"{reason}"}'
+armed_message = "guard armed"
+"#;
+
+    /// A descriptor whose transcript ingest is the declarative extract tier.
+    const EXTRACTED: &str = r#"
+label = "demo"
+skills_dir = ".demo/skills"
+config_dirs = [".demo"]
+
+[tools]
+write = ["file_change"]
+shell = ["command_execution"]
+
+[transcript]
+events_filename = "demo-events.jsonl"
+
+[transcript.extract.tools]
+where = { type = "item.completed" }
+item = "item"
+name_field = "type"
+skip_names = ["agent_message"]
+args_omit = ["id", "type", "output"]
+result_coalesce = ["output"]
+
+[transcript.extract.final_text]
+where = { type = "item.completed", "item.type" = "agent_message" }
+field = "item.text"
+
+[transcript.extract.tokens]
+where = { type = "turn.completed" }
+sum = ["usage.input_tokens", "usage.output_tokens"]
+
+[transcript.extract.duration]
+timestamp_spread = "timestamp"
+"#;
+
+    #[test]
+    fn extract_descriptor_loads_and_reserializes_to_loadable_toml() {
+        let d = load(EXTRACTED).unwrap();
+        let transcript = d.transcript.as_ref().expect("transcript section loads");
+        assert!(transcript.parser.is_none());
+        assert!(transcript.extract.is_some());
+
+        // `harness show` re-serializes resolved descriptors to TOML; the
+        // extract tier must survive the round trip.
+        let shown = toml::to_string(&d).expect("descriptor re-serializes");
+        let reloaded = load(&shown).unwrap();
+        let extract = reloaded.transcript.unwrap().extract.unwrap();
+        assert_eq!(
+            extract.tokens.unwrap().sum,
+            vec!["usage.input_tokens", "usage.output_tokens"]
+        );
+        assert_eq!(
+            extract
+                .tools
+                .unwrap()
+                .r#where
+                .get("type")
+                .map(String::as_str),
+            Some("item.completed")
+        );
+    }
+
+    #[test]
+    fn transcript_section_dispatches_parse_to_the_extract_engine() {
+        let transcript = load(EXTRACTED).unwrap().transcript.unwrap();
+        let dir = tempfile::TempDir::new().unwrap();
+        let path = dir.path().join("demo-events.jsonl");
+        std::fs::write(
+            &path,
+            concat!(
+                r#"{"type":"item.completed","item":{"id":"i1","type":"command_execution","command":"ls","output":"ok"}}"#,
+                "\n",
+                r#"{"type":"item.completed","item":{"id":"i2","type":"agent_message","text":"Done."}}"#,
+                "\n",
+            ),
+        )
+        .unwrap();
+
+        let invocations = transcript.parse(&path).unwrap();
+        assert_eq!(invocations.len(), 1);
+        assert_eq!(invocations[0].name, "command_execution");
+
+        let full = transcript.parse_full(&path).unwrap();
+        assert_eq!(full.final_text, Some("Done.".into()));
+        assert_eq!(full.tool_invocations.len(), 1);
+    }
+
+    #[test]
+    fn minimal_descriptor_loads() {
+        let d = load(MINIMAL).unwrap();
+        assert_eq!(d.label, "demo");
+        assert_eq!(d.skills_dir.as_deref(), Some(".demo/skills"));
+        assert_eq!(d.config_dirs, vec![".demo".to_string()]);
+        // Section defaults match the trait defaults.
+        assert!(!d.run.supports_guard);
+        assert!(d.run.supports_bootstrap_with_no_stage);
+        assert!(d.run.supports_stage_name_with_no_stage);
+        assert!(!d.staging.rewrites_frontmatter_name);
+        assert!(d.guard.is_none());
+        assert!(d.transcript.is_none());
+    }
+
+    #[test]
+    fn guarded_descriptor_loads() {
+        let d = load(GUARDED).unwrap();
+        assert!(d.run.supports_guard);
+        let guard = d.guard.expect("guard section loads");
+        assert_eq!(guard.hooks_file, ".demo/hooks.json");
+        assert_eq!(guard.matcher, "Write|Edit|MultiEdit|NotebookEdit|Bash");
+        assert_eq!(
+            guard.command_template,
+            r#""{exe}" guard-hook --harness demo "{marker}""#
+        );
+        assert_eq!(guard.armed_message, "guard armed");
+    }
+
+    #[test]
+    fn label_only_descriptor_loads_as_baseline() {
+        let d = load("label = \"demo\"\n").unwrap();
+        assert_eq!(d.label, "demo");
+        assert!(d.skills_dir.is_none(), "no skills dir declared");
+        assert!(d.config_dirs.is_empty());
+        assert!(!d.run.supports_guard);
+    }
+
+    #[test]
+    fn rejects_staging_without_skills_dir() {
+        let err = err_of("label = \"demo\"\n\n[staging]\nsurface_phrase = \"skill\"\n");
+        assert!(err.contains("staging"), "{err}");
+        assert!(err.contains("skills_dir"), "{err}");
+    }
+
+    #[test]
+    fn rejects_guard_without_skills_dir() {
+        let toml = &GUARDED.replace("skills_dir = \".demo/skills\"\n", "");
+        let err = err_of(toml);
+        assert!(err.contains("guard"), "{err}");
+        assert!(err.contains("skills_dir"), "{err}");
+    }
+
+    #[test]
+    fn embedded_descriptors_load_and_validate() {
+        for (source, toml_src) in EMBEDDED_DESCRIPTORS {
+            let d = load_descriptor(toml_src, source)
+                .unwrap_or_else(|e| panic!("embedded descriptor {source} is invalid: {e}"));
+            assert!(!d.label.is_empty());
+        }
+    }
+
+    #[test]
+    fn rejects_invalid_toml_syntax() {
+        let err = err_of("label = ");
+        assert!(err.contains("test.toml"), "{err}");
+        assert!(err.contains("invalid TOML"), "{err}");
+    }
+
+    #[test]
+    fn rejects_unknown_top_level_field() {
+        let err = err_of(&format!("{MINIMAL}\nmystery = true\n"));
+        assert!(err.contains("harness-descriptor schema"), "{err}");
+    }
+
+    #[test]
+    fn rejects_non_kebab_case_label() {
+        let err = err_of(&MINIMAL.replace("\"demo\"", "\"Not_Kebab\""));
+        assert!(err.contains("harness-descriptor schema"), "{err}");
+    }
+
+    /// Migration canary: the pre-#137 named-engine shape must fail the schema
+    /// gate, so a stale `engine = "..."` line is caught with a schema message
+    /// instead of silently ignored.
+    #[test]
+    fn rejects_the_retired_guard_engine_field() {
+        let err = err_of(&GUARDED.replace(
+            "hooks_file = \".demo/hooks.json\"",
+            "engine = \"claude-hooks\"",
+        ));
+        assert!(err.contains("harness-descriptor schema"), "{err}");
+    }
+
+    #[test]
+    fn merge_deep_merges_tables_and_replaces_scalars_and_arrays() {
+        let mut base: serde_json::Value = toml::from_str(
+            r#"
+label = "demo"
+config_dirs = [".demo"]
+
+[model]
+flag = "--model"
+
+[dispatch]
+capture_prefix = "demo"
+"#,
+        )
+        .unwrap();
+        let overlay: serde_json::Value = toml::from_str(
+            r#"
+label = "demo"
+config_dirs = [".other"]
+
+[model]
+flag = "--model-x"
+"#,
+        )
+        .unwrap();
+        merge_descriptor_value(&mut base, overlay);
+        // Nested-table scalar replaced; sibling table untouched; array replaced
+        // wholesale (no element-wise merge).
+        assert_eq!(base["model"]["flag"], "--model-x");
+        assert_eq!(base["dispatch"]["capture_prefix"], "demo");
+        assert_eq!(base["config_dirs"], serde_json::json!([".other"]));
+    }
+
+    #[test]
+    fn finalize_names_every_contributing_file_on_invariant_breaks() {
+        // A merged value violating an invariant reports the provenance chain,
+        // not a single path.
+        let value: serde_json::Value =
+            toml::from_str("label = \"demo\"\nskills_dir = \".demo/skills\"\n").unwrap();
+        let err = finalize_descriptor(&value, "base.toml (built-in) + overlay.toml (project)")
+            .expect_err("missing config_dirs parent should be rejected")
+            .to_string();
+        assert!(
+            err.contains("base.toml (built-in) + overlay.toml (project)"),
+            "{err}"
+        );
+    }
+
+    #[test]
+    fn subst_replaces_tokens_and_passes_unknown_through() {
+        let out = subst(
+            "run {exec} with ${JOBS:-4} and -I{} on {exec}",
+            &[("exec", "demo-cmd")],
+        );
+        assert_eq!(out, "run demo-cmd with ${JOBS:-4} and -I{} on demo-cmd");
+    }
+
+    #[test]
+    fn subst_does_not_rescan_substituted_values() {
+        let out = subst("{a} {b}", &[("a", "holds-{b}"), ("b", "second")]);
+        assert_eq!(out, "holds-{b} second");
+    }
+}
diff --git a/src/adapters/descriptor/layers.rs b/src/adapters/descriptor/layers.rs
new file mode 100644
index 0000000..3e86fdb
--- /dev/null
+++ b/src/adapters/descriptor/layers.rs
@@ -0,0 +1,342 @@
+//! Descriptor source layers: where a descriptor's TOML text came from.
+//!
+//! Discovery order is precedence order — embedded built-ins, then user-global
+//! (`~/.config/eval-magic/harnesses/*.toml`), then project-local
+//! (`.eval-magic/harnesses/*.toml`), then a one-off `--harness-file`. Later
+//! layers override earlier ones field-by-field (see
+//! [`merge_descriptor_value`](super::merge_descriptor_value)). Every source
+//! carries its layer and display path so registry entries can report
+//! provenance (`harness list`/`show`) and error messages can name the
+//! contributing file.
+
+use std::fs;
+use std::path::{Path, PathBuf};
+
+use super::{DescriptorError, EMBEDDED_DESCRIPTORS};
+
+/// The layer a descriptor source belongs to, in precedence order (later
+/// layers override earlier ones field-by-field).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Layer {
+    /// A built-in descriptor bundled into the binary (`harnesses/*.toml`).
+    Embedded,
+    /// A user-global descriptor (`<config-root>/harnesses/*.toml`, where the
+    /// config root is `$EVAL_MAGIC_CONFIG_DIR`, `$XDG_CONFIG_HOME/eval-magic`,
+    /// or `~/.config/eval-magic`).
+    UserGlobal,
+    /// A project-local descriptor (`<cwd>/.eval-magic/harnesses/*.toml`).
+    ProjectLocal,
+    /// A one-off descriptor passed via `--harness-file <path>`.
+    HarnessFile,
+}
+
+impl Layer {
+    /// The short name `harness list`/`show` and warnings display.
+    pub fn display_name(self) -> &'static str {
+        match self {
+            Layer::Embedded => "built-in",
+            Layer::UserGlobal => "user",
+            Layer::ProjectLocal => "project",
+            Layer::HarnessFile => "file",
+        }
+    }
+}
+
+/// One descriptor source: its layer, a display path for error messages and
+/// provenance, and the raw TOML text.
+#[derive(Debug, Clone)]
+pub struct DescriptorSource {
+    pub layer: Layer,
+    pub path: String,
+    pub toml_src: String,
+}
+
+/// The bundled built-in descriptors as the registry's base layer.
+pub fn embedded_sources() -> Vec<DescriptorSource> {
+    EMBEDDED_DESCRIPTORS
+        .iter()
+        .map(|(path, toml_src)| DescriptorSource {
+            layer: Layer::Embedded,
+            path: (*path).to_string(),
+            toml_src: (*toml_src).to_string(),
+        })
+        .collect()
+}
+
+/// A `--harness-file` path that could not be read. Unlike discovered layer
+/// files (skipped with a warning), the explicitly named file is a hard error.
+#[derive(Debug, thiserror::Error)]
+#[error("cannot read --harness-file {path}: {message}")]
+pub struct HarnessFileError {
+    pub path: String,
+    pub message: String,
+}
+
+/// Discover every descriptor source in precedence order: embedded →
+/// user-global → project-local → `--harness-file`. Missing layer directories
+/// are fine (empty layer); unreadable files inside a layer directory are
+/// skipped and reported in the returned warnings. Only the explicit
+/// `--harness-file` fails hard.
+pub fn discover_sources(
+    config_root: Option<&Path>,
+    project_root: &Path,
+    harness_file: Option<&Path>,
+) -> Result<(Vec<DescriptorSource>, Vec<String>), HarnessFileError> {
+    let mut warnings = Vec::new();
+    let mut sources = embedded_sources();
+    if let Some(config_root) = config_root {
+        sources.extend(dir_sources(
+            &config_root.join("harnesses"),
+            Layer::UserGlobal,
+            &mut warnings,
+        ));
+    }
+    sources.extend(dir_sources(
+        &project_root.join(".eval-magic").join("harnesses"),
+        Layer::ProjectLocal,
+        &mut warnings,
+    ));
+    if let Some(file) = harness_file {
+        let toml_src = fs::read_to_string(file).map_err(|e| HarnessFileError {
+            path: file.display().to_string(),
+            message: e.to_string(),
+        })?;
+        sources.push(DescriptorSource {
+            layer: Layer::HarnessFile,
+            path: file.display().to_string(),
+            toml_src,
+        });
+    }
+    Ok((sources, warnings))
+}
+
+/// Every `*.toml` in `dir`, sorted by filename for deterministic layering.
+fn dir_sources(dir: &Path, layer: Layer, warnings: &mut Vec<String>) -> Vec<DescriptorSource> {
+    let Ok(entries) = fs::read_dir(dir) else {
+        // No directory means an empty layer, not an error.
+        return Vec::new();
+    };
+    let mut paths: Vec<PathBuf> = entries
+        .flatten()
+        .map(|e| e.path())
+        .filter(|p| p.extension().is_some_and(|ext| ext == "toml") && p.is_file())
+        .collect();
+    paths.sort();
+    paths
+        .into_iter()
+        .filter_map(|path| match fs::read_to_string(&path) {
+            Ok(toml_src) => Some(DescriptorSource {
+                layer,
+                path: path.display().to_string(),
+                toml_src,
+            }),
+            Err(e) => {
+                warnings.push(format!(
+                    "skipping unreadable harness descriptor {}: {e}",
+                    path.display()
+                ));
+                None
+            }
+        })
+        .collect()
+}
+
+/// Resolve the user-global config root from explicit/env inputs:
+/// `$EVAL_MAGIC_CONFIG_DIR` verbatim (empty disables the layer), else
+/// `$XDG_CONFIG_HOME/eval-magic`, else `<home>/.config/eval-magic`.
+pub fn config_root_from(
+    explicit: Option<&str>,
+    xdg_config_home: Option<&str>,
+    home: Option<&Path>,
+) -> Option<PathBuf> {
+    if let Some(explicit) = explicit {
+        if explicit.is_empty() {
+            return None;
+        }
+        return Some(PathBuf::from(explicit));
+    }
+    if let Some(xdg) = xdg_config_home
+        && !xdg.is_empty()
+    {
+        return Some(Path::new(xdg).join("eval-magic"));
+    }
+    home.map(|home| home.join(".config").join("eval-magic"))
+}
+
+/// [`config_root_from`] over the live environment.
+pub fn default_config_root() -> Option<PathBuf> {
+    config_root_from(
+        std::env::var("EVAL_MAGIC_CONFIG_DIR").ok().as_deref(),
+        std::env::var("XDG_CONFIG_HOME").ok().as_deref(),
+        std::env::home_dir().as_deref(),
+    )
+}
+
+/// Reject descriptor content user-supplied files may not declare: the write
+/// guard fails open (an unrenderable or mistyped guard block silently allows
+/// everything), so guard data stays restricted to the embedded built-ins
+/// until user guards get an explicit trust story. The check runs on each
+/// file's own content, so a user overlay of a guarded built-in still inherits
+/// the embedded guard cleanly.
+pub fn check_user_layer_restrictions(
+    value: &serde_json::Value,
+    path: &str,
+) -> Result<(), DescriptorError> {
+    let declares_guard = value.get("guard").is_some();
+    let flips_support = value
+        .pointer("/run/supports_guard")
+        .and_then(serde_json::Value::as_bool)
+        == Some(true);
+    if declares_guard || flips_support {
+        return Err(DescriptorError::Invariant {
+            path: path.to_string(),
+            message: "user-supplied descriptors may not declare [guard] or set \
+                      run.supports_guard = true — the write guard fails open, so a mistyped \
+                      guard block would silently disarm it; guard data stays restricted to \
+                      built-in descriptors. Remove it; unguarded runs fall back to the \
+                      detect-stray-writes audit."
+                .to_string(),
+        });
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::fs;
+    use std::path::Path;
+
+    #[test]
+    fn embedded_sources_cover_every_bundled_descriptor() {
+        let sources = embedded_sources();
+        assert_eq!(sources.len(), EMBEDDED_DESCRIPTORS.len());
+        assert!(sources.iter().all(|s| s.layer == Layer::Embedded));
+        assert_eq!(sources[0].path, "harnesses/claude-code.toml");
+        assert!(!sources[0].toml_src.is_empty());
+    }
+
+    #[test]
+    fn user_layer_may_not_declare_a_guard_table() {
+        // The restriction fires on the [guard] table's presence alone — field
+        // shape is irrelevant (the schema gate owns that).
+        let value: serde_json::Value =
+            toml::from_str("label = \"demo\"\n\n[guard]\narmed_message = \"x\"\n").unwrap();
+        let err = check_user_layer_restrictions(&value, "user.toml")
+            .unwrap_err()
+            .to_string();
+        assert!(err.contains("user.toml"), "{err}");
+        assert!(err.contains("may not declare [guard]"), "{err}");
+        assert!(
+            err.contains("detect-stray-writes"),
+            "names the fallback: {err}"
+        );
+    }
+
+    #[test]
+    fn user_layer_may_not_flip_supports_guard_on() {
+        let value: serde_json::Value =
+            toml::from_str("label = \"demo\"\n\n[run]\nsupports_guard = true\n").unwrap();
+        let err = check_user_layer_restrictions(&value, "user.toml")
+            .unwrap_err()
+            .to_string();
+        assert!(err.contains("run.supports_guard"), "{err}");
+    }
+
+    #[test]
+    fn user_layer_restrictions_pass_everything_else() {
+        let value: serde_json::Value = toml::from_str(
+            "label = \"demo\"\n\n[run]\nsupports_guard = false\n\n[model]\nflag = \"-m\"\n",
+        )
+        .unwrap();
+        assert!(check_user_layer_restrictions(&value, "user.toml").is_ok());
+    }
+
+    #[test]
+    fn config_root_prefers_explicit_env_then_xdg_then_home() {
+        assert_eq!(
+            config_root_from(Some("/explicit"), Some("/xdg"), Some(Path::new("/home/u"))),
+            Some("/explicit".into())
+        );
+        assert_eq!(
+            config_root_from(None, Some("/xdg"), Some(Path::new("/home/u"))),
+            Some("/xdg/eval-magic".into())
+        );
+        assert_eq!(
+            config_root_from(None, None, Some(Path::new("/home/u"))),
+            Some("/home/u/.config/eval-magic".into())
+        );
+        assert_eq!(config_root_from(None, None, None), None);
+    }
+
+    #[test]
+    fn empty_config_dir_env_disables_the_user_layer() {
+        assert_eq!(
+            config_root_from(Some(""), Some("/xdg"), Some(Path::new("/home/u"))),
+            None
+        );
+    }
+
+    #[test]
+    fn discovery_layers_in_precedence_order() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let config_root = tmp.path().join("config");
+        let project_root = tmp.path().join("project");
+        let user_dir = config_root.join("harnesses");
+        let project_dir = project_root.join(".eval-magic").join("harnesses");
+        fs::create_dir_all(&user_dir).unwrap();
+        fs::create_dir_all(&project_dir).unwrap();
+        // Written out of name order to prove the filename sort.
+        fs::write(user_dir.join("b.toml"), "label = \"bee\"\n").unwrap();
+        fs::write(user_dir.join("a.toml"), "label = \"ay\"\n").unwrap();
+        fs::write(user_dir.join("notes.md"), "not a descriptor").unwrap();
+        fs::write(project_dir.join("p.toml"), "label = \"pea\"\n").unwrap();
+        let file = tmp.path().join("one-off.toml");
+        fs::write(&file, "label = \"one-off\"\n").unwrap();
+
+        let (sources, warnings) =
+            discover_sources(Some(&config_root), &project_root, Some(&file)).unwrap();
+        assert!(warnings.is_empty(), "{warnings:?}");
+        let tail: Vec<(Layer, &str)> = sources[EMBEDDED_DESCRIPTORS.len()..]
+            .iter()
+            .map(|s| (s.layer, s.path.as_str()))
+            .collect();
+        assert_eq!(sources[0].layer, Layer::Embedded);
+        assert_eq!(
+            tail,
+            vec![
+                (Layer::UserGlobal, user_dir.join("a.toml").to_str().unwrap()),
+                (Layer::UserGlobal, user_dir.join("b.toml").to_str().unwrap()),
+                (
+                    Layer::ProjectLocal,
+                    project_dir.join("p.toml").to_str().unwrap()
+                ),
+                (Layer::HarnessFile, file.to_str().unwrap()),
+            ]
+        );
+    }
+
+    #[test]
+    fn discovery_tolerates_missing_layer_dirs() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let (sources, warnings) = discover_sources(
+            Some(&tmp.path().join("nope")),
+            &tmp.path().join("also-nope"),
+            None,
+        )
+        .unwrap();
+        assert_eq!(sources.len(), EMBEDDED_DESCRIPTORS.len());
+        assert!(warnings.is_empty(), "{warnings:?}");
+    }
+
+    #[test]
+    fn discovery_fails_hard_on_an_unreadable_harness_file() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let missing = tmp.path().join("missing.toml");
+        let err = discover_sources(None, tmp.path(), Some(&missing))
+            .unwrap_err()
+            .to_string();
+        assert!(err.contains("--harness-file"), "{err}");
+        assert!(err.contains("missing.toml"), "{err}");
+    }
+}
diff --git a/src/adapters/descriptor/validation.rs b/src/adapters/descriptor/validation.rs
new file mode 100644
index 0000000..3136ca1
--- /dev/null
+++ b/src/adapters/descriptor/validation.rs
@@ -0,0 +1,753 @@
+//! Cross-field descriptor invariants — the load-time form of the old
+//! cross-harness adapter tests, applied to every descriptor so user-supplied
+//! files inherit the same checks as the built-ins.
+
+use regex::Regex;
+
+use crate::adapters::guard;
+
+use super::{DescriptorError, HarnessDescriptor, render_staged_slug, stage_name_error};
+
+/// The placeholders a slug template must carry to keep cleanup prefix-scans
+/// and per-cell uniqueness working.
+const SLUG_PLACEHOLDERS: [&str; 4] = ["{prefix}", "{iteration}", "{condition}", "{skill_name}"];
+
+/// Check every cross-field invariant, returning the first violation with an
+/// actionable message.
+pub(super) fn validate_descriptor(
+    d: &HarnessDescriptor,
+    source: &str,
+) -> Result<(), DescriptorError> {
+    let fail = |message: String| {
+        Err(DescriptorError::Invariant {
+            path: source.to_string(),
+            message,
+        })
+    };
+
+    // Guard capability and post-arm banner move in lockstep: `--guard` gates
+    // on the capability, and an armed guard the user is never told about (or a
+    // banner with no guard behind it) misleads the dispatch session.
+    if d.run.supports_guard != d.guard.is_some() {
+        return fail(format!(
+            "run.supports_guard is {} but the [guard] table is {}; the guard capability and \
+             the armed banner must move in lockstep — declare both or neither",
+            d.run.supports_guard,
+            if d.guard.is_some() {
+                "present"
+            } else {
+                "absent"
+            },
+        ));
+    }
+
+    // Native staging and the write guard both live under the skills dir:
+    // staging copies skills into it, and the guard keeps its marker/manifest
+    // there. Without a skills_dir neither has anywhere to operate.
+    if d.skills_dir.is_none() {
+        if d.staging.is_configured() {
+            return fail(
+                "[staging] is configured but skills_dir is not declared; native staging \
+                 copies skills into skills_dir — declare it, or drop [staging] and let \
+                 runs fall back to --no-stage"
+                    .into(),
+            );
+        }
+        if d.guard.is_some() {
+            return fail(
+                "[guard] is declared but skills_dir is not; the guard's marker and \
+                 teardown manifest live under skills_dir — declare it, or drop the \
+                 guard and rely on the detect-stray-writes audit"
+                    .into(),
+            );
+        }
+    }
+
+    // Slug shape: one source of truth, all four placeholders, and the
+    // generated slug must satisfy the descriptor's own naming rules.
+    if d.staging.slug_template.is_some() && d.staging.slug_capability.is_some() {
+        return fail(
+            "declare either staging.slug_template or staging.slug_capability, not both".into(),
+        );
+    }
+    if let Some(template) = &d.staging.slug_template {
+        for placeholder in SLUG_PLACEHOLDERS {
+            if !template.contains(placeholder) {
+                return fail(format!(
+                    "staging.slug_template must contain {placeholder} — cleanup prefix-scans \
+                     and per-cell uniqueness rely on all four placeholders"
+                ));
+            }
+        }
+    }
+    let stage_regex = match &d.staging.stage_name_pattern {
+        Some(pattern) => match Regex::new(pattern) {
+            Ok(regex) => Some(regex),
+            Err(e) => {
+                return fail(format!("staging.stage_name_pattern does not compile: {e}"));
+            }
+        },
+        None => None,
+    };
+    let sample = render_staged_slug(&d.staging, "slow-powers-eval-", 2, "with_skill", "my-skill");
+    if !sample.starts_with("slow-powers-eval-") {
+        return fail(format!(
+            "the staged slug must preserve the prefix (cleanup prefix-scans rely on it); \
+             sample slug: \"{sample}\""
+        ));
+    }
+    if let Some(message) = stage_name_error(&d.staging, stage_regex.as_ref(), &sample) {
+        return fail(format!(
+            "the staged slug \"{sample}\" fails its own stage-name rules ({message}); \
+             align staging.slug_template/slug_capability with the naming rules"
+        ));
+    }
+
+    // The skills dir must live under a declared config dir, or staging's
+    // sibling-asset filter would copy a checked-in copy into staged envs.
+    if let Some(skills_dir) = &d.skills_dir {
+        let top = skills_dir.split('/').next().unwrap_or_default();
+        if !d.config_dirs.iter().any(|dir| dir == top) {
+            return fail(format!(
+                "config_dirs {:?} misses \"{top}\", the parent of skills_dir — staging's \
+                 sibling-asset filter and the guard tamper rules key off config_dirs",
+                d.config_dirs
+            ));
+        }
+    }
+
+    // The guard block is rendered by the generic engine at arm/verdict time,
+    // and the guard fails open — so every data contract is proven here, before
+    // any run arms the hook.
+    if let Some(guard) = &d.guard {
+        // Every tool the guard hooks must be declared in the vocabulary, or
+        // the write-guard arbiter would silently wave it through.
+        let vocabulary: Vec<&str> = d
+            .tools
+            .write
+            .iter()
+            .chain(&d.tools.patch)
+            .chain(&d.tools.shell)
+            .map(String::as_str)
+            .collect();
+        for token in guard.matcher.split('|') {
+            let token = token.trim_matches(['^', '$']);
+            if !vocabulary.contains(&token) {
+                return fail(format!(
+                    "the guard matcher hooks tool \"{token}\" but [tools] does not declare it \
+                     in write/patch/shell — the write-guard arbiter would not recognize it"
+                ));
+            }
+        }
+
+        if guard.hooks_file.starts_with('/')
+            || guard
+                .hooks_file
+                .split('/')
+                .any(|seg| seg.is_empty() || seg == "." || seg == "..")
+        {
+            return fail(format!(
+                "guard.hooks_file must be a relative `/`-separated path without \".\" or \
+                 \"..\" segments (got \"{}\") — it resolves under the staged env root",
+                guard.hooks_file
+            ));
+        }
+
+        for placeholder in ["{exe}", "{marker}"] {
+            if !guard.command_template.contains(placeholder) {
+                return fail(format!(
+                    "guard.command_template must reference {placeholder} — the armed hook \
+                     invokes this binary with the marker path"
+                ));
+            }
+        }
+
+        match serde_json::from_str::<serde_json::Value>(&guard.hook_entry) {
+            Err(e) => {
+                return fail(format!(
+                    "guard.hook_entry does not parse as JSON ({e}); it is the hook object \
+                     appended to the harness's hook config"
+                ));
+            }
+            Ok(entry) => {
+                if !entry.is_object() {
+                    return fail(
+                        "guard.hook_entry must be a JSON object — it is appended to the hook \
+                         config's hooks.PreToolUse array"
+                            .into(),
+                    );
+                }
+                for placeholder in ["{matcher}", "{command}"] {
+                    if !guard::any_string_value_contains(&entry, placeholder) {
+                        return fail(format!(
+                            "guard.hook_entry must reference the {placeholder} placeholder in \
+                             a string value — placeholders substitute into string values only, \
+                             so anywhere else would render an inert hook"
+                        ));
+                    }
+                }
+            }
+        }
+
+        match serde_json::from_str::<serde_json::Value>(&guard.verdict_template) {
+            Err(e) => {
+                return fail(format!(
+                    "guard.verdict_template does not parse as JSON ({e}); it is printed \
+                     verbatim as the deny verdict"
+                ));
+            }
+            Ok(verdict) => {
+                if !guard::any_string_value_contains(&verdict, "{reason}") {
+                    return fail(
+                        "guard.verdict_template must reference the {reason} placeholder in a \
+                         string value — a deny verdict that hides the reason is undebuggable"
+                            .into(),
+                    );
+                }
+            }
+        }
+    }
+
+    // A transcript parser without a write/shell vocabulary makes the
+    // stray-writes audit a silent no-op.
+    if d.transcript.is_some() && (d.tools.write.is_empty() || d.tools.shell.is_empty()) {
+        return fail(
+            "[transcript] is declared but [tools] write/shell are empty; \
+             detect-stray-writes would audit nothing — declare the harness's tool names"
+                .into(),
+        );
+    }
+
+    // Transcript ingest reads through exactly one tier: a named code parser
+    // or the declarative extract block.
+    if let Some(transcript) = &d.transcript {
+        match (&transcript.parser, &transcript.extract) {
+            (Some(_), Some(_)) => {
+                return fail(
+                    "[transcript] declares both a parser and an extract block; ingest reads \
+                     through exactly one — drop one of them. Layered overrides merge fields \
+                     and cannot delete an inherited parser, so moving a harness from parser \
+                     to extract needs a new label rather than an overlay"
+                        .into(),
+                );
+            }
+            (None, None) => {
+                return fail(
+                    "[transcript] declares neither a parser nor an extract block; declare \
+                     exactly one — name a parser capability or add [transcript.extract] — \
+                     or drop the table and let llm_judge carry the grading"
+                        .into(),
+                );
+            }
+            _ => {}
+        }
+        if let Some(extract) = &transcript.extract {
+            if extract.tools.is_none()
+                && extract.final_text.is_none()
+                && extract.tokens.is_none()
+                && extract.duration.is_none()
+            {
+                return fail(
+                    "[transcript.extract] declares none of tools/final_text/tokens/duration; \
+                     an empty extract block parses nothing — declare at least one output"
+                        .into(),
+                );
+            }
+            if let Some(duration) = &extract.duration
+                && duration.field.is_some() == duration.timestamp_spread.is_some()
+            {
+                return fail(
+                    "[transcript.extract.duration] must declare exactly one of field \
+                     (a millisecond pick) or timestamp_spread (last minus first timestamp)"
+                        .into(),
+                );
+            }
+        }
+    }
+
+    // Tool roles are disjoint: one name in two roles would double-classify
+    // invocations in the stray-writes audit.
+    let mut seen: Vec<&str> = Vec::new();
+    for name in d
+        .tools
+        .write
+        .iter()
+        .chain(&d.tools.patch)
+        .chain(&d.tools.shell)
+        .chain(&d.tools.read)
+    {
+        if seen.contains(&name.as_str()) {
+            return fail(format!(
+                "tool \"{name}\" appears in more than one [tools] role — \
+                 write/patch/shell/read must be disjoint"
+            ));
+        }
+        seen.push(name);
+    }
+
+    // The judge command line splices into the shared judge recipe; its
+    // contract (see cli_command::render_judge_dispatch_recipe) is checkable
+    // here rather than at render time.
+    if let Some(judge) = &d.dispatch.judge_command_template {
+        if d.model.is_none() {
+            return fail(
+                "dispatch.judge_command_template requires model.flag — the judge recipe \
+                 splices \"$model_arg\" from each task's model via the model flag"
+                    .into(),
+            );
+        }
+        if d.dispatch.capture_prefix.is_none() {
+            return fail(
+                "dispatch.judge_command_template requires dispatch.capture_prefix — it names \
+                 the per-task $response_base capture files"
+                    .into(),
+            );
+        }
+        if !judge.contains("$model_arg") {
+            return fail(
+                "dispatch.judge_command_template must reference $model_arg (empty when a task \
+                 declares no model)"
+                    .into(),
+            );
+        }
+        if !judge.contains("{cwd}") {
+            return fail(
+                "dispatch.judge_command_template must contain {cwd} — judges run from the \
+                 iteration dir"
+                    .into(),
+            );
+        }
+        if !judge.ends_with(" \\") {
+            return fail(
+                "dispatch.judge_command_template must end with a shell line continuation \
+                 (\" \\\") so the recipe's prompt line follows it"
+                    .into(),
+            );
+        }
+    }
+
+    // Placeholders must have a backing field, or the template renders with the
+    // token left in (the artifact tests' `!contains(\"{{\")` rule, at load time).
+    let dispatch = &d.dispatch;
+    let pairings: [(&Option<String>, &str, &str, bool); 7] = [
+        (
+            &dispatch.next_steps_template,
+            "next_steps_template",
+            "{exec_command}",
+            dispatch.exec_template.is_some(),
+        ),
+        (
+            &dispatch.next_steps_template,
+            "next_steps_template",
+            "{model_note}",
+            dispatch.model_note.is_some(),
+        ),
+        (
+            &dispatch.manifest_template,
+            "manifest_template",
+            "{exec_command}",
+            dispatch.exec_template.is_some(),
+        ),
+        (
+            &dispatch.manifest_template,
+            "manifest_template",
+            "{parallel_recipe}",
+            dispatch.parallel_command_template.is_some(),
+        ),
+        (
+            &dispatch.exec_template,
+            "exec_template",
+            "{guard_args}",
+            dispatch.guard_args.is_some(),
+        ),
+        (
+            &dispatch.parallel_command_template,
+            "parallel_command_template",
+            "{guard_args}",
+            dispatch.guard_args.is_some(),
+        ),
+        (
+            &dispatch.judge_command_template,
+            "judge_command_template",
+            "{guard_args}",
+            dispatch.guard_args.is_some(),
+        ),
+    ];
+    for (template, template_name, placeholder, backed) in pairings {
+        if template.as_deref().is_some_and(|t| t.contains(placeholder)) && !backed {
+            return fail(format!(
+                "dispatch.{template_name} references {placeholder} but the field that fills \
+                 it is not set"
+            ));
+        }
+    }
+
+    // The manifest template is spliced as `split('\n')` lines; exactly one
+    // trailing newline reproduces the section's closing blank line.
+    if let Some(manifest) = &d.dispatch.manifest_template
+        && (!manifest.ends_with('\n') || manifest.ends_with("\n\n"))
+    {
+        return fail(
+            "dispatch.manifest_template must end with exactly one trailing newline — it \
+             becomes the manifest section's closing blank line"
+                .into(),
+        );
+    }
+
+    // A skills-block item that never names the skill renders an unusable list.
+    if let Some(block) = &d.skills_block
+        && !block.item.contains("{name}")
+    {
+        return fail("skills_block.item must contain {name}".into());
+    }
+
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::super::load_descriptor;
+
+    /// Load through the full pipeline so each rejection test proves the
+    /// invariant fires on a descriptor that already passed the schema gate.
+    fn err_of(toml_src: &str) -> String {
+        load_descriptor(toml_src, "test.toml")
+            .expect_err("descriptor should be rejected")
+            .to_string()
+    }
+
+    const MINIMAL: &str = r#"
+label = "demo"
+skills_dir = ".demo/skills"
+config_dirs = [".demo"]
+"#;
+
+    /// A guard-wired descriptor whose tool vocabulary covers its matcher; the
+    /// base for guard/matcher mutation tests.
+    const GUARDED: &str = r#"
+label = "demo"
+skills_dir = ".demo/skills"
+config_dirs = [".demo"]
+
+[run]
+supports_guard = true
+
+[tools]
+write = ["Edit", "MultiEdit", "NotebookEdit", "Write"]
+shell = ["Bash"]
+
+[guard]
+hooks_file = ".demo/hooks.json"
+matcher = "Write|Edit|MultiEdit|NotebookEdit|Bash"
+command_template = '"{exe}" guard-hook --harness demo "{marker}"'
+hook_entry = '{"matcher":"{matcher}","hooks":[{"type":"command","command":"{command}"}]}'
+verdict_template = '{"decision":"block","reason":"{reason}"}'
+armed_message = "guard armed"
+"#;
+
+    #[test]
+    fn rejects_guard_support_without_guard_table() {
+        let err = err_of(&format!("{MINIMAL}\n[run]\nsupports_guard = true\n"));
+        assert!(err.contains("run.supports_guard"), "{err}");
+        assert!(err.contains("lockstep"), "{err}");
+    }
+
+    #[test]
+    fn rejects_guard_table_without_guard_support() {
+        let err = err_of(&GUARDED.replace("supports_guard = true", "supports_guard = false"));
+        assert!(err.contains("run.supports_guard"), "{err}");
+        assert!(err.contains("lockstep"), "{err}");
+    }
+
+    #[test]
+    fn rejects_slug_template_missing_a_placeholder() {
+        let err = err_of(&format!(
+            "{MINIMAL}\n[staging]\nslug_template = \"{{prefix}}{{iteration}}-{{condition}}\"\n"
+        ));
+        assert!(err.contains("staging.slug_template"), "{err}");
+        assert!(err.contains("{skill_name}"), "{err}");
+    }
+
+    #[test]
+    fn rejects_slug_template_and_capability_together() {
+        let err = err_of(&format!(
+            "{MINIMAL}\n[staging]\nslug_template = \"{{prefix}}{{iteration}}-{{condition}}__{{skill_name}}\"\nslug_capability = \"opencode\"\n"
+        ));
+        assert!(err.contains("not both"), "{err}");
+    }
+
+    #[test]
+    fn rejects_slug_that_fails_its_own_stage_name_rules() {
+        // The default slug shape emits `__`, which the single-hyphen pattern
+        // rejects — the staged-slug↔naming-rules invariant.
+        let err = err_of(&format!(
+            "{MINIMAL}\n[staging]\nslug_template = \"{{prefix}}{{iteration}}-{{condition}}__{{skill_name}}\"\nstage_name_pattern = \"^[a-z0-9]+(-[a-z0-9]+)*$\"\nstage_name_max_len = 64\n"
+        ));
+        assert!(err.contains("stage-name rules"), "{err}");
+    }
+
+    #[test]
+    fn rejects_config_dirs_missing_skills_dir_parent() {
+        let err = err_of(&MINIMAL.replace("[\".demo\"]", "[\".other\"]"));
+        assert!(err.contains("parent of skills_dir"), "{err}");
+        assert!(err.contains(".demo"), "{err}");
+    }
+
+    #[test]
+    fn rejects_guard_matcher_tool_missing_from_vocabulary() {
+        // The matcher hooks Write|Edit|MultiEdit|NotebookEdit|Bash; drop Bash
+        // from the shell vocabulary and the arbiter would wave it through.
+        let err = err_of(&GUARDED.replace("shell = [\"Bash\"]", "shell = [\"Shell\"]"));
+        assert!(err.contains("Bash"), "{err}");
+        assert!(err.contains("[tools]"), "{err}");
+    }
+
+    #[test]
+    fn rejects_hook_entry_that_is_not_json() {
+        let err = err_of(&GUARDED.replace(
+            r#"hook_entry = '{"matcher":"{matcher}","hooks":[{"type":"command","command":"{command}"}]}'"#,
+            "hook_entry = 'not json'",
+        ));
+        assert!(err.contains("guard.hook_entry"), "{err}");
+        assert!(err.contains("JSON"), "{err}");
+    }
+
+    #[test]
+    fn rejects_hook_entry_missing_a_placeholder() {
+        // {command} in a JSON *key* must not count: only string values are
+        // substituted, so a key-side placeholder would render an inert hook.
+        for (mutated, needle) in [
+            (
+                r#"hook_entry = '{"matcher":"{matcher}","hooks":[{"type":"command","{command}":"x"}]}'"#,
+                "{command}",
+            ),
+            (
+                r#"hook_entry = '{"matcher":"Write","hooks":[{"type":"command","command":"{command}"}]}'"#,
+                "{matcher}",
+            ),
+        ] {
+            let err = err_of(&GUARDED.replace(
+                r#"hook_entry = '{"matcher":"{matcher}","hooks":[{"type":"command","command":"{command}"}]}'"#,
+                mutated,
+            ));
+            assert!(err.contains("guard.hook_entry"), "{err}");
+            assert!(err.contains(needle), "expected {needle} in: {err}");
+        }
+    }
+
+    #[test]
+    fn rejects_verdict_template_that_is_not_json() {
+        let err = err_of(&GUARDED.replace(
+            r#"verdict_template = '{"decision":"block","reason":"{reason}"}'"#,
+            "verdict_template = 'block it'",
+        ));
+        assert!(err.contains("guard.verdict_template"), "{err}");
+        assert!(err.contains("JSON"), "{err}");
+    }
+
+    #[test]
+    fn rejects_verdict_template_without_reason_placeholder() {
+        let err = err_of(&GUARDED.replace(
+            r#"verdict_template = '{"decision":"block","reason":"{reason}"}'"#,
+            r#"verdict_template = '{"decision":"block"}'"#,
+        ));
+        assert!(err.contains("guard.verdict_template"), "{err}");
+        assert!(err.contains("{reason}"), "{err}");
+    }
+
+    #[test]
+    fn rejects_command_template_missing_exe_or_marker() {
+        for (mutated, needle) in [
+            (
+                r#"command_template = 'eval-magic guard-hook "{marker}"'"#,
+                "{exe}",
+            ),
+            (
+                r#"command_template = '"{exe}" guard-hook --harness demo'"#,
+                "{marker}",
+            ),
+        ] {
+            let err = err_of(&GUARDED.replace(
+                r#"command_template = '"{exe}" guard-hook --harness demo "{marker}"'"#,
+                mutated,
+            ));
+            assert!(err.contains("guard.command_template"), "{err}");
+            assert!(err.contains(needle), "expected {needle} in: {err}");
+        }
+    }
+
+    #[test]
+    fn rejects_hooks_file_that_escapes_the_env() {
+        for mutated in [
+            "hooks_file = \"/etc/hooks.json\"",
+            "hooks_file = \"../hooks.json\"",
+            "hooks_file = \"./hooks.json\"",
+        ] {
+            let err = err_of(&GUARDED.replace("hooks_file = \".demo/hooks.json\"", mutated));
+            assert!(err.contains("guard.hooks_file"), "{err}");
+            assert!(err.contains("relative"), "{err}");
+        }
+    }
+
+    #[test]
+    fn rejects_transcript_without_write_and_shell_tools() {
+        let err = err_of(&format!(
+            "{MINIMAL}\n[transcript]\nevents_filename = \"demo-events.jsonl\"\nparser = \"codex-items\"\n"
+        ));
+        assert!(err.contains("detect-stray-writes"), "{err}");
+    }
+
+    /// Transcript-shape tests need a tool vocabulary so only the shape rule
+    /// under test can fire.
+    const TOOLED: &str = r#"
+label = "demo"
+skills_dir = ".demo/skills"
+config_dirs = [".demo"]
+
+[tools]
+write = ["file_change"]
+shell = ["command_execution"]
+"#;
+
+    #[test]
+    fn rejects_extract_transcript_without_write_and_shell_tools() {
+        let err = err_of(&format!(
+            "{MINIMAL}\n[transcript]\nevents_filename = \"demo-events.jsonl\"\n\n\
+             [transcript.extract.final_text]\nfield = \"text\"\n"
+        ));
+        assert!(err.contains("detect-stray-writes"), "{err}");
+    }
+
+    #[test]
+    fn rejects_transcript_with_parser_and_extract() {
+        let err = err_of(&format!(
+            "{TOOLED}\n[transcript]\nevents_filename = \"demo-events.jsonl\"\nparser = \"codex-items\"\n\n\
+             [transcript.extract.final_text]\nfield = \"text\"\n"
+        ));
+        assert!(err.contains("exactly one"), "{err}");
+        assert!(err.contains("new label"), "{err}");
+    }
+
+    #[test]
+    fn rejects_transcript_with_neither_parser_nor_extract() {
+        let err = err_of(&format!(
+            "{TOOLED}\n[transcript]\nevents_filename = \"demo-events.jsonl\"\n"
+        ));
+        assert!(err.contains("exactly one"), "{err}");
+        assert!(err.contains("llm_judge"), "{err}");
+    }
+
+    #[test]
+    fn rejects_empty_extract_block() {
+        let err = err_of(&format!(
+            "{TOOLED}\n[transcript]\nevents_filename = \"demo-events.jsonl\"\n\n[transcript.extract]\n"
+        ));
+        assert!(err.contains("[transcript.extract]"), "{err}");
+        assert!(err.contains("at least one"), "{err}");
+    }
+
+    #[test]
+    fn rejects_duration_with_both_variants_or_neither() {
+        for duration_block in [
+            "field = \"elapsed_ms\"\ntimestamp_spread = \"timestamp\"\n",
+            "",
+        ] {
+            let err = err_of(&format!(
+                "{TOOLED}\n[transcript]\nevents_filename = \"demo-events.jsonl\"\n\n\
+                 [transcript.extract.duration]\n{duration_block}"
+            ));
+            assert!(err.contains("duration"), "{err}");
+            assert!(err.contains("exactly one"), "{err}");
+        }
+    }
+
+    #[test]
+    fn rejects_tool_declared_in_more_than_one_role() {
+        let err = err_of(&format!(
+            "{MINIMAL}\n[tools]\nwrite = [\"Edit\"]\nshell = [\"Edit\"]\n"
+        ));
+        assert!(err.contains("more than one [tools] role"), "{err}");
+        assert!(err.contains("Edit"), "{err}");
+    }
+
+    #[test]
+    fn rejects_judge_template_without_model_flag() {
+        let err = err_of(&format!(
+            "{MINIMAL}\n[dispatch]\ncapture_prefix = \"demo\"\njudge_command_template = '    demo --cd \"{{cwd}}\" $model_arg \\'\n"
+        ));
+        assert!(err.contains("model.flag"), "{err}");
+    }
+
+    #[test]
+    fn rejects_judge_template_violating_the_recipe_contract() {
+        for (template, needle) in [
+            ("'    demo --cd \"{cwd}\" \\'", "$model_arg"),
+            ("'    demo $model_arg \\'", "{cwd}"),
+            ("'    demo --cd \"{cwd}\" $model_arg'", "line continuation"),
+        ] {
+            let err = err_of(&format!(
+                "{MINIMAL}\n[model]\nflag = \"-m\"\n\n[dispatch]\ncapture_prefix = \"demo\"\njudge_command_template = {template}\n"
+            ));
+            assert!(err.contains(needle), "expected {needle} in: {err}");
+        }
+    }
+
+    #[test]
+    fn rejects_judge_template_without_capture_prefix() {
+        let err = err_of(&format!(
+            "{MINIMAL}\n[model]\nflag = \"-m\"\n\n[dispatch]\njudge_command_template = '    demo --cd \"{{cwd}}\" $model_arg \\'\n"
+        ));
+        assert!(err.contains("capture_prefix"), "{err}");
+    }
+
+    #[test]
+    fn rejects_template_placeholders_without_backing_fields() {
+        for (dispatch_body, needle) in [
+            (
+                "next_steps_template = \"do {exec_command} now\"",
+                "{exec_command}",
+            ),
+            (
+                "next_steps_template = \"go.{model_note} then\"",
+                "{model_note}",
+            ),
+            ("exec_template = \"demo{guard_args} run\"", "{guard_args}"),
+            (
+                "exec_template = \"demo run\"\nmanifest_template = \"use:\\n{exec_command}\\n{parallel_recipe}\\n\"",
+                "{parallel_recipe}",
+            ),
+        ] {
+            let err = err_of(&format!("{MINIMAL}\n[dispatch]\n{dispatch_body}\n"));
+            assert!(err.contains(needle), "expected {needle} in: {err}");
+        }
+    }
+
+    #[test]
+    fn rejects_manifest_template_without_single_trailing_newline() {
+        for manifest in [
+            "\"use:\\n{exec_command}\"",
+            "\"use:\\n{exec_command}\\n\\n\"",
+        ] {
+            let err = err_of(&format!(
+                "{MINIMAL}\n[dispatch]\nexec_template = \"demo run\"\nmanifest_template = {manifest}\n"
+            ));
+            assert!(err.contains("exactly one trailing newline"), "{err}");
+        }
+    }
+
+    #[test]
+    fn rejects_skills_block_item_without_name_placeholder() {
+        let err = err_of(&format!(
+            "{MINIMAL}\n[skills_block]\nheader = \"Skills:\"\nitem = \"- {{description}}\"\n"
+        ));
+        assert!(err.contains("{name}"), "{err}");
+    }
+
+    #[test]
+    fn rejects_stage_name_pattern_that_does_not_compile() {
+        let err = err_of(&format!(
+            "{MINIMAL}\n[staging]\nstage_name_pattern = \"[unclosed\"\n"
+        ));
+        assert!(err.contains("does not compile"), "{err}");
+    }
+}
diff --git a/src/adapters/descriptor_adapter.rs b/src/adapters/descriptor_adapter.rs
new file mode 100644
index 0000000..39bdd58
--- /dev/null
+++ b/src/adapters/descriptor_adapter.rs
@@ -0,0 +1,624 @@
+//! The generic descriptor-backed [`HarnessAdapter`]: one implementation
+//! serving every harness, reading declarative values from a validated
+//! [`HarnessDescriptor`] and dispatching code-backed features through the
+//! named capabilities in [`super::capabilities`].
+
+use std::io;
+use std::path::{Path, PathBuf};
+use std::time::Duration;
+
+use regex::Regex;
+
+use crate::core::{AvailableSkill, HarnessRunCapabilities, ToolInvocation};
+use crate::sandbox::GuardMarker;
+
+use super::TranscriptSummary;
+use super::cli_command::{
+    render_cli_model_arg, render_judge_dispatch_recipe, render_parallel_dispatch_recipe,
+};
+use super::descriptor::{HarnessDescriptor, render_staged_slug, stage_name_error, subst};
+use super::harness::{
+    CliDispatchContext, CliJudgeContext, CliManifestContext, HarnessAdapter, ToolVocabulary,
+};
+use super::skill_shadow::PluginShadowReport;
+use super::skills_block::{DEFAULT_HEADER, DEFAULT_ITEM, render_skills_block};
+
+/// A [`HarnessAdapter`] backed by a validated [`HarnessDescriptor`].
+#[derive(Debug)]
+pub struct DescriptorAdapter {
+    descriptor: HarnessDescriptor,
+    /// Compiled `staging.stage_name_pattern`; validated to compile at load
+    /// time, compiled once here.
+    stage_name_regex: Option<Regex>,
+}
+
+impl DescriptorAdapter {
+    /// Wrap a descriptor that already passed
+    /// [`load_descriptor`](super::descriptor::load_descriptor) (which proves
+    /// the stage-name pattern compiles).
+    pub fn from_descriptor(descriptor: HarnessDescriptor) -> Self {
+        let stage_name_regex = descriptor
+            .staging
+            .stage_name_pattern
+            .as_deref()
+            .map(|pattern| {
+                Regex::new(pattern).expect("stage_name_pattern is validated at descriptor load")
+            });
+        DescriptorAdapter {
+            descriptor,
+            stage_name_regex,
+        }
+    }
+
+    /// The resolved descriptor behind this adapter — the `harness show`/`list`
+    /// data source.
+    pub(crate) fn descriptor(&self) -> &HarnessDescriptor {
+        &self.descriptor
+    }
+
+    /// The single-dispatch command: the exec template with `{model_arg}` /
+    /// `{guard_args}` filled for this run. Empty when no template is wired.
+    fn exec_command(&self, guard: bool, agent_model: Option<&str>) -> String {
+        let Some(template) = &self.descriptor.dispatch.exec_template else {
+            return String::new();
+        };
+        let model_arg = render_cli_model_arg(self.model_flag(), agent_model);
+        subst(
+            template,
+            &[
+                ("model_arg", &model_arg),
+                ("guard_args", self.guard_args(guard)),
+            ],
+        )
+    }
+
+    /// The `{guard_args}` value for this run: the descriptor's fragment when
+    /// the guard is armed, empty otherwise.
+    fn guard_args(&self, guard: bool) -> &str {
+        if guard {
+            self.descriptor.dispatch.guard_args.as_deref().unwrap_or("")
+        } else {
+            ""
+        }
+    }
+
+    fn model_flag(&self) -> Option<&str> {
+        self.descriptor.model.as_ref().map(|m| m.flag.as_str())
+    }
+}
+
+impl HarnessAdapter for DescriptorAdapter {
+    fn label(&self) -> String {
+        self.descriptor.label.clone()
+    }
+
+    fn skills_dir(&self, repo_root: &Path) -> Option<PathBuf> {
+        self.descriptor.skills_dir.as_ref().map(|dir| {
+            dir.split('/')
+                .fold(repo_root.to_path_buf(), |path, segment| path.join(segment))
+        })
+    }
+
+    fn run_capabilities(&self) -> HarnessRunCapabilities {
+        HarnessRunCapabilities {
+            supports_guard: self.descriptor.run.supports_guard,
+            supports_bootstrap_with_no_stage: self.descriptor.run.supports_bootstrap_with_no_stage,
+            supports_stage_name_with_no_stage: self
+                .descriptor
+                .run
+                .supports_stage_name_with_no_stage,
+        }
+    }
+
+    fn config_dir_names(&self) -> Vec<String> {
+        self.descriptor.config_dirs.clone()
+    }
+
+    fn tool_vocabulary(&self) -> ToolVocabulary {
+        ToolVocabulary {
+            write_tools: self.descriptor.tools.write.clone(),
+            patch_tools: self.descriptor.tools.patch.clone(),
+            shell_tools: self.descriptor.tools.shell.clone(),
+            read_tools: self.descriptor.tools.read.clone(),
+        }
+    }
+
+    fn staged_slug(
+        &self,
+        prefix: &str,
+        iteration: u32,
+        condition: &str,
+        skill_name: &str,
+    ) -> String {
+        render_staged_slug(
+            &self.descriptor.staging,
+            prefix,
+            iteration,
+            condition,
+            skill_name,
+        )
+    }
+
+    fn validate_stage_name(&self, name: &str) -> Result<(), String> {
+        match stage_name_error(
+            &self.descriptor.staging,
+            self.stage_name_regex.as_ref(),
+            name,
+        ) {
+            Some(message) => Err(message),
+            None => Ok(()),
+        }
+    }
+
+    fn rewrites_frontmatter_name(&self) -> bool {
+        self.descriptor.staging.rewrites_frontmatter_name
+    }
+
+    fn advertises_staged_slug_name(&self) -> bool {
+        self.descriptor.staging.advertises_staged_slug_name
+    }
+
+    fn render_available_skills_block(&self, skills: &[AvailableSkill]) -> String {
+        match &self.descriptor.skills_block {
+            Some(block) => render_skills_block(&block.header, &block.item, &block.footer, skills),
+            None => render_skills_block(DEFAULT_HEADER, DEFAULT_ITEM, "", skills),
+        }
+    }
+
+    fn skill_surface_phrase(&self) -> String {
+        self.descriptor
+            .staging
+            .surface_phrase
+            .clone()
+            .unwrap_or_else(|| "as a discoverable skill".to_string())
+    }
+
+    fn skill_unresolved_phrase(&self) -> String {
+        self.descriptor
+            .staging
+            .unresolved_phrase
+            .clone()
+            .unwrap_or_else(|| "If the staged skill cannot be resolved".to_string())
+    }
+
+    fn cli_events_filename(&self) -> Option<String> {
+        self.descriptor
+            .transcript
+            .as_ref()
+            .map(|t| t.events_filename.clone())
+    }
+
+    fn parse_cli_events(&self, path: &Path) -> io::Result<Vec<ToolInvocation>> {
+        match &self.descriptor.transcript {
+            Some(transcript) => transcript.parse(path),
+            None => Err(io::Error::new(
+                io::ErrorKind::Unsupported,
+                format!(
+                    "transcript ingest is not wired for the {} harness",
+                    self.label()
+                ),
+            )),
+        }
+    }
+
+    fn parse_cli_events_full(&self, path: &Path) -> io::Result<TranscriptSummary> {
+        match &self.descriptor.transcript {
+            Some(transcript) => transcript.parse_full(path),
+            None => Err(io::Error::new(
+                io::ErrorKind::Unsupported,
+                format!(
+                    "transcript ingest is not wired for the {} harness",
+                    self.label()
+                ),
+            )),
+        }
+    }
+
+    fn transcript_surfaces_skill_invocation(&self) -> bool {
+        self.descriptor
+            .transcript
+            .as_ref()
+            .is_none_or(|t| t.surfaces_skill_invocation)
+    }
+
+    fn cli_model_flag(&self) -> Option<String> {
+        self.model_flag().map(str::to_string)
+    }
+
+    fn install_guard(
+        &self,
+        stage_root: &Path,
+        guard_exe: &Path,
+        ttl: Option<Duration>,
+    ) -> io::Result<PathBuf> {
+        match &self.descriptor.guard {
+            Some(guard) => {
+                let skills_dir = self
+                    .skills_dir(stage_root)
+                    .expect("descriptor validation pairs [guard] with skills_dir");
+                super::guard::install_guard(guard, &skills_dir, stage_root, guard_exe, ttl)
+            }
+            None => Err(io::Error::new(
+                io::ErrorKind::Unsupported,
+                format!("--guard is not supported for the {} harness", self.label()),
+            )),
+        }
+    }
+
+    fn guard_armed_message(&self) -> Option<String> {
+        self.descriptor
+            .guard
+            .as_ref()
+            .map(|g| g.armed_message.clone())
+    }
+
+    fn guard_verdict(&self, payload: &str, marker: Option<GuardMarker>) -> Option<String> {
+        let guard = self.descriptor.guard.as_ref()?;
+        super::guard::guard_verdict(guard, payload, marker)
+    }
+
+    fn guard_hook_cleanup_dir(&self, stage_root: &Path) -> Option<PathBuf> {
+        self.descriptor.guard.as_ref().and_then(|g| {
+            super::guard::hook_cleanup_dir(g, self.descriptor.skills_dir.as_deref(), stage_root)
+        })
+    }
+
+    fn detect_shadowed_skills(
+        &self,
+        scan_root: &Path,
+        staged_skill_names: &[&str],
+    ) -> Option<PluginShadowReport> {
+        self.descriptor
+            .shadow
+            .as_ref()
+            .and_then(|s| s.preflight.detect(scan_root, staged_skill_names))
+    }
+
+    fn has_dispatch_recipes(&self) -> bool {
+        self.descriptor.dispatch.exec_template.is_some()
+    }
+
+    fn cli_next_steps(&self, ctx: CliDispatchContext<'_>) -> String {
+        let ingest_line = format!(
+            "ingest{} --iteration {} --harness {}",
+            ctx.target_args, ctx.iteration, self.descriptor.label
+        );
+        let Some(template) = &self.descriptor.dispatch.next_steps_template else {
+            // Generic fallbacks: a descriptor with just an exec template still
+            // earns a copy-pasteable recipe; a baseline descriptor gets the
+            // harness-agnostic handoff.
+            return match &self.descriptor.dispatch.exec_template {
+                Some(_) => format!(
+                    "\nNext: iterate the tasks[] array in dispatch.json and dispatch each task \
+                     with:\n{}\nThen run `{ingest_line}`.",
+                    self.exec_command(ctx.guard, ctx.agent_model)
+                ),
+                None => format!(
+                    "\nNext: read dispatch-manifest.md and dispatch each task through your \
+                     harness's one-shot CLI from the task's eval_root, saving the agent's \
+                     final reply to outputs/final-message.md.\nThen run `{ingest_line}`."
+                ),
+            };
+        };
+        let exec_command = self.exec_command(ctx.guard, ctx.agent_model);
+        let iteration = ctx.iteration.to_string();
+        let model_note = if ctx.agent_model.is_some() {
+            self.descriptor.dispatch.model_note.as_deref().unwrap_or("")
+        } else {
+            ""
+        };
+        subst(
+            template,
+            &[
+                ("exec_command", &exec_command),
+                ("target_args", ctx.target_args),
+                ("iteration", &iteration),
+                ("model_note", model_note),
+            ],
+        )
+    }
+
+    fn cli_manifest_section(&self, ctx: CliManifestContext<'_>) -> Option<Vec<String>> {
+        let Some(template) = self.descriptor.dispatch.manifest_template.as_ref() else {
+            // An exec template without a manifest template still earns a
+            // generic recipe section; without either, the manifest's shared
+            // header text already covers the baseline handoff.
+            self.descriptor.dispatch.exec_template.as_ref()?;
+            let exec_command = self.exec_command(ctx.guard, ctx.agent_model);
+            return Some(
+                format!(
+                    "## Dispatch recipe\n\nFrom each task's `eval_root`, dispatch with:\n\
+                     {exec_command}\n\nEnsure the agent's final reply lands in the task's \
+                     `outputs/final-message.md` (capture it yourself if the command does not \
+                     write it).\n"
+                )
+                .split('\n')
+                .map(String::from)
+                .collect(),
+            );
+        };
+        let exec_command = self.exec_command(ctx.guard, ctx.agent_model);
+        let parallel_recipe = match &self.descriptor.dispatch.parallel_command_template {
+            Some(block_template) => {
+                let model_arg = render_cli_model_arg(self.model_flag(), ctx.agent_model);
+                render_parallel_dispatch_recipe(&subst(
+                    block_template,
+                    &[
+                        ("model_arg", &model_arg),
+                        ("guard_args", self.guard_args(ctx.guard)),
+                    ],
+                ))
+            }
+            None => String::new(),
+        };
+        Some(
+            subst(
+                template,
+                &[
+                    ("exec_command", &exec_command),
+                    ("parallel_recipe", &parallel_recipe),
+                ],
+            )
+            .split('\n')
+            .map(String::from)
+            .collect(),
+        )
+    }
+
+    fn cli_judge_next_steps(&self, ctx: CliJudgeContext<'_>) -> Option<String> {
+        let template = self.descriptor.dispatch.judge_command_template.as_ref()?;
+        let cwd = ctx.iteration_dir.display().to_string();
+        let command_line = subst(
+            template,
+            &[("cwd", &cwd), ("guard_args", self.guard_args(ctx.guard))],
+        );
+        Some(render_judge_dispatch_recipe(
+            &command_line,
+            // Both guaranteed by descriptor validation when the template is set.
+            self.model_flag().unwrap_or_default(),
+            self.descriptor
+                .dispatch
+                .capture_prefix
+                .as_deref()
+                .unwrap_or_default(),
+        ))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::path::Path;
+
+    use crate::adapters::harness::{CliDispatchContext, CliJudgeContext};
+    use crate::adapters::registry::adapter_for;
+    use crate::core::{AvailableSkill, Harness};
+
+    fn skill(name: &str, description: &str) -> AvailableSkill {
+        AvailableSkill {
+            name: name.into(),
+            path: format!("/x/{name}/SKILL.md"),
+            description: description.into(),
+        }
+    }
+
+    fn next_steps(harness: Harness, agent_model: Option<&str>) -> String {
+        adapter_for(harness).cli_next_steps(CliDispatchContext {
+            guard: harness == Harness::resolve("codex").unwrap(),
+            target_args: " --skill-dir /tmp/skills --skill widget-skill",
+            iteration: 2,
+            agent_model,
+        })
+    }
+
+    fn adapter_from(toml_src: &str) -> super::DescriptorAdapter {
+        super::DescriptorAdapter::from_descriptor(
+            crate::adapters::descriptor::load_descriptor(toml_src, "test.toml").unwrap(),
+        )
+    }
+
+    #[test]
+    fn exec_template_alone_yields_generic_dispatch_recipes() {
+        use crate::adapters::harness::{CliManifestContext, HarnessAdapter};
+        let adapter = adapter_from(
+            "label = \"cool-custom-harness\"\n\n[dispatch]\nexec_template = \"cool-cli run <dispatch_prompt_path>{model_arg}\"\n",
+        );
+        let next = adapter.cli_next_steps(CliDispatchContext {
+            guard: false,
+            target_args: " --skill-dir /s --skill x",
+            iteration: 3,
+            agent_model: None,
+        });
+        assert!(next.contains("cool-cli run"), "{next}");
+        assert!(
+            next.contains(
+                "ingest --skill-dir /s --skill x --iteration 3 --harness cool-custom-harness"
+            ),
+            "{next}"
+        );
+        let manifest = adapter
+            .cli_manifest_section(CliManifestContext {
+                guard: false,
+                agent_model: None,
+            })
+            .expect("an exec template earns a generic manifest recipe")
+            .join("\n");
+        assert!(manifest.contains("cool-cli run"), "{manifest}");
+        assert!(manifest.contains("final-message.md"), "{manifest}");
+    }
+
+    #[test]
+    fn baseline_descriptor_yields_the_generic_handoff() {
+        use crate::adapters::harness::{CliManifestContext, HarnessAdapter};
+        let adapter = adapter_from("label = \"cool-custom-harness\"\n");
+        let next = adapter.cli_next_steps(CliDispatchContext {
+            guard: false,
+            target_args: " --skill x",
+            iteration: 1,
+            agent_model: None,
+        });
+        assert!(next.contains("one-shot CLI"), "{next}");
+        assert!(next.contains("outputs/final-message.md"), "{next}");
+        assert!(
+            next.contains("ingest --skill x --iteration 1 --harness cool-custom-harness"),
+            "{next}"
+        );
+        assert!(
+            adapter
+                .cli_manifest_section(CliManifestContext {
+                    guard: false,
+                    agent_model: None,
+                })
+                .is_none(),
+            "the manifest's generic header already covers the no-recipe baseline"
+        );
+    }
+
+    #[test]
+    fn exec_recipe_includes_model_only_when_declared() {
+        let with = next_steps(Harness::resolve("claude-code").unwrap(), Some("opus"));
+        assert!(with.contains("--model opus"), "{with}");
+        let without = next_steps(Harness::resolve("claude-code").unwrap(), None);
+        assert!(!without.contains("--model "), "{without}");
+    }
+
+    #[test]
+    fn codex_recipes_gate_hook_trust_on_guard() {
+        let guarded = next_steps(Harness::resolve("codex").unwrap(), Some("gpt-5-mini"));
+        assert!(
+            guarded.contains(
+                "codex --ask-for-approval never exec --cd <eval-root> --sandbox workspace-write --dangerously-bypass-hook-trust -m gpt-5-mini --json \\"
+            ),
+            "{guarded}"
+        );
+        let unguarded =
+            adapter_for(Harness::resolve("codex").unwrap()).cli_next_steps(CliDispatchContext {
+                guard: false,
+                target_args: "",
+                iteration: 2,
+                agent_model: None,
+            });
+        assert!(
+            !unguarded.contains("--dangerously-bypass-hook-trust"),
+            "{unguarded}"
+        );
+    }
+
+    #[test]
+    fn codex_judge_recipe_splices_model_arg_in_one_command_shape() {
+        let recipe = adapter_for(Harness::resolve("codex").unwrap())
+            .cli_judge_next_steps(CliJudgeContext {
+                guard: true,
+                iteration_dir: Path::new("/work/iter-1"),
+            })
+            .expect("codex judge recipe is wired");
+        // One command shape: the optional model flag is spliced via $model_arg
+        // (same structure as the Claude judge recipe), not an if/else pair.
+        assert!(
+            recipe.contains(
+                "    codex --ask-for-approval never exec --cd \"/work/iter-1\" --sandbox workspace-write --dangerously-bypass-hook-trust $model_arg --json \\"
+            ),
+            "{recipe}"
+        );
+        assert!(
+            recipe.contains("    model_arg=\"\"; [ -n \"$model\" ] && model_arg=\"-m $model\""),
+            "{recipe}"
+        );
+        assert!(!recipe.contains("if [ -n"), "{recipe}");
+    }
+
+    #[test]
+    fn claude_judge_recipe_snapshot_is_stable() {
+        // Full-string pin carried over from the pre-descriptor adapter: locks
+        // the Claude judge recipe byte-for-byte through the descriptor path.
+        let recipe = adapter_for(Harness::resolve("claude-code").unwrap())
+            .cli_judge_next_steps(CliJudgeContext {
+                guard: false,
+                iteration_dir: Path::new("/work/iter-1"),
+            })
+            .expect("claude judge recipe is wired");
+        let expected = r#"Dispatch each judge task from judge-tasks.json with:
+
+```bash
+JOBS=${JOBS:-4}
+jq -j '.tasks[] | [.dispatch_prompt_path, .response_path, (.model // "")] | @tsv + "\u0000"' judge-tasks.json | \
+  xargs -0 -P "$JOBS" -I{} sh -c '
+    prompt_path="$(printf "%s" "$1" | cut -f1)"
+    response_path="$(printf "%s" "$1" | cut -f2)"
+    model="$(printf "%s" "$1" | cut -f3)"
+    response_base="${response_path%.json}"
+    mkdir -p "$(dirname "$response_path")"
+    model_arg=""; [ -n "$model" ] && model_arg="--model $model"
+    cd "/work/iter-1" && claude -p --output-format stream-json --verbose --permission-mode acceptEdits $model_arg \
+      "Read the file at $prompt_path and follow it exactly. You are a judge worker only: write the JSON verdict to $response_path, then reply with one sentence. Do not run eval-magic. Do not dispatch other judge tasks. Do not wait for other workers." \
+      </dev/null \
+      > "$response_base.claude-events.jsonl" \
+      2> "$response_base.claude-stderr.log"
+  ' sh {}
+```"#;
+        assert_eq!(recipe, expected);
+    }
+
+    #[test]
+    fn skills_blocks_render_each_harness_native_shape() {
+        let skills = vec![skill("zebra", "z skill"), skill("alpha", "a skill")];
+
+        let claude = adapter_for(Harness::resolve("claude-code").unwrap())
+            .render_available_skills_block(&skills);
+        assert!(
+            claude.starts_with("The following skills are available for use with the Skill tool:"),
+            "{claude}"
+        );
+        assert!(claude.contains("\n- alpha: a skill"), "{claude}");
+
+        let codex =
+            adapter_for(Harness::resolve("codex").unwrap()).render_available_skills_block(&skills);
+        assert!(codex.starts_with("## Skills"), "{codex}");
+        assert!(
+            codex.contains("- alpha: a skill (file: /x/alpha/SKILL.md)"),
+            "{codex}"
+        );
+
+        let opencode = adapter_for(Harness::resolve("opencode").unwrap())
+            .render_available_skills_block(&skills);
+        assert!(opencode.starts_with("<available_skills>"), "{opencode}");
+        assert!(opencode.ends_with("\n</available_skills>"), "{opencode}");
+        assert!(opencode.contains("<name>alpha</name>"), "{opencode}");
+        assert!(
+            opencode.contains("<description>a skill</description>"),
+            "{opencode}"
+        );
+
+        // Sorted by name in every shape, and empty renders empty.
+        for harness in Harness::known() {
+            let block = adapter_for(harness).render_available_skills_block(&skills);
+            assert!(
+                block.find("alpha").unwrap() < block.find("zebra").unwrap(),
+                "{harness:?} sorts by name: {block}"
+            );
+            assert_eq!(adapter_for(harness).render_available_skills_block(&[]), "");
+        }
+    }
+
+    #[test]
+    fn opencode_stage_name_rules_match_the_old_validator() {
+        let adapter = adapter_for(Harness::resolve("opencode").unwrap());
+        assert!(adapter.validate_stage_name("valid-name-2").is_ok());
+        for invalid in [
+            "Invalid_Name",
+            "double--hyphen",
+            "-leading",
+            "trailing-",
+            "",
+        ] {
+            let err = adapter
+                .validate_stage_name(invalid)
+                .expect_err("name should be rejected");
+            assert!(
+                err.contains(&format!("OpenCode skill name \"{invalid}\" is invalid")),
+                "{err}"
+            );
+        }
+        assert!(adapter.validate_stage_name(&"a".repeat(64)).is_ok());
+        assert!(adapter.validate_stage_name(&"a".repeat(65)).is_err());
+    }
+}
diff --git a/src/adapters/extract.rs b/src/adapters/extract.rs
new file mode 100644
index 0000000..ef62d55
--- /dev/null
+++ b/src/adapters/extract.rs
@@ -0,0 +1,666 @@
+//! Declarative transcript extraction for flat event streams.
+//!
+//! [`ExtractSpec`] is the data half of a descriptor's `[transcript.extract]`
+//! block: five primitives — an equality event filter, a final-text field pick,
+//! a flat tool-item mapping, a token sum, and a duration rule — interpreted by
+//! this one generic engine. A stream that needs more (keyed cross-event joins,
+//! content coercion) is a named code capability
+//! ([`super::capabilities::TranscriptParser`]), not a bigger spec.
+//!
+//! Fixed rules the spec cannot change: `final_text` and `duration.field` take
+//! the last match; `timestamp_spread` needs at least two parseable RFC 3339
+//! timestamps; `result_coalesce` takes the first *present* field
+//! (present-but-null counts), strings verbatim and everything else as compact
+//! JSON; args preserve the item's key order; dotted paths descend objects
+//! only, so keys containing literal dots are unaddressable.
+
+use crate::adapters::TranscriptSummary;
+use crate::adapters::transcript::read_jsonl;
+use crate::core::ToolInvocation;
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use std::collections::BTreeMap;
+use std::io;
+use std::path::Path;
+
+/// Dotted-path → expected-string equality filter; empty matches every record.
+type Where = BTreeMap<String, String>;
+
+/// The `[transcript.extract]` block: which of the four outputs to produce and
+/// how. Validation requires at least one sub-table.
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct ExtractSpec {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tools: Option<ToolsExtract>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub final_text: Option<FieldPick>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tokens: Option<TokensExtract>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub duration: Option<DurationExtract>,
+}
+
+/// Flat tool-item mapping: each matching record's item object becomes one
+/// [`ToolInvocation`].
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct ToolsExtract {
+    #[serde(default, rename = "where", skip_serializing_if = "BTreeMap::is_empty")]
+    pub r#where: Where,
+    /// Dotted path to the tool object within the record; omit when the record
+    /// itself is the item.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub item: Option<String>,
+    /// Field of the item whose string value is the invocation name; records
+    /// without it are skipped.
+    pub name_field: String,
+    /// Names that are not tools (e.g. message/reasoning items).
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub skip_names: Vec<String>,
+    /// Structural keys excluded from args; whatever remains is the args
+    /// object, `null` when empty.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub args_omit: Vec<String>,
+    /// Result = first present of these item fields.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub result_coalesce: Vec<String>,
+}
+
+/// Field pick over matching records; the last match wins.
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct FieldPick {
+    #[serde(default, rename = "where", skip_serializing_if = "BTreeMap::is_empty")]
+    pub r#where: Where,
+    pub field: String,
+}
+
+/// Token reduction: over matching records, sum the listed integer fields. A
+/// record where no listed path resolves leaves the total untouched (it never
+/// turns an absent total into zero).
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct TokensExtract {
+    #[serde(default, rename = "where", skip_serializing_if = "BTreeMap::is_empty")]
+    pub r#where: Where,
+    pub sum: Vec<String>,
+}
+
+/// Duration: either a direct millisecond field pick (last match wins) or the
+/// spread between the first and last RFC 3339 timestamps. Validation requires
+/// exactly one variant.
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct DurationExtract {
+    #[serde(default, rename = "where", skip_serializing_if = "BTreeMap::is_empty")]
+    pub r#where: Where,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub field: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub timestamp_spread: Option<String>,
+}
+
+/// Extract ordered tool invocations from a JSONL events file.
+pub(crate) fn parse(spec: &ExtractSpec, path: &Path) -> io::Result<Vec<ToolInvocation>> {
+    let records = read_jsonl::<Value>(path)?;
+    Ok(extract_tools(spec, &records))
+}
+
+/// Extract a full [`TranscriptSummary`] from a JSONL events file.
+pub(crate) fn parse_full(spec: &ExtractSpec, path: &Path) -> io::Result<TranscriptSummary> {
+    let records = read_jsonl::<Value>(path)?;
+    Ok(TranscriptSummary {
+        tool_invocations: extract_tools(spec, &records),
+        total_tokens: spec
+            .tokens
+            .as_ref()
+            .and_then(|t| extract_tokens(t, &records)),
+        duration_ms: spec
+            .duration
+            .as_ref()
+            .and_then(|d| extract_duration(d, &records)),
+        final_text: spec
+            .final_text
+            .as_ref()
+            .and_then(|f| extract_final_text(f, &records)),
+    })
+}
+
+/// Follow a dotted path through nested objects.
+fn resolve<'a>(record: &'a Value, path: &str) -> Option<&'a Value> {
+    path.split('.')
+        .try_fold(record, |value, segment| value.get(segment))
+}
+
+fn matches(record: &Value, filter: &Where) -> bool {
+    filter
+        .iter()
+        .all(|(path, expected)| resolve(record, path).and_then(Value::as_str) == Some(expected))
+}
+
+fn stringify_value(v: &Value) -> String {
+    match v {
+        Value::String(s) => s.clone(),
+        other => serde_json::to_string(other).unwrap_or_default(),
+    }
+}
+
+fn extract_tools(spec: &ExtractSpec, records: &[Value]) -> Vec<ToolInvocation> {
+    let Some(tools) = &spec.tools else {
+        return Vec::new();
+    };
+    let mut invocations = Vec::new();
+    for record in records {
+        if !matches(record, &tools.r#where) {
+            continue;
+        }
+        let item_value = match &tools.item {
+            Some(path) => match resolve(record, path) {
+                Some(v) => v,
+                None => continue,
+            },
+            None => record,
+        };
+        let Some(item) = item_value.as_object() else {
+            continue;
+        };
+        let Some(name) = item.get(&tools.name_field).and_then(Value::as_str) else {
+            continue;
+        };
+        if tools.skip_names.iter().any(|skip| skip == name) {
+            continue;
+        }
+        let mut args = serde_json::Map::new();
+        for (key, value) in item {
+            if tools.args_omit.iter().any(|omit| omit == key) {
+                continue;
+            }
+            args.insert(key.clone(), value.clone());
+        }
+        let result = tools
+            .result_coalesce
+            .iter()
+            .find_map(|key| item.get(key).map(stringify_value));
+        let ordinal = invocations.len() as u32;
+        invocations.push(ToolInvocation {
+            name: name.to_string(),
+            args: (!args.is_empty()).then_some(Value::Object(args)),
+            result: result.map(Value::String),
+            ordinal,
+        });
+    }
+    invocations
+}
+
+fn extract_final_text(pick: &FieldPick, records: &[Value]) -> Option<String> {
+    records
+        .iter()
+        .filter(|record| matches(record, &pick.r#where))
+        .filter_map(|record| resolve(record, &pick.field).and_then(Value::as_str))
+        .next_back()
+        .map(str::to_string)
+}
+
+fn extract_tokens(tokens: &TokensExtract, records: &[Value]) -> Option<i64> {
+    let mut total: Option<i64> = None;
+    for record in records {
+        if !matches(record, &tokens.r#where) {
+            continue;
+        }
+        let resolved: Vec<&Value> = tokens
+            .sum
+            .iter()
+            .filter_map(|path| resolve(record, path))
+            .collect();
+        // No listed path resolves: the record carries no token report, and
+        // must not turn an absent total into zero.
+        if resolved.is_empty() {
+            continue;
+        }
+        let sum: i64 = resolved.iter().filter_map(|v| v.as_i64()).sum();
+        total = Some(total.unwrap_or(0) + sum);
+    }
+    total
+}
+
+fn parse_millis(s: &str) -> Option<i64> {
+    chrono::DateTime::parse_from_rfc3339(s)
+        .ok()
+        .map(|dt| dt.timestamp_millis())
+}
+
+fn extract_duration(duration: &DurationExtract, records: &[Value]) -> Option<i64> {
+    let matching = records
+        .iter()
+        .filter(|record| matches(record, &duration.r#where));
+    if let Some(field) = &duration.field {
+        return matching
+            .filter_map(|record| resolve(record, field).and_then(Value::as_i64))
+            .next_back();
+    }
+    let ts_field = duration.timestamp_spread.as_ref()?;
+    let mut first: Option<i64> = None;
+    let mut last: Option<i64> = None;
+    let mut count = 0usize;
+    for record in matching {
+        let Some(ts) = resolve(record, ts_field)
+            .and_then(Value::as_str)
+            .and_then(parse_millis)
+        else {
+            continue;
+        };
+        if first.is_none() {
+            first = Some(ts);
+        }
+        last = Some(ts);
+        count += 1;
+    }
+    match (first, last) {
+        (Some(f), Some(l)) if count >= 2 => Some(l - f),
+        _ => None,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+    use std::fs;
+    use tempfile::TempDir;
+
+    fn write_jsonl(path: &Path, lines: &[Value]) {
+        let body = lines
+            .iter()
+            .map(|l| l.to_string())
+            .collect::<Vec<_>>()
+            .join("\n");
+        fs::write(path, format!("{body}\n")).unwrap();
+    }
+
+    /// The Codex stream expressed in the extractor language — the worked
+    /// example from the BYOH guide, kept equivalent to the `codex-items` code
+    /// parser by the differential test below.
+    fn codex_spec() -> ExtractSpec {
+        toml::from_str(
+            r#"
+            [tools]
+            where = { type = "item.completed" }
+            item = "item"
+            name_field = "type"
+            skip_names = ["agent_message", "reasoning", "plan_update"]
+            args_omit = ["id", "type", "status", "output", "result", "error"]
+            result_coalesce = ["output", "result", "error"]
+
+            [final_text]
+            where = { type = "item.completed", "item.type" = "agent_message" }
+            field = "item.text"
+
+            [tokens]
+            where = { type = "turn.completed" }
+            sum = ["usage.input_tokens", "usage.output_tokens", "usage.reasoning_output_tokens"]
+
+            [duration]
+            timestamp_spread = "timestamp"
+            "#,
+        )
+        .unwrap()
+    }
+
+    #[test]
+    fn extracts_completed_tool_items_with_ordinals_args_and_results() {
+        let dir = TempDir::new().unwrap();
+        let path = dir.path().join("items.jsonl");
+        write_jsonl(
+            &path,
+            &[
+                json!({"type": "item.started", "timestamp": "2026-06-07T10:00:00.000Z", "item": {"id": "item_1", "type": "command_execution", "command": "bash -lc 'bun test'", "status": "in_progress"}}),
+                json!({"type": "item.completed", "timestamp": "2026-06-07T10:00:02.000Z", "item": {"id": "item_1", "type": "command_execution", "command": "bash -lc 'bun test'", "output": "2 pass\n0 fail", "status": "completed"}}),
+                json!({"type": "item.completed", "item": {"id": "item_2", "type": "file_change", "path": "src/app.ts", "status": "completed"}}),
+                json!({"type": "item.completed", "item": {"id": "item_3", "type": "agent_message", "text": "Done."}}),
+            ],
+        );
+
+        let result = parse(&codex_spec(), &path).unwrap();
+        assert_eq!(result.len(), 2);
+        assert_eq!(
+            result[0],
+            ToolInvocation {
+                name: "command_execution".into(),
+                args: Some(json!({"command": "bash -lc 'bun test'"})),
+                result: Some(Value::String("2 pass\n0 fail".into())),
+                ordinal: 0,
+            }
+        );
+        assert_eq!(
+            result[1],
+            ToolInvocation {
+                name: "file_change".into(),
+                args: Some(json!({"path": "src/app.ts"})),
+                result: None,
+                ordinal: 1,
+            }
+        );
+    }
+
+    #[test]
+    fn skips_malformed_jsonl_lines() {
+        let dir = TempDir::new().unwrap();
+        let path = dir.path().join("malformed.jsonl");
+        let good = json!({"type": "item.completed", "item": {"id": "item_1", "type": "web_search", "query": "codex exec json"}});
+        fs::write(&path, format!("{good}\nnot valid json\n")).unwrap();
+        assert_eq!(
+            parse(&codex_spec(), &path).unwrap(),
+            vec![ToolInvocation {
+                name: "web_search".into(),
+                args: Some(json!({"query": "codex exec json"})),
+                result: None,
+                ordinal: 0,
+            }]
+        );
+    }
+
+    #[test]
+    fn preserves_text_fields_on_non_message_tool_items() {
+        let dir = TempDir::new().unwrap();
+        let path = dir.path().join("tool-text.jsonl");
+        write_jsonl(
+            &path,
+            &[
+                json!({"type": "item.completed", "item": {"id": "item_1", "type": "web_search", "query": "codex events", "text": "search summary"}}),
+            ],
+        );
+        assert_eq!(
+            parse(&codex_spec(), &path).unwrap(),
+            vec![ToolInvocation {
+                name: "web_search".into(),
+                args: Some(json!({"query": "codex events", "text": "search summary"})),
+                result: None,
+                ordinal: 0,
+            }]
+        );
+    }
+
+    #[test]
+    fn does_not_treat_skip_named_items_as_tools() {
+        let dir = TempDir::new().unwrap();
+        let path = dir.path().join("non-tools.jsonl");
+        write_jsonl(
+            &path,
+            &[
+                json!({"type": "item.completed", "item": {"id": "a", "type": "agent_message"}}),
+                json!({"type": "item.completed", "item": {"id": "b", "type": "reasoning"}}),
+                json!({"type": "item.completed", "item": {"id": "c", "type": "plan_update"}}),
+            ],
+        );
+        assert_eq!(parse(&codex_spec(), &path).unwrap(), vec![]);
+    }
+
+    #[test]
+    fn extracts_invocations_last_agent_text_usage_and_duration() {
+        let dir = TempDir::new().unwrap();
+        let path = dir.path().join("full.jsonl");
+        write_jsonl(
+            &path,
+            &[
+                json!({"type": "thread.started", "timestamp": "2026-06-07T10:00:00.000Z"}),
+                json!({"type": "item.completed", "timestamp": "2026-06-07T10:00:03.000Z", "item": {"id": "item_1", "type": "command_execution", "command": "ls", "output": "README.md"}}),
+                json!({"type": "item.completed", "timestamp": "2026-06-07T10:00:04.000Z", "item": {"id": "item_2", "type": "agent_message", "text": "First."}}),
+                json!({"type": "item.completed", "timestamp": "2026-06-07T10:00:05.000Z", "item": {"id": "item_3", "type": "agent_message", "text": "Final."}}),
+                json!({"type": "turn.completed", "timestamp": "2026-06-07T10:00:10.000Z", "usage": {"input_tokens": 100, "cached_input_tokens": 75, "output_tokens": 20, "reasoning_output_tokens": 5}}),
+            ],
+        );
+
+        let full = parse_full(&codex_spec(), &path).unwrap();
+        assert_eq!(
+            full.tool_invocations,
+            vec![ToolInvocation {
+                name: "command_execution".into(),
+                args: Some(json!({"command": "ls"})),
+                result: Some(Value::String("README.md".into())),
+                ordinal: 0,
+            }]
+        );
+        assert_eq!(full.final_text, Some("Final.".into()));
+        assert_eq!(full.total_tokens, Some(125)); // fields not listed in `sum` excluded
+        assert_eq!(full.duration_ms, Some(10_000));
+    }
+
+    #[test]
+    fn returns_null_usage_and_duration_when_sparse() {
+        let dir = TempDir::new().unwrap();
+        let path = dir.path().join("sparse.jsonl");
+        write_jsonl(
+            &path,
+            &[
+                json!({"type": "item.completed", "timestamp": "2026-06-07T10:00:00.000Z", "item": {"id": "item_1", "type": "agent_message", "text": "Done."}}),
+            ],
+        );
+        let full = parse_full(&codex_spec(), &path).unwrap();
+        assert_eq!(full.final_text, Some("Done.".into()));
+        assert_eq!(full.total_tokens, None);
+        assert_eq!(full.duration_ms, None);
+    }
+
+    #[test]
+    fn duration_field_variant_picks_the_last_match() {
+        let spec: ExtractSpec = toml::from_str(
+            r#"
+            [duration]
+            where = { type = "result" }
+            field = "elapsed_ms"
+            "#,
+        )
+        .unwrap();
+        let dir = TempDir::new().unwrap();
+        let path = dir.path().join("durations.jsonl");
+        write_jsonl(
+            &path,
+            &[
+                json!({"type": "result", "elapsed_ms": 1_000}),
+                json!({"type": "progress", "elapsed_ms": 9_999}),
+                json!({"type": "result", "elapsed_ms": 2_500}),
+            ],
+        );
+        assert_eq!(parse_full(&spec, &path).unwrap().duration_ms, Some(2_500));
+    }
+
+    #[test]
+    fn matching_event_without_any_listed_token_field_leaves_tokens_null() {
+        let dir = TempDir::new().unwrap();
+        let path = dir.path().join("bare-turn.jsonl");
+        write_jsonl(&path, &[json!({"type": "turn.completed"})]);
+        assert_eq!(parse_full(&codex_spec(), &path).unwrap().total_tokens, None);
+    }
+
+    #[test]
+    fn partial_token_fields_count_and_missing_ones_add_zero() {
+        let dir = TempDir::new().unwrap();
+        let path = dir.path().join("partial-usage.jsonl");
+        write_jsonl(
+            &path,
+            &[
+                json!({"type": "turn.completed", "usage": {"input_tokens": 40}}),
+                json!({"type": "turn.completed", "usage": {"output_tokens": 2}}),
+            ],
+        );
+        assert_eq!(
+            parse_full(&codex_spec(), &path).unwrap().total_tokens,
+            Some(42)
+        );
+    }
+
+    #[test]
+    fn flat_records_map_without_an_item_root() {
+        let spec: ExtractSpec = toml::from_str(
+            r#"
+            [tools]
+            where = { event = "tool" }
+            name_field = "name"
+            args_omit = ["event", "name", "output"]
+            result_coalesce = ["output"]
+            "#,
+        )
+        .unwrap();
+        let dir = TempDir::new().unwrap();
+        let path = dir.path().join("flat.jsonl");
+        write_jsonl(
+            &path,
+            &[
+                json!({"event": "tool", "name": "grep", "pattern": "todo", "output": "3 matches"}),
+                json!({"event": "text", "content": "done"}),
+            ],
+        );
+        assert_eq!(
+            parse(&spec, &path).unwrap(),
+            vec![ToolInvocation {
+                name: "grep".into(),
+                args: Some(json!({"pattern": "todo"})),
+                result: Some(Value::String("3 matches".into())),
+                ordinal: 0,
+            }]
+        );
+    }
+
+    #[test]
+    fn present_but_null_result_field_still_coalesces() {
+        let dir = TempDir::new().unwrap();
+        let path = dir.path().join("null-result.jsonl");
+        write_jsonl(
+            &path,
+            &[
+                json!({"type": "item.completed", "item": {"id": "i", "type": "command_execution", "command": "true", "output": null, "error": "boom"}}),
+            ],
+        );
+        let result = parse(&codex_spec(), &path).unwrap();
+        assert_eq!(result[0].result, Some(Value::String("null".into())));
+    }
+
+    #[test]
+    fn non_string_results_are_compact_json() {
+        let dir = TempDir::new().unwrap();
+        let path = dir.path().join("object-result.jsonl");
+        write_jsonl(
+            &path,
+            &[
+                json!({"type": "item.completed", "item": {"id": "i", "type": "web_search", "result": {"hits": 2}}}),
+            ],
+        );
+        let result = parse(&codex_spec(), &path).unwrap();
+        assert_eq!(result[0].result, Some(Value::String("{\"hits\":2}".into())));
+    }
+
+    #[test]
+    fn items_with_only_omitted_keys_get_null_args() {
+        let dir = TempDir::new().unwrap();
+        let path = dir.path().join("bare-item.jsonl");
+        write_jsonl(
+            &path,
+            &[
+                json!({"type": "item.completed", "item": {"id": "i", "type": "file_change", "status": "completed"}}),
+            ],
+        );
+        let result = parse(&codex_spec(), &path).unwrap();
+        assert_eq!(result[0].args, None);
+    }
+
+    #[test]
+    fn records_missing_the_item_root_or_name_field_are_skipped() {
+        let dir = TempDir::new().unwrap();
+        let path = dir.path().join("shapeless.jsonl");
+        write_jsonl(
+            &path,
+            &[
+                json!({"type": "item.completed"}),
+                json!({"type": "item.completed", "item": "not an object"}),
+                json!({"type": "item.completed", "item": {"id": "i", "type": 7}}),
+                json!({"type": "item.completed", "item": {"id": "i"}}),
+            ],
+        );
+        assert_eq!(parse(&codex_spec(), &path).unwrap(), vec![]);
+    }
+
+    #[test]
+    fn spec_without_a_tools_mapping_yields_no_invocations() {
+        let spec: ExtractSpec = toml::from_str(
+            r#"
+            [final_text]
+            field = "text"
+            "#,
+        )
+        .unwrap();
+        let dir = TempDir::new().unwrap();
+        let path = dir.path().join("no-tools.jsonl");
+        write_jsonl(&path, &[json!({"text": "hello"})]);
+        assert_eq!(parse(&spec, &path).unwrap(), vec![]);
+        let full = parse_full(&spec, &path).unwrap();
+        assert_eq!(full.tool_invocations, vec![]);
+        assert_eq!(full.final_text, Some("hello".into()));
+    }
+
+    /// Acceptance benchmark for the extractor tier: the worked-example spec
+    /// must parse every corpus in this module identically to the `codex-items`
+    /// reference implementation.
+    #[test]
+    fn codex_spec_is_equivalent_to_the_codex_items_reference_parser() {
+        use crate::adapters::codex::transcript::{parse_codex_events, parse_codex_events_full};
+
+        let corpora: Vec<Vec<Value>> = vec![
+            vec![
+                json!({"type": "item.started", "timestamp": "2026-06-07T10:00:00.000Z", "item": {"id": "item_1", "type": "command_execution", "command": "bash -lc 'bun test'", "status": "in_progress"}}),
+                json!({"type": "item.completed", "timestamp": "2026-06-07T10:00:02.000Z", "item": {"id": "item_1", "type": "command_execution", "command": "bash -lc 'bun test'", "output": "2 pass\n0 fail", "status": "completed"}}),
+                json!({"type": "item.completed", "item": {"id": "item_2", "type": "file_change", "path": "src/app.ts", "status": "completed"}}),
+                json!({"type": "item.completed", "item": {"id": "item_3", "type": "agent_message", "text": "Done."}}),
+            ],
+            vec![
+                json!({"type": "item.completed", "item": {"id": "item_1", "type": "web_search", "query": "codex events", "text": "search summary"}}),
+            ],
+            vec![
+                json!({"type": "item.completed", "item": {"id": "a", "type": "agent_message"}}),
+                json!({"type": "item.completed", "item": {"id": "b", "type": "reasoning"}}),
+                json!({"type": "item.completed", "item": {"id": "c", "type": "plan_update"}}),
+            ],
+            vec![
+                json!({"type": "thread.started", "timestamp": "2026-06-07T10:00:00.000Z"}),
+                json!({"type": "item.completed", "timestamp": "2026-06-07T10:00:03.000Z", "item": {"id": "item_1", "type": "command_execution", "command": "ls", "output": "README.md"}}),
+                json!({"type": "item.completed", "timestamp": "2026-06-07T10:00:04.000Z", "item": {"id": "item_2", "type": "agent_message", "text": "First."}}),
+                json!({"type": "item.completed", "timestamp": "2026-06-07T10:00:05.000Z", "item": {"id": "item_3", "type": "agent_message", "text": "Final."}}),
+                json!({"type": "turn.completed", "timestamp": "2026-06-07T10:00:10.000Z", "usage": {"input_tokens": 100, "cached_input_tokens": 75, "output_tokens": 20, "reasoning_output_tokens": 5}}),
+            ],
+            vec![
+                json!({"type": "item.completed", "timestamp": "2026-06-07T10:00:00.000Z", "item": {"id": "item_1", "type": "agent_message", "text": "Done."}}),
+            ],
+            vec![
+                json!({"type": "item.completed", "item": {"id": "i", "type": "command_execution", "command": "true", "output": null, "error": "boom"}}),
+                json!({"type": "item.completed", "item": {"id": "i", "type": "web_search", "result": {"hits": 2}}}),
+                json!({"type": "item.completed", "item": {"id": "i", "type": "file_change", "status": "completed"}}),
+                json!({"type": "turn.completed", "usage": {"input_tokens": 40}}),
+            ],
+        ];
+
+        let spec = codex_spec();
+        let dir = TempDir::new().unwrap();
+        for (i, corpus) in corpora.iter().enumerate() {
+            let path = dir.path().join(format!("corpus-{i}.jsonl"));
+            write_jsonl(&path, corpus);
+            assert_eq!(
+                parse(&spec, &path).unwrap(),
+                parse_codex_events(&path).unwrap(),
+                "invocations diverge on corpus {i}"
+            );
+            assert_eq!(
+                parse_full(&spec, &path).unwrap(),
+                parse_codex_events_full(&path).unwrap(),
+                "summaries diverge on corpus {i}"
+            );
+        }
+
+        // The malformed-line corpus can't round-trip through `json!`; write it raw.
+        let path = dir.path().join("corpus-malformed.jsonl");
+        let good = json!({"type": "item.completed", "item": {"id": "item_1", "type": "web_search", "query": "codex exec json"}});
+        fs::write(&path, format!("{good}\nnot valid json\n")).unwrap();
+        assert_eq!(
+            parse(&spec, &path).unwrap(),
+            parse_codex_events(&path).unwrap()
+        );
+        assert_eq!(
+            parse_full(&spec, &path).unwrap(),
+            parse_codex_events_full(&path).unwrap()
+        );
+    }
+}
diff --git a/src/adapters/guard.rs b/src/adapters/guard.rs
new file mode 100644
index 0000000..708b6e9
--- /dev/null
+++ b/src/adapters/guard.rs
@@ -0,0 +1,638 @@
+//! The generic write-guard engine: one install + verdict implementation
+//! rendered from a descriptor's `[guard]` data block.
+//!
+//! Arming merges one PreToolUse hook entry (the descriptor's `hook_entry` JSON
+//! template) into the harness's hook-config file (`hooks_file`) and stages the
+//! marker/manifest via [`crate::sandbox::install`]. The verdict side feeds a
+//! hook payload through the shared arbiter ([`crate::sandbox::decide`]) and
+//! serializes the descriptor's `verdict_template` on deny. Template key order
+//! is authored in the descriptor and serialized verbatim (`serde_json` keeps
+//! insertion order), so verdict bytes and hook-file shape are pinned by data,
+//! not code.
+//!
+//! Guard blocks exist only in embedded built-in descriptors — the guard fails
+//! open, so [`super::descriptor::layers::check_user_layer_restrictions`] bars
+//! user layers from declaring one.
+
+use std::fs;
+use std::io;
+use std::path::{Path, PathBuf};
+use std::time::Duration;
+
+use serde_json::{Value, json};
+
+use crate::sandbox::decide::{GuardMarker, decide};
+use crate::sandbox::install::{
+    GUARD_MANIFEST, GUARD_MARKER, write_json, write_manifest, write_marker,
+};
+use crate::sandbox::{now_ms, parse_tool_call};
+
+use super::descriptor::{GuardSection, subst};
+
+/// Arm the write guard: marker + manifest under `skills_dir` (absolute,
+/// resolved by the caller), one hook entry merged into the descriptor's
+/// `hooks_file`. Returns the staged marker path.
+///
+/// Template parse failures panic (`expect`): descriptor validation proved the
+/// templates at load time, and arming runs in the orchestrator where a loud
+/// failure beats a silently unarmed guard.
+pub(crate) fn install_guard(
+    guard: &GuardSection,
+    skills_dir: &Path,
+    stage_root: &Path,
+    guard_exe: &Path,
+    ttl: Option<Duration>,
+) -> io::Result<PathBuf> {
+    fs::create_dir_all(skills_dir)?;
+
+    let marker_path = skills_dir.join(GUARD_MARKER);
+    write_marker(&marker_path, stage_root, ttl)?;
+
+    let hooks_path = resolve_rel(stage_root, &guard.hooks_file);
+    if let Some(parent) = hooks_path.parent() {
+        fs::create_dir_all(parent)?;
+    }
+    let hooks_existed = hooks_path.exists();
+    let backup = if hooks_existed {
+        Some(fs::read_to_string(&hooks_path)?)
+    } else {
+        None
+    };
+
+    // Start from the existing hook config (or an empty object), preserving key
+    // order, then append the rendered hook entry.
+    let mut config: Value = backup
+        .as_deref()
+        .and_then(|s| serde_json::from_str(s).ok())
+        .unwrap_or_else(|| json!({}));
+    let exe = guard_exe.display().to_string();
+    let marker = marker_path.display().to_string();
+    let command = subst(
+        &guard.command_template,
+        &[("exe", &exe), ("marker", &marker)],
+    );
+    let mut entry: Value = serde_json::from_str(&guard.hook_entry)
+        .expect("guard.hook_entry parses as JSON (proven at descriptor load)");
+    substitute_strings(
+        &mut entry,
+        &[("matcher", &guard.matcher), ("command", &command)],
+    );
+
+    let hooks = config
+        .as_object_mut()
+        .expect("hook config root is a JSON object")
+        .entry("hooks")
+        .or_insert_with(|| json!({}));
+    let pre = hooks
+        .as_object_mut()
+        .expect("hooks is a JSON object")
+        .entry("PreToolUse")
+        .or_insert_with(|| json!([]));
+    pre.as_array_mut()
+        .expect("PreToolUse is an array")
+        .push(entry);
+    write_json(&hooks_path, &config)?;
+
+    write_manifest(
+        &skills_dir.join(GUARD_MANIFEST),
+        &hooks_path,
+        hooks_existed,
+        backup,
+        &marker_path,
+    )?;
+
+    Ok(marker_path)
+}
+
+/// Evaluate a PreToolUse hook `payload` against `marker`. Returns the deny
+/// verdict to print on stdout (the descriptor's `verdict_template` with
+/// `{reason}` filled), or `None` to allow (print nothing). Every error path —
+/// empty/malformed payload, unrenderable template — fails open: the hook must
+/// never brick a session.
+pub(crate) fn guard_verdict(
+    guard: &GuardSection,
+    payload: &str,
+    marker: Option<GuardMarker>,
+) -> Option<String> {
+    let (tool_name, tool_input) = parse_tool_call(payload)?;
+    let decision = decide(&tool_name, &tool_input, marker.as_ref(), now_ms());
+    if decision.allow {
+        return None;
+    }
+    let mut verdict: Value = serde_json::from_str(&guard.verdict_template).ok()?;
+    substitute_strings(
+        &mut verdict,
+        &[("reason", decision.reason.as_deref().unwrap_or(""))],
+    );
+    serde_json::to_string(&verdict).ok()
+}
+
+/// The hook-config dir the install created outside the skills dir, which
+/// teardown prunes when restoring the original config leaves it empty.
+/// Derived from the data: `hooks_file`'s parent dir, unless the hook file is
+/// at the env root (nothing to prune) or the parent is the skills dir or an
+/// ancestor of it (staging already owns that tree).
+pub(crate) fn hook_cleanup_dir(
+    guard: &GuardSection,
+    skills_dir_rel: Option<&str>,
+    stage_root: &Path,
+) -> Option<PathBuf> {
+    let (parent, _) = guard.hooks_file.rsplit_once('/')?;
+    if let Some(skills) = skills_dir_rel {
+        // Component-wise ancestry: `.a` owns `.a/b/skills` but not `.ab/skills`.
+        let is_ancestor = skills == parent
+            || skills
+                .strip_prefix(parent)
+                .is_some_and(|rest| rest.starts_with('/'));
+        if is_ancestor {
+            return None;
+        }
+    }
+    Some(resolve_rel(stage_root, parent))
+}
+
+/// True when any *string value* in `value` contains `token`. Descriptor
+/// validation uses this to prove template placeholders sit where
+/// [`substitute_strings`] will actually reach them (keys are never
+/// substituted).
+pub(crate) fn any_string_value_contains(value: &Value, token: &str) -> bool {
+    match value {
+        Value::String(s) => s.contains(token),
+        Value::Array(items) => items.iter().any(|v| any_string_value_contains(v, token)),
+        Value::Object(map) => map.values().any(|v| any_string_value_contains(v, token)),
+        _ => false,
+    }
+}
+
+/// Substitute `{token}` placeholders in every string value of `value`,
+/// in place. Substituting after parsing (rather than into the template text)
+/// lets values carry quotes without JSON-escaping concerns — the serializer
+/// escapes them, exactly as `json!` used to.
+fn substitute_strings(value: &mut Value, vars: &[(&str, &str)]) {
+    match value {
+        Value::String(s) if s.contains('{') => {
+            *s = subst(s, vars);
+        }
+        Value::Array(items) => {
+            for item in items {
+                substitute_strings(item, vars);
+            }
+        }
+        Value::Object(map) => {
+            for item in map.values_mut() {
+                substitute_strings(item, vars);
+            }
+        }
+        _ => {}
+    }
+}
+
+/// Resolve a `/`-separated descriptor-relative path under `root` — the same
+/// idiom as [`super::descriptor_adapter::DescriptorAdapter::skills_dir`].
+fn resolve_rel(root: &Path, rel: &str) -> PathBuf {
+    rel.split('/')
+        .fold(root.to_path_buf(), |path, segment| path.join(segment))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::adapters::descriptor::{EMBEDDED_DESCRIPTORS, HarnessDescriptor, load_descriptor};
+    use crate::sandbox::guard_is_armed;
+    use crate::sandbox::install::{iso_millis, teardown_guard};
+    use chrono::DateTime;
+    use tempfile::TempDir;
+
+    struct Case {
+        _tmp: TempDir,
+        stage_root: PathBuf,
+    }
+
+    fn setup() -> Case {
+        let tmp = TempDir::new().unwrap();
+        let stage_root = tmp.path().join("stage");
+        fs::create_dir_all(&stage_root).unwrap();
+        Case {
+            _tmp: tmp,
+            stage_root,
+        }
+    }
+
+    /// Load one embedded descriptor by label — engine tests run against the
+    /// real shipped guard data, not fixtures.
+    fn descriptor(label: &str) -> HarnessDescriptor {
+        let (source, toml_src) = EMBEDDED_DESCRIPTORS
+            .iter()
+            .find(|(path, _)| path.ends_with(&format!("{label}.toml")))
+            .unwrap_or_else(|| panic!("no embedded descriptor for {label}"));
+        load_descriptor(toml_src, source).unwrap()
+    }
+
+    /// Arm the guard for `label` under `stage_root` via the engine, returning
+    /// the marker path.
+    fn install(label: &str, stage_root: &Path) -> PathBuf {
+        let d = descriptor(label);
+        let skills = resolve_rel(stage_root, d.skills_dir.as_deref().unwrap());
+        install_guard(
+            d.guard.as_ref().unwrap(),
+            &skills,
+            stage_root,
+            Path::new("/g/eval-magic"),
+            None,
+        )
+        .unwrap()
+    }
+
+    fn verdict(label: &str, payload: &str, marker: Option<GuardMarker>) -> Option<String> {
+        let d = descriptor(label);
+        guard_verdict(d.guard.as_ref().unwrap(), payload, marker)
+    }
+
+    fn claude_skills_dir(stage_root: &Path) -> PathBuf {
+        stage_root.join(".claude").join("skills")
+    }
+
+    fn settings_path(stage_root: &Path) -> PathBuf {
+        stage_root.join(".claude").join("settings.local.json")
+    }
+
+    fn codex_hooks_path(stage_root: &Path) -> PathBuf {
+        stage_root.join(".codex").join("hooks.json")
+    }
+
+    fn read_json(path: &Path) -> Value {
+        serde_json::from_str(&fs::read_to_string(path).unwrap()).unwrap()
+    }
+
+    fn absolutize(p: &Path) -> PathBuf {
+        std::path::absolute(p).unwrap_or_else(|_| p.to_path_buf())
+    }
+
+    /// A live marker (active, no expiry → unexpired) scoped to one root.
+    fn marker() -> GuardMarker {
+        GuardMarker {
+            active: Some(true),
+            allowed_roots: Some(vec!["/work/.eval-magic".to_string()]),
+            expires_at: None,
+        }
+    }
+
+    #[test]
+    fn install_writes_an_active_marker_hook_and_manifest() {
+        let c = setup();
+        install("claude-code", &c.stage_root);
+
+        let marker = read_json(&claude_skills_dir(&c.stage_root).join(GUARD_MARKER));
+        assert_eq!(marker["active"], json!(true));
+        let expires = marker["expiresAt"].as_str().unwrap();
+        let exp_ms = DateTime::parse_from_rfc3339(expires)
+            .unwrap()
+            .timestamp_millis();
+        assert!(exp_ms > now_ms());
+        let env = absolutize(&c.stage_root).display().to_string();
+        assert!(
+            marker["allowedRoots"]
+                .as_array()
+                .unwrap()
+                .iter()
+                .any(|r| r.as_str().unwrap() == env)
+        );
+
+        let settings = read_json(&settings_path(&c.stage_root));
+        let hook = &settings["hooks"]["PreToolUse"][0];
+        assert!(hook["matcher"].as_str().unwrap().contains("Write"));
+        assert!(
+            hook["hooks"][0]["command"]
+                .as_str()
+                .unwrap()
+                .contains("guard")
+        );
+
+        assert!(
+            claude_skills_dir(&c.stage_root)
+                .join(GUARD_MANIFEST)
+                .exists()
+        );
+    }
+
+    #[test]
+    fn marker_scopes_allowed_roots_to_the_env_and_temp_only() {
+        let c = setup();
+        install("claude-code", &c.stage_root);
+
+        let marker = read_json(&claude_skills_dir(&c.stage_root).join(GUARD_MARKER));
+        let roots: Vec<String> = marker["allowedRoots"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .map(|r| r.as_str().unwrap().to_string())
+            .collect();
+
+        // The guard boundary is the isolated env (stage_root) plus temp — nothing
+        // above it. The parent workspace tree must NOT be an allowed root, or the
+        // agent could write into sibling iterations / the meta dir above `env/`.
+        let env = absolutize(&c.stage_root).display().to_string();
+        let temp = absolutize(&std::env::temp_dir()).display().to_string();
+        assert_eq!(roots, vec![env, temp]);
+        assert!(
+            !roots.iter().any(|r| r.ends_with(".eval-magic")),
+            "workspace_root must not be an allowed root: {roots:?}"
+        );
+    }
+
+    #[test]
+    fn hook_command_invokes_the_binary_guard_subcommand() {
+        let c = setup();
+        let marker = install("claude-code", &c.stage_root);
+        let settings = read_json(&settings_path(&c.stage_root));
+        let command = settings["hooks"]["PreToolUse"][0]["hooks"][0]["command"]
+            .as_str()
+            .unwrap()
+            .to_string();
+        assert_eq!(
+            command,
+            format!("\"/g/eval-magic\" guard \"{}\"", marker.display())
+        );
+    }
+
+    #[test]
+    fn teardown_deletes_settings_it_created() {
+        let c = setup();
+        install("claude-code", &c.stage_root);
+        assert!(settings_path(&c.stage_root).exists());
+
+        assert!(teardown_guard(&c.stage_root));
+        assert!(!settings_path(&c.stage_root).exists());
+        assert!(!claude_skills_dir(&c.stage_root).join(GUARD_MARKER).exists());
+        assert!(
+            !claude_skills_dir(&c.stage_root)
+                .join(GUARD_MANIFEST)
+                .exists()
+        );
+    }
+
+    #[test]
+    fn teardown_restores_a_pre_existing_settings_verbatim() {
+        let c = setup();
+        fs::create_dir_all(c.stage_root.join(".claude")).unwrap();
+        let original = format!(
+            "{}\n",
+            serde_json::to_string_pretty(&json!({
+                "permissions": { "allow": ["Bash(ls)"] }
+            }))
+            .unwrap()
+        );
+        fs::write(settings_path(&c.stage_root), &original).unwrap();
+
+        install("claude-code", &c.stage_root);
+        // hook present while armed
+        assert!(
+            fs::read_to_string(settings_path(&c.stage_root))
+                .unwrap()
+                .contains("PreToolUse")
+        );
+
+        teardown_guard(&c.stage_root);
+        assert_eq!(
+            fs::read_to_string(settings_path(&c.stage_root)).unwrap(),
+            original
+        );
+    }
+
+    #[test]
+    fn guard_is_armed_ignores_missing_inactive_expired_and_malformed_markers() {
+        let c = setup();
+        let marker_path = claude_skills_dir(&c.stage_root).join(GUARD_MARKER);
+        fs::create_dir_all(claude_skills_dir(&c.stage_root)).unwrap();
+
+        assert!(!guard_is_armed(&c.stage_root));
+
+        fs::write(
+            &marker_path,
+            serde_json::to_string(&json!({ "active": false })).unwrap(),
+        )
+        .unwrap();
+        assert!(!guard_is_armed(&c.stage_root));
+
+        fs::write(
+            &marker_path,
+            serde_json::to_string(&json!({
+                "active": true,
+                "expiresAt": iso_millis(now_ms() - 60_000),
+            }))
+            .unwrap(),
+        )
+        .unwrap();
+        assert!(!guard_is_armed(&c.stage_root));
+
+        fs::write(&marker_path, "not json").unwrap();
+        assert!(!guard_is_armed(&c.stage_root));
+    }
+
+    #[test]
+    fn teardown_sweeps_a_stray_marker_even_without_a_manifest() {
+        let c = setup();
+        fs::create_dir_all(claude_skills_dir(&c.stage_root)).unwrap();
+        fs::write(claude_skills_dir(&c.stage_root).join(GUARD_MARKER), "{}").unwrap();
+        assert!(teardown_guard(&c.stage_root));
+        assert!(!claude_skills_dir(&c.stage_root).join(GUARD_MARKER).exists());
+    }
+
+    #[test]
+    fn allows_returns_none() {
+        let payload = r#"{ "tool_name": "Read", "tool_input": { "file_path": "/etc/passwd" } }"#;
+        assert_eq!(verdict("claude-code", payload, Some(marker())), None);
+    }
+
+    #[test]
+    fn deny_returns_pretooluse_deny_json() {
+        let payload = r#"{ "tool_name": "Write", "tool_input": { "file_path": "/etc/passwd" } }"#;
+        let out = verdict("claude-code", payload, Some(marker())).expect("should deny");
+        let v: Value = serde_json::from_str(&out).unwrap();
+        assert_eq!(v["hookSpecificOutput"]["hookEventName"], "PreToolUse");
+        assert_eq!(v["hookSpecificOutput"]["permissionDecision"], "deny");
+        assert!(
+            v["hookSpecificOutput"]["permissionDecisionReason"]
+                .as_str()
+                .unwrap()
+                .contains("outside")
+        );
+    }
+
+    /// Byte-pin of both deny verdicts: full-string equality against the exact
+    /// serialization armed hooks have always read. Key order comes from the
+    /// descriptor templates and must never drift.
+    #[test]
+    fn deny_verdict_bytes_match_the_on_disk_contract() {
+        let payload = r#"{ "tool_name": "Write", "tool_input": { "file_path": "/etc/passwd" } }"#;
+        assert_eq!(
+            verdict("claude-code", payload, Some(marker())).expect("should deny"),
+            "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\
+             \"permissionDecision\":\"deny\",\"permissionDecisionReason\":\
+             \"eval guard: Write to /etc/passwd is outside the eval sandbox \
+             (allowed: /work/.eval-magic)\"}}"
+        );
+
+        let payload =
+            r#"{ "tool_name": "Bash", "tool_input": { "command": "npm install left-pad" } }"#;
+        assert_eq!(
+            verdict("codex", payload, Some(marker())).expect("should block"),
+            "{\"decision\":\"block\",\"reason\":\"eval guard: blocked Bash \
+             (package install/add) — runs outside the eval sandbox\"}"
+        );
+    }
+
+    #[test]
+    fn no_marker_allows_everything() {
+        let payload = r#"{ "tool_name": "Write", "tool_input": { "file_path": "/etc/passwd" } }"#;
+        assert_eq!(verdict("claude-code", payload, None), None);
+    }
+
+    #[test]
+    fn empty_or_malformed_payload_fails_open() {
+        assert_eq!(verdict("claude-code", "", Some(marker())), None);
+        assert_eq!(verdict("claude-code", "not json", Some(marker())), None);
+    }
+
+    #[test]
+    fn codex_install_writes_project_hook_marker_and_manifest() {
+        let c = setup();
+        install("codex", &c.stage_root);
+
+        let marker = read_json(
+            &c.stage_root
+                .join(".agents")
+                .join("skills")
+                .join(GUARD_MARKER),
+        );
+        assert_eq!(marker["active"], json!(true));
+        // The Codex guard shares the env-scoped roots: the staged `.agents/skills`
+        // dir lives inside `stage_root`, so the single env root already covers it.
+        let env = absolutize(&c.stage_root).display().to_string();
+        assert!(
+            marker["allowedRoots"]
+                .as_array()
+                .unwrap()
+                .iter()
+                .any(|r| r.as_str().unwrap() == env)
+        );
+
+        let hooks = read_json(&codex_hooks_path(&c.stage_root));
+        let hook = &hooks["hooks"]["PreToolUse"][0];
+        assert!(hook["matcher"].as_str().unwrap().contains("apply_patch"));
+        assert!(
+            hook["hooks"][0]["command"]
+                .as_str()
+                .unwrap()
+                .contains("guard-codex")
+        );
+        assert!(
+            c.stage_root
+                .join(".agents")
+                .join("skills")
+                .join(GUARD_MANIFEST)
+                .exists()
+        );
+    }
+
+    #[test]
+    fn codex_teardown_restores_pre_existing_hooks_json_verbatim() {
+        let c = setup();
+        fs::create_dir_all(c.stage_root.join(".codex")).unwrap();
+        let original = format!(
+            "{}\n",
+            serde_json::to_string_pretty(&json!({
+                "hooks": {
+                    "PostToolUse": [
+                        {
+                            "matcher": "Bash",
+                            "hooks": [{ "type": "command", "command": "echo ok" }]
+                        }
+                    ]
+                }
+            }))
+            .unwrap()
+        );
+        fs::write(codex_hooks_path(&c.stage_root), &original).unwrap();
+
+        install("codex", &c.stage_root);
+        assert!(
+            fs::read_to_string(codex_hooks_path(&c.stage_root))
+                .unwrap()
+                .contains("guard-codex")
+        );
+
+        teardown_guard(&c.stage_root);
+        assert_eq!(
+            fs::read_to_string(codex_hooks_path(&c.stage_root)).unwrap(),
+            original
+        );
+    }
+
+    #[test]
+    fn codex_deny_returns_decision_block_json() {
+        let payload = r#"{ "hook_event_name": "PreToolUse", "tool_name": "Bash", "tool_input": { "command": "npm install left-pad" } }"#;
+        let out = verdict("codex", payload, Some(marker())).expect("should block");
+        let v: Value = serde_json::from_str(&out).unwrap();
+        assert_eq!(v["decision"], "block");
+        assert!(v["reason"].as_str().unwrap().contains("blocked Bash"));
+    }
+
+    #[test]
+    fn codex_apply_patch_outside_allowed_roots_blocks() {
+        let payload = r#"{ "hook_event_name": "PreToolUse", "tool_name": "apply_patch", "tool_input": { "files": ["/etc/passwd"] } }"#;
+        let out = verdict("codex", payload, Some(marker())).expect("should block");
+        let v: Value = serde_json::from_str(&out).unwrap();
+        assert_eq!(v["decision"], "block");
+        assert!(v["reason"].as_str().unwrap().contains("apply_patch"));
+    }
+
+    #[test]
+    fn codex_apply_patch_inside_allowed_roots_allows() {
+        let payload = r#"{ "hook_event_name": "PreToolUse", "tool_name": "apply_patch", "tool_input": { "files": ["/work/.eval-magic/out.md"] } }"#;
+        assert_eq!(verdict("codex", payload, Some(marker())), None);
+    }
+
+    /// The cleanup dir is derived from the guard data: the hooks file's parent,
+    /// unless the hook file sits at the env root or inside the skills dir's
+    /// ancestry (staging already owns that tree).
+    #[test]
+    fn hook_cleanup_dir_derivation_table() {
+        let root = Path::new("/env");
+        let with = |hooks_file: &str| {
+            let mut guard = descriptor("codex").guard.unwrap();
+            guard.hooks_file = hooks_file.to_string();
+            guard
+        };
+
+        // Claude: `.claude` is the skills dir's parent — staging owns it.
+        assert_eq!(
+            hook_cleanup_dir(
+                &with(".claude/settings.local.json"),
+                Some(".claude/skills"),
+                root
+            ),
+            None
+        );
+        // Codex: `.codex` is created for the hook alone — prune it.
+        assert_eq!(
+            hook_cleanup_dir(&with(".codex/hooks.json"), Some(".agents/skills"), root),
+            Some(PathBuf::from("/env/.codex"))
+        );
+        // Hook file at the env root: never prune the env itself.
+        assert_eq!(
+            hook_cleanup_dir(&with("hooks.json"), Some(".agents/skills"), root),
+            None
+        );
+        // Parent is an ancestor of the skills dir (not merely a string prefix:
+        // `.a` vs `.ab/skills` stays prunable).
+        assert_eq!(
+            hook_cleanup_dir(&with(".a/hooks.json"), Some(".a/b/skills"), root),
+            None
+        );
+        assert_eq!(
+            hook_cleanup_dir(&with(".a/hooks.json"), Some(".ab/skills"), root),
+            Some(PathBuf::from("/env/.a"))
+        );
+    }
+}
diff --git a/src/adapters/harness.rs b/src/adapters/harness.rs
index 07426c3..ea8c835 100644
--- a/src/adapters/harness.rs
+++ b/src/adapters/harness.rs
@@ -1,181 +1,357 @@
-//! The harness adapter API — the single seam between generic run-mode code and
+//! The harness adapter API — the single seam between generic dispatch code and
 //! harness-specific behavior.
 //!
-//! Every harness-specific concern hangs off the [`HarnessAdapter`] trait: how
-//! discoverable skills are presented in a dispatch prompt, how a persisted
-//! transcript is parsed, where staged skills live, and which native hook the
-//! write guard installs. Generic code resolves an adapter with [`adapter_for`]
-//! and then calls the trait — so [`adapter_for`] is the one place that names a
-//! concrete harness for this surface.
+//! The trait is tiered into a **baseline** every harness must implement and
+//! **enhancements** that raise fidelity when a harness has the native support:
+//!
+//! - **Baseline (required):** [`label`](HarnessAdapter::label) and
+//!   [`skills_dir`](HarnessAdapter::skills_dir). A new harness compiles with
+//!   just these two methods; dispatched through its one-shot CLI (with
+//!   `--no-stage` inlining the skill when native staging isn't wired), it
+//!   already supports `llm_judge` grading and the `detect-stray-writes`
+//!   post-pass.
+//! - **Enhancements (defaulted):** every other method has a default — either a
+//!   working generic fallback (e.g. the plain available-skills block) or an
+//!   `Unsupported` error naming the enhancement it belongs to (e.g. transcript
+//!   ingest, the write guard). Override the methods of an enhancement to wire
+//!   it for a harness.
+//!
+//! Generic code resolves an adapter with [`adapter_for`](super::registry::adapter_for)
+//! and then calls the trait — so the [`registry`](super::registry) is the one
+//! place that names a concrete harness for this surface. The impls live in the
+//! per-harness modules ([`claude_code`](super::claude_code),
+//! [`codex`](super::codex), [`opencode`](super::opencode)).
 
