chore: add superharness scaffold, AGENTS.md, SOUL.md; ignore .serena/

.github/workflows/cd.yml

@@ -79,7 +79,7 @@ jobs:
             exit 1
           fi
 
-          echo "tag=$TAG" >> $GITHUB_OUTPUT
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
 
   build-prerelease:
     name: Build pre-release

.github/workflows/release.yml

@@ -180,7 +180,7 @@ jobs:
           if [ -z "$TAG" ]; then
             TAG="${{ github.event.release.tag_name }}"
           fi
-          echo "version=$TAG" >> $GITHUB_OUTPUT
+          echo "version=$TAG" >> "$GITHUB_OUTPUT"
 
       - name: Flatten artifacts
         run: |
@@ -224,7 +224,7 @@ jobs:
           if [ -z "$TAG" ]; then
             TAG="${{ github.event.release.tag_name }}"
           fi
-          echo "tag=$TAG" >> $GITHUB_OUTPUT
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
 
       - name: Send Discord notification
         env:
@@ -259,8 +259,8 @@ jobs:
             TAG="${{ github.event.release.tag_name }}"
           fi
           VERSION="${TAG#v}"
-          echo "tag=$TAG" >> $GITHUB_OUTPUT
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
       - name: Download checksums
         run: |
@@ -273,10 +273,10 @@ jobs:
       - name: Parse checksums
         id: sha
         run: |
-          echo "mac_arm=$(grep aarch64-apple-darwin.tar.gz checksums.txt | head -1 | awk '{print $1}')" >> $GITHUB_OUTPUT
-          echo "mac_intel=$(grep x86_64-apple-darwin.tar.gz checksums.txt | head -1 | awk '{print $1}')" >> $GITHUB_OUTPUT
-          echo "linux_arm=$(grep aarch64-unknown-linux-gnu.tar.gz checksums.txt | head -1 | awk '{print $1}')" >> $GITHUB_OUTPUT
-          echo "linux_intel=$(grep x86_64-unknown-linux-musl.tar.gz checksums.txt | head -1 | awk '{print $1}')" >> $GITHUB_OUTPUT
+          echo "mac_arm=$(grep aarch64-apple-darwin.tar.gz checksums.txt | head -1 | awk '{print $1}')" >> "$GITHUB_OUTPUT"
+          echo "mac_intel=$(grep x86_64-apple-darwin.tar.gz checksums.txt | head -1 | awk '{print $1}')" >> "$GITHUB_OUTPUT"
+          echo "linux_arm=$(grep aarch64-unknown-linux-gnu.tar.gz checksums.txt | head -1 | awk '{print $1}')" >> "$GITHUB_OUTPUT"
+          echo "linux_intel=$(grep x86_64-unknown-linux-musl.tar.gz checksums.txt | head -1 | awk '{print $1}')" >> "$GITHUB_OUTPUT"
 
       - name: Generate formula
         run: |

.gitignore

@@ -46,3 +46,5 @@ claudedocs
 
 # icm 
 .fastembed_cache/
+.serena/
+excalidraw.log

.project-hooks/pre-commit

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Force tracking tests to use a writable temp DB path during hook execution.
+tmp_db="$(mktemp /tmp/rtk-precommit-db.XXXXXX.sqlite3)"
+trap 'rm -f "$tmp_db"' EXIT
+
+RTK_DB_PATH="$tmp_db" cargo test