 use std::io;
 use std::path::{Path, PathBuf};
 use std::time::Duration;
 
-use crate::core::{AvailableSkill, Harness, ToolInvocation};
+use crate::core::{AvailableSkill, HarnessRunCapabilities, ToolInvocation};
+use crate::sandbox::GuardMarker;
 
 use super::TranscriptSummary;
-use super::claude_cli::{
-    claude_exec_command_template, claude_judge_dispatch_recipe, claude_parallel_dispatch_recipe,
-};
-use super::codex_cli::{
-    codex_exec_command_template, codex_judge_dispatch_recipe, codex_parallel_dispatch_recipe,
-};
-use super::{
-    parse_claude_stream_json, parse_claude_stream_json_full, parse_codex_events,
-    parse_codex_events_full, parse_transcript, parse_transcript_full,
-    render_available_skills_block, render_codex_available_skills_block,
-    render_opencode_available_skills_block,
-};
-
-/// The behavior that varies by harness. Generic run-mode code depends on this
-/// trait, never on a concrete harness variant.
+use super::skill_shadow::PluginShadowReport;
+
+/// One harness's tool-name vocabulary: every name its guard hook payloads or
+/// transcript parser can produce, grouped by role. Consumers match against the
+/// union across all harnesses ([`all_tool_vocabulary`](super::registry::all_tool_vocabulary)).
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct ToolVocabulary {
+    /// Tools that write the filesystem with a single target path argument.
+    pub write_tools: Vec<String>,
+    /// apply_patch-style tools whose payload carries multiple patch targets.
+    pub patch_tools: Vec<String>,
+    /// Shell-execution tools carrying a `command` argument.
+    pub shell_tools: Vec<String>,
+    /// Read-only tools carrying a target path argument.
+    pub read_tools: Vec<String>,
+}
+
+/// The behavior that varies by harness. Generic dispatch code depends on this
+/// trait, never on a concrete harness variant. See the module docs for the
+/// baseline-vs-enhancement contract.
 pub trait HarnessAdapter {
-    /// The kebab-case identifier used in CLI flags, `dispatch.json`, and the
-    /// staged `conditions.json`.
-    fn label(&self) -> &'static str;
-
-    /// The project-local directory staged skills live under for this harness.
-    fn skills_dir(&self, repo_root: &Path) -> PathBuf;
-
-    /// Whether a staged skill's frontmatter `name:` is rewritten to its slug so
-    /// the harness's repo-local discovery resolves the staged copy.
-    fn rewrites_frontmatter_name(&self) -> bool;
-
-    /// Whether the skill-under-test is advertised in the available-skills block
-    /// under its staged slug (vs. its natural name). True for Codex, whose
-    /// repo-local discovery keys on the rewritten frontmatter name. (OpenCode
-    /// also rewrites the frontmatter to the slug yet still advertises the natural
-    /// name — a known inconsistency tracked for a separate fix.)
-    fn advertises_staged_slug_name(&self) -> bool;
-
-    /// Render the discoverable skills the way this harness natively surfaces
-    /// them (e.g. Claude Code's Skill-tool list, Codex's `## Skills`, OpenCode's
-    /// `<available_skills>` XML).
-    fn render_available_skills_block(&self, skills: &[AvailableSkill]) -> String;
-
-    /// How a staged skill is described as discoverable in the neutral
-    /// slug-disambiguation line (e.g. "via the Skill tool").
-    fn skill_surface_phrase(&self) -> &'static str;
-
-    /// The lead-in for the fallback "read the skill from `<path>`" instruction
-    /// when the staged identifier can't be resolved.
-    fn skill_unresolved_phrase(&self) -> &'static str;
-
-    /// The verbatim plan-mode procedure profile bundled for this harness.
-    fn plan_mode_profile(&self) -> &'static str;
-
-    /// Wrap a plan-mode profile as a `<system-reminder>` operating-context
-    /// layer. The default usually suffices.
-    fn render_plan_mode_context(&self, profile_text: &str) -> String {
-        let trimmed = profile_text.trim();
-        if trimmed.is_empty() {
-            return String::new();
+    // ── Baseline (required) — every harness implements these ────────────────
+
+    /// **Baseline.** The kebab-case identifier used in CLI flags,
+    /// `dispatch.json`, and the staged `conditions.json`.
+    fn label(&self) -> String;
+
+    /// **Baseline.** The project-local directory staged skills live under for
+    /// this harness. Under `--no-stage` nothing is staged into it, so a
+    /// baseline harness may point this at any repo-local path its discovery
+    /// would read. `None` when the harness declares no skills directory —
+    /// native staging is then unavailable and the run preflight forces
+    /// `--no-stage` (each SKILL.md is inlined into its dispatch prompt).
+    fn skills_dir(&self, repo_root: &Path) -> Option<PathBuf>;
+
+    // ── Run-option capabilities (defaulted) ──────────────────────────────────
+
+    /// The run options the generic `run` preflight may accept for this
+    /// harness. The default is the baseline: no write guard, `--bootstrap` and
+    /// `--stage-name` allowed alongside `--no-stage`. Override alongside the
+    /// enhancement that changes support (e.g. wiring the write guard flips
+    /// `supports_guard`).
+    fn run_capabilities(&self) -> HarnessRunCapabilities {
+        HarnessRunCapabilities {
+            supports_guard: false,
+            supports_bootstrap_with_no_stage: true,
+            supports_stage_name_with_no_stage: true,
         }
-        format!("<system-reminder>\n{trimmed}\n</system-reminder>")
     }
 
-    /// The **interactive** (agent-followed) `RUNBOOK.md` template a harness uses
-    /// under [`InSession`](crate::core::DispatchMechanism::InSession) dispatch,
-    /// carrying `{{TOKEN}}` placeholders the run fills. The default is the shared
-    /// headless template (harmless for the Cli-only harnesses that never read it
-    /// via this path); [`InSession`](crate::core::DispatchMechanism::InSession)
-    /// harnesses override it. The Cli-dispatch runbook always uses
-    /// [`HEADLESS_RUNBOOK_TEMPLATE`], selected by mechanism in `build_runbook`.
-    fn runbook_template(&self) -> &'static str {
-        HEADLESS_RUNBOOK_TEMPLATE
+    /// The project-local config dir names this harness reads or the adapter
+    /// writes (e.g. `.claude`). Staging excludes every harness's config dirs
+    /// when copying a skill's sibling assets, so a stray checked-in config dir
+    /// never rides into a staged env. Via
+    /// [`all_config_dir_names`](super::registry::all_config_dir_names) this list
+    /// also feeds the guard's Bash tamper rule and detect-stray-writes'
+    /// staging-dir lookbehind, so adding a dir here automatically grows the
+    /// write-guard's deny surface. List the parent of
+    /// [`skills_dir`](Self::skills_dir) plus any hook/config dirs the adapter
+    /// writes.
+    fn config_dir_names(&self) -> Vec<String> {
+        Vec::new()
+    }
+
+    /// The tool names this harness's guard hook payloads and parsed transcripts
+    /// use, grouped by role. Via
+    /// [`all_tool_vocabulary`](super::registry::all_tool_vocabulary) this feeds the guard
+    /// arbiter's tool classification and detect-stray-writes' invocation audit,
+    /// so list every name this harness's surfaces produce — even names another
+    /// harness also uses; the union dedups. Default empty: a harness with no
+    /// guard and no transcript parser contributes nothing.
+    fn tool_vocabulary(&self) -> ToolVocabulary {
+        ToolVocabulary::default()
+    }
+
+    // ── Enhancement: native skill staging (defaulted) ────────────────────────
+    // Fallback without it: `--no-stage` inlines each SKILL.md into its
+    // dispatch prompt instead of staging files for native discovery.
+
+    /// **Enhancement: native staging.** Build the conspicuous staged-skill
+    /// slug. The default underscore form is fine for any harness without
+    /// naming rules; a harness with constrained skill names (e.g. OpenCode)
+    /// overrides it. `prefix` must be preserved so cleanup prefix-scans still
+    /// find the staged dir.
+    fn staged_slug(
+        &self,
+        prefix: &str,
+        iteration: u32,
+        condition: &str,
+        skill_name: &str,
+    ) -> String {
+        format!("{prefix}{iteration}-{condition}__{skill_name}")
+    }
+
+    /// **Enhancement: native staging.** Validate a staged-skill identifier
+    /// (generated slug or `--stage-name` override) against this harness's
+    /// naming rules. The default accepts anything.
+    fn validate_stage_name(&self, _name: &str) -> Result<(), String> {
+        Ok(())
+    }
+
+    /// **Enhancement: native staging.** Whether a staged skill's frontmatter
+    /// `name:` is rewritten to its slug so the harness's repo-local discovery
+    /// resolves the staged copy.
+    fn rewrites_frontmatter_name(&self) -> bool {
+        false
+    }
+
+    /// **Enhancement: native staging.** Whether the skill-under-test is
+    /// advertised in the available-skills block under its staged slug (vs. its
+    /// natural name). True for Codex, whose repo-local discovery keys on the
+    /// rewritten frontmatter name. (OpenCode also rewrites the frontmatter to
+    /// the slug yet still advertises the natural name — a known inconsistency
+    /// tracked for a separate fix.)
+    fn advertises_staged_slug_name(&self) -> bool {
+        false
+    }
+
+    /// **Enhancement: native staging.** Render the discoverable skills the way
+    /// this harness natively surfaces them (e.g. Claude Code's Skill-tool
+    /// list, Codex's `## Skills`, OpenCode's `<available_skills>` XML). The
+    /// default is a neutral bulleted list.
+    fn render_available_skills_block(&self, skills: &[AvailableSkill]) -> String {
+        super::skills_block::render_skills_block(
+            super::skills_block::DEFAULT_HEADER,
+            super::skills_block::DEFAULT_ITEM,
+            "",
+            skills,
+        )
+    }
+
+    /// **Enhancement: native staging.** How a staged skill is described as
+    /// discoverable in the neutral slug-disambiguation line (e.g. "via the
+    /// Skill tool").
+    fn skill_surface_phrase(&self) -> String {
+        "as a discoverable skill".to_string()
+    }
+
+    /// **Enhancement: native staging.** The lead-in for the fallback "read the
+    /// skill from `<path>`" instruction when the staged identifier can't be
+    /// resolved.
+    fn skill_unresolved_phrase(&self) -> String {
+        "If the staged skill cannot be resolved".to_string()
     }
 
-    /// For a [`Cli`](crate::core::DispatchMechanism::Cli)-dispatch harness, the
-    /// filename (under a task's `outputs/` dir) its one-shot CLI writes the
-    /// transcript to. `None` when the harness dispatches in-session (no local
-    /// transcript) or has no Cli-mechanism transcript wired yet.
-    fn cli_events_filename(&self) -> Option<&'static str> {
+    // ── Enhancement: transcript parser (defaulted) ───────────────────────────
+    // Fallback without it: `transcript_check` assertions grade as
+    // unverifiable, `llm_judge` carries the grading, token/cost/duration go
+    // unrecorded, and run records are assembled by hand (or from
+    // `outputs/final-message.md`) instead of auto-ingested.
+
+    /// **Enhancement: transcript parser.** The filename (under a task's
+    /// `outputs/` dir) this harness's one-shot CLI writes the captured
+    /// transcript to. `None` when no transcript ingest is wired — the ingest
+    /// pipeline then never calls the parsers below.
+    fn cli_events_filename(&self) -> Option<String> {
         None
     }
 
-    /// For a [`Cli`](crate::core::DispatchMechanism::Cli)-dispatch harness, the
-    /// native model-selection flag accepted by the harness CLI. `None` means the
-    /// adapter has no model-selection support wired yet.
-    fn cli_model_flag(&self) -> Option<&'static str> {
+    /// **Enhancement: transcript parser.** Parse the events file this
+    /// harness's one-shot CLI wrote (the captured transcript) into ordered
+    /// tool invocations.
+    fn parse_cli_events(&self, _path: &Path) -> io::Result<Vec<ToolInvocation>> {
+        Err(io::Error::new(
+            io::ErrorKind::Unsupported,
+            format!(
+                "transcript ingest is not wired for the {} harness",
+                self.label()
+            ),
+        ))
+    }
+
+    /// **Enhancement: transcript parser.** The full-summary counterpart of
+    /// [`parse_cli_events`](Self::parse_cli_events): tool invocations, deduped
+    /// token usage, duration, and final message text.
+    fn parse_cli_events_full(&self, _path: &Path) -> io::Result<TranscriptSummary> {
+        Err(io::Error::new(
+            io::ErrorKind::Unsupported,
+            format!(
+                "transcript ingest is not wired for the {} harness",
+                self.label()
+            ),
+        ))
+    }
+
+    /// **Enhancement: transcript parser.** Whether the parsed transcript
+    /// exposes a deterministic skill-invocation event the `__skill_invoked`
+    /// meta-check can match. False for Codex (its JSONL has no skill-tool
+    /// event), which routes the meta-check to the LLM-judge fallback.
+    fn transcript_surfaces_skill_invocation(&self) -> bool {
+        true
+    }
+
+    // ── Enhancement: model flag (defaulted) ──────────────────────────────────
+    // Fallback without it: `--agent-model` / `--judge-model` are recorded as
+    // provenance only; dispatches run on the harness's default model.
+
+    /// **Enhancement: model flag.** The native model-selection flag accepted
+    /// by this harness's CLI. `None` means no model-selection support is
+    /// wired.
+    fn cli_model_flag(&self) -> Option<String> {
         None
     }
 
-    /// The `Next:` guidance printed after `run` for a
-    /// [`Cli`](crate::core::DispatchMechanism::Cli)-dispatch harness: how to
-    /// dispatch each task through this harness's one-shot CLI and then ingest.
-    /// Empty for in-session harnesses (their guidance is the mechanism's, not the
-    /// adapter's).
-    fn cli_next_steps(&self, _ctx: CliDispatchContext<'_>) -> String {
-        String::new()
+    // ── Enhancement: write guard (defaulted) ─────────────────────────────────
+    // Fallback without it: the `detect-stray-writes` post-pass (folded into
+    // `ingest`) audits out-of-bounds writes after the fact.
+
+    /// **Enhancement: write guard.** Arm the write guard using this harness's
+    /// native pre-tool hook surface, returning the staged marker path. The
+    /// guard's allowed roots are derived from `stage_root` (the isolated env /
+    /// agent cwd), so it bounds the agent to the same env boundary that
+    /// isolates its reads.
+    fn install_guard(
+        &self,
+        _stage_root: &Path,
+        _guard_exe: &Path,
+        _ttl: Option<Duration>,
+    ) -> io::Result<PathBuf> {
+        Err(io::Error::new(
+            io::ErrorKind::Unsupported,
+            format!("--guard is not supported for the {} harness", self.label()),
+        ))
     }
 
-    /// Extra `dispatch-manifest.md` lines describing this harness's Cli dispatch
-    /// recipe (command template, parallel recipe, ingest note). `None` when the
-    /// harness contributes no Cli-specific manifest section.
-    fn cli_manifest_section(&self, _ctx: CliManifestContext<'_>) -> Option<Vec<String>> {
+    /// **Enhancement: write guard.** The banner printed after `--guard`
+    /// successfully arms, describing the harness's native hook surface and how
+    /// to remove it. `None` for a harness with no write guard (its
+    /// [`install_guard`](Self::install_guard) errors), in which case no banner
+    /// is printed.
+    fn guard_armed_message(&self) -> Option<String> {
         None
     }
 
-    /// The post-`grade` / post-`ingest` judge dispatch guidance for a
-    /// [`Cli`](crate::core::DispatchMechanism::Cli)-dispatch harness. `None`
-    /// leaves the generic in-session-style judge handoff in place.
-    fn cli_judge_next_steps(&self, _ctx: CliJudgeContext<'_>) -> Option<String> {
+    /// **Enhancement: write guard.** Evaluate a PreToolUse hook `payload`
+    /// against `marker`, returning the serialized deny verdict to print on
+    /// stdout, or `None` to allow. The default fails open — a harness with no
+    /// guard never denies — matching the hook entry points' contract that a
+    /// guard invocation can never brick a session.
+    fn guard_verdict(&self, _payload: &str, _marker: Option<GuardMarker>) -> Option<String> {
         None
     }
 
-    /// Parse a persisted transcript into its ordered tool invocations.
-    fn parse_transcript(&self, path: &Path) -> io::Result<Vec<ToolInvocation>>;
+    /// **Enhancement: write guard.** A hook-config dir the guard install
+    /// created outside [`skills_dir`](Self::skills_dir) (e.g. Codex's
+    /// `.codex/`), which teardown prunes when restoring the original config
+    /// leaves it empty. `None` when the guard writes only under existing dirs.
+    fn guard_hook_cleanup_dir(&self, _stage_root: &Path) -> Option<PathBuf> {
+        None
+    }
 
-    /// Parse a persisted transcript into the full summary: tool invocations,
-    /// deduped token usage, duration, and final message text.
-    fn parse_transcript_full(&self, path: &Path) -> io::Result<TranscriptSummary>;
+    // ── Enhancement: shadow preflight (defaulted) ────────────────────────────
+    // Fallback without it: no preflight — the run proceeds with no shadow
+    // report, exactly as for a harness whose dispatches load nothing global.
 
-    /// Parse a [`Cli`](crate::core::DispatchMechanism::Cli)-mechanism events file
-    /// (the harness CLI's captured output) into ordered tool invocations. Defaults
-    /// to [`parse_transcript`](Self::parse_transcript): for Codex/OpenCode the
-    /// on-disk parser already *is* the events parser, so the default is correct;
-    /// Claude Code overrides it, because its `parse_transcript` is the in-session
-    /// subagent parser while its Cli events are `claude -p` stream-json.
-    fn parse_cli_events(&self, path: &Path) -> io::Result<Vec<ToolInvocation>> {
-        self.parse_transcript(path)
+    /// **Enhancement: shadow preflight.** Detect staged skill names that are
+    /// also discoverable from the operator's live environment (e.g. Claude
+    /// Code's enabled plugins or global skills dir), which contaminates the
+    /// with/without comparison. `scan_root` is a real staged env root — its
+    /// project-local settings participate in detection. `None` when the
+    /// harness has no shadow preflight (the default) or nothing is shadowed.
+    fn detect_shadowed_skills(
+        &self,
+        _scan_root: &Path,
+        _staged_skill_names: &[&str],
+    ) -> Option<PluginShadowReport> {
+        None
     }
 
-    /// The full-summary counterpart of [`parse_cli_events`](Self::parse_cli_events).
-    fn parse_cli_events_full(&self, path: &Path) -> io::Result<TranscriptSummary> {
-        self.parse_transcript_full(path)
+    // ── Enhancement: plan-mode context (defaulted) ───────────────────────────
+
+    /// **Enhancement: plan-mode context.** Wrap a plan-mode profile as an
+    /// operating-context layer. The shared `<system-reminder>` default
+    /// usually suffices; a harness with a real native plan mode could inject
+    /// it differently.
+    fn render_plan_mode_context(&self, profile_text: &str) -> String {
+        let trimmed = profile_text.trim();
+        if trimmed.is_empty() {
+            return String::new();
+        }
+        format!("<system-reminder>\n{trimmed}\n</system-reminder>")
     }
 
-    /// Arm the write guard using this harness's native pre-tool hook surface,
-    /// returning the staged marker path. The guard's allowed roots are derived
-    /// from `stage_root` (the isolated env / agent cwd), so it bounds the agent to
-    /// the same env boundary that isolates its reads.
-    fn install_guard(
-        &self,
-        stage_root: &Path,
-        guard_exe: &Path,
-        ttl: Option<Duration>,
-    ) -> io::Result<PathBuf>;
-
-    /// The banner printed after `--guard` successfully arms, describing the
-    /// harness's native hook surface and how to remove it. Harness-specific text,
-    /// so it lives here rather than in generic run code. `None` for a harness with
-    /// no write guard (its [`install_guard`](Self::install_guard) errors), in which
-    /// case no banner is printed.
-    fn guard_armed_message(&self) -> Option<&'static str> {
+    // ── Enhancement: dispatch recipes (defaulted) ────────────────────────────
+    // Fallback without them: `run` prints the generic handoff and the runbook
+    // carries no copy-pasteable per-task command.
+
+    /// **Enhancement: dispatch recipes.** Whether a copy-pasteable per-task
+    /// exec command is wired (the descriptor's `[dispatch] exec_template`).
+    /// `false` means `RUNBOOK.md` / `dispatch-manifest.md` carry handoff
+    /// guidance without a per-task command recipe, and the `run` preflight
+    /// warns naming that limitation.
+    fn has_dispatch_recipes(&self) -> bool {
+        false
+    }
+
+    /// **Enhancement: dispatch recipes.** The `Next:` guidance printed after
+    /// `run`: how to dispatch each task through this harness's one-shot CLI
+    /// and then ingest. Empty when no dispatch recipe is wired.
+    fn cli_next_steps(&self, _ctx: CliDispatchContext<'_>) -> String {
+        String::new()
+    }
+
+    /// **Enhancement: dispatch recipes.** Extra `dispatch-manifest.md` lines
+    /// describing this harness's dispatch recipe (command template, parallel
+    /// recipe, ingest note). `None` when the harness contributes no manifest
+    /// section.
+    fn cli_manifest_section(&self, _ctx: CliManifestContext<'_>) -> Option<Vec<String>> {
         None
     }
-}
 
-/// The shared **headless** (human-followed) `RUNBOOK.md` template used by every
-/// [`Cli`](crate::core::DispatchMechanism::Cli)-dispatch run, regardless of
-/// harness (Codex, OpenCode, and Claude Code in hybrid/headless).
-pub const HEADLESS_RUNBOOK_TEMPLATE: &str =
-    include_str!("../../profiles/shared/runbook-headless.md");
+    /// **Enhancement: dispatch recipes.** The post-`grade` / post-`ingest`
+    /// judge dispatch guidance for this harness. `None` leaves the generic
+    /// judge handoff in place.
+    fn cli_judge_next_steps(&self, _ctx: CliJudgeContext<'_>) -> Option<String> {
+        None
+    }
+}
 
-pub struct ClaudeCodeAdapter;
-pub struct CodexAdapter;
-pub struct OpenCodeAdapter;
+/// The shared (human-followed) `RUNBOOK.md` template used by every run,
+/// regardless of harness (Claude Code, Codex, OpenCode).
+pub const RUNBOOK_TEMPLATE: &str = include_str!("../../profiles/shared/runbook.md");
 
 /// Context for rendering a harness's one-shot CLI agent-dispatch guidance.
 #[derive(Debug, Clone, Copy)]
@@ -200,315 +376,96 @@ pub struct CliJudgeContext<'a> {
     pub iteration_dir: &'a Path,
 }
 
-impl HarnessAdapter for ClaudeCodeAdapter {
-    fn label(&self) -> &'static str {
-        "claude-code"
-    }
-    fn skills_dir(&self, repo_root: &Path) -> PathBuf {
-        repo_root.join(".claude").join("skills")
-    }
-    fn rewrites_frontmatter_name(&self) -> bool {
-        false
-    }
-    fn advertises_staged_slug_name(&self) -> bool {
-        false
-    }
-    fn render_available_skills_block(&self, skills: &[AvailableSkill]) -> String {
-        render_available_skills_block(skills)
-    }
-    fn skill_surface_phrase(&self) -> &'static str {
-        "via the Skill tool"
-    }
-    fn skill_unresolved_phrase(&self) -> &'static str {
-        "If the Skill tool cannot resolve that identifier"
-    }
-    fn plan_mode_profile(&self) -> &'static str {
-        include_str!("../../profiles/claude-code/plan-mode.md")
-    }
-    fn runbook_template(&self) -> &'static str {
-        include_str!("../../profiles/claude-code/runbook.md")
-    }
-    fn cli_events_filename(&self) -> Option<&'static str> {
-        Some("claude-events.jsonl")
-    }
-    fn cli_model_flag(&self) -> Option<&'static str> {
-        Some("--model")
-    }
-    fn cli_next_steps(&self, ctx: CliDispatchContext<'_>) -> String {
-        format!(
-            "\nNext: iterate the tasks[] array in dispatch.json and dispatch each task (from the env dir — `claude` has no --cd flag) with:\n{}\nThen run `ingest{target_args} --iteration {iteration} --harness claude-code`.",
-            claude_exec_command_template(self.cli_model_flag(), ctx.agent_model),
-            target_args = ctx.target_args,
-            iteration = ctx.iteration
-        )
-    }
-    fn cli_manifest_section(&self, ctx: CliManifestContext<'_>) -> Option<Vec<String>> {
-        Some(vec![
-            "After all dispatches (Claude Code hybrid):".to_string(),
-            String::new(),
-            "Run one fresh `claude -p` per task from the env dir (`cd <eval-root>` — `claude` has no --cd flag). `--output-format stream-json` requires `--verbose`; detach stdin with `</dev/null` so a permission prompt cannot block and piped task data cannot become extra prompt context; capture stdout as `outputs/claude-events.jsonl` and stderr as `outputs/claude-stderr.log`.".to_string(),
-            String::new(),
-            "```bash".to_string(),
-            claude_exec_command_template(self.cli_model_flag(), ctx.agent_model),
-            "```".to_string(),
-            String::new(),
-            "Parallel dispatch from this iteration directory:".to_string(),
-            String::new(),
-            "```bash".to_string(),
-            claude_parallel_dispatch_recipe(self.cli_model_flag(), ctx.agent_model),
-            "```".to_string(),
-            String::new(),
-            "Then run `eval-magic ingest --harness claude-code --run-mode hybrid`; Claude hybrid ingest reads each task's `outputs/claude-events.jsonl`.".to_string(),
-            String::new(),
-        ])
-    }
-    fn cli_judge_next_steps(&self, ctx: CliJudgeContext<'_>) -> Option<String> {
-        Some(claude_judge_dispatch_recipe(
-            self.cli_model_flag(),
-            ctx.iteration_dir,
-        ))
-    }
-    fn parse_transcript(&self, path: &Path) -> io::Result<Vec<ToolInvocation>> {
-        parse_transcript(path)
-    }
-    fn parse_transcript_full(&self, path: &Path) -> io::Result<TranscriptSummary> {
-        parse_transcript_full(path)
-    }
-    fn parse_cli_events(&self, path: &Path) -> io::Result<Vec<ToolInvocation>> {
-        parse_claude_stream_json(path)
-    }
-    fn parse_cli_events_full(&self, path: &Path) -> io::Result<TranscriptSummary> {
-        parse_claude_stream_json_full(path)
-    }
-    fn install_guard(
-        &self,
-        stage_root: &Path,
-        guard_exe: &Path,
-        ttl: Option<Duration>,
-    ) -> io::Result<PathBuf> {
-        crate::sandbox::install::install_claude_guard(stage_root, guard_exe, ttl)
-    }
-    fn guard_armed_message(&self) -> Option<&'static str> {
-        Some(
-            "\n🛡 Write guard armed: a PreToolUse hook is staged in .claude/settings.local.json\n   and will block writes/installs outside the eval sandbox during dispatches —\n   both in-session subagents and `claude -p` (hybrid/headless), which loads the\n   hook from the env cwd each dispatch runs in.\n   It auto-expires in 6h and is removed on the next run; to remove it now:\n     eval-magic teardown-guard",
-        )
-    }
-}
-
-impl HarnessAdapter for CodexAdapter {
-    fn label(&self) -> &'static str {
-        "codex"
-    }
-    fn skills_dir(&self, repo_root: &Path) -> PathBuf {
-        repo_root.join(".agents").join("skills")
-    }
-    fn rewrites_frontmatter_name(&self) -> bool {
-        true
-    }
-    fn advertises_staged_slug_name(&self) -> bool {
-        true
-    }
-    fn render_available_skills_block(&self, skills: &[AvailableSkill]) -> String {
-        render_codex_available_skills_block(skills)
-    }
-    fn skill_surface_phrase(&self) -> &'static str {
-        "as a Codex skill"
-    }
-    fn skill_unresolved_phrase(&self) -> &'static str {
-        "If it does not load as a Codex skill"
-    }
-    fn plan_mode_profile(&self) -> &'static str {
-        include_str!("../../profiles/codex/plan-mode.md")
-    }
-    fn cli_events_filename(&self) -> Option<&'static str> {
-        Some("codex-events.jsonl")
-    }
-    fn cli_model_flag(&self) -> Option<&'static str> {
-        Some("-m")
-    }
-    fn cli_next_steps(&self, ctx: CliDispatchContext<'_>) -> String {
-        format!(
-            "\nNext: iterate the tasks[] array in dispatch.json and dispatch each task with:\n{}\nThen run `ingest{target_args} --iteration {iteration} --harness codex`.",
-            codex_exec_command_template(self.cli_model_flag(), ctx.guard, ctx.agent_model),
-            target_args = ctx.target_args,
-            iteration = ctx.iteration
-        )
-    }
-    fn cli_manifest_section(&self, ctx: CliManifestContext<'_>) -> Option<Vec<String>> {
-        Some(vec![
-            "After all dispatches (Codex):".to_string(),
-            String::new(),
-            "Run one fresh `codex --ask-for-approval never exec --json` per task. Detach stdin with `</dev/null` so piped task data cannot become extra prompt context; capture stdout as `outputs/codex-events.jsonl` and stderr as `outputs/codex-stderr.log`.".to_string(),
-            String::new(),
-            "```bash".to_string(),
-            codex_exec_command_template(self.cli_model_flag(), ctx.guard, ctx.agent_model),
-            "```".to_string(),
-            String::new(),
-            "Parallel dispatch from this iteration directory:".to_string(),
-            String::new(),
-            "```bash".to_string(),
-            codex_parallel_dispatch_recipe(self.cli_model_flag(), ctx.guard, ctx.agent_model),
-            "```".to_string(),
-            String::new(),
-            "Then run `eval-magic ingest --harness codex`; Codex transcript ingest reads each task's `outputs/codex-events.jsonl`.".to_string(),
-            String::new(),
-        ])
-    }
-    fn cli_judge_next_steps(&self, ctx: CliJudgeContext<'_>) -> Option<String> {
-        Some(codex_judge_dispatch_recipe(
-            self.cli_model_flag(),
-            ctx.guard,
-            ctx.iteration_dir,
-        ))
-    }
-    fn parse_transcript(&self, path: &Path) -> io::Result<Vec<ToolInvocation>> {
-        parse_codex_events(path)
-    }
-    fn parse_transcript_full(&self, path: &Path) -> io::Result<TranscriptSummary> {
-        parse_codex_events_full(path)
-    }
-    fn install_guard(
-        &self,
-        stage_root: &Path,
-        guard_exe: &Path,
-        ttl: Option<Duration>,
-    ) -> io::Result<PathBuf> {
-        crate::sandbox::install::install_codex_guard(stage_root, guard_exe, ttl)
-    }
-    fn guard_armed_message(&self) -> Option<&'static str> {
-        Some(
-            "\n🛡 Write guard armed: a PreToolUse hook is staged in .codex/hooks.json\n   and will block writes/installs outside the eval sandbox during Codex dispatches.\n   Dispatch with codex --ask-for-approval never exec --dangerously-bypass-hook-trust so the vetted eval hook runs.\n   It auto-expires in 6h and is removed on the next run; to remove it now:\n     eval-magic teardown-guard",
-        )
-    }
-}
-
-impl HarnessAdapter for OpenCodeAdapter {
-    fn label(&self) -> &'static str {
-        "opencode"
-    }
-    fn skills_dir(&self, repo_root: &Path) -> PathBuf {
-        repo_root.join(".opencode").join("skills")
-    }
-    fn rewrites_frontmatter_name(&self) -> bool {
-        true
-    }
-    fn advertises_staged_slug_name(&self) -> bool {
-        false
-    }
-    fn render_available_skills_block(&self, skills: &[AvailableSkill]) -> String {
-        render_opencode_available_skills_block(skills)
-    }
-    fn skill_surface_phrase(&self) -> &'static str {
-        "as an OpenCode skill"
-    }
-    fn skill_unresolved_phrase(&self) -> &'static str {
-        "If it does not load as an OpenCode skill"
-    }
-    fn plan_mode_profile(&self) -> &'static str {
-        include_str!("../../profiles/opencode/plan-mode.md")
-    }
-    fn cli_next_steps(&self, ctx: CliDispatchContext<'_>) -> String {
-        let model_note = if ctx.agent_model.is_some() {
-            " Model selection was recorded as provenance, but the OpenCode adapter has no CLI model flag wired yet."
-        } else {
-            ""
-        };
-        format!(
-            "\nNext: iterate the tasks[] array in dispatch.json and dispatch each task with `opencode run`.{model_note} OpenCode transcript ingest is not yet wired, so assemble each task's `run.json`/`timing.json` manually (or capture `opencode run --format json` / `opencode export` output), then run `ingest{target_args} --iteration {iteration} --harness opencode`.",
-            target_args = ctx.target_args,
-            iteration = ctx.iteration
-        )
-    }
-    // OpenCode transcript ingest is not yet wired. In the current dispatch flow
-    // this is unreachable (no subagents dir and no events file), so delegating to
-    // the shared JSONL parser preserves the pre-refactor behavior of the
-    // transcript-source branch until OpenCode ingest lands.
-    fn parse_transcript(&self, path: &Path) -> io::Result<Vec<ToolInvocation>> {
-        parse_transcript(path)
-    }
-    fn parse_transcript_full(&self, path: &Path) -> io::Result<TranscriptSummary> {
-        parse_transcript_full(path)
-    }
-    fn install_guard(
-        &self,
-        _stage_root: &Path,
-        _guard_exe: &Path,
-        _ttl: Option<Duration>,
-    ) -> io::Result<PathBuf> {
-        Err(io::Error::new(
-            io::ErrorKind::Unsupported,
-            "--guard is not yet supported for the opencode harness",
-        ))
-    }
-}
-
-/// Resolve the adapter for a [`Harness`]. This is the single dispatch point on
-/// the harness variant for all harness-specific behavior; every other module
-/// goes through the returned trait object.
-pub fn adapter_for(harness: Harness) -> &'static dyn HarnessAdapter {
-    match harness {
-        Harness::ClaudeCode => &ClaudeCodeAdapter,
-        Harness::Codex => &CodexAdapter,
-        Harness::OpenCode => &OpenCodeAdapter,
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::adapters::registry::adapter_for;
+    use crate::core::Harness;
+
+    // Cross-method invariants (guard/banner lockstep, hook-matcher ⊆
+    // vocabulary, slug ↔ naming rules, …) are enforced at descriptor load
+    // time in `descriptor::validation`; only per-value pins live here.
+
+    #[test]
+    fn detect_shadowed_skills_defaults_to_none_for_harnesses_without_a_preflight() {
+        for h in [
+            Harness::resolve("codex").unwrap(),
+            Harness::resolve("opencode").unwrap(),
+        ] {
+            assert_eq!(
+                adapter_for(h).detect_shadowed_skills(Path::new("/nonexistent"), &["any-skill"]),
+                None
+            );
+        }
+    }
 
     #[test]
-    fn labels_match_kebab_case_identifiers() {
-        assert_eq!(adapter_for(Harness::ClaudeCode).label(), "claude-code");
-        assert_eq!(adapter_for(Harness::Codex).label(), "codex");
-        assert_eq!(adapter_for(Harness::OpenCode).label(), "opencode");
+    fn has_dispatch_recipes_matches_the_readme_support_table() {
+        assert!(adapter_for(Harness::resolve("claude-code").unwrap()).has_dispatch_recipes());
+        assert!(adapter_for(Harness::resolve("codex").unwrap()).has_dispatch_recipes());
+        assert!(!adapter_for(Harness::resolve("opencode").unwrap()).has_dispatch_recipes());
     }
 
     #[test]
     fn skills_dir_is_harness_native() {
         let root = Path::new("/repo");
         assert_eq!(
-            adapter_for(Harness::ClaudeCode).skills_dir(root),
-            root.join(".claude").join("skills")
+            adapter_for(Harness::resolve("claude-code").unwrap()).skills_dir(root),
+            Some(root.join(".claude").join("skills"))
         );
         assert_eq!(
-            adapter_for(Harness::Codex).skills_dir(root),
-            root.join(".agents").join("skills")
+            adapter_for(Harness::resolve("codex").unwrap()).skills_dir(root),
+            Some(root.join(".agents").join("skills"))
         );
         assert_eq!(
-            adapter_for(Harness::OpenCode).skills_dir(root),
-            root.join(".opencode").join("skills")
+            adapter_for(Harness::resolve("opencode").unwrap()).skills_dir(root),
+            Some(root.join(".opencode").join("skills"))
         );
     }
 
     #[test]
     fn only_codex_and_opencode_rewrite_frontmatter() {
-        assert!(!adapter_for(Harness::ClaudeCode).rewrites_frontmatter_name());
-        assert!(adapter_for(Harness::Codex).rewrites_frontmatter_name());
-        assert!(adapter_for(Harness::OpenCode).rewrites_frontmatter_name());
+        assert!(!adapter_for(Harness::resolve("claude-code").unwrap()).rewrites_frontmatter_name());
+        assert!(adapter_for(Harness::resolve("codex").unwrap()).rewrites_frontmatter_name());
+        assert!(adapter_for(Harness::resolve("opencode").unwrap()).rewrites_frontmatter_name());
     }
 
     #[test]
     fn plan_mode_context_wraps_in_system_reminder_for_every_harness() {
-        for h in [Harness::ClaudeCode, Harness::Codex, Harness::OpenCode] {
+        for h in Harness::known() {
             let out = adapter_for(h).render_plan_mode_context("BODY");
             assert_eq!(out, "<system-reminder>\nBODY\n</system-reminder>");
             assert_eq!(adapter_for(h).render_plan_mode_context("   "), "");
+            assert_eq!(
+                adapter_for(h).render_plan_mode_context("\n\n  BODY  \n\n"),
+                "<system-reminder>\nBODY\n</system-reminder>"
+            );
         }
     }
 
     #[test]
-    fn claude_adapter_advertises_cli_events_file_and_model_flag() {
-        let a = adapter_for(Harness::ClaudeCode);
-        assert_eq!(a.cli_events_filename(), Some("claude-events.jsonl"));
-        assert_eq!(a.cli_model_flag(), Some("--model"));
+    fn run_capabilities_capture_run_option_support_by_harness() {
+        let claude = adapter_for(Harness::resolve("claude-code").unwrap()).run_capabilities();
+        assert!(claude.supports_guard);
+        assert!(claude.supports_bootstrap_with_no_stage);
+        assert!(claude.supports_stage_name_with_no_stage);
+
+        let codex = adapter_for(Harness::resolve("codex").unwrap()).run_capabilities();
+        assert!(codex.supports_guard);
+        assert!(!codex.supports_bootstrap_with_no_stage);
+        assert!(!codex.supports_stage_name_with_no_stage);
+
+        let opencode = adapter_for(Harness::resolve("opencode").unwrap()).run_capabilities();
+        assert!(!opencode.supports_guard);
+        assert!(opencode.supports_bootstrap_with_no_stage);
+        assert!(opencode.supports_stage_name_with_no_stage);
     }
 
     #[test]
     fn guard_armed_message_is_harness_specific_and_absent_for_opencode() {
         // The post-arm `--guard` banner names the harness's native hook surface,
         // so it lives behind the adapter rather than in generic run code.
-        let claude = adapter_for(Harness::ClaudeCode)
+        let claude = adapter_for(Harness::resolve("claude-code").unwrap())
             .guard_armed_message()
             .expect("claude code has a write guard");
         assert!(
@@ -516,7 +473,7 @@ mod tests {
             "claude banner names its hook file: {claude}"
         );
 
-        let codex = adapter_for(Harness::Codex)
+        let codex = adapter_for(Harness::resolve("codex").unwrap())
             .guard_armed_message()
             .expect("codex has a write guard");
         assert!(
@@ -526,50 +483,32 @@ mod tests {
 
         // OpenCode has no write guard (its install_guard errors), so there is no
         // banner to print.
-        assert_eq!(adapter_for(Harness::OpenCode).guard_armed_message(), None);
-    }
-
-    #[test]
-    fn claude_parse_cli_events_full_reads_stream_json_result_event() {
-        use serde_json::json;
-        let dir = tempfile::TempDir::new().unwrap();
-        let path = dir.path().join("claude-events.jsonl");
-        // No per-line timestamps; the result event is the only source of duration.
-        let lines = [
-            json!({"type": "assistant", "message": {"id": "msg_1", "role": "assistant", "content": [
-                {"type": "tool_use", "id": "toolu_1", "name": "Bash", "input": {"command": "ls"}}
-            ]}}),
-            json!({"type": "result", "subtype": "success", "is_error": false, "result": "Done", "duration_ms": 5637, "usage": {"input_tokens": 1, "output_tokens": 2, "cache_creation_input_tokens": 0, "cache_read_input_tokens": 0}}),
-        ];
-        let body = lines
-            .iter()
-            .map(|l| l.to_string())
-            .collect::<Vec<_>>()
-            .join("\n");
-        std::fs::write(&path, format!("{body}\n")).unwrap();
-
-        let a = adapter_for(Harness::ClaudeCode);
-        let summary = a.parse_cli_events_full(&path).unwrap();
-        assert_eq!(summary.final_text, Some("Done".into()));
-        assert_eq!(summary.duration_ms, Some(5637));
-        assert_eq!(summary.tool_invocations.len(), 1);
-        assert_eq!(summary.tool_invocations[0].name, "Bash");
-
-        // The on-disk parser would find no duration here (no line timestamps),
-        // proving parse_cli_events_full routes to the stream-json parser.
-        assert_eq!(a.parse_transcript_full(&path).unwrap().duration_ms, None);
+        assert_eq!(
+            adapter_for(Harness::resolve("opencode").unwrap()).guard_armed_message(),
+            None
+        );
     }
 
     #[test]
-    fn codex_parse_cli_events_delegates_to_events_parser() {
-        use serde_json::json;
-        let dir = tempfile::TempDir::new().unwrap();
-        let path = dir.path().join("codex-events.jsonl");
-        let line = json!({"type": "item.completed", "item": {"id": "i1", "type": "command_execution", "command": "bun test", "output": "ok"}});
-        std::fs::write(&path, format!("{line}\n")).unwrap();
-
-        let inv = adapter_for(Harness::Codex).parse_cli_events(&path).unwrap();
-        assert_eq!(inv.len(), 1);
-        assert_eq!(inv[0].name, "command_execution");
+    fn staged_slug_default_and_opencode_override_preserve_the_prefix() {
+        let prefix = "slow-powers-eval-";
+        assert_eq!(
+            adapter_for(Harness::resolve("claude-code").unwrap()).staged_slug(
+                prefix,
+                2,
+                "with_skill",
+                "my-skill"
+            ),
+            "slow-powers-eval-2-with_skill__my-skill"
+        );
+        assert_eq!(
+            adapter_for(Harness::resolve("opencode").unwrap()).staged_slug(
+                prefix,
+                2,
+                "with_skill",
+                "my-skill"
+            ),
+            "slow-powers-eval-2-with-skill-my-skill"
+        );
     }
 }
diff --git a/src/adapters/mod.rs b/src/adapters/mod.rs
index f48abb1..a6d7b5c 100644
--- a/src/adapters/mod.rs
+++ b/src/adapters/mod.rs
@@ -1,43 +1,42 @@
 //! The harness adapter layer.
 //!
 //! [`harness`] defines the [`HarnessAdapter`] trait — the single API generic
-//! run-mode code uses to reach harness-specific behavior. The per-harness
-//! session renderers + transcript parsers it delegates to live in the sibling
-//! submodules, plus plugin-shadow detection. The submodules are re-exported
-//! flat so downstream code writes `crate::adapters::<fn>`.
+//! dispatch code uses to reach harness-specific behavior. Each harness's
+//! declarative half lives in its embedded descriptor file
+//! (`harnesses/<label>.toml`, loaded by [`descriptor`] and served through the
+//! generic [`descriptor_adapter`]); the code-backed features a descriptor
+//! references by name live in [`capabilities`], backed by the per-harness
+//! module trees ([`claude_code`], [`codex`], [`opencode`]): transcript
+//! parsers, plugin-shadow detection, slug sanitization. The write guard is
+//! pure descriptor data rendered by the generic engine in [`guard`].
+//! The [`registry`] loads the descriptors into label-keyed entries and owns
+//! harness-identifier resolution; generic code resolves an adapter with
+//! [`adapter_for`] and calls the trait.
 
-mod claude_cli;
-pub mod claude_code_session;
-pub mod claude_code_transcript;
-pub mod claude_stream_json;
+pub mod capabilities;
+pub mod claude_code;
 mod cli_command;
-mod codex_cli;
-pub mod codex_session;
-pub mod codex_transcript;
+pub mod codex;
+pub mod descriptor;
+pub mod descriptor_adapter;
+pub mod extract;
+pub(crate) mod guard;
 pub mod harness;
-pub mod opencode_session;
-pub mod plugin_shadow;
+pub mod opencode;
+pub mod registry;
+pub mod skill_shadow;
+mod skills_block;
+pub mod transcript;
 
 pub use harness::{
-    ClaudeCodeAdapter, CliDispatchContext, CliJudgeContext, CliManifestContext, CodexAdapter,
-    HEADLESS_RUNBOOK_TEMPLATE, HarnessAdapter, OpenCodeAdapter, adapter_for,
+    CliDispatchContext, CliJudgeContext, CliManifestContext, HarnessAdapter, RUNBOOK_TEMPLATE,
+    ToolVocabulary,
 };
-
-pub use claude_code_session::{
-    render_available_skills_block, render_plan_mode_context, resolve_subagents_dir_for_session,
-    slugify_project_path,
-};
-pub use claude_code_transcript::{
-    SubagentEntry, SubagentMeta, TranscriptSummary, find_by_description, list_subagents,
-    parse_transcript, parse_transcript_full,
-};
-pub use claude_stream_json::{parse_claude_stream_json, parse_claude_stream_json_full};
-pub use codex_session::{render_codex_available_skills_block, render_codex_plan_mode_context};
-pub use codex_transcript::{parse_codex_events, parse_codex_events_full};
-pub use opencode_session::{
-    render_opencode_available_skills_block, render_opencode_plan_mode_context,
+pub use registry::{
+    DEFAULT_HARNESS_NAME, UnknownHarnessError, adapter_for, all_config_dir_names,
+    all_tool_vocabulary,
 };
-pub use plugin_shadow::{
-    PluginShadowReport, ShadowSource, config_dir_from_env, detect_plugin_shadows,
-    format_shadow_banner, resolve_config_dir, shadow_validity_warnings,
+pub use skill_shadow::{
+    PluginShadowReport, ShadowSource, format_shadow_banner, shadow_validity_warnings,
 };
+pub use transcript::TranscriptSummary;
diff --git a/src/adapters/opencode/mod.rs b/src/adapters/opencode/mod.rs
new file mode 100644
index 0000000..859525d
--- /dev/null
+++ b/src/adapters/opencode/mod.rs
@@ -0,0 +1,117 @@
+//! OpenCode harness support.
+//!
+//! The declarative half of this harness lives in `harnesses/opencode.toml`
+//! (including the stage-name rules, expressed as a regex + length cap); this
+//! file keeps only the code-backed `opencode` slug capability — sanitization
+//! and truncation the descriptor's format-string template cannot express.
+
+/// True when `name` satisfies OpenCode's skill-name rules:
+/// - 1–64 characters
+/// - lowercase alphanumeric with single-hyphen separators
+/// - no leading/trailing/consecutive hyphens
+fn is_valid_opencode_name(name: &str) -> bool {
+    if name.is_empty() || name.len() > 64 {
+        return false;
+    }
+    let mut prev = '-';
+    for ch in name.chars() {
+        if ch == '-' {
+            if prev == '-' {
+                return false;
+            }
+        } else if !ch.is_ascii_lowercase() && !ch.is_ascii_digit() {
+            return false;
+        }
+        prev = ch;
+    }
+    !name.starts_with('-') && !name.ends_with('-')
+}
+
+/// Sanitize an arbitrary identifier so it is a valid OpenCode skill name.
+fn sanitize_opencode_name(name: &str) -> String {
+    let mut out = String::new();
+    let mut prev_hyphen = false;
+    for ch in name.to_ascii_lowercase().chars() {
+        if ch.is_ascii_lowercase() || ch.is_ascii_digit() {
+            out.push(ch);
+            prev_hyphen = false;
+        } else if !prev_hyphen {
+            out.push('-');
+            prev_hyphen = true;
+        }
+    }
+    while out.ends_with('-') {
+        out.pop();
+    }
+    while out.starts_with('-') {
+        out.remove(0);
+    }
+    if out.is_empty() {
+        out.push_str("skill");
+    }
+    if out.len() > 64 {
+        out.truncate(64);
+        while out.ends_with('-') {
+            out.pop();
+        }
+    }
+    out
+}
+
+/// Build a slug that is valid for OpenCode's skill directory + frontmatter name
+/// constraints. `prefix` is the conspicuous staged-skill prefix, preserved so
+/// cleanup prefix-scans still find it. `pub(crate)` because the `opencode`
+/// named slug capability dispatches here.
+pub(crate) fn opencode_slug(
+    prefix: &str,
+    iteration: u32,
+    condition: &str,
+    skill_name: &str,
+) -> String {
+    let condition = sanitize_opencode_name(condition);
+    let skill = sanitize_opencode_name(skill_name);
+    let base = format!("{prefix}{iteration}-{condition}-{skill}");
+    if base.len() <= 64 && is_valid_opencode_name(&base) {
+        return base;
+    }
+    // If the combined slug is too long, truncate the skill portion.
+    let prefix = format!("{prefix}{iteration}-{condition}-");
+    let budget = 64usize.saturating_sub(prefix.len());
+    let mut truncated = skill.clone();
+    truncated.truncate(budget);
+    while truncated.ends_with('-') {
+        truncated.pop();
+    }
+    if truncated.is_empty() {
+        truncated.push_str("skill");
+    }
+    format!("{prefix}{truncated}")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const PREFIX: &str = "slow-powers-eval-";
+
+    #[test]
+    fn opencode_slug_sanitizes_underscores_and_special_characters() {
+        assert_eq!(
+            opencode_slug(PREFIX, 1, "with_skill", "My_Skill!"),
+            "slow-powers-eval-1-with-skill-my-skill"
+        );
+        assert_eq!(
+            opencode_slug(PREFIX, 2, "without_skill", "snake_case"),
+            "slow-powers-eval-2-without-skill-snake-case"
+        );
+    }
+
+    #[test]
+    fn opencode_slug_truncates_to_valid_max_length() {
+        let very_long = "a".repeat(200);
+        let slug = opencode_slug(PREFIX, 1, "with_skill", &very_long);
+        assert!(slug.len() <= 64);
+        assert!(is_valid_opencode_name(&slug));
+        assert!(slug.starts_with("slow-powers-eval-1-with-skill-"));
+    }
+}
diff --git a/src/adapters/opencode_session.rs b/src/adapters/opencode_session.rs
deleted file mode 100644
index 64463ae..0000000
--- a/src/adapters/opencode_session.rs
+++ /dev/null
@@ -1,101 +0,0 @@
-//! OpenCode-specific rendering of session-start context.
-//!
-//! OpenCode exposes discoverable skills through the `skill` tool description as
-//! `<available_skills>` XML, and loads them from `.opencode/skills/`. This
-//! adapter mirrors that native presentation so eval dispatches feel like a real
-//! OpenCode session rather than an eval-specific bulletin.
-
-use crate::core::AvailableSkill;
-
-/// Render the discoverable skills the way OpenCode surfaces them in the `skill`
-/// tool description: an `<available_skills>` block with one `<skill>` element
-/// per skill containing `<name>` and `<description>`. Returns an empty string
-/// when no skills are staged.
-pub fn render_opencode_available_skills_block(skills: &[AvailableSkill]) -> String {
-    if skills.is_empty() {
-        return String::new();
-    }
-    let mut sorted: Vec<&AvailableSkill> = skills.iter().collect();
-    sorted.sort_by(|a, b| a.name.cmp(&b.name));
-    let mut out = String::from("<available_skills>");
-    for s in sorted {
-        out.push_str(&format!(
-            "\n  <skill>\n    <name>{}</name>\n    <description>{}</description>\n  </skill>",
-            s.name, s.description
-        ));
-    }
-    out.push_str("\n</available_skills>");
-    out
-}
-
-/// Render an OpenCode plan-mode profile as an operating-context reminder. The
-/// real OpenCode plan agent is a primary agent mode, not text, so this is the
-/// portable approximation: a `<system-reminder>` the dispatch reads.
-pub fn render_opencode_plan_mode_context(profile_text: &str) -> String {
-    let trimmed = profile_text.trim();
-    if trimmed.is_empty() {
-        return String::new();
-    }
-    format!("<system-reminder>\n{trimmed}\n</system-reminder>")
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::core::AvailableSkill;
-
-    fn skill(name: &str, description: &str) -> AvailableSkill {
-        AvailableSkill {
-            name: name.into(),
-            path: format!("/x/{name}/SKILL.md"),
-            description: description.into(),
-        }
-    }
-
-    #[test]
-    fn renders_opencode_xml_with_name_and_description() {
-        let block =
-            render_opencode_available_skills_block(&[skill("git-release", "Create releases")]);
-        assert!(block.contains("<available_skills>"));
-        assert!(block.contains("</available_skills>"));
-        assert!(block.contains("<name>git-release</name>"));
-        assert!(block.contains("<description>Create releases</description>"));
-        assert!(block.contains("<skill>"));
-        assert!(block.contains("</skill>"));
-    }
-
-    #[test]
-    fn sorts_skills_by_name() {
-        let block =
-            render_opencode_available_skills_block(&[skill("zebra", "z"), skill("alpha", "a")]);
-        assert!(
-            block.find("<name>alpha</name>").unwrap() < block.find("<name>zebra</name>").unwrap()
-        );
-    }
-
-    #[test]
-    fn empty_list_renders_empty_string() {
-        assert_eq!(render_opencode_available_skills_block(&[]), "");
-    }
-
-    #[test]
-    fn plan_mode_wraps_in_system_reminder() {
-        let block = render_opencode_plan_mode_context("OpenCode plan mode is active.");
-        assert_eq!(
-            block,
-            "<system-reminder>\nOpenCode plan mode is active.\n</system-reminder>"
-        );
-    }
-
-    #[test]
-    fn plan_mode_trims_surrounding_whitespace() {
-        let block = render_opencode_plan_mode_context("\n\n  PROFILE-BODY  \n\n");
-        assert_eq!(block, "<system-reminder>\nPROFILE-BODY\n</system-reminder>");
-    }
-
-    #[test]
-    fn plan_mode_empty_or_whitespace_renders_empty_string() {
-        assert_eq!(render_opencode_plan_mode_context(""), "");
-        assert_eq!(render_opencode_plan_mode_context("   \n  "), "");
-    }
-}
diff --git a/src/adapters/registry.rs b/src/adapters/registry.rs
new file mode 100644
index 0000000..a25d128
--- /dev/null
+++ b/src/adapters/registry.rs
@@ -0,0 +1,726 @@
+//! The harness descriptor registry — the resolution authority for harness
+//! identifiers.
+//!
+//! Descriptor sources load into label-keyed entries, and every way the rest of
+//! the crate names a harness funnels through them: [`Harness::resolve`] turns
+//! a string into a validated handle (resolving `--harness` after parsing, and
+//! behind the artifact `Deserialize`), [`Harness::known`] enumerates the
+//! entries, and [`adapter_for`] serves each handle's [`HarnessAdapter`].
+
+use std::path::Path;
+use std::sync::{LazyLock, OnceLock};
+
+use crate::core::Harness;
+
+use super::descriptor::layers::{
+    DescriptorSource, HarnessFileError, Layer, check_user_layer_restrictions, default_config_root,
+    discover_sources, embedded_sources,
+};
+use super::descriptor::{
+    DescriptorError, HarnessDescriptor, finalize_descriptor, merge_descriptor_value,
+    parse_descriptor_value,
+};
+use super::descriptor_adapter::DescriptorAdapter;
+use super::harness::{HarnessAdapter, ToolVocabulary};
+
+/// One registry entry: a harness identity (the descriptor's `label`), the
+/// descriptor sources that contributed to it (for `harness list`/`show`
+/// provenance), the merged descriptor value (the base `harness lint` merges
+/// candidate overlays onto), and its descriptor-backed adapter.
+#[derive(Debug)]
+struct RegistryEntry {
+    label: &'static str,
+    sources: Vec<(Layer, String)>,
+    value: serde_json::Value,
+    adapter: DescriptorAdapter,
+}
+
+impl RegistryEntry {
+    /// True when any contributing source is an embedded built-in — the
+    /// provenance check behind guard gating (guards are embedded-only).
+    fn has_embedded_layer(&self) -> bool {
+        self.sources
+            .iter()
+            .any(|(layer, _)| *layer == Layer::Embedded)
+    }
+}
+
+/// Set once by `init_registry` (layered sources), or lazily to the embedded
+/// built-ins on first pre-init access. The lazy fallback keeps unit tests
+/// hermetic: they never call `init_registry`, so user-supplied descriptor
+/// layers can't leak into them.
+static REGISTRY: OnceLock<Vec<RegistryEntry>> = OnceLock::new();
+
+fn registry() -> &'static Vec<RegistryEntry> {
+    REGISTRY.get_or_init(|| {
+        // The embedded descriptors are bundled and known-valid, so a failure
+        // here is a programmer error (a bad descriptor edit) and panics —
+        // mirroring the bundled-schema panics in `validation::schema` — with
+        // the descriptor's own actionable message.
+        build_registry(embedded_sources())
+            .unwrap_or_else(|e| panic!("bundled harness descriptor is invalid: {e}"))
+            .entries
+    })
+}
+
+/// The registry could not be initialized from the layered sources.
+#[derive(Debug, thiserror::Error)]
+pub enum RegistryInitError {
+    #[error(transparent)]
+    HarnessFile(#[from] HarnessFileError),
+    #[error(transparent)]
+    Build(#[from] RegistryBuildError),
+    #[error("the harness registry is already initialized")]
+    AlreadyInitialized,
+}
+
+/// When `--harness-file` is in play, its descriptor's label — consulted by
+/// `Default for Harness` so the one-off harness doesn't have to be repeated
+/// via `--harness`.
+static SESSION_DEFAULT_HARNESS: OnceLock<&'static str> = OnceLock::new();
+
+/// Initialize the registry from every descriptor layer: embedded built-ins →
+/// user-global (`<config-root>/harnesses/*.toml`) → project-local
+/// (`<cwd>/.eval-magic/harnesses/*.toml`) → the optional one-off
+/// `--harness-file`. Called once by the CLI entry point, before anything
+/// resolves a harness.
+///
+/// Discovered files that fail to load are skipped with a warning on stderr
+/// (pointing at `harness lint`); a broken `--harness-file` is a hard error.
+/// When `--harness-file` names a descriptor, its label becomes the session's
+/// default harness.
+pub fn init_registry(harness_file: Option<&Path>) -> Result<(), RegistryInitError> {
+    let project_root = std::env::current_dir().unwrap_or_default();
+    let (sources, io_warnings) = discover_sources(
+        default_config_root().as_deref(),
+        &project_root,
+        harness_file,
+    )?;
+    let built = build_registry(sources)?;
+    for warning in io_warnings.iter().chain(&built.warnings) {
+        eprintln!("⚠ {warning}");
+    }
+    if harness_file.is_some()
+        && let Some(entry) = built
+            .entries
+            .iter()
+            .find(|e| e.sources.iter().any(|(l, _)| *l == Layer::HarnessFile))
+    {
+        let _ = SESSION_DEFAULT_HARNESS.set(entry.label);
+    }
+    REGISTRY
+        .set(built.entries)
+        .map_err(|_| RegistryInitError::AlreadyInitialized)
+}
+
+/// A descriptor source set that cannot form a registry. Only embedded and
+/// `--harness-file` sources can produce this — discovered layer files fail
+/// soft (skipped with a warning in [`BuiltRegistry::warnings`]) so a broken
+/// user descriptor never bricks the CLI.
+#[derive(Debug, thiserror::Error)]
+pub enum RegistryBuildError {
+    #[error(transparent)]
+    Descriptor(#[from] DescriptorError),
+    #[error("duplicate harness label {label:?}: {first} and {second}")]
+    DuplicateLabel {
+        label: String,
+        first: String,
+        second: String,
+    },
+}
+
+/// The outcome of loading a layered source set: the label-keyed entries plus
+/// the warnings for every discovered file that was skipped.
+#[derive(Debug)]
+struct BuiltRegistry {
+    entries: Vec<RegistryEntry>,
+    warnings: Vec<String>,
+}
+
+/// One label's in-progress state while folding layered sources.
+struct PendingEntry {
+    label: String,
+    value: serde_json::Value,
+    descriptor: HarnessDescriptor,
+    sources: Vec<(Layer, String)>,
+}
+
+/// Load descriptor sources into label-keyed entries with layered overrides.
+///
+/// Sources arrive in precedence order. The first source for a label defines
+/// it; a later source with the same label from a *different* layer merges
+/// field-by-field on top ([`merge_descriptor_value`]) and the merged result is
+/// re-validated with the full provenance chain in its error messages. Two
+/// same-label files within one layer have no precedence between them, so the
+/// second is rejected (fatal for embedded, a skip-warning otherwise).
+///
+/// Failure policy per layer: embedded sources are known-valid (a failure is a
+/// programmer error, propagated), `--harness-file` was explicitly named (a
+/// failure is the user's answer, propagated), and discovered user/project
+/// files fail soft — the file is skipped, the message lands in
+/// [`BuiltRegistry::warnings`], and any earlier state for that label survives.
+fn build_registry(sources: Vec<DescriptorSource>) -> Result<BuiltRegistry, RegistryBuildError> {
+    let mut pending: Vec<PendingEntry> = Vec::new();
+    let mut warnings: Vec<String> = Vec::new();
+    for source in sources {
+        let strict = matches!(source.layer, Layer::Embedded | Layer::HarnessFile);
+        let mut fail_soft = |e: RegistryBuildError| -> Result<(), RegistryBuildError> {
+            if strict {
+                Err(e)
+            } else {
+                warnings.push(format!(
+                    "skipping harness descriptor: {e}\n  (run `eval-magic harness lint <file>` \
+                     for the full report)"
+                ));
+                Ok(())
+            }
+        };
+
+        let value = match parse_descriptor_value(&source.toml_src, &source.path) {
+            Ok(value) => value,
+            Err(e) => {
+                fail_soft(e.into())?;
+                continue;
+            }
+        };
+        if source.layer != Layer::Embedded
+            && let Err(e) = check_user_layer_restrictions(&value, &source.path)
+        {
+            fail_soft(e.into())?;
+            continue;
+        }
+        let label = value
+            .get("label")
+            .and_then(serde_json::Value::as_str)
+            .expect("the schema gate requires a string label")
+            .to_string();
+
+        match pending.iter().position(|p| p.label == label) {
+            None => match finalize_descriptor(&value, &source.path) {
+                Ok(descriptor) => pending.push(PendingEntry {
+                    label,
+                    value,
+                    descriptor,
+                    sources: vec![(source.layer, source.path)],
+                }),
+                Err(e) => fail_soft(e.into())?,
+            },
+            Some(index) => {
+                let entry = &mut pending[index];
+                let (last_layer, last_path) = entry
+                    .sources
+                    .last()
+                    .expect("every entry records its source");
+                if *last_layer == source.layer {
+                    fail_soft(RegistryBuildError::DuplicateLabel {
+                        label,
+                        first: last_path.clone(),
+                        second: source.path,
+                    })?;
+                    continue;
+                }
+                let mut merged = entry.value.clone();
+                merge_descriptor_value(&mut merged, value);
+                let provenance = provenance_chain(&entry.sources, &source);
+                match finalize_descriptor(&merged, &provenance) {
+                    Ok(descriptor) => {
+                        entry.value = merged;
+                        entry.descriptor = descriptor;
+                        entry.sources.push((source.layer, source.path));
+                    }
+                    Err(e) => fail_soft(e.into())?,
+                }
+            }
+        }
+    }
+
+    let entries = pending
+        .into_iter()
+        .map(|p| RegistryEntry {
+            // Leaked once per registry entry per process: the label becomes
+            // the `'static` identity the rest of the crate passes around by
+            // handle.
+            label: Box::leak(p.label.into_boxed_str()),
+            sources: p.sources,
+            value: p.value,
+            adapter: DescriptorAdapter::from_descriptor(p.descriptor),
+        })
+        .collect();
+    Ok(BuiltRegistry { entries, warnings })
+}
+
+/// `base.toml (built-in) + overlay.toml (project)` — the provenance string a
+/// merged descriptor's validation errors carry.
+fn provenance_chain(sources: &[(Layer, String)], next: &DescriptorSource) -> String {
+    sources
+        .iter()
+        .map(|(layer, path)| format!("{path} ({})", layer.display_name()))
+        .chain([format!("{} ({})", next.path, next.layer.display_name())])
+        .collect::<Vec<_>>()
+        .join(" + ")
+}
+
+/// The registry-level default harness — what `--harness` falls back to when
+/// absent. A registry concept rather than a descriptor field, so layered
+/// user-supplied descriptor files (#136) can never fight over an
+/// exactly-one-default invariant.
+pub const DEFAULT_HARNESS_NAME: &str = "claude-code";
+
+/// A harness name that no registry entry matches. Names every registered
+/// harness so the rejection is actionable wherever it surfaces (artifact
+/// deserialization, direct resolution).
+#[derive(Debug, thiserror::Error)]
+#[error("unknown harness '{name}'; known harnesses: {}", known.join(", "))]
+pub struct UnknownHarnessError {
+    pub name: String,
+    pub known: Vec<&'static str>,
+}
+
+impl Harness {
+    /// Resolve a kebab-case identifier against the descriptor registry — the
+    /// only way to obtain a [`Harness`], so every held handle is valid.
+    pub fn resolve(name: &str) -> Result<Harness, UnknownHarnessError> {
+        registry()
+            .iter()
+            .find(|e| e.label == name)
+            .map(|e| Harness::from_static_name(e.label))
+            .ok_or_else(|| UnknownHarnessError {
+                name: name.to_string(),
+                known: Harness::known().map(Harness::name).collect(),
+            })
+    }
+
+    /// Every registered harness, in registry (embedded descriptor) order —
+    /// for code that must sweep all of them (e.g. guard teardown scans each
+    /// harness's skills dir for a marker).
+    pub fn known() -> impl Iterator<Item = Harness> {
+        registry()
+            .iter()
+            .map(|e| Harness::from_static_name(e.label))
+    }
+}
+
+impl Default for Harness {
+    fn default() -> Self {
+        // A `--harness-file` descriptor becomes the session default, so the
+        // one-off harness doesn't have to be repeated via `--harness`.
+        Harness::resolve(default_harness_name())
+            .expect("the session default resolves against the registry")
+    }
+}
+
+impl<'de> serde::Deserialize<'de> for Harness {
+    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let name = String::deserialize(deserializer)?;
+        Harness::resolve(&name).map_err(serde::de::Error::custom)
+    }
+}
+
+/// Resolve the adapter for a [`Harness`]. This is the single dispatch point on
+/// the harness identifier for all harness-specific behavior; every other
+/// module goes through the returned trait object.
+pub fn adapter_for(harness: Harness) -> &'static dyn HarnessAdapter {
+    &registry()
+        .iter()
+        .find(|e| e.label == harness.name())
+        .expect("Harness handles originate from the registry")
+        .adapter
+}
+
+/// True when `harness` has an embedded built-in descriptor among its sources
+/// — i.e. it is not defined by user-supplied descriptor files alone. Preflight
+/// uses this to hard-reject `--guard` on user-only harnesses (the write guard
+/// stays restricted to built-ins because it fails open).
+pub fn has_embedded_layer(harness: Harness) -> bool {
+    registry()
+        .iter()
+        .find(|e| e.label == harness.name())
+        .expect("Harness handles originate from the registry")
+        .has_embedded_layer()
+}
+
+/// One registered harness as `harness list`/`show`/`lint` see it: identity,
+/// contributing sources in layer order, the merged descriptor value, and the
+/// resolved descriptor.
+pub struct HarnessInfo {
+    pub label: &'static str,
+    pub sources: &'static [(Layer, String)],
+    pub value: &'static serde_json::Value,
+    pub descriptor: &'static HarnessDescriptor,
+}
+
+/// Every registered harness in registry order, with provenance and the
+/// resolved descriptor — the data source for the `harness` subcommands.
+pub fn harness_info() -> impl Iterator<Item = HarnessInfo> {
+    registry().iter().map(|e| HarnessInfo {
+        label: e.label,
+        sources: &e.sources,
+        value: &e.value,
+        descriptor: e.adapter.descriptor(),
+    })
+}
+
+/// The effective default harness name: the `--harness-file` descriptor's
+/// label when one is loaded, else [`DEFAULT_HARNESS_NAME`].
+pub fn default_harness_name() -> &'static str {
+    SESSION_DEFAULT_HARNESS
+        .get()
+        .copied()
+        .unwrap_or(DEFAULT_HARNESS_NAME)
+}
+
+/// The union of every harness's project-local config dir names (sorted,
+/// deduplicated): the dirs harness-agnostic code must treat as protected —
+/// staging's sibling-asset filter, the guard's Bash tamper rule, and
+/// detect-stray-writes' staging-dir lookbehind.
+pub fn all_config_dir_names() -> Vec<String> {
+    let mut names: Vec<String> = registry()
+        .iter()
+        .flat_map(|e| e.adapter.config_dir_names())
+        .collect();
+    names.sort_unstable();
+    names.dedup();
+    names
+}
+
+/// The union of every harness's tool vocabulary (each list sorted,
+/// deduplicated). Computed once behind a `LazyLock` — the guard arbiter
+/// consults it on every hooked tool call.
+pub fn all_tool_vocabulary() -> &'static ToolVocabulary {
+    static ALL: LazyLock<ToolVocabulary> = LazyLock::new(|| {
+        let mut union = ToolVocabulary::default();
+        for entry in registry().iter() {
+            let vocab = entry.adapter.tool_vocabulary();
+            union.write_tools.extend(vocab.write_tools);
+            union.patch_tools.extend(vocab.patch_tools);
+            union.shell_tools.extend(vocab.shell_tools);
+            union.read_tools.extend(vocab.read_tools);
+        }
+        for list in [
+            &mut union.write_tools,
+            &mut union.patch_tools,
+            &mut union.shell_tools,
+            &mut union.read_tools,
+        ] {
+            list.sort_unstable();
+            list.dedup();
+        }
+        union
+    });
+    &ALL
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    use crate::adapters::descriptor::EMBEDDED_DESCRIPTORS;
+    use crate::adapters::descriptor::layers::{Layer, embedded_sources};
+
+    #[test]
+    fn all_config_dir_names_unions_every_adapter() {
+        assert_eq!(
+            all_config_dir_names(),
+            [".agents", ".claude", ".codex", ".opencode"]
+        );
+    }
+
+    #[test]
+    fn all_tool_vocabulary_unions_every_adapter() {
+        let vocab = all_tool_vocabulary();
+        assert_eq!(
+            vocab.write_tools,
+            ["Edit", "MultiEdit", "NotebookEdit", "Write", "file_change"]
+        );
+        assert_eq!(vocab.patch_tools, ["apply_patch"]);
+        assert_eq!(vocab.shell_tools, ["Bash", "command_execution"]);
+        assert_eq!(vocab.read_tools, ["Glob", "Grep", "Read"]);
+    }
+
+    fn src(layer: Layer, path: &str, toml_src: &str) -> DescriptorSource {
+        DescriptorSource {
+            layer,
+            path: path.to_string(),
+            toml_src: toml_src.to_string(),
+        }
+    }
+
+    /// A schema-valid user descriptor declaring a [guard] block — must be
+    /// rejected by the user-layer restriction, not the schema gate.
+    const USER_GUARD_TOML: &str = r#"
+label = "armed"
+
+[guard]
+hooks_file = ".armed/hooks.json"
+matcher = "Write"
+command_template = '"{exe}" guard-hook --harness armed "{marker}"'
+hook_entry = '{"matcher":"{matcher}","hooks":[{"type":"command","command":"{command}"}]}'
+verdict_template = '{"decision":"block","reason":"{reason}"}'
+armed_message = "x"
+"#;
+
+    #[test]
+    fn duplicate_embedded_label_errors() {
+        let mut sources = embedded_sources();
+        sources.push(sources[0].clone());
+        let err = build_registry(sources).unwrap_err().to_string();
+        assert!(err.contains("duplicate harness label"), "{err}");
+        assert!(err.contains("claude-code"), "names the label: {err}");
+        assert!(
+            err.contains("harnesses/claude-code.toml"),
+            "names the colliding source files: {err}"
+        );
+    }
+
+    #[test]
+    fn registry_entries_record_embedded_provenance() {
+        let built = build_registry(embedded_sources()).unwrap();
+        assert!(built.warnings.is_empty(), "{:?}", built.warnings);
+        assert_eq!(built.entries.len(), EMBEDDED_DESCRIPTORS.len());
+        for entry in &built.entries {
+            assert_eq!(entry.sources.len(), 1, "one contributing file per built-in");
+            assert_eq!(entry.sources[0].0, Layer::Embedded);
+            assert!(
+                entry.sources[0].1.contains(entry.label),
+                "source path names the harness: {}",
+                entry.sources[0].1
+            );
+        }
+    }
+
+    #[test]
+    fn project_layer_overrides_a_single_field_of_a_builtin() {
+        let mut sources = embedded_sources();
+        sources.push(src(
+            Layer::ProjectLocal,
+            ".eval-magic/harnesses/claude-code.toml",
+            "label = \"claude-code\"\n\n[model]\nflag = \"--model-x\"\n",
+        ));
+        let built = build_registry(sources).unwrap();
+        assert!(built.warnings.is_empty(), "{:?}", built.warnings);
+        assert_eq!(built.entries.len(), EMBEDDED_DESCRIPTORS.len());
+        let entry = built
+            .entries
+            .iter()
+            .find(|e| e.label == "claude-code")
+            .unwrap();
+        // The overridden field changed; everything else survives from the
+        // embedded base (field-level merge, not file shadowing).
+        assert_eq!(entry.adapter.cli_model_flag(), Some("--model-x".into()));
+        assert!(entry.adapter.run_capabilities().supports_guard);
+        assert_eq!(
+            entry.sources,
+            vec![
+                (Layer::Embedded, "harnesses/claude-code.toml".to_string()),
+                (
+                    Layer::ProjectLocal,
+                    ".eval-magic/harnesses/claude-code.toml".to_string()
+                ),
+            ]
+        );
+    }
+
+    #[test]
+    fn new_label_in_a_user_layer_registers_a_new_harness() {
+        let mut sources = embedded_sources();
+        sources.push(src(
+            Layer::ProjectLocal,
+            ".eval-magic/harnesses/cool.toml",
+            "label = \"cool-custom-harness\"\n",
+        ));
+        let built = build_registry(sources).unwrap();
+        assert!(built.warnings.is_empty(), "{:?}", built.warnings);
+        let entry = built
+            .entries
+            .iter()
+            .find(|e| e.label == "cool-custom-harness")
+            .expect("new harness registered");
+        assert_eq!(entry.sources[0].0, Layer::ProjectLocal);
+        assert!(entry.adapter.skills_dir(Path::new("/r")).is_none());
+    }
+
+    #[test]
+    fn discovered_file_declaring_a_guard_warns_and_is_skipped() {
+        let mut sources = embedded_sources();
+        sources.push(src(
+            Layer::ProjectLocal,
+            ".eval-magic/harnesses/armed.toml",
+            USER_GUARD_TOML,
+        ));
+        let built = build_registry(sources).unwrap();
+        assert_eq!(
+            built.entries.len(),
+            EMBEDDED_DESCRIPTORS.len(),
+            "file skipped"
+        );
+        assert_eq!(built.warnings.len(), 1);
+        assert!(
+            built.warnings[0].contains("may not declare [guard]"),
+            "{}",
+            built.warnings[0]
+        );
+    }
+
+    #[test]
+    fn discovered_overlay_breaking_invariants_warns_and_keeps_the_base() {
+        let mut sources = embedded_sources();
+        // Replacing config_dirs orphans skills_dir's parent — an invariant
+        // break that only shows post-merge.
+        sources.push(src(
+            Layer::ProjectLocal,
+            ".eval-magic/harnesses/claude-code.toml",
+            "label = \"claude-code\"\nconfig_dirs = [\".other\"]\n",
+        ));
+        let built = build_registry(sources).unwrap();
+        assert_eq!(built.warnings.len(), 1);
+        assert!(
+            built.warnings[0].contains(".eval-magic/harnesses/claude-code.toml"),
+            "names the offending file: {}",
+            built.warnings[0]
+        );
+        let entry = built
+            .entries
+            .iter()
+            .find(|e| e.label == "claude-code")
+            .unwrap();
+        assert_eq!(
+            entry.adapter.config_dir_names(),
+            vec![".claude".to_string()],
+            "embedded base survives the dropped overlay"
+        );
+        assert_eq!(
+            entry.sources.len(),
+            1,
+            "the bad overlay records no provenance"
+        );
+    }
+
+    #[test]
+    fn same_label_twice_in_one_discovered_layer_warns_and_skips_the_second() {
+        let mut sources = embedded_sources();
+        sources.push(src(
+            Layer::ProjectLocal,
+            "a.toml",
+            "label = \"claude-code\"\n\n[model]\nflag = \"--from-a\"\n",
+        ));
+        sources.push(src(
+            Layer::ProjectLocal,
+            "b.toml",
+            "label = \"claude-code\"\n\n[model]\nflag = \"--from-b\"\n",
+        ));
+        let built = build_registry(sources).unwrap();
+        assert_eq!(built.warnings.len(), 1);
+        assert!(
+            built.warnings[0].contains("a.toml"),
+            "{}",
+            built.warnings[0]
+        );
+        assert!(
+            built.warnings[0].contains("b.toml"),
+            "{}",
+            built.warnings[0]
+        );
+        let entry = built
+            .entries
+            .iter()
+            .find(|e| e.label == "claude-code")
+            .unwrap();
+        assert_eq!(entry.adapter.cli_model_flag(), Some("--from-a".into()));
+    }
+
+    #[test]
+    fn harness_file_failures_are_fatal() {
+        let mut sources = embedded_sources();
+        sources.push(src(Layer::HarnessFile, "one-off.toml", "label = "));
+        let err = build_registry(sources).unwrap_err().to_string();
+        assert!(err.contains("one-off.toml"), "{err}");
+    }
+
+    #[test]
+    fn harness_file_guard_rejection_is_fatal() {
+        let mut sources = embedded_sources();
+        sources.push(src(Layer::HarnessFile, "one-off.toml", USER_GUARD_TOML));
+        let err = build_registry(sources).unwrap_err().to_string();
+        assert!(err.contains("may not declare [guard]"), "{err}");
+    }
+
+    #[test]
+    fn harness_file_overlay_merges_on_top_of_discovered_layers() {
+        let mut sources = embedded_sources();
+        sources.push(src(
+            Layer::ProjectLocal,
+            "p.toml",
+            "label = \"claude-code\"\n\n[model]\nflag = \"--from-project\"\n",
+        ));
+        sources.push(src(
+            Layer::HarnessFile,
+            "one-off.toml",
+            "label = \"claude-code\"\n\n[model]\nflag = \"--from-file\"\n",
+        ));
+        let built = build_registry(sources).unwrap();
+        assert!(built.warnings.is_empty(), "{:?}", built.warnings);
+        let entry = built
+            .entries
+            .iter()
+            .find(|e| e.label == "claude-code")
+            .unwrap();
+        assert_eq!(entry.adapter.cli_model_flag(), Some("--from-file".into()));
+        assert_eq!(entry.sources.len(), 3);
+    }
+
+    #[test]
+    fn embedded_layer_provenance_distinguishes_built_ins_from_user_only_harnesses() {
+        let mut sources = embedded_sources();
+        sources.push(src(
+            Layer::ProjectLocal,
+            ".eval-magic/harnesses/cool.toml",
+            "label = \"cool\"\n",
+        ));
+        let built = build_registry(sources).unwrap();
+        let entry = |label: &str| built.entries.iter().find(|e| e.label == label).unwrap();
+        assert!(
+            entry("claude-code").has_embedded_layer(),
+            "built-ins carry their embedded source"
+        );
+        assert!(
+            !entry("cool").has_embedded_layer(),
+            "a user-only harness has no embedded layer"
+        );
+    }
+
+    #[test]
+    fn resolve_unknown_name_lists_known_harnesses() {
+        let err = Harness::resolve("nonexistent").unwrap_err().to_string();
+        assert!(err.contains("unknown harness 'nonexistent'"), "{err}");
+        for name in ["claude-code", "codex", "opencode"] {
+            assert!(err.contains(name), "error must name {name}: {err}");
+        }
+    }
+
+    #[test]
+    fn resolve_round_trips_every_registry_entry() {
+        for harness in Harness::known() {
+            assert_eq!(Harness::resolve(harness.name()).unwrap(), harness);
+        }
+    }
+
+    #[test]
+    fn default_harness_is_claude_code() {
+        assert_eq!(DEFAULT_HARNESS_NAME, "claude-code");
+        assert_eq!(Harness::default().name(), DEFAULT_HARNESS_NAME);
+    }
+
+    #[test]
+    fn known_iterates_in_descriptor_order() {
+        let names: Vec<_> = Harness::known().map(Harness::name).collect();
+        assert_eq!(names, ["claude-code", "codex", "opencode"]);
+    }
+
+    #[test]
+    fn labels_match_kebab_case_identifiers() {
+        for name in ["claude-code", "codex", "opencode"] {
+            let harness = Harness::resolve(name).unwrap();
+            assert_eq!(adapter_for(harness).label(), name);
+        }
+    }
+}
diff --git a/src/adapters/skill_shadow.rs b/src/adapters/skill_shadow.rs
new file mode 100644
index 0000000..034c3e6
--- /dev/null
+++ b/src/adapters/skill_shadow.rs
@@ -0,0 +1,191 @@
+//! Harness-neutral skill-shadow report types and formatters.
+//!
+//! A *shadow* is a staged skill name that is also discoverable from the
+//! operator's live environment, contaminating the with/without comparison.
+//! Detection is harness-specific (each adapter's
+//! [`detect_shadowed_skills`](crate::adapters::HarnessAdapter::detect_shadowed_skills)
+//! decides what "discoverable" means); the report shape and its renderings are
+//! shared. The remediation text is Claude-flavored because only the Claude Code
+//! adapter produces reports today — promote the formatters to adapter methods
+//! when a second harness wires this preflight.
+
+use serde::{Deserialize, Serialize};
+
+const ISOLATION_DOC: &str = "docs/claude-notes.md → \"Isolating from installed plugins\"";
+
+/// A staged skill that is also discoverable from the live environment.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "kebab-case")]
+pub enum ShadowSource {
+    Plugin {
+        plugin: String,
+        skill_name: String,
+        path: String,
+    },
+    GlobalSkill {
+        skill_name: String,
+        path: String,
+    },
+}
+
+impl ShadowSource {
+    pub(crate) fn skill_name(&self) -> &str {
+        match self {
+            ShadowSource::Plugin { skill_name, .. } => skill_name,
+            ShadowSource::GlobalSkill { skill_name, .. } => skill_name,
+        }
+    }
+
+    fn source_label(&self) -> String {
+        match self {
+            ShadowSource::Plugin { plugin, .. } => format!("enabled plugin '{plugin}'"),
+            ShadowSource::GlobalSkill { .. } => "the global skills dir".to_string(),
+        }
+    }
+}
+
+/// The detector's findings for a run.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct PluginShadowReport {
+    pub config_dir: String,
+    pub shadowed: Vec<ShadowSource>,
+}
+
+/// One `validity_warnings` line per shadowed skill (for benchmark.json).
+pub fn shadow_validity_warnings(report: &PluginShadowReport) -> Vec<String> {
+    report
+        .shadowed
+        .iter()
+        .map(|s| {
+            format!(
+                "staged skill '{}' is also provided by {} — each claude -p dispatch could discover \
+                 both copies, so with/without results may be contaminated. Isolate each dispatch's \
+                 Claude config (see {}).",
+                s.skill_name(),
+                s.source_label(),
+                ISOLATION_DOC
+            )
+        })
+        .collect()
+}
+
+/// Build-time banner for the runner. Empty string when nothing is shadowed.
+pub fn format_shadow_banner(report: &PluginShadowReport) -> String {
+    if report.shadowed.is_empty() {
+        return String::new();
+    }
+    let mut lines = vec![
+        String::new(),
+        "⚠ Plugin-shadow warning: skills staged for this eval are ALSO discoverable".to_string(),
+        "  from your live environment:".to_string(),
+    ];
+    for s in &report.shadowed {
+        lines.push(format!("  • {} — {}", s.skill_name(), s.source_label()));
+    }
+    lines.push(
+        "  Each `claude -p` dispatch loads your user/global plugins and skills, so".to_string(),
+    );
+    lines.push("  both the staged copy and the installed copy are discoverable — the".to_string());
+    lines.push(
+        "  with/without comparison may be contaminated and the control arm is not truly"
+            .to_string(),
+    );
+    lines.push(
+        "  skill-absent. The runner cannot strip an installed plugin from the dispatch."
+            .to_string(),
+    );
+    lines.push("  Isolate each dispatch's Claude config, one of these ways:".to_string());
+    lines.push(
+        "  1. Drop user-scope plugins, keep auth: add `--setting-sources project,local`"
+            .to_string(),
+    );
+    lines.push("     to each dispatch.".to_string());
+    lines.push(
+        "  2. Disable the specific plugin: set `\"enabledPlugins\": { \"<plugin>@<marketplace>\":"
+            .to_string(),
+    );
+    lines.push("     false }` in a settings source the dispatch loads.".to_string());
+    lines.push("  3. Clean config dir (strips everything): run each dispatch under".to_string());
+    lines.push(
+        "     `CLAUDE_CONFIG_DIR=\"$(mktemp -d)\"` — auth may need `ANTHROPIC_API_KEY`."
+            .to_string(),
+    );
+    lines.push(format!("  Full mechanics: {ISOLATION_DOC}."));
+    lines.join("\n")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn sample_report() -> PluginShadowReport {
+        PluginShadowReport {
+            config_dir: "/x".into(),
+            shadowed: vec![ShadowSource::Plugin {
+                plugin: "slow-powers@slowdini".into(),
+                skill_name: "verification-before-completion".into(),
+                path: "/p".into(),
+            }],
+        }
+    }
+
+    #[test]
+    fn validity_warnings_name_skill_plugin_and_contamination() {
+        let warnings = shadow_validity_warnings(&sample_report());
+        assert_eq!(warnings.len(), 1);
+        assert!(warnings[0].contains("verification-before-completion"));
+        assert!(warnings[0].contains("slow-powers@slowdini"));
+        assert!(warnings[0].to_lowercase().contains("contaminat"));
+    }
+
+    #[test]
+    fn banner_is_empty_when_nothing_shadowed() {
+        let empty = PluginShadowReport {
+            config_dir: "/x".into(),
+            shadowed: vec![],
+        };
+        assert_eq!(format_shadow_banner(&empty), "");
+    }
+
+    #[test]
+    fn banner_lists_shadowed_skills_and_points_at_isolation_docs() {
+        let banner = format_shadow_banner(&sample_report());
+        assert!(banner.contains("verification-before-completion"));
+        assert!(banner.contains("slow-powers@slowdini"));
+        assert!(banner.to_lowercase().contains("isolat"));
+    }
+
+    #[test]
+    fn banner_carries_the_three_isolation_recipes_inline() {
+        // The remediation options live in the banner itself — shown exactly when
+        // the contamination is detected — not in a README section the operator
+        // has to go find.
+        let banner = format_shadow_banner(&sample_report());
+        assert!(
+            banner.contains("--setting-sources project,local"),
+            "banner names the setting-sources option: {banner}"
+        );
+        assert!(
+            banner.contains("enabledPlugins"),
+            "banner names the per-plugin disable option: {banner}"
+        );
+        assert!(
+            banner.contains("CLAUDE_CONFIG_DIR"),
+            "banner names the clean-config-dir option: {banner}"
+        );
+        assert!(
+            banner.contains("docs/claude-notes.md"),
+            "banner points at the harness dev notes for the full mechanics: {banner}"
+        );
+    }
+
+    #[test]
+    fn validity_warnings_point_at_a_doc_that_exists() {
+        let warnings = shadow_validity_warnings(&sample_report());
+        assert!(
+            warnings[0].contains("docs/claude-notes.md"),
+            "warning points at the harness dev notes: {}",
+            warnings[0]
+        );
+    }
+}
diff --git a/src/adapters/skills_block.rs b/src/adapters/skills_block.rs
new file mode 100644
index 0000000..9c48242
--- /dev/null
+++ b/src/adapters/skills_block.rs
@@ -0,0 +1,87 @@
+//! The generic available-skills block renderer.
+//!
+//! Every harness surfaces discoverable skills as header + one item per skill
+//! (+ optional footer); only the strings differ, so they live in each harness
+//! descriptor's `[skills_block]` and this renderer supplies the shared shape:
+//! empty list renders empty, skills sort by name, and the item template's
+//! `{name}`/`{description}`/`{path}` placeholders fill per skill.
+
+use crate::core::AvailableSkill;
+
+use super::descriptor::subst;
+
+/// The neutral shape used when a descriptor declares no `[skills_block]` —
+/// the trait's documented default.
+pub(crate) const DEFAULT_HEADER: &str = "The following skills are available in this session:\n";
+pub(crate) const DEFAULT_ITEM: &str = "\n- {name}: {description}";
+
+/// Render the block, or an empty string when no skills are staged (the caller
+/// omits the block entirely in that case).
+pub(crate) fn render_skills_block(
+    header: &str,
+    item: &str,
+    footer: &str,
+    skills: &[AvailableSkill],
+) -> String {
+    if skills.is_empty() {
+        return String::new();
+    }
+    let mut sorted: Vec<&AvailableSkill> = skills.iter().collect();
+    sorted.sort_by(|a, b| a.name.cmp(&b.name));
+    let mut out = String::from(header);
+    for skill in sorted {
+        out.push_str(&subst(
+            item,
+            &[
+                ("name", &skill.name),
+                ("description", &skill.description),
+                ("path", &skill.path),
+            ],
+        ));
+    }
+    out.push_str(footer);
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn skill(name: &str, description: &str) -> AvailableSkill {
+        AvailableSkill {
+            name: name.into(),
+            path: format!("/x/{name}/SKILL.md"),
+            description: description.into(),
+        }
+    }
+
+    #[test]
+    fn renders_header_items_and_footer_sorted_by_name() {
+        let block = render_skills_block(
+            "<skills>",
+            "\n- {name}: {description} ({path})",
+            "\n</skills>",
+            &[skill("zebra", "z"), skill("alpha", "a")],
+        );
+        assert_eq!(
+            block,
+            "<skills>\n- alpha: a (/x/alpha/SKILL.md)\n- zebra: z (/x/zebra/SKILL.md)\n</skills>"
+        );
+    }
+
+    #[test]
+    fn empty_list_renders_empty_string_even_with_templates() {
+        assert_eq!(render_skills_block("H", "\n- {name}", "F", &[]), "");
+    }
+
+    #[test]
+    fn braces_in_a_description_are_not_reexpanded() {
+        let block = render_skills_block(
+            "",
+            "\n- {name}: {description}",
+            "",
+            &[skill("a", "uses {name} literally")],
+        );
+        assert_eq!(block, "\n- a: uses {name} literally");
+    }
+}
diff --git a/src/adapters/transcript.rs b/src/adapters/transcript.rs
new file mode 100644
index 0000000..e359d2b
--- /dev/null
+++ b/src/adapters/transcript.rs
@@ -0,0 +1,72 @@
+//! Harness-neutral transcript types.
+//!
+//! Every harness's transcript parser reduces its native events file to a
+//! [`TranscriptSummary`]; the pipeline consumes only this shape, never a
+//! harness's raw record types.
+
+use serde::{Deserialize, Serialize};
+use std::fs;
+use std::io;
+use std::path::Path;
+
+use crate::core::ToolInvocation;
+
+/// Read a JSONL file, deserializing each non-blank line as `T` and silently
+/// skipping malformed lines (a partial transcript still yields its parseable
+/// records).
+pub(crate) fn read_jsonl<T: serde::de::DeserializeOwned>(path: &Path) -> io::Result<Vec<T>> {
+    let raw = fs::read_to_string(path)?;
+    Ok(raw
+        .split('\n')
+        .filter(|line| !line.trim().is_empty())
+        .filter_map(|line| serde_json::from_str::<T>(line).ok())
+        .collect())
+}
+
+/// A transcript boiled down to the artifacts the pipeline needs.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct TranscriptSummary {
+    pub tool_invocations: Vec<ToolInvocation>,
+    /// Total token usage (input + output + cache creation/read), as reported by
+    /// the run's terminal `result` event.
+    pub total_tokens: Option<i64>,
+    /// Wall-clock duration, as reported by the run's terminal `result` event.
+    pub duration_ms: Option<i64>,
+    /// Concatenated text blocks of the last assistant message.
+    pub final_text: Option<String>,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::read_jsonl;
+    use serde_json::Value;
+    use std::fs;
+    use tempfile::TempDir;
+
+    #[test]
+    fn read_jsonl_skips_malformed_lines() {
+        let dir = TempDir::new().unwrap();
+        let path = dir.path().join("events.jsonl");
+        fs::write(&path, "{\"a\":1}\nnot json\n{\"a\":2}\n").unwrap();
+        let values: Vec<Value> = read_jsonl(&path).unwrap();
+        assert_eq!(values.len(), 2);
+        assert_eq!(values[0]["a"], 1);
+        assert_eq!(values[1]["a"], 2);
+    }
+
+    #[test]
+    fn read_jsonl_skips_blank_and_whitespace_only_lines() {
+        let dir = TempDir::new().unwrap();
+        let path = dir.path().join("events.jsonl");
+        fs::write(&path, "{\"a\":1}\n\n   \n\t\n{\"a\":2}\n").unwrap();
+        let values: Vec<Value> = read_jsonl(&path).unwrap();
+        assert_eq!(values.len(), 2);
+    }
+
+    #[test]
+    fn read_jsonl_errors_on_a_missing_file() {
+        let dir = TempDir::new().unwrap();
+        let missing = dir.path().join("absent.jsonl");
+        assert!(read_jsonl::<Value>(&missing).is_err());
+    }
+}
diff --git a/src/cli/args.rs b/src/cli/args.rs
index 0bdb0e7..8fa6a42 100644
--- a/src/cli/args.rs
+++ b/src/cli/args.rs
@@ -6,8 +6,6 @@
 
 use clap::{Args, Parser, Subcommand};
 
-use crate::core::{Harness, RunMode};
-
 /// Run skill evals — measure whether an agent skill actually shifts behavior.
 ///
 /// An eval dispatches a fresh subagent twice per test case — once with the skill
@@ -35,6 +33,16 @@ use crate::core::{Harness, RunMode};
     after_help = super::help::AFTER_HELP
 )]
 pub(crate) struct Cli {
+    /// Load a one-off harness descriptor file as the top registry layer.
+    ///
+    /// The file merges field-by-field onto any registered harness with the same
+    /// `label` (or defines a new one), exactly like a project-local descriptor
+    /// in `.eval-magic/harnesses/`, and — when `--harness` is omitted — its
+    /// label becomes the invocation's default harness. Unlike discovered
+    /// descriptor files (skipped with a warning when broken), errors in this
+    /// explicitly named file are fatal.
+    #[arg(long, global = true, value_name = "PATH")]
+    pub harness_file: Option<String>,
     #[command(subcommand)]
     pub command: Option<Commands>,
 }
@@ -75,51 +83,20 @@ pub struct CommonArgs {
     /// Target harness: `claude-code` (default), `codex`, or `opencode`.
     ///
     /// Claude Code and Codex both support staged skills, transcript ingest, and
-    /// `--guard`. Codex stages skills under `.agents/skills` and reads each
-    /// task's `outputs/codex-events.jsonl` instead of a subagents dir.
-    /// OpenCode stages skills under `.opencode/skills`; transcript ingest and
-    /// `--guard` are not yet wired for OpenCode.
-    #[arg(long)]
-    pub harness: Option<Harness>,
-    /// Run mode: `interactive` (in-session subagents), `hybrid` (an agent
-    /// orchestrates while each dispatch shells out to the harness CLI), or
-    /// `headless` (CLI-only, no session).
-    ///
-    /// Defaults per harness — Claude Code → `interactive`, Codex/OpenCode →
-    /// `hybrid`. `hybrid`/`headless` dispatch through the harness CLI (`claude -p`,
-    /// `codex exec`) and read each task's `outputs/<harness>-events.jsonl`;
-    /// `interactive` dispatches in-session subagents. Claude Code wires all three
-    /// (`hybrid`/`headless` ride `claude -p` stream-json); Codex wires `hybrid` +
-    /// `headless`; OpenCode wires `hybrid` only. Pass the same value to every command
-    /// of a run (it selects the transcript source at `ingest`); the printed next-step
-    /// commands already carry it.
-    #[arg(long)]
-    pub run_mode: Option<RunMode>,
+    /// the write guard (armed automatically). Each reads its own per-task events
+    /// file (`claude-events.jsonl`, `codex-events.jsonl`); Codex stages skills
+    /// under `.agents/skills`. OpenCode stages skills under `.opencode/skills`;
+    /// transcript ingest and the write guard are not yet wired for OpenCode.
+    /// The name is resolved against the harness descriptor registry after
+    /// parsing; an unknown name errors listing every registered harness.
+    #[arg(long)]
+    pub harness: Option<String>,
     /// Workspace directory (defaults to `<cwd>/.eval-magic`).
     ///
     /// The artifact root. Pass the same value to every command of a run, including
     /// `teardown`.
     #[arg(long)]
     pub workspace_dir: Option<String>,
-    /// Subagents transcript dir (Claude Code only), e.g.
-    /// `~/.claude/projects/<slug>/<session-id>/subagents/`.
-    ///
-    /// Where Claude Code persisted subagent transcripts. `ingest`/`record-runs`/
-    /// `fill-transcripts` read it to populate `tool_invocations`, tokens, and
-    /// duration. Optional: when omitted it is auto-resolved from `--session-id`
-    /// (or the `CLAUDE_CODE_SESSION_ID` env var); pass it explicitly only to
-    /// override. Not used for Codex, which reads `outputs/codex-events.jsonl`.
-    #[arg(long)]
-    pub subagents_dir: Option<String>,
-    /// Parent session id for auto-resolving `--subagents-dir` (Claude Code only).
-    ///
-    /// Defaults to the `CLAUDE_CODE_SESSION_ID` env var that Claude Code sets in
-    /// the orchestrating agent's shell. `ingest`/`record-runs`/`fill-transcripts`
-    /// use it to locate `<config>/projects/<cwd-slug>/<session-id>/subagents/`
-    /// (scanning `projects/*` if the cwd slug differs). Pass it only when running
-    /// outside that session; an explicit `--subagents-dir` overrides it.
-    #[arg(long)]
-    pub session_id: Option<String>,
     /// Restrict to these eval ids (comma-separated).
     ///
     /// Mutually exclusive with `--skip`; every named id must exist or the run
@@ -135,6 +112,92 @@ pub struct CommonArgs {
     pub overwrite: bool,
 }
 
+/// `harness` groups the descriptor-inspection subcommands.
+#[derive(Debug, Args)]
+pub struct HarnessArgs {
+    #[command(subcommand)]
+    pub command: HarnessCommands,
+}
+
+#[derive(Debug, Subcommand)]
+pub(crate) enum HarnessCommands {
+    /// Scaffold a commented descriptor template and notes skeleton for a new
+    /// harness.
+    ///
+    /// Writes two files into the project-local descriptor layer:
+    /// `.eval-magic/harnesses/<name>.toml`, pre-filled with `label = "<name>"`
+    /// and every optional table present as a commented-out, inline-explained
+    /// example; and `.eval-magic/harnesses/<name>-notes.md`, the
+    /// verification-record skeleton where each filled-in value's source is
+    /// recorded. The scaffold is lint-clean exactly as written — `harness
+    /// lint` passes before a single field is filled in, and the file registers
+    /// `<name>` as a baseline harness immediately. Values must be verified
+    /// against the harness's own documentation or observed output, never
+    /// guessed. Scaffolding an already-registered name (e.g. the built-in
+    /// `claude-code`) is allowed with a note: descriptor layers merge
+    /// field-by-field, so the file overlays the registered harness instead of
+    /// defining a new one. The `[guard]` table is never scaffolded —
+    /// user-supplied descriptors may not declare it. The authoring guide is
+    /// docs/byoh.md; its "Upstreaming your descriptor" section covers
+    /// contributing the finished descriptor.
+    Init {
+        /// Label for the new harness (kebab-case, e.g. `cool-cli`); becomes
+        /// the descriptor's `label` and both file names.
+        name: String,
+        /// Print the rendered descriptor template to stdout instead of
+        /// writing files.
+        ///
+        /// Prints only the template (no notes skeleton, no next steps), so
+        /// the output is redirectable — e.g. into a user-global layer
+        /// (`~/.config/eval-magic/harnesses/`) or a one-off `--harness-file`.
+        #[arg(long)]
+        stdout: bool,
+        /// Overwrite existing scaffold files.
+        #[arg(long)]
+        force: bool,
+    },
+    /// List every registered harness: name, source layer(s), enhancements.
+    ///
+    /// One line per harness with the layers that contributed to it (built-in,
+    /// user, project, file — a merged descriptor shows all of them, e.g.
+    /// `built-in + project`) and the enhancements the resolved descriptor
+    /// declares (staging, skills-block, transcript, model-flag, guard,
+    /// shadow-preflight, dispatch-recipes; `baseline` when none). The session's
+    /// default harness — `claude-code`, or the `--harness-file` descriptor when
+    /// one is loaded — is marked `(default)`.
+    List,
+    /// Print one harness's resolved descriptor (after layer merging) as TOML.
+    ///
+    /// The output is authorable: the provenance header lists every contributing
+    /// file as `#` comments, and the body is valid descriptor TOML you can copy
+    /// into a layer file (`.eval-magic/harnesses/<name>.toml`) and edit. Fields
+    /// at their baseline defaults are omitted. When reusing a guarded built-in's
+    /// output as a user layer, drop its `[guard]` table and
+    /// `run.supports_guard` first — user-supplied descriptors may not declare
+    /// them.
+    Show {
+        /// Registered harness name (see `harness list`).
+        name: String,
+    },
+    /// Validate a descriptor file, or every layer of a registered harness.
+    ///
+    /// A file target runs the full load pipeline with one ✓/✗ line per check:
+    /// TOML syntax + schema (unknown fields, bad capability names), the
+    /// user-layer restrictions (`[guard]` and `run.supports_guard = true` stay
+    /// built-in-only; unguarded runs fall back to the detect-stray-writes
+    /// audit), and the cross-field invariants — merged onto the registered
+    /// harness with the same `label` when one exists, so a partial override is
+    /// checked against its real merge target. A name target re-lints every
+    /// discovered layer file strictly, surfacing descriptors that registry
+    /// initialization skipped with a warning. Exits non-zero when any check
+    /// fails. (A future `--probe` flag is reserved for a live dispatch probe
+    /// through the exec template.)
+    Lint {
+        /// Descriptor file path, or a registered harness name.
+        target: String,
+    },
+}
+
 /// `validate` only needs to know where to look.
 #[derive(Debug, Args)]
 pub struct ValidateArgs {
@@ -206,31 +269,6 @@ pub struct GradeArgs {
     pub finalize: bool,
 }
 
-/// `switch-condition` names the condition about to be dispatched (the one to keep)
-/// on top of the common set.
-#[derive(Debug, Args)]
-pub struct SwitchConditionArgs {
-    #[command(flatten)]
-    pub common: CommonArgs,
-    /// The condition you are about to dispatch next (the one to KEEP). Its
-    /// counterpart's staged skill is removed from `env/.claude/skills/`.
-    #[arg(long)]
-    pub condition: String,
-}
-
-/// `reset-batch` names the isolation group about to be dispatched, on top of the
-/// common set.
-#[derive(Debug, Args)]
-pub struct ResetBatchArgs {
-    #[command(flatten)]
-    pub common: CommonArgs,
-    /// The isolation group you are about to dispatch next. The shared `env/`'s
-    /// working tree is wiped (keeping the staged skills + the outputs tree) and
-    /// re-seeded with this group's fixtures.
-    #[arg(long)]
-    pub group: String,
-}
-
 /// `snapshot` adds a label and an optional git ref on top of the common set.
 #[derive(Debug, Args)]
 pub struct SnapshotArgs {
@@ -309,13 +347,21 @@ pub struct RunArgs {
     /// asset files); use the staged (default) path when the measured behavior
     /// depends on sibling files. The isolated env (`env/`) is still built either
     /// way — `--no-stage` only skips populating the harness skills dir. Also
-    /// disables `--guard` — the write guard requires staging — so no-stage runs
-    /// are unguarded and rely on `detect-stray-writes` after the fact.
+    /// disables the write guard (auto-armed or explicit) — it requires staging —
+    /// so no-stage runs are unguarded and rely on `detect-stray-writes` after
+    /// the fact.
     #[arg(long)]
     pub no_stage: bool,
-    /// Arm the write guard (PreToolUse hook) for the dispatch window.
+    /// Arm the write guard explicitly (it auto-arms when the harness supports it).
     ///
-    /// Stages a harness-native `PreToolUse` hook that *blocks* subagent
+    /// The write guard arms automatically on guard-capable built-in harnesses
+    /// whenever staging is active, so this flag only makes the request explicit:
+    /// where auto-arm quietly stays off (no declared guard, or `--no-stage`), an
+    /// explicit `--guard` warns, and a harness defined only by user-supplied
+    /// descriptors rejects it in preflight (rerun without it;
+    /// `detect-stray-writes` audits after the fact). Opt out with `--no-guard`.
+    ///
+    /// The guard is a harness-native `PreToolUse` hook that *blocks* subagent
     /// writes/installs outside the isolated run env (the agent-under-test's cwd)
     /// while dispatches run. Its allowed roots are the env plus the OS temp dir, so
     /// the guard boundary matches the same env that isolates the agent's reads.
@@ -323,25 +369,34 @@ pub struct RunArgs {
     /// env, the guard's main remaining value is blocking Bash-subprocess escapes the
     /// cwd boundary doesn't cover — `npm install`, `git worktree add`, `sed -i`,
     /// redirects to absolute paths — and acting as a backstop when the isolated
-    /// session runs with relaxed permissions. Arm it unless the user opts out. The
-    /// marker auto-expires after 6h and is torn down at the next run; while armed the
+    /// session runs with relaxed permissions. The marker auto-expires after 6h
+    /// and is torn down at the next run; while armed the
     /// hook fires on your own tool calls too. If it remains armed after `finalize`,
     /// `finalize` reminds you to run `teardown` before editing source (which disarms
     /// the cwd guard and every per-`(group, condition)` Cli env's guard). Requires
-    /// staging — incompatible with `--no-stage`, under which guard install is skipped
-    /// and the run is unguarded.
+    /// staging — with `--no-stage` the guard stays off and the run is unguarded.
     /// Codex dispatches must include `--dangerously-bypass-hook-trust` so the
     /// vetted project-local eval hook runs. Unguarded, stray writes are only
     /// *detected* after the fact by `detect-stray-writes`, never blocked.
-    /// Works under Claude Code's CLI run modes (`hybrid`/`headless`) too: the
-    /// `PreToolUse` hook is staged in `env/.claude/settings.local.json`, and each
-    /// `claude -p` dispatch loads it from that cwd (`cd <eval-root>`), enforcing the
-    /// same boundary as an in-session run (the recipe never passes `--bare`).
+    /// Under Claude Code the `PreToolUse` hook is staged in each env's
+    /// `.claude/settings.local.json`, and each `claude -p` dispatch loads it from
+    /// that cwd (`cd <eval-root>`), enforcing the eval boundary (the recipe never
+    /// passes `--bare`).
     /// When invoking this from inside Codex, staging writes `.agents/skills` and
     /// guarded runs also write `.codex/hooks.json`; Codex protects those paths in
     /// its default workspace-write sandbox, so approval/escalation may be needed.
     #[arg(long)]
     pub guard: bool,
+    /// Opt out of the write guard for this run.
+    ///
+    /// The guard arms automatically on harnesses that declare one (see
+    /// `--guard`). Pass this to run unguarded — e.g. when the skill under test
+    /// legitimately writes outside the isolated run env — and to silence the
+    /// unguarded-harness preflight warning. Unguarded, out-of-bounds writes are
+    /// only *detected* after the fact by `detect-stray-writes` (folded into
+    /// `ingest`), never blocked.
+    #[arg(long, conflicts_with = "guard")]
+    pub no_guard: bool,
     /// Stage the skill-under-test under this verbatim name instead of the
     /// conspicuous `slow-powers-eval-…` slug.
     ///
@@ -349,13 +404,13 @@ pub struct RunArgs {
     /// to clobber an existing dir; registered for next-run cleanup.
     #[arg(long)]
     pub stage_name: Option<String>,
-    /// Inject the harness's plan-mode profile as an operating-context layer.
+    /// Inject the shared plan-mode profile as an operating-context layer.
     ///
-    /// Injects the harness's verbatim plan-mode procedure
-    /// (`profiles/<harness>/plan-mode.md`) as a `<system-reminder>` in every
-    /// dispatch, identical across arms. Opt-in, for plan-mode-relevant skills.
-    /// A harness with no profile aborts. It is text the subagent reads, not a
-    /// real injected mode.
+    /// Injects the shared, harness-agnostic plan-mode procedure
+    /// (`profiles/shared/plan-mode.md`) as a `<system-reminder>` in every
+    /// dispatch, identical across arms and harnesses. Opt-in, for
+    /// plan-mode-relevant skills. It is text the subagent reads, not a real
+    /// injected mode.
     #[arg(long)]
     pub plan_mode: bool,
     /// Runs per condition cell, for variance reduction (default: 1).
@@ -373,10 +428,9 @@ pub struct RunArgs {
     /// Agent-under-test model for CLI dispatches; otherwise recorded as
     /// provenance.
     ///
-    /// For `Cli`-mechanism harnesses such as Codex, the run's dispatch recipes
-    /// include the harness-native model flag when the adapter supports one. For
-    /// in-session dispatch, the runner cannot select the model, so the value is
-    /// persisted to `conditions.json` for `promote-baseline`.
+    /// The run's dispatch recipes include the harness-native model flag when the
+    /// adapter supports one (e.g. Codex's `-m`, Claude Code's `--model`); otherwise
+    /// the value is persisted to `conditions.json` for `promote-baseline`.
     #[arg(long)]
     pub agent_model: Option<String>,
     /// Default judge model for emitted judge tasks.
@@ -402,10 +456,9 @@ pub(crate) enum Commands {
     ///
     /// Builds the iteration workspace, snapshots the `SKILL.md`, stages skills, and
     /// emits `dispatch.json` (machine-readable) alongside `dispatch-manifest.md`
-    /// (human-readable). Your agent then dispatches each task as a fresh subagent.
-    /// Also writes `RUNBOOK.md`, a followable handoff for an isolated run session
-    /// ("Read and follow RUNBOOK.md") — interactive (agent-followed) for Claude
-    /// Code, human-followed for Codex/OpenCode.
+    /// (human-readable). Dispatch each task through the harness CLI (`claude -p`,
+    /// `codex exec`). Also writes `RUNBOOK.md`, a human-followable handoff for the
+    /// run ("Read and follow RUNBOOK.md").
     Run(RunArgs),
     /// Snapshot a workspace baseline.
     ///
@@ -430,10 +483,8 @@ pub(crate) enum Commands {
     /// grade. Assembles each task's `run.json` + `timing.json`, scans for stray
     /// writes, grades `transcript_check` assertions, then stops at the judge
     /// hand-off, listing a judge task per `llm_judge` assertion. Requires
-    /// `--iteration`; Claude Code auto-resolves the subagents dir from the session
-    /// id (override with `--subagents-dir`), while Codex reads each task's
-    /// `outputs/codex-events.jsonl`. Re-running after a fix is safe — every
-    /// sub-step skips work already done.
+    /// `--iteration`; reads each task's `outputs/<harness>-events.jsonl`.
+    /// Re-running after a fix is safe — every sub-step skips work already done.
     Ingest(CommonArgs),
     /// Finalize grading after judge responses are in.
     ///
@@ -442,39 +493,18 @@ pub(crate) enum Commands {
     /// any per-`(group, condition)` Cli env guard — prints a `teardown` reminder before
     /// source edits. Requires `--iteration`.
     Finalize(CommonArgs),
-    /// Switch the active condition batch in a single-session isolated run.
-    ///
-    /// Removes the *off-condition*'s staged skill from `env/.claude/skills/` so the
-    /// next batch you dispatch cannot read it — the per-condition read-isolation
-    /// barrier for an interactive isolated run (see `RUNBOOK.md`).
-    /// `--condition` names the condition you are about to
-    /// dispatch next (the one to keep); its counterpart's staged skill is removed.
-    /// Run it only after every Task subagent of the prior batch has returned — it is
-    /// a hard barrier. Idempotent; resolves the iteration from `--workspace-dir` so
-    /// it works invoked from `env/`. Requires `--iteration`.
-    SwitchCondition(SwitchConditionArgs),
-    /// Swap the active isolation batch in a single-session isolated run.
-    ///
-    /// Wipes the shared `env/` working tree (keeping `.claude/skills/` and the
-    /// `.eval-magic-outputs/` tree) and re-seeds it with `--group`'s fixtures — the
-    /// per-batch isolation barrier between eval groups in an interactive isolated run
-    /// (see `RUNBOOK.md`). `--group` names the group you are
-    /// about to dispatch next. Run it only after every Task subagent of the prior
-    /// batch has returned — it is a hard barrier. Resolves the iteration from
-    /// `--workspace-dir` so it works invoked from `env/`. Requires `--iteration`.
-    ResetBatch(ResetBatchArgs),
     /// Assemble run records from a dispatch and its transcripts.
     ///
     /// Assembles a schema-valid `run.json` and backfills `timing.json` for every
     /// task in a runner-built iteration, from `dispatch.json` +
-    /// `outputs/final-message.md` + the persisted transcript. Never clobbers
-    /// existing records without `--overwrite`; transcript-derived timing carries
-    /// `"source": "transcript"`. Folded into `ingest`.
+    /// `outputs/final-message.md` + each task's `outputs/<harness>-events.jsonl`.
+    /// Never clobbers existing records without `--overwrite`; transcript-derived
+    /// timing carries `"source": "transcript"`. Folded into `ingest`.
     RecordRuns(CommonArgs),
     /// Populate tool invocations from persisted transcripts.
     ///
-    /// Matches each `(eval, condition)` to a subagent transcript by description and
-    /// populates `tool_invocations` in `run.json`. Subsumed by `record-runs` for
+    /// Reads each task's `outputs/<harness>-events.jsonl` and populates
+    /// `tool_invocations` in `run.json`. Subsumed by `record-runs` for
     /// runner-built iterations; still the tool for filling a pre-existing (hand- or
     /// agent-written) `run.json`.
     FillTranscripts(CommonArgs),
@@ -518,6 +548,18 @@ pub(crate) enum Commands {
     PromoteBaseline(PromoteBaselineArgs),
     /// Validate `evals.json` files against the bundled schemas.
     Validate(ValidateArgs),
+    /// Inspect and validate harness descriptors (built-in and user-supplied).
+    ///
+    /// Harnesses are described by layered TOML descriptor files: embedded
+    /// built-ins → user-global (`$EVAL_MAGIC_CONFIG_DIR`,
+    /// `$XDG_CONFIG_HOME/eval-magic`, or `~/.config/eval-magic`, each under
+    /// `harnesses/*.toml`) → project-local (`.eval-magic/harnesses/*.toml`) →
+    /// a one-off `--harness-file <path>`. A later file whose `label` matches an
+    /// earlier descriptor overrides individual fields (field-level merge, not
+    /// whole-file shadowing); a new `label` defines a new harness usable with
+    /// `--harness`. `list` surveys the registry, `show` prints one resolved
+    /// descriptor, and `lint` validates a descriptor file or registered name.
+    Harness(HarnessArgs),
     /// Internal PreToolUse hook entry point. Invoked by the installed write-guard
     /// hook as `eval-magic guard <marker>`, not by users; hidden from help.
     #[command(hide = true)]
@@ -535,4 +577,18 @@ pub(crate) enum Commands {
         /// `<cwd>/.agents/skills/.slow-powers-eval-guard.json`.
         marker: Option<String>,
     },
+    /// Internal generic PreToolUse hook entry point. Invoked by the installed
+    /// write-guard hook as `eval-magic guard-hook --harness <name> <marker>`,
+    /// not by users; hidden from help. `guard` / `guard-codex` are frozen
+    /// aliases of this for the claude-code and codex harnesses.
+    #[command(hide = true, name = "guard-hook")]
+    GuardHook {
+        /// Harness whose embedded descriptor supplies the verdict shape; an
+        /// unknown name fails open (allows the call).
+        #[arg(long)]
+        harness: String,
+        /// Path to the guard marker file. Defaults to the harness's
+        /// `<skills_dir>/.slow-powers-eval-guard.json` under the cwd.
+        marker: Option<String>,
+    },
 }
diff --git a/src/cli/commands/guard.rs b/src/cli/commands/guard.rs
index c4211d0..9ef73bf 100644
--- a/src/cli/commands/guard.rs
+++ b/src/cli/commands/guard.rs
@@ -1,37 +1,53 @@
-//! Write-guard command handlers: the hidden `guard` PreToolUse hook entry point
-//! and the user-facing `teardown-guard`.
+//! Write-guard command handlers: the hidden PreToolUse hook entry points and
+//! the user-facing `teardown-guard`.
+//!
+//! The `guard` / `guard-codex` subcommand names are a **stable on-disk
+//! contract**: armed hooks staged into harness config reference them by name,
+//! so renaming either would break every already-armed guard. Both are aliases
+//! of the generic `guard-hook` entry point, which future guard-capable
+//! harnesses use directly (`eval-magic guard-hook --harness <name>`).
 
 use std::io;
 use std::path::PathBuf;
 
+use crate::adapters::{HarnessAdapter, adapter_for};
+use crate::core::Harness;
 use crate::sandbox;
 
-/// The hidden PreToolUse hook entry point. Reads the hook payload from stdin and
-/// the marker path from argv, then prints a deny verdict for out-of-bounds calls.
-/// It **fails open** — every error path allows the call and exits 0, so the
-/// guard can never brick a session.
+/// The hidden Claude Code PreToolUse hook entry point — a frozen alias for
+/// `guard-hook --harness claude-code`.
 pub(crate) fn run_guard(marker: Option<String>) -> anyhow::Result<()> {
-    let marker_path = marker
-        .map(PathBuf::from)
-        .unwrap_or_else(default_marker_path);
-    let payload = io::read_to_string(io::stdin()).unwrap_or_default();
-    if let Some(verdict) = sandbox::guard_decision(&payload, sandbox::read_marker(&marker_path)) {
-        print!("{verdict}");
-    }
-    Ok(())
+    run_guard_hook("claude-code", marker)
 }
 
-/// The hidden Codex PreToolUse hook entry point. Same policy as `guard`, but
-/// Codex blocks by reading `{ "decision": "block", "reason": "..." }` from the
-/// hook's stdout.
+/// The hidden Codex PreToolUse hook entry point — a frozen alias for
+/// `guard-hook --harness codex`.
 pub(crate) fn run_guard_codex(marker: Option<String>) -> anyhow::Result<()> {
-    let marker_path = marker
-        .map(PathBuf::from)
-        .unwrap_or_else(default_codex_marker_path);
+    run_guard_hook("codex", marker)
+}
+
+/// The generic PreToolUse hook entry point. Reads the hook payload from stdin
+/// and the marker path from argv, resolves the harness's guard from the
+/// embedded descriptors (hook invocations skip layered discovery — see
+/// `cli::run`'s `is_guard_hook` gate), and prints a deny verdict for
+/// out-of-bounds calls. It **fails open** — an unknown harness, a guard-less
+/// descriptor, or any error path allows the call and exits 0, so the guard can
+/// never brick a session.
+pub(crate) fn run_guard_hook(harness_name: &str, marker: Option<String>) -> anyhow::Result<()> {
+    // Drain stdin before any early return so the harness writing the payload
+    // never sees a broken pipe, whatever the verdict.
     let payload = io::read_to_string(io::stdin()).unwrap_or_default();
-    if let Some(verdict) =
-        sandbox::codex_guard_decision(&payload, sandbox::read_marker(&marker_path))
-    {
+    let Ok(harness) = Harness::resolve(harness_name) else {
+        return Ok(());
+    };
+    let adapter = adapter_for(harness);
+    let Some(marker_path) = marker
+        .map(PathBuf::from)
+        .or_else(|| default_marker_path(adapter))
+    else {
+        return Ok(());
+    };
+    if let Some(verdict) = adapter.guard_verdict(&payload, sandbox::read_marker(&marker_path)) {
         print!("{verdict}");
     }
     Ok(())
@@ -53,22 +69,13 @@ pub(crate) fn run_teardown_guard() -> anyhow::Result<()> {
     Ok(())
 }
 
-/// The marker path the guard reads when argv carries none:
-/// `<cwd>/.claude/skills/.slow-powers-eval-guard.json`.
-fn default_marker_path() -> PathBuf {
-    std::env::current_dir()
-        .unwrap_or_default()
-        .join(".claude")
-        .join("skills")
-        .join(sandbox::GUARD_MARKER)
-}
-
-/// The marker path the Codex guard reads when argv carries none:
-/// `<cwd>/.agents/skills/.slow-powers-eval-guard.json`.
-fn default_codex_marker_path() -> PathBuf {
-    std::env::current_dir()
-        .unwrap_or_default()
-        .join(".agents")
-        .join("skills")
-        .join(sandbox::GUARD_MARKER)
+/// The marker path a guard hook reads when argv carries none: the harness's
+/// skills dir under the cwd, e.g. `<cwd>/.claude/skills/.slow-powers-eval-guard.json`.
+/// `None` (fail open) for a harness that declares no skills dir.
+fn default_marker_path(adapter: &dyn HarnessAdapter) -> Option<PathBuf> {
+    Some(
+        adapter
+            .skills_dir(&std::env::current_dir().unwrap_or_default())?
+            .join(sandbox::GUARD_MARKER),
+    )
 }
diff --git a/src/cli/commands/harness.rs b/src/cli/commands/harness.rs
new file mode 100644
index 0000000..98e2d4e
--- /dev/null
+++ b/src/cli/commands/harness.rs
@@ -0,0 +1,500 @@
+//! The `harness` subcommands: scaffold, inspect, and validate the layered
+//! harness descriptor registry (`init`, `list`, `show`, `lint`).
+
+use std::fs;
+use std::path::Path;
+
+use anyhow::{Context, bail};
+
+use crate::adapters::descriptor::layers::{
+    Layer, check_user_layer_restrictions, default_config_root, discover_sources,
+};
+use crate::adapters::descriptor::{
+    HarnessDescriptor, finalize_descriptor, merge_descriptor_value, parse_descriptor_value, subst,
+};
+use crate::adapters::registry::{HarnessInfo, default_harness_name, harness_info};
+use crate::core::Harness;
+
+use crate::cli::args::{HarnessArgs, HarnessCommands};
+
+/// The `harness init` descriptor scaffold; `{label}` is substituted with the
+/// new harness's name.
+const INIT_TEMPLATE: &str = include_str!("../../../harnesses/template.toml");
+
+/// The `harness init` notes skeleton scaffolded beside the descriptor.
+const INIT_NOTES_TEMPLATE: &str = include_str!("../../../harnesses/template-notes.md");
+
+pub(crate) fn run_harness(args: HarnessArgs) -> anyhow::Result<()> {
+    match args.command {
+        HarnessCommands::Init {
+            name,
+            stdout,
+            force,
+        } => run_init_scaffold(&name, stdout, force),
+        HarnessCommands::List => run_list(),
+        HarnessCommands::Show { name } => run_show(&name),
+        HarnessCommands::Lint { target } => run_lint(&target),
+    }
+}
+
+/// Scaffold the commented descriptor template and notes skeleton for `name`
+/// into the project-local layer (or print the template with `--stdout`).
+fn run_init_scaffold(name: &str, stdout: bool, force: bool) -> anyhow::Result<()> {
+    // Friendlier than the schema gate's pattern error, and before any I/O.
+    let is_kebab = !name.is_empty()
+        && name.split('-').all(|seg| {
+            !seg.is_empty()
+                && seg
+                    .chars()
+                    .all(|c| c.is_ascii_lowercase() || c.is_ascii_digit())
+        });
+    if !is_kebab {
+        bail!(
+            "harness name {name:?} must be kebab-case (lowercase alphanumerics separated by \
+             single hyphens), e.g. cool-cli"
+        );
+    }
+
+    // Prove the scaffold is lint-clean before anything lands on disk — a
+    // template regression fails loudly here instead of shipping a broken file.
+    let rendered = subst(INIT_TEMPLATE, &[("label", name)]);
+    let source = format!("harness init {name} (rendered template)");
+    let value = parse_descriptor_value(&rendered, &source)?;
+    check_user_layer_restrictions(&value, &source)?;
+    finalize_descriptor(&value, &source)?;
+
+    if stdout {
+        print!("{rendered}");
+        return Ok(());
+    }
+
+    // A colliding label is legitimate layering, not an error: the new file
+    // overlays the registered harness field-by-field.
+    if let Some(info) = harness_info().find(|info| info.label == name) {
+        eprintln!(
+            "note: '{name}' is already registered ({}) — this file will overlay it \
+             field-by-field (docs/byoh.md \"Layering\"); pick a new name for a new harness, \
+             or start an overlay from `eval-magic harness show {name}`.",
+            layer_chain(&info)
+        );
+    }
+
+    let dir = Path::new(".eval-magic").join("harnesses");
+    let descriptor_path = dir.join(format!("{name}.toml"));
+    let notes_path = dir.join(format!("{name}-notes.md"));
+    if !force {
+        for path in [&descriptor_path, &notes_path] {
+            if path.exists() {
+                bail!(
+                    "{} already exists — pass --force to overwrite it",
+                    path.display()
+                );
+            }
+        }
+    }
+    fs::create_dir_all(&dir).with_context(|| format!("cannot create {}", dir.display()))?;
+    fs::write(&descriptor_path, &rendered)
+        .with_context(|| format!("cannot write {}", descriptor_path.display()))?;
+    fs::write(&notes_path, subst(INIT_NOTES_TEMPLATE, &[("label", name)]))
+        .with_context(|| format!("cannot write {}", notes_path.display()))?;
+
+    println!(
+        "Scaffolded harness descriptor: {}",
+        descriptor_path.display()
+    );
+    println!("Scaffolded notes skeleton:     {}", notes_path.display());
+    println!();
+    lint_file(&descriptor_path)?;
+    println!();
+    println!("Next:");
+    println!("  1. Fill in verified values — follow the template's comments; never guess a flag");
+    println!(
+        "     (record each value's source in {}).",
+        notes_path.display()
+    );
+    println!(
+        "  2. Re-lint after every edit: eval-magic harness lint {}",
+        descriptor_path.display()
+    );
+    println!(
+        "  3. Smoke eval: eval-magic run --harness {name}  (dispatch, then ingest + finalize)"
+    );
+    println!(
+        "  4. Upstreaming the proven descriptor: docs/byoh.md \"Upstreaming your descriptor\"."
+    );
+    Ok(())
+}
+
+/// One line per registered harness: label, contributing layers, declared
+/// enhancements.
+fn run_list() -> anyhow::Result<()> {
+    let default_name = default_harness_name();
+    let rows: Vec<(String, String, String)> = harness_info()
+        .map(|info| {
+            let name = if info.label == default_name {
+                format!("{} (default)", info.label)
+            } else {
+                info.label.to_string()
+            };
+            (
+                name,
+                layer_chain(&info),
+                declared_enhancements(info.descriptor),
+            )
+        })
+        .collect();
+    let name_width = rows.iter().map(|(n, _, _)| n.len()).max().unwrap_or(0);
+    let layer_width = rows.iter().map(|(_, l, _)| l.len()).max().unwrap_or(0);
+    for (name, layers, enhancements) in rows {
+        println!("{name:<name_width$}  {layers:<layer_width$}  {enhancements}");
+    }
+    Ok(())
+}
+
+/// Print one harness's resolved (layer-merged) descriptor as authorable TOML,
+/// headed by its provenance chain.
+fn run_show(name: &str) -> anyhow::Result<()> {
+    let Some(info) = harness_info().find(|info| info.label == name) else {
+        return Err(Harness::resolve(name)
+            .expect_err("name is absent from the registry")
+            .into());
+    };
+    println!("# {name} — resolved descriptor (after layer merging)");
+    println!("# sources:");
+    for (layer, path) in info.sources {
+        println!("#   {path} ({})", layer.display_name());
+    }
+    println!();
+    print!("{}", toml::to_string(info.descriptor)?);
+    Ok(())
+}
+
+/// Lint a descriptor file, or every discovered layer of a registered name.
+fn run_lint(target: &str) -> anyhow::Result<()> {
+    let looks_like_path = target.contains(std::path::MAIN_SEPARATOR)
+        || target.ends_with(".toml")
+        || Path::new(target).is_file();
+    if looks_like_path {
+        lint_file(Path::new(target))
+    } else {
+        lint_name(target)
+    }
+}
+
+/// Run one descriptor file through the full load pipeline, reporting each
+/// check as a ✓/✗ line (the `validate` idiom).
+fn lint_file(path: &Path) -> anyhow::Result<()> {
+    let display = path.display();
+    let toml_src = fs::read_to_string(path).with_context(|| format!("cannot read {display}"))?;
+    let mut failed = 0usize;
+
+    let value = match parse_descriptor_value(&toml_src, &display.to_string()) {
+        Ok(value) => {
+            println!("✓ TOML syntax + schema");
+            Some(value)
+        }
+        Err(e) => {
+            eprintln!("✗ {e}");
+            failed += 1;
+            None
+        }
+    };
+
+    if let Some(value) = &value {
+        match check_user_layer_restrictions(value, &display.to_string()) {
+            Ok(()) => println!("✓ user-layer restrictions ([guard] stays built-in-only)"),
+            Err(e) => {
+                eprintln!("✗ {e}");
+                failed += 1;
+            }
+        }
+
+        // Cross-field invariants — merged onto the registered harness with the
+        // same label when one exists, so a partial override file is checked
+        // against its real merge target. Merging is idempotent, so linting a
+        // file the registry already discovered reports identically.
+        let label = value.get("label").and_then(serde_json::Value::as_str);
+        let target = label.and_then(|l| harness_info().find(|info| info.label == l));
+        let (merged, provenance) = match &target {
+            Some(info) => {
+                let mut merged = info.value.clone();
+                merge_descriptor_value(&mut merged, value.clone());
+                (
+                    merged,
+                    format!("{} + {display} (lint)", layer_provenance(info)),
+                )
+            }
+            None => (value.clone(), display.to_string()),
+        };
+        match finalize_descriptor(&merged, &provenance) {
+            Ok(_) => match &target {
+                Some(info) => println!("✓ cross-field invariants (merged onto {})", info.label),
+                None => println!("✓ cross-field invariants"),
+            },
+            Err(e) => {
+                eprintln!("✗ {e}");
+                failed += 1;
+            }
+        }
+    }
+
+    if failed > 0 {
+        bail!("descriptor lint failed for {display}: {failed} check(s) failed");
+    }
+    println!("Linted {display}: all checks passed.");
+    Ok(())
+}
+
+/// Strictly re-lint every discovered layer file, reporting the ones registry
+/// initialization skipped with a warning, and re-validate the named harness's
+/// merged chain.
+fn lint_name(name: &str) -> anyhow::Result<()> {
+    let project_root = std::env::current_dir().unwrap_or_default();
+    let (sources, io_warnings) =
+        discover_sources(default_config_root().as_deref(), &project_root, None)
+            .map_err(anyhow::Error::from)?;
+    let mut failed = io_warnings.len();
+    for warning in io_warnings {
+        eprintln!("✗ {warning}");
+    }
+
+    let mut chain: Option<(serde_json::Value, Vec<String>)> = None;
+    for source in sources {
+        let value = match parse_descriptor_value(&source.toml_src, &source.path) {
+            Ok(value) => value,
+            Err(e) => {
+                // The label is unknowable, so every broken discovered file is
+                // reported — these are exactly the files init skipped.
+                if source.layer != Layer::Embedded {
+                    eprintln!("✗ {e}");
+                    failed += 1;
+                }
+                continue;
+            }
+        };
+        if source.layer != Layer::Embedded
+            && let Err(e) = check_user_layer_restrictions(&value, &source.path)
+        {
+            eprintln!("✗ {e}");
+            failed += 1;
+            continue;
+        }
+        if value.get("label").and_then(serde_json::Value::as_str) != Some(name) {
+            continue;
+        }
+        let step = format!("{} ({})", source.path, source.layer.display_name());
+        println!("✓ {step}: schema + user-layer checks");
+        match &mut chain {
+            None => chain = Some((value, vec![step])),
+            Some((base, steps)) => {
+                let mut merged = base.clone();
+                merge_descriptor_value(&mut merged, value);
+                steps.push(step);
+                let provenance = steps.join(" + ");
+                match finalize_descriptor(&merged, &provenance) {
+                    Ok(_) => *base = merged,
+                    Err(e) => {
+                        eprintln!("✗ {e}");
+                        failed += 1;
+                        steps.pop();
+                    }
+                }
+            }
+        }
+    }
+
+    match &chain {
+        Some((value, steps)) => {
+            let provenance = steps.join(" + ");
+            match finalize_descriptor(value, &provenance) {
+                Ok(_) => println!("✓ resolved descriptor: {provenance}"),
+                Err(e) => {
+                    eprintln!("✗ {e}");
+                    failed += 1;
+                }
+            }
+        }
+        // Discovery missed it, but a `--harness-file` may still have
+        // registered it for this invocation.
+        None => match harness_info().find(|info| info.label == name) {
+            Some(info) => println!("✓ registered: {}", layer_provenance(&info)),
+            None if failed == 0 => {
+                return Err(Harness::resolve(name)
+                    .expect_err("name is absent from every layer")
+                    .into());
+            }
+            None => {}
+        },
+    }
+
+    if failed > 0 {
+        bail!(
+            "descriptor lint found {failed} failing check(s) across the discovered layers \
+             (see ✗ lines above; broken files are reported even when their label is not \
+             {name:?}, since a file that fails to parse has no readable label)"
+        );
+    }
+    println!("Linted {name}: all checks passed.");
+    Ok(())
+}
+
+/// `built-in + project` — the layer chain for `harness list`.
+fn layer_chain(info: &HarnessInfo) -> String {
+    info.sources
+        .iter()
+        .map(|(layer, _)| layer.display_name())
+        .collect::<Vec<_>>()
+        .join(" + ")
+}
+
+/// `harnesses/claude-code.toml (built-in) + …` — the full provenance chain.
+fn layer_provenance(info: &HarnessInfo) -> String {
+    info.sources
+        .iter()
+        .map(|(layer, path)| format!("{path} ({})", layer.display_name()))
+        .collect::<Vec<_>>()
+        .join(" + ")
+}
+
+/// The enhancements a resolved descriptor declares, for `harness list`.
+fn declared_enhancements(descriptor: &HarnessDescriptor) -> String {
+    let mut list: Vec<&str> = Vec::new();
+    if descriptor.skills_dir.is_some() {
+        list.push("staging");
+    }
+    if descriptor.skills_block.is_some() {
+        list.push("skills-block");
+    }
+    if descriptor.transcript.is_some() {
+        list.push("transcript");
+    }
+    if descriptor.model.is_some() {
+        list.push("model-flag");
+    }
+    if descriptor.guard.is_some() {
+        list.push("guard");
+    }
+    if descriptor.shadow.is_some() {
+        list.push("shadow-preflight");
+    }
+    if !descriptor.dispatch.is_empty() {
+        list.push("dispatch-recipes");
+    }
+    if list.is_empty() {
+        "baseline".to_string()
+    } else {
+        list.join(", ")
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::adapters::descriptor::load_descriptor;
+
+    #[test]
+    fn rendered_template_passes_the_full_descriptor_pipeline() {
+        let rendered = subst(INIT_TEMPLATE, &[("label", "demo")]);
+        let value = parse_descriptor_value(&rendered, "template").expect("schema-clean");
+        check_user_layer_restrictions(&value, "template").expect("no guard data");
+        let descriptor = load_descriptor(&rendered, "template").expect("invariant-clean");
+
+        // As written the scaffold is a pure baseline harness: only `label`
+        // is live, every enhancement stays commented out.
+        assert_eq!(descriptor.label, "demo");
+        assert!(descriptor.skills_dir.is_none());
+        assert!(descriptor.transcript.is_none());
+        assert!(descriptor.guard.is_none());
+        assert!(descriptor.dispatch.is_empty());
+    }
+
+    #[test]
+    fn template_substitutes_only_the_label_token() {
+        let rendered = subst(INIT_TEMPLATE, &[("label", "demo")]);
+        assert!(!rendered.contains("{label}"));
+        // Placeholders that belong to the examples survive substitution.
+        for survivor in ["{prefix}", "{model_arg}", "{name}", "{cwd}"] {
+            assert!(
+                rendered.contains(survivor),
+                "{survivor} should pass through subst"
+            );
+        }
+    }
+
+    /// The drift guard: a schema field or capability name that the template
+    /// never mentions is invisible to an agent authoring from the scaffold.
+    #[test]
+    fn template_mentions_every_schema_field_and_capability_name() {
+        let schema: serde_json::Value = serde_json::from_str(include_str!(
+            "../../../schema/harness-descriptor.schema.json"
+        ))
+        .expect("schema parses");
+        let properties = schema["properties"]
+            .as_object()
+            .expect("schema has properties");
+
+        for (field, spec) in properties {
+            assert!(
+                INIT_TEMPLATE.contains(field),
+                "template never mentions {field:?}"
+            );
+            // [guard] subfields are deliberately not scaffolded (user layers
+            // may not declare the table); the table name itself is asserted
+            // above via the "guard" mention and below as literal prose.
+            if field == "guard" {
+                continue;
+            }
+            if let Some(nested) = spec["properties"].as_object() {
+                for (nested_field, nested_spec) in nested {
+                    assert!(
+                        INIT_TEMPLATE.contains(nested_field),
+                        "template never mentions {field}.{nested_field}"
+                    );
+                    if let Some(values) = nested_spec["enum"].as_array() {
+                        for value in values {
+                            let value = value.as_str().expect("string enum");
+                            assert!(
+                                INIT_TEMPLATE.contains(value),
+                                "template never mentions capability {field}.{nested_field} = \
+                                 {value:?}"
+                            );
+                        }
+                    }
+                }
+            }
+        }
+        assert!(
+            INIT_TEMPLATE.contains("[guard]"),
+            "the guard restriction must be explained"
+        );
+    }
+
+    /// Every commented-out example must jointly form one coherent fictional
+    /// descriptor — so an agent uncommenting any subset of tables starts from
+    /// mutually consistent values. `## ` lines are prose and stay comments;
+    /// `# ` lines are the uncommentable examples.
+    #[test]
+    fn fully_uncommented_template_is_a_coherent_descriptor() {
+        let rendered = subst(INIT_TEMPLATE, &[("label", "demo")]);
+        let uncommented: String = rendered
+            .lines()
+            .map(|line| line.strip_prefix("# ").unwrap_or(line))
+            .collect::<Vec<_>>()
+            .join("\n");
+
+        let value =
+            parse_descriptor_value(&uncommented, "uncommented template").expect("schema-clean");
+        check_user_layer_restrictions(&value, "uncommented template").expect("no guard data");
+        let descriptor =
+            load_descriptor(&uncommented, "uncommented template").expect("invariant-clean");
+
+        // The examples exercise every scaffolded table.
+        assert!(descriptor.skills_dir.is_some());
+        assert!(descriptor.transcript.is_some());
+        assert!(descriptor.model.is_some());
+        assert!(descriptor.skills_block.is_some());
+        assert!(descriptor.shadow.is_some());
+        assert!(!descriptor.dispatch.is_empty());
+        assert!(descriptor.guard.is_none());
+    }
+}
diff --git a/src/cli/commands/mod.rs b/src/cli/commands/mod.rs
index cbb697f..2000432 100644
--- a/src/cli/commands/mod.rs
+++ b/src/cli/commands/mod.rs
@@ -5,17 +5,19 @@
 //! [`super`] (`crate::cli`).
 