.shipguard.yml

@@ -0,0 +1,40 @@
+# ShipGuard configuration
+# Reviewed 2026-04-01 — celstnblacc/rtk fork of rtk-ai/rtk
+# All findings here are pre-existing upstream issues, not introduced by this fork.
+
+severity_threshold: medium
+
+exclude_paths:
+  - "vendor/**"
+  - "node_modules/**"
+  - "**/fixtures/**"
+  - "**/__snapshots__/**"
+  # Installer and test/developer scripts — not production code
+  - "scripts/**"
+  # SHELL-005 false positive: ${GREEN}/${NC} ANSI color vars in printf format strings
+  # are flagged as JSON variable interpolation — they are not JSON
+  - "install.sh"
+  # Claude Code hook files — SHELL-002 false positives: $updated inside jq
+  # single-quoted filter strings is a jq variable, not a shell variable
+  - ".claude/**"
+  # Hook test harnesses — SHELL-005 false positives: echo "$input_json" | bash "$HOOK"
+  # pipes pre-constructed test fixtures, not user-controlled JSON being built via interpolation
+  - "hooks/*/test-*.sh"
+
+# Accepted risks (reviewed 2026-04-01)
+disable_rules:
+  # GHA-002: Unpinned GitHub Actions — upstream workflow files, not owned by this fork
+  - GHA-002
+  # GHA-005: PR head checkout — upstream CI pattern, no sensitive secrets in CI
+  - GHA-005
+  # SC-004: .gitignore advisory — tracked separately in repo root .gitignore
+  - SC-004
+  # SC-005: Docker image signing — dev-tool CLI, not a production pipeline
+  - SC-005
+  # SC-003: No frozen lockfile — test scripts only, no production dependency resolution here
+  - SC-003
+  # SHELL-002: Unquoted variable flagged in hooks/claude/rtk-rewrite.sh:83,95
+  # FALSE POSITIVE — `$updated` appears inside single-quoted jq filter strings (e.g. '{...}').
+  # Single quotes prevent shell expansion; `$updated` is a jq variable injected via
+  # --argjson, not a shell variable. The shell cannot expand it. Confirmed 2026-04-01.
+  - SHELL-002

.superharness/.gitignore

@@ -0,0 +1,4 @@
+.dashboard_auth_token
+trace.jsonl
+session-progress.md
+watcher.heartbeat

.superharness/contract.yaml

@@ -0,0 +1,21 @@
+# Active contract for rtk
+id: initial-setup
+created: 2026-03-31
+created_by: owner
+status: draft
+
+goal: "TBD — describe the current objective"
+
+tasks: []
+
+decisions: []
+
+failures: []
+
+# Task schema (recommended):
+# tasks:
+#   - id: "task-id"
+#     title: "Task title"
+#     status: "todo|in_progress|done"
+#     owner: "claude-code|codex-cli"
+#     project_path: "/Users/airm2max/DevOpsSec/rtk"

.superharness/decisions.yaml

@@ -0,0 +1,11 @@
+# Cross-agent decision records (ADR-lite)
+# Both Claude Code and Codex CLI read/write this file.
+# Format:
+#   - id: "short-kebab-id"
+#     what: "decision title"
+#     why: "rationale"
+#     alternatives: ["alt1", "alt2"]
+#     date: YYYY-MM-DD
+#     by: claude-code | codex-cli | owner
+#     status: accepted | superseded | deprecated
+decisions: []

.superharness/failures.yaml

@@ -0,0 +1,11 @@
+# Cross-agent failure memory
+# Both Claude Code and Codex CLI read/write this file.
+# Format:
+#   - what: "brief description"
+#     why_failed: "root cause"
+#     date: YYYY-MM-DD
+#     agent: claude-code | codex-cli
+#     tech: "technology/library involved"
+#     severity: minor | major | critical
+#     promoted: false  # set true when added to CLAUDE.md/AGENTS.md "Do Not" section
+failures: []

.superharness/features.json

@@ -0,0 +1,34 @@
+{
+  "features": [
+    {
+      "id": "project-builds",
+      "category": "core",
+      "description": "Project builds without errors",
+      "steps": [
+        "Run the build command",
+        "Verify no errors in output"
+      ],
+      "passes": false
+    },
+    {
+      "id": "tests-pass",
+      "category": "core",
+      "description": "All tests pass",
+      "steps": [
+        "Run the test suite",
+        "Verify all tests green"
+      ],
+      "passes": false
+    },
+    {
+      "id": "cli-entry-point",
+      "category": "cli",
+      "description": "CLI entry point works",
+      "steps": [
+        "Run the CLI with --help or --version",
+        "Verify output"
+      ],
+      "passes": false
+    }
+  ]
+}