 mod guard;
+mod harness;
 mod init;
 mod pipeline;
 mod run;
 mod validate;
 mod workspace;
 
-pub(crate) use guard::{run_guard, run_guard_codex, run_teardown_guard};
+pub(crate) use guard::{run_guard, run_guard_codex, run_guard_hook, run_teardown_guard};
+pub(crate) use harness::run_harness;
 pub(crate) use init::run_init;
 pub(crate) use pipeline::{
     run_aggregate, run_detect_stray_writes, run_fill_transcripts, run_finalize, run_grade,
-    run_ingest, run_record_runs, run_reset_batch, run_switch_condition,
+    run_ingest, run_record_runs,
 };
 pub(crate) use run::run_run;
 pub(crate) use validate::run_validate;
diff --git a/src/cli/commands/pipeline.rs b/src/cli/commands/pipeline.rs
index ab185e0..d3587b7 100644
--- a/src/cli/commands/pipeline.rs
+++ b/src/cli/commands/pipeline.rs
@@ -5,13 +5,11 @@
 use anyhow::bail;
 
 use crate::adapters::{CliJudgeContext, adapter_for};
-use crate::cli::args::{CommonArgs, GradeArgs, ResetBatchArgs, SwitchConditionArgs};
+use crate::cli::args::{CommonArgs, GradeArgs};
 use crate::cli::command_target_args;
 use crate::cli::run;
-use crate::cli::{
-    iteration_dir, resolve_iteration, resolve_subagents_dir, run_context_from, staged_env_roots,
-};
-use crate::core::{DispatchMechanism, RunContext};
+use crate::cli::{iteration_dir, resolve_iteration, run_context_from, staged_env_roots};
+use crate::core::RunContext;
 use crate::pipeline;
 use crate::sandbox;
 use crate::validation;
@@ -23,21 +21,16 @@ fn judge_dispatch_guidance(ctx: &RunContext, iteration: u32) -> String {
         .workspace_root
         .join(&ctx.skill_name)
         .join(format!("iteration-{iteration}"));
-    match ctx.run_mode.mechanism() {
-        DispatchMechanism::InSession => {
-            format!("Dispatch each task as a judge subagent with:\n  {JUDGE_WORKER_PROMPT}")
-        }
-        DispatchMechanism::Cli => adapter_for(ctx.harness)
-            .cli_judge_next_steps(CliJudgeContext {
-                guard: sandbox::guard_is_armed(&ctx.stage_root),
-                iteration_dir: &iteration_dir,
-            })
-            .unwrap_or_else(|| {
-                format!(
-                    "Dispatch each task from judge-tasks.json with:\n  {JUDGE_WORKER_PROMPT}\nModel selection is recorded in judge-tasks.json, but this harness adapter has no judge CLI recipe wired yet."
-                )
-            }),
-    }
+    adapter_for(ctx.harness)
+        .cli_judge_next_steps(CliJudgeContext {
+            guard: sandbox::guard_is_armed(&ctx.stage_root),
+            iteration_dir: &iteration_dir,
+        })
+        .unwrap_or_else(|| {
+            format!(
+                "Dispatch each task from judge-tasks.json with:\n  {JUDGE_WORKER_PROMPT}\nModel selection is recorded in judge-tasks.json, but this harness adapter has no judge CLI recipe wired yet."
+            )
+        })
 }
 
 /// Execute one chain step by mapping its [`run::steps::StepKind`] to the stage
@@ -51,13 +44,8 @@ fn run_step(step: &run::steps::StepCommand) -> anyhow::Result<()> {
         skill: step.skill.clone(),
         iteration: Some(step.iteration),
         mode: None,
-        harness: Some(step.harness),
-        run_mode: Some(step.run_mode),
+        harness: Some(step.harness.name().to_string()),
         workspace_dir: step.workspace_dir.clone(),
-        // The chain carries the already-resolved absolute subagents dir, so the
-        // session id is no longer needed downstream.
-        subagents_dir: step.subagents_dir.clone(),
-        session_id: None,
         only: None,
         skip: None,
         overwrite: false,
@@ -80,20 +68,22 @@ fn run_step(step: &run::steps::StepCommand) -> anyhow::Result<()> {
 pub(crate) fn run_ingest(args: CommonArgs) -> anyhow::Result<()> {
     let ctx = run_context_from(&args)?;
     let iteration = resolve_iteration(&ctx, args.iteration)?;
-    let resolved = resolve_subagents_dir(
-        ctx.run_mode.mechanism(),
-        args.subagents_dir.as_deref(),
-        args.session_id.as_deref(),
-    )?;
-    let resolved = resolved.as_ref().map(|p| p.to_string_lossy().into_owned());
+
+    let adapter = crate::adapters::adapter_for(ctx.harness);
+    if adapter.cli_events_filename().is_none() {
+        eprintln!(
+            "ℹ --harness {}: no transcript parser — records come from outputs/final-message.md \
+             only; steps/tokens/duration go unrecorded and transcript_check assertions grade \
+             as unverifiable (llm_judge carries the grading).",
+            adapter.label()
+        );
+    }
 
     let steps = run::steps::build_ingest_commands(&run::steps::StepParams {
         skill_dir: args.skill_dir.as_deref(),
         skill: args.skill.as_deref(),
         iteration,
         harness: ctx.harness,
-        run_mode: ctx.run_mode,
-        subagents_dir: resolved.as_deref(),
         workspace_dir: args.workspace_dir.as_deref(),
     });
     if let Some(failed) = run::steps::run_steps(&steps, run_step) {
@@ -137,8 +127,6 @@ pub(crate) fn run_finalize(args: CommonArgs) -> anyhow::Result<()> {
         skill: args.skill.as_deref(),
         iteration,
         harness: ctx.harness,
-        run_mode: ctx.run_mode,
-        subagents_dir: None,
         workspace_dir: args.workspace_dir.as_deref(),
     });
     if let Some(failed) = run::steps::run_steps(&steps, run_step) {
@@ -148,15 +136,11 @@ pub(crate) fn run_finalize(args: CommonArgs) -> anyhow::Result<()> {
     println!(
         "\n✅ Finalize complete. Read the benchmark above, then tear down: eval-magic teardown{target_args}"
     );
-    // Warn if a guard is still armed. The cwd check covers the in-session flow (run
-    // from inside `env/`); under Cli there is one env per (group, condition), so also
-    // walk each per-env marker. `teardown` (not the cwd-only `teardown-guard`) is what
-    // disarms them all.
+    // Warn if a guard is still armed. There is one env per (group, condition), so
+    // walk each per-env marker as well as the cwd. `teardown` (not the cwd-only
+    // `teardown-guard`) is what disarms them all.
     let mut armed = sandbox::guard_is_armed(&ctx.stage_root);
-    if !armed
-        && ctx.run_mode.mechanism() == DispatchMechanism::Cli
-        && let Ok(dir) = iteration_dir(&ctx, Some(iteration))
-    {
+    if !armed && let Ok(dir) = iteration_dir(&ctx, Some(iteration)) {
         armed = staged_env_roots(&dir)
             .iter()
             .any(|env| sandbox::guard_is_armed(env));
@@ -169,191 +153,12 @@ pub(crate) fn run_finalize(args: CommonArgs) -> anyhow::Result<()> {
     Ok(())
 }
 
-/// Switch the active condition batch in a single-session isolated run: remove the
-/// *off-condition*'s staged skill from `env/.claude/skills/` so the next batch the
-/// session dispatches cannot read it. `--condition` names the condition about to be
-/// dispatched (the one to keep); its counterpart is removed. Idempotent, and a hard
-/// barrier — the runbook instructs the operator to join every Task subagent of the
-/// prior batch first. Resolves the iteration from `--workspace-dir`, so it runs from
-/// `cwd = env/`. The guard marker is a sibling file of the slug subtree, so removing
-/// the slug dir leaves it (and an armed guard) intact.
-pub(crate) fn run_switch_condition(args: SwitchConditionArgs) -> anyhow::Result<()> {
-    let ctx = run_context_from(&args.common)?;
-    let dir = iteration_dir(&ctx, args.common.iteration)?;
-
-    let conditions_path = dir.join("conditions.json");
-    if !conditions_path.exists() {
-        bail!("missing: {}", conditions_path.display());
-    }
-    let conditions: crate::core::ConditionsRecord =
-        serde_json::from_str(&std::fs::read_to_string(&conditions_path)?)?;
-
-    // `--condition` names the arm to KEEP; its counterpart is the off-condition to
-    // remove. Validate against the recorded conditions so a typo fails loudly
-    // instead of silently no-opping.
-    let names: Vec<&str> = conditions
-        .conditions
-        .iter()
-        .map(|c| c.name.as_str())
-        .collect();
-    if !names.contains(&args.condition.as_str()) {
-        bail!(
-            "unknown --condition '{}'; this iteration's conditions are: {}",
-            args.condition,
-            names.join(", ")
-        );
-    }
-    let off = conditions
-        .conditions
-        .iter()
-        .find(|c| c.name != args.condition)
-        .ok_or_else(|| anyhow::anyhow!("no off-condition to switch away from"))?;
-
-    let skills_dir = run::staging::skills_dir_for_harness(&dir.join("env"), ctx.harness);
-    match off.staged_skill_slug.as_ref() {
-        // The off-condition staged a skill: remove exactly its slug subtree. We do
-        // NOT use `cleanup_staged_skills` (it prefix-scans and would remove both
-        // arms' slugs and prune the dir) — only this one slug must go.
-        Some(Some(slug)) => {
-            let slug_dir = skills_dir.join(slug);
-            if slug_dir.exists() {
-                std::fs::remove_dir_all(&slug_dir)?;
-                println!(
-                    "Switched to '{}': removed off-condition '{}' staged skill ({}).",
-                    args.condition,
-                    off.name,
-                    slug_dir.display()
-                );
-            } else {
-                println!(
-                    "Switched to '{}': off-condition '{}' staged skill already absent — nothing to do.",
-                    args.condition, off.name
-                );
-            }
-        }
-        // The off-condition never staged a skill (e.g. the new-skill control arm),
-        // so there is nothing to hide.
-        _ => println!(
-            "Switched to '{}': off-condition '{}' has no staged skill — nothing to remove.",
-            args.condition, off.name
-        ),
-    }
-    Ok(())
-}
-
-/// Swap the active isolation batch in a single-session (in-session) isolated run:
-/// wipe the shared `env/` working tree — keeping the staged skills and the
-/// `.eval-magic-outputs/` tree — and re-seed it with `--group`'s fixtures, so the
-/// next batch starts from a clean tree the prior batch's fixtures and stray writes
-/// can't taint. A hard barrier: the runbook joins every Task subagent of the prior
-/// batch first. Resolves the iteration from `--workspace-dir`, so it runs from
-/// `cwd = env/`.
-pub(crate) fn run_reset_batch(args: ResetBatchArgs) -> anyhow::Result<()> {
-    let ctx = run_context_from(&args.common)?;
-    let dir = iteration_dir(&ctx, args.common.iteration)?;
-    let env_dir = dir.join("env");
-    if !env_dir.exists() {
-        bail!("missing env dir: {}", env_dir.display());
-    }
-
-    let dispatch_path = dir.join("dispatch.json");
-    if !dispatch_path.exists() {
-        bail!("missing: {}", dispatch_path.display());
-    }
-    let dispatch: serde_json::Value =
-        serde_json::from_str(&std::fs::read_to_string(&dispatch_path)?)?;
-    let tasks = dispatch["tasks"].as_array().cloned().unwrap_or_default();
-
-    // Groups are tagged on tasks only when there is more than one. Validate against
-    // them so a typo (or a needless reset on a single-group run) fails loudly.
-    let group_ids: std::collections::BTreeSet<&str> =
-        tasks.iter().filter_map(|t| t["group"].as_str()).collect();
-    if !group_ids.contains(args.group.as_str()) {
-        if group_ids.is_empty() {
-            bail!(
-                "unknown --group '{}'; this iteration has a single group, so reset-batch is not needed.",
-                args.group
-            );
-        }
-        bail!(
-            "unknown --group '{}'; this iteration's groups are: {}",
-            args.group,
-            group_ids.into_iter().collect::<Vec<_>>().join(", ")
-        );
-    }
-
-    // The group's declared, env-relative fixture dests (deduped across its tasks).
-    let mut dests: Vec<String> = Vec::new();
-    for t in &tasks {
-        if t["group"].as_str() != Some(args.group.as_str()) {
-            continue;
-        }
-        if let Some(fixtures) = t["fixtures"].as_array() {
-            for f in fixtures.iter().filter_map(|f| f.as_str()) {
-                if !dests.iter().any(|d| d == f) {
-                    dests.push(f.to_string());
-                }
-            }
-        }
-    }
-
-    // Full wipe: drop every entry in env/ except the staged skills, the outputs
-    // tree, and the runbook — so a prior batch's fixtures and any stray writes can't
-    // leak into this one.
-    const KEEP: &[&str] = &[
-        ".claude",
-        ".agents",
-        ".codex",
-        ".opencode",
-        ".eval-magic-outputs",
-        "RUNBOOK.md",
-    ];
-    for entry in std::fs::read_dir(&env_dir)? {
-        let entry = entry?;
-        if KEEP.iter().any(|k| entry.file_name() == **k) {
-            continue;
-        }
-        let path = entry.path();
-        if path.is_dir() {
-            std::fs::remove_dir_all(&path)?;
-        } else {
-            std::fs::remove_file(&path)?;
-        }
-    }
-
-    // Re-seed this group's fixtures from the skill's evals/ dir.
-    for dest in &dests {
-        let src = ctx.skill_subdir.join("evals").join(dest);
-        let dst = env_dir.join(dest);
-        if let Some(parent) = dst.parent() {
-            std::fs::create_dir_all(parent)?;
-        }
-        run::copy_entry(&src, &dst)?;
-    }
-
-    println!(
-        "Reset to group '{}': wiped the env working tree and re-seeded {} fixture(s).",
-        args.group,
-        dests.len()
-    );
-    Ok(())
-}
-
 /// Assemble `run.json` + `timing.json` for every task in the iteration's
 /// `dispatch.json`.
 pub(crate) fn run_record_runs(args: CommonArgs) -> anyhow::Result<()> {
     let ctx = run_context_from(&args)?;
-    let mechanism = ctx.run_mode.mechanism();
-    let resolved = resolve_subagents_dir(
-        mechanism,
-        args.subagents_dir.as_deref(),
-        args.session_id.as_deref(),
-    )?;
-    let subagents_dir = resolved.as_deref();
-
     let dir = iteration_dir(&ctx, args.iteration)?;
-    let result =
-        pipeline::record_runs(&dir, ctx.harness, mechanism, subagents_dir, args.overwrite)?;
+    let result = pipeline::record_runs(&dir, ctx.harness, args.overwrite)?;
 
     println!(
         "\nRecorded: {}, skipped (existing run.json): {}, skipped (no final message): {}, skipped (prompt unread): {}, missing transcript: {}",
@@ -363,7 +168,7 @@ pub(crate) fn run_record_runs(args: CommonArgs) -> anyhow::Result<()> {
         result.skipped_prompt_unread,
         result.missing_transcript
     );
-    if let Some(warning) = result.transcript_warning(ctx.harness, mechanism) {
+    if let Some(warning) = result.transcript_warning(ctx.harness) {
         eprintln!("{warning}");
     }
     if let Some(warning) = result.prompt_unread_warning() {
@@ -376,17 +181,8 @@ pub(crate) fn run_record_runs(args: CommonArgs) -> anyhow::Result<()> {
 /// the iteration.
 pub(crate) fn run_fill_transcripts(args: CommonArgs) -> anyhow::Result<()> {
     let ctx = run_context_from(&args)?;
-    let mechanism = ctx.run_mode.mechanism();
-    let resolved = resolve_subagents_dir(
-        mechanism,
-        args.subagents_dir.as_deref(),
-        args.session_id.as_deref(),
-    )?;
-    let subagents_dir = resolved.as_deref();
-
     let dir = iteration_dir(&ctx, args.iteration)?;
-    let result =
-        pipeline::fill_transcripts(&dir, ctx.harness, mechanism, subagents_dir, args.overwrite)?;
+    let result = pipeline::fill_transcripts(&dir, ctx.harness, args.overwrite)?;
 
     println!(
         "\nFilled: {}, skipped (already populated): {}, missing transcript: {}",
@@ -444,7 +240,7 @@ pub(crate) fn run_detect_stray_writes(args: CommonArgs) -> anyhow::Result<()> {
     let clean = t.violations == 0 && t.warnings == 0 && t.live_source_reads == 0;
     if clean && report.invocations_inspected == 0 {
         eprintln!(
-            "⚠ Unverifiable — 0 transcript tool-calls inspected. Stray-write detection had nothing to check (every run's tool_invocations is empty); link transcripts first, then re-run (see the record-runs warning about passing agent_description verbatim / pointing --subagents-dir at the right session)."
+            "⚠ Unverifiable — 0 transcript tool-calls inspected. Stray-write detection had nothing to check (every run's tool_invocations is empty); link transcripts first, then re-run (confirm each task's `outputs/<harness>-events.jsonl` exists — see the record-runs warning)."
         );
     } else if clean {
         println!("✓ No out-of-bounds writes or live-source reads detected.");
diff --git a/src/cli/commands/run.rs b/src/cli/commands/run.rs
index 372efdd..b304756 100644
--- a/src/cli/commands/run.rs
+++ b/src/cli/commands/run.rs
@@ -19,7 +19,11 @@ pub(crate) fn run_run(args: RunArgs) -> anyhow::Result<()> {
             iteration: args.common.iteration,
             dry_run: args.dry_run,
             no_stage: args.no_stage,
-            guard: args.guard,
+            guard: match (args.guard, args.no_guard) {
+                (true, _) => Some(true),
+                (_, true) => Some(false),
+                _ => None,
+            },
             stage_name: args.stage_name.as_deref(),
             plan_mode: args.plan_mode,
             runs: args.runs,
diff --git a/src/cli/commands/workspace.rs b/src/cli/commands/workspace.rs
index 2905485..62032e1 100644
--- a/src/cli/commands/workspace.rs
+++ b/src/cli/commands/workspace.rs
@@ -8,7 +8,6 @@ use crate::cli::run;
 use crate::cli::{
     command_target_args, iteration_dir, resolve_iteration, run_context_from, staged_env_roots,
 };
-use crate::core::DispatchMechanism;
 use crate::sandbox;
 use crate::workspace;
 
@@ -91,15 +90,12 @@ pub(crate) fn run_promote_baseline(args: PromoteBaselineArgs) -> anyhow::Result<
 /// any iteration with uncommitted results.
 pub(crate) fn run_teardown(args: CommonArgs) -> anyhow::Result<()> {
     let ctx = run_context_from(&args)?;
-    // Disarm the guard at the invocation cwd — the in-session flow runs teardown from
-    // inside `env/`. Under Cli there is one env per (group, condition) and the human
-    // runs teardown from the iteration dir, so additionally walk each per-env marker
-    // (before `cleanup_workspace` reclaims the tree). Best-effort: a missing iteration
-    // just skips the walk; `teardown_guard` is a no-op without a marker.
+    // Disarm the guard at the invocation cwd, then walk each per-(group, condition)
+    // env marker (the human runs teardown from the iteration dir) before
+    // `cleanup_workspace` reclaims the tree. Best-effort: a missing iteration just
+    // skips the walk; `teardown_guard` is a no-op without a marker.
     let mut torn = sandbox::teardown_guard(&std::env::current_dir()?);
-    if ctx.run_mode.mechanism() == DispatchMechanism::Cli
-        && let Ok(dir) = iteration_dir(&ctx, args.iteration)
-    {
+    if let Ok(dir) = iteration_dir(&ctx, args.iteration) {
         for env in staged_env_roots(&dir) {
             torn |= sandbox::teardown_guard(&env);
         }
diff --git a/src/cli/help.rs b/src/cli/help.rs
index c97afab..6c1f99c 100644
--- a/src/cli/help.rs
+++ b/src/cli/help.rs
@@ -12,21 +12,20 @@ EXAMPLES:
   eval-magic init
 
   # Mode A — evaluate a new skill (with vs. without)
-  eval-magic run --guard
-  # run builds the isolated env/ + RUNBOOK.md, then prints a handoff:
-  #   cd into env/, start a fresh session, say \"Read and follow RUNBOOK.md\".
-  # The fresh session walks the whole loop below from inside env/:
-  #   …dispatch each task in dispatch.json as a fresh subagent…
-  #   eval-magic ingest      # auto-resolves --subagents-dir from CLAUDE_CODE_SESSION_ID
-  #                          # (override: --session-id <id> or --subagents-dir <path>)
+  eval-magic run
+  # run builds per-(group, condition) envs + RUNBOOK.md (a human-followed recipe),
+  # arming the write guard automatically when the harness supports it.
+  # Follow it to dispatch each task in dispatch.json via `claude -p`, capturing each
+  # task's outputs/claude-events.jsonl, then:
+  #   eval-magic ingest      # reads each task's outputs/claude-events.jsonl
   #   …dispatch each judge task ingest listed…
   #   eval-magic finalize
   #   eval-magic teardown
-  eval-magic promote-baseline   # optional, from the prep session once benchmark.json lands
+  eval-magic promote-baseline   # optional, once benchmark.json lands
 
   # Mode B — evaluate a language change (edit-first)
   eval-magic snapshot --ref HEAD
-  eval-magic run --mode revision --guard
+  eval-magic run --mode revision
   # …then the same ingest → finalize → teardown steps as Mode A.
 
   # Reduced-set / dry runs
@@ -34,11 +33,14 @@ EXAMPLES:
   eval-magic run --only case-a,case-b
   eval-magic run --skip slow-case
 
+  # Opt out of the auto-armed write guard
+  eval-magic run --no-guard
+
   # Evaluate one skill from elsewhere, without staging sibling skills
-  eval-magic run --skill ./skills/my-skill --guard
+  eval-magic run --skill ./skills/my-skill
 
   # Opt in to seeded environment parity: stage sibling skills from a skills dir
-  eval-magic run --skill-dir ./skills --skill my-skill --guard
+  eval-magic run --skill-dir ./skills --skill my-skill
 
   # Codex harness: dispatch with stdin detached; ingest reads each task's codex-events.jsonl
   eval-magic run --harness codex
@@ -52,4 +54,16 @@ EXAMPLES:
   eval-magic run --harness opencode
   # ...dispatch each task with `opencode run`, then assemble records manually
   # until OpenCode transcript ingest is wired.
+
+  # Bring your own harness (docs/byoh.md): scaffold a commented descriptor +
+  # notes skeleton into .eval-magic/harnesses/, fill in verified values, lint, run
+  eval-magic harness init cool-custom-harness
+  eval-magic harness lint .eval-magic/harnesses/cool-custom-harness.toml
+  eval-magic harness list
+  eval-magic run --harness cool-custom-harness
+  # ...or load a one-off descriptor (its label becomes the default harness):
+  eval-magic run --harness-file ./cool-custom-harness.toml
+
+  # Inspect the resolved descriptor after layer merging (built-ins included)
+  eval-magic harness show claude-code
 ";
diff --git a/src/cli/mod.rs b/src/cli/mod.rs
index a83aca7..b5c9175 100644
--- a/src/cli/mod.rs
+++ b/src/cli/mod.rs
@@ -11,8 +11,7 @@ use std::path::{Path, PathBuf};
 use anyhow::{anyhow, bail};
 use clap::Parser;
 
-use crate::adapters::{config_dir_from_env, resolve_subagents_dir_for_session};
-use crate::core::{DetectInput, DispatchMechanism, RunContext, detect_run_context};
+use crate::core::{DetectInput, Harness, RunContext, detect_run_context};
 
 mod args;
 mod commands;
@@ -22,10 +21,23 @@ mod run;
 use args::{Cli, Commands, CommonArgs, RunArgs};
 use commands::*;
 
-/// Parse process arguments, dispatch to the selected subcommand, and return its
-/// result. Called by the binary entry point.
+/// Parse process arguments, initialize the harness descriptor registry (every
+/// layer, including an optional `--harness-file`), dispatch to the selected
+/// subcommand, and return its result. Called by the binary entry point.
 pub fn run() -> anyhow::Result<()> {
-    dispatch(Cli::parse().command)
+    let cli = Cli::parse();
+    // The hidden guard hooks fire on every PreToolUse in a dispatched session
+    // and only ever need the embedded descriptors — skip layered discovery so
+    // a broken user descriptor can't add noise or latency per tool call (the
+    // lazy registry fallback serves them embedded-only).
+    let is_guard_hook = matches!(
+        cli.command,
+        Some(Commands::Guard { .. } | Commands::GuardCodex { .. } | Commands::GuardHook { .. })
+    );
+    if !is_guard_hook {
+        crate::adapters::registry::init_registry(cli.harness_file.as_deref().map(Path::new))?;
+    }
+    dispatch(cli.command)
 }
 
 fn dispatch(command: Option<Commands>) -> anyhow::Result<()> {
@@ -37,10 +49,7 @@ fn dispatch(command: Option<Commands>) -> anyhow::Result<()> {
             iteration: None,
             mode: None,
             harness: None,
-            run_mode: None,
             workspace_dir: None,
-            subagents_dir: None,
-            session_id: None,
             only: None,
             skip: None,
             overwrite: false,
@@ -50,6 +59,7 @@ fn dispatch(command: Option<Commands>) -> anyhow::Result<()> {
         dry_run: false,
         no_stage: false,
         guard: false,
+        no_guard: false,
         stage_name: None,
         plan_mode: false,
         runs: 1,
@@ -62,18 +72,18 @@ fn dispatch(command: Option<Commands>) -> anyhow::Result<()> {
         Commands::Run(args) => run_run(args),
         Commands::Ingest(args) => run_ingest(args),
         Commands::Finalize(args) => run_finalize(args),
-        Commands::SwitchCondition(args) => run_switch_condition(args),
-        Commands::ResetBatch(args) => run_reset_batch(args),
         Commands::Init(args) => run_init(args),
         Commands::Validate(args) => run_validate(args),
         Commands::TeardownGuard(_) => run_teardown_guard(),
         Commands::Guard { marker } => run_guard(marker),
         Commands::GuardCodex { marker } => run_guard_codex(marker),
+        Commands::GuardHook { harness, marker } => run_guard_hook(&harness, marker),
         Commands::RecordRuns(args) => run_record_runs(args),
         Commands::FillTranscripts(args) => run_fill_transcripts(args),
         Commands::DetectStrayWrites(args) => run_detect_stray_writes(args),
         Commands::Grade(args) => run_grade(args),
         Commands::Aggregate(args) => run_aggregate(args),
+        Commands::Harness(args) => run_harness(args),
         Commands::Snapshot(args) => run_snapshot(args),
         Commands::Teardown(args) => run_teardown(args),
         Commands::PromoteBaseline(args) => run_promote_baseline(args),
@@ -92,13 +102,16 @@ pub(crate) fn run_context_with_bootstrap(
     args: &CommonArgs,
     bootstrap: Option<String>,
 ) -> anyhow::Result<RunContext> {
+    // `--harness` parses as a plain string so runtime-loaded descriptors can
+    // name harnesses clap never saw; resolution against the registry happens
+    // here, after parsing.
+    let harness = args.harness.as_deref().map(Harness::resolve).transpose()?;
     Ok(detect_run_context(DetectInput {
         skill_dir: args.skill_dir.clone(),
         skill: args.skill.clone(),
         bootstrap,
         workspace_dir: args.workspace_dir.clone(),
-        harness: args.harness,
-        run_mode: args.run_mode,
+        harness,
         cwd: None,
     })?)
 }
@@ -118,17 +131,16 @@ pub(crate) fn parse_id_list(v: Option<&str>) -> Option<Vec<String>> {
 /// Always names `--skill-dir`, `--skill`, and `--workspace-dir` (all three are
 /// always populated in [`RunContext`] and always re-resolve), so the printed
 /// "Next:" commands are copy-pasteable from any cwd — not just the one `run`
-/// happened to start in. The absolute `--workspace-dir` is what lets the isolated
-/// session run `ingest`/`finalize`/`switch-condition` from `cwd = iteration-N/env/`:
-/// without it, `workspace_root` would default to `<cwd>/.eval-magic`
-/// (`detect_run_context`) and the iteration tree above the env would not resolve.
+/// happened to start in. The absolute `--workspace-dir` is what lets the human
+/// run `ingest`/`finalize` from a per-`(group, condition)` env dir: without it,
+/// `workspace_root` would default to `<cwd>/.eval-magic` (`detect_run_context`)
+/// and the iteration tree above the env would not resolve.
 pub(crate) fn command_target_args(ctx: &RunContext) -> String {
     format!(
-        " --skill-dir {} --skill {} --workspace-dir {} --run-mode {}",
+        " --skill-dir {} --skill {} --workspace-dir {}",
         ctx.skill_dir.display(),
         ctx.skill_name,
         ctx.workspace_root.display(),
-        ctx.run_mode.as_str()
     )
 }
 
@@ -178,13 +190,12 @@ pub(crate) fn iteration_dir(ctx: &RunContext, iteration: Option<u32>) -> anyhow:
     Ok(dir)
 }
 
-/// The env directories a run staged under `iteration_dir`: the single `env/` for
-/// the InSession mechanism, or one `env-<group>-<condition>/` per `(group, condition)`
-/// for Cli. A best-effort directory scan (returns empty when the dir can't be read),
-/// used by `teardown`/`finalize` to walk every env's write guard. Preferred over
-/// reading `dispatch.json` because it has no parse-failure mode, needs no path
-/// re-basing (recorded env dirs can be relative), and the only `env`/`env-*` children
-/// of an iteration dir are the staged envs.
+/// The env directories a run staged under `iteration_dir`: one
+/// `env-<group>-<condition>/` per `(group, condition)`. A best-effort directory
+/// scan (returns empty when the dir can't be read), used by `teardown`/`finalize`
+/// to walk every env's write guard. Preferred over reading `dispatch.json` because
+/// it has no parse-failure mode, needs no path re-basing (recorded env dirs can be
+/// relative), and the only `env-*` children of an iteration dir are the staged envs.
 pub(crate) fn staged_env_roots(iteration_dir: &Path) -> Vec<PathBuf> {
     let Ok(entries) = std::fs::read_dir(iteration_dir) else {
         return Vec::new();
@@ -201,57 +212,6 @@ pub(crate) fn staged_env_roots(iteration_dir: &Path) -> Vec<PathBuf> {
         .collect()
 }
 
-/// Resolve the subagents transcript dir for an in-session stage that reads
-/// transcripts. The subagents dir is the `InSession` transcript source, so this
-/// is keyed on the dispatch *mechanism*, not the harness: `Cli`-mechanism runs
-/// (Codex; Claude Code hybrid/headless) read each task's `outputs/<events>.jsonl`
-/// and resolve to `None` — they must never bail on a missing
-/// `CLAUDE_CODE_SESSION_ID`. For the `InSession` mechanism (Claude Code
-/// interactive), precedence is: an explicit `--subagents-dir` (validated to
-/// exist) wins; otherwise resolve from a session id — the `--session-id` flag if
-/// given, else the `CLAUDE_CODE_SESSION_ID` env var Claude Code sets in the
-/// orchestrating agent's shell — locating
-/// `<config>/projects/<cwd-slug>/<session-id>/subagents/` (scanning `projects/*`
-/// if the cwd slug differs).
-pub(crate) fn resolve_subagents_dir(
-    mechanism: DispatchMechanism,
-    subagents_dir: Option<&str>,
-    session_id: Option<&str>,
-) -> anyhow::Result<Option<PathBuf>> {
-    if mechanism != DispatchMechanism::InSession {
-        return Ok(None);
-    }
-    if let Some(dir) = subagents_dir {
-        let path = PathBuf::from(dir);
-        if !path.exists() {
-            bail!("subagents-dir not found: {}", path.display());
-        }
-        return Ok(Some(path));
-    }
-    let session = session_id
-        .map(str::to_string)
-        .or_else(|| std::env::var("CLAUDE_CODE_SESSION_ID").ok())
-        .filter(|s| !s.trim().is_empty());
-    let Some(session) = session else {
-        bail!(
-            "could not auto-resolve the subagents dir: CLAUDE_CODE_SESSION_ID is not set. \
-             Re-run inside the Claude Code session that dispatched the subagents, or pass \
-             --session-id <id> or --subagents-dir <path>."
-        );
-    };
-    let config_dir = config_dir_from_env();
-    let cwd = std::env::current_dir()?;
-    match resolve_subagents_dir_for_session(&config_dir, &cwd, &session) {
-        Some(path) => Ok(Some(path)),
-        None => bail!(
-            "no subagents dir found for session {session} under {}/projects/. The session may \
-             not have dispatched any subagents (or lives under a different CLAUDE_CONFIG_DIR). \
-             Pass --subagents-dir <path> to override.",
-            config_dir.display()
-        ),
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -312,11 +272,10 @@ mod tests {
         assert_eq!(resolved.skill_subdir, ctx.skill_subdir);
     }
 
-    /// The isolated session runs `ingest`/`finalize`/`switch-condition` from
-    /// `cwd = iteration-N/env/`. Without an explicit workspace root those commands
-    /// default `workspace_root` to `<cwd>/.eval-magic` and bail "not found",
-    /// so the selector must carry an absolute `--workspace-dir` pointing at the
-    /// real workspace above the env.
+    /// The human runs `ingest`/`finalize` from a per-`(group, condition)` env dir.
+    /// Without an explicit workspace root those commands default `workspace_root`
+    /// to `<cwd>/.eval-magic` and bail "not found", so the selector must carry an
+    /// absolute `--workspace-dir` pointing at the real workspace above the env.
     #[test]
     fn target_args_carry_absolute_workspace_dir() {
         let tmp = TempDir::new().unwrap();
@@ -359,55 +318,4 @@ mod tests {
         .unwrap();
         assert_eq!(resolved.workspace_root, ctx.workspace_root);
     }
-
-    #[test]
-    fn resolve_subagents_dir_is_none_for_cli_mechanism() {
-        // The subagents dir is the InSession transcript source. Cli-mechanism
-        // runs (Codex; Claude Code hybrid/headless) read each task's events file,
-        // so resolution is a no-op — and must NOT bail on a missing
-        // CLAUDE_CODE_SESSION_ID. This is the regression: the old harness-keyed
-        // gate forced session resolution for Claude Code and aborted under
-        // hybrid/headless. The Cli arm returns before reading any env var, so this
-        // is deterministic regardless of the test runner's environment.
-        assert_eq!(
-            resolve_subagents_dir(DispatchMechanism::Cli, None, None).unwrap(),
-            None
-        );
-        // A passed --subagents-dir is ignored in Cli mode (the events file is the
-        // source), so it resolves to None without touching the filesystem.
-        assert_eq!(
-            resolve_subagents_dir(DispatchMechanism::Cli, Some("/whatever"), None).unwrap(),
-            None
-        );
-    }
-
-    #[test]
-    fn resolve_subagents_dir_uses_existing_explicit_dir() {
-        // InSession (Claude Code interactive): an explicit, existing
-        // --subagents-dir wins over any session-id resolution.
-        let tmp = TempDir::new().unwrap();
-        let resolved = resolve_subagents_dir(
-            DispatchMechanism::InSession,
-            Some(&tmp.path().display().to_string()),
-            None,
-        )
-        .unwrap();
-        assert_eq!(resolved, Some(tmp.path().to_path_buf()));
-    }
-
-    #[test]
-    fn resolve_subagents_dir_errors_when_explicit_dir_missing() {
-        // InSession with an explicit --subagents-dir that doesn't exist is a hard
-        // error (not a silent fallback to session-id resolution).
-        let err = resolve_subagents_dir(
-            DispatchMechanism::InSession,
-            Some("/no/such/subagents/dir/xyz"),
-            None,
-        )
-        .unwrap_err();
-        assert!(
-            err.to_string().contains("subagents-dir not found"),
-            "got: {err}"
-        );
-    }
 }
diff --git a/src/cli/run/dispatch.rs b/src/cli/run/dispatch.rs
index e610166..08e9185 100644
--- a/src/cli/run/dispatch.rs
+++ b/src/cli/run/dispatch.rs
@@ -14,7 +14,7 @@ use regex::Regex;
 use serde::{Deserialize, Serialize};
 
 use crate::adapters::{CliManifestContext, adapter_for};
-use crate::core::{AvailableSkill, DispatchMechanism, Eval, Harness};
+use crate::core::{AvailableSkill, Eval, Harness};
 
 use super::RunError;
 
@@ -43,9 +43,8 @@ pub struct DispatchTask {
     /// byte-identical.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub group: Option<String>,
-    /// The agent-under-test's cwd for this task (its env dir). Absent in the
-    /// single-group case, where the Cli recipe's `<eval-root>` placeholder still
-    /// resolves to `env/`; present (per `(group, condition)`) for multi-group Cli.
+    /// The agent-under-test's cwd for this task — its per-`(group, condition)` env
+    /// dir, which the CLI dispatch recipe's `<eval-root>` placeholder resolves to.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub eval_root: Option<String>,
     #[serde(default, skip_serializing)]
@@ -53,7 +52,7 @@ pub struct DispatchTask {
 }
 
 /// Inputs to [`build_dispatch_task`]. `harness` defaults to Claude Code.
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, Default)]
 pub struct DispatchTaskOpts<'a> {
     pub eval_id: &'a str,
     pub condition: &'a str,
@@ -86,31 +85,6 @@ pub struct DispatchTaskOpts<'a> {
     pub eval_root: Option<&'a str>,
 }
 
-impl Default for DispatchTaskOpts<'_> {
-    fn default() -> Self {
-        Self {
-            eval_id: "",
-            condition: "",
-            skill_path: None,
-            staged_skill_slug: None,
-            staged_skill_path: None,
-            user_prompt: "",
-            fixtures: Vec::new(),
-            outputs_dir: "",
-            cond_dir: "",
-            bootstrap_content: None,
-            plan_mode_content: None,
-            skill_name: "",
-            available_skills: Vec::new(),
-            harness: Harness::ClaudeCode,
-            run_tag: None,
-            run_index: None,
-            group: None,
-            eval_root: None,
-        }
-    }
-}
-
 fn render_available_skills_block_for_harness(
     harness: Harness,
     skills: &[AvailableSkill],
@@ -381,7 +355,6 @@ pub use crate::core::Mode;
 #[derive(Debug, Clone, Copy)]
 pub struct ManifestContext<'a> {
     pub harness: Harness,
-    pub mechanism: DispatchMechanism,
     pub guard: bool,
     pub agent_model: Option<&'a str>,
 }
@@ -413,25 +386,19 @@ pub fn build_manifest(
         String::new(),
         "## How to use this manifest".to_string(),
         String::new(),
-        "In an agent session, read `dispatch.json` (sibling of this file) instead of this manifest. Each task has a `dispatch_prompt_path` field pointing at the file that holds the full prompt — dispatch the subagent with a short \"read this file and follow it\" instruction rather than inlining the prompt — plus exact paths for `run.json` and `timing.json`.".to_string(),
-        String::new(),
-        "**Transcript correlation:** Each task has an `agent_description` field of the form `<eval_id>:<condition>[:r<k>]:i<N>-<nonce>` (the `r<k>` segment appears only in multi-run cells, naming the 1-based run index). When dispatching the subagent via the host's primitive (e.g. Claude Code's Agent tool), pass this string verbatim as the dispatch `description` — do not reconstruct it. The per-run nonce keeps descriptions unique across iterations sharing one session's subagents dir, so the transcript adapter correlates each subagent's persisted transcript back to the right `(eval, condition, run)` slot without collisions.".to_string(),
+        "In an agent session, read `dispatch.json` (sibling of this file) instead of this manifest. Each task has a `dispatch_prompt_path` field pointing at the file that holds the full prompt — dispatch the task with a short \"read this file and follow it\" instruction rather than inlining the prompt — plus exact paths for `run.json` and `timing.json`.".to_string(),
         String::new(),
     ];
-    // Only a Cli-dispatch run emits a CLI recipe section; an in-session run
-    // (e.g. interactive Claude Code) gets the generic ingest guidance below.
-    if context.mechanism == DispatchMechanism::Cli
-        && let Some(lines) = adapter_for(context.harness).cli_manifest_section(CliManifestContext {
-            guard: context.guard,
-            agent_model: context.agent_model,
-        })
-    {
+    if let Some(lines) = adapter_for(context.harness).cli_manifest_section(CliManifestContext {
+        guard: context.guard,
+        agent_model: context.agent_model,
+    }) {
         header.extend(lines);
     }
     header.extend([
-        "After all dispatches (Claude Code only):".to_string(),
+        "After all dispatches:".to_string(),
         String::new(),
-        "1. Run `eval-magic ingest` (it auto-resolves the subagents dir from CLAUDE_CODE_SESSION_ID; outside the dispatching session, pass `--session-id <id>` or `--subagents-dir <path>`) — a fixed-order chain of record-runs (assembles every task's `run.json` from `dispatch.json` + the subagent's own `outputs/final-message.md` + the persisted transcript, and backfills `timing.json` with transcript-derived tokens/duration; never clobbers an existing record), fill-transcripts, detect-stray-writes, and grade. Optional higher-fidelity timing: write `{ \"total_tokens\": <n>, \"duration_ms\": <n>, \"source\": \"completion-event\" }` from the task completion event to `timing.json` right after a dispatch — completion-event numbers always win over the backfill.".to_string(),
+        "1. Run `eval-magic ingest --harness <harness>` — a fixed-order chain of record-runs (assembles every task's `run.json` from `dispatch.json` + the task's own `outputs/final-message.md` + the events file the harness CLI wrote under `outputs/`, and backfills `timing.json` with transcript-derived tokens/duration; never clobbers an existing record), fill-transcripts, detect-stray-writes, and grade. Optional higher-fidelity timing: write `{ \"total_tokens\": <n>, \"duration_ms\": <n>, \"source\": \"completion-event\" }` from the task completion event to `timing.json` right after a dispatch — completion-event numbers always win over the backfill.".to_string(),
         "2. Dispatch the judge tasks ingest lists, then run `eval-magic finalize` for the benchmark.".to_string(),
         String::new(),
         "On a harness without persisted transcripts, instead write each task's `run.json` (matching `skills/evaluating-skills/schema/run-record.schema.json`, enforced at runtime by grade/fill-transcripts/detect-stray-writes) and `timing.json` by hand when its subagent returns: carry over `eval_id`, `condition`, `skill_path` (`null` on the without_skill arm), `prompt`, and `files` from the task; populate `final_message` from the subagent's reply; leave `tool_invocations` as `[]`; capture `total_tokens`/`duration_ms` from the task completion event immediately — they may not be persisted anywhere else.".to_string(),
@@ -778,7 +745,7 @@ mod tests {
     fn codex_flavored_fallback_wording() {
         let staged = "/repo/.agents/skills/slow-powers-eval-1-with_skill__foo/SKILL.md";
         let task = build_dispatch_task(&DispatchTaskOpts {
-            harness: Harness::Codex,
+            harness: Harness::resolve("codex").unwrap(),
             staged_skill_path: Some(staged),
             ..base_opts()
         })
@@ -801,7 +768,7 @@ mod tests {
     fn opencode_flavored_fallback_wording() {
         let staged = "/repo/.opencode/skills/slow-powers-eval-1-with-skill-foo/SKILL.md";
         let task = build_dispatch_task(&DispatchTaskOpts {
-            harness: Harness::OpenCode,
+            harness: Harness::resolve("opencode").unwrap(),
             staged_skill_path: Some(staged),
             ..base_opts()
         })
@@ -823,7 +790,7 @@ mod tests {
     #[test]
     fn opencode_available_skills_block_uses_xml() {
         let task = build_dispatch_task(&DispatchTaskOpts {
-            harness: Harness::OpenCode,
+            harness: Harness::resolve("opencode").unwrap(),
             available_skills: vec![skill("foo", "the foo skill")],
             ..base_opts()
         })
diff --git a/src/cli/run/golden_tests.rs b/src/cli/run/golden_tests.rs
new file mode 100644
index 0000000..8913d7a
--- /dev/null
+++ b/src/cli/run/golden_tests.rs
@@ -0,0 +1,231 @@
+//! Golden-fixture tests pinning the generated harness artifacts byte-for-byte.
+//!
+//! Every fixture under `tests/golden/<harness>/` is rendered from a fixed,
+//! deterministic context (no tempdirs, no clocks) so the comparison is exact,
+//! guarding the generated artifacts byte-for-byte against descriptor and
+//! renderer edits.
+//!
+//! To regenerate after an intentional output change:
+//! `GOLDEN_BLESS=1 cargo test golden_` — then review the fixture diff.
+
+use std::fs;
+use std::path::{Path, PathBuf};
+
+use crate::adapters::{CliDispatchContext, CliJudgeContext, adapter_for};
+use crate::core::{AvailableSkill, Harness, Mode};
+
+use super::dispatch::{DispatchTaskOpts, ManifestContext, build_dispatch_task, build_manifest};
+use super::runbook::{RunbookContext, build_runbook};
+
+fn golden_path(rel: &str) -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR"))
+        .join("tests/golden")
+        .join(rel)
+}
+
+fn assert_golden(rel: &str, actual: &str) {
+    let path = golden_path(rel);
+    if std::env::var_os("GOLDEN_BLESS").is_some_and(|v| v == "1") {
+        fs::create_dir_all(path.parent().unwrap()).unwrap();
+        fs::write(&path, actual).unwrap();
+    }
+    let expected = fs::read_to_string(&path).unwrap_or_else(|_| {
+        panic!(
+            "golden fixture {} is missing — run `GOLDEN_BLESS=1 cargo test golden_` and commit the fixtures",
+            path.display()
+        )
+    });
+    assert_eq!(
+        actual, expected,
+        "output diverged from tests/golden/{rel}; if the change is intentional, \
+         re-bless with `GOLDEN_BLESS=1 cargo test golden_` and review the fixture diff"
+    );
+}
+
+fn fixed_skills() -> Vec<AvailableSkill> {
+    vec![
+        AvailableSkill {
+            name: "widget-skill".to_string(),
+            path: "/work/staged/widget-skill/SKILL.md".to_string(),
+            description: "Builds widgets the house way.".to_string(),
+        },
+        AvailableSkill {
+            name: "aux-helper".to_string(),
+            path: "/work/staged/aux-helper/SKILL.md".to_string(),
+            description: "Assists with auxiliary chores.".to_string(),
+        },
+    ]
+}
+
+fn staged_task(harness: Harness) -> DispatchTaskOpts<'static> {
+    DispatchTaskOpts {
+        eval_id: "demo-eval",
+        condition: "with_skill",
+        staged_skill_path: Some("/work/staged/widget-skill/SKILL.md"),
+        user_prompt: "Build me a widget.",
+        fixtures: vec!["/work/fixtures/input.txt".to_string()],
+        outputs_dir: "/work/outputs",
+        cond_dir: "/work/cond",
+        bootstrap_content: Some("Session guidelines: be concise."),
+        plan_mode_content: Some("PLAN STEP"),
+        skill_name: "widget-skill",
+        available_skills: fixed_skills(),
+        harness,
+        ..Default::default()
+    }
+}
+
+fn bare_task(harness: Harness) -> DispatchTaskOpts<'static> {
+    DispatchTaskOpts {
+        eval_id: "demo-eval",
+        condition: "without_skill",
+        user_prompt: "Build me a widget.",
+        fixtures: vec!["/work/fixtures/input.txt".to_string()],
+        outputs_dir: "/work/outputs-b",
+        cond_dir: "/work/cond-b",
+        skill_name: "widget-skill",
+        harness,
+        ..Default::default()
+    }
+}
+
+fn render_manifest(harness: Harness, guard: bool, agent_model: Option<&str>) -> String {
+    let slug =
+        adapter_for(harness).staged_slug("slow-powers-eval-", 2, "with_skill", "widget-skill");
+    let mut staged = staged_task(harness);
+    staged.staged_skill_slug = Some(&slug);
+    let tasks = vec![
+        build_dispatch_task(&staged).unwrap(),
+        build_dispatch_task(&bare_task(harness)).unwrap(),
+    ];
+    build_manifest(
+        "widget-skill",
+        Mode::Revision,
+        Some("iteration-1"),
+        2,
+        "2026-01-01T00:00:00Z",
+        &tasks,
+        ManifestContext {
+            harness,
+            guard,
+            agent_model,
+        },
+    )
+}
+
+#[test]
+fn golden_runbook_per_harness() {
+    for harness in Harness::known() {
+        let label = adapter_for(harness).label();
+        let dir = PathBuf::from("/work/.eval-magic/widget-skill/iteration-2");
+        let book = build_runbook(&RunbookContext {
+            harness,
+            skill_name: "widget-skill",
+            iteration: 2,
+            iteration_dir: &dir,
+            mode: Mode::Revision,
+            cond_a: "old_skill",
+            cond_b: "new_skill",
+            num_tasks: 6,
+            target_args: " --skill-dir /tmp/skills --skill widget-skill",
+            guard: true,
+            agent_model: Some("model-x"),
+        });
+        assert_golden(&format!("{label}/runbook.golden.md"), &book);
+    }
+}
+
+#[test]
+fn golden_manifest_per_harness() {
+    for harness in Harness::known() {
+        let label = adapter_for(harness).label();
+        let manifest = render_manifest(harness, true, Some("model-x"));
+        assert_golden(&format!("{label}/manifest.golden.md"), &manifest);
+    }
+}
+
+#[test]
+fn golden_manifest_codex_without_guard() {
+    // Pins the hook-trust conditional: no --dangerously-bypass-hook-trust.
+    let manifest = render_manifest(Harness::resolve("codex").unwrap(), false, Some("model-x"));
+    assert_golden("codex/manifest-noguard.golden.md", &manifest);
+}
+
+#[test]
+fn golden_manifest_claude_without_model() {
+    // Pins the empty model-arg rendering.
+    let manifest = render_manifest(Harness::resolve("claude-code").unwrap(), true, None);
+    assert_golden("claude-code/manifest-nomodel.golden.md", &manifest);
+}
+
+#[test]
+fn golden_dispatch_prompt_per_harness() {
+    for harness in Harness::known() {
+        let label = adapter_for(harness).label();
+        let slug =
+            adapter_for(harness).staged_slug("slow-powers-eval-", 2, "with_skill", "widget-skill");
+        let mut opts = staged_task(harness);
+        opts.staged_skill_slug = Some(&slug);
+        let task = build_dispatch_task(&opts).unwrap();
+        assert_golden(
+            &format!("{label}/dispatch-prompt.golden.txt"),
+            &task.dispatch_prompt,
+        );
+    }
+}
+
+#[test]
+fn golden_skills_block_per_harness() {
+    for harness in Harness::known() {
+        let label = adapter_for(harness).label();
+        let block = adapter_for(harness).render_available_skills_block(&fixed_skills());
+        assert_golden(&format!("{label}/skills-block.golden.txt"), &block);
+    }
+}
+
+#[test]
+fn golden_judge_recipe_claude_and_codex() {
+    for (harness, guard, rel) in [
+        (
+            Harness::resolve("claude-code").unwrap(),
+            true,
+            "claude-code/judge-recipe.golden.md",
+        ),
+        (
+            Harness::resolve("codex").unwrap(),
+            true,
+            "codex/judge-recipe.golden.md",
+        ),
+        // Pins the hook-trust conditional in the judge command line.
+        (
+            Harness::resolve("codex").unwrap(),
+            false,
+            "codex/judge-recipe-noguard.golden.md",
+        ),
+    ] {
+        let recipe = adapter_for(harness)
+            .cli_judge_next_steps(CliJudgeContext {
+                guard,
+                iteration_dir: Path::new("/work/iter-1"),
+            })
+            .expect("judge recipe is wired for this harness");
+        assert_golden(rel, &recipe);
+    }
+}
+
+#[test]
+fn golden_opencode_next_steps_with_and_without_model() {
+    for (agent_model, rel) in [
+        (Some("model-x"), "opencode/next-steps-model.golden.txt"),
+        (None, "opencode/next-steps-nomodel.golden.txt"),
+    ] {
+        let steps =
+            adapter_for(Harness::resolve("opencode").unwrap()).cli_next_steps(CliDispatchContext {
+                guard: false,
+                target_args: " --skill-dir /tmp/skills --skill widget-skill",
+                iteration: 2,
+                agent_model,
+            });
+        assert_golden(rel, &steps);
+    }
+}
diff --git a/src/cli/run/grouping.rs b/src/cli/run/grouping.rs
index 105778a..6582a2e 100644
--- a/src/cli/run/grouping.rs
+++ b/src/cli/run/grouping.rs
@@ -5,9 +5,8 @@
 //! different content at the same path were a hard error. Grouping turns that into
 //! a decision: evals whose fixtures conflict (same env-relative dest from a
 //! *different* source) are routed into separate groups, and an eval may opt into
-//! its own singleton group via [`Isolation::Isolated`]. The realization differs by
-//! dispatch mechanism (one env + reset barrier for in-session; one env per
-//! `(group, condition)` for CLI), but the grouping decision here is shared.
+//! its own singleton group via [`Isolation::Isolated`]. Each group is realized as
+//! one env per `(group, condition)`, but the grouping decision here is shared.
 //!
 //! The conflict rule is identical to the per-env fixture-claim rule in
 //! [`super::fixtures`]: same dest + same source is an idempotent share (evals may
diff --git a/src/cli/run/mod.rs b/src/cli/run/mod.rs
index 0121503..9604aef 100644
--- a/src/cli/run/mod.rs
+++ b/src/cli/run/mod.rs
@@ -1,4 +1,4 @@
-//! The `run` orchestrator and its run-mode variants.
+//! The `run` orchestrator.
 //!
 //! Split into focused sub-orchestrators:
 //!
@@ -17,6 +17,8 @@ use serde::Serialize;
 
 pub mod dispatch;
 pub mod fixtures;
+#[cfg(test)]
+mod golden_tests;
 pub mod grouping;
 pub mod orchestrate;
 pub mod runbook;
diff --git a/src/cli/run/orchestrate/build.rs b/src/cli/run/orchestrate/build.rs
index 37d1251..e97f07a 100644
--- a/src/cli/run/orchestrate/build.rs
+++ b/src/cli/run/orchestrate/build.rs
@@ -1,7 +1,7 @@
 //! Phases 3 & 4 — build every `(eval, condition)` dispatch task and write
 //! `conditions.json` / `dispatch-manifest.md` / per-task prompts / `dispatch.json`
-//! ([`write_dispatch`]), then arm the opt-in write guard and run the plugin-shadow
-//! preflight ([`post_build`]).
+//! ([`write_dispatch`]), then arm the write guard (auto-armed; `--no-guard`
+//! opts out) and run the harness's shadow preflight ([`post_build`]).
 
 use std::collections::HashMap;
 use std::fs;
@@ -9,12 +9,8 @@ use std::path::Path;
 
 use serde_json::{Value, json};
 
-use crate::adapters::{
-    adapter_for, config_dir_from_env, detect_plugin_shadows, format_shadow_banner,
-};
-use crate::core::{
-    AvailableSkill, ConditionEntry, ConditionsRecord, DispatchMechanism, Harness, RunContext,
-};
+use crate::adapters::{adapter_for, format_shadow_banner};
+use crate::core::{AvailableSkill, ConditionEntry, ConditionsRecord, RunContext};
 use crate::pipeline::io::now_iso8601;
 
 use super::super::dispatch::{
@@ -55,7 +51,6 @@ pub(super) fn write_dispatch(
         ],
         timestamp: now_iso8601(),
         harness: Some(ctx.harness),
-        run_mode: Some(ctx.run_mode),
         run_nonce: Some(r.run_nonce.clone()),
         runs: Some(opts.runs),
         agent_model: opts.agent_model.map(str::to_owned),
@@ -125,16 +120,13 @@ pub(super) fn write_dispatch(
         fixtures_by_eval.insert(ev.id.as_str(), dests);
     }
 
-    let mechanism = ctx.run_mode.mechanism();
-    // A single group keeps the pre-grouping task shape (no `group`/`eval_root`
-    // keys); >1 group, or any Cli run (per-(group, condition) envs), tags tasks.
+    // A single group keeps the `group` key off each task (>1 group tags them);
+    // `eval_root` (the per-task cwd) is always set, one env per (group, condition).
     let multi_group = r.groups.len() > 1;
 
     let mut tasks = Vec::new();
-    // Build tasks CONDITION-outer, GROUP-inner — so the in-session runbook reads
-    // tasks[] top to bottom as: dispatch each (condition, group) segment, with a
-    // `reset-batch` between groups and one `switch-condition` between conditions.
-    // A single group collapses this to the legacy condition-outer order.
+    // Build tasks CONDITION-outer, GROUP-inner. A single group collapses this to
+    // the legacy condition-outer order.
     for (cond_name, cond_skill_path, cond_slug) in [
         (
             r.cond_a,
@@ -148,7 +140,7 @@ pub(super) fn write_dispatch(
         ),
     ] {
         for group in &r.groups {
-            let env_root = task_env_root(&r.iteration_dir, mechanism, &group.id, cond_name);
+            let env_root = task_env_root(&r.iteration_dir, &group.id, cond_name);
             let env_root_str = env_root.to_string_lossy().into_owned();
             let staged_path = staged_skill_path_for(&env_root, cond_slug);
             let available_skills = available_skills_for(&env_root, cond_skill_path, cond_slug);
@@ -213,13 +205,9 @@ pub(super) fn write_dispatch(
                         run_index,
                         // Tag the group only when there's more than one (keeps the
                         // single-group task byte-identical). `eval_root` is the
-                        // per-task cwd the Cli recipe `cd`s into; the in-session
-                        // path shares one env, so it stays `None`.
+                        // per-task cwd the CLI recipe `cd`s into.
                         group: multi_group.then_some(group.id.as_str()),
-                        eval_root: match mechanism {
-                            DispatchMechanism::Cli => Some(env_root_str.as_str()),
-                            DispatchMechanism::InSession => None,
-                        },
+                        eval_root: Some(env_root_str.as_str()),
                     })?);
                 }
             }
@@ -238,8 +226,7 @@ pub(super) fn write_dispatch(
             &tasks,
             ManifestContext {
                 harness: ctx.harness,
-                mechanism: ctx.run_mode.mechanism(),
-                guard: opts.guard,
+                guard: opts.guard_armed(),
                 agent_model: opts.agent_model,
             },
         ),
@@ -265,53 +252,45 @@ pub(super) fn write_dispatch(
         "label": conditions.label,
         "conditions": conditions.conditions,
         "harness": ctx.harness,
-        "run_mode": ctx.run_mode,
         "tasks": tasks,
     });
     // The isolation-batch plan the executing session/human follows: which evals
-    // share an env, why, and (per condition) the env each batch runs in. Omitted in
-    // the trivial single-group in-session case so its dispatch.json stays
-    // byte-identical; emitted whenever the layout is non-trivial (>1 group, or any
-    // Cli run with per-(group, condition) envs).
-    if multi_group || mechanism == DispatchMechanism::Cli {
-        let groups: Vec<Value> = r
-            .groups
-            .iter()
-            .map(|g| {
-                let envs: Vec<Value> = [r.cond_a, r.cond_b]
-                    .iter()
-                    .map(|cond| {
-                        json!({
-                            "condition": cond,
-                            "dir": task_env_root(&r.iteration_dir, mechanism, &g.id, cond)
-                                .to_string_lossy(),
-                        })
+    // share an env, why, and (per condition) the env each batch runs in. There is
+    // one env per (group, condition).
+    let groups: Vec<Value> = r
+        .groups
+        .iter()
+        .map(|g| {
+            let envs: Vec<Value> = [r.cond_a, r.cond_b]
+                .iter()
+                .map(|cond| {
+                    json!({
+                        "condition": cond,
+                        "dir": task_env_root(&r.iteration_dir, &g.id, cond).to_string_lossy(),
                     })
-                    .collect();
-                json!({
-                    "id": g.id,
-                    "evals": g.eval_ids,
-                    "rationale": g.rationale,
-                    "envs": envs,
                 })
+                .collect();
+            json!({
+                "id": g.id,
+                "evals": g.eval_ids,
+                "rationale": g.rationale,
+                "envs": envs,
             })
-            .collect();
-        dispatch_json
-            .as_object_mut()
-            .expect("dispatch_json is a JSON object")
-            .insert("groups".to_string(), Value::Array(groups));
-    }
+        })
+        .collect();
+    dispatch_json
+        .as_object_mut()
+        .expect("dispatch_json is a JSON object")
+        .insert("groups".to_string(), Value::Array(groups));
     write_json(&dispatch_json_path, &dispatch_json)?;
 
-    // The followable handoff artifact: a fresh isolated session (interactive) or
-    // a human (headless) reads RUNBOOK.md to run the loop. It references eval-magic
-    // meta (dispatch.json, benchmark.json) under `iteration_dir`, so `RunbookContext`
-    // keeps `iteration_dir`, not the env. Generated, not version controlled.
+    // The followable handoff artifact: a human reads RUNBOOK.md to run the loop.
+    // It references eval-magic meta (dispatch.json, benchmark.json) under
+    // `iteration_dir`, so `RunbookContext` keeps `iteration_dir`, not the env, and
+    // the human drives from there. Generated, not version controlled.
     let target_args = command_target_args(ctx);
-    let group_ids: Vec<String> = r.groups.iter().map(|g| g.id.clone()).collect();
     let runbook = build_runbook(&RunbookContext {
         harness: ctx.harness,
-        run_mode: ctx.run_mode,
         skill_name: &ctx.skill_name,
         iteration: r.iteration,
         iteration_dir: &r.iteration_dir,
@@ -319,36 +298,28 @@ pub(super) fn write_dispatch(
         cond_a: r.cond_a,
         cond_b: r.cond_b,
         num_tasks: tasks.len(),
-        groups: &group_ids,
         target_args: &target_args,
-        guard: opts.guard,
+        guard: opts.guard_armed(),
         agent_model: opts.agent_model,
     });
-    // In-session: written into the single `env/` (the isolated session's cwd, =
-    // `ctx.stage_root`). Cli: there is no single env (one per (group, condition)),
-    // and the human drives from the iteration dir, so it lands there.
-    let runbook_path = match mechanism {
-        DispatchMechanism::InSession => ctx.stage_root.join("RUNBOOK.md"),
-        DispatchMechanism::Cli => r.iteration_dir.join("RUNBOOK.md"),
-    };
-    fs::write(runbook_path, runbook)?;
+    fs::write(r.iteration_dir.join("RUNBOOK.md"), runbook)?;
 
     Ok(tasks.len())
 }
 
-/// Post-build side effects: arm the opt-in write guard and run the Claude Code
-/// plugin-shadow preflight.
+/// Post-build side effects: arm the write guard (auto-armed when the harness
+/// declares one; `--no-guard` opts out) and run the harness's shadow
+/// preflight.
 pub(super) fn post_build(
     ctx: &RunContext,
     opts: &RunOptions,
     r: &Resolved,
 ) -> Result<(), RunError> {
-    // Every env this run staged: one shared `env/` for in-session, one per
-    // (group, condition) for Cli. Computed once and reused below to arm the guard in
-    // each env and to point the plugin-shadow preflight at a real staged env.
+    // Every env this run staged: one per (group, condition). Computed once and
+    // reused below to arm the guard in each env and to point the plugin-shadow
+    // preflight at a real staged env.
     let targets = env_targets(&EnvLayoutInput {
         iteration_dir: &r.iteration_dir,
-        mechanism: ctx.run_mode.mechanism(),
         groups: &r.groups,
         cond_a: r.cond_a,
         cond_b: r.cond_b,
@@ -356,21 +327,19 @@ pub(super) fn post_build(
         skill_path_b: r.skill_path_b.as_deref(),
     });
 
-    // Opt-in hard guard: a PreToolUse hook blocking subagent writes/installs
-    // outside the eval sandbox while dispatches run. Armed in *every* env the run
-    // staged — since each subprocess loads its hook from its own cwd.
-    if opts.guard && !opts.dry_run {
-        if opts.no_stage {
-            eprintln!("\n⚠ --guard requires staging enabled; skipping guard install.");
-        } else {
-            let adapter = adapter_for(ctx.harness);
-            let exe = std::env::current_exe()?;
-            for target in &targets {
-                adapter.install_guard(&target.root, &exe, None)?;
-            }
-            if let Some(msg) = adapter.guard_armed_message() {
-                println!("{msg}");
-            }
+    // Hard guard: a PreToolUse hook blocking subagent writes/installs outside
+    // the eval sandbox while dispatches run. Armed in *every* env the run
+    // staged — since each subprocess loads its hook from its own cwd. The
+    // preflight resolved the guard state (no-stage and guardless-harness runs
+    // arrive with it off), so only --dry-run gates the install here.
+    if opts.guard_armed() && !opts.dry_run {
+        let adapter = adapter_for(ctx.harness);
+        let exe = std::env::current_exe()?;
+        for target in &targets {
+            adapter.install_guard(&target.root, &exe, None)?;
+        }
+        if let Some(msg) = adapter.guard_armed_message() {
+            println!("{msg}");
         }
     }
 
@@ -382,24 +351,19 @@ pub(super) fn post_build(
         eprintln!("{notice}");
     }
 
-    // Plugin-shadow preflight (Claude Code): a staged skill name also discoverable
-    // from an enabled plugin or the global skills dir contaminates the run. Scan the
-    // first staged env, not `ctx.stage_root` — under Cli the legacy single `env/` is
-    // never created, so the project-local `.claude/settings.json` enabledPlugins the
-    // scan reads must come from a real staged env. In-session's first target *is*
-    // `env/` (== `ctx.stage_root`), so this is unchanged there.
-    if ctx.harness == Harness::ClaudeCode {
-        let mut names: Vec<&str> = vec![ctx.skill_name.as_str()];
-        names.extend(ctx.sibling_skill_names.iter().map(String::as_str));
-        let scan_root = targets
-            .first()
-            .map(|t| t.root.as_path())
-            .unwrap_or(ctx.stage_root.as_path());
-        let report = detect_plugin_shadows(&config_dir_from_env(), scan_root, &names);
-        if !report.shadowed.is_empty() {
-            write_json(&r.iteration_dir.join("plugin-shadow.json"), &report)?;
-            eprintln!("{}", format_shadow_banner(&report));
-        }
+    // Shadow preflight: a staged skill name also discoverable from the operator's
+    // live environment contaminates the run. Scan the first staged env, not
+    // `ctx.stage_root` — only the per-`(group, condition)` envs are created, so
+    // the project-local settings the scan reads must come from a real staged env.
+    let mut names: Vec<&str> = vec![ctx.skill_name.as_str()];
+    names.extend(ctx.sibling_skill_names.iter().map(String::as_str));
+    let scan_root = targets
+        .first()
+        .map(|t| t.root.as_path())
+        .unwrap_or(ctx.stage_root.as_path());
+    if let Some(report) = adapter_for(ctx.harness).detect_shadowed_skills(scan_root, &names) {
+        write_json(&r.iteration_dir.join("plugin-shadow.json"), &report)?;
+        eprintln!("{}", format_shadow_banner(&report));
     }
     Ok(())
 }
diff --git a/src/cli/run/orchestrate/envs.rs b/src/cli/run/orchestrate/envs.rs
index c6f469f..424c65b 100644
--- a/src/cli/run/orchestrate/envs.rs
+++ b/src/cli/run/orchestrate/envs.rs
@@ -1,26 +1,20 @@
 //! Env-layout planning: turn the computed isolation [`Group`]s into the concrete
-//! environment directories a run stages into, which differs by dispatch mechanism.
+//! environment directories a run stages into.
 //!
-//! - **InSession** keeps a single `iteration-N/env/` that hosts *both* conditions
-//!   (the off-condition skill is removed by `switch-condition`) and the first
-//!   group's fixtures (later groups are swapped in by `reset-batch`). One env, one
-//!   session — byte-identical to the pre-grouping layout in the single-group case.
-//! - **Cli** materializes one `iteration-N/env-<group>-<condition>/` per
-//!   `(group, condition)`: each subprocess `cd`s into its own env, which holds only
-//!   that condition's skill (or none) and that group's fixtures — real physical
-//!   isolation along both axes.
+//! A run materializes one `iteration-N/env-<group>-<condition>/` per
+//! `(group, condition)`: each subprocess `cd`s into its own env, which holds only
+//! that condition's skill (or none) and that group's fixtures — real physical
+//! isolation along both axes.
 
 use std::path::{Path, PathBuf};
 
-use crate::core::DispatchMechanism;
-
 use super::super::grouping::Group;
 
 /// One environment directory to stage for a run.
 pub(super) struct EnvTarget {
     pub root: PathBuf,
-    /// `(condition name, that condition's skill path)` staged into this env.
-    /// InSession stages both conditions here; Cli stages exactly one.
+    /// `(condition name, that condition's skill path)` staged into this env —
+    /// exactly one per env.
     pub conditions: Vec<(&'static str, Option<String>)>,
     /// Eval ids whose fixtures populate this env (its group's evals).
     pub eval_ids: Vec<String>,
@@ -29,7 +23,6 @@ pub(super) struct EnvTarget {
 /// Inputs to [`env_targets`].
 pub(super) struct EnvLayoutInput<'a> {
     pub iteration_dir: &'a Path,
-    pub mechanism: DispatchMechanism,
     pub groups: &'a [Group],
     pub cond_a: &'static str,
     pub cond_b: &'static str,
@@ -37,61 +30,31 @@ pub(super) struct EnvLayoutInput<'a> {
     pub skill_path_b: Option<&'a str>,
 }
 
-/// The env dir a `(group, condition)` task runs in: the shared `env/` for
-/// InSession, or the per-`(group, condition)` env for Cli.
-pub(super) fn task_env_root(
-    iteration_dir: &Path,
-    mechanism: DispatchMechanism,
-    group_id: &str,
-    condition: &str,
-) -> PathBuf {
-    match mechanism {
-        DispatchMechanism::InSession => iteration_dir.join("env"),
-        DispatchMechanism::Cli => iteration_dir.join(format!("env-{group_id}-{condition}")),
-    }
+/// The env dir a `(group, condition)` task runs in.
+pub(super) fn task_env_root(iteration_dir: &Path, group_id: &str, condition: &str) -> PathBuf {
+    iteration_dir.join(format!("env-{group_id}-{condition}"))
 }
 
-/// Plan the environments to stage. InSession returns a single env hosting both
-/// conditions and the *first* group's fixtures; Cli returns one env per
-/// `(group, condition)`.
+/// Plan the environments to stage: one env per `(group, condition)`.
 pub(super) fn env_targets(input: &EnvLayoutInput) -> Vec<EnvTarget> {
     let conds: [(&'static str, Option<String>); 2] = [
         (input.cond_a, input.skill_path_a.map(str::to_owned)),
         (input.cond_b, input.skill_path_b.map(str::to_owned)),
     ];
-    match input.mechanism {
-        DispatchMechanism::InSession => {
-            // One env, staged for the first group; reset-batch swaps later groups in.
-            let first = input
-                .groups
-                .first()
-                .expect("at least one group is always computed");
-            vec![EnvTarget {
-                root: task_env_root(
-                    input.iteration_dir,
-                    input.mechanism,
-                    &first.id,
-                    input.cond_a,
-                ),
-                conditions: conds.to_vec(),
-                eval_ids: first.eval_ids.clone(),
-            }]
-        }
-        DispatchMechanism::Cli => input
-            .groups
-            .iter()
-            .flat_map(|g| {
-                conds
-                    .clone()
-                    .into_iter()
-                    .map(move |(cond, skill)| EnvTarget {
-                        root: task_env_root(input.iteration_dir, input.mechanism, &g.id, cond),
-                        conditions: vec![(cond, skill)],
-                        eval_ids: g.eval_ids.clone(),
-                    })
-            })
-            .collect(),
-    }
+    input
+        .groups
+        .iter()
+        .flat_map(|g| {
+            conds
+                .clone()
+                .into_iter()
+                .map(move |(cond, skill)| EnvTarget {
+                    root: task_env_root(input.iteration_dir, &g.id, cond),
+                    conditions: vec![(cond, skill)],
+                    eval_ids: g.eval_ids.clone(),
+                })
+        })
+        .collect()
 }
 
 #[cfg(test)]
@@ -114,39 +77,11 @@ mod tests {
     }
 
     #[test]
-    fn insession_single_env_hosts_both_conditions_and_first_group() {
-        let iter = Path::new("/w/iteration-1");
-        let gs = groups();
-        let targets = env_targets(&EnvLayoutInput {
-            iteration_dir: iter,
-            mechanism: DispatchMechanism::InSession,
-            groups: &gs,
-            cond_a: "with_skill",
-            cond_b: "without_skill",
-            skill_path_a: Some("/s/SKILL.md"),
-            skill_path_b: None,
-        });
-        assert_eq!(targets.len(), 1);
-        assert_eq!(targets[0].root, Path::new("/w/iteration-1/env"));
-        assert_eq!(
-            targets[0]
-                .conditions
-                .iter()
-                .map(|(c, _)| *c)
-                .collect::<Vec<_>>(),
-            vec!["with_skill", "without_skill"]
-        );
-        // Only the first group's fixtures populate the env up front.
-        assert_eq!(targets[0].eval_ids, vec!["e1"]);
-    }
-
-    #[test]
-    fn cli_one_env_per_group_condition_with_only_that_conditions_skill() {
+    fn one_env_per_group_condition_with_only_that_conditions_skill() {
         let iter = Path::new("/w/iteration-1");
         let gs = groups();
         let targets = env_targets(&EnvLayoutInput {
             iteration_dir: iter,
-            mechanism: DispatchMechanism::Cli,
             groups: &gs,
             cond_a: "with_skill",
             cond_b: "without_skill",
@@ -181,14 +116,10 @@ mod tests {
     }
 
     #[test]
-    fn task_env_root_is_bare_env_for_insession_and_suffixed_for_cli() {
+    fn task_env_root_is_suffixed_by_group_and_condition() {
         let iter = Path::new("/w/iteration-1");
         assert_eq!(
-            task_env_root(iter, DispatchMechanism::InSession, "g2", "without_skill"),
-            Path::new("/w/iteration-1/env")
-        );
-        assert_eq!(
-            task_env_root(iter, DispatchMechanism::Cli, "g2", "without_skill"),
+            task_env_root(iter, "g2", "without_skill"),
             Path::new("/w/iteration-1/env-g2-without_skill")
         );
     }
diff --git a/src/cli/run/orchestrate/mod.rs b/src/cli/run/orchestrate/mod.rs
index 6130f14..1ce8249 100644
--- a/src/cli/run/orchestrate/mod.rs
+++ b/src/cli/run/orchestrate/mod.rs
@@ -15,10 +15,10 @@ use std::path::PathBuf;
 
 use crate::adapters::{CliDispatchContext, adapter_for};
 use crate::cli::command_target_args;
-use crate::core::{DispatchMechanism, Eval, Mode, RunContext};
+use crate::core::{Eval, Mode, RunContext};
 
 use super::RunError;
-use super::util::{insession_isolated_handoff, mode_str};
+use super::util::mode_str;
 
 mod build;
 mod envs;
@@ -36,7 +36,10 @@ pub struct RunOptions<'a> {
     pub iteration: Option<u32>,
     pub dry_run: bool,
     pub no_stage: bool,
-    pub guard: bool,
+    /// Tri-state write guard: `None` = auto (the preflight resolves it to
+    /// `Some` — armed when the harness declares a guard and staging is
+    /// active), `Some` = explicit `--guard` / `--no-guard`.
+    pub guard: Option<bool>,
     pub stage_name: Option<&'a str>,
     pub plan_mode: bool,
     /// Runs per condition cell; per-eval `runs` overrides take precedence.
@@ -48,6 +51,14 @@ pub struct RunOptions<'a> {
     pub label: Option<&'a str>,
 }
 
+impl RunOptions<'_> {
+    /// Whether the preflight-resolved guard is armed. (`None` only occurs
+    /// before the preflight runs; it reads as unarmed.)
+    pub(crate) fn guard_armed(&self) -> bool {
+        self.guard == Some(true)
+    }
+}
+
 /// Everything [`resolve::resolve_request`] works out before any filesystem
 /// mutation: the comparison mode, the selected evals, the iteration coordinates,
 /// and each condition's name + skill path.
@@ -85,8 +96,24 @@ struct Staged {
 
 /// Build the iteration workspace and dispatch plan for a run.
 pub fn command_run(ctx: &RunContext, opts: &RunOptions) -> Result<(), RunError> {
+    // Resolve first (read-only): the preflight scopes its transcript warning
+    // to the eval config actually selected for the run.
     let resolved = resolve::resolve_request(ctx, opts)?;
 
+    // The harness preflight provides supported enhancements automatically (the
+    // write guard auto-arms), warns about undeclared ones (naming each
+    // fallback), and adjusts the options — it only rejects genuinely
+    // contradictory flag combinations.
+    let preflight = super::util::harness_run_preflight(
+        opts,
+        ctx,
+        super::util::evals_use_transcript_check(&resolved.selected_evals),
+    )?;
+    for warning in &preflight.warnings {
+        eprintln!("⚠ {warning}");
+    }
+    let opts = &preflight.opts;
+
     // Redirect staging into the isolated env dir. `resolve_request` has now
     // computed `iteration_dir`; `env/` becomes the agent-under-test's cwd and the
     // staging root, so the existing root-parameterized staging path follows it
@@ -140,6 +167,11 @@ fn print_run_plan(ctx: &RunContext, opts: &RunOptions, r: &Resolved) {
             "  staging: disabled (--no-stage) — skills will be inlined into dispatch_prompt for harnesses without project-local skill discovery"
         );
     }
+    if opts.guard_armed() {
+        println!(
+            "  guard: armed — the write guard blocks out-of-env writes during dispatch (--no-guard to opt out)"
+        );
+    }
 }
 
 /// Print the workspace paths, dispatch count, and the harness-specific next-step
@@ -156,16 +188,10 @@ fn print_next_steps(ctx: &RunContext, opts: &RunOptions, r: &Resolved, num_tasks
         r.iteration_dir.join("dispatch.json").display()
     );
 
-    match ctx.run_mode.mechanism() {
-        DispatchMechanism::InSession => println!(
-            "Runbook:            {} — start a fresh session in env/ and \"Read and follow RUNBOOK.md\".",
-            ctx.stage_root.join("RUNBOOK.md").display()
-        ),
-        DispatchMechanism::Cli => println!(
-            "Runbook:            {} — a human-followed copy of the steps below.",
-            r.iteration_dir.join("RUNBOOK.md").display()
-        ),
-    }
+    println!(
+        "Runbook:            {} — a human-followed copy of the steps below.",
+        r.iteration_dir.join("RUNBOOK.md").display()
+    );
     let run_counts: Vec<u32> = r
         .selected_evals
         .iter()
@@ -197,23 +223,14 @@ fn print_next_steps(ctx: &RunContext, opts: &RunOptions, r: &Resolved, num_tasks
         return;
     }
     let target_args = command_target_args(ctx);
-    match ctx.run_mode.mechanism() {
-        // In-session subagent dispatch (Claude Code's Task tool today). The env is
-        // built before the isolated session starts, so the summary just hands off:
-        // cd into env/, start a fresh session, "Read and follow RUNBOOK.md" — which
-        // carries the full dispatch → switch-condition → ingest → finalize loop.
-        DispatchMechanism::InSession => {
-            println!("\nNext: {}", insession_isolated_handoff(&ctx.stage_root))
-        }
-        // One-shot CLI dispatch; the exact command is harness-specific.
-        DispatchMechanism::Cli => println!(
-            "{}",
-            adapter_for(ctx.harness).cli_next_steps(CliDispatchContext {
-                guard: opts.guard,
-                target_args: &target_args,
-                iteration,
-                agent_model: opts.agent_model,
-            })
-        ),
-    }
+    // One-shot CLI dispatch; the exact command is harness-specific.
+    println!(
+        "{}",
+        adapter_for(ctx.harness).cli_next_steps(CliDispatchContext {
+            guard: opts.guard_armed(),
+            target_args: &target_args,
+            iteration,
+            agent_model: opts.agent_model,
+        })
+    );
 }
diff --git a/src/cli/run/orchestrate/resolve.rs b/src/cli/run/orchestrate/resolve.rs
index 48fd403..abee50d 100644
--- a/src/cli/run/orchestrate/resolve.rs
+++ b/src/cli/run/orchestrate/resolve.rs
@@ -13,9 +13,7 @@ use super::super::RunError;
 use super::super::dispatch::select_evals;
 use super::super::fixtures::fixture_pairs;
 use super::super::grouping::{GroupInput, compute_groups};
-use super::super::util::{
-    condition_names_for, make_run_nonce, next_iteration, validate_harness_run_options,
-};
+use super::super::util::{condition_names_for, make_run_nonce, next_iteration};
 use super::{Resolved, RunOptions};
 
 pub(super) fn resolve_request(ctx: &RunContext, opts: &RunOptions) -> Result<Resolved, RunError> {
@@ -30,7 +28,6 @@ pub(super) fn resolve_request(ctx: &RunContext, opts: &RunOptions) -> Result<Res
     if opts.runs == 0 {
         return Err(RunError::msg("--runs must be at least 1"));
     }
-    validate_harness_run_options(opts, ctx)?;
 
     let skill_md_path = ctx.skill_subdir.join("SKILL.md");
     if !skill_md_path.exists() {
diff --git a/src/cli/run/orchestrate/stage.rs b/src/cli/run/orchestrate/stage.rs
index 99dfd4e..d6848e7 100644
--- a/src/cli/run/orchestrate/stage.rs
+++ b/src/cli/run/orchestrate/stage.rs
@@ -32,9 +32,9 @@ pub(super) fn stage_conditions(
     };
 
     let plan_mode_content = if opts.plan_mode {
-        let profile = resolve_plan_mode_profile(ctx.harness)?;
+        let profile = resolve_plan_mode_profile();
         println!(
-            "  plan-mode: injecting {} plan-mode profile as operating context (issue #142; necessary-not-sufficient fidelity layer)",
+            "  plan-mode: injecting the shared plan-mode profile as operating context for {} (issue #142; necessary-not-sufficient fidelity layer)",
             harness_label(ctx.harness)
         );
         Some(profile.to_string())
@@ -70,12 +70,10 @@ pub(super) fn stage_conditions(
         ));
     }
 
-    // The environments to stage: one shared `env/` for in-session (hosting both
-    // conditions + the first group's fixtures), or one per (group, condition) for
-    // Cli (each with only its condition's skill + its group's fixtures).
+    // The environments to stage: one per (group, condition), each with only its
+    // condition's skill + its group's fixtures.
     let targets = env_targets(&EnvLayoutInput {
         iteration_dir: &r.iteration_dir,
-        mechanism: ctx.run_mode.mechanism(),
         groups: &r.groups,
         cond_a: r.cond_a,
         cond_b: r.cond_b,
@@ -89,7 +87,7 @@ pub(super) fn stage_conditions(
     for target in &targets {
         // Disarm a prior run's guard before re-staging, so a crashed run can't leave
         // the write-blocking hook armed across runs. Created unconditionally — even
-        // under --no-stage, fixtures (and the in-session RUNBOOK) still land here.
+        // under --no-stage, each env's fixtures still land here.
         teardown_guard(&target.root);
         fs::create_dir_all(&target.root)?;
 
diff --git a/src/cli/run/runbook.rs b/src/cli/run/runbook.rs
index ac0b921..be5beb5 100644
--- a/src/cli/run/runbook.rs
+++ b/src/cli/run/runbook.rs
@@ -2,31 +2,20 @@
 //! iteration directory during `run`.
 //!
 //! The runbook turns the prep session's "what to do next" guidance into a file
-//! a *fresh, isolated* session (or a human at a terminal) can read end-to-end:
-//! "Read and follow RUNBOOK.md". Which template is used is keyed on the run mode's
-//! [`DispatchMechanism`](crate::core::DispatchMechanism), not the harness:
+//! a human at a terminal can read end-to-end: "Read and follow RUNBOOK.md". Every
+//! run uses the shared [`RUNBOOK_TEMPLATE`], whose harness-specific dispatch +
+//! judge recipes come from the adapter's CLI generators.
 //!
-//! - `InSession` (interactive) → the harness's interactive, agent-followed template.
-//! - `Cli` (hybrid / headless) → the shared headless, human-followed template —
-//!   including Claude Code under `--run-mode hybrid`.
-//!
-//! The per-mode prose skeletons live in `profiles/` (checked in, loaded via
-//! [`HarnessAdapter::runbook_template`](crate::adapters::HarnessAdapter::runbook_template))
-//! and carry `{{TOKEN}}` placeholders the renderer fills with run-specific values.
-//! The generated `RUNBOOK.md` itself is a workspace artifact and is not version
-//! controlled.
+//! The prose skeleton lives in `profiles/` (checked in) and carries `{{TOKEN}}`
+//! placeholders the renderer fills with run-specific values. The generated
+//! `RUNBOOK.md` itself is a workspace artifact and is not version controlled.
 
 use std::path::Path;
 
-use crate::adapters::{
-    CliDispatchContext, CliJudgeContext, HEADLESS_RUNBOOK_TEMPLATE, adapter_for,
-};
-use crate::core::{DispatchMechanism, Harness, Mode, RunMode};
+use crate::adapters::{CliDispatchContext, CliJudgeContext, RUNBOOK_TEMPLATE, adapter_for};
+use crate::core::{Harness, Mode};
 
-use super::util::{
-    harness_label, insession_dispatch_batch, insession_dispatch_segment, insession_ingest_command,
-    insession_reset_batch_command, insession_switch_command, mode_str,
-};
+use super::util::{harness_label, mode_str};
 
 /// Run-specific values the renderer substitutes into a runbook template. Built by
 /// the orchestrator from the resolved run; kept as primitives so the renderer is
@@ -34,7 +23,6 @@ use super::util::{
 /// unit-testable on its own.
 pub(crate) struct RunbookContext<'a> {
     pub harness: Harness,
-    pub run_mode: RunMode,
     pub skill_name: &'a str,
     pub iteration: u32,
     pub iteration_dir: &'a Path,
@@ -42,9 +30,6 @@ pub(crate) struct RunbookContext<'a> {
     pub cond_a: &'a str,
     pub cond_b: &'a str,
     pub num_tasks: usize,
-    /// Isolation-group ids in order. One entry → the byte-identical single-batch
-    /// dispatch; more → per-group batches with `reset-batch` barriers (in-session).
-    pub groups: &'a [String],
     /// The self-sufficient `--skill-dir … --skill …` selector (leading space),
     /// from [`command_target_args`](crate::cli::command_target_args).
     pub target_args: &'a str,
@@ -52,50 +37,14 @@ pub(crate) struct RunbookContext<'a> {
     pub agent_model: Option<&'a str>,
 }
 
-/// The per-condition dispatch block for the interactive runbook. A single group
-/// renders the legacy single-batch instruction (byte-identical to the pre-grouping
-/// runbook). Multiple groups render each group's batch with a `reset-batch` barrier
-/// between them; `first_condition` suppresses the reset before the very first group
-/// (condition A starts from the env already staged with group 1, while condition B
-/// must restore group 1 after A's last group mutated the env).
-fn insession_dispatch_block(
-    condition: &str,
-    groups: &[String],
-    target_args: &str,
-    iteration: u32,
-    first_condition: bool,
-) -> String {
-    if groups.len() <= 1 {
-        return insession_dispatch_batch(condition);
-    }
-    let mut parts: Vec<String> = Vec::new();
-    for (i, group) in groups.iter().enumerate() {
-        if !(first_condition && i == 0) {
-            parts.push(format!(
-                "Reset the env to group `{group}` (wait for the previous batch to finish first):\n\n```\n{}\n```",
-                insession_reset_batch_command(target_args, iteration, group)
-            ));
-        }
-        parts.push(format!(
-            "Dispatch group `{group}`: {}",
-            insession_dispatch_segment(condition, group)
-        ));
-    }
-    parts.join("\n\n")
-}
-
-/// Render `RUNBOOK.md` for a run: pick the harness's template (interactive vs.
-/// headless) and fill its `{{TOKEN}}` placeholders with run-specific values.
+/// Render `RUNBOOK.md` for a run: fill the shared runbook template's
+/// `{{TOKEN}}` placeholders with run-specific values. The harness-specific
+/// dispatch + judge recipes come from the adapter's CLI generators, so the
+/// runbook stays in lockstep with `dispatch-manifest.md` and the printed next
+/// steps; pipeline commands carry `--harness`.
 pub(crate) fn build_runbook(ctx: &RunbookContext) -> String {
     let adapter = adapter_for(ctx.harness);
-    // The runbook template is mechanism-keyed, not harness-keyed: an in-session
-    // run uses the harness's interactive (agent-followed) template; every Cli run
-    // uses the shared headless (human-followed) one — including Claude Code in
-    // hybrid, whose `runbook_template()` is the interactive variant.
-    let template = match ctx.run_mode.mechanism() {
-        DispatchMechanism::InSession => adapter.runbook_template(),
-        DispatchMechanism::Cli => HEADLESS_RUNBOOK_TEMPLATE,
-    };
+    let template = RUNBOOK_TEMPLATE;
 
     let iteration = ctx.iteration.to_string();
     let num_tasks = ctx.num_tasks.to_string();
@@ -122,77 +71,37 @@ pub(crate) fn build_runbook(ctx: &RunbookContext) -> String {
         ("BENCHMARK_PATH", &benchmark_path),
     ];
 
-    // Mechanism-specific tokens. Owners outlive the `render` call below.
-    let (dispatch_cond_a, dispatch_cond_b, switch_cmd, ingest_cmd);
-    let (dispatch_recipe, judge_recipe, finalize_cmd, teardown_cmd);
-    match ctx.run_mode.mechanism() {
-        // Interactive: an agent dispatches in-session subagents one condition batch
-        // at a time, runs `switch-condition` between them, then runs the rest of the
-        // loop itself. Built from the same fragments as the post-`run` "Next:"
-        // message so the two can never drift on the dispatch / switch / ingest text.
-        DispatchMechanism::InSession => {
-            dispatch_cond_a = insession_dispatch_block(
-                ctx.cond_a,
-                ctx.groups,
-                ctx.target_args,
-                ctx.iteration,
-                true,
-            );
-            dispatch_cond_b = insession_dispatch_block(
-                ctx.cond_b,
-                ctx.groups,
-                ctx.target_args,
-                ctx.iteration,
-                false,
-            );
-            switch_cmd = insession_switch_command(ctx.target_args, ctx.iteration, ctx.cond_b);
-            ingest_cmd = insession_ingest_command(ctx.target_args, ctx.iteration);
-            finalize_cmd = format!(
-                "eval-magic finalize{} --iteration {}",
-                ctx.target_args, ctx.iteration
-            );
-            teardown_cmd = format!("eval-magic teardown{}", ctx.target_args);
-            vars.push(("DISPATCH_COND_A", &dispatch_cond_a));
-            vars.push(("DISPATCH_COND_B", &dispatch_cond_b));
-            vars.push(("SWITCH_CMD", &switch_cmd));
-            vars.push(("INGEST_CMD", &ingest_cmd));
-            vars.push(("FINALIZE_CMD", &finalize_cmd));
-            vars.push(("TEARDOWN_CMD", &teardown_cmd));
-        }
-        // Headless: a human pastes commands. The harness-specific dispatch +
-        // judge recipes come from the adapter's existing CLI generators, so the
-        // runbook stays in lockstep with `dispatch-manifest.md` and the printed
-        // next steps; pipeline commands carry `--harness`.
-        DispatchMechanism::Cli => {
-            let label = harness_label(ctx.harness);
-            dispatch_recipe = adapter.cli_next_steps(CliDispatchContext {
-                guard: ctx.guard,
-                target_args: ctx.target_args,
-                iteration: ctx.iteration,
-                agent_model: ctx.agent_model,
-            });
-            judge_recipe = adapter
-                .cli_judge_next_steps(CliJudgeContext {
-                    guard: ctx.guard,
-                    iteration_dir: ctx.iteration_dir,
-                })
-                .unwrap_or_else(|| {
-                    "Dispatch each judge task `ingest` listed through the same harness CLI, \
-                     capturing its transcript output, then finalize."
-                        .to_string()
-                });
-            finalize_cmd = format!(
-                "eval-magic finalize{} --iteration {} --harness {label}",
-                ctx.target_args, ctx.iteration
-            );
-            teardown_cmd = format!("eval-magic teardown{} --harness {label}", ctx.target_args);
-            vars.push(("HARNESS", label));
-            vars.push(("DISPATCH_RECIPE", &dispatch_recipe));
-            vars.push(("JUDGE_RECIPE", &judge_recipe));
-            vars.push(("FINALIZE_CMD", &finalize_cmd));
-            vars.push(("TEARDOWN_CMD", &teardown_cmd));
-        }
-    }
+    // A human pastes commands. The harness-specific dispatch + judge recipes come
+    // from the adapter's CLI generators, so the runbook stays in lockstep with
+    // `dispatch-manifest.md` and the printed next steps; pipeline commands carry
+    // `--harness`. Owners outlive the `render` call below.
+    let label = harness_label(ctx.harness);
+    let dispatch_recipe = adapter.cli_next_steps(CliDispatchContext {
+        guard: ctx.guard,
+        target_args: ctx.target_args,
+        iteration: ctx.iteration,
+        agent_model: ctx.agent_model,
+    });
+    let judge_recipe = adapter
+        .cli_judge_next_steps(CliJudgeContext {
+            guard: ctx.guard,
+            iteration_dir: ctx.iteration_dir,
+        })
+        .unwrap_or_else(|| {
+            "Dispatch each judge task `ingest` listed through the same harness CLI, \
+             capturing its transcript output, then finalize."
+                .to_string()
+        });
+    let finalize_cmd = format!(
+        "eval-magic finalize{} --iteration {} --harness {label}",
+        ctx.target_args, ctx.iteration
+    );
+    let teardown_cmd = format!("eval-magic teardown{} --harness {label}", ctx.target_args);
+    vars.push(("HARNESS", &label));
+    vars.push(("DISPATCH_RECIPE", &dispatch_recipe));
+    vars.push(("JUDGE_RECIPE", &judge_recipe));
+    vars.push(("FINALIZE_CMD", &finalize_cmd));
+    vars.push(("TEARDOWN_CMD", &teardown_cmd));
 
     render(template, &vars)
 }
@@ -238,137 +147,11 @@ mod tests {
     use super::*;
     use std::path::PathBuf;
 
-    fn claude_ctx(dir: &Path) -> RunbookContext<'_> {
-        RunbookContext {
-            harness: Harness::ClaudeCode,
-            run_mode: RunMode::Interactive,
-            skill_name: "widget-skill",
-            iteration: 5,
-            iteration_dir: dir,
-            mode: Mode::NewSkill,
-            cond_a: "with_skill",
-            cond_b: "without_skill",
-            num_tasks: 4,
-            groups: &[],
-            target_args: " --skill-dir /tmp/skills --skill widget-skill",
-            guard: true,
-            agent_model: None,
-        }
-    }
-
-    #[test]
-    fn interactive_runbook_carries_run_specifics_and_full_loop() {
-        let dir = PathBuf::from("/work/.eval-magic/widget-skill/iteration-5");
-        let book = build_runbook(&claude_ctx(&dir));
-
-        // Run-specific identity.
-        assert!(book.contains("widget-skill"), "names the skill: {book}");
-        assert!(book.contains("iteration 5"), "names the iteration: {book}");
-        assert!(
-            book.contains("with_skill") && book.contains("without_skill"),
-            "names both conditions: {book}"
-        );
-        assert!(book.contains("new-skill"), "names the mode: {book}");
-
-        // The dispatch step reuses the in-session guidance (agent_description is
-        // the transcript-linking key).
-        assert!(
-            book.contains("agent_description"),
-            "carries the dispatch-loop guidance: {book}"
-        );
-
-        // The per-condition batch loop: each condition dispatched as its own batch,
-        // with a `switch-condition` barrier (naming the kept condition) between them.
-        assert!(
-            book.contains("`condition` is `with_skill`")
-                && book.contains("`condition` is `without_skill`"),
-            "dispatches each condition as its own batch: {book}"
-        );
-        assert!(
-            book.contains(
-                "eval-magic switch-condition --skill-dir /tmp/skills --skill widget-skill --iteration 5 --condition without_skill"
-            ),
-            "carries the switch-condition barrier command: {book}"
-        );
-
-        // The full single-session loop: ingest → finalize → teardown, each a
-        // copy-pasteable command threaded with the target selector + iteration.
-        assert!(
-            book.contains(
-                "eval-magic ingest --skill-dir /tmp/skills --skill widget-skill --iteration 5"
-            ),
-            "carries the ingest command: {book}"
-        );
-        assert!(
-            book.contains(
-                "eval-magic finalize --skill-dir /tmp/skills --skill widget-skill --iteration 5"
-            ),
-            "carries the finalize command: {book}"
-        );
-        assert!(
-            book.contains("eval-magic teardown --skill-dir /tmp/skills --skill widget-skill"),
-            "carries the teardown command: {book}"
-        );
-        assert!(
-            book.contains("benchmark.json"),
-            "points at the result: {book}"
-        );
-
-        // No interactive run is dispatched through a harness CLI — that is the
-        // headless path.
-        assert!(
-            !book.contains("codex exec"),
-            "interactive runbook is not a CLI-dispatch recipe: {book}"
-        );
-        // Every template token must be filled.
-        assert!(
-            !book.contains("{{"),
-            "no unsubstituted tokens remain: {book}"
-        );
-    }
-
-    #[test]
-    fn interactive_runbook_with_multiple_groups_carries_reset_batch_barriers() {
-        let dir = PathBuf::from("/work/.eval-magic/widget-skill/iteration-5");
-        let groups = ["g1".to_string(), "g2".to_string()];
-        let book = build_runbook(&RunbookContext {
-            groups: &groups,
-            ..claude_ctx(&dir)
-        });
-
-        // Each group dispatches as its own segment, filtered by group.
-        assert!(
-            book.contains("`condition` is `with_skill` and `group` is `g1`")
-                && book.contains("`condition` is `with_skill` and `group` is `g2`"),
-            "with_skill dispatches each group separately: {book}"
-        );
-        assert!(
-            book.contains("`condition` is `without_skill` and `group` is `g1`")
-                && book.contains("`condition` is `without_skill` and `group` is `g2`"),
-            "without_skill dispatches each group separately: {book}"
-        );
-        // reset-batch barriers between groups, naming the group to seed.
-        assert!(
-            book.contains(
-                "eval-magic reset-batch --skill-dir /tmp/skills --skill widget-skill --iteration 5 --group g2"
-            ),
-            "carries the reset-batch barrier for g2: {book}"
-        );
-        // The switch-condition barrier is still present, once, between conditions.
-        assert!(
-            book.contains("eval-magic switch-condition")
-                && book.contains("--condition without_skill"),
-            "still carries the switch-condition barrier: {book}"
-        );
-        assert!(!book.contains("{{"), "no unsubstituted tokens: {book}");
-    }
-
     #[test]
-    fn headless_runbook_is_human_followed_cli_recipe() {
+    fn runbook_is_human_followed_cli_recipe() {
         let dir = PathBuf::from("/work/.eval-magic/widget-skill/iteration-2");
         let ctx = RunbookContext {
-            harness: Harness::Codex,
-            run_mode: RunMode::Hybrid,
+            harness: Harness::resolve("codex").unwrap(),
             skill_name: "widget-skill",
             iteration: 2,
             iteration_dir: &dir,
@@ -376,7 +159,6 @@ mod tests {
             cond_a: "old_skill",
             cond_b: "new_skill",
             num_tasks: 6,
-            groups: &[],
             target_args: " --skill-dir /tmp/skills --skill widget-skill",
             guard: false,
             agent_model: Some("gpt-5-mini"),
@@ -391,8 +173,7 @@ mod tests {
             "names both conditions: {book}"
         );
 
-        // Human-followed framing (the shared headless template), not the agent
-        // in-session framing.
+        // Human-followed framing (the shared runbook template).
         assert!(
             book.contains("human driving"),
             "frames the run for a human at a terminal: {book}"
diff --git a/src/cli/run/staging/mod.rs b/src/cli/run/staging/mod.rs
index d15ba80..59408dd 100644
--- a/src/cli/run/staging/mod.rs
+++ b/src/cli/run/staging/mod.rs
@@ -15,7 +15,7 @@ use std::time::{SystemTime, UNIX_EPOCH};
 use regex::Regex;
 use serde::{Deserialize, Serialize};
 
-use crate::adapters::adapter_for;
+use crate::adapters::{adapter_for, all_config_dir_names};
 use crate::core::Harness;
 use crate::pipeline::io::now_iso8601;
 use crate::workspace::SNAPSHOT_META;
@@ -81,7 +81,7 @@ impl Default for StageSkillOpts<'_> {
             repo_root: Path::new(""),
             assets_dir: None,
             stage_name_override: None,
-            harness: Harness::ClaudeCode,
+            harness: Harness::default(),
         }
     }
 }
@@ -101,14 +101,24 @@ impl Default for StageSiblingOpts<'_> {
             skill_under_test: "",
             skills_source_dir: Path::new(""),
             repo_root: Path::new(""),
-            harness: Harness::ClaudeCode,
+            harness: Harness::default(),
         }
     }
 }
 
 /// `<repo_root>/.agents/skills` (Codex) or `<repo_root>/.claude/skills`.
 pub(crate) fn skills_dir_for_harness(repo_root: &Path, harness: Harness) -> PathBuf {
-    adapter_for(harness).skills_dir(repo_root)
+    adapter_for(harness)
+        .skills_dir(repo_root)
+        .expect("staging requires skills_dir; the run preflight forces --no-stage otherwise")
+}
+
+/// True when `name` is any harness's project-local config dir (`.claude`,
+/// `.agents`, …). Staging excludes every harness's config dirs when copying a
+/// skill's sibling assets — regardless of the active harness — so a checked-in
+/// config dir never rides into a staged env.
+fn is_harness_config_dir(name: &str) -> bool {
+    all_config_dir_names().iter().any(|d| d == name)
 }
 
 /// Rewrite (or insert) the `name:` frontmatter field so a Codex-staged skill's
@@ -142,104 +152,25 @@ fn prune_if_empty(dir: &Path) -> Result<(), RunError> {
     Ok(())
 }
 
-/// True when `name` satisfies OpenCode's skill-name rules:
-/// - 1–64 characters
-/// - lowercase alphanumeric with single-hyphen separators
-/// - no leading/trailing/consecutive hyphens
-fn is_valid_opencode_name(name: &str) -> bool {
-    if name.is_empty() || name.len() > 64 {
-        return false;
-    }
-    let mut prev = '-';
-    for ch in name.chars() {
-        if ch == '-' {
-            if prev == '-' {
-                return false;
-            }
-        } else if !ch.is_ascii_lowercase() && !ch.is_ascii_digit() {
-            return false;
-        }
-        prev = ch;
-    }
-    !name.starts_with('-') && !name.ends_with('-')
-}
-
-/// Sanitize an arbitrary identifier so it is a valid OpenCode skill name.
-fn sanitize_opencode_name(name: &str) -> String {
-    let mut out = String::new();
-    let mut prev_hyphen = false;
-    for ch in name.to_ascii_lowercase().chars() {
-        if ch.is_ascii_lowercase() || ch.is_ascii_digit() {
-            out.push(ch);
-            prev_hyphen = false;
-        } else if !prev_hyphen {
-            out.push('-');
-            prev_hyphen = true;
-        }
-    }
-    while out.ends_with('-') {
-        out.pop();
-    }
-    while out.starts_with('-') {
-        out.remove(0);
-    }
-    if out.is_empty() {
-        out.push_str("skill");
-    }
-    if out.len() > 64 {
-        out.truncate(64);
-        while out.ends_with('-') {
-            out.pop();
-        }
-    }
-    out
-}
-
-/// Build a slug that is valid for OpenCode's skill directory + frontmatter name
-/// constraints. The prefix is preserved so cleanup prefix-scans still find it.
-fn opencode_slug(iteration: u32, condition: &str, skill_name: &str) -> String {
-    let condition = sanitize_opencode_name(condition);
-    let skill = sanitize_opencode_name(skill_name);
-    let base = format!("{STAGED_SKILL_PREFIX}{iteration}-{condition}-{skill}");
-    if base.len() <= 64 && is_valid_opencode_name(&base) {
-        return base;
-    }
-    // If the combined slug is too long, truncate the skill portion.
-    let prefix = format!("{STAGED_SKILL_PREFIX}{iteration}-{condition}-");
-    let budget = 64usize.saturating_sub(prefix.len());
-    let mut truncated = skill.clone();
-    truncated.truncate(budget);
-    while truncated.ends_with('-') {
-        truncated.pop();
-    }
-    if truncated.is_empty() {
-        truncated.push_str("skill");
-    }
-    format!("{prefix}{truncated}")
-}
-
-/// Stage one skill under the harness's skills dir and return its slug. For Codex
-/// and OpenCode the frontmatter `name:` is rewritten to the slug.
+/// Stage one skill under the harness's skills dir and return its slug. For
+/// harnesses whose adapter opts in, the frontmatter `name:` is rewritten to the
+/// slug.
 pub fn stage_skill_for_harness(opts: &StageSkillOpts) -> Result<String, RunError> {
+    let adapter = adapter_for(opts.harness);
     let slug = match opts.stage_name_override {
         Some(name) => name.to_string(),
-        None => match opts.harness {
-            Harness::OpenCode => opencode_slug(opts.iteration, opts.condition, opts.skill_name),
-            _ => format!(
-                "{STAGED_SKILL_PREFIX}{}-{}__{}",
-                opts.iteration, opts.condition, opts.skill_name
-            ),
-        },
+        None => adapter.staged_slug(
+            STAGED_SKILL_PREFIX,
+            opts.iteration,
+            opts.condition,
+            opts.skill_name,
+        ),
     };
-    if opts.harness == Harness::OpenCode && !is_valid_opencode_name(&slug) {
-        return Err(RunError::msg(format!(
-            "OpenCode skill name \"{slug}\" is invalid; names must be 1-64 lowercase alphanumeric characters separated by single hyphens"
-        )));
-    }
+    adapter.validate_stage_name(&slug).map_err(RunError::msg)?;
     let skill_dir = skills_dir_for_harness(opts.repo_root, opts.harness).join(&slug);
     fs::create_dir_all(&skill_dir)?;
 
-    let content = if adapter_for(opts.harness).rewrites_frontmatter_name() {
+    let content = if adapter.rewrites_frontmatter_name() {
         rewrite_frontmatter_name(opts.content, &slug)
     } else {
         opts.content.to_string()
@@ -252,17 +183,12 @@ pub fn stage_skill_for_harness(opts: &StageSkillOpts) -> Result<String, RunError
         for entry in fs::read_dir(assets_dir)? {
             let entry = entry?;
             let name = entry.file_name();
+            let name_str = name.to_string_lossy();
             if matches!(
-                name.to_string_lossy().as_ref(),
-                "SKILL.md"
-                    | "evals"
-                    | SNAPSHOT_META
-                    | ".eval-magic"
-                    | ".claude"
-                    | ".agents"
-                    | ".codex"
-                    | ".opencode"
-            ) {
+                name_str.as_ref(),
+                "SKILL.md" | "evals" | SNAPSHOT_META | ".eval-magic"
+            ) || is_harness_config_dir(name_str.as_ref())
+            {
                 continue;
             }
             copy_entry(&assets_dir.join(&name), &skill_dir.join(&name))?;
@@ -277,7 +203,7 @@ pub fn stage_skill_for_harness(opts: &StageSkillOpts) -> Result<String, RunError
 #[cfg(test)]
 pub fn stage_skill_for_cc(opts: &StageSkillOpts) -> Result<String, RunError> {
     stage_skill_for_harness(&StageSkillOpts {
-        harness: Harness::ClaudeCode,
+        harness: Harness::resolve("claude-code").unwrap(),
         ..opts.clone()
     })
 }
diff --git a/src/cli/run/staging/tests/cleanup.rs b/src/cli/run/staging/tests/cleanup.rs
index 1ec1c90..9b26c25 100644
--- a/src/cli/run/staging/tests/cleanup.rs
+++ b/src/cli/run/staging/tests/cleanup.rs
@@ -19,7 +19,7 @@ fn cleanup_removes_only_prefixed_dirs() {
         fs::create_dir_all(d).unwrap();
     }
 
-    cleanup_staged_skills(tmp.path(), Harness::ClaudeCode).unwrap();
+    cleanup_staged_skills(tmp.path(), Harness::resolve("claude-code").unwrap()).unwrap();
 
     assert!(!staged_a.exists());
     assert!(!staged_b.exists());
@@ -29,7 +29,7 @@ fn cleanup_removes_only_prefixed_dirs() {
 #[test]
 fn cleanup_is_noop_when_skills_dir_missing() {
     let tmp = TempDir::new().unwrap();
-    cleanup_staged_skills(tmp.path(), Harness::ClaudeCode).unwrap();
+    cleanup_staged_skills(tmp.path(), Harness::resolve("claude-code").unwrap()).unwrap();
 }
 
 // ── manifest-aware ────────────────────────────────────────────────────
@@ -46,12 +46,12 @@ fn codex_cleanup_restores_preexisting_agents_entries() {
         skill_under_test: "x",
         skills_source_dir: &src,
         repo_root: tmp.path(),
-        harness: Harness::Codex,
+        harness: Harness::resolve("codex").unwrap(),
     })
     .unwrap();
     assert_eq!(read(&skills_dir.join("alpha/SKILL.md")), "new alpha");
 
-    cleanup_staged_skills(tmp.path(), Harness::Codex).unwrap();
+    cleanup_staged_skills(tmp.path(), Harness::resolve("codex").unwrap()).unwrap();
 
     assert_eq!(read(&skills_dir.join("alpha/SKILL.md")), "USER ALPHA");
     assert!(!skills_dir.join(STAGED_SIBLING_MANIFEST).exists());
@@ -77,7 +77,7 @@ fn removes_sibling_entries_and_restores_backups() {
     assert_eq!(read(&skills_dir.join("alpha/SKILL.md")), "new alpha");
     assert_eq!(read(&skills_dir.join("beta/SKILL.md")), "new beta");
 
-    cleanup_staged_skills(tmp.path(), Harness::ClaudeCode).unwrap();
+    cleanup_staged_skills(tmp.path(), Harness::resolve("claude-code").unwrap()).unwrap();
 
     assert_eq!(read(&skills_dir.join("alpha/SKILL.md")), "USER ALPHA");
     assert!(!skills_dir.join("beta").exists());
@@ -91,7 +91,7 @@ fn sweeps_prefix_entries_when_no_manifest() {
     fs::create_dir_all(skills_dir.join("slow-powers-eval-1-with_skill__foo")).unwrap();
     fs::create_dir_all(skills_dir.join("user-custom")).unwrap();
 
-    cleanup_staged_skills(tmp.path(), Harness::ClaudeCode).unwrap();
+    cleanup_staged_skills(tmp.path(), Harness::resolve("claude-code").unwrap()).unwrap();
 
     assert!(
         !skills_dir
@@ -118,7 +118,7 @@ fn removes_whole_tree_when_runner_created_and_prunes_claude() {
     .unwrap();
     fs::create_dir_all(tmp.path().join(".claude/skills/stray-leftover")).unwrap();
 
-    cleanup_staged_skills(tmp.path(), Harness::ClaudeCode).unwrap();
+    cleanup_staged_skills(tmp.path(), Harness::resolve("claude-code").unwrap()).unwrap();
 
     assert!(!tmp.path().join(".claude/skills").exists());
     assert!(!tmp.path().join(".claude").exists());
@@ -140,7 +140,7 @@ fn keeps_claude_and_settings_when_runner_created_only_skills() {
     })
     .unwrap();
 
-    cleanup_staged_skills(tmp.path(), Harness::ClaudeCode).unwrap();
+    cleanup_staged_skills(tmp.path(), Harness::resolve("claude-code").unwrap()).unwrap();
 
     assert!(!claude_dir.join("skills").exists());
     assert!(claude_dir.exists());
@@ -163,7 +163,7 @@ fn leaves_preexisting_skills_dir_in_place() {
     })
     .unwrap();
 
-    cleanup_staged_skills(tmp.path(), Harness::ClaudeCode).unwrap();
+    cleanup_staged_skills(tmp.path(), Harness::resolve("claude-code").unwrap()).unwrap();
 
     assert!(skills_dir.exists());
     assert_eq!(read(&skills_dir.join("user-owned/SKILL.md")), "USER");
diff --git a/src/cli/run/staging/tests/stage.rs b/src/cli/run/staging/tests/stage.rs
index e24b653..a865496 100644
--- a/src/cli/run/staging/tests/stage.rs
+++ b/src/cli/run/staging/tests/stage.rs
@@ -170,7 +170,7 @@ fn codex_stages_under_agents_skills_and_rewrites_frontmatter_name() {
         condition: "with_skill",
         skill_name: "mr-review",
         repo_root: tmp.path(),
-        harness: Harness::Codex,
+        harness: Harness::resolve("codex").unwrap(),
         ..Default::default()
     })
     .unwrap();
@@ -198,7 +198,7 @@ fn codex_stage_name_override_is_dir_and_frontmatter_name() {
         condition: "with_skill",
         skill_name: "mr-review",
         repo_root: tmp.path(),
-        harness: Harness::Codex,
+        harness: Harness::resolve("codex").unwrap(),
         stage_name_override: Some("mr-review"),
         ..Default::default()
     })
@@ -210,27 +210,6 @@ fn codex_stage_name_override_is_dir_and_frontmatter_name() {
 
 // ── stage_skill_for_harness (opencode) ────────────────────────────────
 
-#[test]
-fn opencode_slug_sanitizes_underscores_and_special_characters() {
-    assert_eq!(
-        opencode_slug(1, "with_skill", "My_Skill!"),
-        "slow-powers-eval-1-with-skill-my-skill"
-    );
-    assert_eq!(
-        opencode_slug(2, "without_skill", "snake_case"),
-        "slow-powers-eval-2-without-skill-snake-case"
-    );
-}
-
-#[test]
-fn opencode_slug_truncates_to_valid_max_length() {
-    let very_long = "a".repeat(200);
-    let slug = opencode_slug(1, "with_skill", &very_long);
-    assert!(slug.len() <= 64);
-    assert!(is_valid_opencode_name(&slug));
-    assert!(slug.starts_with("slow-powers-eval-1-with-skill-"));
-}
-
 #[test]
 fn opencode_stages_under_opencode_skills_and_rewrites_frontmatter_name() {
     let tmp = TempDir::new().unwrap();
@@ -241,7 +220,7 @@ fn opencode_stages_under_opencode_skills_and_rewrites_frontmatter_name() {
         condition: "with_skill",
         skill_name: "my-skill",
         repo_root: tmp.path(),
-        harness: Harness::OpenCode,
+        harness: Harness::resolve("opencode").unwrap(),
         ..Default::default()
     })
     .unwrap();
@@ -270,7 +249,7 @@ fn opencode_rejects_invalid_stage_name_override() {
         condition: "with_skill",
         skill_name: "my-skill",
         repo_root: tmp.path(),
-        harness: Harness::OpenCode,
+        harness: Harness::resolve("opencode").unwrap(),
         stage_name_override: Some("invalid_name"),
         ..Default::default()
     })
@@ -302,7 +281,7 @@ fn register_appends_custom_dir_so_cleanup_removes_it() {
     register_staged_skill_for_cleanup(
         tmp.path(),
         "verification-before-completion",
-        Harness::ClaudeCode,
+        Harness::resolve("claude-code").unwrap(),
     )
     .unwrap();
 
@@ -314,7 +293,7 @@ fn register_appends_custom_dir_so_cleanup_removes_it() {
     names.sort();
     assert_eq!(names, vec!["sibling-a", "verification-before-completion"]);
 
-    cleanup_staged_skills(tmp.path(), Harness::ClaudeCode).unwrap();
+    cleanup_staged_skills(tmp.path(), Harness::resolve("claude-code").unwrap()).unwrap();
     assert!(!custom_dir.exists());
 }
 
@@ -332,8 +311,18 @@ fn register_is_idempotent() {
         .unwrap(),
     );
 
-    register_staged_skill_for_cleanup(tmp.path(), "foo-staged", Harness::ClaudeCode).unwrap();
-    register_staged_skill_for_cleanup(tmp.path(), "foo-staged", Harness::ClaudeCode).unwrap();
+    register_staged_skill_for_cleanup(
+        tmp.path(),
+        "foo-staged",
+        Harness::resolve("claude-code").unwrap(),
+    )
+    .unwrap();
+    register_staged_skill_for_cleanup(
+        tmp.path(),
+        "foo-staged",
+        Harness::resolve("claude-code").unwrap(),
+    )
+    .unwrap();
 
     let count = read_manifest(&skills_dir)
         .created_entries
diff --git a/src/cli/run/steps.rs b/src/cli/run/steps.rs
index 532184c..1d708bc 100644
--- a/src/cli/run/steps.rs
+++ b/src/cli/run/steps.rs
@@ -13,7 +13,7 @@
 //! parameter; the production runner — which maps each [`StepKind`] to its stage
 //! handler — lives in [`crate::cli`] alongside those handlers.
 
-use crate::core::{DispatchMechanism, Harness, RunMode};
+use crate::core::Harness;
 
 /// Which post-dispatch stage a [`StepCommand`] runs. The production runner
 /// matches on this to call the corresponding handler; tests assert on it.
@@ -37,49 +37,21 @@ pub struct StepCommand {
     pub skill: Option<String>,
     pub iteration: u32,
     pub harness: Harness,
-    /// The run mode, re-derived at each stage so the transcript source matches
-    /// the dispatch mechanism. Round-trips through `CommonArgs` exactly like
-    /// `harness`, so ingest sub-stages don't silently re-default it.
-    pub run_mode: RunMode,
-    /// Only the transcript-reading stages (record-runs, fill-transcripts) carry a
-    /// subagents dir; the others leave it `None`.
-    pub subagents_dir: Option<String>,
     pub workspace_dir: Option<String>,
 }
 
 /// Resolved inputs shared by every step of a chain.
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, Default)]
 pub struct StepParams<'a> {
     pub skill_dir: Option<&'a str>,
     pub skill: Option<&'a str>,
     pub iteration: u32,
     pub harness: Harness,
-    pub run_mode: RunMode,
-    pub subagents_dir: Option<&'a str>,
     pub workspace_dir: Option<&'a str>,
 }
 
-impl Default for StepParams<'_> {
-    fn default() -> Self {
-        Self {
-            skill_dir: None,
-            skill: None,
-            iteration: 0,
-            harness: Harness::ClaudeCode,
-            run_mode: RunMode::Interactive,
-            subagents_dir: None,
-            workspace_dir: None,
-        }
-    }
-}
-
 impl StepParams<'_> {
-    fn step(
-        &self,
-        label: &'static str,
-        kind: StepKind,
-        subagents_dir: Option<String>,
-    ) -> StepCommand {
+    fn step(&self, label: &'static str, kind: StepKind) -> StepCommand {
         StepCommand {
             label,
             kind,
@@ -87,35 +59,28 @@ impl StepParams<'_> {
             skill: self.skill.map(str::to_string),
             iteration: self.iteration,
             harness: self.harness,
-            run_mode: self.run_mode,
-            subagents_dir,
             workspace_dir: self.workspace_dir.map(str::to_string),
         }
     }
 }
 
 /// The ingest chain: record-runs → fill-transcripts → detect-stray-writes →
-/// grade. Only the first two carry the subagents dir, and only for the
-/// in-session dispatch mechanism (a Cli-dispatch harness reads its transcript
-/// from each task's `outputs/` dir instead).
+/// grade. Each stage reads its transcript from each task's `outputs/` events
+/// file.
 pub fn build_ingest_commands(p: &StepParams) -> Vec<StepCommand> {
-    let transcripts = match p.run_mode.mechanism() {
-        DispatchMechanism::InSession => p.subagents_dir.map(str::to_string),
-        DispatchMechanism::Cli => None,
-    };
     vec![
-        p.step("record-runs", StepKind::RecordRuns, transcripts.clone()),
-        p.step("fill-transcripts", StepKind::FillTranscripts, transcripts),
-        p.step("detect-stray-writes", StepKind::DetectStrayWrites, None),
-        p.step("grade", StepKind::Grade { finalize: false }, None),
+        p.step("record-runs", StepKind::RecordRuns),
+        p.step("fill-transcripts", StepKind::FillTranscripts),
+        p.step("detect-stray-writes", StepKind::DetectStrayWrites),
+        p.step("grade", StepKind::Grade { finalize: false }),
     ]
 }
 
 /// The finalize chain: grade --finalize → aggregate.
 pub fn build_finalize_commands(p: &StepParams) -> Vec<StepCommand> {
     vec![
-        p.step("grade --finalize", StepKind::Grade { finalize: true }, None),
-        p.step("aggregate", StepKind::Aggregate, None),
+        p.step("grade --finalize", StepKind::Grade { finalize: true }),
+        p.step("aggregate", StepKind::Aggregate),
     ]
 }
 
@@ -146,7 +111,6 @@ mod tests {
             skill_dir: Some("/skills"),
             skill: Some("mr-review"),
             iteration: 2,
-            subagents_dir: Some("/subagents"),
             ..Default::default()
         }
     }
@@ -178,21 +142,15 @@ mod tests {
             assert_eq!(s.skill.as_deref(), Some("mr-review"));
             assert_eq!(s.iteration, 2);
         }
-        // The transcript-reading steps get the subagents dir; the others must not.
-        assert_eq!(steps[0].subagents_dir.as_deref(), Some("/subagents"));
-        assert_eq!(steps[1].subagents_dir.as_deref(), Some("/subagents"));
-        assert_eq!(steps[2].subagents_dir, None);
-        assert_eq!(steps[3].subagents_dir, None);
     }
 
     #[test]
-    fn ingest_omits_subagents_for_codex() {
+    fn ingest_threads_harness_through_every_step() {
         let steps = build_ingest_commands(&StepParams {
             skill_dir: Some("/skills"),
             skill: Some("mr-review"),
             iteration: 2,
-            harness: Harness::Codex,
-            run_mode: RunMode::Hybrid,
+            harness: Harness::resolve("codex").unwrap(),
             ..Default::default()
         });
         assert_eq!(
@@ -204,41 +162,11 @@ mod tests {
                 "grade"
             ]
         );
-        assert!(steps.iter().all(|s| s.harness == Harness::Codex));
-        assert_eq!(steps[0].subagents_dir, None);
-        assert_eq!(steps[1].subagents_dir, None);
-    }
-
-    #[test]
-    fn ingest_omits_subagents_for_claude_hybrid() {
-        // Claude Code in hybrid mode dispatches via the CLI, so it reads each
-        // task's events file — not a subagents dir — even though the harness is
-        // ClaudeCode and a subagents dir was passed.
-        let steps = build_ingest_commands(&StepParams {
-            skill_dir: Some("/skills"),
-            skill: Some("mr-review"),
-            iteration: 2,
-            harness: Harness::ClaudeCode,
-            run_mode: RunMode::Hybrid,
-            subagents_dir: Some("/subagents"),
-            ..Default::default()
-        });
-        assert!(steps.iter().all(|s| s.harness == Harness::ClaudeCode));
-        assert!(steps.iter().all(|s| s.run_mode == RunMode::Hybrid));
-        assert_eq!(steps[0].subagents_dir, None);
-        assert_eq!(steps[1].subagents_dir, None);
-    }
-
-    #[test]
-    fn ingest_keeps_subagents_for_claude_interactive() {
-        // The default (interactive) Claude path still reads the subagents dir.
-        let steps = build_ingest_commands(&StepParams {
-            iteration: 2,
-            subagents_dir: Some("/subagents"),
-            ..Default::default()
-        });
-        assert_eq!(steps[0].subagents_dir.as_deref(), Some("/subagents"));
-        assert_eq!(steps[1].subagents_dir.as_deref(), Some("/subagents"));
+        assert!(
+            steps
+                .iter()
+                .all(|s| s.harness == Harness::resolve("codex").unwrap())
+        );
     }
 
     #[test]
@@ -264,9 +192,7 @@ mod tests {
             skill_dir: None,
             skill: None,
             iteration: 0,
-            harness: Harness::ClaudeCode,
-            run_mode: RunMode::Interactive,
-            subagents_dir: None,
+            harness: Harness::resolve("claude-code").unwrap(),
             workspace_dir: None,
         }
     }
diff --git a/src/cli/run/util.rs b/src/cli/run/util.rs
index 0a5738b..c33059d 100644
--- a/src/cli/run/util.rs
+++ b/src/cli/run/util.rs
@@ -8,7 +8,8 @@ use std::path::Path;
 use std::time::{SystemTime, UNIX_EPOCH};
 
 use crate::adapters::adapter_for;
-use crate::core::{Harness, Mode, RunContext, capabilities_for};
+use crate::adapters::registry::has_embedded_layer;
+use crate::core::{Assertion, Eval, Harness, Mode, RunContext};
 
 use super::RunError;
 use super::orchestrate::RunOptions;
@@ -56,96 +57,44 @@ pub(crate) fn unguarded_notice(no_stage: bool) -> Option<String> {
     )
 }
 
-/// The shared dispatch-instruction body, parameterized on the `tasks[]` filter so
-/// the condition-only and condition+group variants stay in lockstep.
-fn insession_dispatch_instruction(filter: &str) -> String {
-    format!(
-        "iterate the `tasks[]` entries in dispatch.json whose {filter} and \
-         dispatch each as a subagent, passing its `agent_description` verbatim as the subagent \
-         description (that string is the key that links each transcript back — without it tool \
-         calls, tokens, and duration come back empty)."
-    )
-}
-
-/// Dispatch instruction for one condition batch: iterate the matching `tasks[]`
-/// and dispatch each as a subagent with its `agent_description` verbatim. A building
-/// block of the interactive runbook's per-condition steps ([`super::runbook`]).
-pub(crate) fn insession_dispatch_batch(condition: &str) -> String {
-    insession_dispatch_instruction(&format!("`condition` is `{condition}`"))
-}
-
-/// Dispatch instruction for one `(condition, group)` segment — used when a run has
-/// more than one isolation group, so each group's batch dispatches separately with
-/// a [`insession_reset_batch_command`] barrier between groups ([`super::runbook`]).
-pub(crate) fn insession_dispatch_segment(condition: &str, group: &str) -> String {
-    insession_dispatch_instruction(&format!(
-        "`condition` is `{condition}` and `group` is `{group}`"
-    ))
-}
-
-/// The `reset-batch` barrier command between isolation-group batches: wipe the
-/// env working tree and re-seed it with `group`'s fixtures before dispatching it.
-/// A building block of the interactive runbook ([`super::runbook`]).
-pub(crate) fn insession_reset_batch_command(
-    target_args: &str,
-    iteration: u32,
-    group: &str,
-) -> String {
-    format!("eval-magic reset-batch{target_args} --iteration {iteration} --group {group}")
-}
-
-/// The `switch-condition` barrier command between batches: name the condition about
-/// to be dispatched (the one to keep). A building block of the interactive runbook
-/// ([`super::runbook`]).
-pub(crate) fn insession_switch_command(target_args: &str, iteration: u32, keep: &str) -> String {
-    format!("eval-magic switch-condition{target_args} --iteration {iteration} --condition {keep}")
-}
-
-/// The `ingest` hand-off command + its session-resolution hint. A building block of
-/// the interactive runbook ([`super::runbook`]).
-pub(crate) fn insession_ingest_command(target_args: &str, iteration: u32) -> String {
-    format!(
-        "eval-magic ingest{target_args} --iteration {iteration}\n\
-         (ingest auto-resolves the subagents dir from CLAUDE_CODE_SESSION_ID; outside that \
-         session, add --session-id <id> or --subagents-dir <path>.)"
-    )
-}
-
-/// The post-`run` handoff for the isolated in-session flow: cd into the env, start a
-/// *fresh* Claude Code session there, and have it read `RUNBOOK.md` — which carries the
-/// full dispatch → switch-condition → ingest → finalize loop. The env (incl.
-/// `env/.claude/skills/`) is built before that session starts, so the fresh session is
-/// structural, not a watcher workaround; the orchestrator no longer juggles the dispatch
-/// loop itself.
-pub(crate) fn insession_isolated_handoff(env_dir: &Path) -> String {
-    format!(
-        "start the isolated run in a fresh session:\n  \
-         1. cd {env}\n  \
-         2. start a fresh Claude Code session there (`claude`)\n  \
-         3. say: Read and follow RUNBOOK.md\n\
-         RUNBOOK.md walks the whole loop (dispatch → switch-condition → ingest → finalize) and \
-         writes benchmark.json; resume here to read it.",
-        env = env_dir.display()
-    )
+/// Resolve the shared, harness-agnostic plan-mode procedure profile injected by
+/// `--plan-mode`. A compile-time bundled asset, mirroring the schema embedding in
+/// `validation`.
+pub(crate) fn resolve_plan_mode_profile() -> &'static str {
+    include_str!("../../../profiles/shared/plan-mode.md")
 }
 
-/// Resolve the verbatim plan-mode procedure profile for a harness.
-/// The profile is a compile-time bundled asset, mirroring the schema embedding in
-/// `validation`.
-pub(crate) fn resolve_plan_mode_profile(harness: Harness) -> Result<&'static str, RunError> {
-    Ok(adapter_for(harness).plan_mode_profile())
+/// The harness preflight verdict: possibly-adjusted run options plus the
+/// warnings to print, each naming the fallback that carries the run.
+pub(crate) struct HarnessPreflight<'a> {
+    pub opts: RunOptions<'a>,
+    pub warnings: Vec<String>,
 }
 
-/// Reject run options not supported by the selected harness's current mechanism.
-pub(crate) fn validate_harness_run_options(
-    opts: &RunOptions,
+/// Check the run options against the selected harness's declared enhancements
+/// — the #126 model: each supported enhancement is provided automatically
+/// (the write guard auto-arms when the harness declares one and staging is
+/// active), a missing enhancement *warns* naming its fallback, and the run
+/// continues degraded. Only genuinely contradictory flag combinations
+/// (options the harness declares incompatible with `--no-stage`) and an
+/// explicit `--guard` on a harness defined by user-supplied descriptors alone
+/// (guards are embedded-only) stay errors.
+///
+/// Adjustments: `opts.guard` arrives tri-state (`None` = auto) and leaves
+/// resolved to `Some`; a harness without a `skills_dir` forces `--no-stage`
+/// (each SKILL.md is inlined into its dispatch prompt).
+pub(crate) fn harness_run_preflight<'a>(
+    opts: &RunOptions<'a>,
     ctx: &RunContext,
-) -> Result<(), RunError> {
-    let capabilities = capabilities_for(ctx.harness);
+    uses_transcript_check: bool,
+) -> Result<HarnessPreflight<'a>, RunError> {
+    let adapter = adapter_for(ctx.harness);
+    let capabilities = adapter.run_capabilities();
+    let label = harness_label(ctx.harness);
+
+    // Contradictory-flag declarations stay hard errors: the harness's staging
+    // mechanism conflicts with these options, so no fallback can honor them.
     let mut unsupported: Vec<&str> = Vec::new();
-    if opts.guard && !capabilities.supports_guard {
-        unsupported.push("--guard");
-    }
     if ctx.bootstrap_path.is_some()
         && opts.no_stage
         && !capabilities.supports_bootstrap_with_no_stage
@@ -156,22 +105,132 @@ pub(crate) fn validate_harness_run_options(
     {
         unsupported.push("--stage-name with --no-stage");
     }
-    if unsupported.is_empty() {
-        Ok(())
-    } else {
-        Err(RunError::msg(format!(
+    if !unsupported.is_empty() {
+        return Err(RunError::msg(format!(
             "Unsupported for --harness {}: {}.",
-            harness_label(ctx.harness),
+            label,
             unsupported.join(", ")
-        )))
+        )));
+    }
+
+    // An explicit `--guard` on a harness defined only by user-supplied
+    // descriptors is a hard error, not a downgrade: the write guard stays
+    // restricted to built-in descriptors (it fails open, so a mistyped user
+    // descriptor would silently disarm it), and a run the user asked to guard
+    // must not continue silently unguarded. Auto-arm never errors here — it
+    // quietly stays off (warning below).
+    if opts.guard == Some(true) && !capabilities.supports_guard && !has_embedded_layer(ctx.harness)
+    {
+        return Err(RunError::msg(format!(
+            "--guard: --harness {label} comes from user-supplied descriptors only, and the \
+             write guard stays restricted to built-in harnesses (it fails open, so a mistyped \
+             descriptor would silently disarm it). Rerun without --guard — out-of-bounds \
+             writes are detected after the fact by the detect-stray-writes audit (folded \
+             into `ingest`)."
+        )));
     }
+
+    let mut opts = opts.clone();
+    let mut warnings = Vec::new();
+
+    // Missing native staging forces --no-stage before the guard resolves, so
+    // the guard sees the *effective* staging state.
+    if !opts.no_stage && adapter.skills_dir(Path::new(".")).is_none() {
+        opts.no_stage = true;
+        warnings.push(format!(
+            "--harness {label} declares no skills_dir — native staging is unavailable; \
+             falling back to --no-stage (each SKILL.md is inlined into its dispatch prompt)."
+        ));
+    }
+
+    // Resolve the guard tri-state. The guard requires staging and a declared
+    // (embedded built-in) guard block; auto mode arms it whenever both hold.
+    let can_arm = capabilities.supports_guard && has_embedded_layer(ctx.harness) && !opts.no_stage;
+    match opts.guard {
+        Some(true) if !capabilities.supports_guard => {
+            opts.guard = Some(false);
+            warnings.push(format!(
+                "--guard: --harness {label} declares no write guard — continuing unguarded; \
+                 out-of-bounds writes are detected after the fact by the detect-stray-writes \
+                 audit (folded into `ingest`), never blocked."
+            ));
+        }
+        Some(true) if opts.no_stage => {
+            opts.guard = Some(false);
+            warnings.push(
+                "--guard: --no-stage disables the write guard (it requires staging) — \
+                 continuing unguarded; out-of-bounds writes are detected after the fact by \
+                 the detect-stray-writes audit (folded into `ingest`), never blocked."
+                    .to_string(),
+            );
+        }
+        Some(_) => {}
+        None => {
+            opts.guard = Some(can_arm);
+            if !capabilities.supports_guard {
+                warnings.push(format!(
+                    "--harness {label} declares no write guard — the run continues unguarded; \
+                     out-of-bounds writes are detected after the fact by the \
+                     detect-stray-writes audit (folded into `ingest`), never blocked. Pass \
+                     --no-guard to acknowledge and silence this."
+                ));
+            }
+            // A supported guard on a no-stage run stays off without a warning:
+            // the run-summary unguarded notice already covers it.
+        }
+    }
+
+    if adapter.cli_events_filename().is_none() {
+        warnings.push(if uses_transcript_check {
+            format!(
+                "--harness {label} declares no transcript parser — transcript_check assertions \
+                 will grade as unverifiable and llm_judge carries the grading; tokens/duration \
+                 go unrecorded. Recover each final message into outputs/final-message.md \
+                 (see RUNBOOK.md)."
+            )
+        } else {
+            format!(
+                "--harness {label} declares no transcript parser — tokens/duration go \
+                 unrecorded and run records are assembled from each task's \
+                 outputs/final-message.md (see RUNBOOK.md)."
+            )
+        });
+    }
+    if (opts.agent_model.is_some() || opts.judge_model.is_some())
+        && adapter.cli_model_flag().is_none()
+    {
+        warnings.push(format!(
+            "--harness {label} declares no model flag — models are recorded in \
+             conditions.json as provenance only; dispatches run on the harness's \
+             default model."
+        ));
+    }
+    if !adapter.has_dispatch_recipes() {
+        warnings.push(format!(
+            "--harness {label} declares no dispatch exec recipe — RUNBOOK.md and \
+             dispatch-manifest.md carry handoff guidance without a copy-pasteable per-task \
+             command; construct each dispatch through the harness's one-shot CLI yourself."
+        ));
+    }
+    Ok(HarnessPreflight { opts, warnings })
+}
+
+/// Whether any selected eval declares a `transcript_check` assertion — scopes
+/// the no-transcript-parser preflight warning to the eval configs it actually
+/// affects.
+pub(crate) fn evals_use_transcript_check(evals: &[Eval]) -> bool {
+    evals.iter().any(|e| {
+        e.assertions
+            .iter()
+            .flatten()
+            .any(|a| matches!(a, Assertion::TranscriptCheck(_)))
+    })
 }
 
 /// A per-run nonce (`<millis-base36>-<6 hex>`) that namespaces dispatch
-/// descriptions so transcripts can't collide across iterations sharing one parent
-/// session's subagents dir. With no RNG crate, the low bits of the
-/// sub-millisecond clock supply the entropy — enough, since the base36 millis
-/// prefix already differs between runs.
+/// descriptions so they stay unique across iterations of the same skill. With no
+/// RNG crate, the low bits of the sub-millisecond clock supply the entropy —
+/// enough, since the base36 millis prefix already differs between runs.
 pub(crate) fn make_run_nonce() -> String {
     let now = SystemTime::now()
         .duration_since(UNIX_EPOCH)
@@ -204,18 +263,18 @@ pub(crate) fn mode_str(mode: Mode) -> &'static str {
     }
 }
 
-pub(crate) fn harness_label(harness: Harness) -> &'static str {
+pub(crate) fn harness_label(harness: Harness) -> String {
     adapter_for(harness).label()
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::core::{DetectInput, RunMode, detect_run_context};
+    use crate::core::{DetectInput, detect_run_context};
     use std::fs;
 
-    /// Build a `RunContext` for `harness`/`run_mode` against a throwaway skill dir.
-    fn ctx_for(harness: Harness, run_mode: RunMode) -> (tempfile::TempDir, RunContext) {
+    /// Build a `RunContext` for `harness` against a throwaway skill dir.
+    fn ctx_for(harness: Harness) -> (tempfile::TempDir, RunContext) {
         let tmp = tempfile::TempDir::new().unwrap();
         let skill = tmp.path().join("widget");
         fs::create_dir_all(&skill).unwrap();
@@ -227,7 +286,6 @@ mod tests {
         let ctx = detect_run_context(DetectInput {
             skill: Some(skill.display().to_string()),
             harness: Some(harness),
-            run_mode: Some(run_mode),
             cwd: Some(tmp.path().to_path_buf()),
             ..Default::default()
         })
@@ -236,97 +294,294 @@ mod tests {
     }
 
     #[test]
-    fn claude_hybrid_allows_guard() {
+    fn claude_preflight_is_quiet_and_keeps_guard() {
         // `claude -p` loads the project `.claude/settings.local.json` PreToolUse
-        // hook from its cwd, so the write guard fires under Cli dispatch too.
-        let (_t, ctx) = ctx_for(Harness::ClaudeCode, RunMode::Hybrid);
+        // hook from its cwd, so the write guard fires under CLI dispatch. A
+        // fully-enhanced harness produces no fallback warnings.
+        let (_t, ctx) = ctx_for(Harness::resolve("claude-code").unwrap());
         let opts = RunOptions {
-            guard: true,
+            guard: Some(true),
             ..Default::default()
         };
-        assert!(validate_harness_run_options(&opts, &ctx).is_ok());
+        let preflight = harness_run_preflight(&opts, &ctx, false).unwrap();
+        assert_eq!(preflight.opts.guard, Some(true));
+        assert!(preflight.warnings.is_empty(), "{:?}", preflight.warnings);
+    }
+
+    #[test]
+    fn guard_auto_arms_on_a_supported_staged_run() {
+        // No guard flag at all: the enhancement is detected and provided
+        // automatically (#126), with no warning to acknowledge.
+        let (_t, ctx) = ctx_for(Harness::resolve("claude-code").unwrap());
+        let preflight = harness_run_preflight(&RunOptions::default(), &ctx, false).unwrap();
+        assert_eq!(preflight.opts.guard, Some(true), "auto-arm resolves to on");
+        assert!(preflight.warnings.is_empty(), "{:?}", preflight.warnings);
     }
 
     #[test]
-    fn claude_headless_allows_guard() {
-        let (_t, ctx) = ctx_for(Harness::ClaudeCode, RunMode::Headless);
+    fn guard_auto_stays_off_quietly_with_no_stage() {
+        // Auto-arm never nags: an unstageable run stays unguarded without a
+        // preflight warning (the run-summary unguarded notice covers it).
+        let (_t, ctx) = ctx_for(Harness::resolve("claude-code").unwrap());
         let opts = RunOptions {
-            guard: true,
+            no_stage: true,
             ..Default::default()
         };
-        assert!(validate_harness_run_options(&opts, &ctx).is_ok());
+        let preflight = harness_run_preflight(&opts, &ctx, false).unwrap();
+        assert_eq!(preflight.opts.guard, Some(false));
+        assert!(preflight.warnings.is_empty(), "{:?}", preflight.warnings);
+    }
+
+    #[test]
+    fn guard_auto_stays_off_and_warns_on_a_guardless_harness() {
+        let (_t, ctx) = ctx_for(Harness::resolve("opencode").unwrap());
+        let preflight = harness_run_preflight(&RunOptions::default(), &ctx, false).unwrap();
+        assert_eq!(preflight.opts.guard, Some(false));
+        let warning = preflight
+            .warnings
+            .iter()
+            .find(|w| w.contains("declares no write guard"))
+            .expect("a guard warning fires");
+        assert!(
+            !warning.starts_with("--guard:"),
+            "auto-arm, not the explicit flag, stayed off: {warning}"
+        );
+        assert!(
+            warning.contains("detect-stray-writes"),
+            "names the fallback: {warning}"
+        );
+        assert!(
+            warning.contains("--no-guard"),
+            "names the opt-out that silences it: {warning}"
+        );
     }
 
     #[test]
-    fn claude_interactive_allows_guard() {
-        let (_t, ctx) = ctx_for(Harness::ClaudeCode, RunMode::Interactive);
+    fn no_guard_opts_out_without_warnings() {
+        for name in ["claude-code", "opencode"] {
+            let (_t, ctx) = ctx_for(Harness::resolve(name).unwrap());
+            let opts = RunOptions {
+                guard: Some(false),
+                ..Default::default()
+            };
+            let preflight = harness_run_preflight(&opts, &ctx, false).unwrap();
+            assert_eq!(preflight.opts.guard, Some(false));
+            assert!(
+                !preflight.warnings.iter().any(|w| w.contains("write guard")),
+                "--no-guard acknowledges the state, no warning: {:?}",
+                preflight.warnings
+            );
+        }
+    }
+
+    #[test]
+    fn explicit_guard_with_no_stage_warns_and_continues_unguarded() {
+        let (_t, ctx) = ctx_for(Harness::resolve("claude-code").unwrap());
         let opts = RunOptions {
-            guard: true,
+            guard: Some(true),
+            no_stage: true,
             ..Default::default()
         };
-        assert!(validate_harness_run_options(&opts, &ctx).is_ok());
+        let preflight = harness_run_preflight(&opts, &ctx, false).unwrap();
+        assert_eq!(preflight.opts.guard, Some(false));
+        let warning = preflight
+            .warnings
+            .iter()
+            .find(|w| w.starts_with("--guard:"))
+            .expect("an explicit --guard request that can't be honored warns");
+        assert!(warning.contains("--no-stage"), "{warning}");
+        assert!(
+            warning.contains("detect-stray-writes"),
+            "names the fallback: {warning}"
+        );
     }
 
     #[test]
-    fn unguarded_notice_when_no_stage() {
-        let notice = unguarded_notice(true).unwrap();
+    fn guard_on_a_guardless_harness_warns_and_continues_unguarded() {
+        let (_t, ctx) = ctx_for(Harness::resolve("opencode").unwrap());
+        let opts = RunOptions {
+            guard: Some(true),
+            ..Default::default()
+        };
+        let preflight = harness_run_preflight(&opts, &ctx, false).unwrap();
+        assert_eq!(
+            preflight.opts.guard,
+            Some(false),
+            "guard is forced off, not rejected"
+        );
+        let warning = preflight
+            .warnings
+            .iter()
+            .find(|w| w.contains("--guard"))
+            .expect("a guard warning fires");
         assert!(
-            notice.to_lowercase().contains("unguarded"),
-            "calls the run unguarded: {notice}"
+            warning.contains("detect-stray-writes"),
+            "names the fallback: {warning}"
         );
+        assert!(warning.contains("never blocked"), "{warning}");
+    }
+
+    #[test]
+    fn transcriptless_harness_warns_naming_the_llm_judge_fallback() {
+        let (_t, ctx) = ctx_for(Harness::resolve("opencode").unwrap());
+        let preflight = harness_run_preflight(&RunOptions::default(), &ctx, true).unwrap();
+        let warning = preflight
+            .warnings
+            .iter()
+            .find(|w| w.contains("transcript"))
+            .expect("a transcript warning fires");
+        assert!(warning.contains("unverifiable"), "{warning}");
         assert!(
-            notice.contains("detect-stray-writes"),
-            "names the after-the-fact backstop: {notice}"
+            warning.contains("llm_judge"),
+            "names the fallback: {warning}"
         );
+        assert!(warning.contains("final-message.md"), "{warning}");
     }
 
     #[test]
-    fn no_unguarded_notice_when_staging() {
-        assert!(unguarded_notice(false).is_none());
+    fn transcript_warning_omits_transcript_check_sentence_when_unused() {
+        // The eval config declares no transcript_check assertions, so the
+        // warning covers only the limitations that actually apply.
+        let (_t, ctx) = ctx_for(Harness::resolve("opencode").unwrap());
+        let preflight = harness_run_preflight(&RunOptions::default(), &ctx, false).unwrap();
+        let warning = preflight
+            .warnings
+            .iter()
+            .find(|w| w.contains("transcript parser"))
+            .expect("a transcript warning fires");
+        assert!(!warning.contains("unverifiable"), "{warning}");
+        assert!(!warning.contains("llm_judge"), "{warning}");
+        assert!(warning.contains("tokens/duration"), "{warning}");
+        assert!(warning.contains("final-message.md"), "{warning}");
+    }
+
+    #[test]
+    fn evals_use_transcript_check_detects_the_assertion_type() {
+        use crate::core::{Assertion, AssertionLlmJudge, AssertionTranscriptCheck, Eval};
+
+        fn eval_with(assertions: Option<Vec<Assertion>>) -> Eval {
+            Eval {
+                id: "e1".into(),
+                prompt: "p".into(),
+                expected_output: "o".into(),
+                files: None,
+                assertions,
+                skill_should_trigger: None,
+                runs: None,
+                isolation: None,
+            }
+        }
+
+        let transcript = Assertion::TranscriptCheck(AssertionTranscriptCheck {
+            id: "a1".into(),
+            check: "ran tests".into(),
+            pattern: None,
+            must_precede: None,
+        });
+        let judge = Assertion::LlmJudge(AssertionLlmJudge {
+            id: "a2".into(),
+            rubric: "r".into(),
+            model: None,
+        });
+
+        assert!(evals_use_transcript_check(&[eval_with(Some(vec![
+            judge.clone(),
+            transcript
+        ]))]));
+        assert!(!evals_use_transcript_check(&[
+            eval_with(Some(vec![judge])),
+            eval_with(None)
+        ]));
+        assert!(!evals_use_transcript_check(&[]));
+    }
+
+    #[test]
+    fn dispatchless_harness_warns_naming_the_generic_handoff() {
+        let (_t, ctx) = ctx_for(Harness::resolve("opencode").unwrap());
+        let preflight = harness_run_preflight(&RunOptions::default(), &ctx, false).unwrap();
+        let warning = preflight
+            .warnings
+            .iter()
+            .find(|w| w.contains("dispatch exec recipe"))
+            .expect("a dispatch-recipe warning fires");
+        assert!(warning.contains("RUNBOOK.md"), "{warning}");
+
+        let (_t, ctx) = ctx_for(Harness::resolve("claude-code").unwrap());
+        let preflight = harness_run_preflight(&RunOptions::default(), &ctx, false).unwrap();
+        assert!(
+            !preflight
+                .warnings
+                .iter()
+                .any(|w| w.contains("dispatch exec recipe")),
+            "{:?}",
+            preflight.warnings
+        );
     }
 
     #[test]
-    fn isolated_handoff_points_into_env_and_at_the_runbook() {
-        let env = Path::new("/work/.eval-magic/widget/iteration-3/env");
-        let handoff = insession_isolated_handoff(env);
+    fn model_flags_without_a_descriptor_model_flag_warn_provenance_only() {
+        let (_t, ctx) = ctx_for(Harness::resolve("opencode").unwrap());
+        let opts = RunOptions {
+            agent_model: Some("some-model"),
+            ..Default::default()
+        };
+        let preflight = harness_run_preflight(&opts, &ctx, false).unwrap();
+        let warning = preflight
+            .warnings
+            .iter()
+            .find(|w| w.contains("model flag"))
+            .expect("a model warning fires");
         assert!(
-            handoff.contains("/work/.eval-magic/widget/iteration-3/env"),
-            "names the env to cd into: {handoff}"
+            warning.contains("provenance"),
+            "names the fallback: {warning}"
         );
-        assert!(handoff.contains("cd "), "spells out the cd step: {handoff}");
+    }
+
+    #[test]
+    fn no_model_warning_when_no_models_are_requested() {
+        let (_t, ctx) = ctx_for(Harness::resolve("opencode").unwrap());
+        let preflight = harness_run_preflight(&RunOptions::default(), &ctx, false).unwrap();
         assert!(
-            handoff.contains("Read and follow RUNBOOK.md"),
-            "hands off to the runbook in a fresh session: {handoff}"
+            !preflight.warnings.iter().any(|w| w.contains("model flag")),
+            "{:?}",
+            preflight.warnings
         );
+    }
+
+    #[test]
+    fn unguarded_notice_when_no_stage() {
+        let notice = unguarded_notice(true).unwrap();
         assert!(
-            handoff.contains("fresh"),
-            "names the fresh isolated session: {handoff}"
+            notice.to_lowercase().contains("unguarded"),
+            "calls the run unguarded: {notice}"
         );
-        // The handoff replaces the old printed dispatch loop — it must not re-print it.
         assert!(
-            !handoff.contains("one batch at a time"),
-            "the dispatch loop lives in RUNBOOK.md now, not the summary: {handoff}"
+            notice.contains("detect-stray-writes"),
+            "names the after-the-fact backstop: {notice}"
         );
     }
 
     #[test]
-    fn opencode_plan_mode_profile_resolves() {
-        let profile = resolve_plan_mode_profile(Harness::OpenCode).unwrap();
-        assert!(profile.contains("OpenCode plan mode is active"));
-        assert!(profile.contains("plan agent"));
+    fn no_unguarded_notice_when_staging() {
+        assert!(unguarded_notice(false).is_none());
     }
 
     #[test]
-    fn harness_label_opencode() {
-        assert_eq!(harness_label(Harness::OpenCode), "opencode");
+    fn plan_mode_profile_is_shared_and_harness_agnostic() {
+        let profile = resolve_plan_mode_profile();
+        assert!(profile.contains("Plan mode is active"));
+        // Harness-agnostic content: no Claude-specific ExitPlanMode rail or
+        // Codex-specific <proposed_plan> block.
+        assert!(!profile.contains("ExitPlanMode"));
+        assert!(!profile.contains("<proposed_plan>"));
     }
 
     #[test]
-    fn codex_plan_mode_profile_resolves() {
-        let profile = resolve_plan_mode_profile(Harness::Codex).unwrap();
-        assert!(profile.contains("Codex plan mode is active"));
-        assert!(profile.contains("<proposed_plan>"));
-        assert!(!profile.contains("ExitPlanMode"));
+    fn harness_label_opencode() {
+        assert_eq!(
+            harness_label(Harness::resolve("opencode").unwrap()),
+            "opencode"
+        );
     }
 
     #[test]
diff --git a/src/core/capabilities.rs b/src/core/capabilities.rs
new file mode 100644
index 0000000..bcf5af9
--- /dev/null
+++ b/src/core/capabilities.rs
@@ -0,0 +1,22 @@
+//! Per-harness run-option capabilities.
+//!
+//! Every dispatch rides a single mechanism: each task is delivered through a
+//! one-shot harness CLI subprocess. What still varies by harness is which *run
+//! options* the generic `run` preflight may accept — captured as this narrow
+//! capability struct, reported per harness by
+//! `HarnessAdapter::run_capabilities` and independent of the comparison
+//! [`Mode`](crate::core::Mode) (`new-skill` / `revision`), which selects the
+//! two conditions being compared.
+
+/// Run-option support for a harness's dispatch path.
+///
+/// This is intentionally narrower than the full enhancement surface: it only
+/// describes options the generic `run` preflight must accept or reject before
+/// the build sequence starts. Harness-specific behavior still lives behind the
+/// adapter.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct HarnessRunCapabilities {
+    pub supports_guard: bool,
+    pub supports_bootstrap_with_no_stage: bool,
+    pub supports_stage_name_with_no_stage: bool,
+}
diff --git a/src/core/context.rs b/src/core/context.rs
index 9939f8c..f22fab4 100644
--- a/src/core/context.rs
+++ b/src/core/context.rs
@@ -7,22 +7,38 @@
 
 use std::path::{Path, PathBuf};
 
-use serde::{Deserialize, Serialize};
-
-use crate::core::run_mode::{RunMode, resolve_run_mode};
-
-/// The agent harness an eval runs against. Single source of truth, shared with
-/// the CLI layer (it derives `clap::ValueEnum` so flags can parse it directly).
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize, clap::ValueEnum)]
-#[serde(rename_all = "kebab-case")]
-#[value(rename_all = "kebab-case")]
-pub enum Harness {
-    #[default]
-    ClaudeCode,
-    Codex,
-    #[serde(rename = "opencode")]
-    #[value(name = "opencode")]
-    OpenCode,
+use serde::Serialize;
+
+/// The agent harness an eval runs against: a validated handle to an entry in
+/// the descriptor registry. Constructible only through registry resolution, so
+/// a held `Harness` always names a registered harness and adapter lookup never
+/// fails. The registry-dependent behavior lives next to the registry in
+/// `crate::adapters::harness`: `Harness::resolve` (the string-to-handle
+/// gateway, resolving `--harness` after parsing), `Harness::known` (every
+/// registered harness), `Default` (the registry's default harness), and
+/// `Deserialize` (resolves artifact values, rejecting unknown names).
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub struct Harness {
+    name: &'static str,
+}
+
+impl Harness {
+    /// Registry-only constructor: `name` must be a registry entry's label.
+    pub(crate) const fn from_static_name(name: &'static str) -> Self {
+        Harness { name }
+    }
+
+    /// The kebab-case identifier (`claude-code`, `codex`, `opencode`, …) — the
+    /// `--harness` flag value and the `harness` value in artifacts.
+    pub fn name(self) -> &'static str {
+        self.name
+    }
+}
+
+impl Serialize for Harness {
+    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.serialize_str(self.name)
+    }
 }
 
 /// The resolved environment for a run: validated skill location, sibling skills,
@@ -39,14 +55,12 @@ pub struct RunContext {
     pub stage_root: PathBuf,
     pub bootstrap_path: Option<PathBuf>,
     pub harness: Harness,
-    /// The resolved run mode (the dispatch mechanism + who drives the loop).
-    /// Resolved per harness from the `--run-mode` flag in [`detect_run_context`].
-    pub run_mode: RunMode,
 }
 
 /// Already-parsed flag values handed to [`detect_run_context`]. `clap` owns the
-/// actual argv parsing (and, once wired, the harness `ValueEnum` rejection); this
-/// struct carries the raw values through to filesystem validation and defaulting.
+/// actual argv parsing, and `--harness` is resolved against the registry before
+/// this struct is built (unknown names are rejected there); it carries the raw
+/// values through to filesystem validation and defaulting.
 #[derive(Debug, Clone, Default)]
 pub struct DetectInput {
     pub skill_dir: Option<String>,
@@ -54,7 +68,6 @@ pub struct DetectInput {
     pub bootstrap: Option<String>,
     pub workspace_dir: Option<String>,
     pub harness: Option<Harness>,
-    pub run_mode: Option<RunMode>,
     pub cwd: Option<PathBuf>,
 }
 
@@ -77,8 +90,6 @@ pub enum ContextError {
     SkillNotFound(String),
     #[error("--bootstrap file not found: {0}")]
     BootstrapNotFound(String),
-    #[error("{0}")]
-    UnsupportedRunMode(String),
     #[error("io error: {0}")]
     Io(#[from] std::io::Error),
 }
@@ -212,8 +223,6 @@ pub fn detect_run_context(input: DetectInput) -> Result<RunContext, ContextError
     let stage_root = cwd;
 
     let harness = input.harness.unwrap_or_default();
-    let run_mode =
-        resolve_run_mode(harness, input.run_mode).map_err(ContextError::UnsupportedRunMode)?;
 
     Ok(RunContext {
         skill_dir,
@@ -225,7 +234,6 @@ pub fn detect_run_context(input: DetectInput) -> Result<RunContext, ContextError
         stage_root,
         bootstrap_path,
         harness,
-        run_mode,
     })
 }
 
@@ -414,7 +422,7 @@ mod tests {
         );
         assert!(ctx.sibling_skill_names.is_empty());
         assert!(ctx.bootstrap_path.is_none());
-        assert_eq!(ctx.harness, Harness::ClaudeCode);
+        assert_eq!(ctx.harness, Harness::resolve("claude-code").unwrap());
     }
 
     #[test]
@@ -492,11 +500,11 @@ mod tests {
         let tmp = TempDir::new().unwrap();
         let skill_dir = make_skill_dir(tmp.path(), &["foo"]);
         let ctx = detect_run_context(DetectInput {
-            harness: Some(Harness::Codex),
+            harness: Some(Harness::resolve("codex").unwrap()),
             ..input(&skill_dir, "foo")
         })
         .unwrap();
-        assert_eq!(ctx.harness, Harness::Codex);
+        assert_eq!(ctx.harness, Harness::resolve("codex").unwrap());
     }
 
     #[test]
@@ -504,10 +512,10 @@ mod tests {
         let tmp = TempDir::new().unwrap();
         let skill_dir = make_skill_dir(tmp.path(), &["foo"]);
         let ctx = detect_run_context(DetectInput {
-            harness: Some(Harness::OpenCode),
+            harness: Some(Harness::resolve("opencode").unwrap()),
             ..input(&skill_dir, "foo")
         })
         .unwrap();
-        assert_eq!(ctx.harness, Harness::OpenCode);
+        assert_eq!(ctx.harness, Harness::resolve("opencode").unwrap());
     }
 }
diff --git a/src/core/mod.rs b/src/core/mod.rs
index a0d12b8..9ca390b 100644
--- a/src/core/mod.rs
+++ b/src/core/mod.rs
@@ -1,21 +1,19 @@
 //! Shared kernel used by nearly every other module.
 //!
-//! - [`types`]    — domain types (`Eval`, `RunRecord`, `Assertion`, `GradingResult`, …)
-//! - [`context`]  — `RunContext` detection from parsed flags / environment
-//! - [`run_mode`] — dispatch mechanism (in-session vs. one-shot CLI)
-//! - [`runtime`]  — runtime helpers (git spawning)
+//! - [`types`]        — domain types (`Eval`, `RunRecord`, `Assertion`, `GradingResult`, …)
+//! - [`context`]      — `RunContext` detection from parsed flags / environment
+//! - [`capabilities`] — per-harness run-option capabilities
+//! - [`runtime`]      — runtime helpers (git spawning)
 //!
 //! The submodules are re-exported flat here so downstream code writes
 //! `crate::core::Eval` rather than `crate::core::types::Eval`.
 
+pub mod capabilities;
 pub mod context;
-pub mod run_mode;
 pub mod runtime;
 pub mod types;
 
+pub use capabilities::HarnessRunCapabilities;
 pub use context::{ContextError, DetectInput, Harness, RunContext, detect_run_context};
-pub use run_mode::{
-    DispatchMechanism, HarnessRunCapabilities, RunMode, capabilities_for, resolve_run_mode,
-};
 pub use runtime::{GitOutput, run_git};
 pub use types::*;
diff --git a/src/core/run_mode.rs b/src/core/run_mode.rs
deleted file mode 100644
index a2457df..0000000
--- a/src/core/run_mode.rs
+++ /dev/null
@@ -1,262 +0,0 @@
-//! Run mode — *how* an eval is dispatched, independent of *which* harness runs
-//! it.
-//!
-//! There are two dispatch **mechanisms** in the code today:
-//!
-//! - [`DispatchMechanism::InSession`] — the runner hands tasks to in-session
-//!   subagents (Claude Code's Task tool). The reference is Claude Code.
-//! - [`DispatchMechanism::Cli`] — each task is dispatched through a one-shot
-//!   harness CLI subprocess (`codex exec`). The reference is Codex.
-//!
-//! These two mechanisms underpin the three *user-facing* run modes documented in
-//! the README: **fully-interactive** rides on [`InSession`](DispatchMechanism::InSession);
-//! **headless** and **hybrid** both ride on [`Cli`](DispatchMechanism::Cli),
-//! differing only in whether a human/agent session drives the loop — not in how
-//! a single task reaches the harness.
-//!
-//! This is distinct from the comparison [`Mode`](crate::core::Mode)
-//! (`new-skill` / `revision`), which selects the two conditions being compared,
-//! not the dispatch path.
-
-use serde::{Deserialize, Serialize};
-
-use crate::core::Harness;
-
-/// How a single dispatch is delivered to a harness. The primary code axis for
-/// run-mode concerns (next-steps guidance, transcript source).
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum DispatchMechanism {
-    /// In-session subagent dispatch (Claude Code's Task tool).
-    InSession,
-    /// One-shot harness CLI subprocess dispatch (`codex exec`).
-    Cli,
-}
-
-/// The user-facing run mode — *who/what drives the loop* plus which dispatch
-/// mechanism each task rides on. This is the parity vocabulary documented in the
-/// README (§Run modes); it maps down to a [`DispatchMechanism`] via
-/// [`RunMode::mechanism`]. `hybrid` and `headless` both ride on
-/// [`Cli`](DispatchMechanism::Cli) and differ only in whether a session drives
-/// the loop — a distinction we persist (in `conditions.json`) even though it
-/// doesn't change how a single task reaches the harness.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, clap::ValueEnum)]
-#[serde(rename_all = "kebab-case")]
-#[value(rename_all = "kebab-case")]
-pub enum RunMode {
-    /// In-session subagent dispatch (Claude Code's Task tool).
-    Interactive,
-    /// An agent session orchestrates while each dispatch shells out to the
-    /// harness CLI (`claude -p`, `codex exec`).
-    Hybrid,
-    /// No session drives the loop; eval-magic commands dispatch through the
-    /// harness CLI end to end.
-    Headless,
-}
-
-impl RunMode {
-    /// The dispatch mechanism this run mode rides on.
-    pub fn mechanism(self) -> DispatchMechanism {
-        match self {
-            RunMode::Interactive => DispatchMechanism::InSession,
-            RunMode::Hybrid | RunMode::Headless => DispatchMechanism::Cli,
-        }
-    }
-
-    /// The default run mode for a harness when `--run-mode` is omitted, chosen to
-    /// preserve today's behavior: Claude Code → interactive, the CLI-dispatch
-    /// harnesses → hybrid.
-    pub fn default_for(harness: Harness) -> RunMode {
-        match harness {
-            Harness::ClaudeCode => RunMode::Interactive,
-            Harness::Codex | Harness::OpenCode => RunMode::Hybrid,
-        }
-    }
-
-    /// The kebab-case identifier (matches the `--run-mode` flag values and the
-    /// serialized form in `conditions.json`).
-    pub fn as_str(self) -> &'static str {
-        match self {
-            RunMode::Interactive => "interactive",
-            RunMode::Hybrid => "hybrid",
-            RunMode::Headless => "headless",
-        }
-    }
-}
-
-/// Resolve the effective run mode for a harness, defaulting per harness when
-/// unspecified and rejecting unsupported `(harness, mode)` combinations. The
-/// `Err` string is operator-facing.
-pub fn resolve_run_mode(harness: Harness, requested: Option<RunMode>) -> Result<RunMode, String> {
-    let mode = requested.unwrap_or_else(|| RunMode::default_for(harness));
-    let supported: &[RunMode] = match harness {
-        // Claude Code wires every mode: in-session (interactive) plus both CLI
-        // modes (hybrid and headless ride the same `claude -p` mechanism).
-        Harness::ClaudeCode => &[RunMode::Interactive, RunMode::Hybrid, RunMode::Headless],
-        // Codex dispatches via subprocess, so in-session doesn't translate, but
-        // both CLI modes do (hybrid is agent-driven, headless human-driven).
-        Harness::Codex => &[RunMode::Hybrid, RunMode::Headless],
-        // OpenCode's CLI path is only partially wired (no transcript ingest), so
-        // only hybrid is advertised for now.
-        Harness::OpenCode => &[RunMode::Hybrid],
-    };
-    if supported.contains(&mode) {
-        return Ok(mode);
-    }
-    let supported_list = supported
-        .iter()
-        .map(|m| m.as_str())
-        .collect::<Vec<_>>()
-        .join(", ");
-    Err(format!(
-        "--run-mode {} is not supported for --harness {}; supported: {}",
-        mode.as_str(),
-        harness_label(harness),
-        supported_list,
-    ))
-}
-
-/// The kebab-case CLI identifier for a harness (for operator-facing messages).
-fn harness_label(harness: Harness) -> &'static str {
-    match harness {
-        Harness::ClaudeCode => "claude-code",
-        Harness::Codex => "codex",
-        Harness::OpenCode => "opencode",
-    }
-}
-
-/// Run-option support for a harness's currently wired dispatch mechanism.
-///
-/// This is intentionally narrower than full harness parity: it only describes
-/// options the generic `run` preflight must accept or reject before the build
-/// sequence starts. Harness-specific behavior still lives behind the adapter.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub struct HarnessRunCapabilities {
-    pub mechanism: DispatchMechanism,
-    pub supports_guard: bool,
-    pub supports_bootstrap_with_no_stage: bool,
-    pub supports_stage_name_with_no_stage: bool,
-}
-
-/// The focused capability table for generic `run` option validation.
-pub fn capabilities_for(harness: Harness) -> HarnessRunCapabilities {
-    match harness {
-        Harness::ClaudeCode => HarnessRunCapabilities {
-            mechanism: DispatchMechanism::InSession,
-            supports_guard: true,
-            supports_bootstrap_with_no_stage: true,
-            supports_stage_name_with_no_stage: true,
-        },
-        Harness::Codex => HarnessRunCapabilities {
-            mechanism: DispatchMechanism::Cli,
-            supports_guard: true,
-            supports_bootstrap_with_no_stage: false,
-            supports_stage_name_with_no_stage: false,
-        },
-        Harness::OpenCode => HarnessRunCapabilities {
-            mechanism: DispatchMechanism::Cli,
-            supports_guard: false,
-            supports_bootstrap_with_no_stage: true,
-            supports_stage_name_with_no_stage: true,
-        },
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn capabilities_capture_run_option_support_by_harness() {
-        let claude = capabilities_for(Harness::ClaudeCode);
-        assert_eq!(claude.mechanism, DispatchMechanism::InSession);
-        assert!(claude.supports_guard);
-        assert!(claude.supports_bootstrap_with_no_stage);
-        assert!(claude.supports_stage_name_with_no_stage);
-
-        let codex = capabilities_for(Harness::Codex);
-        assert_eq!(codex.mechanism, DispatchMechanism::Cli);
-        assert!(codex.supports_guard);
-        assert!(!codex.supports_bootstrap_with_no_stage);
-        assert!(!codex.supports_stage_name_with_no_stage);
-
-        let opencode = capabilities_for(Harness::OpenCode);
-        assert_eq!(opencode.mechanism, DispatchMechanism::Cli);
-        assert!(!opencode.supports_guard);
-        assert!(opencode.supports_bootstrap_with_no_stage);
-        assert!(opencode.supports_stage_name_with_no_stage);
-    }
-
-    #[test]
-    fn run_mode_mechanism_maps_each_mode() {
-        assert_eq!(
-            RunMode::Interactive.mechanism(),
-            DispatchMechanism::InSession
-        );
-        assert_eq!(RunMode::Hybrid.mechanism(), DispatchMechanism::Cli);
-        assert_eq!(RunMode::Headless.mechanism(), DispatchMechanism::Cli);
-    }
-
-    #[test]
-    fn run_mode_default_per_harness_preserves_today() {
-        assert_eq!(
-            RunMode::default_for(Harness::ClaudeCode),
-            RunMode::Interactive
-        );
-        assert_eq!(RunMode::default_for(Harness::Codex), RunMode::Hybrid);
-        assert_eq!(RunMode::default_for(Harness::OpenCode), RunMode::Hybrid);
-    }
-
-    #[test]
-    fn resolve_run_mode_defaults_when_unspecified() {
-        assert_eq!(
-            resolve_run_mode(Harness::ClaudeCode, None).unwrap(),
-            RunMode::Interactive
-        );
-        assert_eq!(
-            resolve_run_mode(Harness::Codex, None).unwrap(),
-            RunMode::Hybrid
-        );
-    }
-
-    #[test]
-    fn resolve_run_mode_accepts_claude_hybrid() {
-        assert_eq!(
-            resolve_run_mode(Harness::ClaudeCode, Some(RunMode::Hybrid)).unwrap(),
-            RunMode::Hybrid
-        );
-    }
-
-    #[test]
-    fn resolve_run_mode_rejects_interactive_for_cli_harnesses() {
-        let err = resolve_run_mode(Harness::Codex, Some(RunMode::Interactive)).unwrap_err();
-        assert!(err.contains("interactive"), "message was: {err}");
-        assert!(err.contains("codex"), "message was: {err}");
-        assert!(resolve_run_mode(Harness::OpenCode, Some(RunMode::Interactive)).is_err());
-    }
-
-    #[test]
-    fn resolve_run_mode_accepts_claude_headless() {
-        assert_eq!(
-            resolve_run_mode(Harness::ClaudeCode, Some(RunMode::Headless)).unwrap(),
-            RunMode::Headless
-        );
-    }
-
-    #[test]
-    fn resolve_run_mode_accepts_codex_headless() {
-        assert_eq!(
-            resolve_run_mode(Harness::Codex, Some(RunMode::Headless)).unwrap(),
-            RunMode::Headless
-        );
-    }
-
-    #[test]
-    fn run_mode_serde_roundtrips_kebab_case() {
-        assert_eq!(
-            serde_json::to_string(&RunMode::Hybrid).unwrap(),
-            "\"hybrid\""
-        );
-        let parsed: RunMode = serde_json::from_str("\"headless\"").unwrap();
-        assert_eq!(parsed, RunMode::Headless);
-    }
-}
diff --git a/src/core/types.rs b/src/core/types.rs
index dddd9d7..8dc26b0 100644
--- a/src/core/types.rs
+++ b/src/core/types.rs
@@ -10,7 +10,6 @@ use serde::{Deserialize, Serialize};
 use serde_json::Value;
 
 use crate::core::context::Harness;
-use crate::core::run_mode::RunMode;
 
 /// Meta-assertion id reserved for the skill-invocation check.
 pub const SKILL_INVOKED_META_ID: &str = "__skill_invoked";
@@ -110,10 +109,26 @@ pub struct ConditionEntry {
     pub name: String,
     pub skill_path: Option<String>,
     /// Optional and nullable: absent (omitted), explicit `null`, or a slug.
-    #[serde(skip_serializing_if = "Option::is_none")]
+    #[serde(
+        default,
+        skip_serializing_if = "Option::is_none",
+        deserialize_with = "deserialize_present_key"
+    )]
     pub staged_skill_slug: Option<Option<String>>,
 }
 
+/// Tri-state field deserializer: a present key — even an explicit `null` —
+/// becomes `Some(inner)`, while a missing key falls back to `None` via
+/// `default`. The stock `Option<Option<T>>` impl collapses `null` to the outer
+/// `None`, which would drop the key on re-serialization and break artifact
+/// round-trips.
+fn deserialize_present_key<'de, D>(deserializer: D) -> Result<Option<Option<String>>, D::Error>
+where
+    D: serde::Deserializer<'de>,
+{
+    Option::<String>::deserialize(deserializer).map(Some)
+}
+
 /// The conditions manifest written for a run.
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
 pub struct ConditionsRecord {
@@ -124,12 +139,8 @@ pub struct ConditionsRecord {
     pub timestamp: String,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub harness: Option<Harness>,
-    /// The run mode this iteration was built with (provenance + recoverability).
-    /// `None` on older artifacts written before run-mode selection existed.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub run_mode: Option<RunMode>,
-    /// Per-run nonce; namespaces dispatch descriptions so transcripts can't
-    /// collide across iterations sharing one parent session's subagents dir.
+    /// Per-run nonce; namespaces dispatch descriptions so they stay unique across
+    /// iterations of the same skill.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub run_nonce: Option<String>,
     /// The `--runs` value the iteration was built with (provenance; per-eval
@@ -396,6 +407,16 @@ mod tests {
             some.get("staged_skill_slug"),
             Some(&Value::String("slug-1".into()))
         );
+        // Deserialization preserves all three states (explicit null must stay
+        // a present key, not collapse to absent).
+        let back = |v| {
+            serde_json::from_value::<ConditionEntry>(v)
+                .unwrap()
+                .staged_skill_slug
+        };
+        assert_eq!(back(absent), None);
+        assert_eq!(back(null), Some(None));
+        assert_eq!(back(some), Some(Some("slug-1".into())));
     }
 
     #[test]
@@ -405,8 +426,7 @@ mod tests {
             baseline: None,
             conditions: vec![],
             timestamp: "2026-06-08T00:00:00Z".into(),
-            harness: Some(Harness::ClaudeCode),
-            run_mode: Some(RunMode::Hybrid),
+            harness: Some(Harness::resolve("claude-code").unwrap()),
             run_nonce: None,
             runs: None,
             agent_model: None,
@@ -419,12 +439,66 @@ mod tests {
             out.get("harness"),
             Some(&Value::String("claude-code".into()))
         );
-        assert_eq!(out.get("run_mode"), Some(&Value::String("hybrid".into())));
         // Absent optionals omitted.
         assert!(out.get("baseline").is_none());
         assert!(out.get("run_nonce").is_none());
     }
 
+    /// Fixture artifacts captured from the pre-#135 binary (compile-time
+    /// `Harness` enum era). Parsing and re-serializing with the artifact
+    /// writer format (`to_string_pretty` + trailing newline, matching
+    /// `pipeline::io::write_json`) must reproduce every byte, so opening the
+    /// harness identifier can never reshape existing artifacts.
+    #[test]
+    fn conditions_json_fixtures_round_trip_byte_identically() {
+        for (name, fixture) in [
+            (
+                "claude-code",
+                include_str!("../../tests/fixtures/conditions/claude-code.json"),
+            ),
+            (
+                "codex",
+                include_str!("../../tests/fixtures/conditions/codex.json"),
+            ),
+            (
+                "opencode",
+                include_str!("../../tests/fixtures/conditions/opencode.json"),
+            ),
+            (
+                "no-harness",
+                include_str!("../../tests/fixtures/conditions/no-harness.json"),
+            ),
+        ] {
+            let record: ConditionsRecord = serde_json::from_str(fixture)
+                .unwrap_or_else(|e| panic!("fixture {name} no longer parses: {e}"));
+            let mut out = serde_json::to_string_pretty(&record).unwrap();
+            out.push('\n');
+            assert_eq!(
+                out, fixture,
+                "fixture {name} did not round-trip byte-identically"
+            );
+        }
+    }
+
+    /// A `conditions.json` naming a harness the registry doesn't know must
+    /// fail deserialization with the known harnesses listed, mirroring the
+    /// `--harness` CLI rejection.
+    #[test]
+    fn conditions_json_with_unknown_harness_errors_naming_known_harnesses() {
+        let err = serde_json::from_value::<ConditionsRecord>(json!({
+            "mode": "new-skill",
+            "conditions": [],
+            "timestamp": "2026-06-08T00:00:00Z",
+            "harness": "nonexistent"
+        }))
+        .unwrap_err()
+        .to_string();
+        assert!(err.contains("unknown harness 'nonexistent'"), "{err}");
+        for name in ["claude-code", "codex", "opencode"] {
+            assert!(err.contains(name), "error must name {name}: {err}");
+        }
+    }
+
     #[test]
     fn timing_source_kebab_roundtrips() {
         let v = serde_json::to_value(TimingSource::CompletionEvent).unwrap();
diff --git a/src/pipeline/detect_stray_writes.rs b/src/pipeline/detect_stray_writes.rs
index a1a5c57..a6e44c7 100644
--- a/src/pipeline/detect_stray_writes.rs
+++ b/src/pipeline/detect_stray_writes.rs
@@ -3,8 +3,8 @@
 //! Classifies a run's tool
 //! invocations against its allowed outputs dir:
 //!
-//! - **violations**: file-write tools (Write/Edit/MultiEdit/NotebookEdit/Codex
-//!   `file_change`) whose target path resolves outside the outputs dir.
+//! - **violations**: file-write tools (per the adapters' cross-harness
+//!   vocabulary union) whose target path resolves outside the outputs dir.
 //! - **warnings**: shell commands matching a mutating pattern that don't
 //!   reference the outputs dir (via the sandbox `classify_bash` policy).
 //! - **live_source_reads**: read tools / shell commands that touched the live
@@ -14,21 +14,18 @@ use std::path::{Path, PathBuf};
 
 use serde::{Deserialize, Serialize};
 
+use crate::adapters::{all_config_dir_names, all_tool_vocabulary};
 use crate::core::{ConditionsRecord, RunRecord, ToolInvocation};
 use crate::pipeline::error::PipelineError;
 use crate::pipeline::io::{now_iso8601, write_json};
 use crate::pipeline::slots::{run_key, run_slots};
-use crate::sandbox::{WRITE_TOOLS, classify_bash, is_under, path_arg};
+use crate::sandbox::{classify_bash, is_shell_tool, is_under, is_write_tool, path_arg};
 use crate::validation::{SchemaName, validate_against_schema};
 
-/// Shell-execution tools across harnesses.
-const SHELL_TOOLS: [&str; 2] = ["Bash", "command_execution"];
-/// Read-only tools that carry a target path argument.
-const READ_TOOLS: [&str; 3] = ["Read", "Glob", "Grep"];
-
-/// A file-write tool: a sandbox write tool, or Codex's `file_change`.
-fn is_file_write_tool(name: &str) -> bool {
-    WRITE_TOOLS.contains(&name) || name == "file_change"
+/// A read-only tool carrying a target path argument, in any harness's
+/// vocabulary.
+fn is_read_tool(name: &str) -> bool {
+    all_tool_vocabulary().read_tools.iter().any(|t| t == name)
 }
 
 const LIVE_SOURCE_REASON: &str =
@@ -73,7 +70,7 @@ pub fn detect_stray_writes(
     let mut findings = RunFindings::default();
 
     for inv in invocations {
-        if is_file_write_tool(&inv.name) {
+        if is_write_tool(&inv.name) {
             if let Some(p) = inv.args.as_ref().and_then(path_arg)
                 && !is_under(p, outputs_dir, repo_root)
             {
@@ -88,7 +85,7 @@ pub fn detect_stray_writes(
             continue;
         }
 
-        if SHELL_TOOLS.contains(&inv.name.as_str()) {
+        if is_shell_tool(&inv.name) {
             let command = command_of(inv);
             if let Some(reason) =
                 classify_bash(command, std::slice::from_ref(&outputs_dir.to_string()))
@@ -142,10 +139,11 @@ fn is_trailing_boundary(b: u8) -> bool {
 }
 
 /// True if `command` references `rel` as a bare path token — bounded as a path
-/// segment and **not** prefixed by a `.claude`/`.agents` staging dir. The
-/// `regex` crate has no lookbehind, so each occurrence is scanned directly for
-/// the boundary + preceding-segment conditions.
-fn references_bare_rel(command: &str, rel: &str) -> bool {
+/// segment and **not** prefixed by any harness config dir (`config_dirs`, the
+/// caller-supplied `adapters::all_config_dir_names()` list). The `regex` crate
+/// has no lookbehind, so each occurrence is scanned directly for the boundary +
+/// preceding-segment conditions.
+fn references_bare_rel(command: &str, rel: &str, config_dirs: &[String]) -> bool {
     if rel.is_empty() {
         return false;
     }
@@ -160,7 +158,7 @@ fn references_bare_rel(command: &str, rel: &str) -> bool {
         // including) that char must not end with a staging-dir prefix.
         let lookbehind_ok = start == 0 || {
             let before = &command[..start - 1];
-            !before.ends_with(".claude") && !before.ends_with(".agents")
+            !config_dirs.iter().any(|dir| before.ends_with(dir.as_str()))
         };
         let trailing_ok = end == command.len() || is_trailing_boundary(bytes[end]);
 
@@ -185,9 +183,10 @@ pub fn detect_live_source_reads(
     let live_dir_str = live_dir.to_string_lossy();
     let rel = path_relative(repo_root, &live_dir);
     let rel_usable = !rel.starts_with("..");
+    let config_dirs = all_config_dir_names();
 
     for inv in invocations {
-        if READ_TOOLS.contains(&inv.name.as_str()) {
+        if is_read_tool(&inv.name) {
             if let Some(p) = inv.args.as_ref().and_then(path_arg)
                 && is_under(p, &live_dir_str, repo_root)
             {
@@ -202,10 +201,10 @@ pub fn detect_live_source_reads(
             continue;
         }
 
-        if SHELL_TOOLS.contains(&inv.name.as_str()) {
+        if is_shell_tool(&inv.name) {
             let command = command_of(inv);
             if command.contains(live_dir_str.as_ref())
-                || (rel_usable && references_bare_rel(command, &rel))
+                || (rel_usable && references_bare_rel(command, &rel, &config_dirs))
             {
                 findings.push(StrayFinding {
                     tool: inv.name.clone(),
@@ -582,7 +581,22 @@ mod tests {
             repo(),
         );
         assert_eq!(f.warnings.len(), 1);
-        assert!(f.warnings[0].reason.to_lowercase().contains(".claude"));
+        assert!(f.warnings[0].reason.to_lowercase().contains("config dir"));
+    }
+
+    #[test]
+    fn creating_a_path_under_dot_codex_is_a_warning() {
+        let f = detect_stray_writes(
+            &[inv(
+                "Bash",
+                json!({"command": "cp evil.json .codex/hooks.json"}),
+                0,
+            )],
+            OUTPUTS,
+            repo(),
+        );
+        assert_eq!(f.warnings.len(), 1);
+        assert!(f.warnings[0].reason.to_lowercase().contains("config dir"));
     }
 
     #[test]
@@ -742,6 +756,20 @@ mod tests {
         assert!(f.is_empty());
     }
 
+    #[test]
+    fn a_bash_referencing_a_staged_copy_under_dot_opencode_skills_is_not_flagged() {
+        let f = detect_live_source_reads(
+            &[inv(
+                "Bash",
+                json!({"command": "cat .opencode/skills/mr-review/SKILL.md"}),
+                0,
+            )],
+            live(),
+            repo(),
+        );
+        assert!(f.is_empty());
+    }
+
     #[test]
     fn unrelated_reads_and_commands_are_not_flagged() {
         let f = detect_live_source_reads(
diff --git a/src/pipeline/fill_transcripts.rs b/src/pipeline/fill_transcripts.rs
index 06bd0b6..3133f69 100644
--- a/src/pipeline/fill_transcripts.rs
+++ b/src/pipeline/fill_transcripts.rs
@@ -2,9 +2,10 @@
 //!
 //! Walks the iteration's `eval-*`
 //! directories and, for each `(eval, condition)` `run.json`, populates
-//! `tool_invocations` from the persisted transcript (Claude Code subagent JSONL
-//! resolved by the task's `agent_description`, or Codex `codex-events.jsonl`).
-//! Records that already carry invocations are skipped unless `overwrite`.
+//! `tool_invocations` from the events file the harness CLI wrote under the task's
+//! `outputs_dir` (e.g. Codex's `codex-events.jsonl`, Claude Code's
+//! `claude-events.jsonl`). Records that already carry invocations are skipped
+//! unless `overwrite`.
 
 use std::collections::HashMap;
 use std::fs;
@@ -12,8 +13,8 @@ use std::path::Path;
 
 use serde::Deserialize;
 
-use crate::adapters::{adapter_for, find_by_description};
-use crate::core::{ConditionsRecord, DispatchMechanism, Harness, RunRecord, ToolInvocation};
+use crate::adapters::adapter_for;
+use crate::core::{ConditionsRecord, Harness, RunRecord, ToolInvocation};
 use crate::pipeline::error::PipelineError;
 use crate::pipeline::io::write_json;
 use crate::pipeline::slots::{run_key, run_slots};
@@ -40,45 +41,14 @@ struct DispatchRef {
     #[serde(default)]
     run_index: Option<u32>,
     #[serde(default)]
-    agent_description: Option<String>,
-    #[serde(default)]
     outputs_dir: Option<String>,
 }
 
-/// The canonical dispatch description for an `(eval, condition, run)` run.
-///
-/// The runner writes a unique `agent_description` per task into `dispatch.json`
-/// (namespaced with the iteration + run nonce); reading it back binds each run to
-/// the exact agent that produced it. Falls back to the
-/// `<eval_id>:<condition>[:r<k>]` reconstruction when `dispatch.json` is absent,
-/// malformed, or missing the task (hand-authored/operator runs).
-pub fn resolve_agent_description(
-    iteration_dir: &Path,
-    eval_id: &str,
-    condition: &str,
-    run_index: Option<u32>,
-) -> String {
-    let dispatch_path = iteration_dir.join("dispatch.json");
-    if let Ok(raw) = fs::read_to_string(&dispatch_path)
-        && let Ok(env) = serde_json::from_str::<DispatchEnvelope>(&raw)
-        && let Some(tasks) = env.tasks
-        && let Some(task) = tasks
-            .iter()
-            .find(|t| t.eval_id == eval_id && t.condition == condition && t.run_index == run_index)
-        && let Some(desc) = &task.agent_description
-    {
-        return desc.clone();
-    }
-    run_key(eval_id, condition, run_index)
-}
-
 /// Populate `tool_invocations` for every `run.json` under `iteration_dir`. See
 /// the module docs for the transcript sources and overwrite semantics.
 pub fn fill_transcripts(
     iteration_dir: &Path,
     harness: Harness,
-    mechanism: DispatchMechanism,
-    subagents_dir: Option<&Path>,
     overwrite: bool,
 ) -> Result<FillTranscriptsResult, PipelineError> {
     let conditions_path = iteration_dir.join("conditions.json");
@@ -131,18 +101,8 @@ pub fn fill_transcripts(
                     .cloned()
                     .unwrap_or_else(|| slot.dir.join("outputs").to_string_lossy().into_owned());
 
-                // Resolve the in-session description lazily — only the InSession
-                // branch needs it, so a Cli run skips the dispatch.json re-read.
-                let description = (mechanism == DispatchMechanism::InSession).then(|| {
-                    resolve_agent_description(iteration_dir, eval_id, cond, slot.run_index)
-                });
-                let Some(invocations) = invocations_for_run(
-                    harness,
-                    mechanism,
-                    subagents_dir,
-                    description.as_deref(),
-                    Path::new(&outputs_dir),
-                ) else {
+                let Some(invocations) = invocations_for_run(harness, Path::new(&outputs_dir))
+                else {
                     result.missing += 1;
                     continue;
                 };
@@ -174,34 +134,15 @@ fn outputs_dirs_by_key(iteration_dir: &Path) -> HashMap<String, String> {
     out
 }
 
-/// Parse the invocations for one run, keyed on the dispatch mechanism: a
-/// `Cli`-mechanism harness reads the events file its CLI wrote under
-/// `outputs_dir` (e.g. Codex's `codex-events.jsonl`, Claude Code hybrid's
-/// `claude-events.jsonl`); an `InSession` harness reads the subagent transcript
-/// matched by `description` (resolved by the caller).
-fn invocations_for_run(
-    harness: Harness,
-    mechanism: DispatchMechanism,
-    subagents_dir: Option<&Path>,
-    description: Option<&str>,
-    outputs_dir: &Path,
-) -> Option<Vec<ToolInvocation>> {
-    match mechanism {
-        DispatchMechanism::Cli => {
-            let events_path = outputs_dir.join(adapter_for(harness).cli_events_filename()?);
-            if !events_path.exists() {
-                return None;
-            }
-            adapter_for(harness).parse_cli_events(&events_path).ok()
-        }
-        DispatchMechanism::InSession => {
-            let subagent =
-                find_by_description(subagents_dir.unwrap_or_else(|| Path::new("")), description?)?;
-            adapter_for(harness)
-                .parse_transcript(&subagent.jsonl_path)
-                .ok()
-        }
+/// Parse the invocations for one run: read the events file the harness CLI wrote
+/// under `outputs_dir` (e.g. Codex's `codex-events.jsonl`, Claude Code's
+/// `claude-events.jsonl`). Returns `None` when no events file is found.
+fn invocations_for_run(harness: Harness, outputs_dir: &Path) -> Option<Vec<ToolInvocation>> {
+    let events_path = outputs_dir.join(adapter_for(harness).cli_events_filename()?);
+    if !events_path.exists() {
+        return None;
     }
+    adapter_for(harness).parse_cli_events(&events_path).ok()
 }
 
 #[cfg(test)]
@@ -244,70 +185,10 @@ mod tests {
         fs::write(path, serde_json::to_string_pretty(&record).unwrap()).unwrap();
     }
 
-    // --- resolveAgentDescription ---
-
-    #[test]
-    fn returns_the_namespaced_agent_description_from_dispatch() {
-        let root = TempDir::new().unwrap();
-        let dir = root.path().join("iter-canonical");
-        write_dispatch(
-            &dir,
-            json!([
-                {"eval_id": "crash", "condition": "with_skill", "agent_description": "crash:with_skill:i3-abc123"},
-                {"eval_id": "crash", "condition": "without_skill", "agent_description": "crash:without_skill:i3-abc123"}
-            ]),
-        );
-        assert_eq!(
-            resolve_agent_description(&dir, "crash", "with_skill", None),
-            "crash:with_skill:i3-abc123"
-        );
-        assert_eq!(
-            resolve_agent_description(&dir, "crash", "without_skill", None),
-            "crash:without_skill:i3-abc123"
-        );
-    }
-
-    #[test]
-    fn falls_back_to_legacy_reconstruction_when_dispatch_absent() {
-        let root = TempDir::new().unwrap();
-        let dir = root.path().join("iter-no-dispatch");
-        fs::create_dir_all(&dir).unwrap();
-        assert_eq!(
-            resolve_agent_description(&dir, "crash", "with_skill", None),
-            "crash:with_skill"
-        );
-    }
-
-    #[test]
-    fn falls_back_when_task_missing_from_dispatch() {
-        let root = TempDir::new().unwrap();
-        let dir = root.path().join("iter-partial");
-        write_dispatch(
-            &dir,
-            json!([{"eval_id": "other", "condition": "with_skill", "agent_description": "other:with_skill:i1-x"}]),
-        );
-        assert_eq!(
-            resolve_agent_description(&dir, "crash", "with_skill", None),
-            "crash:with_skill"
-        );
-    }
-
-    #[test]
-    fn falls_back_when_dispatch_malformed() {
-        let root = TempDir::new().unwrap();
-        let dir = root.path().join("iter-malformed");
-        fs::create_dir_all(&dir).unwrap();
-        fs::write(dir.join("dispatch.json"), "{ not valid json").unwrap();
-        assert_eq!(
-            resolve_agent_description(&dir, "crash", "with_skill", None),
-            "crash:with_skill"
-        );
-    }
-
     // --- fillTranscripts ---
 
     #[test]
-    fn fills_a_claude_hybrid_run_record_from_outputs_events() {
+    fn fills_a_claude_run_record_from_outputs_events() {
         let root = TempDir::new().unwrap();
         let iteration_dir: PathBuf = root.path().join("iter-claude-fill");
         let cond_dir = iteration_dir.join("eval-crash").join("with_skill");
@@ -321,8 +202,7 @@ mod tests {
                 "mode": "new-skill",
                 "conditions": [{"name": "with_skill", "skill_path": "/skill/SKILL.md"}],
                 "timestamp": "2026-06-07T00:00:00.000Z",
-                "harness": "claude-code",
-                "run_mode": "hybrid"
+                "harness": "claude-code"
             })
             .to_string(),
         )
@@ -344,9 +224,7 @@ mod tests {
 
         let result = fill_transcripts(
             &iteration_dir,
-            Harness::ClaudeCode,
-            DispatchMechanism::Cli,
-            None,
+            Harness::resolve("claude-code").unwrap(),
             false,
         )
         .unwrap();
@@ -393,14 +271,8 @@ mod tests {
         )
         .unwrap();
 
-        let result = fill_transcripts(
-            &iteration_dir,
-            Harness::Codex,
-            DispatchMechanism::Cli,
-            None,
-            false,
-        )
-        .unwrap();
+        let result =
+            fill_transcripts(&iteration_dir, Harness::resolve("codex").unwrap(), false).unwrap();
         assert_eq!(result.filled, 1);
         assert_eq!(result.missing, 0);
 
@@ -443,14 +315,8 @@ mod tests {
             .unwrap();
         }
 
-        let result = fill_transcripts(
-            &iteration_dir,
-            Harness::Codex,
-            DispatchMechanism::Cli,
-            None,
-            false,
-        )
-        .unwrap();
+        let result =
+            fill_transcripts(&iteration_dir, Harness::resolve("codex").unwrap(), false).unwrap();
         assert_eq!(result.filled, 2);
         assert_eq!(result.missing, 0);
 
diff --git a/src/pipeline/grade/judge_tasks.rs b/src/pipeline/grade/judge_tasks.rs
index 0b760fa..659dd20 100644
--- a/src/pipeline/grade/judge_tasks.rs
+++ b/src/pipeline/grade/judge_tasks.rs
@@ -13,7 +13,7 @@ use std::path::Path;
 use serde::Serialize;
 use serde_json::json;
 
-use crate::core::{Assertion, Harness, RunRecord, SKILL_INVOKED_META_ID, ToolInvocation};
+use crate::core::{Assertion, RunRecord, SKILL_INVOKED_META_ID, ToolInvocation};
 use crate::pipeline::error::PipelineError;
 use crate::pipeline::io::{now_iso8601, write_json};
 use crate::pipeline::slots::run_slots;
@@ -223,7 +223,13 @@ pub fn emit_judge_tasks(ctx: &GradeContext) -> Result<EmitSummary, PipelineError
             )
         })
         .collect();
-    let code_check_available = ctx.conditions.harness != Some(Harness::Codex);
+    // The deterministic `__skill_invoked` code check needs a transcript that
+    // exposes a skill-invocation event; harnesses without one (per their
+    // adapter) fall back to the LLM judge.
+    let code_check_available = ctx
+        .conditions
+        .harness
+        .is_none_or(|h| crate::adapters::adapter_for(h).transcript_surfaces_skill_invocation());
     let default_judge_model = ctx.conditions.judge_model.clone();
 
     let mut tasks: Vec<JudgeTask> = Vec::new();
diff --git a/src/pipeline/mod.rs b/src/pipeline/mod.rs
index 82c889d..1417b3c 100644
--- a/src/pipeline/mod.rs
+++ b/src/pipeline/mod.rs
@@ -21,7 +21,7 @@ pub use detect_stray_writes::{
     detect_stray_writes_report,
 };
 pub use error::PipelineError;
-pub use fill_transcripts::{FillTranscriptsResult, fill_transcripts, resolve_agent_description};
+pub use fill_transcripts::{FillTranscriptsResult, fill_transcripts};
 pub use grade::{GradeContext, emit_judge_tasks, finalize};
 pub use record_runs::{RecordRunsResult, record_runs};
 pub use slots::{RunSlot, run_slots};
diff --git a/src/pipeline/record_runs.rs b/src/pipeline/record_runs.rs
index c97034b..872647e 100644
--- a/src/pipeline/record_runs.rs
+++ b/src/pipeline/record_runs.rs
@@ -5,8 +5,8 @@
 //! from sources already on disk: carry-over fields from the dispatch task, the
 //! `final_message` (from `<outputs_dir>/final-message.md`, falling back to the
 //! transcript's last assistant text), and `tool_invocations`/tokens/duration from
-//! the persisted transcript (Claude Code subagent JSONL or Codex
-//! `codex-events.jsonl`).
+//! each task's events file (`outputs/<harness>-events.jsonl` — Claude Code's
+//! `claude -p` stream-json or Codex's `codex-events.jsonl`).
 //!
 //! Existing records always win: an agent/operator-written `run.json` is skipped
 //! without `overwrite`, and `timing.json` is backfill-only — completion-event
@@ -18,8 +18,8 @@ use std::path::Path;
 
 use serde::Deserialize;
 
-use crate::adapters::{TranscriptSummary, adapter_for, find_by_description};
-use crate::core::{DispatchMechanism, Harness, RunRecord, TimingRecord, TimingSource};
+use crate::adapters::{TranscriptSummary, adapter_for};
+use crate::core::{Harness, RunRecord, TimingRecord, TimingSource};
 use crate::pipeline::error::PipelineError;
 use crate::pipeline::io::write_json;
 use crate::validation::{SchemaName, validate_against_schema};
@@ -44,7 +44,6 @@ struct DispatchTask {
     outputs_dir: String,
     run_record_path: String,
     timing_path: String,
-    agent_description: String,
     #[serde(default)]
     dispatch_prompt_path: String,
 }
@@ -63,14 +62,9 @@ impl RecordRunsResult {
     /// A loud, actionable warning when runs were recorded from `final-message.md`
     /// but their transcripts didn't link — leaving `tool_invocations`/tokens/
     /// duration empty so `transcript_check` assertions silently grade
-    /// unverifiable. `None` when every run matched its transcript. The hint is
-    /// tailored to how the harness correlates transcripts (description match vs.
-    /// the Codex events file).
-    pub fn transcript_warning(
-        &self,
-        harness: Harness,
-        mechanism: DispatchMechanism,
-    ) -> Option<String> {
+    /// unverifiable. `None` when every run matched its transcript. The hint names
+    /// the per-task events file the harness CLI was expected to write.
+    pub fn transcript_warning(&self, harness: Harness) -> Option<String> {
         if self.missing_transcript == 0 {
             return None;
         }
@@ -82,23 +76,10 @@ impl RecordRunsResult {
         } else {
             format!("⚠ {n} run{plural} missing a transcript")
         };
-        // The cause is keyed on the dispatch mechanism, not the harness: a
-        // Cli-dispatch run (Codex, or Claude Code in hybrid/headless) misses the
-        // per-task events file; an in-session run misses the subagent transcript.
-        let cause = match mechanism {
-            DispatchMechanism::Cli => {
-                let file = adapter_for(harness)
-                    .cli_events_filename()
-                    .unwrap_or("the events file");
-                format!("expected `outputs/{file}` was not found")
-            }
-            DispatchMechanism::InSession => {
-                "did you pass each task's `agent_description` verbatim as the subagent \
-                 description? If so, confirm `--subagents-dir` points at the parent session's \
-                 subagents dir"
-                    .to_string()
-            }
-        };
+        let file = adapter_for(harness)
+            .cli_events_filename()
+            .unwrap_or_else(|| "the events file".to_string());
+        let cause = format!("expected `outputs/{file}` was not found");
         Some(format!(
             "{lead} — {cause}; tool_invocations/tokens/duration are empty, so transcript_check \
              assertions will grade unverifiable."
@@ -130,8 +111,6 @@ impl RecordRunsResult {
 pub fn record_runs(
     iteration_dir: &Path,
     harness: Harness,
-    mechanism: DispatchMechanism,
-    subagents_dir: Option<&Path>,
     overwrite: bool,
 ) -> Result<RecordRunsResult, PipelineError> {
     let dispatch_path = iteration_dir.join("dispatch.json");
@@ -148,7 +127,7 @@ pub fn record_runs(
 
     let mut result = RecordRunsResult::default();
     for task in &tasks {
-        let summary = transcript_summary_for_task(harness, mechanism, subagents_dir, task);
+        let summary = transcript_summary_for_task(harness, task);
         if summary.is_none() {
             result.missing_transcript += 1;
         }
@@ -230,7 +209,7 @@ pub fn record_runs(
 /// call returned the prompt's content (its distinctive first-line `sentinel`).
 ///
 /// A run that never references the prompt path is NOT flagged — absence is not
-/// proof of failure (an in-session subagent can receive the prompt another way),
+/// proof of failure (the agent can receive the prompt another way),
 /// and requiring positive evidence keeps the check free of false positives.
 /// Returns `false` when `sentinel` is empty (the prompt file was missing or
 /// unreadable, so the read cannot be judged).
@@ -277,38 +256,18 @@ fn prompt_sentinel(prompt_path: &str) -> String {
         .unwrap_or_default()
 }
 
-/// Resolve a task's transcript summary, keyed on the dispatch mechanism: a
-/// `Cli`-mechanism harness reads the events file its CLI wrote under the task's
-/// outputs dir (e.g. Codex's `codex-events.jsonl`); an `InSession` harness reads
-/// the subagent transcript matched by the task's `agent_description`. Returns
-/// `None` when no transcript is found.
-fn transcript_summary_for_task(
-    harness: Harness,
-    mechanism: DispatchMechanism,
-    subagents_dir: Option<&Path>,
-    task: &DispatchTask,
-) -> Option<TranscriptSummary> {
-    match mechanism {
-        DispatchMechanism::Cli => {
-            let events_path =
-                Path::new(&task.outputs_dir).join(adapter_for(harness).cli_events_filename()?);
-            if !events_path.exists() {
-                return None;
-            }
-            adapter_for(harness)
-                .parse_cli_events_full(&events_path)
-                .ok()
-        }
-        DispatchMechanism::InSession => {
-            let subagent = find_by_description(
-                subagents_dir.unwrap_or_else(|| Path::new("")),
-                &task.agent_description,
-            )?;
-            adapter_for(harness)
-                .parse_transcript_full(&subagent.jsonl_path)
-                .ok()
-        }
-    }
+/// Resolve a task's transcript summary: read the events file the harness CLI
+/// wrote under the task's outputs dir (e.g. Codex's `codex-events.jsonl`, Claude
+/// Code's `claude-events.jsonl`). Returns `None` when no transcript is found.
+fn transcript_summary_for_task(harness: Harness, task: &DispatchTask) -> Option<TranscriptSummary> {
+    let events_path =
+        Path::new(&task.outputs_dir).join(adapter_for(harness).cli_events_filename()?);
+    if !events_path.exists() {
+        return None;
+    }
+    adapter_for(harness)
+        .parse_cli_events_full(&events_path)
+        .ok()
 }
 
 #[cfg(test)]
@@ -318,12 +277,6 @@ mod tests {
     use std::path::PathBuf;
     use tempfile::TempDir;
 
-    /// Token math for `transcript_lines`: msg_1 (100+20+30+50) + msg_2
-    /// (200+40+0+60) = 500.
-    const TRANSCRIPT_TOKENS: i64 = 500;
-    /// 10:00:00.000 → 10:01:00.000.
-    const TRANSCRIPT_DURATION_MS: i64 = 60_000;
-
     fn jsonl(lines: &[Value]) -> String {
         let body = lines
             .iter()
@@ -333,33 +286,6 @@ mod tests {
         format!("{body}\n")
     }
 
-    /// A minimal transcript with usage, timestamps, one tool call, and final text.
-    fn transcript_lines(final_text: &str) -> Vec<Value> {
-        vec![
-            json!({"type": "user", "timestamp": "2026-06-04T10:00:00.000Z", "message": {"role": "user", "content": "go"}}),
-            json!({"type": "assistant", "timestamp": "2026-06-04T10:00:10.000Z", "message": {
-                "id": "msg_1", "role": "assistant",
-                "usage": {"input_tokens": 100, "output_tokens": 20, "cache_creation_input_tokens": 30, "cache_read_input_tokens": 50},
-                "content": [{"type": "tool_use", "id": "toolu_1", "name": "Bash", "input": {"command": "ls"}}]
-            }}),
-            json!({"type": "user", "timestamp": "2026-06-04T10:00:12.000Z", "message": {"role": "user", "content": [{"type": "tool_result", "tool_use_id": "toolu_1", "content": "ok"}]}}),
-            json!({"type": "assistant", "timestamp": "2026-06-04T10:01:00.000Z", "message": {
-                "id": "msg_2", "role": "assistant",
-                "usage": {"input_tokens": 200, "output_tokens": 40, "cache_creation_input_tokens": 0, "cache_read_input_tokens": 60},
-                "content": [{"type": "text", "text": final_text}]
-            }}),
-        ]
-    }
-
-    fn write_subagent(subagents_dir: &Path, name: &str, description: &str, lines: &[Value]) {
-        fs::write(
-            subagents_dir.join(format!("{name}.meta.json")),
-            json!({"agentType": "general-purpose", "description": description}).to_string(),
-        )
-        .unwrap();
-        fs::write(subagents_dir.join(format!("{name}.jsonl")), jsonl(lines)).unwrap();
-    }
-
     fn write_codex_events(outputs_dir: &Path, final_text: &str) {
         let lines = vec![
             json!({"type": "thread.started", "timestamp": "2026-06-04T10:00:00.000Z"}),
@@ -438,14 +364,7 @@ mod tests {
             "I could not read the prompt file.",
         );
 
-        let result = record_runs(
-            iter,
-            Harness::ClaudeCode,
-            DispatchMechanism::Cli,
-            None,
-            false,
-        )
-        .unwrap();
+        let result = record_runs(iter, Harness::resolve("claude-code").unwrap(), false).unwrap();
 
         assert_eq!(result.skipped_prompt_unread, 1);
         assert_eq!(result.recorded, 0);
@@ -482,14 +401,7 @@ mod tests {
             "Done.",
         );
 
-        let result = record_runs(
-            iter,
-            Harness::ClaudeCode,
-            DispatchMechanism::Cli,
-            None,
-            false,
-        )
-        .unwrap();
+        let result = record_runs(iter, Harness::resolve("claude-code").unwrap(), false).unwrap();
 
         assert_eq!(result.recorded, 1);
         assert_eq!(result.skipped_prompt_unread, 0);
@@ -591,20 +503,18 @@ mod tests {
             .exists()
     }
 
-    /// `(iteration_dir, subagents_dir)` under a fresh temp root.
-    fn dirs(root: &TempDir) -> (PathBuf, PathBuf) {
+    /// The iteration dir under a fresh temp root.
+    fn dirs(root: &TempDir) -> PathBuf {
         let iteration_dir = root.path().join("iter");
-        let subagents_dir = root.path().join("sub");
         fs::create_dir_all(&iteration_dir).unwrap();
-        fs::create_dir_all(&subagents_dir).unwrap();
-        (iteration_dir, subagents_dir)
+        iteration_dir
     }
 
     #[test]
     fn assembles_run_and_timing_for_every_task_from_disk() {
         let root = TempDir::new().unwrap();
-        let (iter, sub) = dirs(&root);
-        write_iteration(
+        let iter = dirs(&root);
+        let paths = write_iteration(
             &iter,
             &[
                 FixtureTask {
@@ -619,27 +529,10 @@ mod tests {
                 },
             ],
         );
-        write_subagent(
-            &sub,
-            "agent-a",
-            "crash:with_skill:i1-nonce1",
-            &transcript_lines("unused"),
-        );
-        write_subagent(
-            &sub,
-            "agent-b",
-            "crash:without_skill:i1-nonce1",
-            &transcript_lines("unused"),
-        );
+        write_claude_events(&paths[0].outputs_dir, "unused");
+        write_claude_events(&paths[1].outputs_dir, "unused");
 
-        let result = record_runs(
-            &iter,
-            Harness::ClaudeCode,
-            DispatchMechanism::InSession,
-            Some(&sub),
-            false,
-        )
-        .unwrap();
+        let result = record_runs(&iter, Harness::resolve("claude-code").unwrap(), false).unwrap();
         assert_eq!(result.recorded, 2);
         assert_eq!(result.missing_transcript, 0);
 
@@ -661,15 +554,15 @@ mod tests {
         );
 
         let timing = read_timing_value(&iter, "crash", "with_skill");
-        assert_eq!(timing["total_tokens"], json!(TRANSCRIPT_TOKENS));
-        assert_eq!(timing["duration_ms"], json!(TRANSCRIPT_DURATION_MS));
+        assert_eq!(timing["total_tokens"], json!(125));
+        assert_eq!(timing["duration_ms"], json!(30_000));
         assert_eq!(timing["source"], json!("transcript"));
     }
 
     #[test]
     fn carries_run_index_from_dispatch_task_into_each_run_record() {
         let root = TempDir::new().unwrap();
-        let (iter, _sub) = dirs(&root);
+        let iter = dirs(&root);
         let cond_dir = iter.join("eval-crash").join("with_skill");
         let mut serialized = Vec::new();
         for k in [1u32, 2] {
@@ -702,8 +595,7 @@ mod tests {
         )
         .unwrap();
 
-        let result =
-            record_runs(&iter, Harness::Codex, DispatchMechanism::Cli, None, false).unwrap();
+        let result = record_runs(&iter, Harness::resolve("codex").unwrap(), false).unwrap();
         assert_eq!(result.recorded, 2);
 
         for k in [1u32, 2] {
@@ -718,7 +610,7 @@ mod tests {
     #[test]
     fn assembles_codex_records_from_each_tasks_events() {
         let root = TempDir::new().unwrap();
-        let (iter, _sub) = dirs(&root);
+        let iter = dirs(&root);
         let paths = write_iteration(
             &iter,
             &[FixtureTask {
@@ -729,8 +621,7 @@ mod tests {
         );
         write_codex_events(&paths[0].outputs_dir, "Codex final.");
 
-        let result =
-            record_runs(&iter, Harness::Codex, DispatchMechanism::Cli, None, false).unwrap();
+        let result = record_runs(&iter, Harness::resolve("codex").unwrap(), false).unwrap();
         assert_eq!(result.recorded, 1);
         assert_eq!(result.missing_transcript, 0);
 
@@ -751,7 +642,7 @@ mod tests {
     #[test]
     fn falls_back_to_codex_final_agent_message_when_final_message_md_missing() {
         let root = TempDir::new().unwrap();
-        let (iter, _sub) = dirs(&root);
+        let iter = dirs(&root);
         let paths = write_iteration(
             &iter,
             &[FixtureTask {
@@ -762,8 +653,7 @@ mod tests {
         );
         write_codex_events(&paths[0].outputs_dir, "Closing summary from Codex.");
 
-        let result =
-            record_runs(&iter, Harness::Codex, DispatchMechanism::Cli, None, false).unwrap();
+        let result = record_runs(&iter, Harness::resolve("codex").unwrap(), false).unwrap();
         assert_eq!(result.recorded, 1);
         assert_eq!(
             read_run(&iter, "crash", "with_skill").final_message,
@@ -774,7 +664,7 @@ mod tests {
     #[test]
     fn skips_existing_run_without_overwrite_then_replaces_with_it() {
         let root = TempDir::new().unwrap();
-        let (iter, sub) = dirs(&root);
+        let iter = dirs(&root);
         let paths = write_iteration(
             &iter,
             &[FixtureTask {
@@ -783,12 +673,7 @@ mod tests {
                 final_message: Some("New."),
             }],
         );
-        write_subagent(
-            &sub,
-            "agent-a",
-            "crash:with_skill:i1-nonce1",
-            &transcript_lines("unused"),
-        );
+        write_claude_events(&paths[0].outputs_dir, "unused");
         let hand_written = json!({
             "eval_id": "crash", "condition": "with_skill",
             "skill_path": "/staged/skill/SKILL.md", "prompt": "Do the crash task",
@@ -796,14 +681,7 @@ mod tests {
         });
         fs::write(&paths[0].run_record_path, hand_written.to_string()).unwrap();
 
-        let skipped = record_runs(
-            &iter,
-            Harness::ClaudeCode,
-            DispatchMechanism::InSession,
-            Some(&sub),
-            false,
-        )
-        .unwrap();
+        let skipped = record_runs(&iter, Harness::resolve("claude-code").unwrap(), false).unwrap();
         assert_eq!(skipped.recorded, 0);
         assert_eq!(skipped.skipped_existing, 1);
         assert_eq!(
@@ -811,14 +689,7 @@ mod tests {
             "Agent-authored."
         );
 
-        let replaced = record_runs(
-            &iter,
-            Harness::ClaudeCode,
-            DispatchMechanism::InSession,
-            Some(&sub),
-            true,
-        )
-        .unwrap();
+        let replaced = record_runs(&iter, Harness::resolve("claude-code").unwrap(), true).unwrap();
         assert_eq!(replaced.recorded, 1);
         assert_eq!(read_run(&iter, "crash", "with_skill").final_message, "New.");
     }
@@ -826,7 +697,7 @@ mod tests {
     #[test]
     fn backfills_timing_only_when_absent() {
         let root = TempDir::new().unwrap();
-        let (iter, sub) = dirs(&root);
+        let iter = dirs(&root);
         let paths = write_iteration(
             &iter,
             &[FixtureTask {
@@ -835,26 +706,14 @@ mod tests {
                 final_message: Some("Done."),
             }],
         );
-        write_subagent(
-            &sub,
-            "agent-a",
-            "crash:with_skill:i1-nonce1",
-            &transcript_lines("unused"),
-        );
+        write_claude_events(&paths[0].outputs_dir, "unused");
         fs::write(
             &paths[0].timing_path,
             json!({"total_tokens": 12345, "duration_ms": 9000}).to_string(),
         )
         .unwrap();
 
-        record_runs(
-            &iter,
-            Harness::ClaudeCode,
-            DispatchMechanism::InSession,
-            Some(&sub),
-            false,
-        )
-        .unwrap();
+        record_runs(&iter, Harness::resolve("claude-code").unwrap(), false).unwrap();
 
         // Agent-captured completion-event timing wins; not overwritten.
         let timing = read_timing_value(&iter, "crash", "with_skill");
@@ -863,44 +722,10 @@ mod tests {
         assert!(timing.get("source").is_none());
     }
 
-    #[test]
-    fn falls_back_to_transcript_final_assistant_text_when_final_message_md_missing() {
-        let root = TempDir::new().unwrap();
-        let (iter, sub) = dirs(&root);
-        write_iteration(
-            &iter,
-            &[FixtureTask {
-                eval_id: "crash",
-                condition: "with_skill",
-                final_message: None,
-            }],
-        );
-        write_subagent(
-            &sub,
-            "agent-a",
-            "crash:with_skill:i1-nonce1",
-            &transcript_lines("Closing summary from transcript."),
-        );
-
-        let result = record_runs(
-            &iter,
-            Harness::ClaudeCode,
-            DispatchMechanism::InSession,
-            Some(&sub),
-            false,
-        )
-        .unwrap();
-        assert_eq!(result.recorded, 1);
-        assert_eq!(
-            read_run(&iter, "crash", "with_skill").final_message,
-            "Closing summary from transcript."
-        );
-    }
-
     #[test]
     fn skips_the_slot_entirely_when_no_final_message_source_exists() {
         let root = TempDir::new().unwrap();
-        let (iter, sub) = dirs(&root);
+        let iter = dirs(&root);
         write_iteration(
             &iter,
             &[FixtureTask {
@@ -911,14 +736,7 @@ mod tests {
         );
         // No final-message.md, no transcript.
 
-        let result = record_runs(
-            &iter,
-            Harness::ClaudeCode,
-            DispatchMechanism::InSession,
-            Some(&sub),
-            false,
-        )
-        .unwrap();
+        let result = record_runs(&iter, Harness::resolve("claude-code").unwrap(), false).unwrap();
         assert_eq!(result.recorded, 0);
         assert_eq!(result.skipped_no_final_message, 1);
         assert!(!run_exists(&iter, "crash", "with_skill"));
@@ -928,7 +746,7 @@ mod tests {
     #[test]
     fn writes_empty_invocations_and_no_timing_when_transcript_missing() {
         let root = TempDir::new().unwrap();
-        let (iter, sub) = dirs(&root);
+        let iter = dirs(&root);
         write_iteration(
             &iter,
             &[FixtureTask {
@@ -937,16 +755,9 @@ mod tests {
                 final_message: Some("Done."),
             }],
         );
-        // final-message.md exists but no subagent transcript matches.
+        // final-message.md exists but no events file is present.
 
-        let result = record_runs(
-            &iter,
-            Harness::ClaudeCode,
-            DispatchMechanism::InSession,
-            Some(&sub),
-            false,
-        )
-        .unwrap();
+        let result = record_runs(&iter, Harness::resolve("claude-code").unwrap(), false).unwrap();
         assert_eq!(result.recorded, 1);
         assert_eq!(result.missing_transcript, 1);
 
@@ -959,16 +770,9 @@ mod tests {
     #[test]
     fn errors_when_dispatch_json_is_absent() {
         let root = TempDir::new().unwrap();
-        let (iter, sub) = dirs(&root);
+        let iter = dirs(&root);
         // Hand-authored/operator runs have no dispatch.json — the manual path owns them.
-        let err = record_runs(
-            &iter,
-            Harness::ClaudeCode,
-            DispatchMechanism::InSession,
-            Some(&sub),
-            false,
-        )
-        .unwrap_err();
+        let err = record_runs(&iter, Harness::resolve("claude-code").unwrap(), false).unwrap_err();
         assert!(
             err.to_string().contains("dispatch.json"),
             "error was: {err}"
@@ -984,36 +788,11 @@ mod tests {
         };
         assert!(
             result
-                .transcript_warning(Harness::ClaudeCode, DispatchMechanism::InSession)
+                .transcript_warning(Harness::resolve("claude-code").unwrap())
                 .is_none()
         );
     }
 
-    #[test]
-    fn claude_code_warning_names_agent_description_when_all_runs_miss() {
-        let result = RecordRunsResult {
-            recorded: 8,
-            missing_transcript: 8,
-            ..Default::default()
-        };
-        let warning = result
-            .transcript_warning(Harness::ClaudeCode, DispatchMechanism::InSession)
-            .unwrap();
-        assert!(warning.contains("8"), "names the count: {warning}");
-        assert!(
-            warning.contains("agent_description"),
-            "points at the load-bearing key: {warning}"
-        );
-        assert!(
-            warning.to_lowercase().contains("verbatim"),
-            "says pass it verbatim: {warning}"
-        );
-        assert!(
-            warning.contains("--subagents-dir"),
-            "offers the other likely cause: {warning}"
-        );
-    }
-
     #[test]
     fn claude_code_warning_fires_on_partial_miss() {
         let result = RecordRunsResult {
@@ -1022,7 +801,7 @@ mod tests {
             ..Default::default()
         };
         let warning = result
-            .transcript_warning(Harness::ClaudeCode, DispatchMechanism::InSession)
+            .transcript_warning(Harness::resolve("claude-code").unwrap())
             .unwrap();
         assert!(warning.contains('1'), "names the count: {warning}");
     }
@@ -1035,7 +814,7 @@ mod tests {
             ..Default::default()
         };
         let warning = result
-            .transcript_warning(Harness::Codex, DispatchMechanism::Cli)
+            .transcript_warning(Harness::resolve("codex").unwrap())
             .unwrap();
         assert!(
             warning.contains("codex-events.jsonl"),
@@ -1048,9 +827,9 @@ mod tests {
     }
 
     #[test]
-    fn assembles_claude_hybrid_records_from_each_tasks_events() {
+    fn assembles_claude_records_from_each_tasks_events() {
         let root = TempDir::new().unwrap();
-        let (iter, _sub) = dirs(&root);
+        let iter = dirs(&root);
         let paths = write_iteration(
             &iter,
             &[FixtureTask {
@@ -1061,14 +840,7 @@ mod tests {
         );
         write_claude_events(&paths[0].outputs_dir, "Closing summary.");
 
-        let result = record_runs(
-            &iter,
-            Harness::ClaudeCode,
-            DispatchMechanism::Cli,
-            None,
-            false,
-        )
-        .unwrap();
+        let result = record_runs(&iter, Harness::resolve("claude-code").unwrap(), false).unwrap();
         assert_eq!(result.recorded, 1);
         assert_eq!(result.missing_transcript, 0);
 
@@ -1091,7 +863,7 @@ mod tests {
         // Claude `-p` has no --output-last-message, so the result event's text is
         // the primary final-message source.
         let root = TempDir::new().unwrap();
-        let (iter, _sub) = dirs(&root);
+        let iter = dirs(&root);
         let paths = write_iteration(
             &iter,
             &[FixtureTask {
@@ -1102,14 +874,7 @@ mod tests {
         );
         write_claude_events(&paths[0].outputs_dir, "Closing summary from claude -p.");
 
-        let result = record_runs(
-            &iter,
-            Harness::ClaudeCode,
-            DispatchMechanism::Cli,
-            None,
-            false,
-        )
-        .unwrap();
+        let result = record_runs(&iter, Harness::resolve("claude-code").unwrap(), false).unwrap();
         assert_eq!(result.recorded, 1);
         assert_eq!(
             read_run(&iter, "crash", "with_skill").final_message,
@@ -1118,22 +883,22 @@ mod tests {
     }
 
     #[test]
-    fn claude_hybrid_warning_points_at_events_file() {
+    fn claude_warning_points_at_events_file() {
         let result = RecordRunsResult {
             recorded: 2,
             missing_transcript: 2,
             ..Default::default()
         };
         let warning = result
-            .transcript_warning(Harness::ClaudeCode, DispatchMechanism::Cli)
+            .transcript_warning(Harness::resolve("claude-code").unwrap())
             .unwrap();
         assert!(
             warning.contains("claude-events.jsonl"),
-            "names the Claude hybrid source: {warning}"
+            "names the Claude CLI events source: {warning}"
         );
         assert!(
             !warning.contains("agent_description"),
-            "hybrid doesn't use agent_description: {warning}"
+            "CLI dispatch doesn't use agent_description: {warning}"
         );
     }
 }
diff --git a/src/sandbox/decide.rs b/src/sandbox/decide.rs
index ba417a2..c036a33 100644
--- a/src/sandbox/decide.rs
+++ b/src/sandbox/decide.rs
@@ -10,7 +10,10 @@ use chrono::DateTime;
 use serde::Deserialize;
 use serde_json::Value;
 
-use super::policy::{apply_patch_paths, classify_bash, is_under_any, is_write_tool, path_arg};
+use super::policy::{
+    apply_patch_paths, classify_bash, is_patch_tool, is_shell_tool, is_under_any, is_write_tool,
+    path_arg,
+};
 
 /// The staged marker file that arms the guard. The guard is a no-op unless this
 /// file exists, is active, and has not expired — so a crashed run that never tore
@@ -101,31 +104,30 @@ pub fn decide(
         return GuardDecision::allow();
     }
 
-    if tool_name == "apply_patch" {
+    if is_patch_tool(tool_name) {
         let paths = apply_patch_paths(tool_input);
         if paths.is_empty() {
-            return GuardDecision::deny(
-                "eval guard: blocked apply_patch because no patch target path could be determined"
-                    .to_string(),
-            );
+            return GuardDecision::deny(format!(
+                "eval guard: blocked {tool_name} because no patch target path could be determined"
+            ));
         }
         if let Some(path) = paths.iter().find(|p| !is_under_any(p, &roots, &repo_root)) {
             return GuardDecision::deny(format!(
-                "eval guard: apply_patch target {path} is outside the eval sandbox (allowed: {})",
+                "eval guard: {tool_name} target {path} is outside the eval sandbox (allowed: {})",
                 roots.join(", ")
             ));
         }
         return GuardDecision::allow();
     }
 
-    if tool_name == "Bash" {
+    if is_shell_tool(tool_name) {
         let command = tool_input
             .get("command")
             .and_then(Value::as_str)
             .unwrap_or("");
         if let Some(reason) = classify_bash(command, &roots) {
             return GuardDecision::deny(format!(
-                "eval guard: blocked Bash ({reason}) — runs outside the eval sandbox"
+                "eval guard: blocked {tool_name} ({reason}) — runs outside the eval sandbox"
             ));
         }
     }
@@ -362,6 +364,81 @@ mod tests {
         assert!(d.allow);
     }
 
+    #[test]
+    fn denies_bash_that_creates_a_path_under_dot_codex_via_non_redirect_verb() {
+        assert!(
+            !decide_now(
+                "Bash",
+                json!({ "command": "mkdir -p .codex/foo" }),
+                Some(&marker())
+            )
+            .allow
+        );
+        assert!(
+            !decide_now(
+                "Bash",
+                json!({ "command": "cp evil.json .codex/hooks.json" }),
+                Some(&marker())
+            )
+            .allow
+        );
+    }
+
+    #[test]
+    fn denies_bash_that_creates_a_path_under_dot_agents_via_non_redirect_verb() {
+        assert!(
+            !decide_now(
+                "Bash",
+                json!({ "command": "mkdir -p .agents/foo" }),
+                Some(&marker())
+            )
+            .allow
+        );
+    }
+
+    #[test]
+    fn denies_bash_that_creates_a_path_under_dot_opencode_via_non_redirect_verb() {
+        assert!(
+            !decide_now(
+                "Bash",
+                json!({ "command": "touch .opencode/opencode.json" }),
+                Some(&marker())
+            )
+            .allow
+        );
+    }
+
+    #[test]
+    fn still_allows_reads_of_other_harness_config_dirs_with_no_create_verb() {
+        for command in [
+            "cat .codex/hooks.json",
+            "ls .agents",
+            "cat .opencode/skills/x/SKILL.md",
+        ] {
+            assert!(
+                decide_now("Bash", json!({ "command": command }), Some(&marker())).allow,
+                "{command} should stay allowed"
+            );
+        }
+    }
+
+    #[test]
+    fn allows_a_create_scoped_to_a_codex_skills_staging_root() {
+        let codex_marker = GuardMarker {
+            allowed_roots: Some(vec![
+                "/work/.eval-magic".to_string(),
+                "/work/.agents/skills".to_string(),
+            ]),
+            ..marker()
+        };
+        let d = decide_now(
+            "Bash",
+            json!({ "command": "mkdir -p /work/.agents/skills/staged-x" }),
+            Some(&codex_marker),
+        );
+        assert!(d.allow);
+    }
+
     #[test]
     fn does_not_flag_a_skills_prefixed_dir_as_a_bare_skills_write() {
         // A `skills`-prefixed path that is NOT an allowed root: the bare-`skills/`
diff --git a/src/sandbox/guard.rs b/src/sandbox/guard.rs
index 51af2db..43687f1 100644
--- a/src/sandbox/guard.rs
+++ b/src/sandbox/guard.rs
@@ -1,17 +1,17 @@
-//! Guard hook evaluation.
+//! Shared guard-hook plumbing.
 //!
-//! Library logic behind the binary's hidden `guard` subcommand: the CLI handler
-//! reads the hook payload from stdin and the marker path from argv, calls
-//! [`guard_decision`], and writes any deny verdict to stdout. Both layers fail
-//! open — a malformed payload or unreadable marker yields "allow", so the guard
-//! can never brick a session.
+//! The harness-specific verdict shaping lives with each harness's guard module
+//! (`crate::adapters::<harness>::guard`): the CLI handler reads the hook
+//! payload from stdin and the marker path from argv, and the harness guard
+//! calls [`parse_tool_call`] + `decide` to evaluate it. Both layers fail open —
+//! a malformed payload or unreadable marker yields "allow", so the guard can
+//! never brick a session.
 
 use std::path::Path;
 
-use serde_json::{Map, Value, json};
+use serde_json::{Map, Value};
 
-use super::decide::{GuardMarker, decide};
-use super::now_ms;
+use super::decide::GuardMarker;
 
 /// Read and parse the guard marker. Missing or unparseable → `None` (the guard
 /// then allows everything — fail open).
@@ -20,48 +20,10 @@ pub fn read_marker(path: &Path) -> Option<GuardMarker> {
     serde_json::from_str(&text).ok()
 }
 
-/// Evaluate a PreToolUse hook `payload` (the JSON the harness sends on stdin)
-/// against `marker`. Returns the serialized deny verdict to print on stdout when
-/// the call is blocked, or `None` to allow (print nothing). An empty or malformed
-/// payload is treated as allow.
-pub fn guard_decision(payload: &str, marker: Option<GuardMarker>) -> Option<String> {
-    let (tool_name, tool_input) = parse_tool_call(payload)?;
-
-    let decision = decide(&tool_name, &tool_input, marker.as_ref(), now_ms());
-    if decision.allow {
-        return None;
-    }
-    Some(
-        serde_json::to_string(&json!({
-            "hookSpecificOutput": {
-                "hookEventName": "PreToolUse",
-                "permissionDecision": "deny",
-                "permissionDecisionReason": decision.reason,
-            }
-        }))
-        .expect("deny verdict serializes"),
-    )
-}
-
-/// Codex's hook contract blocks by returning `{ "decision": "block", "reason":
-/// "..." }` on stdout. Keep this separate from Claude Code's
-/// `hookSpecificOutput` shape so both harnesses use their native conventions.
-pub fn codex_guard_decision(payload: &str, marker: Option<GuardMarker>) -> Option<String> {
-    let (tool_name, tool_input) = parse_tool_call(payload)?;
-    let decision = decide(&tool_name, &tool_input, marker.as_ref(), now_ms());
-    if decision.allow {
-        return None;
-    }
-    Some(
-        serde_json::to_string(&json!({
-            "decision": "block",
-            "reason": decision.reason,
-        }))
-        .expect("Codex block verdict serializes"),
-    )
-}
-
-fn parse_tool_call(payload: &str) -> Option<(String, Value)> {
+/// Extract the tool name + input from a PreToolUse hook payload (the JSON the
+/// harness sends on stdin). `None` for an empty or malformed payload — treated
+/// as allow by every caller.
+pub(crate) fn parse_tool_call(payload: &str) -> Option<(String, Value)> {
     let trimmed = payload.trim();
     let parsed: Value =
         serde_json::from_str(if trimmed.is_empty() { "{}" } else { trimmed }).ok()?;
@@ -109,74 +71,3 @@ fn merge_top_level_files(input: Value, parsed: &Value) -> Value {
         other => other,
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// A live marker (active, no expiry → unexpired) scoped to one root.
-    fn marker() -> GuardMarker {
-        GuardMarker {
-            active: Some(true),
-            allowed_roots: Some(vec!["/work/.eval-magic".to_string()]),
-            expires_at: None,
-        }
-    }
-
-    #[test]
-    fn allows_returns_none() {
-        let payload = r#"{ "tool_name": "Read", "tool_input": { "file_path": "/etc/passwd" } }"#;
-        assert_eq!(guard_decision(payload, Some(marker())), None);
-    }
-
-    #[test]
-    fn deny_returns_pretooluse_deny_json() {
-        let payload = r#"{ "tool_name": "Write", "tool_input": { "file_path": "/etc/passwd" } }"#;
-        let out = guard_decision(payload, Some(marker())).expect("should deny");
-        let v: Value = serde_json::from_str(&out).unwrap();
-        assert_eq!(v["hookSpecificOutput"]["hookEventName"], "PreToolUse");
-        assert_eq!(v["hookSpecificOutput"]["permissionDecision"], "deny");
-        assert!(
-            v["hookSpecificOutput"]["permissionDecisionReason"]
-                .as_str()
-                .unwrap()
-                .contains("outside")
-        );
-    }
-
-    #[test]
-    fn no_marker_allows_everything() {
-        let payload = r#"{ "tool_name": "Write", "tool_input": { "file_path": "/etc/passwd" } }"#;
-        assert_eq!(guard_decision(payload, None), None);
-    }
-
-    #[test]
-    fn codex_deny_returns_decision_block_json() {
-        let payload = r#"{ "hook_event_name": "PreToolUse", "tool_name": "Bash", "tool_input": { "command": "npm install left-pad" } }"#;
-        let out = codex_guard_decision(payload, Some(marker())).expect("should block");
-        let v: Value = serde_json::from_str(&out).unwrap();
-        assert_eq!(v["decision"], "block");
-        assert!(v["reason"].as_str().unwrap().contains("blocked Bash"));
-    }
-
-    #[test]
-    fn codex_apply_patch_outside_allowed_roots_blocks() {
-        let payload = r#"{ "hook_event_name": "PreToolUse", "tool_name": "apply_patch", "tool_input": { "files": ["/etc/passwd"] } }"#;
-        let out = codex_guard_decision(payload, Some(marker())).expect("should block");
-        let v: Value = serde_json::from_str(&out).unwrap();
-        assert_eq!(v["decision"], "block");
-        assert!(v["reason"].as_str().unwrap().contains("apply_patch"));
-    }
-
-    #[test]
-    fn codex_apply_patch_inside_allowed_roots_allows() {
-        let payload = r#"{ "hook_event_name": "PreToolUse", "tool_name": "apply_patch", "tool_input": { "files": ["/work/.eval-magic/out.md"] } }"#;
-        assert_eq!(codex_guard_decision(payload, Some(marker())), None);
-    }
-
-    #[test]
-    fn empty_or_malformed_payload_fails_open() {
-        assert_eq!(guard_decision("", Some(marker())), None);
-        assert_eq!(guard_decision("not json", Some(marker())), None);
-    }
-}
diff --git a/src/sandbox/install.rs b/src/sandbox/install.rs
index 6f9d774..530842f 100644
--- a/src/sandbox/install.rs
+++ b/src/sandbox/install.rs
@@ -1,9 +1,10 @@
-//! Arm / disarm the write guard.
+//! Shared write-guard arm/disarm machinery.
 //!
-//! [`install_guard`] writes a marker listing the allowed roots and merges a
-//! `PreToolUse` hook into the target harness's project config. The original hook
-//! file is backed up verbatim in a manifest so [`teardown_guard`] restores it
-//! exactly.
+//! Each harness's installer (in its adapter module, e.g.
+//! `crate::adapters::claude_code::guard`) writes a marker listing the allowed
+//! roots and merges a `PreToolUse` hook into that harness's project config,
+//! using the marker/manifest helpers here. The original hook file is backed up
+//! verbatim in a manifest so [`teardown_guard`] restores it exactly.
 //!
 //! The hook command points at the running binary (`std::env::current_exe`), so
 //! there is no separate hook script to ship and no interpreter to select.
@@ -15,7 +16,10 @@ use std::time::Duration;
 
 use chrono::{DateTime, SecondsFormat};
 use serde::{Deserialize, Serialize};
-use serde_json::{Value, json};
+use serde_json::Value;
+use serde_json::json;
+
+use crate::core::Harness;
 
 use super::now_ms;
 use super::{guard::read_marker, marker_is_armed};
@@ -29,11 +33,6 @@ pub const GUARD_MANIFEST: &str = ".slow-powers-eval-guard-manifest.json";
 /// linger before it is treated as expired (see `super::decide`).
 const GUARD_TTL: Duration = Duration::from_secs(6 * 60 * 60); // 6h
 
-/// Tool names the Claude Code PreToolUse hook fires on.
-const CLAUDE_HOOK_MATCHER: &str = "Write|Edit|MultiEdit|NotebookEdit|Bash";
-/// Tool names the Codex PreToolUse hook fires on.
-const CODEX_HOOK_MATCHER: &str = "^Bash$|^apply_patch$|^Edit$|^Write$";
-
 /// Restoration record written beside the marker. The field names are the
 /// on-disk manifest format — keep them stable so older manifests stay readable.
 #[derive(Debug, Serialize, Deserialize)]
@@ -47,7 +46,7 @@ struct GuardManifest {
 
 /// Format epoch milliseconds as `2026-06-08T12:00:00.000Z` — RFC 3339 with
 /// millisecond precision, the timestamp format every artifact uses.
-fn iso_millis(ms: i64) -> String {
+pub(crate) fn iso_millis(ms: i64) -> String {
     DateTime::from_timestamp_millis(ms)
         .unwrap_or_default()
         .to_rfc3339_opts(SecondsFormat::Millis, true)
@@ -61,7 +60,7 @@ fn absolutize(p: &Path) -> PathBuf {
 
 /// Write `value` as 2-space-pretty JSON with a trailing newline — the stable
 /// on-disk format for every artifact this binary writes.
-fn write_json(path: &Path, value: &Value) -> io::Result<()> {
+pub(crate) fn write_json(path: &Path, value: &Value) -> io::Result<()> {
     let mut text = serde_json::to_string_pretty(value)
         .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;
     text.push('\n');
@@ -69,14 +68,14 @@ fn write_json(path: &Path, value: &Value) -> io::Result<()> {
 }
 
 /// The guard's allowed write roots: the isolated env (`stage_root`, the
-/// agent-under-test's cwd) and the OS temp dir. The staged skills dir
-/// (`stage_root/.claude/skills` or `.agents/skills`) and the per-task outputs dir
-/// both live *inside* `stage_root`, so a single env root covers every legitimate
-/// agent write. Scoping to the env — not the parent `.eval-magic/` — keeps the
-/// guard boundary identical to the isolation boundary: the agent can't reach a
-/// sibling iteration or the `iteration-N/` meta tree above its cwd. eval-magic's own
-/// above-env writes (e.g. `benchmark.json`) are not gated here: they run as
-/// non-mutating `eval-magic` subprocesses the guard's Bash classifier passes.
+/// agent-under-test's cwd) and the OS temp dir. The staged skills dir and the
+/// per-task outputs dir both live *inside* `stage_root`, so a single env root
+/// covers every legitimate agent write. Scoping to the env — not the parent
+/// `.eval-magic/` — keeps the guard boundary identical to the isolation
+/// boundary: the agent can't reach a sibling iteration or the `iteration-N/`
+/// meta tree above its cwd. eval-magic's own above-env writes (e.g.
+/// `benchmark.json`) are not gated here: they run as non-mutating `eval-magic`
+/// subprocesses the guard's Bash classifier passes.
 fn marker_allowed_roots(stage_root: &Path) -> Vec<String> {
     vec![
         absolutize(stage_root).display().to_string(),
@@ -84,7 +83,14 @@ fn marker_allowed_roots(stage_root: &Path) -> Vec<String> {
     ]
 }
 
-fn write_marker(marker_path: &Path, stage_root: &Path, ttl: Option<Duration>) -> io::Result<()> {
+/// Write the guard marker that arms the hook for `stage_root`. The guard is a
+/// no-op until this marker exists and is unexpired, so the hook is inert
+/// outside an active run. `ttl` overrides the default 6h lifetime.
+pub(crate) fn write_marker(
+    marker_path: &Path,
+    stage_root: &Path,
+    ttl: Option<Duration>,
+) -> io::Result<()> {
     let expires_ms = now_ms() + ttl.unwrap_or(GUARD_TTL).as_millis() as i64;
     write_json(
         marker_path,
@@ -96,7 +102,8 @@ fn write_marker(marker_path: &Path, stage_root: &Path, ttl: Option<Duration>) ->
     )
 }
 
-fn write_manifest(
+/// Write the restoration manifest recording what install changed.
+pub(crate) fn write_manifest(
     manifest_path: &Path,
     settings_path: &Path,
     settings_existed: bool,
@@ -117,163 +124,37 @@ fn write_manifest(
     )
 }
 
-/// Arm the write guard for an eval run. Returns the marker path. The guard is a
-/// no-op until this marker exists and is unexpired, so the hook is inert outside
-/// an active run. `guard_exe` is the path the hook invokes (normally
-/// `std::env::current_exe()`); `ttl` overrides the default 6h lifetime.
-pub fn install_guard(
-    stage_root: &Path,
-    guard_exe: &Path,
-    ttl: Option<Duration>,
-) -> io::Result<PathBuf> {
-    install_claude_guard(stage_root, guard_exe, ttl)
-}
-
-pub(crate) fn install_claude_guard(
-    stage_root: &Path,
-    guard_exe: &Path,
-    ttl: Option<Duration>,
-) -> io::Result<PathBuf> {
-    let skills_dir = stage_root.join(".claude").join("skills");
-    fs::create_dir_all(&skills_dir)?;
-
-    let marker_path = skills_dir.join(GUARD_MARKER);
-    write_marker(&marker_path, stage_root, ttl)?;
-
-    let settings_path = stage_root.join(".claude").join("settings.local.json");
-    let settings_existed = settings_path.exists();
-    let backup = if settings_existed {
-        Some(fs::read_to_string(&settings_path)?)
-    } else {
-        None
-    };
-
-    // Start from the existing settings (or an empty object), preserving key
-    // order, then append the PreToolUse hook entry.
-    let mut settings: Value = backup
-        .as_deref()
-        .and_then(|s| serde_json::from_str(s).ok())
-        .unwrap_or_else(|| json!({}));
-    let hooks = settings
-        .as_object_mut()
-        .expect("settings is a JSON object")
-        .entry("hooks")
-        .or_insert_with(|| json!({}));
-    let pre = hooks
-        .as_object_mut()
-        .expect("hooks is a JSON object")
-        .entry("PreToolUse")
-        .or_insert_with(|| json!([]));
-    let command = format!(
-        "\"{}\" guard \"{}\"",
-        guard_exe.display(),
-        marker_path.display()
-    );
-    pre.as_array_mut()
-        .expect("PreToolUse is an array")
-        .push(json!({
-            "matcher": CLAUDE_HOOK_MATCHER,
-            "hooks": [ { "type": "command", "command": command } ],
-        }));
-    write_json(&settings_path, &settings)?;
-
-    write_manifest(
-        &skills_dir.join(GUARD_MANIFEST),
-        &settings_path,
-        settings_existed,
-        backup,
-        &marker_path,
-    )?;
-
-    Ok(marker_path)
-}
-
-pub(crate) fn install_codex_guard(
-    stage_root: &Path,
-    guard_exe: &Path,
-    ttl: Option<Duration>,
-) -> io::Result<PathBuf> {
-    let skills_dir = stage_root.join(".agents").join("skills");
-    fs::create_dir_all(&skills_dir)?;
-
-    let marker_path = skills_dir.join(GUARD_MARKER);
-    write_marker(&marker_path, stage_root, ttl)?;
-
-    let hooks_path = stage_root.join(".codex").join("hooks.json");
-    if let Some(parent) = hooks_path.parent() {
-        fs::create_dir_all(parent)?;
-    }
-    let hooks_existed = hooks_path.exists();
-    let backup = if hooks_existed {
-        Some(fs::read_to_string(&hooks_path)?)
-    } else {
-        None
-    };
-
-    let mut hooks: Value = backup
-        .as_deref()
-        .and_then(|s| serde_json::from_str(s).ok())
-        .unwrap_or_else(|| json!({}));
-    let hooks_obj = hooks
-        .as_object_mut()
-        .expect("hooks.json root is a JSON object")
-        .entry("hooks")
-        .or_insert_with(|| json!({}));
-    let pre = hooks_obj
-        .as_object_mut()
-        .expect("hooks is a JSON object")
-        .entry("PreToolUse")
-        .or_insert_with(|| json!([]));
-    let command = format!(
-        "\"{}\" guard-codex \"{}\"",
-        guard_exe.display(),
-        marker_path.display()
-    );
-    pre.as_array_mut()
-        .expect("PreToolUse is an array")
-        .push(json!({
-            "matcher": CODEX_HOOK_MATCHER,
-            "hooks": [
-                {
-                    "type": "command",
-                    "command": command,
-                    "timeout": 30,
-                    "statusMessage": "Checking eval write boundary",
-                }
-            ],
-        }));
-    write_json(&hooks_path, &hooks)?;
-
-    write_manifest(
-        &skills_dir.join(GUARD_MANIFEST),
-        &hooks_path,
-        hooks_existed,
-        backup,
-        &marker_path,
-    )?;
-
-    Ok(marker_path)
-}
-
 /// Disarm the guard: restore the original harness hook file (or delete it if we
-/// created it) and remove the marker + manifest. Safe to call when no guard is
-/// installed. Returns true if a guard was found and torn down.
+/// created it) and remove the marker + manifest, for every harness's skills
+/// dir. Safe to call when no guard is installed. Returns true if a guard was
+/// found and torn down.
 pub fn teardown_guard(stage_root: &Path) -> bool {
-    let torn_claude = teardown_guard_from_skills_dir(&stage_root.join(".claude").join("skills"));
-    let torn_codex = teardown_guard_from_skills_dir(&stage_root.join(".agents").join("skills"));
-    let _ = prune_if_empty(&stage_root.join(".codex"));
-    torn_claude || torn_codex
+    let mut torn = false;
+    for harness in Harness::known() {
+        let adapter = crate::adapters::adapter_for(harness);
+        // A harness without a skills dir cannot host a guard (descriptor
+        // validation rejects the combination), so there is nothing to sweep.
+        if let Some(skills_dir) = adapter.skills_dir(stage_root) {
+            torn |= teardown_guard_from_skills_dir(&skills_dir);
+        }
+        if let Some(hook_dir) = adapter.guard_hook_cleanup_dir(stage_root) {
+            let _ = prune_if_empty(&hook_dir);
+        }
+    }
+    torn
 }
 
-/// True when either harness has a live guard marker under `stage_root`.
+/// True when any harness has a live guard marker under `stage_root`.
 pub(crate) fn guard_is_armed(stage_root: &Path) -> bool {
     let now = now_ms();
-    [
-        stage_root.join(".claude").join("skills").join(GUARD_MARKER),
-        stage_root.join(".agents").join("skills").join(GUARD_MARKER),
-    ]
-    .iter()
-    .any(|path| marker_is_armed(read_marker(path).as_ref(), now))
+    Harness::known().any(|harness| {
+        crate::adapters::adapter_for(harness)
+            .skills_dir(stage_root)
+            .is_some_and(|skills_dir| {
+                let marker_path = skills_dir.join(GUARD_MARKER);
+                marker_is_armed(read_marker(&marker_path).as_ref(), now)
+            })
+    })
 }
 
 fn teardown_guard_from_skills_dir(skills_dir: &Path) -> bool {
@@ -336,271 +217,111 @@ mod tests {
         }
     }
 
-    fn skills_dir(stage_root: &Path) -> PathBuf {
-        stage_root.join(".claude").join("skills")
-    }
-
-    fn settings_path(stage_root: &Path) -> PathBuf {
-        stage_root.join(".claude").join("settings.local.json")
-    }
-
-    fn codex_hooks_path(stage_root: &Path) -> PathBuf {
-        stage_root.join(".codex").join("hooks.json")
-    }
-
-    fn read_json(path: &Path) -> Value {
-        serde_json::from_str(&fs::read_to_string(path).unwrap()).unwrap()
-    }
-
     #[test]
-    fn install_writes_an_active_marker_hook_and_manifest() {
+    fn teardown_is_a_safe_no_op_when_nothing_is_installed() {
         let c = setup();
-        let exe = Path::new("/g/eval-magic");
-        install_guard(&c.stage_root, exe, None).unwrap();
-
-        let marker = read_json(&skills_dir(&c.stage_root).join(GUARD_MARKER));
-        assert_eq!(marker["active"], json!(true));
-        let expires = marker["expiresAt"].as_str().unwrap();
-        let exp_ms = DateTime::parse_from_rfc3339(expires)
-            .unwrap()
-            .timestamp_millis();
-        assert!(exp_ms > now_ms());
-        let env = absolutize(&c.stage_root).display().to_string();
-        assert!(
-            marker["allowedRoots"]
-                .as_array()
-                .unwrap()
-                .iter()
-                .any(|r| r.as_str().unwrap() == env)
-        );
-
-        let settings = read_json(&settings_path(&c.stage_root));
-        let hook = &settings["hooks"]["PreToolUse"][0];
-        assert!(hook["matcher"].as_str().unwrap().contains("Write"));
-        assert!(
-            hook["hooks"][0]["command"]
-                .as_str()
-                .unwrap()
-                .contains("guard")
-        );
-
-        assert!(skills_dir(&c.stage_root).join(GUARD_MANIFEST).exists());
+        assert!(!teardown_guard(&c.stage_root));
     }
 
     #[test]
-    fn marker_scopes_allowed_roots_to_the_env_and_temp_only() {
+    fn teardown_sweeps_stray_marker_without_manifest() {
         let c = setup();
-        let exe = Path::new("/g/eval-magic");
-        install_guard(&c.stage_root, exe, None).unwrap();
-
-        let marker = read_json(&skills_dir(&c.stage_root).join(GUARD_MARKER));
-        let roots: Vec<String> = marker["allowedRoots"]
-            .as_array()
-            .unwrap()
-            .iter()
-            .map(|r| r.as_str().unwrap().to_string())
-            .collect();
-
-        // The guard boundary is the isolated env (stage_root) plus temp — nothing
-        // above it. The parent workspace tree must NOT be an allowed root, or the
-        // agent could write into sibling iterations / the meta dir above `env/`.
-        let env = absolutize(&c.stage_root).display().to_string();
-        let temp = absolutize(&std::env::temp_dir()).display().to_string();
-        assert_eq!(roots, vec![env, temp]);
-        assert!(
-            !roots.iter().any(|r| r.ends_with(".eval-magic")),
-            "workspace_root must not be an allowed root: {roots:?}"
-        );
+        // A stray marker (no manifest) in any harness's skills dir must still
+        // be swept so the guard can't stay armed.
+        for skills_dir in [
+            c.stage_root.join(".claude").join("skills"),
+            c.stage_root.join(".opencode").join("skills"),
+        ] {
+            fs::create_dir_all(&skills_dir).unwrap();
+            let marker = skills_dir.join(GUARD_MARKER);
+            fs::write(&marker, "{}").unwrap();
+            assert!(teardown_guard(&c.stage_root));
+            assert!(!marker.exists(), "stray marker at {marker:?} was not swept");
+        }
     }
 
+    /// Byte-pin of a fresh Claude hook file: armed envs and their backups are an
+    /// on-disk compatibility surface, so the merged settings must keep this exact
+    /// 2-space-pretty shape, key order, and trailing newline.
     #[test]
-    fn hook_command_invokes_the_binary_guard_subcommand() {
+    fn claude_install_writes_this_exact_hook_file() {
         let c = setup();
-        let exe = Path::new("/g/eval-magic");
-        let marker = install_guard(&c.stage_root, exe, None).unwrap();
-        let settings = read_json(&settings_path(&c.stage_root));
-        let command = settings["hooks"]["PreToolUse"][0]["hooks"][0]["command"]
-            .as_str()
-            .unwrap()
-            .to_string();
-        assert_eq!(
-            command,
-            format!("\"/g/eval-magic\" guard \"{}\"", marker.display())
+        let adapter = crate::adapters::adapter_for(Harness::resolve("claude-code").unwrap());
+        let marker = adapter
+            .install_guard(&c.stage_root, Path::new("/g/eval-magic"), None)
+            .unwrap();
+
+        let settings =
+            fs::read_to_string(c.stage_root.join(".claude").join("settings.local.json")).unwrap();
+        let expected = format!(
+            r#"{{
+  "hooks": {{
+    "PreToolUse": [
+      {{
+        "matcher": "Write|Edit|MultiEdit|NotebookEdit|Bash",
+        "hooks": [
+          {{
+            "type": "command",
+            "command": "\"/g/eval-magic\" guard \"{marker}\""
+          }}
+        ]
+      }}
+    ]
+  }}
+}}
+"#,
+            marker = marker.display()
         );
+        assert_eq!(settings, expected);
     }
 
+    /// Byte-pin of a fresh Codex hook file — same compatibility contract as the
+    /// Claude pin, plus the Codex-only `timeout`/`statusMessage` keys.
     #[test]
-    fn teardown_deletes_settings_it_created() {
-        let c = setup();
-        let exe = Path::new("/g/eval-magic");
-        install_guard(&c.stage_root, exe, None).unwrap();
-        assert!(settings_path(&c.stage_root).exists());
-
-        assert!(teardown_guard(&c.stage_root));
-        assert!(!settings_path(&c.stage_root).exists());
-        assert!(!skills_dir(&c.stage_root).join(GUARD_MARKER).exists());
-        assert!(!skills_dir(&c.stage_root).join(GUARD_MANIFEST).exists());
-    }
-
-    #[test]
-    fn teardown_restores_a_pre_existing_settings_verbatim() {
+    fn codex_install_writes_this_exact_hook_file() {
         let c = setup();
-        fs::create_dir_all(c.stage_root.join(".claude")).unwrap();
-        let original = format!(
-            "{}\n",
-            serde_json::to_string_pretty(&json!({
-                "permissions": { "allow": ["Bash(ls)"] }
-            }))
-            .unwrap()
-        );
-        fs::write(settings_path(&c.stage_root), &original).unwrap();
-
-        let exe = Path::new("/g/eval-magic");
-        install_guard(&c.stage_root, exe, None).unwrap();
-        // hook present while armed
-        assert!(
-            fs::read_to_string(settings_path(&c.stage_root))
-                .unwrap()
-                .contains("PreToolUse")
-        );
-
-        teardown_guard(&c.stage_root);
-        assert_eq!(
-            fs::read_to_string(settings_path(&c.stage_root)).unwrap(),
-            original
+        let adapter = crate::adapters::adapter_for(Harness::resolve("codex").unwrap());
+        let marker = adapter
+            .install_guard(&c.stage_root, Path::new("/g/eval-magic"), None)
+            .unwrap();
+
+        let hooks = fs::read_to_string(c.stage_root.join(".codex").join("hooks.json")).unwrap();
+        let expected = format!(
+            r#"{{
+  "hooks": {{
+    "PreToolUse": [
+      {{
+        "matcher": "^Bash$|^apply_patch$|^Edit$|^Write$",
+        "hooks": [
+          {{
+            "type": "command",
+            "command": "\"/g/eval-magic\" guard-codex \"{marker}\"",
+            "timeout": 30,
+            "statusMessage": "Checking eval write boundary"
+          }}
+        ]
+      }}
+    ]
+  }}
+}}
+"#,
+            marker = marker.display()
         );
-    }
-
-    #[test]
-    fn teardown_is_a_safe_no_op_when_nothing_is_installed() {
-        let c = setup();
-        assert!(!teardown_guard(&c.stage_root));
+        assert_eq!(hooks, expected);
     }
 
     #[test]
     fn guard_is_armed_detects_claude_or_codex_marker() {
         let c = setup();
-        install_guard(&c.stage_root, Path::new("/g/eval-magic"), None).unwrap();
+        let exe = Path::new("/g/eval-magic");
+        let claude = crate::adapters::adapter_for(Harness::resolve("claude-code").unwrap());
+        claude.install_guard(&c.stage_root, exe, None).unwrap();
         assert!(guard_is_armed(&c.stage_root));
         teardown_guard(&c.stage_root);
         assert!(!guard_is_armed(&c.stage_root));
 
-        install_codex_guard(&c.stage_root, Path::new("/g/eval-magic"), None).unwrap();
+        let codex = crate::adapters::adapter_for(Harness::resolve("codex").unwrap());
+        codex.install_guard(&c.stage_root, exe, None).unwrap();
         assert!(guard_is_armed(&c.stage_root));
     }
-
-    #[test]
-    fn guard_is_armed_ignores_missing_inactive_expired_and_malformed_markers() {
-        let c = setup();
-        let marker_path = skills_dir(&c.stage_root).join(GUARD_MARKER);
-        fs::create_dir_all(skills_dir(&c.stage_root)).unwrap();
-
-        assert!(!guard_is_armed(&c.stage_root));
-
-        fs::write(
-            &marker_path,
-            serde_json::to_string(&json!({ "active": false })).unwrap(),
-        )
-        .unwrap();
-        assert!(!guard_is_armed(&c.stage_root));
-
-        fs::write(
-            &marker_path,
-            serde_json::to_string(&json!({
-                "active": true,
-                "expiresAt": iso_millis(now_ms() - 60_000),
-            }))
-            .unwrap(),
-        )
-        .unwrap();
-        assert!(!guard_is_armed(&c.stage_root));
-
-        fs::write(&marker_path, "not json").unwrap();
-        assert!(!guard_is_armed(&c.stage_root));
-    }
-
-    #[test]
-    fn teardown_sweeps_a_stray_marker_even_without_a_manifest() {
-        let c = setup();
-        fs::create_dir_all(skills_dir(&c.stage_root)).unwrap();
-        fs::write(skills_dir(&c.stage_root).join(GUARD_MARKER), "{}").unwrap();
-        assert!(teardown_guard(&c.stage_root));
-        assert!(!skills_dir(&c.stage_root).join(GUARD_MARKER).exists());
-    }
-
-    #[test]
-    fn codex_install_writes_project_hook_marker_and_manifest() {
-        let c = setup();
-        let exe = Path::new("/g/eval-magic");
-        install_codex_guard(&c.stage_root, exe, None).unwrap();
-
-        let marker = read_json(
-            &c.stage_root
-                .join(".agents")
-                .join("skills")
-                .join(GUARD_MARKER),
-        );
-        assert_eq!(marker["active"], json!(true));
-        // The Codex guard shares the env-scoped roots: the staged `.agents/skills`
-        // dir lives inside `stage_root`, so the single env root already covers it.
-        let env = absolutize(&c.stage_root).display().to_string();
-        assert!(
-            marker["allowedRoots"]
-                .as_array()
-                .unwrap()
-                .iter()
-                .any(|r| r.as_str().unwrap() == env)
-        );
-
-        let hooks = read_json(&codex_hooks_path(&c.stage_root));
-        let hook = &hooks["hooks"]["PreToolUse"][0];
-        assert!(hook["matcher"].as_str().unwrap().contains("apply_patch"));
-        assert!(
-            hook["hooks"][0]["command"]
-                .as_str()
-                .unwrap()
-                .contains("guard-codex")
-        );
-        assert!(
-            c.stage_root
-                .join(".agents")
-                .join("skills")
-                .join(GUARD_MANIFEST)
-                .exists()
-        );
-    }
-
-    #[test]
-    fn codex_teardown_restores_pre_existing_hooks_json_verbatim() {
-        let c = setup();
-        fs::create_dir_all(c.stage_root.join(".codex")).unwrap();
-        let original = format!(
-            "{}\n",
-            serde_json::to_string_pretty(&json!({
-                "hooks": {
-                    "PostToolUse": [
-                        {
-                            "matcher": "Bash",
-                            "hooks": [{ "type": "command", "command": "echo ok" }]
-                        }
-                    ]
-                }
-            }))
-            .unwrap()
-        );
-        fs::write(codex_hooks_path(&c.stage_root), &original).unwrap();
-
-        install_codex_guard(&c.stage_root, Path::new("/g/eval-magic"), None).unwrap();
-        assert!(
-            fs::read_to_string(codex_hooks_path(&c.stage_root))
-                .unwrap()
-                .contains("guard-codex")
-        );
-
-        teardown_guard(&c.stage_root);
-        assert_eq!(
-            fs::read_to_string(codex_hooks_path(&c.stage_root)).unwrap(),
-            original
-        );
-    }
 }
diff --git a/src/sandbox/mod.rs b/src/sandbox/mod.rs
index 7537227..000e053 100644
--- a/src/sandbox/mod.rs
+++ b/src/sandbox/mod.rs
@@ -1,9 +1,13 @@
-//! Execution sandbox: write-guard install/teardown and write-boundary policy.
+//! Execution sandbox: shared write-guard machinery and write-boundary policy.
 //!
-//! The hook entry points are hidden subcommands on this binary (see [`guard`] and
-//! `cli`), so the installed PreToolUse hook invokes `eval-magic guard <marker>`
-//! or `eval-magic guard-codex <marker>` — no separate hook script to ship or
-//! locate.
+//! The hook entry points are hidden subcommands on this binary (see `cli`), so
+//! the installed PreToolUse hook invokes `eval-magic guard <marker>`,
+//! `eval-magic guard-codex <marker>`, or the generic
+//! `eval-magic guard-hook --harness <name> <marker>` — no separate hook script
+//! to ship or locate. Each harness's hook path, matcher, and verdict shape are
+//! descriptor data rendered by the generic engine (`crate::adapters::guard`);
+//! this module holds the shared marker/manifest/teardown machinery and the
+//! boundary policy.
 
 pub mod decide;
 pub mod guard;
@@ -12,10 +16,11 @@ pub mod policy;
 
 pub(crate) use decide::marker_is_armed;
 pub use decide::{GuardDecision, GuardMarker, decide};
-pub use guard::{codex_guard_decision, guard_decision, read_marker};
+pub(crate) use guard::parse_tool_call;
+pub use guard::read_marker;
 pub(crate) use install::guard_is_armed;
-pub use install::{GUARD_MANIFEST, GUARD_MARKER, install_guard, teardown_guard};
-pub use policy::{WRITE_TOOLS, classify_bash, is_under, is_under_any, is_write_tool, path_arg};
+pub use install::{GUARD_MANIFEST, GUARD_MARKER, teardown_guard};
+pub use policy::{classify_bash, is_shell_tool, is_under, is_under_any, is_write_tool, path_arg};
 
 use std::time::{SystemTime, UNIX_EPOCH};
 
diff --git a/src/sandbox/policy.rs b/src/sandbox/policy.rs
index 02e9d0a..4a5f8b3 100644
--- a/src/sandbox/policy.rs
+++ b/src/sandbox/policy.rs
@@ -3,7 +3,8 @@
 //! Stateless classifiers shared by the armed guard ([`super::decide`]) and
 //! `pipeline::detect-stray-writes`: which tools write, which Bash commands
 //! mutate state outside a sandbox, and whether a path falls under an allowed
-//! root.
+//! root. Tool names come from the adapters' cross-harness vocabulary union
+//! ([`all_tool_vocabulary`]), so no harness's tool naming is hardcoded here.
 
 use std::path::Path;
 use std::sync::LazyLock;
@@ -11,12 +12,33 @@ use std::sync::LazyLock;
 use regex::Regex;
 use serde_json::Value;
 
-/// Tools that mutate the filesystem and carry a target path argument.
-pub const WRITE_TOOLS: [&str; 4] = ["Write", "Edit", "MultiEdit", "NotebookEdit"];
+use crate::adapters::all_tool_vocabulary;
 
-/// True for a tool name that writes the filesystem with a path argument.
+/// True for a tool name that writes the filesystem with a single target path
+/// argument, in any harness's vocabulary.
 pub fn is_write_tool(tool_name: &str) -> bool {
-    WRITE_TOOLS.contains(&tool_name)
+    all_tool_vocabulary()
+        .write_tools
+        .iter()
+        .any(|t| t == tool_name)
+}
+
+/// True for an apply_patch-style tool whose payload carries patch targets
+/// (extracted with [`apply_patch_paths`]), in any harness's vocabulary.
+pub fn is_patch_tool(tool_name: &str) -> bool {
+    all_tool_vocabulary()
+        .patch_tools
+        .iter()
+        .any(|t| t == tool_name)
+}
+
+/// True for a shell-execution tool carrying a `command` argument, in any
+/// harness's vocabulary.
+pub fn is_shell_tool(tool_name: &str) -> bool {
+    all_tool_vocabulary()
+        .shell_tools
+        .iter()
+        .any(|t| t == tool_name)
 }
 
 /// Bash command patterns that mutate state outside an eval's sandbox. Heuristics
@@ -27,43 +49,53 @@ pub fn is_write_tool(tool_name: &str) -> bool {
 /// Compiled once. The patterns are known-valid, so a compile failure here is a
 /// programmer error and panics.
 static BASH_MUTATION_PATTERNS: LazyLock<Vec<(Regex, &'static str)>> = LazyLock::new(|| {
+    let config_dirs = crate::adapters::all_config_dir_names()
+        .iter()
+        .map(|d| regex::escape(d))
+        .collect::<Vec<_>>()
+        .join("|");
     [
         (
-            r"\b(npm|pnpm|yarn|bun)\s+(install|add|ci|i)\b",
+            r"\b(npm|pnpm|yarn|bun)\s+(install|add|ci|i)\b".to_string(),
             "package install/add",
         ),
-        (r"\bpip3?\s+install\b", "pip install"),
-        (r"\bsed\s+-i\b", "in-place file edit (sed -i)"),
+        (r"\bpip3?\s+install\b".to_string(), "pip install"),
+        (r"\bsed\s+-i\b".to_string(), "in-place file edit (sed -i)"),
         (
-            r"\bgit\s+(commit|add|push|checkout|reset|restore|merge|rebase)\b",
+            r"\bgit\s+(commit|add|push|checkout|reset|restore|merge|rebase)\b".to_string(),
             "git mutation",
         ),
         (
-            r"\bgit\s+worktree\s+add\b",
+            r"\bgit\s+worktree\s+add\b".to_string(),
             "git worktree add (working tree outside the sandbox)",
         ),
-        // A create/copy/move/link verb whose operand is a path under `.claude` —
-        // catches stray writes to the harness config dir that aren't a `>`
-        // redirect (caught below). Read-only verbs (`cat`, `ls`) aren't listed,
-        // so inspecting `.claude` stays allowed.
+        // A create/copy/move/link verb whose operand is a path under any
+        // harness config dir (`adapters::all_config_dir_names`) — catches
+        // stray writes to a config dir that aren't a `>` redirect (caught
+        // below). Read-only verbs (`cat`, `ls`) aren't listed, so inspecting
+        // the dirs stays allowed.
         (
-            r"\b(cp|mv|mkdir|touch|ln|rsync|install)\b[^|;&\n]*\.claude(/|\b)",
-            "path under .claude",
+            format!(r"\b(cp|mv|mkdir|touch|ln|rsync|install)\b[^|;&\n]*({config_dirs})(/|\b)"),
+            "path under a harness config dir",
         ),
         // The same create verbs whose operand is a top-level `skills/` directory —
         // catches a bare `skills/` left in the cwd. `skills-data` and other
         // `skills`-prefixed names are excluded by the trailing `/`, whitespace, or
         // end-of-string boundary.
         (
-            r#"\b(cp|mv|mkdir|touch|ln|rsync)\b[^|;&\n]*[\s'"=/]\.{0,2}/?skills(/|\s|$)"#,
+            r#"\b(cp|mv|mkdir|touch|ln|rsync)\b[^|;&\n]*[\s'"=/]\.{0,2}/?skills(/|\s|$)"#
+                .to_string(),
             "creates a bare skills/ dir",
         ),
-        (r"(^|\s)(>>?|tee)\s", "output redirection to a file"),
+        (
+            r"(^|\s)(>>?|tee)\s".to_string(),
+            "output redirection to a file",
+        ),
     ]
     .into_iter()
     .map(|(re, reason)| {
         (
-            Regex::new(re)
+            Regex::new(&re)
                 .unwrap_or_else(|e| panic!("bundled bash pattern {re:?} is invalid: {e}")),
             reason,
         )
@@ -196,15 +228,33 @@ mod tests {
     }
 
     #[test]
-    fn is_write_tool_matches_the_four_write_tools() {
-        for t in ["Write", "Edit", "MultiEdit", "NotebookEdit"] {
+    fn is_write_tool_matches_every_harness_write_tool() {
+        for t in ["Write", "Edit", "MultiEdit", "NotebookEdit", "file_change"] {
             assert!(is_write_tool(t), "{t} should be a write tool");
         }
-        for t in ["Read", "Bash", "Grep", ""] {
+        for t in ["Read", "Bash", "Grep", "apply_patch", ""] {
             assert!(!is_write_tool(t), "{t} should not be a write tool");
         }
     }
 
+    #[test]
+    fn is_patch_tool_matches_apply_patch_style_tools_only() {
+        assert!(is_patch_tool("apply_patch"));
+        for t in ["Write", "Bash", "file_change", ""] {
+            assert!(!is_patch_tool(t), "{t} should not be a patch tool");
+        }
+    }
+
+    #[test]
+    fn is_shell_tool_matches_every_harness_shell_tool() {
+        for t in ["Bash", "command_execution"] {
+            assert!(is_shell_tool(t), "{t} should be a shell tool");
+        }
+        for t in ["Write", "apply_patch", ""] {
+            assert!(!is_shell_tool(t), "{t} should not be a shell tool");
+        }
+    }
+
     #[test]
     fn path_arg_prefers_file_path_then_notebook_then_path() {
         assert_eq!(path_arg(&json!({ "file_path": "/a" })), Some("/a"));
@@ -283,6 +333,28 @@ mod tests {
         );
     }
 
+    #[test]
+    fn classify_bash_flags_creates_under_every_harness_config_dir_but_allows_reads() {
+        for dir in crate::adapters::all_config_dir_names() {
+            assert_eq!(
+                classify_bash(&format!("mkdir -p {dir}/x"), &[]),
+                Some("path under a harness config dir"),
+                "mkdir under {dir} should be flagged"
+            );
+            assert_eq!(
+                classify_bash(&format!("cp evil.json {dir}/hooks.json"), &[]),
+                Some("path under a harness config dir"),
+                "cp into {dir} should be flagged"
+            );
+            assert_eq!(
+                classify_bash(&format!("cat {dir}/settings.json"), &[]),
+                None,
+                "read of {dir} should stay allowed"
+            );
+            assert_eq!(classify_bash(&format!("ls {dir}"), &[]), None);
+        }
+    }
+
     #[test]
     fn classify_bash_allows_scoped_and_readonly_commands() {
         // Textually references an allowed root → scoped → allowed.
diff --git a/src/validation/schema.rs b/src/validation/schema.rs
index c98a407..62a516c 100644
--- a/src/validation/schema.rs
+++ b/src/validation/schema.rs
@@ -24,17 +24,19 @@ pub enum SchemaName {
     StrayWrites,
     Benchmark,
     JudgeTasks,
+    HarnessDescriptor,
 }
 
 impl SchemaName {
     /// Every schema, for building the validator cache.
-    const ALL: [SchemaName; 6] = [
+    const ALL: [SchemaName; 7] = [
         SchemaName::RunRecord,
         SchemaName::Evals,
         SchemaName::Grading,
         SchemaName::StrayWrites,
         SchemaName::Benchmark,
         SchemaName::JudgeTasks,
+        SchemaName::HarnessDescriptor,
     ];
 
     /// The schema's kebab-case name, as used in error messages and the on-disk
@@ -47,6 +49,7 @@ impl SchemaName {
             SchemaName::StrayWrites => "stray-writes",
             SchemaName::Benchmark => "benchmark",
             SchemaName::JudgeTasks => "judge-tasks",
+            SchemaName::HarnessDescriptor => "harness-descriptor",
         }
     }
 
@@ -59,6 +62,9 @@ impl SchemaName {
             SchemaName::StrayWrites => include_str!("../../schema/stray-writes.schema.json"),
             SchemaName::Benchmark => include_str!("../../schema/benchmark.schema.json"),
             SchemaName::JudgeTasks => include_str!("../../schema/judge-tasks.schema.json"),
+            SchemaName::HarnessDescriptor => {
+                include_str!("../../schema/harness-descriptor.schema.json")
+            }
         }
     }
 }
diff --git a/src/workspace/promote.rs b/src/workspace/promote.rs
index d4193fa..2a177dd 100644
--- a/src/workspace/promote.rs
+++ b/src/workspace/promote.rs
@@ -341,7 +341,7 @@ mod tests {
             skill_name: "mr-review",
             skill_subdir: &f.skill_subdir,
             iteration,
-            harness: Harness::ClaudeCode,
+            harness: Harness::resolve("claude-code").unwrap(),
             label: None,
             agent_model: None,
             judge_model: None,
diff --git a/tests/cli/basics.rs b/tests/cli/basics.rs
index cc9ec59..bf85d06 100644
--- a/tests/cli/basics.rs
+++ b/tests/cli/basics.rs
@@ -1,6 +1,7 @@
 //! Help output, `validate`, and parser-level dispatch (unknown subcommands).
 
 use crate::helpers::skill_eval;
+use predicates::prelude::PredicateBooleanExt;
 use predicates::str::contains;
 use std::fs;
 use tempfile::TempDir;
@@ -40,6 +41,26 @@ fn help_uses_published_binary_name() {
         .stdout(contains("eval-magic"));
 }
 
+/// `--guard` and `--no-guard` are contradictory and rejected at parse time.
+#[test]
+fn run_rejects_guard_with_no_guard() {
+    skill_eval()
+        .args(["run", "--guard", "--no-guard"])
+        .assert()
+        .failure()
+        .stderr(contains("cannot be used with"));
+}
+
+/// The auto-arm opt-out is a documented part of the `run` surface.
+#[test]
+fn run_help_documents_no_guard() {
+    skill_eval()
+        .args(["run", "--help"])
+        .assert()
+        .success()
+        .stdout(contains("--no-guard"));
+}
+
 /// `ingest` reaches its own context validation when invoked bare.
 #[test]
 fn ingest_is_wired_and_validates_context() {
@@ -135,3 +156,35 @@ fn validate_requires_a_skill_context() {
 fn unknown_subcommand_is_rejected() {
     skill_eval().arg("does-not-exist").assert().failure();
 }
+
+/// An unknown `--harness` value is rejected by the registry resolver with an
+/// error naming the offending value and every known harness. (Resolution
+/// happens after parsing, not in clap, so runtime-loaded descriptors count.)
+#[test]
+fn unknown_harness_value_is_rejected_naming_known_harnesses() {
+    skill_eval()
+        .args(["aggregate", "--harness", "nonexistent"])
+        .assert()
+        .failure()
+        .stderr(
+            contains("unknown harness 'nonexistent'")
+                .and(contains("claude-code"))
+                .and(contains("codex"))
+                .and(contains("opencode")),
+        );
+}
+
+/// `run --help` names the built-in harnesses in the `--harness` doc text.
+#[test]
+fn run_help_names_builtin_harnesses() {
+    skill_eval()
+        .args(["run", "--help"])
+        .assert()
+        .success()
+        .stdout(
+            contains("--harness")
+                .and(contains("claude-code"))
+                .and(contains("codex"))
+                .and(contains("opencode")),
+        );
+}
diff --git a/tests/cli/grade_models.rs b/tests/cli/grade_models.rs
index 6c21e3c..da883ca 100644
--- a/tests/cli/grade_models.rs
+++ b/tests/cli/grade_models.rs
@@ -87,7 +87,7 @@ fn grade_defaults_judge_tasks_to_recorded_judge_model() {
         .success();
     let stdout = String::from_utf8(assert.get_output().stdout.clone()).unwrap();
     assert!(stdout.contains("codex --ask-for-approval never exec"));
-    assert!(stdout.contains("-m \"$model\""));
+    assert!(stdout.contains("model_arg=\"-m $model\""));
 
     let tasks: serde_json::Value =
         serde_json::from_str(&fs::read_to_string(iteration_dir.join("judge-tasks.json")).unwrap())
diff --git a/tests/cli/guard.rs b/tests/cli/guard.rs
index c05cd20..3946d7e 100644
--- a/tests/cli/guard.rs
+++ b/tests/cli/guard.rs
@@ -17,6 +17,10 @@ fn guard_subcommand_is_hidden_but_callable() {
         .stdout(contains("PreToolUse hook entry point").not());
 
     skill_eval().arg("guard").arg("--help").assert().success();
+    skill_eval()
+        .args(["guard-hook", "--help"])
+        .assert()
+        .success();
 }
 
 /// Write an armed guard marker scoping writes to `<allowed>`, and return its path.
@@ -105,6 +109,59 @@ fn guard_codex_subcommand_blocks_with_codex_verdict_shape() {
         .stdout(contains("blocked Bash"));
 }
 
+/// Byte-pin of the Claude deny verdict: armed hooks from previous releases keep
+/// reading this exact shape, so the serialized bytes are a compatibility
+/// contract — full-string equality, not substrings.
+#[test]
+fn guard_deny_verdict_bytes_are_stable() {
+    let tmp = TempDir::new().unwrap();
+    let marker = tmp.path().join("marker.json");
+    fs::write(
+        &marker,
+        r#"{"active":true,"allowedRoots":["/work/env"],"expiresAt":"2999-01-01T00:00:00.000Z"}"#,
+    )
+    .unwrap();
+
+    skill_eval()
+        .arg("guard")
+        .arg(&marker)
+        .write_stdin(r#"{ "tool_name": "Write", "tool_input": { "file_path": "/etc/passwd" } }"#)
+        .assert()
+        .success()
+        .stdout(
+            "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\
+             \"permissionDecision\":\"deny\",\"permissionDecisionReason\":\
+             \"eval guard: Write to /etc/passwd is outside the eval sandbox \
+             (allowed: /work/env)\"}}",
+        );
+}
+
+/// Byte-pin of the Codex block verdict — same compatibility contract as the
+/// Claude pin above.
+#[test]
+fn guard_codex_block_verdict_bytes_are_stable() {
+    let tmp = TempDir::new().unwrap();
+    let marker = tmp.path().join("marker.json");
+    fs::write(
+        &marker,
+        r#"{"active":true,"allowedRoots":["/work/env"],"expiresAt":"2999-01-01T00:00:00.000Z"}"#,
+    )
+    .unwrap();
+
+    skill_eval()
+        .arg("guard-codex")
+        .arg(&marker)
+        .write_stdin(
+            r#"{ "tool_name": "Bash", "tool_input": { "command": "npm install left-pad" } }"#,
+        )
+        .assert()
+        .success()
+        .stdout(
+            "{\"decision\":\"block\",\"reason\":\"eval guard: blocked Bash \
+             (package install/add) — runs outside the eval sandbox\"}",
+        );
+}
+
 /// `guard` fails open when the marker is absent: empty stdout, exit 0.
 #[test]
 fn guard_fails_open_without_marker() {
@@ -118,6 +175,71 @@ fn guard_fails_open_without_marker() {
         .stdout("");
 }
 
+/// The generic `guard-hook --harness <name>` entry point resolves the verdict
+/// shape from the named harness's embedded descriptor — Claude's deny shape
+/// for claude-code, Codex's block shape for codex. Future guard-capable
+/// built-ins use this instead of minting another alias.
+#[test]
+fn guard_hook_resolves_the_harness_verdict_shape() {
+    let tmp = TempDir::new().unwrap();
+    let marker = write_armed_marker(tmp.path(), &tmp.path().join(".eval-magic"));
+
+    skill_eval()
+        .args(["guard-hook", "--harness", "claude-code"])
+        .arg(&marker)
+        .write_stdin(r#"{ "tool_name": "Write", "tool_input": { "file_path": "/etc/passwd" } }"#)
+        .assert()
+        .success()
+        .stdout(contains(r#""permissionDecision":"deny""#));
+
+    skill_eval()
+        .args(["guard-hook", "--harness", "codex"])
+        .arg(&marker)
+        .write_stdin(
+            r#"{ "tool_name": "Bash", "tool_input": { "command": "npm install left-pad" } }"#,
+        )
+        .assert()
+        .success()
+        .stdout(contains(r#""decision":"block""#));
+}
+
+/// `guard-hook` fails open on an unknown harness: empty stdout, exit 0 — the
+/// hook must never brick a session, whatever config invoked it.
+#[test]
+fn guard_hook_fails_open_for_an_unknown_harness() {
+    let tmp = TempDir::new().unwrap();
+    let marker = write_armed_marker(tmp.path(), &tmp.path().join(".eval-magic"));
+
+    skill_eval()
+        .args(["guard-hook", "--harness", "mystery"])
+        .arg(&marker)
+        .write_stdin(r#"{ "tool_name": "Write", "tool_input": { "file_path": "/etc/passwd" } }"#)
+        .assert()
+        .success()
+        .stdout("");
+}
+
+/// Like `guard`, the generic entry point must stay off layered descriptor
+/// discovery: it fires per tool call and reads embedded descriptors only.
+#[test]
+fn guard_hook_generic_skips_descriptor_discovery() {
+    let tmp = TempDir::new().unwrap();
+    let marker = write_armed_marker(tmp.path(), &tmp.path().join(".eval-magic"));
+    let harnesses = tmp.path().join(".eval-magic").join("harnesses");
+    fs::create_dir_all(&harnesses).unwrap();
+    fs::write(harnesses.join("broken.toml"), "label = ").unwrap();
+
+    skill_eval()
+        .args(["guard-hook", "--harness", "claude-code"])
+        .arg(&marker)
+        .current_dir(tmp.path())
+        .write_stdin(r#"{ "tool_name": "Write", "tool_input": { "file_path": "/etc/passwd" } }"#)
+        .assert()
+        .success()
+        .stdout(contains(r#""permissionDecision":"deny""#))
+        .stderr(contains("skipping harness descriptor").not());
+}
+
 /// `teardown-guard` reports when no guard is installed (cwd has no marker).
 #[test]
 fn teardown_guard_reports_nothing_to_remove() {
@@ -149,3 +271,25 @@ fn teardown_guard_removes_installed_guard() {
             .exists()
     );
 }
+
+/// The guard hook fires on every PreToolUse in a dispatched session, so it
+/// must not run layered descriptor discovery: a broken user descriptor in the
+/// eval env must not spam a skip-warning (or any other noise) per tool call.
+#[test]
+fn guard_hook_skips_descriptor_discovery() {
+    let tmp = TempDir::new().unwrap();
+    let marker = write_armed_marker(tmp.path(), &tmp.path().join(".eval-magic"));
+    let harnesses = tmp.path().join(".eval-magic").join("harnesses");
+    fs::create_dir_all(&harnesses).unwrap();
+    fs::write(harnesses.join("broken.toml"), "label = ").unwrap();
+
+    skill_eval()
+        .arg("guard")
+        .arg(&marker)
+        .current_dir(tmp.path())
+        .write_stdin(r#"{ "tool_name": "Write", "tool_input": { "file_path": "/etc/passwd" } }"#)
+        .assert()
+        .success()
+        .stdout(contains(r#""permissionDecision":"deny""#))
+        .stderr(contains("skipping harness descriptor").not());
+}
diff --git a/tests/cli/harness.rs b/tests/cli/harness.rs
new file mode 100644
index 0000000..4569bf8
--- /dev/null
+++ b/tests/cli/harness.rs
@@ -0,0 +1,397 @@
+//! Layered harness-descriptor discovery: user-global and project-local
+//! descriptor files, the one-off `--harness-file`, and the fail-soft policy
+//! for broken discovered files.
+
+use crate::helpers::skill_eval;
+use predicates::prelude::PredicateBooleanExt;
+use predicates::str::contains;
+use std::fs;
+use std::path::Path;
+use tempfile::TempDir;
+
+/// Write `<root>/.eval-magic/harnesses/<file>` with the given TOML.
+fn write_project_descriptor(root: &Path, file: &str, contents: &str) {
+    let dir = root.join(".eval-magic").join("harnesses");
+    fs::create_dir_all(&dir).unwrap();
+    fs::write(dir.join(file), contents).unwrap();
+}
+
+#[test]
+fn project_local_descriptor_registers_a_new_harness() {
+    let tmp = TempDir::new().unwrap();
+    write_project_descriptor(tmp.path(), "cool.toml", "label = \"cool-custom-harness\"\n");
+
+    // The command still fails later (no skill context), but the harness name
+    // resolves — the registry saw the project-local layer.
+    skill_eval()
+        .current_dir(tmp.path())
+        .args(["aggregate", "--harness", "cool-custom-harness"])
+        .assert()
+        .failure()
+        .stderr(contains("unknown harness").not());
+}
+
+#[test]
+fn unknown_harness_error_lists_discovered_harnesses() {
+    let tmp = TempDir::new().unwrap();
+    write_project_descriptor(tmp.path(), "cool.toml", "label = \"cool-custom-harness\"\n");
+
+    skill_eval()
+        .current_dir(tmp.path())
+        .args(["aggregate", "--harness", "nonexistent"])
+        .assert()
+        .failure()
+        .stderr(
+            contains("unknown harness 'nonexistent'")
+                .and(contains("claude-code"))
+                .and(contains("cool-custom-harness")),
+        );
+}
+
+#[test]
+fn user_global_layer_is_discovered_via_config_dir_env() {
+    let tmp = TempDir::new().unwrap();
+    let config_root = tmp.path().join("config");
+    let dir = config_root.join("harnesses");
+    fs::create_dir_all(&dir).unwrap();
+    fs::write(dir.join("cool.toml"), "label = \"cool-custom-harness\"\n").unwrap();
+
+    skill_eval()
+        .current_dir(tmp.path())
+        .env("EVAL_MAGIC_CONFIG_DIR", &config_root)
+        .args(["aggregate", "--harness", "cool-custom-harness"])
+        .assert()
+        .failure()
+        .stderr(contains("unknown harness").not());
+}
+
+#[test]
+fn harness_file_registers_a_one_off_harness() {
+    let tmp = TempDir::new().unwrap();
+    let file = tmp.path().join("cool.toml");
+    fs::write(&file, "label = \"cool-custom-harness\"\n").unwrap();
+
+    skill_eval()
+        .current_dir(tmp.path())
+        .arg("aggregate")
+        .arg("--harness-file")
+        .arg(&file)
+        .args(["--harness", "cool-custom-harness"])
+        .assert()
+        .failure()
+        .stderr(contains("unknown harness").not());
+}
+
+#[test]
+fn broken_project_local_descriptor_warns_but_never_bricks() {
+    let tmp = TempDir::new().unwrap();
+    write_project_descriptor(
+        tmp.path(),
+        "broken.toml",
+        "label = \"broken\"\nmystery = 1\n",
+    );
+
+    // The built-in harness still resolves; the broken file is skipped with a
+    // warning that points at the lint command.
+    skill_eval()
+        .current_dir(tmp.path())
+        .args(["aggregate", "--harness", "claude-code"])
+        .assert()
+        .failure()
+        .stderr(
+            contains("skipping harness descriptor")
+                .and(contains("harness lint"))
+                .and(contains("unknown harness").not()),
+        );
+}
+
+#[test]
+fn broken_harness_file_is_fatal() {
+    let tmp = TempDir::new().unwrap();
+    let file = tmp.path().join("broken.toml");
+    fs::write(&file, "label = ").unwrap();
+
+    skill_eval()
+        .current_dir(tmp.path())
+        .arg("aggregate")
+        .arg("--harness-file")
+        .arg(&file)
+        .assert()
+        .failure()
+        .stderr(contains("broken.toml").and(contains("invalid TOML")));
+}
+
+#[test]
+fn harness_list_names_layers_and_enhancements() {
+    let tmp = TempDir::new().unwrap();
+    write_project_descriptor(tmp.path(), "cool.toml", "label = \"cool-custom-harness\"\n");
+
+    skill_eval()
+        .current_dir(tmp.path())
+        .args(["harness", "list"])
+        .assert()
+        .success()
+        .stdout(
+            contains("claude-code")
+                .and(contains("(default)"))
+                .and(contains("built-in"))
+                .and(contains("opencode"))
+                .and(contains("cool-custom-harness"))
+                .and(contains("project"))
+                .and(contains("baseline"))
+                .and(contains("transcript")),
+        );
+}
+
+#[test]
+fn harness_list_marks_merged_builtins() {
+    let tmp = TempDir::new().unwrap();
+    write_project_descriptor(
+        tmp.path(),
+        "claude-code.toml",
+        "label = \"claude-code\"\n\n[model]\nflag = \"--model-x\"\n",
+    );
+
+    skill_eval()
+        .current_dir(tmp.path())
+        .args(["harness", "list"])
+        .assert()
+        .success()
+        .stdout(contains("built-in + project"));
+}
+
+#[test]
+fn harness_show_prints_the_merged_descriptor_as_toml() {
+    let tmp = TempDir::new().unwrap();
+    write_project_descriptor(
+        tmp.path(),
+        "claude-code.toml",
+        "label = \"claude-code\"\n\n[model]\nflag = \"--model-x\"\n",
+    );
+
+    skill_eval()
+        .current_dir(tmp.path())
+        .args(["harness", "show", "claude-code"])
+        .assert()
+        .success()
+        .stdout(
+            contains("label = \"claude-code\"")
+                .and(contains("--model-x"))
+                .and(contains("harnesses/claude-code.toml (built-in)"))
+                .and(contains("claude-code.toml (project)"))
+                // The rest of the embedded descriptor survives the merge.
+                .and(contains("skills_dir = \".claude/skills\"")),
+        );
+}
+
+#[test]
+fn harness_show_unknown_name_lists_known_harnesses() {
+    let tmp = TempDir::new().unwrap();
+    skill_eval()
+        .current_dir(tmp.path())
+        .args(["harness", "show", "nonexistent"])
+        .assert()
+        .failure()
+        .stderr(contains("unknown harness 'nonexistent'").and(contains("claude-code")));
+}
+
+#[test]
+fn harness_lint_passes_a_valid_file() {
+    let tmp = TempDir::new().unwrap();
+    let file = tmp.path().join("cool.toml");
+    fs::write(&file, "label = \"cool-custom-harness\"\n").unwrap();
+
+    skill_eval()
+        .current_dir(tmp.path())
+        .args(["harness", "lint"])
+        .arg(&file)
+        .assert()
+        .success()
+        .stdout(contains("✓"));
+}
+
+#[test]
+fn harness_lint_reports_schema_violations() {
+    let tmp = TempDir::new().unwrap();
+    let file = tmp.path().join("bad.toml");
+    fs::write(&file, "label = \"bad\"\nmystery = 1\n").unwrap();
+
+    skill_eval()
+        .current_dir(tmp.path())
+        .args(["harness", "lint"])
+        .arg(&file)
+        .assert()
+        .failure()
+        .stderr(contains("✗").and(contains("mystery")));
+}
+
+#[test]
+fn harness_lint_rejects_a_user_guard_block() {
+    let tmp = TempDir::new().unwrap();
+    let file = tmp.path().join("armed.toml");
+    fs::write(
+        &file,
+        r#"
+label = "armed"
+
+[guard]
+hooks_file = ".armed/hooks.json"
+matcher = "Write"
+command_template = '"{exe}" guard-hook --harness armed "{marker}"'
+hook_entry = '{"matcher":"{matcher}","hooks":[{"type":"command","command":"{command}"}]}'
+verdict_template = '{"decision":"block","reason":"{reason}"}'
+armed_message = "x"
+"#,
+    )
+    .unwrap();
+
+    skill_eval()
+        .current_dir(tmp.path())
+        .args(["harness", "lint"])
+        .arg(&file)
+        .assert()
+        .failure()
+        .stderr(contains("may not declare [guard]").and(contains("detect-stray-writes")));
+}
+
+#[test]
+fn harness_lint_reports_invariant_breaks() {
+    let tmp = TempDir::new().unwrap();
+    let file = tmp.path().join("slug.toml");
+    fs::write(
+        &file,
+        "label = \"demo\"\nskills_dir = \".demo/skills\"\nconfig_dirs = [\".demo\"]\n\n\
+         [staging]\nslug_template = \"{prefix}{iteration}-{condition}\"\n",
+    )
+    .unwrap();
+
+    skill_eval()
+        .current_dir(tmp.path())
+        .args(["harness", "lint"])
+        .arg(&file)
+        .assert()
+        .failure()
+        .stderr(contains("staging.slug_template").and(contains("{skill_name}")));
+}
+
+#[test]
+fn harness_lint_checks_a_partial_override_against_its_merge_target() {
+    let tmp = TempDir::new().unwrap();
+    // Standalone this partial is fine; merged onto claude-code it orphans
+    // skills_dir's parent — lint must catch the post-merge break.
+    let file = tmp.path().join("claude-code.toml");
+    fs::write(
+        &file,
+        "label = \"claude-code\"\nconfig_dirs = [\".other\"]\n",
+    )
+    .unwrap();
+
+    skill_eval()
+        .current_dir(tmp.path())
+        .args(["harness", "lint"])
+        .arg(&file)
+        .assert()
+        .failure()
+        .stderr(contains("parent of skills_dir"));
+}
+
+#[test]
+fn harness_lint_passes_an_extract_descriptor() {
+    let tmp = TempDir::new().unwrap();
+    let file = tmp.path().join("flat.toml");
+    fs::write(
+        &file,
+        r#"label = "flat"
+
+[tools]
+write = ["file_write"]
+shell = ["shell"]
+
+[transcript]
+events_filename = "flat-events.jsonl"
+
+[transcript.extract.tools]
+where = { kind = "tool.call" }
+name_field = "tool"
+
+[transcript.extract.final_text]
+where = { kind = "message" }
+field = "text"
+"#,
+    )
+    .unwrap();
+
+    skill_eval()
+        .current_dir(tmp.path())
+        .args(["harness", "lint"])
+        .arg(&file)
+        .assert()
+        .success()
+        .stdout(contains("✓"));
+}
+
+#[test]
+fn harness_lint_reports_extract_overlaying_a_builtin_parser() {
+    let tmp = TempDir::new().unwrap();
+    // Standalone this partial is fine; merged onto claude-code it collides
+    // with the built-in's named parser — transcript ingest reads through
+    // exactly one tier, and an overlay cannot delete the inherited parser.
+    let file = tmp.path().join("claude-code.toml");
+    fs::write(
+        &file,
+        "label = \"claude-code\"\n\n[transcript]\nevents_filename = \"events.jsonl\"\n\n\
+         [transcript.extract.final_text]\nfield = \"result\"\n",
+    )
+    .unwrap();
+
+    skill_eval()
+        .current_dir(tmp.path())
+        .args(["harness", "lint"])
+        .arg(&file)
+        .assert()
+        .failure()
+        .stderr(contains("exactly one").and(contains("new label")));
+}
+
+#[test]
+fn harness_lint_accepts_a_registered_harness_name() {
+    let tmp = TempDir::new().unwrap();
+    skill_eval()
+        .current_dir(tmp.path())
+        .args(["harness", "lint", "claude-code"])
+        .assert()
+        .success()
+        .stdout(contains("✓"));
+}
+
+#[test]
+fn harness_lint_of_a_name_reports_the_skipped_project_file() {
+    let tmp = TempDir::new().unwrap();
+    write_project_descriptor(
+        tmp.path(),
+        "broken.toml",
+        "label = \"broken\"\nmystery = 1\n",
+    );
+
+    // Init skips the broken file with a warning; linting the name surfaces
+    // the full per-file report and fails.
+    skill_eval()
+        .current_dir(tmp.path())
+        .args(["harness", "lint", "broken"])
+        .assert()
+        .failure()
+        .stderr(contains("✗").and(contains("mystery")));
+}
+
+#[test]
+fn missing_harness_file_is_fatal() {
+    let tmp = TempDir::new().unwrap();
+    skill_eval()
+        .current_dir(tmp.path())
+        .arg("aggregate")
+        .arg("--harness-file")
+        .arg(tmp.path().join("missing.toml"))
+        .assert()
+        .failure()
+        .stderr(contains("--harness-file").and(contains("missing.toml")));
+}
diff --git a/tests/cli/harness_init.rs b/tests/cli/harness_init.rs
new file mode 100644
index 0000000..8b119ce
--- /dev/null
+++ b/tests/cli/harness_init.rs
@@ -0,0 +1,222 @@
+//! `harness init`: scaffolding the commented descriptor template and notes
+//! skeleton for a new harness — overwrite/overlay/stdout behavior included.
+
+use crate::helpers::skill_eval;
+use predicates::prelude::PredicateBooleanExt;
+use predicates::str::contains;
+use std::fs;
+use std::path::{Path, PathBuf};
+use tempfile::TempDir;
+
+fn descriptor_path(root: &Path) -> PathBuf {
+    root.join(".eval-magic/harnesses/cool-cli.toml")
+}
+
+fn notes_path(root: &Path) -> PathBuf {
+    root.join(".eval-magic/harnesses/cool-cli-notes.md")
+}
+
+#[test]
+fn harness_init_scaffolds_a_lint_clean_descriptor_and_notes_skeleton() {
+    let tmp = TempDir::new().unwrap();
+
+    skill_eval()
+        .current_dir(tmp.path())
+        .args(["harness", "init", "cool-cli"])
+        .assert()
+        .success()
+        .stdout(
+            contains("Scaffolded")
+                .and(contains("✓ TOML syntax + schema"))
+                .and(contains("all checks passed"))
+                .and(contains("Next:")),
+        );
+    assert!(descriptor_path(tmp.path()).is_file());
+    assert!(notes_path(tmp.path()).is_file());
+
+    // The scaffold is lint-clean as written — via the real lint command, not
+    // just the in-process validation `init` runs itself.
+    skill_eval()
+        .current_dir(tmp.path())
+        .args(["harness", "lint", ".eval-magic/harnesses/cool-cli.toml"])
+        .assert()
+        .success()
+        .stdout(contains("all checks passed"));
+}
+
+#[test]
+fn harness_init_scaffold_registers_at_baseline() {
+    let tmp = TempDir::new().unwrap();
+
+    skill_eval()
+        .current_dir(tmp.path())
+        .args(["harness", "init", "cool-cli"])
+        .assert()
+        .success();
+    skill_eval()
+        .current_dir(tmp.path())
+        .args(["harness", "list"])
+        .assert()
+        .success()
+        .stdout(
+            contains("cool-cli")
+                .and(contains("project"))
+                .and(contains("baseline")),
+        );
+}
+
+#[test]
+fn harness_init_refuses_to_overwrite_an_existing_descriptor() {
+    let tmp = TempDir::new().unwrap();
+    fs::create_dir_all(tmp.path().join(".eval-magic/harnesses")).unwrap();
+    fs::write(descriptor_path(tmp.path()), "label = \"cool-cli\"\n").unwrap();
+
+    skill_eval()
+        .current_dir(tmp.path())
+        .args(["harness", "init", "cool-cli"])
+        .assert()
+        .failure()
+        .stderr(contains("already exists").and(contains("--force")));
+
+    let survived = fs::read_to_string(descriptor_path(tmp.path())).unwrap();
+    assert_eq!(survived, "label = \"cool-cli\"\n");
+    // Nothing is half-written: the notes skeleton is withheld too.
+    assert!(!notes_path(tmp.path()).exists());
+}
+
+#[test]
+fn harness_init_refuses_to_overwrite_an_existing_notes_file() {
+    let tmp = TempDir::new().unwrap();
+    fs::create_dir_all(tmp.path().join(".eval-magic/harnesses")).unwrap();
+    fs::write(notes_path(tmp.path()), "my precious notes\n").unwrap();
+
+    skill_eval()
+        .current_dir(tmp.path())
+        .args(["harness", "init", "cool-cli"])
+        .assert()
+        .failure()
+        .stderr(contains("already exists").and(contains("--force")));
+
+    let survived = fs::read_to_string(notes_path(tmp.path())).unwrap();
+    assert_eq!(survived, "my precious notes\n");
+    assert!(!descriptor_path(tmp.path()).exists());
+}
+
+#[test]
+fn harness_init_force_overwrites_both_files() {
+    let tmp = TempDir::new().unwrap();
+    fs::create_dir_all(tmp.path().join(".eval-magic/harnesses")).unwrap();
+    fs::write(descriptor_path(tmp.path()), "label = \"stale\"\n").unwrap();
+    fs::write(notes_path(tmp.path()), "stale notes\n").unwrap();
+
+    skill_eval()
+        .current_dir(tmp.path())
+        .args(["harness", "init", "cool-cli", "--force"])
+        .assert()
+        .success();
+
+    let descriptor = fs::read_to_string(descriptor_path(tmp.path())).unwrap();
+    assert!(descriptor.contains("label = \"cool-cli\""));
+    let notes = fs::read_to_string(notes_path(tmp.path())).unwrap();
+    assert!(!notes.contains("stale notes"));
+}
+
+#[test]
+fn harness_init_stdout_prints_the_template_without_writing() {
+    let tmp = TempDir::new().unwrap();
+
+    skill_eval()
+        .current_dir(tmp.path())
+        .args(["harness", "init", "cool-cli", "--stdout"])
+        .assert()
+        .success()
+        .stdout(contains("label = \"cool-cli\"").and(contains("Scaffolded").not()));
+
+    assert!(!tmp.path().join(".eval-magic").exists());
+}
+
+#[test]
+fn harness_init_rejects_a_non_kebab_case_name() {
+    let tmp = TempDir::new().unwrap();
+
+    skill_eval()
+        .current_dir(tmp.path())
+        .args(["harness", "init", "Not_Kebab"])
+        .assert()
+        .failure()
+        .stderr(contains("kebab-case"));
+
+    assert!(!tmp.path().join(".eval-magic").exists());
+}
+
+#[test]
+fn harness_init_notes_overlay_semantics_for_registered_names() {
+    let tmp = TempDir::new().unwrap();
+
+    // Scaffolding a built-in's name is legitimate layering, not an error —
+    // but the note must say the file overlays the registered harness.
+    skill_eval()
+        .current_dir(tmp.path())
+        .args(["harness", "init", "claude-code"])
+        .assert()
+        .success()
+        .stderr(contains("already registered").and(contains("overlay")));
+
+    // The label-only scaffold merges onto the built-in as a no-op.
+    skill_eval()
+        .current_dir(tmp.path())
+        .args(["harness", "lint", ".eval-magic/harnesses/claude-code.toml"])
+        .assert()
+        .success()
+        .stdout(contains("all checks passed"));
+}
+
+#[test]
+fn harness_init_template_prompts_for_verified_values() {
+    let tmp = TempDir::new().unwrap();
+
+    skill_eval()
+        .current_dir(tmp.path())
+        .args(["harness", "init", "cool-cli"])
+        .assert()
+        .success();
+
+    let descriptor = fs::read_to_string(descriptor_path(tmp.path())).unwrap();
+    for needle in [
+        "VERIFY",
+        "guess",
+        "cool-cli-notes.md",
+        "claude-stream-json",
+        "codex-items",
+        "[guard]",
+        "harness lint",
+    ] {
+        assert!(
+            descriptor.contains(needle),
+            "descriptor template should mention {needle:?}"
+        );
+    }
+
+    let notes = fs::read_to_string(notes_path(tmp.path())).unwrap();
+    for needle in ["cool-cli", "Verified against", "Verification record"] {
+        assert!(
+            notes.contains(needle),
+            "notes skeleton should mention {needle:?}"
+        );
+    }
+}
+
+#[test]
+fn harness_init_help_documents_the_scaffold_workflow() {
+    skill_eval()
+        .args(["harness", "init", "--help"])
+        .assert()
+        .success()
+        .stdout(
+            contains("lint-clean")
+                .and(contains("overlay"))
+                .and(contains("docs/byoh.md"))
+                .and(contains("--force"))
+                .and(contains("guess")),
+        );
+}
diff --git a/tests/cli/helpers.rs b/tests/cli/helpers.rs
index eae12dc..bc34b2f 100644
--- a/tests/cli/helpers.rs
+++ b/tests/cli/helpers.rs
@@ -7,7 +7,11 @@ use tempfile::TempDir;
 
 /// Build a `Command` for the built `eval-magic` binary.
 pub fn skill_eval() -> Command {
-    Command::cargo_bin("eval-magic").expect("binary `eval-magic` should build")
+    let mut cmd = Command::cargo_bin("eval-magic").expect("binary `eval-magic` should build");
+    // Disable user-global descriptor discovery so a developer's
+    // ~/.config/eval-magic/harnesses never leaks into the tests.
+    cmd.env("EVAL_MAGIC_CONFIG_DIR", "");
+    cmd
 }
 
 /// A canonicalized temp root (resolves macOS /var → /private/var so the binary's
diff --git a/tests/cli/main.rs b/tests/cli/main.rs
index ef77a55..b16c3cc 100644
--- a/tests/cli/main.rs
+++ b/tests/cli/main.rs
@@ -13,6 +13,8 @@ mod basics;
 mod grade;
 mod grade_models;
 mod guard;
+mod harness;
+mod harness_init;
 mod init;
 mod package;
 mod stray_writes;
diff --git a/tests/cli/package.rs b/tests/cli/package.rs
index cfc031f..cba6ba2 100644
--- a/tests/cli/package.rs
+++ b/tests/cli/package.rs
@@ -73,7 +73,13 @@ fn cargo_package_excludes_repo_local_authoring_files() {
         "LICENSE",
         "README.md",
         "schema/evals.schema.json",
-        "profiles/codex/plan-mode.md",
+        "schema/harness-descriptor.schema.json",
+        "profiles/shared/plan-mode.md",
+        "harnesses/claude-code.toml",
+        "harnesses/codex.toml",
+        "harnesses/opencode.toml",
+        "harnesses/template.toml",
+        "harnesses/template-notes.md",
         "src/main.rs",
     ] {
         assert!(
diff --git a/tests/fixtures/conditions/claude-code.json b/tests/fixtures/conditions/claude-code.json
new file mode 100644
index 0000000..199a907
--- /dev/null
+++ b/tests/fixtures/conditions/claude-code.json
@@ -0,0 +1,19 @@
+{
+  "mode": "new-skill",
+  "conditions": [
+    {
+      "name": "with_skill",
+      "skill_path": "/tmp/eval/skill-dir/mr-review/SKILL.md",
+      "staged_skill_slug": "slow-powers-eval-1-with_skill__mr-review"
+    },
+    {
+      "name": "without_skill",
+      "skill_path": null,
+      "staged_skill_slug": null
+    }
+  ],
+  "timestamp": "2026-07-14T04:29:09.009Z",
+  "harness": "claude-code",
+  "run_nonce": "mrk5j5zj-6d2180",
+  "runs": 1
+}
diff --git a/tests/fixtures/conditions/codex.json b/tests/fixtures/conditions/codex.json
new file mode 100644
index 0000000..95e25bf
--- /dev/null
+++ b/tests/fixtures/conditions/codex.json
@@ -0,0 +1,19 @@
+{
+  "mode": "new-skill",
+  "conditions": [
+    {
+      "name": "with_skill",
+      "skill_path": "/tmp/eval/skill-dir/mr-review/SKILL.md",
+      "staged_skill_slug": "slow-powers-eval-1-with_skill__mr-review"
+    },
+    {
+      "name": "without_skill",
+      "skill_path": null,
+      "staged_skill_slug": null
+    }
+  ],
+  "timestamp": "2026-07-14T04:29:09.046Z",
+  "harness": "codex",
+  "run_nonce": "mrk5j60f-535258",
+  "runs": 1
+}
diff --git a/tests/fixtures/conditions/no-harness.json b/tests/fixtures/conditions/no-harness.json
new file mode 100644
index 0000000..847dbf1
--- /dev/null
+++ b/tests/fixtures/conditions/no-harness.json
@@ -0,0 +1,18 @@
+{
+  "mode": "new-skill",
+  "conditions": [
+    {
+      "name": "with_skill",
+      "skill_path": "/tmp/eval/skill-dir/mr-review/SKILL.md",
+      "staged_skill_slug": "slow-powers-eval-1-with_skill__mr-review"
+    },
+    {
+      "name": "without_skill",
+      "skill_path": null,
+      "staged_skill_slug": null
+    }
+  ],
+  "timestamp": "2026-07-14T04:29:09.009Z",
+  "run_nonce": "mrk5j5zj-6d2180",
+  "runs": 1
+}
diff --git a/tests/fixtures/conditions/opencode.json b/tests/fixtures/conditions/opencode.json
new file mode 100644
index 0000000..521c90d
--- /dev/null
+++ b/tests/fixtures/conditions/opencode.json
@@ -0,0 +1,19 @@
+{
+  "mode": "new-skill",
+  "conditions": [
+    {
+      "name": "with_skill",
+      "skill_path": "/tmp/eval/skill-dir/mr-review/SKILL.md",
+      "staged_skill_slug": "slow-powers-eval-1-with-skill-mr-review"
+    },
+    {
+      "name": "without_skill",
+      "skill_path": null,
+      "staged_skill_slug": null
+    }
+  ],
+  "timestamp": "2026-07-14T04:29:09.075Z",
+  "harness": "opencode",
+  "run_nonce": "mrk5j619-276678",
+  "runs": 1
+}
diff --git a/tests/golden/claude-code/dispatch-prompt.golden.txt b/tests/golden/claude-code/dispatch-prompt.golden.txt
new file mode 100644
index 0000000..19c177e
--- /dev/null
+++ b/tests/golden/claude-code/dispatch-prompt.golden.txt
@@ -0,0 +1,32 @@
+<session-start-context>
+The following guidelines were loaded at session start by the slow-powers plugin
+(equivalent to the SessionStart hook firing in a real user's environment):
+
+Session guidelines: be concise.
+</session-start-context>
+The following skills are available for use with the Skill tool:
+
+- aux-helper: Assists with auxiliary chores.
+- widget-skill: Builds widgets the house way.
+
+<system-reminder>
+PLAN STEP
+</system-reminder>
+
+You are executing a single test case for a skill evaluation framework.
+Treat this as a real user request — do NOT optimize behavior for the eval.
+
+The `widget-skill` skill is registered under the identifier `slow-powers-eval-2-with_skill__widget-skill` and is discoverable via the Skill tool. If you invoke it, use that identifier.
+If the Skill tool cannot resolve that identifier, read the skill from `/work/staged/widget-skill/SKILL.md` instead.
+
+Available fixture files:
+  - /work/fixtures/input.txt
+Output directory: /work/outputs
+
+Instructions:
+- Write any files you produce into the output directory.
+- After completing the task, write your final user-facing response to /work/outputs/final-message.md.
+- Do not write outside the output directory.
+
+User request:
+Build me a widget.
\ No newline at end of file
diff --git a/tests/golden/claude-code/judge-recipe.golden.md b/tests/golden/claude-code/judge-recipe.golden.md
new file mode 100644
index 0000000..97c7364
--- /dev/null
+++ b/tests/golden/claude-code/judge-recipe.golden.md
@@ -0,0 +1,19 @@
+Dispatch each judge task from judge-tasks.json with:
+
+```bash
+JOBS=${JOBS:-4}
+jq -j '.tasks[] | [.dispatch_prompt_path, .response_path, (.model // "")] | @tsv + "\u0000"' judge-tasks.json | \
+  xargs -0 -P "$JOBS" -I{} sh -c '
+    prompt_path="$(printf "%s" "$1" | cut -f1)"
+    response_path="$(printf "%s" "$1" | cut -f2)"
+    model="$(printf "%s" "$1" | cut -f3)"
+    response_base="${response_path%.json}"
+    mkdir -p "$(dirname "$response_path")"
+    model_arg=""; [ -n "$model" ] && model_arg="--model $model"
+    cd "/work/iter-1" && claude -p --output-format stream-json --verbose --permission-mode acceptEdits $model_arg \
+      "Read the file at $prompt_path and follow it exactly. You are a judge worker only: write the JSON verdict to $response_path, then reply with one sentence. Do not run eval-magic. Do not dispatch other judge tasks. Do not wait for other workers." \
+      </dev/null \
+      > "$response_base.claude-events.jsonl" \
+      2> "$response_base.claude-stderr.log"
+  ' sh {}
+```
\ No newline at end of file
diff --git a/tests/golden/claude-code/manifest-nomodel.golden.md b/tests/golden/claude-code/manifest-nomodel.golden.md
new file mode 100644
index 0000000..60de6e2
--- /dev/null
+++ b/tests/golden/claude-code/manifest-nomodel.golden.md
@@ -0,0 +1,113 @@
+# Dispatch manifest — widget-skill iteration-2
+
+Mode: revision (baseline: iteration-1)
+Generated: 2026-01-01T00:00:00Z
+Total dispatches: 2
+
+## How to use this manifest
+
+In an agent session, read `dispatch.json` (sibling of this file) instead of this manifest. Each task has a `dispatch_prompt_path` field pointing at the file that holds the full prompt — dispatch the task with a short "read this file and follow it" instruction rather than inlining the prompt — plus exact paths for `run.json` and `timing.json`.
+
+After all dispatches (Claude Code):
+
+Run one fresh `claude -p` per task from the env dir (`cd <eval-root>` — `claude` has no --cd flag). `--output-format stream-json` requires `--verbose`; detach stdin with `</dev/null` so a permission prompt cannot block and piped task data cannot become extra prompt context; capture stdout as `outputs/claude-events.jsonl` and stderr as `outputs/claude-stderr.log`.
+
+```bash
+cd <eval-root> && claude -p --output-format stream-json --verbose --permission-mode acceptEdits \
+  "Read the file at <dispatch_prompt_path> and follow its instructions exactly. When you finish, make your final response your closing summary." \
+  </dev/null \
+  > <outputs_dir>/claude-events.jsonl \
+  2> <outputs_dir>/claude-stderr.log
+```
+
+Parallel dispatch from this iteration directory:
+
+```bash
+JOBS=${JOBS:-4}
+jq -j '.tasks[] | [.eval_root, .dispatch_prompt_path, .outputs_dir] | @tsv + "\u0000"' dispatch.json | \
+  xargs -0 -P "$JOBS" -I{} sh -c '
+    eval_root="$(printf "%s" "$1" | cut -f1)"
+    prompt_path="$(printf "%s" "$1" | cut -f2)"
+    outputs_dir="$(printf "%s" "$1" | cut -f3)"
+    mkdir -p "$outputs_dir"
+    cd "$eval_root" && claude -p --output-format stream-json --verbose --permission-mode acceptEdits \
+      "Read the file at $prompt_path and follow its instructions exactly. When you finish, make your final response your closing summary." \
+      </dev/null \
+      > "$outputs_dir/claude-events.jsonl" \
+      2> "$outputs_dir/claude-stderr.log"
+  ' sh {}
+```
+
+Then run `eval-magic ingest --harness claude-code`; ingest reads each task's `outputs/claude-events.jsonl`.
+
+After all dispatches:
+
+1. Run `eval-magic ingest --harness <harness>` — a fixed-order chain of record-runs (assembles every task's `run.json` from `dispatch.json` + the task's own `outputs/final-message.md` + the events file the harness CLI wrote under `outputs/`, and backfills `timing.json` with transcript-derived tokens/duration; never clobbers an existing record), fill-transcripts, detect-stray-writes, and grade. Optional higher-fidelity timing: write `{ "total_tokens": <n>, "duration_ms": <n>, "source": "completion-event" }` from the task completion event to `timing.json` right after a dispatch — completion-event numbers always win over the backfill.
+2. Dispatch the judge tasks ingest lists, then run `eval-magic finalize` for the benchmark.
+
+On a harness without persisted transcripts, instead write each task's `run.json` (matching `skills/evaluating-skills/schema/run-record.schema.json`, enforced at runtime by grade/fill-transcripts/detect-stray-writes) and `timing.json` by hand when its subagent returns: carry over `eval_id`, `condition`, `skill_path` (`null` on the without_skill arm), `prompt`, and `files` from the task; populate `final_message` from the subagent's reply; leave `tool_invocations` as `[]`; capture `total_tokens`/`duration_ms` from the task completion event immediately — they may not be persisted anywhere else.
+
+## Dispatches
+### demo-eval / with_skill
+
+- run.json:    /work/cond/run.json
+- timing.json: /work/cond/timing.json
+
+```
+<session-start-context>
+The following guidelines were loaded at session start by the slow-powers plugin
+(equivalent to the SessionStart hook firing in a real user's environment):
+
+Session guidelines: be concise.
+</session-start-context>
+The following skills are available for use with the Skill tool:
+
+- aux-helper: Assists with auxiliary chores.
+- widget-skill: Builds widgets the house way.
+
+<system-reminder>
+PLAN STEP
+</system-reminder>
+
+You are executing a single test case for a skill evaluation framework.
+Treat this as a real user request — do NOT optimize behavior for the eval.
+
+The `widget-skill` skill is registered under the identifier `slow-powers-eval-2-with_skill__widget-skill` and is discoverable via the Skill tool. If you invoke it, use that identifier.
+If the Skill tool cannot resolve that identifier, read the skill from `/work/staged/widget-skill/SKILL.md` instead.
+
+Available fixture files:
+  - /work/fixtures/input.txt
+Output directory: /work/outputs
+
+Instructions:
+- Write any files you produce into the output directory.
+- After completing the task, write your final user-facing response to /work/outputs/final-message.md.
+- Do not write outside the output directory.
+
+User request:
+Build me a widget.
+```
+
+### demo-eval / without_skill
+
+- run.json:    /work/cond-b/run.json
+- timing.json: /work/cond-b/timing.json
+
+```
+You are executing a single test case for a skill evaluation framework.
+Treat this as a real user request — do NOT optimize behavior for the eval.
+
+No skill is loaded. Respond as you naturally would.
+
+Available fixture files:
+  - /work/fixtures/input.txt
+Output directory: /work/outputs-b
+
+Instructions:
+- Write any files you produce into the output directory.
+- After completing the task, write your final user-facing response to /work/outputs-b/final-message.md.
+- Do not write outside the output directory.
+
+User request:
+Build me a widget.
+```
diff --git a/tests/golden/claude-code/manifest.golden.md b/tests/golden/claude-code/manifest.golden.md
new file mode 100644
index 0000000..9700276
--- /dev/null
+++ b/tests/golden/claude-code/manifest.golden.md
@@ -0,0 +1,113 @@
+# Dispatch manifest — widget-skill iteration-2
+
+Mode: revision (baseline: iteration-1)
+Generated: 2026-01-01T00:00:00Z
+Total dispatches: 2
+
+## How to use this manifest
+
+In an agent session, read `dispatch.json` (sibling of this file) instead of this manifest. Each task has a `dispatch_prompt_path` field pointing at the file that holds the full prompt — dispatch the task with a short "read this file and follow it" instruction rather than inlining the prompt — plus exact paths for `run.json` and `timing.json`.
+
+After all dispatches (Claude Code):
+
+Run one fresh `claude -p` per task from the env dir (`cd <eval-root>` — `claude` has no --cd flag). `--output-format stream-json` requires `--verbose`; detach stdin with `</dev/null` so a permission prompt cannot block and piped task data cannot become extra prompt context; capture stdout as `outputs/claude-events.jsonl` and stderr as `outputs/claude-stderr.log`.
+
+```bash
+cd <eval-root> && claude -p --output-format stream-json --verbose --permission-mode acceptEdits --model model-x \
+  "Read the file at <dispatch_prompt_path> and follow its instructions exactly. When you finish, make your final response your closing summary." \
+  </dev/null \
+  > <outputs_dir>/claude-events.jsonl \
+  2> <outputs_dir>/claude-stderr.log
+```
+
+Parallel dispatch from this iteration directory:
+
+```bash
+JOBS=${JOBS:-4}
+jq -j '.tasks[] | [.eval_root, .dispatch_prompt_path, .outputs_dir] | @tsv + "\u0000"' dispatch.json | \
+  xargs -0 -P "$JOBS" -I{} sh -c '
+    eval_root="$(printf "%s" "$1" | cut -f1)"
+    prompt_path="$(printf "%s" "$1" | cut -f2)"
+    outputs_dir="$(printf "%s" "$1" | cut -f3)"
+    mkdir -p "$outputs_dir"
+    cd "$eval_root" && claude -p --output-format stream-json --verbose --permission-mode acceptEdits --model model-x \
+      "Read the file at $prompt_path and follow its instructions exactly. When you finish, make your final response your closing summary." \
+      </dev/null \
+      > "$outputs_dir/claude-events.jsonl" \
+      2> "$outputs_dir/claude-stderr.log"
+  ' sh {}
+```
+
+Then run `eval-magic ingest --harness claude-code`; ingest reads each task's `outputs/claude-events.jsonl`.
+
+After all dispatches:
+
+1. Run `eval-magic ingest --harness <harness>` — a fixed-order chain of record-runs (assembles every task's `run.json` from `dispatch.json` + the task's own `outputs/final-message.md` + the events file the harness CLI wrote under `outputs/`, and backfills `timing.json` with transcript-derived tokens/duration; never clobbers an existing record), fill-transcripts, detect-stray-writes, and grade. Optional higher-fidelity timing: write `{ "total_tokens": <n>, "duration_ms": <n>, "source": "completion-event" }` from the task completion event to `timing.json` right after a dispatch — completion-event numbers always win over the backfill.
+2. Dispatch the judge tasks ingest lists, then run `eval-magic finalize` for the benchmark.
+
+On a harness without persisted transcripts, instead write each task's `run.json` (matching `skills/evaluating-skills/schema/run-record.schema.json`, enforced at runtime by grade/fill-transcripts/detect-stray-writes) and `timing.json` by hand when its subagent returns: carry over `eval_id`, `condition`, `skill_path` (`null` on the without_skill arm), `prompt`, and `files` from the task; populate `final_message` from the subagent's reply; leave `tool_invocations` as `[]`; capture `total_tokens`/`duration_ms` from the task completion event immediately — they may not be persisted anywhere else.
+
+## Dispatches
+### demo-eval / with_skill
+
+- run.json:    /work/cond/run.json
+- timing.json: /work/cond/timing.json
+
+```
+<session-start-context>
+The following guidelines were loaded at session start by the slow-powers plugin
+(equivalent to the SessionStart hook firing in a real user's environment):
+
+Session guidelines: be concise.
+</session-start-context>
+The following skills are available for use with the Skill tool:
+
+- aux-helper: Assists with auxiliary chores.
+- widget-skill: Builds widgets the house way.
+
+<system-reminder>
+PLAN STEP
+</system-reminder>
+
+You are executing a single test case for a skill evaluation framework.
+Treat this as a real user request — do NOT optimize behavior for the eval.
+
+The `widget-skill` skill is registered under the identifier `slow-powers-eval-2-with_skill__widget-skill` and is discoverable via the Skill tool. If you invoke it, use that identifier.
+If the Skill tool cannot resolve that identifier, read the skill from `/work/staged/widget-skill/SKILL.md` instead.
+
+Available fixture files:
+  - /work/fixtures/input.txt
+Output directory: /work/outputs
+
+Instructions:
+- Write any files you produce into the output directory.
+- After completing the task, write your final user-facing response to /work/outputs/final-message.md.
+- Do not write outside the output directory.
+
+User request:
+Build me a widget.
+```
+
+### demo-eval / without_skill
+
+- run.json:    /work/cond-b/run.json
+- timing.json: /work/cond-b/timing.json
+
+```
+You are executing a single test case for a skill evaluation framework.
+Treat this as a real user request — do NOT optimize behavior for the eval.
+
+No skill is loaded. Respond as you naturally would.
+
+Available fixture files:
+  - /work/fixtures/input.txt
+Output directory: /work/outputs-b
+
+Instructions:
+- Write any files you produce into the output directory.
+- After completing the task, write your final user-facing response to /work/outputs-b/final-message.md.
+- Do not write outside the output directory.
+
+User request:
+Build me a widget.
+```
diff --git a/tests/golden/claude-code/runbook.golden.md b/tests/golden/claude-code/runbook.golden.md
new file mode 100644
index 0000000..927197d
--- /dev/null
+++ b/tests/golden/claude-code/runbook.golden.md
@@ -0,0 +1,65 @@
+# Eval run — widget-skill (iteration 2, claude-code)
+
+This runbook is for a human driving the run from a terminal. Work from this iteration directory
+and copy-paste each step. The workspace is self-contained — you should not need the surrounding
+repo.
+
+- **Skill under test:** widget-skill
+- **Mode:** revision — comparing `old_skill` vs `new_skill`
+- **Dispatches:** 6 (the `tasks[]` array in `/work/.eval-magic/widget-skill/iteration-2/dispatch.json`)
+
+## 1. Dispatch the eval agents, then ingest
+
+Next: iterate the tasks[] array in dispatch.json and dispatch each task (from the env dir — `claude` has no --cd flag) with:
+cd <eval-root> && claude -p --output-format stream-json --verbose --permission-mode acceptEdits --model model-x \
+  "Read the file at <dispatch_prompt_path> and follow its instructions exactly. When you finish, make your final response your closing summary." \
+  </dev/null \
+  > <outputs_dir>/claude-events.jsonl \
+  2> <outputs_dir>/claude-stderr.log
+Then run `ingest --skill-dir /tmp/skills --skill widget-skill --iteration 2 --harness claude-code`.
+
+`ingest` records each run, backfills transcripts, scans for stray writes, and grades every
+mechanical assertion. It then prints any `llm_judge` tasks it could not grade itself.
+
+## 2. Dispatch the judge agents, then finalize
+Dispatch each judge task from judge-tasks.json with:
+
+```bash
+JOBS=${JOBS:-4}
+jq -j '.tasks[] | [.dispatch_prompt_path, .response_path, (.model // "")] | @tsv + "\u0000"' judge-tasks.json | \
+  xargs -0 -P "$JOBS" -I{} sh -c '
+    prompt_path="$(printf "%s" "$1" | cut -f1)"
+    response_path="$(printf "%s" "$1" | cut -f2)"
+    model="$(printf "%s" "$1" | cut -f3)"
+    response_base="${response_path%.json}"
+    mkdir -p "$(dirname "$response_path")"
+    model_arg=""; [ -n "$model" ] && model_arg="--model $model"
+    cd "/work/.eval-magic/widget-skill/iteration-2" && claude -p --output-format stream-json --verbose --permission-mode acceptEdits $model_arg \
+      "Read the file at $prompt_path and follow it exactly. You are a judge worker only: write the JSON verdict to $response_path, then reply with one sentence. Do not run eval-magic. Do not dispatch other judge tasks. Do not wait for other workers." \
+      </dev/null \
+      > "$response_base.claude-events.jsonl" \
+      2> "$response_base.claude-stderr.log"
+  ' sh {}
+```
+
+Then merge the verdicts and aggregate:
+
+```
+eval-magic finalize --skill-dir /tmp/skills --skill widget-skill --iteration 2 --harness claude-code
+```
+
+## 3. Read the result
+
+`finalize` writes the cross-condition benchmark to:
+
+```
+/work/.eval-magic/widget-skill/iteration-2/benchmark.json
+```
+
+Read it for the per-condition pass rates and the `old_skill` − `new_skill` deltas.
+
+## 4. Tear down
+
+```
+eval-magic teardown --skill-dir /tmp/skills --skill widget-skill --harness claude-code
+```
diff --git a/tests/golden/claude-code/skills-block.golden.txt b/tests/golden/claude-code/skills-block.golden.txt
new file mode 100644
index 0000000..d83867d
--- /dev/null
+++ b/tests/golden/claude-code/skills-block.golden.txt
@@ -0,0 +1,4 @@
+The following skills are available for use with the Skill tool:
+
+- aux-helper: Assists with auxiliary chores.
+- widget-skill: Builds widgets the house way.
\ No newline at end of file
diff --git a/tests/golden/codex/dispatch-prompt.golden.txt b/tests/golden/codex/dispatch-prompt.golden.txt
new file mode 100644
index 0000000..d3b0ef8
--- /dev/null
+++ b/tests/golden/codex/dispatch-prompt.golden.txt
@@ -0,0 +1,32 @@
+<session-start-context>
+The following guidelines were loaded at session start by the slow-powers plugin
+(equivalent to the SessionStart hook firing in a real user's environment):
+
+Session guidelines: be concise.
+</session-start-context>
+## Skills
+
+- aux-helper: Assists with auxiliary chores. (file: /work/staged/aux-helper/SKILL.md)
+- widget-skill: Builds widgets the house way. (file: /work/staged/widget-skill/SKILL.md)
+
+<system-reminder>
+PLAN STEP
+</system-reminder>
+
+You are executing a single test case for a skill evaluation framework.
+Treat this as a real user request — do NOT optimize behavior for the eval.
+
+The `widget-skill` skill is registered under the identifier `slow-powers-eval-2-with_skill__widget-skill` and is discoverable as a Codex skill. If you invoke it, use that identifier.
+If it does not load as a Codex skill, read the skill from `/work/staged/widget-skill/SKILL.md` instead.
+
+Available fixture files:
+  - /work/fixtures/input.txt
+Output directory: /work/outputs
+
+Instructions:
+- Write any files you produce into the output directory.
+- After completing the task, write your final user-facing response to /work/outputs/final-message.md.
+- Do not write outside the output directory.
+
+User request:
+Build me a widget.
\ No newline at end of file
diff --git a/tests/golden/codex/judge-recipe-noguard.golden.md b/tests/golden/codex/judge-recipe-noguard.golden.md
new file mode 100644
index 0000000..dc2e2a5
--- /dev/null
+++ b/tests/golden/codex/judge-recipe-noguard.golden.md
@@ -0,0 +1,19 @@
+Dispatch each judge task from judge-tasks.json with:
+
+```bash
+JOBS=${JOBS:-4}
+jq -j '.tasks[] | [.dispatch_prompt_path, .response_path, (.model // "")] | @tsv + "\u0000"' judge-tasks.json | \
+  xargs -0 -P "$JOBS" -I{} sh -c '
+    prompt_path="$(printf "%s" "$1" | cut -f1)"
+    response_path="$(printf "%s" "$1" | cut -f2)"
+    model="$(printf "%s" "$1" | cut -f3)"
+    response_base="${response_path%.json}"
+    mkdir -p "$(dirname "$response_path")"
+    model_arg=""; [ -n "$model" ] && model_arg="-m $model"
+    codex --ask-for-approval never exec --cd "/work/iter-1" --sandbox workspace-write $model_arg --json \
+      "Read the file at $prompt_path and follow it exactly. You are a judge worker only: write the JSON verdict to $response_path, then reply with one sentence. Do not run eval-magic. Do not dispatch other judge tasks. Do not wait for other workers." \
+      </dev/null \
+      > "$response_base.codex-events.jsonl" \
+      2> "$response_base.codex-stderr.log"
+  ' sh {}
+```
\ No newline at end of file
diff --git a/tests/golden/codex/judge-recipe.golden.md b/tests/golden/codex/judge-recipe.golden.md
new file mode 100644
index 0000000..476c51a
--- /dev/null
+++ b/tests/golden/codex/judge-recipe.golden.md
@@ -0,0 +1,19 @@
+Dispatch each judge task from judge-tasks.json with:
+
+```bash
+JOBS=${JOBS:-4}
+jq -j '.tasks[] | [.dispatch_prompt_path, .response_path, (.model // "")] | @tsv + "\u0000"' judge-tasks.json | \
+  xargs -0 -P "$JOBS" -I{} sh -c '
+    prompt_path="$(printf "%s" "$1" | cut -f1)"
+    response_path="$(printf "%s" "$1" | cut -f2)"
+    model="$(printf "%s" "$1" | cut -f3)"
+    response_base="${response_path%.json}"
+    mkdir -p "$(dirname "$response_path")"
+    model_arg=""; [ -n "$model" ] && model_arg="-m $model"
+    codex --ask-for-approval never exec --cd "/work/iter-1" --sandbox workspace-write --dangerously-bypass-hook-trust $model_arg --json \
+      "Read the file at $prompt_path and follow it exactly. You are a judge worker only: write the JSON verdict to $response_path, then reply with one sentence. Do not run eval-magic. Do not dispatch other judge tasks. Do not wait for other workers." \
+      </dev/null \
+      > "$response_base.codex-events.jsonl" \
+      2> "$response_base.codex-stderr.log"
+  ' sh {}
+```
\ No newline at end of file
diff --git a/tests/golden/codex/manifest-noguard.golden.md b/tests/golden/codex/manifest-noguard.golden.md
new file mode 100644
index 0000000..1de7120
--- /dev/null
+++ b/tests/golden/codex/manifest-noguard.golden.md
@@ -0,0 +1,115 @@
+# Dispatch manifest — widget-skill iteration-2
+
+Mode: revision (baseline: iteration-1)
+Generated: 2026-01-01T00:00:00Z
+Total dispatches: 2
+
+## How to use this manifest
+
+In an agent session, read `dispatch.json` (sibling of this file) instead of this manifest. Each task has a `dispatch_prompt_path` field pointing at the file that holds the full prompt — dispatch the task with a short "read this file and follow it" instruction rather than inlining the prompt — plus exact paths for `run.json` and `timing.json`.
+
+After all dispatches (Codex):
+
+Run one fresh `codex --ask-for-approval never exec --json` per task. Detach stdin with `</dev/null` so piped task data cannot become extra prompt context; capture stdout as `outputs/codex-events.jsonl` and stderr as `outputs/codex-stderr.log`.
+
+```bash
+codex --ask-for-approval never exec --cd <eval-root> --sandbox workspace-write -m model-x --json \
+  --output-last-message <outputs_dir>/final-message.md \
+  "Read the file at <dispatch_prompt_path> and follow its instructions exactly. When you finish, make your final response exactly the same text you wrote to <outputs_dir>/final-message.md." \
+  </dev/null \
+  > <outputs_dir>/codex-events.jsonl \
+  2> <outputs_dir>/codex-stderr.log
+```
+
+Parallel dispatch from this iteration directory:
+
+```bash
+JOBS=${JOBS:-4}
+jq -j '.tasks[] | [.eval_root, .dispatch_prompt_path, .outputs_dir] | @tsv + "\u0000"' dispatch.json | \
+  xargs -0 -P "$JOBS" -I{} sh -c '
+    eval_root="$(printf "%s" "$1" | cut -f1)"
+    prompt_path="$(printf "%s" "$1" | cut -f2)"
+    outputs_dir="$(printf "%s" "$1" | cut -f3)"
+    mkdir -p "$outputs_dir"
+    codex --ask-for-approval never exec --cd "$eval_root" --sandbox workspace-write -m model-x --json \
+      --output-last-message "$outputs_dir/final-message.md" \
+      "Read the file at $prompt_path and follow its instructions exactly. When you finish, make your final response exactly the same text you wrote to $outputs_dir/final-message.md." \
+      </dev/null \
+      > "$outputs_dir/codex-events.jsonl" \
+      2> "$outputs_dir/codex-stderr.log"
+  ' sh {}
+```
+
+Then run `eval-magic ingest --harness codex`; Codex transcript ingest reads each task's `outputs/codex-events.jsonl`.
+
+After all dispatches:
+
+1. Run `eval-magic ingest --harness <harness>` — a fixed-order chain of record-runs (assembles every task's `run.json` from `dispatch.json` + the task's own `outputs/final-message.md` + the events file the harness CLI wrote under `outputs/`, and backfills `timing.json` with transcript-derived tokens/duration; never clobbers an existing record), fill-transcripts, detect-stray-writes, and grade. Optional higher-fidelity timing: write `{ "total_tokens": <n>, "duration_ms": <n>, "source": "completion-event" }` from the task completion event to `timing.json` right after a dispatch — completion-event numbers always win over the backfill.
+2. Dispatch the judge tasks ingest lists, then run `eval-magic finalize` for the benchmark.
+
+On a harness without persisted transcripts, instead write each task's `run.json` (matching `skills/evaluating-skills/schema/run-record.schema.json`, enforced at runtime by grade/fill-transcripts/detect-stray-writes) and `timing.json` by hand when its subagent returns: carry over `eval_id`, `condition`, `skill_path` (`null` on the without_skill arm), `prompt`, and `files` from the task; populate `final_message` from the subagent's reply; leave `tool_invocations` as `[]`; capture `total_tokens`/`duration_ms` from the task completion event immediately — they may not be persisted anywhere else.
+
+## Dispatches
+### demo-eval / with_skill
+
+- run.json:    /work/cond/run.json
+- timing.json: /work/cond/timing.json
+
+```
+<session-start-context>
+The following guidelines were loaded at session start by the slow-powers plugin
+(equivalent to the SessionStart hook firing in a real user's environment):
+
+Session guidelines: be concise.
+</session-start-context>
+## Skills
+
+- aux-helper: Assists with auxiliary chores. (file: /work/staged/aux-helper/SKILL.md)
+- widget-skill: Builds widgets the house way. (file: /work/staged/widget-skill/SKILL.md)
+
+<system-reminder>
+PLAN STEP
+</system-reminder>
+
+You are executing a single test case for a skill evaluation framework.
+Treat this as a real user request — do NOT optimize behavior for the eval.
+
+The `widget-skill` skill is registered under the identifier `slow-powers-eval-2-with_skill__widget-skill` and is discoverable as a Codex skill. If you invoke it, use that identifier.
+If it does not load as a Codex skill, read the skill from `/work/staged/widget-skill/SKILL.md` instead.
+
+Available fixture files:
+  - /work/fixtures/input.txt
+Output directory: /work/outputs
+
+Instructions:
+- Write any files you produce into the output directory.
+- After completing the task, write your final user-facing response to /work/outputs/final-message.md.
+- Do not write outside the output directory.
+
+User request:
+Build me a widget.
+```
+
+### demo-eval / without_skill
+
+- run.json:    /work/cond-b/run.json
+- timing.json: /work/cond-b/timing.json
+
+```
+You are executing a single test case for a skill evaluation framework.
+Treat this as a real user request — do NOT optimize behavior for the eval.
+
+No skill is loaded. Respond as you naturally would.
+
+Available fixture files:
+  - /work/fixtures/input.txt
+Output directory: /work/outputs-b
+
+Instructions:
+- Write any files you produce into the output directory.
+- After completing the task, write your final user-facing response to /work/outputs-b/final-message.md.
+- Do not write outside the output directory.
+
+User request:
+Build me a widget.
+```
diff --git a/tests/golden/codex/manifest.golden.md b/tests/golden/codex/manifest.golden.md
new file mode 100644
index 0000000..264f8bc
--- /dev/null
+++ b/tests/golden/codex/manifest.golden.md
@@ -0,0 +1,115 @@
+# Dispatch manifest — widget-skill iteration-2
+
+Mode: revision (baseline: iteration-1)
+Generated: 2026-01-01T00:00:00Z
+Total dispatches: 2
+
+## How to use this manifest
+
+In an agent session, read `dispatch.json` (sibling of this file) instead of this manifest. Each task has a `dispatch_prompt_path` field pointing at the file that holds the full prompt — dispatch the task with a short "read this file and follow it" instruction rather than inlining the prompt — plus exact paths for `run.json` and `timing.json`.
+
+After all dispatches (Codex):
+
+Run one fresh `codex --ask-for-approval never exec --json` per task. Detach stdin with `</dev/null` so piped task data cannot become extra prompt context; capture stdout as `outputs/codex-events.jsonl` and stderr as `outputs/codex-stderr.log`.
+
+```bash
+codex --ask-for-approval never exec --cd <eval-root> --sandbox workspace-write --dangerously-bypass-hook-trust -m model-x --json \
+  --output-last-message <outputs_dir>/final-message.md \
+  "Read the file at <dispatch_prompt_path> and follow its instructions exactly. When you finish, make your final response exactly the same text you wrote to <outputs_dir>/final-message.md." \
+  </dev/null \
+  > <outputs_dir>/codex-events.jsonl \
+  2> <outputs_dir>/codex-stderr.log
+```
+
+Parallel dispatch from this iteration directory:
+
+```bash
+JOBS=${JOBS:-4}
+jq -j '.tasks[] | [.eval_root, .dispatch_prompt_path, .outputs_dir] | @tsv + "\u0000"' dispatch.json | \
+  xargs -0 -P "$JOBS" -I{} sh -c '
+    eval_root="$(printf "%s" "$1" | cut -f1)"
+    prompt_path="$(printf "%s" "$1" | cut -f2)"
+    outputs_dir="$(printf "%s" "$1" | cut -f3)"
+    mkdir -p "$outputs_dir"
+    codex --ask-for-approval never exec --cd "$eval_root" --sandbox workspace-write --dangerously-bypass-hook-trust -m model-x --json \
+      --output-last-message "$outputs_dir/final-message.md" \
+      "Read the file at $prompt_path and follow its instructions exactly. When you finish, make your final response exactly the same text you wrote to $outputs_dir/final-message.md." \
+      </dev/null \
+      > "$outputs_dir/codex-events.jsonl" \
+      2> "$outputs_dir/codex-stderr.log"
+  ' sh {}
+```
+
+Then run `eval-magic ingest --harness codex`; Codex transcript ingest reads each task's `outputs/codex-events.jsonl`.
+
+After all dispatches:
+
+1. Run `eval-magic ingest --harness <harness>` — a fixed-order chain of record-runs (assembles every task's `run.json` from `dispatch.json` + the task's own `outputs/final-message.md` + the events file the harness CLI wrote under `outputs/`, and backfills `timing.json` with transcript-derived tokens/duration; never clobbers an existing record), fill-transcripts, detect-stray-writes, and grade. Optional higher-fidelity timing: write `{ "total_tokens": <n>, "duration_ms": <n>, "source": "completion-event" }` from the task completion event to `timing.json` right after a dispatch — completion-event numbers always win over the backfill.
+2. Dispatch the judge tasks ingest lists, then run `eval-magic finalize` for the benchmark.
+
+On a harness without persisted transcripts, instead write each task's `run.json` (matching `skills/evaluating-skills/schema/run-record.schema.json`, enforced at runtime by grade/fill-transcripts/detect-stray-writes) and `timing.json` by hand when its subagent returns: carry over `eval_id`, `condition`, `skill_path` (`null` on the without_skill arm), `prompt`, and `files` from the task; populate `final_message` from the subagent's reply; leave `tool_invocations` as `[]`; capture `total_tokens`/`duration_ms` from the task completion event immediately — they may not be persisted anywhere else.
+
+## Dispatches
+### demo-eval / with_skill
+
+- run.json:    /work/cond/run.json
+- timing.json: /work/cond/timing.json
+
+```
+<session-start-context>
+The following guidelines were loaded at session start by the slow-powers plugin
+(equivalent to the SessionStart hook firing in a real user's environment):
+
+Session guidelines: be concise.
+</session-start-context>
+## Skills
+
+- aux-helper: Assists with auxiliary chores. (file: /work/staged/aux-helper/SKILL.md)
+- widget-skill: Builds widgets the house way. (file: /work/staged/widget-skill/SKILL.md)
+
+<system-reminder>
+PLAN STEP
+</system-reminder>
+
+You are executing a single test case for a skill evaluation framework.
+Treat this as a real user request — do NOT optimize behavior for the eval.
+
+The `widget-skill` skill is registered under the identifier `slow-powers-eval-2-with_skill__widget-skill` and is discoverable as a Codex skill. If you invoke it, use that identifier.
+If it does not load as a Codex skill, read the skill from `/work/staged/widget-skill/SKILL.md` instead.
+
+Available fixture files:
+  - /work/fixtures/input.txt
+Output directory: /work/outputs
+
+Instructions:
+- Write any files you produce into the output directory.
+- After completing the task, write your final user-facing response to /work/outputs/final-message.md.
+- Do not write outside the output directory.
+
+User request:
+Build me a widget.
+```
+
+### demo-eval / without_skill
+
+- run.json:    /work/cond-b/run.json
+- timing.json: /work/cond-b/timing.json
+
+```
+You are executing a single test case for a skill evaluation framework.
+Treat this as a real user request — do NOT optimize behavior for the eval.
+
+No skill is loaded. Respond as you naturally would.
+
+Available fixture files:
+  - /work/fixtures/input.txt
+Output directory: /work/outputs-b
+
+Instructions:
+- Write any files you produce into the output directory.
+- After completing the task, write your final user-facing response to /work/outputs-b/final-message.md.
+- Do not write outside the output directory.
+
+User request:
+Build me a widget.
+```
diff --git a/tests/golden/codex/runbook.golden.md b/tests/golden/codex/runbook.golden.md
new file mode 100644
index 0000000..f31464d
--- /dev/null
+++ b/tests/golden/codex/runbook.golden.md
@@ -0,0 +1,66 @@
+# Eval run — widget-skill (iteration 2, codex)
+
+This runbook is for a human driving the run from a terminal. Work from this iteration directory
+and copy-paste each step. The workspace is self-contained — you should not need the surrounding
+repo.
+
+- **Skill under test:** widget-skill
+- **Mode:** revision — comparing `old_skill` vs `new_skill`
+- **Dispatches:** 6 (the `tasks[]` array in `/work/.eval-magic/widget-skill/iteration-2/dispatch.json`)
+
+## 1. Dispatch the eval agents, then ingest
+
+Next: iterate the tasks[] array in dispatch.json and dispatch each task with:
+codex --ask-for-approval never exec --cd <eval-root> --sandbox workspace-write --dangerously-bypass-hook-trust -m model-x --json \
+  --output-last-message <outputs_dir>/final-message.md \
+  "Read the file at <dispatch_prompt_path> and follow its instructions exactly. When you finish, make your final response exactly the same text you wrote to <outputs_dir>/final-message.md." \
+  </dev/null \
+  > <outputs_dir>/codex-events.jsonl \
+  2> <outputs_dir>/codex-stderr.log
+Then run `ingest --skill-dir /tmp/skills --skill widget-skill --iteration 2 --harness codex`.
+
+`ingest` records each run, backfills transcripts, scans for stray writes, and grades every
+mechanical assertion. It then prints any `llm_judge` tasks it could not grade itself.
+
+## 2. Dispatch the judge agents, then finalize
+Dispatch each judge task from judge-tasks.json with:
+
+```bash
+JOBS=${JOBS:-4}
+jq -j '.tasks[] | [.dispatch_prompt_path, .response_path, (.model // "")] | @tsv + "\u0000"' judge-tasks.json | \
+  xargs -0 -P "$JOBS" -I{} sh -c '
+    prompt_path="$(printf "%s" "$1" | cut -f1)"
+    response_path="$(printf "%s" "$1" | cut -f2)"
+    model="$(printf "%s" "$1" | cut -f3)"
+    response_base="${response_path%.json}"
+    mkdir -p "$(dirname "$response_path")"
+    model_arg=""; [ -n "$model" ] && model_arg="-m $model"
+    codex --ask-for-approval never exec --cd "/work/.eval-magic/widget-skill/iteration-2" --sandbox workspace-write --dangerously-bypass-hook-trust $model_arg --json \
+      "Read the file at $prompt_path and follow it exactly. You are a judge worker only: write the JSON verdict to $response_path, then reply with one sentence. Do not run eval-magic. Do not dispatch other judge tasks. Do not wait for other workers." \
+      </dev/null \
+      > "$response_base.codex-events.jsonl" \
+      2> "$response_base.codex-stderr.log"
+  ' sh {}
+```
+
+Then merge the verdicts and aggregate:
+
+```
+eval-magic finalize --skill-dir /tmp/skills --skill widget-skill --iteration 2 --harness codex
+```
+
+## 3. Read the result
+
+`finalize` writes the cross-condition benchmark to:
+
+```
+/work/.eval-magic/widget-skill/iteration-2/benchmark.json
+```
+
+Read it for the per-condition pass rates and the `old_skill` − `new_skill` deltas.
+
+## 4. Tear down
+
+```
+eval-magic teardown --skill-dir /tmp/skills --skill widget-skill --harness codex
+```
diff --git a/tests/golden/codex/skills-block.golden.txt b/tests/golden/codex/skills-block.golden.txt
new file mode 100644
index 0000000..d894ed2
--- /dev/null
+++ b/tests/golden/codex/skills-block.golden.txt
@@ -0,0 +1,4 @@
+## Skills
+
+- aux-helper: Assists with auxiliary chores. (file: /work/staged/aux-helper/SKILL.md)
+- widget-skill: Builds widgets the house way. (file: /work/staged/widget-skill/SKILL.md)
\ No newline at end of file
diff --git a/tests/golden/opencode/dispatch-prompt.golden.txt b/tests/golden/opencode/dispatch-prompt.golden.txt
new file mode 100644
index 0000000..ec430d0
--- /dev/null
+++ b/tests/golden/opencode/dispatch-prompt.golden.txt
@@ -0,0 +1,38 @@
+<session-start-context>
+The following guidelines were loaded at session start by the slow-powers plugin
+(equivalent to the SessionStart hook firing in a real user's environment):
+
+Session guidelines: be concise.
+</session-start-context>
+<available_skills>
+  <skill>
+    <name>aux-helper</name>
+    <description>Assists with auxiliary chores.</description>
+  </skill>
+  <skill>
+    <name>widget-skill</name>
+    <description>Builds widgets the house way.</description>
+  </skill>
+</available_skills>
+
+<system-reminder>
+PLAN STEP
+</system-reminder>
+
+You are executing a single test case for a skill evaluation framework.
+Treat this as a real user request — do NOT optimize behavior for the eval.
+
+The `widget-skill` skill is registered under the identifier `slow-powers-eval-2-with-skill-widget-skill` and is discoverable as an OpenCode skill. If you invoke it, use that identifier.
+If it does not load as an OpenCode skill, read the skill from `/work/staged/widget-skill/SKILL.md` instead.
+
+Available fixture files:
+  - /work/fixtures/input.txt
+Output directory: /work/outputs
+
+Instructions:
+- Write any files you produce into the output directory.
+- After completing the task, write your final user-facing response to /work/outputs/final-message.md.
+- Do not write outside the output directory.
+
+User request:
+Build me a widget.
\ No newline at end of file
diff --git a/tests/golden/opencode/manifest.golden.md b/tests/golden/opencode/manifest.golden.md
new file mode 100644
index 0000000..823a9af
--- /dev/null
+++ b/tests/golden/opencode/manifest.golden.md
@@ -0,0 +1,87 @@
+# Dispatch manifest — widget-skill iteration-2
+
+Mode: revision (baseline: iteration-1)
+Generated: 2026-01-01T00:00:00Z
+Total dispatches: 2
+
+## How to use this manifest
+
+In an agent session, read `dispatch.json` (sibling of this file) instead of this manifest. Each task has a `dispatch_prompt_path` field pointing at the file that holds the full prompt — dispatch the task with a short "read this file and follow it" instruction rather than inlining the prompt — plus exact paths for `run.json` and `timing.json`.
+
+After all dispatches:
+
+1. Run `eval-magic ingest --harness <harness>` — a fixed-order chain of record-runs (assembles every task's `run.json` from `dispatch.json` + the task's own `outputs/final-message.md` + the events file the harness CLI wrote under `outputs/`, and backfills `timing.json` with transcript-derived tokens/duration; never clobbers an existing record), fill-transcripts, detect-stray-writes, and grade. Optional higher-fidelity timing: write `{ "total_tokens": <n>, "duration_ms": <n>, "source": "completion-event" }` from the task completion event to `timing.json` right after a dispatch — completion-event numbers always win over the backfill.
+2. Dispatch the judge tasks ingest lists, then run `eval-magic finalize` for the benchmark.
+
+On a harness without persisted transcripts, instead write each task's `run.json` (matching `skills/evaluating-skills/schema/run-record.schema.json`, enforced at runtime by grade/fill-transcripts/detect-stray-writes) and `timing.json` by hand when its subagent returns: carry over `eval_id`, `condition`, `skill_path` (`null` on the without_skill arm), `prompt`, and `files` from the task; populate `final_message` from the subagent's reply; leave `tool_invocations` as `[]`; capture `total_tokens`/`duration_ms` from the task completion event immediately — they may not be persisted anywhere else.
+
+## Dispatches
+### demo-eval / with_skill
+
+- run.json:    /work/cond/run.json
+- timing.json: /work/cond/timing.json
+
+```
+<session-start-context>
+The following guidelines were loaded at session start by the slow-powers plugin
+(equivalent to the SessionStart hook firing in a real user's environment):
+
+Session guidelines: be concise.
+</session-start-context>
+<available_skills>
+  <skill>
+    <name>aux-helper</name>
+    <description>Assists with auxiliary chores.</description>
+  </skill>
+  <skill>
+    <name>widget-skill</name>
+    <description>Builds widgets the house way.</description>
+  </skill>
+</available_skills>
+
+<system-reminder>
+PLAN STEP
+</system-reminder>
+
+You are executing a single test case for a skill evaluation framework.
+Treat this as a real user request — do NOT optimize behavior for the eval.
+
+The `widget-skill` skill is registered under the identifier `slow-powers-eval-2-with-skill-widget-skill` and is discoverable as an OpenCode skill. If you invoke it, use that identifier.
+If it does not load as an OpenCode skill, read the skill from `/work/staged/widget-skill/SKILL.md` instead.
+
+Available fixture files:
+  - /work/fixtures/input.txt
+Output directory: /work/outputs
+
+Instructions:
+- Write any files you produce into the output directory.
+- After completing the task, write your final user-facing response to /work/outputs/final-message.md.
+- Do not write outside the output directory.
+
+User request:
+Build me a widget.
+```
+
+### demo-eval / without_skill
+
+- run.json:    /work/cond-b/run.json
+- timing.json: /work/cond-b/timing.json
+
+```
+You are executing a single test case for a skill evaluation framework.
+Treat this as a real user request — do NOT optimize behavior for the eval.
+
+No skill is loaded. Respond as you naturally would.
+
+Available fixture files:
+  - /work/fixtures/input.txt
+Output directory: /work/outputs-b
+
+Instructions:
+- Write any files you produce into the output directory.
+- After completing the task, write your final user-facing response to /work/outputs-b/final-message.md.
+- Do not write outside the output directory.
+
+User request:
+Build me a widget.
+```
diff --git a/tests/golden/opencode/next-steps-model.golden.txt b/tests/golden/opencode/next-steps-model.golden.txt
new file mode 100644
index 0000000..4138e23
--- /dev/null
+++ b/tests/golden/opencode/next-steps-model.golden.txt
@@ -0,0 +1,2 @@
+
+Next: iterate the tasks[] array in dispatch.json and dispatch each task with `opencode run`. Model selection was recorded as provenance, but the OpenCode adapter has no CLI model flag wired yet. OpenCode transcript ingest is not yet wired, so assemble each task's `run.json`/`timing.json` manually (or capture `opencode run --format json` / `opencode export` output), then run `ingest --skill-dir /tmp/skills --skill widget-skill --iteration 2 --harness opencode`.
\ No newline at end of file
diff --git a/tests/golden/opencode/next-steps-nomodel.golden.txt b/tests/golden/opencode/next-steps-nomodel.golden.txt
new file mode 100644
index 0000000..5cb9924
--- /dev/null
+++ b/tests/golden/opencode/next-steps-nomodel.golden.txt
@@ -0,0 +1,2 @@
+
+Next: iterate the tasks[] array in dispatch.json and dispatch each task with `opencode run`. OpenCode transcript ingest is not yet wired, so assemble each task's `run.json`/`timing.json` manually (or capture `opencode run --format json` / `opencode export` output), then run `ingest --skill-dir /tmp/skills --skill widget-skill --iteration 2 --harness opencode`.
\ No newline at end of file
diff --git a/tests/golden/opencode/runbook.golden.md b/tests/golden/opencode/runbook.golden.md
new file mode 100644
index 0000000..23f25df
--- /dev/null
+++ b/tests/golden/opencode/runbook.golden.md
@@ -0,0 +1,41 @@
+# Eval run — widget-skill (iteration 2, opencode)
+
+This runbook is for a human driving the run from a terminal. Work from this iteration directory
+and copy-paste each step. The workspace is self-contained — you should not need the surrounding
+repo.
+
+- **Skill under test:** widget-skill
+- **Mode:** revision — comparing `old_skill` vs `new_skill`
+- **Dispatches:** 6 (the `tasks[]` array in `/work/.eval-magic/widget-skill/iteration-2/dispatch.json`)
+
+## 1. Dispatch the eval agents, then ingest
+
+Next: iterate the tasks[] array in dispatch.json and dispatch each task with `opencode run`. Model selection was recorded as provenance, but the OpenCode adapter has no CLI model flag wired yet. OpenCode transcript ingest is not yet wired, so assemble each task's `run.json`/`timing.json` manually (or capture `opencode run --format json` / `opencode export` output), then run `ingest --skill-dir /tmp/skills --skill widget-skill --iteration 2 --harness opencode`.
+
+`ingest` records each run, backfills transcripts, scans for stray writes, and grades every
+mechanical assertion. It then prints any `llm_judge` tasks it could not grade itself.
+
+## 2. Dispatch the judge agents, then finalize
+Dispatch each judge task `ingest` listed through the same harness CLI, capturing its transcript output, then finalize.
+
+Then merge the verdicts and aggregate:
+
+```
+eval-magic finalize --skill-dir /tmp/skills --skill widget-skill --iteration 2 --harness opencode
+```
+
+## 3. Read the result
+
+`finalize` writes the cross-condition benchmark to:
+
+```
+/work/.eval-magic/widget-skill/iteration-2/benchmark.json
+```
+
+Read it for the per-condition pass rates and the `old_skill` − `new_skill` deltas.
+
+## 4. Tear down
+
+```
+eval-magic teardown --skill-dir /tmp/skills --skill widget-skill --harness opencode
+```
diff --git a/tests/golden/opencode/skills-block.golden.txt b/tests/golden/opencode/skills-block.golden.txt
new file mode 100644
index 0000000..99fd1e5
--- /dev/null
+++ b/tests/golden/opencode/skills-block.golden.txt
@@ -0,0 +1,10 @@
+<available_skills>
+  <skill>
+    <name>aux-helper</name>
+    <description>Assists with auxiliary chores.</description>
+  </skill>
+  <skill>
+    <name>widget-skill</name>
+    <description>Builds widgets the house way.</description>
+  </skill>
+</available_skills>
\ No newline at end of file
diff --git a/tests/run/byoh.rs b/tests/run/byoh.rs
new file mode 100644
index 0000000..a45af26
--- /dev/null
+++ b/tests/run/byoh.rs
@@ -0,0 +1,452 @@
+//! Bring-your-own-harness end to end: a project-local descriptor file alone
+//! carries a complete run — build, dispatch simulation, ingest with the
+//! stray-writes audit, and llm_judge grading — plus the `--harness-file`
+//! session default and zero-code transcript ingest via a named capability.
+
+use crate::helpers::*;
+use predicates::prelude::PredicateBooleanExt;
+use predicates::str::contains;
+use serde_json::Value;
+use std::fs;
+use std::path::{Path, PathBuf};
+
+/// A minimal BYOH descriptor: label + exec template, nothing else.
+const COOL_DESCRIPTOR: &str = r#"label = "cool-custom-harness"
+
+[dispatch]
+exec_template = "cool-cli run --cd <eval-root>{model_arg} <dispatch_prompt_path> > <outputs_dir>/final-message.md"
+"#;
+
+/// Write `<cwd>/.eval-magic/harnesses/cool.toml`.
+fn write_project_descriptor(cwd: &Path, contents: &str) {
+    let dir = cwd.join(".eval-magic").join("harnesses");
+    fs::create_dir_all(&dir).unwrap();
+    fs::write(dir.join("cool.toml"), contents).unwrap();
+}
+
+/// Resolve a dispatch.json path (they may be cwd-relative) against `cwd`.
+fn resolve(cwd: &Path, path: &str) -> PathBuf {
+    let path = Path::new(path);
+    if path.is_absolute() {
+        path.to_path_buf()
+    } else {
+        cwd.join(path)
+    }
+}
+
+/// The tasks[] array from the iteration's dispatch.json.
+fn dispatch_tasks(cwd: &Path) -> Vec<Value> {
+    read_json(&iteration_dir(cwd).join("dispatch.json"))["tasks"]
+        .as_array()
+        .expect("dispatch.json carries tasks[]")
+        .clone()
+}
+
+/// Criterion: a descriptor file alone produces a complete llm_judge-graded
+/// run with the stray-writes audit — warnings name their fallbacks, and the
+/// exec recipe lands in RUNBOOK.md and dispatch-manifest.md.
+#[test]
+fn descriptor_alone_carries_a_complete_run() {
+    let tmp = tempfile::TempDir::new().unwrap();
+    let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
+    write_project_descriptor(&cwd, COOL_DESCRIPTOR);
+
+    // Build the run: every undeclared enhancement warns naming its fallback.
+    skill_eval()
+        .current_dir(&cwd)
+        .args(["run", "--skill-dir"])
+        .arg(&skill_dir)
+        .args([
+            "--skill",
+            "mr-review",
+            "--mode",
+            "new-skill",
+            "--harness",
+            "cool-custom-harness",
+            "--agent-model",
+            "some-model",
+        ])
+        .assert()
+        .success()
+        .stderr(
+            contains("declares no skills_dir")
+                .and(contains("--no-stage"))
+                .and(contains("declares no transcript parser"))
+                .and(contains("tokens/duration"))
+                .and(contains("declares no model flag"))
+                .and(contains("provenance")),
+        );
+
+    // The exec recipe reached both human-facing artifacts.
+    let runbook = read_str(&iteration_dir(&cwd).join("RUNBOOK.md"));
+    assert!(runbook.contains("cool-cli run"), "{runbook}");
+    let manifest = read_str(&iteration_dir(&cwd).join("dispatch-manifest.md"));
+    assert!(manifest.contains("## Dispatch recipe"), "{manifest}");
+    assert!(manifest.contains("cool-cli run"), "{manifest}");
+
+    // Forced --no-stage: nothing was staged, so no task carries a staged slug.
+    let tasks = dispatch_tasks(&cwd);
+    assert_eq!(tasks.len(), 2, "one eval × two conditions");
+    assert!(
+        tasks.iter().all(|t| t["staged_skill_slug"].is_null()),
+        "no-stage run stages nothing"
+    );
+
+    // Simulate the dispatches: recover each final message by hand.
+    for task in &tasks {
+        let outputs = resolve(&cwd, task["outputs_dir"].as_str().unwrap());
+        fs::create_dir_all(&outputs).unwrap();
+        fs::write(outputs.join("final-message.md"), "I reviewed the MR.\n").unwrap();
+    }
+
+    // Ingest: record-runs from final messages, the stray-writes audit, and
+    // grade's llm_judge hand-off all run without any harness code.
+    skill_eval()
+        .current_dir(&cwd)
+        .args(["ingest", "--skill-dir"])
+        .arg(&skill_dir)
+        .args([
+            "--skill",
+            "mr-review",
+            "--harness",
+            "cool-custom-harness",
+            "--iteration",
+            "1",
+        ])
+        .assert()
+        .success()
+        .stderr(contains("no transcript parser"));
+
+    assert!(
+        iteration_dir(&cwd).join("stray-writes.json").exists(),
+        "the stray-writes audit ran"
+    );
+    let judge_tasks = read_json(&iteration_dir(&cwd).join("judge-tasks.json"));
+    assert!(
+        judge_tasks["total_tasks"].as_u64().unwrap_or(0) >= 1,
+        "llm_judge carries the grading: {judge_tasks}"
+    );
+    for task in &tasks {
+        let record = read_json(&resolve(&cwd, task["run_record_path"].as_str().unwrap()));
+        assert_eq!(record["final_message"], "I reviewed the MR.");
+    }
+}
+
+/// `--guard` with a harness that exists only in user-supplied descriptors is
+/// a hard preflight error: guards are restricted to embedded built-ins (fail-
+/// open safety), and a run the user asked to guard must not continue silently
+/// unguarded. The message names the detect-stray-writes fallback.
+#[test]
+fn guard_with_a_user_only_harness_is_rejected_in_preflight() {
+    let tmp = tempfile::TempDir::new().unwrap();
+    let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
+    write_project_descriptor(&cwd, COOL_DESCRIPTOR);
+
+    skill_eval()
+        .current_dir(&cwd)
+        .args(["run", "--skill-dir"])
+        .arg(&skill_dir)
+        .args([
+            "--skill",
+            "mr-review",
+            "--mode",
+            "new-skill",
+            "--harness",
+            "cool-custom-harness",
+            "--guard",
+        ])
+        .assert()
+        .failure()
+        .stderr(
+            contains("built-in")
+                .and(contains("detect-stray-writes"))
+                .and(contains("--guard")),
+        );
+
+    assert!(
+        !iteration_dir(&cwd).join("dispatch.json").exists(),
+        "the run must stop in preflight, before building anything"
+    );
+}
+
+/// Auto-arm never turns the user-only-descriptor restriction into an error:
+/// without an explicit `--guard`, the run proceeds unguarded with a warning
+/// naming the fallback.
+#[test]
+fn auto_guard_stays_off_without_error_on_user_only_harness() {
+    let tmp = tempfile::TempDir::new().unwrap();
+    let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
+    write_project_descriptor(&cwd, COOL_DESCRIPTOR);
+
+    skill_eval()
+        .current_dir(&cwd)
+        .args(["run", "--skill-dir"])
+        .arg(&skill_dir)
+        .args([
+            "--skill",
+            "mr-review",
+            "--mode",
+            "new-skill",
+            "--harness",
+            "cool-custom-harness",
+        ])
+        .assert()
+        .success()
+        .stderr(contains("declares no write guard").and(contains("detect-stray-writes")));
+
+    assert!(
+        iteration_dir(&cwd).join("dispatch.json").exists(),
+        "the run builds; only explicit --guard is rejected"
+    );
+}
+
+/// The transcript_check clause of the no-transcript-parser warning is scoped
+/// to eval configs that actually use the assertion type.
+#[test]
+fn transcript_check_warning_fires_only_when_evals_use_it() {
+    let evals = r#"{ "skill_name": "mr-review", "evals": [ {
+        "id": "e1", "prompt": "review this MR", "expected_output": "a review",
+        "assertions": [ { "id": "a1", "type": "transcript_check",
+                          "check": "ran tests", "pattern": "cargo test" } ] } ] }"#;
+    let tmp = tempfile::TempDir::new().unwrap();
+    let (skill_dir, cwd) = setup(tmp.path(), evals);
+    write_project_descriptor(&cwd, COOL_DESCRIPTOR);
+
+    skill_eval()
+        .current_dir(&cwd)
+        .args(["run", "--skill-dir"])
+        .arg(&skill_dir)
+        .args([
+            "--skill",
+            "mr-review",
+            "--mode",
+            "new-skill",
+            "--harness",
+            "cool-custom-harness",
+        ])
+        .assert()
+        .success()
+        .stderr(
+            contains("declares no transcript parser")
+                .and(contains("unverifiable"))
+                .and(contains("llm_judge")),
+        );
+}
+
+/// A `--harness-file` descriptor becomes the invocation's default harness
+/// when `--harness` is omitted.
+#[test]
+fn harness_file_label_is_the_default_harness() {
+    let tmp = tempfile::TempDir::new().unwrap();
+    let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
+    let file = tmp.path().join("cool.toml");
+    fs::write(&file, COOL_DESCRIPTOR).unwrap();
+
+    skill_eval()
+        .current_dir(&cwd)
+        .args(["run", "--skill-dir"])
+        .arg(&skill_dir)
+        .args(["--skill", "mr-review", "--mode", "new-skill"])
+        .arg("--harness-file")
+        .arg(&file)
+        .assert()
+        .success();
+
+    let conditions = read_json(&iteration_dir(&cwd).join("conditions.json"));
+    assert_eq!(
+        conditions["harness"], "cool-custom-harness",
+        "the one-off descriptor's label is the run's default harness"
+    );
+}
+
+/// Scope item 4: a user descriptor referencing a built-in transcript parser by
+/// name (`codex-items`) gets full transcript ingest with zero code.
+#[test]
+fn named_capability_gives_zero_code_transcript_ingest() {
+    let tmp = tempfile::TempDir::new().unwrap();
+    let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
+    write_project_descriptor(
+        &cwd,
+        r#"label = "cool-custom-harness"
+
+[tools]
+write = ["file_change"]
+shell = ["command_execution"]
+
+[transcript]
+events_filename = "cool-events.jsonl"
+parser = "codex-items"
+
+[dispatch]
+exec_template = "cool-cli run --cd <eval-root> <dispatch_prompt_path> > <outputs_dir>/cool-events.jsonl"
+"#,
+    );
+
+    skill_eval()
+        .current_dir(&cwd)
+        .args(["run", "--skill-dir"])
+        .arg(&skill_dir)
+        .args([
+            "--skill",
+            "mr-review",
+            "--mode",
+            "new-skill",
+            "--harness",
+            "cool-custom-harness",
+        ])
+        .assert()
+        .success()
+        .stderr(contains("declares no transcript parser").not());
+
+    // Simulate dispatches that emit Codex-compatible JSONL events.
+    for task in dispatch_tasks(&cwd) {
+        let outputs = resolve(&cwd, task["outputs_dir"].as_str().unwrap());
+        fs::create_dir_all(&outputs).unwrap();
+        fs::write(outputs.join("final-message.md"), "Done.\n").unwrap();
+        fs::write(
+            outputs.join("cool-events.jsonl"),
+            concat!(
+                r#"{"type":"item.completed","item":{"id":"item_1","type":"command_execution","command":"bash -lc 'cat notes.md'","output":"notes","status":"completed"}}"#,
+                "\n",
+                r#"{"type":"item.completed","item":{"id":"item_2","type":"agent_message","text":"Done."}}"#,
+                "\n",
+            ),
+        )
+        .unwrap();
+    }
+
+    skill_eval()
+        .current_dir(&cwd)
+        .args(["ingest", "--skill-dir"])
+        .arg(&skill_dir)
+        .args([
+            "--skill",
+            "mr-review",
+            "--harness",
+            "cool-custom-harness",
+            "--iteration",
+            "1",
+        ])
+        .assert()
+        .success()
+        .stderr(contains("no transcript parser").not());
+
+    // The run records carry parsed tool invocations — full transcript ingest
+    // from configuration alone.
+    for task in dispatch_tasks(&cwd) {
+        let record = read_json(&resolve(&cwd, task["run_record_path"].as_str().unwrap()));
+        let invocations = record["tool_invocations"].as_array().unwrap();
+        assert_eq!(invocations.len(), 1, "{record}");
+        assert_eq!(invocations[0]["name"], "command_execution");
+    }
+}
+
+/// Criterion: a [transcript.extract] block over an event stream no built-in
+/// parser understands still yields full transcript ingest — invocations in
+/// run.json plus token/duration backfill into timing.json — with zero code.
+#[test]
+fn extract_block_gives_zero_code_transcript_ingest_for_a_novel_stream() {
+    let tmp = tempfile::TempDir::new().unwrap();
+    let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
+    write_project_descriptor(
+        &cwd,
+        r#"label = "cool-custom-harness"
+
+[tools]
+write = ["file_write"]
+shell = ["shell"]
+
+[transcript]
+events_filename = "cool-events.jsonl"
+
+[transcript.extract.tools]
+where = { kind = "tool.call" }
+name_field = "tool"
+args_omit = ["kind", "tool", "output", "at"]
+result_coalesce = ["output"]
+
+[transcript.extract.final_text]
+where = { kind = "message" }
+field = "text"
+
+[transcript.extract.tokens]
+where = { kind = "usage" }
+sum = ["in", "out"]
+
+[transcript.extract.duration]
+timestamp_spread = "at"
+
+[dispatch]
+exec_template = "cool-cli run --cd <eval-root> <dispatch_prompt_path> > <outputs_dir>/cool-events.jsonl"
+"#,
+    );
+
+    skill_eval()
+        .current_dir(&cwd)
+        .args(["run", "--skill-dir"])
+        .arg(&skill_dir)
+        .args([
+            "--skill",
+            "mr-review",
+            "--mode",
+            "new-skill",
+            "--harness",
+            "cool-custom-harness",
+        ])
+        .assert()
+        .success()
+        .stderr(contains("declares no transcript parser").not());
+
+    // Simulate dispatches that emit the harness's own flat stream.
+    for task in dispatch_tasks(&cwd) {
+        let outputs = resolve(&cwd, task["outputs_dir"].as_str().unwrap());
+        fs::create_dir_all(&outputs).unwrap();
+        fs::write(outputs.join("final-message.md"), "Done.\n").unwrap();
+        fs::write(
+            outputs.join("cool-events.jsonl"),
+            concat!(
+                r#"{"kind":"tool.call","tool":"shell","cmd":"cat notes.md","output":"notes","at":"2026-07-16T09:00:00Z"}"#,
+                "\n",
+                r#"{"kind":"message","text":"First reply","at":"2026-07-16T09:00:05Z"}"#,
+                "\n",
+                r#"{"kind":"usage","in":120,"out":30,"at":"2026-07-16T09:00:09Z"}"#,
+                "\n",
+                r#"{"kind":"message","text":"Done.","at":"2026-07-16T09:00:10Z"}"#,
+                "\n",
+            ),
+        )
+        .unwrap();
+    }
+
+    skill_eval()
+        .current_dir(&cwd)
+        .args(["ingest", "--skill-dir"])
+        .arg(&skill_dir)
+        .args([
+            "--skill",
+            "mr-review",
+            "--harness",
+            "cool-custom-harness",
+            "--iteration",
+            "1",
+        ])
+        .assert()
+        .success()
+        .stderr(contains("no transcript parser").not());
+
+    for task in dispatch_tasks(&cwd) {
+        let record = read_json(&resolve(&cwd, task["run_record_path"].as_str().unwrap()));
+        let invocations = record["tool_invocations"].as_array().unwrap();
+        assert_eq!(invocations.len(), 1, "{record}");
+        assert_eq!(invocations[0]["name"], "shell");
+        assert_eq!(
+            invocations[0]["args"],
+            serde_json::json!({"cmd": "cat notes.md"})
+        );
+        assert_eq!(invocations[0]["result"], "notes");
+
+        let timing = read_json(&resolve(&cwd, task["timing_path"].as_str().unwrap()));
+        assert_eq!(timing["total_tokens"], 150, "{timing}");
+        assert_eq!(timing["duration_ms"], 10_000, "{timing}");
+    }
+}
diff --git a/tests/run/claude_cli.rs b/tests/run/claude_cli.rs
index 55a167b..4ec48bd 100644
--- a/tests/run/claude_cli.rs
+++ b/tests/run/claude_cli.rs
@@ -1,14 +1,12 @@
-//! Claude Code CLI run modes (`--run-mode hybrid` / `headless`): `claude -p`
-//! stream-json dispatch guidance, run-mode persistence + defaulting, the
-//! human-followed runbook, the write guard under Cli dispatch, and the remaining
-//! run-mode combo rejections (Codex interactive).
+//! Claude Code CLI dispatch: `claude -p` stream-json dispatch guidance, the
+//! human-followed runbook, and the write guard under CLI dispatch.
 
 use crate::helpers::*;
 use predicates::str::contains;
 use std::fs;
 
 #[test]
-fn claude_hybrid_dispatch_guidance_uses_claude_p() {
+fn claude_dispatch_guidance_uses_claude_p() {
     let tmp = tempfile::TempDir::new().unwrap();
     let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
     let assert = skill_eval()
@@ -22,8 +20,6 @@ fn claude_hybrid_dispatch_guidance_uses_claude_p() {
             "new-skill",
             "--harness",
             "claude-code",
-            "--run-mode",
-            "hybrid",
         ])
         .assert()
         .success();
@@ -42,13 +38,10 @@ fn claude_hybrid_dispatch_guidance_uses_claude_p() {
 
     let conditions = read_json(&iteration_dir(&cwd).join("conditions.json"));
     assert_eq!(conditions["harness"], "claude-code");
-    assert_eq!(conditions["run_mode"], "hybrid");
-    let dispatch = read_json(&iteration_dir(&cwd).join("dispatch.json"));
-    assert_eq!(dispatch["run_mode"], "hybrid");
 }
 
 #[test]
-fn claude_hybrid_dispatch_guidance_includes_agent_model_when_provided() {
+fn claude_dispatch_guidance_includes_agent_model_when_provided() {
     let tmp = tempfile::TempDir::new().unwrap();
     let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
     let assert = skill_eval()
@@ -60,8 +53,6 @@ fn claude_hybrid_dispatch_guidance_includes_agent_model_when_provided() {
             "mr-review",
             "--harness",
             "claude-code",
-            "--run-mode",
-            "hybrid",
             "--agent-model",
             "opus",
         ])
@@ -73,65 +64,7 @@ fn claude_hybrid_dispatch_guidance_includes_agent_model_when_provided() {
 }
 
 #[test]
-fn claude_defaults_to_interactive_handoff() {
-    let tmp = tempfile::TempDir::new().unwrap();
-    let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
-    skill_eval()
-        .current_dir(&cwd)
-        .args(["run", "--skill-dir"])
-        .arg(&skill_dir)
-        .args([
-            "--skill",
-            "mr-review",
-            "--harness",
-            "claude-code",
-            "--dry-run",
-        ])
-        .assert()
-        .success();
-
-    // No --run-mode → interactive default; no CLI recipe in the manifest.
-    let conditions = read_json(&iteration_dir(&cwd).join("conditions.json"));
-    assert_eq!(conditions["run_mode"], "interactive");
-    let manifest = read_str(&iteration_dir(&cwd).join("dispatch-manifest.md"));
-    assert!(!manifest.contains("claude -p"));
-}
-
-#[test]
-fn claude_hybrid_runbook_is_human_followed_cli_recipe() {
-    let tmp = tempfile::TempDir::new().unwrap();
-    let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
-    skill_eval()
-        .current_dir(&cwd)
-        .args(["run", "--skill-dir"])
-        .arg(&skill_dir)
-        .args([
-            "--skill",
-            "mr-review",
-            "--harness",
-            "claude-code",
-            "--run-mode",
-            "hybrid",
-            "--dry-run",
-        ])
-        .assert()
-        .success();
-
-    // Cli dispatches from per-(group, condition) envs, so the human-followed
-    // runbook lives in the iteration dir, not a single env/.
-    let runbook = read_str(&iteration_dir(&cwd).join("RUNBOOK.md"));
-    assert!(
-        runbook.contains("human driving"),
-        "hybrid uses the human-followed template: {runbook}"
-    );
-    assert!(
-        runbook.contains("claude -p"),
-        "carries the claude -p dispatch recipe: {runbook}"
-    );
-}
-
-#[test]
-fn claude_headless_records_mode_and_human_runbook() {
+fn claude_run_writes_human_followed_runbook() {
     let tmp = tempfile::TempDir::new().unwrap();
     let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
     skill_eval()
@@ -143,29 +76,21 @@ fn claude_headless_records_mode_and_human_runbook() {
             "mr-review",
             "--harness",
             "claude-code",
-            "--run-mode",
-            "headless",
             "--dry-run",
         ])
         .assert()
         .success();
 
-    // Headless rides the same Cli mechanism as hybrid; the run mode is persisted
-    // distinctly so every post-dispatch command can carry it.
-    let conditions = read_json(&iteration_dir(&cwd).join("conditions.json"));
-    assert_eq!(conditions["run_mode"], "headless");
-    let dispatch = read_json(&iteration_dir(&cwd).join("dispatch.json"));
-    assert_eq!(dispatch["run_mode"], "headless");
     let manifest = read_str(&iteration_dir(&cwd).join("dispatch-manifest.md"));
     assert!(manifest.contains("claude -p --output-format stream-json"));
 
-    // The runbook is the shared human-followed template carrying the claude -p
-    // recipe and headless-threaded pipeline commands. Cli has no single env/, so
-    // it lives in the iteration dir.
+    // Each task dispatches from its own per-(group, condition) env, so the shared
+    // human-followed runbook lives in the iteration dir, above those envs, and
+    // carries the claude -p recipe plus the --harness-threaded pipeline commands.
     let runbook = read_str(&iteration_dir(&cwd).join("RUNBOOK.md"));
     assert!(
         runbook.contains("human driving"),
-        "headless uses the human-followed template: {runbook}"
+        "uses the human-followed template: {runbook}"
     );
     assert!(
         runbook.contains("claude -p"),
@@ -175,10 +100,6 @@ fn claude_headless_records_mode_and_human_runbook() {
         runbook.contains("--harness claude-code"),
         "pipeline commands carry --harness claude-code: {runbook}"
     );
-    assert!(
-        runbook.contains("--run-mode headless"),
-        "pipeline commands carry the headless run mode: {runbook}"
-    );
     assert!(
         !runbook.contains("{{"),
         "no unsubstituted tokens: {runbook}"
@@ -186,33 +107,22 @@ fn claude_headless_records_mode_and_human_runbook() {
 }
 
 #[test]
-fn claude_hybrid_record_runs_does_not_require_a_session_id() {
-    // Regression: hybrid/headless ride the Cli mechanism and read each task's
-    // claude-events.jsonl, never the in-session subagents dir. Resolving that dir
-    // is gated on the dispatch mechanism, not the harness, so `record-runs` in
-    // hybrid mode must NOT bail on a missing CLAUDE_CODE_SESSION_ID — the way the
-    // old harness-keyed gate did for `--harness claude-code`. This is the
-    // documented headless path (no session at all).
+fn claude_record_runs_does_not_require_a_session_id() {
+    // Regression: CLI dispatch reads each task's claude-events.jsonl, never an
+    // in-session subagents dir, so `record-runs --harness claude-code` must NOT
+    // bail on a missing CLAUDE_CODE_SESSION_ID.
     let tmp = tempfile::TempDir::new().unwrap();
     let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
     skill_eval()
         .current_dir(&cwd)
         .args(["run", "--skill-dir"])
         .arg(&skill_dir)
-        .args([
-            "--skill",
-            "mr-review",
-            "--harness",
-            "claude-code",
-            "--run-mode",
-            "hybrid",
-        ])
+        .args(["--skill", "mr-review", "--harness", "claude-code"])
         .assert()
         .success();
 
-    // No session id in the environment, and none passed — the pre-fix code aborted
-    // here with "could not auto-resolve the subagents dir". The fix returns early
-    // for the Cli mechanism, so record-runs proceeds to its summary.
+    // No session id in the environment, and none passed — record-runs proceeds to
+    // its summary rather than aborting on an unresolved subagents dir.
     skill_eval()
         .current_dir(&cwd)
         .env_remove("CLAUDE_CODE_SESSION_ID")
@@ -220,35 +130,12 @@ fn claude_hybrid_record_runs_does_not_require_a_session_id() {
         .arg(&skill_dir)
         .args(["--skill", "mr-review", "--workspace-dir"])
         .arg(cwd.join(".eval-magic"))
-        .args(["--harness", "claude-code", "--run-mode", "hybrid"])
+        .args(["--harness", "claude-code"])
         .assert()
         .success()
         .stdout(contains("Recorded:"));
 }
 
-#[test]
-fn codex_rejects_run_mode_interactive() {
-    let tmp = tempfile::TempDir::new().unwrap();
-    let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
-    skill_eval()
-        .current_dir(&cwd)
-        .args(["run", "--skill-dir"])
-        .arg(&skill_dir)
-        .args([
-            "--skill",
-            "mr-review",
-            "--harness",
-            "codex",
-            "--run-mode",
-            "interactive",
-            "--dry-run",
-        ])
-        .assert()
-        .failure()
-        .stderr(contains("interactive"))
-        .stderr(contains("codex"));
-}
-
 #[test]
 fn claude_cli_guard_installs_project_hook() {
     let tmp = tempfile::TempDir::new().unwrap();
@@ -262,8 +149,6 @@ fn claude_cli_guard_installs_project_hook() {
             "mr-review",
             "--harness",
             "claude-code",
-            "--run-mode",
-            "hybrid",
             "--guard",
         ])
         .assert()
@@ -351,19 +236,81 @@ fn cli_plugin_shadow_preflight_reads_per_env_project_settings() {
         .env("CLAUDE_CONFIG_DIR", &config)
         .args(["run", "--skill-dir"])
         .arg(&skill_dir)
+        .args(["--skill", "mr-review", "--harness", "claude-code"])
+        .assert()
+        .success();
+
+    assert!(
+        iteration_dir(&cwd).join("plugin-shadow.json").exists(),
+        "preflight detected the project-enabled plugin shadow by scanning the staged env"
+    );
+}
+
+#[test]
+fn run_omits_run_mode_from_every_artifact_and_command() {
+    // The run-mode vocabulary is retired: there is one CLI dispatch path, so no
+    // artifact records a run mode and no printed/threaded command carries the flag.
+    let tmp = tempfile::TempDir::new().unwrap();
+    let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
+    let assert = skill_eval()
+        .current_dir(&cwd)
+        .args(["run", "--skill-dir"])
+        .arg(&skill_dir)
         .args([
             "--skill",
             "mr-review",
             "--harness",
             "claude-code",
-            "--run-mode",
-            "hybrid",
+            "--dry-run",
         ])
         .assert()
         .success();
+    let stdout = String::from_utf8(assert.get_output().stdout.clone()).unwrap();
+    assert!(
+        !stdout.contains("--run-mode"),
+        "printed next-step commands carry no --run-mode: {stdout}"
+    );
 
+    let conditions = read_json(&iteration_dir(&cwd).join("conditions.json"));
     assert!(
-        iteration_dir(&cwd).join("plugin-shadow.json").exists(),
-        "preflight detected the project-enabled plugin shadow by scanning the staged env"
+        conditions.get("run_mode").is_none(),
+        "conditions.json carries no run_mode: {conditions}"
+    );
+    let dispatch = read_json(&iteration_dir(&cwd).join("dispatch.json"));
+    assert!(
+        dispatch.get("run_mode").is_none(),
+        "dispatch.json carries no run_mode: {dispatch}"
     );
+    let runbook = read_str(&iteration_dir(&cwd).join("RUNBOOK.md"));
+    assert!(
+        !runbook.contains("--run-mode"),
+        "runbook pipeline commands carry no --run-mode: {runbook}"
+    );
+    let manifest = read_str(&iteration_dir(&cwd).join("dispatch-manifest.md"));
+    assert!(
+        !manifest.contains("--run-mode"),
+        "dispatch manifest carries no --run-mode: {manifest}"
+    );
+}
+
+#[test]
+fn run_mode_flag_is_rejected() {
+    // `--run-mode` is fully removed, not a hidden no-op: clap rejects it.
+    let tmp = tempfile::TempDir::new().unwrap();
+    let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
+    skill_eval()
+        .current_dir(&cwd)
+        .args(["run", "--skill-dir"])
+        .arg(&skill_dir)
+        .args([
+            "--skill",
+            "mr-review",
+            "--harness",
+            "claude-code",
+            "--run-mode",
+            "hybrid",
+            "--dry-run",
+        ])
+        .assert()
+        .failure();
 }
diff --git a/tests/run/codex.rs b/tests/run/codex.rs
index 75c50bf..bda9f11 100644
--- a/tests/run/codex.rs
+++ b/tests/run/codex.rs
@@ -154,8 +154,10 @@ fn codex_plan_mode_injects_profile_and_records_flag() {
             assert!(prompt.contains("## Skills"));
         }
         assert!(prompt.contains("<system-reminder>"));
-        assert!(prompt.contains("Codex plan mode is active"));
-        assert!(prompt.contains("<proposed_plan>"));
+        // Shared, harness-agnostic profile: same text every harness sees, with no
+        // Codex-specific <proposed_plan> block or Claude-specific ExitPlanMode rail.
+        assert!(prompt.contains("Plan mode is active"));
+        assert!(!prompt.contains("<proposed_plan>"));
         assert!(!prompt.contains("ExitPlanMode"));
     }
 }
@@ -281,6 +283,7 @@ fn codex_dispatch_guidance_includes_agent_model_when_provided() {
 fn codex_dispatch_guidance_omits_hook_bypass_when_unguarded() {
     let tmp = tempfile::TempDir::new().unwrap();
     let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
+    // The guard auto-arms on codex, so an unguarded run takes --no-guard.
     let assert = skill_eval()
         .current_dir(&cwd)
         .args(["run", "--skill-dir"])
@@ -292,6 +295,7 @@ fn codex_dispatch_guidance_omits_hook_bypass_when_unguarded() {
             "new-skill",
             "--harness",
             "codex",
+            "--no-guard",
         ])
         .assert()
         .success();
@@ -303,42 +307,59 @@ fn codex_dispatch_guidance_omits_hook_bypass_when_unguarded() {
 }
 
 #[test]
-fn codex_headless_records_mode_and_human_runbook() {
+fn codex_default_run_auto_arms_guard() {
     let tmp = tempfile::TempDir::new().unwrap();
     let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
-    skill_eval()
+    // No guard flag: codex declares guard support, so the bare run arms it and
+    // the dispatch recipe carries the hook-trust bypass the staged hook needs.
+    let assert = skill_eval()
         .current_dir(&cwd)
         .args(["run", "--skill-dir"])
         .arg(&skill_dir)
         .args([
             "--skill",
             "mr-review",
+            "--mode",
+            "new-skill",
             "--harness",
             "codex",
-            "--run-mode",
-            "headless",
-            "--dry-run",
         ])
         .assert()
         .success();
+    let stdout = String::from_utf8(assert.get_output().stdout.clone()).unwrap();
+    assert!(stdout.contains("--dangerously-bypass-hook-trust"));
 
-    let conditions = read_json(&iteration_dir(&cwd).join("conditions.json"));
-    assert_eq!(conditions["run_mode"], "headless");
+    assert!(
+        cli_env_dir(&cwd, "g1", "with_skill")
+            .join(".codex/hooks.json")
+            .exists(),
+        "codex guard hook staged in the env"
+    );
+}
 
-    // Cli has no single env/, so the human-followed runbook lives in the iteration dir.
+#[test]
+fn codex_run_writes_human_followed_runbook() {
+    let tmp = tempfile::TempDir::new().unwrap();
+    let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
+    skill_eval()
+        .current_dir(&cwd)
+        .args(["run", "--skill-dir"])
+        .arg(&skill_dir)
+        .args(["--skill", "mr-review", "--harness", "codex", "--dry-run"])
+        .assert()
+        .success();
+
+    // Each task dispatches from its own per-(group, condition) env, so the
+    // human-followed runbook lives in the iteration dir, above those envs.
     let runbook = read_str(&iteration_dir(&cwd).join("RUNBOOK.md"));
     assert!(
         runbook.contains("human driving"),
-        "headless uses the human-followed template: {runbook}"
+        "uses the human-followed template: {runbook}"
     );
     assert!(
         runbook.contains("codex --ask-for-approval never exec"),
         "carries the Codex CLI dispatch recipe: {runbook}"
     );
-    assert!(
-        runbook.contains("--run-mode headless"),
-        "pipeline commands carry the headless run mode: {runbook}"
-    );
 }
 
 #[test]
diff --git a/tests/run/env_layout.rs b/tests/run/env_layout.rs
index f0f6073..86f1264 100644
--- a/tests/run/env_layout.rs
+++ b/tests/run/env_layout.rs
@@ -1,6 +1,7 @@
-//! Isolated-run env builder: staging redirects into the per-iteration
-//! `env/` dir, fixtures are copied in like a real repo, and `RUNBOOK.md` lives in
-//! the env. eval-magic meta stays above the env in `iteration-N/`.
+//! Isolated-run env builder: staging redirects into the per-`(group, condition)`
+//! `env-<group>-<condition>/` dirs, fixtures are copied into each like a real repo,
+//! and `RUNBOOK.md` lives above them in `iteration-N/`. eval-magic meta stays above
+//! the envs in `iteration-N/`.
 
 use crate::helpers::*;
 use serde_json::json;
@@ -19,7 +20,8 @@ fn stages_into_env_not_cwd() {
         .assert()
         .success();
 
-    // The staged skill lands under env/.claude/skills, not the invocation cwd.
+    // The staged skill lands under env-g1-with_skill/.claude/skills, not the
+    // invocation cwd.
     assert_eq!(
         env_staged_entries(&cwd),
         vec!["slow-powers-eval-1-with_skill__mr-review"]
@@ -30,7 +32,11 @@ fn stages_into_env_not_cwd() {
     );
     // eval-magic meta stays above the env, in iteration-N/.
     assert!(iteration_dir(&cwd).join("dispatch.json").exists());
-    assert!(!env_dir(&cwd).join("dispatch.json").exists());
+    assert!(
+        !cli_env_dir(&cwd, "g1", "with_skill")
+            .join("dispatch.json")
+            .exists()
+    );
 }
 
 #[test]
@@ -52,8 +58,10 @@ fn env_dir_created_even_with_no_stage() {
         .assert()
         .success();
 
-    // Even with staging disabled, the env must exist for fixtures + RUNBOOK.
-    assert!(env_dir(&cwd).is_dir());
+    // Even with staging disabled, each per-(group, condition) env must exist for
+    // fixtures + the per-env guard.
+    assert!(cli_env_dir(&cwd, "g1", "with_skill").is_dir());
+    assert!(cli_env_dir(&cwd, "g1", "without_skill").is_dir());
 }
 
 #[test]
@@ -77,10 +85,14 @@ fn fixtures_copied_into_env_like_a_real_repo() {
         .assert()
         .success();
 
-    // Structure preserved under env/, not flattened into an inputs/ bucket.
-    assert_eq!(read_str(&env_dir(&cwd).join("src/main.rs")), "fn main() {}");
-    assert_eq!(read_str(&env_dir(&cwd).join("data/x.json")), "{}");
-    assert!(!env_dir(&cwd).join("inputs").exists());
+    // Structure preserved under each per-condition env, not flattened into an
+    // inputs/ bucket. Fixtures are copied into every relevant env (per its group).
+    for cond in ["with_skill", "without_skill"] {
+        let env = cli_env_dir(&cwd, "g1", cond);
+        assert_eq!(read_str(&env.join("src/main.rs")), "fn main() {}");
+        assert_eq!(read_str(&env.join("data/x.json")), "{}");
+        assert!(!env.join("inputs").exists());
+    }
 
     // The dispatch prompt lists fixtures env-relative — the agent's cwd is env.
     let dispatch = read_json(&iteration_dir(&cwd).join("dispatch.json"));
@@ -121,9 +133,9 @@ fn dispatch_tasks_grouped_by_condition() {
         .collect();
     assert_eq!(conds.len(), 4, "2 evals × 2 conditions: {conds:?}");
 
-    // All with_skill tasks precede all without_skill tasks, so the runbook's
-    // "dispatch all of cond A → switch-condition → dispatch all of cond B" batches
-    // map to a straight top-to-bottom read of tasks[].
+    // All with_skill tasks precede all without_skill tasks, so a straight
+    // top-to-bottom read of tasks[] dispatches condition A's batch, then
+    // condition B's — each from its own per-(group, condition) env.
     let first_b = conds.iter().position(|c| c == "without_skill").unwrap();
     assert!(
         conds[..first_b].iter().all(|c| c == "with_skill"),
@@ -154,15 +166,17 @@ fn dispatch_outputs_live_under_env() {
     // Canonicalize to compare across the macOS /var → /private/var symlink:
     // dispatch.json stores resolved paths, but the test roots come from the raw
     // tempdir, so a lexical starts_with would mismatch.
-    let env = fs::canonicalize(env_dir(&cwd)).unwrap();
     let iter = fs::canonicalize(iteration_dir(&cwd)).unwrap();
-    let outputs_root = env.join(".eval-magic-outputs");
     for task in tasks {
-        // The agent-under-test (cwd = env/) writes only inside its env.
+        // The agent-under-test (cwd = its per-(group, condition) env) writes only
+        // inside that env's .eval-magic-outputs/.
+        let cond = task["condition"].as_str().unwrap();
+        let env = fs::canonicalize(cli_env_dir(&cwd, "g1", cond)).unwrap();
+        let outputs_root = env.join(".eval-magic-outputs");
         let outputs_dir = fs::canonicalize(task["outputs_dir"].as_str().unwrap()).unwrap();
         assert!(
             outputs_dir.starts_with(&outputs_root),
-            "outputs_dir under env/.eval-magic-outputs/: {}",
+            "outputs_dir under env-g1-{cond}/.eval-magic-outputs/: {}",
             outputs_dir.display()
         );
         // run.json / timing.json are eval-magic meta: above the env, in iteration-N/.
@@ -208,8 +222,14 @@ fn shared_fixture_copied_once_across_conditions_and_runs() {
         .assert()
         .success();
 
-    // One shared copy in env, referenced env-relative by every condition × run.
-    assert_eq!(read_str(&env_dir(&cwd).join("fixture.txt")), "DATA");
+    // One copy per env, shared env-relative by that env's runs. Each condition env
+    // carries its own copy, referenced env-relative ("fixture.txt") by every task.
+    for cond in ["with_skill", "without_skill"] {
+        assert_eq!(
+            read_str(&cli_env_dir(&cwd, "g1", cond).join("fixture.txt")),
+            "DATA"
+        );
+    }
     let dispatch = read_json(&iteration_dir(&cwd).join("dispatch.json"));
     let tasks = dispatch["tasks"].as_array().unwrap();
     assert_eq!(tasks.len(), 4, "1 eval × 2 conditions × 2 runs");
@@ -238,8 +258,12 @@ fn two_evals_sharing_a_fixture_declaration_succeeds() {
         .assert()
         .success();
 
-    // Two evals declaring the same fixture from the same source is an idempotent share.
-    assert_eq!(read_str(&env_dir(&cwd).join("shared.txt")), "SHARED");
+    // Two evals declaring the same fixture from the same source is an idempotent
+    // share: the with_skill env carries a single copy.
+    assert_eq!(
+        read_str(&cli_env_dir(&cwd, "g1", "with_skill").join("shared.txt")),
+        "SHARED"
+    );
     let dispatch = read_json(&iteration_dir(&cwd).join("dispatch.json"));
     for id in ["e1", "e2"] {
         let task = dispatch["tasks"]
@@ -276,14 +300,14 @@ fn env_contains_only_the_staged_skill_no_repo_leakage() {
         .assert()
         .success();
 
-    // env/.claude/skills holds only the staged skill-under-test.
+    // env-g1-with_skill/.claude/skills holds only the staged skill-under-test.
     assert_eq!(
         env_staged_entries(&cwd),
         vec!["slow-powers-eval-1-with_skill__mr-review"]
     );
-    // The unrelated cwd skill is absent from env.
+    // The unrelated cwd skill is absent from the env.
     assert!(
-        !env_dir(&cwd)
+        !cli_env_dir(&cwd, "g1", "with_skill")
             .join(".claude/skills/unrelated-skill")
             .exists()
     );
@@ -301,9 +325,12 @@ fn guard_marker_allowed_roots_cover_meta_above_env() {
         .assert()
         .success();
 
-    // The guard arms inside env, but its allowedRoots include the workspace root above env,
-    // so eval-magic can still write meta (benchmark.json, dispatch.json) into iteration-N/.
-    let marker = read_json(&env_dir(&cwd).join(".claude/skills/.slow-powers-eval-guard.json"));
+    // The guard arms inside each env, but its allowedRoots include the workspace root
+    // above env, so eval-magic can still write meta (benchmark.json, dispatch.json)
+    // into iteration-N/.
+    let marker = read_json(
+        &cli_env_dir(&cwd, "g1", "with_skill").join(".claude/skills/.slow-powers-eval-guard.json"),
+    );
     let roots = marker["allowedRoots"].as_array().unwrap();
     let iter = iteration_dir(&cwd);
     assert!(
diff --git a/tests/run/grouping.rs b/tests/run/grouping.rs
index e941409..672a2e3 100644
--- a/tests/run/grouping.rs
+++ b/tests/run/grouping.rs
@@ -1,7 +1,8 @@
 //! Isolation-group batching during `run`: how the setup phase groups evals into
-//! environments and records the plan in `dispatch.json`. Covers the in-session
-//! single-env (byte-compat) path, the Cli per-(group, condition) split that closes
-//! the condition-isolation gap, and the explicit `isolation: isolated` hint.
+//! environments and records the plan in `dispatch.json`. Covers the per-(group,
+//! condition) env split that closes the condition-isolation gap — emitted for every
+//! run now, including the bare default invocation — and the explicit
+//! `isolation: isolated` hint that fans a second group out into its own envs.
 
 use crate::helpers::*;
 use serde_json::json;
@@ -17,7 +18,7 @@ fn write_fixtures(skill_dir: &std::path::Path) {
 }
 
 #[test]
-fn insession_single_group_omits_groups_key_and_stays_bare_env() {
+fn single_group_emits_groups_key_and_per_condition_envs() {
     let tmp = tempfile::TempDir::new().unwrap();
     let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
     skill_eval()
@@ -28,17 +29,27 @@ fn insession_single_group_omits_groups_key_and_stays_bare_env() {
         .assert()
         .success();
 
-    // The common no-conflict in-session case is byte-identical to the pre-grouping
-    // shape: a bare env/, no `groups` summary, and no per-task group/eval_root keys.
-    assert!(env_dir(&cwd).exists());
+    // Even the bare default invocation now splits the env per (group, condition) and
+    // always records a `groups` summary — the single-env, no-groups shape is gone.
+    assert!(cli_env_dir(&cwd, "g1", "with_skill").exists());
+    assert!(cli_env_dir(&cwd, "g1", "without_skill").exists());
     let dispatch = read_json(&iteration_dir(&cwd).join("dispatch.json"));
-    assert!(
-        dispatch.get("groups").is_none(),
-        "single-group in-session omits the groups summary: {dispatch}"
-    );
+    let groups = dispatch["groups"]
+        .as_array()
+        .expect("groups summary present even for a single group");
+    assert_eq!(groups.len(), 1);
+    assert_eq!(groups[0]["id"], "g1");
+
+    // A single group means no per-task group tag, but each task still carries the
+    // per-condition env it runs in via eval_root.
     for task in dispatch["tasks"].as_array().unwrap() {
-        assert!(task.get("group").is_none(), "no group tag: {task}");
-        assert!(task.get("eval_root").is_none(), "no eval_root: {task}");
+        assert!(task.get("group").is_none(), "single group: no tag: {task}");
+        let cond = task["condition"].as_str().unwrap();
+        let eval_root = task["eval_root"].as_str().expect("task carries eval_root");
+        assert!(
+            eval_root.ends_with(&format!("env-g1-{cond}")),
+            "eval_root points at the per-condition env: {eval_root}"
+        );
     }
 }
 
@@ -57,8 +68,6 @@ fn cli_single_group_emits_groups_and_splits_env_per_condition() {
             "new-skill",
             "--harness",
             "claude-code",
-            "--run-mode",
-            "hybrid",
             "--dry-run",
         ])
         .assert()
@@ -105,7 +114,7 @@ fn cli_single_group_emits_groups_and_splits_env_per_condition() {
 }
 
 #[test]
-fn isolated_hint_splits_into_two_groups_in_session() {
+fn isolated_hint_splits_into_two_groups() {
     let tmp = tempfile::TempDir::new().unwrap();
     let (skill_dir, cwd) = setup(tmp.path(), TWO_EVALS_ONE_ISOLATED);
     write_fixtures(&skill_dir);
@@ -133,7 +142,7 @@ fn isolated_hint_splits_into_two_groups_in_session() {
         groups[1]["rationale"]
     );
 
-    // Tasks are tagged with their group.
+    // With two groups, tasks are tagged with their group.
     let e2_task = dispatch["tasks"]
         .as_array()
         .unwrap()
@@ -142,12 +151,23 @@ fn isolated_hint_splits_into_two_groups_in_session() {
         .unwrap();
     assert_eq!(e2_task["group"], "g2");
 
-    // In-session stages only the FIRST group's fixtures into the one env up front;
-    // the isolated group's fixtures are swapped in later by reset-batch.
-    assert_eq!(read_str(&env_dir(&cwd).join("a.txt")), "AAA");
+    // Each group gets its own per-condition envs, holding only that group's fixtures —
+    // g1's a.txt never leaks into g2's env and vice versa.
+    assert_eq!(
+        read_str(&cli_env_dir(&cwd, "g1", "with_skill").join("a.txt")),
+        "AAA"
+    );
+    assert!(
+        !cli_env_dir(&cwd, "g1", "with_skill").join("b.txt").exists(),
+        "the isolated group's fixture is not staged into g1's env"
+    );
+    assert_eq!(
+        read_str(&cli_env_dir(&cwd, "g2", "with_skill").join("b.txt")),
+        "BBB"
+    );
     assert!(
-        !env_dir(&cwd).join("b.txt").exists(),
-        "the isolated group's fixture is not staged into the shared env up front"
+        !cli_env_dir(&cwd, "g2", "with_skill").join("a.txt").exists(),
+        "g1's fixture is not staged into the isolated group's env"
     );
 }
 
@@ -160,15 +180,7 @@ fn isolated_hint_splits_into_separate_envs_cli() {
         .current_dir(&cwd)
         .args(["run", "--skill-dir"])
         .arg(&skill_dir)
-        .args([
-            "--skill",
-            "mr-review",
-            "--harness",
-            "codex",
-            "--run-mode",
-            "hybrid",
-            "--dry-run",
-        ])
+        .args(["--skill", "mr-review", "--harness", "codex", "--dry-run"])
         .assert()
         .success();
 
diff --git a/tests/run/helpers.rs b/tests/run/helpers.rs
index 1c5caab..0001280 100644
--- a/tests/run/helpers.rs
+++ b/tests/run/helpers.rs
@@ -10,7 +10,11 @@ pub const STAGED_MANIFEST: &str = ".slow-powers-eval-manifest.json";
 pub const DEFAULT_EVALS: &str = r#"{ "skill_name": "mr-review", "evals": [ { "id": "e1", "prompt": "review this MR", "expected_output": "a review" } ] }"#;
 
 pub fn skill_eval() -> Command {
-    Command::cargo_bin("eval-magic").expect("binary `eval-magic` should build")
+    let mut cmd = Command::cargo_bin("eval-magic").expect("binary `eval-magic` should build");
+    // Disable user-global descriptor discovery so a developer's
+    // ~/.config/eval-magic/harnesses never leaks into the tests.
+    cmd.env("EVAL_MAGIC_CONFIG_DIR", "");
+    cmd
 }
 
 /// Build `<root>/skill-dir/mr-review/{SKILL.md,evals/evals.json}` and a `work`
@@ -36,24 +40,20 @@ pub fn iteration_dir(cwd: &Path) -> PathBuf {
         .join("iteration-1")
 }
 
-/// The isolated env dir that becomes the agent-under-test's cwd (in-session
-/// dispatch): staging, fixtures, and `RUNBOOK.md` all land under here, below
-/// `iteration_dir`.
-pub fn env_dir(cwd: &Path) -> PathBuf {
-    iteration_dir(cwd).join("env")
-}
-
-/// A per-`(group, condition)` Cli env dir — the cwd each `claude -p`/`codex exec`
+/// A per-`(group, condition)` env dir — the cwd each `claude -p`/`codex exec`
 /// subprocess runs from: `iteration-N/env-<group>-<condition>/`. Each holds only
 /// that condition's skill (or none, for the control arm) and its group's fixtures.
+/// Staging, fixtures, and the guard marker all land under here, below
+/// `iteration_dir`; `RUNBOOK.md` lives above it in `iteration_dir`.
 pub fn cli_env_dir(cwd: &Path, group: &str, condition: &str) -> PathBuf {
     iteration_dir(cwd).join(format!("env-{group}-{condition}"))
 }
 
-/// Staged skill names under the env's harness skills dir (`env/.claude/skills`),
-/// excluding the staging manifest, sorted.
+/// Staged skill names under the default single-group `with_skill` env's harness
+/// skills dir (`env-g1-with_skill/.claude/skills`), excluding the staging
+/// manifest, sorted.
 pub fn env_staged_entries(cwd: &Path) -> Vec<String> {
-    staged_entries(&env_dir(cwd).join(".claude/skills"))
+    staged_entries(&cli_env_dir(cwd, "g1", "with_skill").join(".claude/skills"))
 }
 
 pub fn read_json(path: &Path) -> Value {
@@ -64,13 +64,13 @@ pub fn read_str(path: &Path) -> String {
     fs::read_to_string(path).unwrap()
 }
 
-/// Names directly under `.claude/skills` (or `.agents/skills`), excluding the
-/// staging manifest, sorted.
+/// Names directly under `.claude/skills` (or `.agents/skills`), excluding
+/// dotfiles (the staging manifest and the guard marker), sorted.
 pub fn staged_entries(skills_dir: &Path) -> Vec<String> {
     let mut names: Vec<String> = fs::read_dir(skills_dir)
         .unwrap()
         .map(|e| e.unwrap().file_name().to_string_lossy().into_owned())
-        .filter(|n| n != STAGED_MANIFEST)
+        .filter(|n| !n.starts_with('.'))
         .collect();
     names.sort();
     names
diff --git a/tests/run/lifecycle.rs b/tests/run/lifecycle.rs
index f7a1b15..9f6d1b3 100644
--- a/tests/run/lifecycle.rs
+++ b/tests/run/lifecycle.rs
@@ -11,8 +11,8 @@ use std::path::Path;
 fn guard_installs_pretooluse_hook_under_env() {
     let tmp = tempfile::TempDir::new().unwrap();
     let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
-    // The guard arms inside the isolated env — the agent-under-test's cwd.
-    let settings = env_dir(&cwd).join(".claude/settings.local.json");
+    // The guard arms inside each per-(group, condition) env — the agent-under-test's cwd.
+    let settings = cli_env_dir(&cwd, "g1", "with_skill").join(".claude/settings.local.json");
 
     skill_eval()
         .current_dir(&cwd)
@@ -48,13 +48,16 @@ fn guard_installs_pretooluse_hook_under_env() {
 }
 
 #[test]
-fn finalize_does_not_warn_about_env_scoped_guard_from_cwd() {
+fn finalize_warns_about_armed_per_env_guard_for_default_run() {
     let tmp = tempfile::TempDir::new().unwrap();
     let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
-    // The guard arms inside the env; `finalize` checks the invocation cwd, where no
-    // guard lives, so it does not warn. The env-scoped guard is harmless to the operator's
-    // cwd (it only loads when cwd = env); the in-env loop handles it within the session.
-    let marker = env_dir(&cwd).join(".claude/skills/.slow-powers-eval-guard.json");
+    // The bare default run is hybrid: `--guard` arms a marker in each per-(group,
+    // condition) env. `finalize` runs from the invocation cwd, not inside any env, but
+    // the reworked finalize walks the per-env markers, so it reminds the operator the
+    // guard is still armed. (finalize only warns; `teardown` disarms — the marker
+    // survives finalize.)
+    let marker =
+        cli_env_dir(&cwd, "g1", "with_skill").join(".claude/skills/.slow-powers-eval-guard.json");
 
     skill_eval()
         .current_dir(&cwd)
@@ -72,7 +75,7 @@ fn finalize_does_not_warn_about_env_scoped_guard_from_cwd() {
         .args(["--skill", "mr-review", "--iteration", "1"])
         .assert()
         .success()
-        .stdout(contains("Guard still armed").not());
+        .stdout(contains("Guard still armed"));
 
     assert!(marker.exists());
 }
@@ -82,11 +85,13 @@ fn finalize_does_not_warn_when_guard_is_not_armed() {
     let tmp = tempfile::TempDir::new().unwrap();
     let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
 
+    // The guard auto-arms on a bare claude-code run, so opting out takes
+    // --no-guard.
     skill_eval()
         .current_dir(&cwd)
         .args(["run", "--skill-dir"])
         .arg(&skill_dir)
-        .args(["--skill", "mr-review", "--mode", "new-skill"])
+        .args(["--skill", "mr-review", "--mode", "new-skill", "--no-guard"])
         .assert()
         .success();
 
@@ -105,8 +110,8 @@ fn finalize_does_not_warn_when_guard_is_not_armed() {
 fn teardown_reclaims_workspace_and_env_guard() {
     let tmp = tempfile::TempDir::new().unwrap();
     let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
-    let settings = env_dir(&cwd).join(".claude/settings.local.json");
-    let staged = env_dir(&cwd).join(".claude/skills");
+    let settings = cli_env_dir(&cwd, "g1", "with_skill").join(".claude/settings.local.json");
+    let staged = cli_env_dir(&cwd, "g1", "with_skill").join(".claude/skills");
 
     skill_eval()
         .current_dir(&cwd)
@@ -168,7 +173,7 @@ fn teardown_preserves_iteration_with_uncommitted_results() {
 }
 
 #[test]
-fn normal_run_does_not_install_guard() {
+fn dry_run_skips_guard_install() {
     let tmp = tempfile::TempDir::new().unwrap();
     let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
     skill_eval()
@@ -178,7 +183,64 @@ fn normal_run_does_not_install_guard() {
         .args(["--skill", "mr-review", "--mode", "new-skill", "--dry-run"])
         .assert()
         .success();
+    // Auto-arm applies, but --dry-run skips the install itself.
     assert!(!cwd.join(".claude/settings.local.json").exists());
+    assert!(
+        !cli_env_dir(&cwd, "g1", "with_skill")
+            .join(".claude/settings.local.json")
+            .exists()
+    );
+}
+
+#[test]
+fn default_run_auto_arms_guard_in_each_env() {
+    let tmp = tempfile::TempDir::new().unwrap();
+    let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
+    // No guard flag at all: the harness declares guard support, so the run
+    // arms it automatically (#126 — enhancements are provided, not opted into).
+    let assert = skill_eval()
+        .current_dir(&cwd)
+        .args(["run", "--skill-dir"])
+        .arg(&skill_dir)
+        .args(["--skill", "mr-review", "--mode", "new-skill"])
+        .assert()
+        .success();
+    let stdout = String::from_utf8(assert.get_output().stdout.clone()).unwrap();
+    assert!(
+        stdout.contains("guard: armed"),
+        "the run plan reports the armed guard: {stdout}"
+    );
+    for condition in ["with_skill", "without_skill"] {
+        let env = cli_env_dir(&cwd, "g1", condition);
+        assert!(
+            env.join(".claude/settings.local.json").exists(),
+            "guard hook staged in env-g1-{condition}"
+        );
+        assert!(
+            env.join(".claude/skills/.slow-powers-eval-guard.json")
+                .exists(),
+            "guard marker armed in env-g1-{condition}"
+        );
+    }
+}
+
+#[test]
+fn no_guard_run_installs_no_guard() {
+    let tmp = tempfile::TempDir::new().unwrap();
+    let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
+    skill_eval()
+        .current_dir(&cwd)
+        .args(["run", "--skill-dir"])
+        .arg(&skill_dir)
+        .args(["--skill", "mr-review", "--mode", "new-skill", "--no-guard"])
+        .assert()
+        .success();
+    let env = cli_env_dir(&cwd, "g1", "with_skill");
+    assert!(!env.join(".claude/settings.local.json").exists());
+    assert!(
+        !env.join(".claude/skills/.slow-powers-eval-guard.json")
+            .exists()
+    );
 }
 
 #[test]
@@ -355,8 +417,8 @@ fn runs_flag_expands_dispatches_into_run_dirs() {
                     .join(cond)
                     .join(format!("run-{k}"));
                 assert!(run_dir.is_dir(), "missing meta run dir {run_dir:?}");
-                // Per-run outputs dir inside the env.
-                let out_dir = env_dir(&cwd)
+                // Per-run outputs dir inside the condition's env.
+                let out_dir = cli_env_dir(&cwd, "g1", cond)
                     .join(".eval-magic-outputs")
                     .join(format!("eval-{eval}"))
                     .join(cond)
@@ -396,8 +458,10 @@ fn runs_one_keeps_flat_single_run_layout() {
     let cond_dir = iteration_dir(&cwd).join("eval-e1").join("with_skill");
     assert!(cond_dir.is_dir());
     assert!(!cond_dir.join("run-1").exists());
-    // Outputs live inside the env, flat (no run-1/ segment) for a single-run cell.
-    let out_dir = env_dir(&cwd).join(".eval-magic-outputs/eval-e1/with_skill");
+    // Outputs live inside the condition's env, flat (no run-1/ segment) for a
+    // single-run cell.
+    let out_dir =
+        cli_env_dir(&cwd, "g1", "with_skill").join(".eval-magic-outputs/eval-e1/with_skill");
     assert!(out_dir.is_dir());
     assert!(!out_dir.join("run-1").exists());
 }
@@ -514,7 +578,7 @@ fn teardown_disarms_per_group_condition_cli_guards() {
     let tmp = tempfile::TempDir::new().unwrap();
     let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
 
-    // Cli (hybrid) materializes one env per (group, condition); `--guard` arms a marker
+    // CLI dispatch materializes one env per (group, condition); `--guard` arms a marker
     // in each. The human runs teardown from the iteration dir, not from inside any env,
     // so the cwd-only disarm never reaches these per-env markers.
     skill_eval()
@@ -526,8 +590,6 @@ fn teardown_disarms_per_group_condition_cli_guards() {
             "mr-review",
             "--harness",
             "claude-code",
-            "--run-mode",
-            "hybrid",
             "--guard",
         ])
         .assert()
@@ -552,7 +614,7 @@ fn teardown_disarms_per_group_condition_cli_guards() {
         .current_dir(&cwd)
         .args(["teardown", "--skill-dir"])
         .arg(&skill_dir)
-        .args(["--skill", "mr-review", "--run-mode", "hybrid"])
+        .args(["--skill", "mr-review"])
         .assert()
         .success()
         .stdout(contains("write guard disarmed"));
@@ -570,7 +632,7 @@ fn finalize_warns_about_armed_cli_per_env_guard() {
     let tmp = tempfile::TempDir::new().unwrap();
     let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
 
-    // Cli (hybrid) arms a guard in each per-(group, condition) env. finalize runs from
+    // CLI dispatch arms a guard in each per-(group, condition) env. finalize runs from
     // the iteration dir, not an env, so the cwd-only check misses them; it must walk the
     // per-env markers and remind the operator.
     skill_eval()
@@ -582,8 +644,6 @@ fn finalize_warns_about_armed_cli_per_env_guard() {
             "mr-review",
             "--harness",
             "claude-code",
-            "--run-mode",
-            "hybrid",
             "--guard",
         ])
         .assert()
@@ -593,14 +653,7 @@ fn finalize_warns_about_armed_cli_per_env_guard() {
         .current_dir(&cwd)
         .args(["finalize", "--skill-dir"])
         .arg(&skill_dir)
-        .args([
-            "--skill",
-            "mr-review",
-            "--run-mode",
-            "hybrid",
-            "--iteration",
-            "1",
-        ])
+        .args(["--skill", "mr-review", "--iteration", "1"])
         .assert()
         .success()
         .stdout(contains("Guard still armed"));
diff --git a/tests/run/main.rs b/tests/run/main.rs
index 74ef8d2..4e2a975 100644
--- a/tests/run/main.rs
+++ b/tests/run/main.rs
@@ -9,13 +9,12 @@
 
 mod helpers;
 
+mod byoh;
 mod claude_cli;
 mod codex;
 mod env_layout;
 mod grouping;
 mod lifecycle;
 mod opencode;
-mod reset_batch;
 mod runbook;
 mod staging;
-mod switch_condition;
diff --git a/tests/run/opencode.rs b/tests/run/opencode.rs
index 073ae87..91e8581 100644
--- a/tests/run/opencode.rs
+++ b/tests/run/opencode.rs
@@ -1,9 +1,10 @@
 //! OpenCode-harness behavior: `.opencode/skills` staging, slug sanitization,
 //! native `<available_skills>` dispatch rendering, plan-mode approximation, and
-//! the `--guard` rejection. Characterization tests pinning current behavior so
-//! the run-mode refactor stays behavior-preserving.
+//! the `--guard` warn-and-continue fallback. Characterization tests pinning
+//! current behavior so the run-mode refactor stays behavior-preserving.
 
 use crate::helpers::*;
+use predicates::prelude::PredicateBooleanExt;
 use predicates::str::contains;
 use std::fs;
 use std::path::Path;
@@ -141,15 +142,18 @@ fn opencode_plan_mode_injects_profile_and_records_flag() {
             assert!(prompt.contains("<available_skills>"));
         }
         assert!(prompt.contains("<system-reminder>"));
-        assert!(prompt.contains("OpenCode plan mode is active"));
+        // Shared, harness-agnostic profile: same text every harness sees.
+        assert!(prompt.contains("Plan mode is active"));
         assert!(!prompt.contains("ExitPlanMode"));
     }
 }
 
 #[test]
-fn opencode_rejects_guard() {
+fn opencode_guard_warns_and_continues_unguarded() {
     let tmp = tempfile::TempDir::new().unwrap();
     let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
+    // The #126 model: an undeclared enhancement warns naming its fallback and
+    // the run proceeds — it never rejects.
     skill_eval()
         .current_dir(&cwd)
         .args(["run", "--skill-dir"])
@@ -164,11 +168,82 @@ fn opencode_rejects_guard() {
             "--guard",
         ])
         .assert()
-        .failure()
-        .stderr(contains("Unsupported for --harness opencode: --guard"));
+        .success()
+        .stderr(
+            contains("declares no write guard")
+                .and(contains("detect-stray-writes"))
+                .and(contains("Unsupported for --harness").not()),
+        );
 
-    assert!(!cwd.join(".opencode/skills").exists());
-    assert!(!iteration_dir(&cwd).exists());
+    // The run was built (staged, dispatch written) — just without a guard.
+    assert!(iteration_dir(&cwd).exists());
+    let with_skill_env = cli_env_dir(&cwd, "g1", "with_skill");
+    assert!(
+        with_skill_env.join(".opencode/skills").exists(),
+        "staging proceeded"
+    );
+    assert!(
+        !with_skill_env
+            .join(".opencode/skills/.slow-powers-eval-guard.json")
+            .exists(),
+        "no guard marker was installed"
+    );
+}
+
+#[test]
+fn opencode_default_run_warns_unguarded_without_the_flag() {
+    let tmp = tempfile::TempDir::new().unwrap();
+    let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
+    // No guard flag: auto-arm can't apply (no declared guard), so the run
+    // proceeds unguarded with a warning naming the fallback and the opt-out.
+    skill_eval()
+        .current_dir(&cwd)
+        .args(["run", "--skill-dir"])
+        .arg(&skill_dir)
+        .args([
+            "--skill",
+            "mr-review",
+            "--mode",
+            "new-skill",
+            "--harness",
+            "opencode",
+        ])
+        .assert()
+        .success()
+        .stderr(
+            contains("declares no write guard")
+                .and(contains("detect-stray-writes"))
+                .and(contains("--no-guard")),
+        );
+
+    assert!(
+        !cli_env_dir(&cwd, "g1", "with_skill")
+            .join(".opencode/skills/.slow-powers-eval-guard.json")
+            .exists(),
+        "no guard marker was installed"
+    );
+}
+
+#[test]
+fn opencode_run_warns_missing_dispatch_recipe() {
+    let tmp = tempfile::TempDir::new().unwrap();
+    let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
+    skill_eval()
+        .current_dir(&cwd)
+        .args(["run", "--skill-dir"])
+        .arg(&skill_dir)
+        .args([
+            "--skill",
+            "mr-review",
+            "--mode",
+            "new-skill",
+            "--harness",
+            "opencode",
+            "--dry-run",
+        ])
+        .assert()
+        .success()
+        .stderr(contains("declares no dispatch exec recipe").and(contains("RUNBOOK.md")));
 }
 
 #[test]
diff --git a/tests/run/reset_batch.rs b/tests/run/reset_batch.rs
deleted file mode 100644
index f2b7247..0000000
--- a/tests/run/reset_batch.rs
+++ /dev/null
@@ -1,118 +0,0 @@
-//! `reset-batch`: the per-group isolation barrier for a single-session (in-session)
-//! isolated run. Between eval-group batches it wipes the shared `env/` working tree
-//! — keeping the staged skills and the outputs tree — and re-seeds it with the next
-//! group's fixtures, so a prior batch's fixtures and stray writes can't leak.
-
-use crate::helpers::*;
-use predicates::str::contains;
-use std::fs;
-use std::path::Path;
-
-const WITH_SLUG: &str = "slow-powers-eval-1-with_skill__mr-review";
-
-/// Two evals routed into two groups: e2's `isolation: isolated` hint forces its own
-/// group, so the in-session env stages group g1 (e1/a.txt) up front and swaps in
-/// group g2 (e2/b.txt) via reset-batch.
-const TWO_GROUPS: &str = r#"{ "skill_name": "mr-review", "evals": [
-    { "id": "e1", "prompt": "p1", "expected_output": "o", "files": ["a.txt"] },
-    { "id": "e2", "prompt": "p2", "expected_output": "o", "files": ["b.txt"], "isolation": "isolated" } ] }"#;
-
-/// Stage a two-group interactive iteration; returns `(skill_dir, cwd)` with `env/`
-/// holding group g1's fixtures.
-fn setup_two_groups(root: &Path) -> (std::path::PathBuf, std::path::PathBuf) {
-    let (skill_dir, cwd) = setup(root, TWO_GROUPS);
-    fs::write(skill_dir.join("mr-review/evals/a.txt"), "AAA").unwrap();
-    fs::write(skill_dir.join("mr-review/evals/b.txt"), "BBB").unwrap();
-    skill_eval()
-        .current_dir(&cwd)
-        .args(["run", "--skill-dir"])
-        .arg(&skill_dir)
-        .args(["--skill", "mr-review", "--mode", "new-skill", "--dry-run"])
-        .assert()
-        .success();
-    (skill_dir, cwd)
-}
-
-/// Run `reset-batch` the way the runbook prescribes: from inside `env/`, carrying
-/// only the self-sufficient `--skill-dir/--skill/--workspace-dir` selector.
-fn reset_to(cwd: &Path, skill_dir: &Path, group: &str) -> assert_cmd::assert::Assert {
-    skill_eval()
-        .current_dir(env_dir(cwd))
-        .args(["reset-batch", "--skill-dir"])
-        .arg(skill_dir)
-        .args(["--skill", "mr-review", "--workspace-dir"])
-        .arg(cwd.join(".eval-magic"))
-        .args(["--iteration", "1", "--group", group])
-        .assert()
-}
-
-#[test]
-fn reset_batch_wipes_working_tree_and_reseeds_group_fixtures() {
-    let tmp = tempfile::TempDir::new().unwrap();
-    let (skill_dir, cwd) = setup_two_groups(tmp.path());
-
-    // Up front the env holds group g1's fixture only.
-    assert_eq!(read_str(&env_dir(&cwd).join("a.txt")), "AAA");
-    assert!(!env_dir(&cwd).join("b.txt").exists());
-    // Simulate a stray file the g1 batch's agent wrote into the env.
-    fs::write(env_dir(&cwd).join("stray.txt"), "STRAY").unwrap();
-
-    reset_to(&cwd, &skill_dir, "g2").success();
-
-    // The env is now seeded for g2: its fixture present, g1's gone, the stray write
-    // gone — a clean tree.
-    assert_eq!(read_str(&env_dir(&cwd).join("b.txt")), "BBB");
-    assert!(!env_dir(&cwd).join("a.txt").exists());
-    assert!(!env_dir(&cwd).join("stray.txt").exists());
-
-    // The staged skill and the outputs tree survive the wipe.
-    assert!(
-        env_dir(&cwd)
-            .join(".claude/skills")
-            .join(WITH_SLUG)
-            .is_dir(),
-        "the staged skill survives reset-batch"
-    );
-    assert!(env_dir(&cwd).join(".eval-magic-outputs").exists());
-}
-
-#[test]
-fn reset_batch_can_restore_the_first_group() {
-    let tmp = tempfile::TempDir::new().unwrap();
-    let (skill_dir, cwd) = setup_two_groups(tmp.path());
-
-    // Move to g2, then back to g1 (as condition B's loop does after condition A left
-    // the env on the last group).
-    reset_to(&cwd, &skill_dir, "g2").success();
-    reset_to(&cwd, &skill_dir, "g1").success();
-    assert_eq!(read_str(&env_dir(&cwd).join("a.txt")), "AAA");
-    assert!(!env_dir(&cwd).join("b.txt").exists());
-}
-
-#[test]
-fn reset_batch_rejects_unknown_group() {
-    let tmp = tempfile::TempDir::new().unwrap();
-    let (skill_dir, cwd) = setup_two_groups(tmp.path());
-    reset_to(&cwd, &skill_dir, "g99")
-        .failure()
-        .stderr(contains("unknown --group"));
-}
-
-#[test]
-fn reset_batch_on_single_group_run_explains_it_is_unneeded() {
-    let tmp = tempfile::TempDir::new().unwrap();
-    let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
-    skill_eval()
-        .current_dir(&cwd)
-        .args(["run", "--skill-dir"])
-        .arg(&skill_dir)
-        .args(["--skill", "mr-review", "--mode", "new-skill", "--dry-run"])
-        .assert()
-        .success();
-
-    // A single-group run tags no task with a group, so reset-batch has nothing to do
-    // and says so rather than silently wiping.
-    reset_to(&cwd, &skill_dir, "g1")
-        .failure()
-        .stderr(contains("single group"));
-}
diff --git a/tests/run/runbook.rs b/tests/run/runbook.rs
index e4c4a62..abb93ef 100644
--- a/tests/run/runbook.rs
+++ b/tests/run/runbook.rs
@@ -2,65 +2,6 @@
 //! artifact, and the post-run pointer at it.
 
 use crate::helpers::*;
-use predicates::prelude::PredicateBooleanExt;
-use predicates::str::contains;
-
-#[test]
-fn run_writes_interactive_runbook_and_points_at_it() {
-    let tmp = tempfile::TempDir::new().unwrap();
-    let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
-    // A real run (not --dry-run) so the post-run "Next:" handoff prints; --dry-run
-    // stops before next steps by contract.
-    skill_eval()
-        .current_dir(&cwd)
-        .args(["run", "--skill-dir"])
-        .arg(&skill_dir)
-        .args(["--skill", "mr-review"])
-        .assert()
-        .success()
-        // The summary hands off to a fresh isolated session: cd into env/, then
-        // "Read and follow RUNBOOK.md". It must not re-print the dispatch loop —
-        // that lives only in RUNBOOK.md now (the session-juggling apparatus is gone).
-        // (The exact env path in the handoff is locked by the util.rs unit test;
-        // here we just confirm the handoff is wired into stdout.)
-        .stdout(contains("Read and follow RUNBOOK.md"))
-        .stdout(contains("1. cd "))
-        .stdout(contains("one batch at a time").not());
-
-    // The runbook lives inside the isolated env — the session's cwd reads it.
-    assert!(!iteration_dir(&cwd).join("RUNBOOK.md").exists());
-    let book = read_str(&env_dir(&cwd).join("RUNBOOK.md"));
-    assert!(book.contains("mr-review"), "names the skill: {book}");
-    assert!(
-        book.contains("with_skill") && book.contains("without_skill"),
-        "names both conditions: {book}"
-    );
-    assert!(
-        book.contains("agent_description"),
-        "carries the in-session dispatch guidance: {book}"
-    );
-    // The per-condition batch loop: a switch-condition barrier between the two
-    // batches, carrying the absolute --workspace-dir so it resolves from env/.
-    assert!(
-        book.contains("eval-magic switch-condition --skill-dir")
-            && book.contains("--workspace-dir")
-            && book.contains("--condition without_skill"),
-        "carries the switch-condition barrier between batches: {book}"
-    );
-    assert!(
-        book.contains("eval-magic ingest --skill-dir"),
-        "carries the ingest command: {book}"
-    );
-    assert!(
-        book.contains("eval-magic finalize --skill-dir"),
-        "carries the finalize command: {book}"
-    );
-    assert!(
-        book.contains("benchmark.json"),
-        "points at the result: {book}"
-    );
-    assert!(!book.contains("{{"), "no unsubstituted tokens: {book}");
-}
 
 #[test]
 fn run_writes_headless_runbook_for_codex() {
@@ -75,8 +16,12 @@ fn run_writes_headless_runbook_for_codex() {
         .success();
 
     // Cli dispatches from per-(group, condition) envs, so the human-followed runbook
-    // lives in the iteration dir (there is no single env/).
-    assert!(!env_dir(&cwd).join("RUNBOOK.md").exists());
+    // lives in the iteration dir, not inside any env.
+    assert!(
+        !cli_env_dir(&cwd, "g1", "with_skill")
+            .join("RUNBOOK.md")
+            .exists()
+    );
     let book = read_str(&iteration_dir(&cwd).join("RUNBOOK.md"));
     assert!(
         book.contains("human driving"),
@@ -106,18 +51,15 @@ fn run_writes_headless_runbook_for_claude() {
             "mr-review",
             "--harness",
             "claude-code",
-            "--run-mode",
-            "headless",
             "--dry-run",
         ])
         .assert()
         .success();
 
     let book = read_str(&iteration_dir(&cwd).join("RUNBOOK.md"));
-    // A Claude Code Cli-mode run uses the shared human-followed template, NOT
-    // Claude's interactive (agent-followed) one — so the in-session switch-condition
-    // batch loop is absent and the claude -p recipe is present. Cli has no single
-    // env/, so the runbook lives in the iteration dir.
+    // A Claude Code run uses the shared human-followed template carrying the
+    // `claude -p` recipe. Each task dispatches from its own per-(group, condition)
+    // env, so the runbook lives in the iteration dir, above those envs.
     assert!(
         book.contains("human driving"),
         "frames the run for a human at a terminal: {book}"
diff --git a/tests/run/staging.rs b/tests/run/staging.rs
index 0db4828..e0f3bc0 100644
--- a/tests/run/staging.rs
+++ b/tests/run/staging.rs
@@ -64,9 +64,9 @@ fn run_from_skill_dir_defaults_to_new_skill_without_staging_siblings() {
         .assert()
         .success()
         .stdout(contains("Preparing mr-review iteration-1 (new-skill)"))
-        // The run summary now hands off to the isolated session; the pipeline
-        // commands live in the RUNBOOK (asserted below), not the printed summary.
-        .stdout(contains("Read and follow RUNBOOK.md"));
+        // The run summary points at the human-followed RUNBOOK (a copy of the dispatch
+        // steps); the auto-derived pipeline commands are threaded into it (asserted below).
+        .stdout(contains("RUNBOOK.md"));
 
     assert!(
         direct_iteration_dir(&skill_sub)
@@ -79,13 +79,10 @@ fn run_from_skill_dir_defaults_to_new_skill_without_staging_siblings() {
     );
 
     // Run from inside the skill dir with no args: the auto-derived target selector
-    // (`command_target_args`) is threaded into the RUNBOOK's pipeline commands.
-    let runbook = read_str(
-        &direct_iteration_dir(&skill_sub)
-            .join("env")
-            .join("RUNBOOK.md"),
-    );
-    assert!(runbook.contains("eval-magic ingest --skill-dir"));
+    // (`command_target_args`) is threaded into the RUNBOOK's pipeline commands. The
+    // RUNBOOK lives in the iteration dir (Cli dispatch has no single env/).
+    let runbook = read_str(&direct_iteration_dir(&skill_sub).join("RUNBOOK.md"));
+    assert!(runbook.contains("ingest --skill-dir"));
     assert!(runbook.contains("--skill mr-review --workspace-dir"));
     assert!(runbook.contains("--iteration 1"));
 
@@ -148,7 +145,9 @@ fn plan_mode_injects_profile_and_records_flag() {
         let prompt = read_str(Path::new(task["dispatch_prompt_path"].as_str().unwrap()));
         assert!(prompt.contains("<system-reminder>"));
         assert!(prompt.contains("Plan mode is active"));
-        assert!(prompt.contains("ExitPlanMode"));
+        // The shared profile is harness-agnostic: no Claude-specific ExitPlanMode rail.
+        assert!(prompt.contains("for the user's approval"));
+        assert!(!prompt.contains("ExitPlanMode"));
     }
 }
 
@@ -192,7 +191,7 @@ fn stage_name_threads_verbatim_name_and_registers_cleanup() {
         .assert()
         .success();
 
-    let skills_dir = env_dir(&cwd).join(".claude/skills");
+    let skills_dir = cli_env_dir(&cwd, "g1", "with_skill").join(".claude/skills");
     assert_eq!(staged_entries(&skills_dir), vec!["mr-review"]);
 
     let conditions = read_json(&iteration_dir(&cwd).join("conditions.json"));
@@ -229,10 +228,10 @@ fn stage_name_threads_verbatim_name_and_registers_cleanup() {
 fn stage_name_refuses_to_clobber_preexisting_dir() {
     let tmp = tempfile::TempDir::new().unwrap();
     let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
-    // Staging now lands in env/.claude/skills, which is fresh per iteration.
-    // The clobber guard still matters on a re-run (--iteration 1) where the env
-    // already holds an untracked skill dir; pre-seed that and confirm it is preserved.
-    let preexisting = env_dir(&cwd).join(".claude/skills/my-real-skill");
+    // Staging now lands in env-g1-with_skill/.claude/skills, which is fresh per
+    // iteration. The clobber guard still matters on a re-run (--iteration 1) where the
+    // env already holds an untracked skill dir; pre-seed that and confirm it is preserved.
+    let preexisting = cli_env_dir(&cwd, "g1", "with_skill").join(".claude/skills/my-real-skill");
     fs::create_dir_all(&preexisting).unwrap();
     fs::write(preexisting.join("SKILL.md"), "USER OWNED").unwrap();
 
diff --git a/tests/run/switch_condition.rs b/tests/run/switch_condition.rs
deleted file mode 100644
index cd39279..0000000
--- a/tests/run/switch_condition.rs
+++ /dev/null
@@ -1,153 +0,0 @@
-//! `switch-condition`: the per-condition read-isolation barrier for a
-//! single-session isolated run. It removes the off-condition's staged skill from
-//! `env/.claude/skills/` between dispatch batches, and must resolve the iteration
-//! tree while invoked from `cwd = env/`.
-
-use crate::helpers::*;
-use std::path::{Path, PathBuf};
-
-const WITH_SLUG: &str = "slow-powers-eval-1-with_skill__mr-review";
-
-fn env_skills_dir(cwd: &Path) -> PathBuf {
-    env_dir(cwd).join(".claude/skills")
-}
-
-/// Run `switch-condition` the way the runbook prescribes: from inside `env/`,
-/// carrying only the self-sufficient `--skill-dir/--skill/--workspace-dir` selector.
-fn switch_to(cwd: &Path, skill_dir: &Path, condition: &str) -> assert_cmd::assert::Assert {
-    skill_eval()
-        .current_dir(env_dir(cwd))
-        .args(["switch-condition", "--skill-dir"])
-        .arg(skill_dir)
-        .args(["--skill", "mr-review", "--workspace-dir"])
-        .arg(cwd.join(".eval-magic"))
-        .args(["--iteration", "1", "--condition", condition])
-        .assert()
-}
-
-#[test]
-fn switch_condition_removes_off_condition_slug_from_env_cwd() {
-    let tmp = tempfile::TempDir::new().unwrap();
-    let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
-    // Build the env (staging happens even under --dry-run).
-    skill_eval()
-        .current_dir(&cwd)
-        .args(["run", "--skill-dir"])
-        .arg(&skill_dir)
-        .args(["--skill", "mr-review", "--mode", "new-skill", "--dry-run"])
-        .assert()
-        .success();
-
-    let with_slug = env_skills_dir(&cwd).join(WITH_SLUG);
-    assert!(with_slug.is_dir(), "with_skill staged before switch");
-
-    // Move to the without_skill batch: the off-condition (with_skill) staged skill
-    // is removed so the control arm cannot read it.
-    switch_to(&cwd, &skill_dir, "without_skill").success();
-
-    assert!(!with_slug.exists(), "with_skill slug removed after switch");
-}
-
-#[test]
-fn switch_condition_is_idempotent() {
-    let tmp = tempfile::TempDir::new().unwrap();
-    let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
-    skill_eval()
-        .current_dir(&cwd)
-        .args(["run", "--skill-dir"])
-        .arg(&skill_dir)
-        .args(["--skill", "mr-review", "--mode", "new-skill", "--dry-run"])
-        .assert()
-        .success();
-
-    // Two switches in a row: the second is a no-op, not an error (a re-run after a
-    // fix, or an over-eager operator, must stay safe).
-    switch_to(&cwd, &skill_dir, "without_skill").success();
-    switch_to(&cwd, &skill_dir, "without_skill").success();
-    assert!(!env_skills_dir(&cwd).join(WITH_SLUG).exists());
-}
-
-#[test]
-fn switch_condition_preserves_guard_marker() {
-    let tmp = tempfile::TempDir::new().unwrap();
-    let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
-    // A guarded run arms the write guard; --guard requires a real (non-dry) run.
-    skill_eval()
-        .current_dir(&cwd)
-        .args(["run", "--skill-dir"])
-        .arg(&skill_dir)
-        .args(["--skill", "mr-review", "--mode", "new-skill", "--guard"])
-        .assert()
-        .success();
-
-    // The guard marker is a sibling file of the slug subtree inside the skills dir.
-    let marker = env_skills_dir(&cwd).join(".slow-powers-eval-guard.json");
-    assert!(marker.exists(), "guard armed before switch");
-
-    switch_to(&cwd, &skill_dir, "without_skill").success();
-
-    assert!(
-        !env_skills_dir(&cwd).join(WITH_SLUG).exists(),
-        "slug removed"
-    );
-    assert!(marker.exists(), "guard marker survives the switch");
-}
-
-#[test]
-fn switch_condition_rejects_unknown_condition() {
-    let tmp = tempfile::TempDir::new().unwrap();
-    let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
-    skill_eval()
-        .current_dir(&cwd)
-        .args(["run", "--skill-dir"])
-        .arg(&skill_dir)
-        .args(["--skill", "mr-review", "--mode", "new-skill", "--dry-run"])
-        .assert()
-        .success();
-
-    switch_to(&cwd, &skill_dir, "bogus_condition")
-        .failure()
-        .stderr(predicates::str::contains(
-            "unknown --condition 'bogus_condition'",
-        ));
-    // A typo must not silently leave the staged skill in place under a false sense
-    // of isolation.
-    assert!(env_skills_dir(&cwd).join(WITH_SLUG).is_dir());
-}
-
-#[test]
-fn switch_condition_revision_removes_old_skill_keeps_new() {
-    let tmp = tempfile::TempDir::new().unwrap();
-    let (skill_dir, cwd) = setup(tmp.path(), DEFAULT_EVALS);
-    // Revision mode compares a baseline snapshot (old_skill) against the working
-    // SKILL.md (new_skill); both arms stage a skill. Seed the baseline snapshot.
-    let snapshot = iteration_dir(&cwd)
-        .parent()
-        .unwrap()
-        .join("snapshots")
-        .join("baseline");
-    std::fs::create_dir_all(&snapshot).unwrap();
-    std::fs::write(
-        snapshot.join("SKILL.md"),
-        "---\nname: mr-review\ndescription: review merge requests\n---\n\nold body\n",
-    )
-    .unwrap();
-
-    skill_eval()
-        .current_dir(&cwd)
-        .args(["run", "--skill-dir"])
-        .arg(&skill_dir)
-        .args(["--skill", "mr-review", "--mode", "revision", "--dry-run"])
-        .assert()
-        .success();
-
-    let old_slug = env_skills_dir(&cwd).join("slow-powers-eval-1-old_skill__mr-review");
-    let new_slug = env_skills_dir(&cwd).join("slow-powers-eval-1-new_skill__mr-review");
-    assert!(old_slug.is_dir() && new_slug.is_dir(), "both arms staged");
-
-    // Switch to the new_skill batch: only the old_skill slug is removed.
-    switch_to(&cwd, &skill_dir, "new_skill").success();
-
-    assert!(!old_slug.exists(), "old_skill slug removed");
-    assert!(new_slug.is_dir(), "new_skill slug kept");
-}