# Discover harness

This repository researches software products from the outside in. A run models one target as a person meets it: every surface it shows, what each surface contains, how the surfaces connect, what the product claims, and how its design measures against the B2B product-UX canon. The corpus it leaves at `research/<target>/runs/<run-id>/` is what the next agent or person starts from.

## The run

- **Entry:** every run goes through the `discover` skill: `discover <target>` runs or resumes, `discover derive <run-dir>` compiles a captured run, and `calibrate` re-derives a past run blind.
- **Two phases:** capture saves every revealed state of the live product (an image and a structural dump per state); derive compiles surface records, the model and the census from what was saved. A claim with no saved state behind it is not observed.
- **The walk is the centre of gravity.** The `surface-census` skill captures; `product-model` compiles; the `evidence` skill's checks gate every phase; lanes run in the background and tell the walk what exists.
- **One page per run:** the `report` skill renders `report/index.html` from the corpus at close. The page is git-ignored and rebuilt by its script, never edited.
- **Scope of a run:** page composition. Wire protocol, auth, stack and shipped clients run only under the `technical` profile (`wire-tradecraft` skill, `exterior` agent, with REA leading on shipped clients and merged with the walk on the web); rebuilding a behaviour runs only under `reconstruct`.

## Delegation

| Agent | Job | Tier |
| --- | --- | --- |
| `structure`, `dimensional-analyzer`, `schema` | background lanes: surfaces from source or bundle, the product's public dimensions and what it claims, the published object model | standard (sonnet) |
| `exterior` | `technical` lane: stack fingerprint and shipped-client metadata | fast (haiku) for DNS and header tables, standard otherwise |
| `critic` | blind re-verification of a sampled question set against saved evidence | standard |
| `redaction-auditor` | opens every saved image and dump and lists people, ids and secrets | standard |

- **Every dispatch names its tier;** none inherits the session's model, and the strongest tier runs only on the user's ask.
- **The main session owns the browser and every composition judgment.** No agent drives the user's Chrome, writes a surface record or calls a file clean.
- **A delegated result is a report:** the lane's files are read before anything relies on them, and a dispatch is scoped to minutes and never the only thing running.

## Ethics

Product research, spec-writing, integration planning and competitive analysis only. The `discover` skill's `references/ethics.md` holds the full rules.

- **Never enter credentials or sign up.** The user logs in; a login wall is a stop and a question.
- **Read-only unless named.** Every write, spend or action visible to others needs an exact line in the run's write authorization, or the user's yes in chat.
- **Secrets and people never reach disk.** The overlay runs before every screenshot, the `redaction-auditor` opens every image, and `sweep.py` passes before a corpus is committed.
- **No interception of third parties, no reconstruction of third-party code, no exfiltration.**

## Enforcement

Hooks in `.claude/settings.json` run `.claude/hooks/discover_hook.py`: no screenshot without a fresh overlay on that tab, no typing on a sign-in page, no reads of sealed paths, lint feedback on every record and summary written. The `evidence` skill's `checks.py` is the one engine behind every gate; a check that fires is fixed or recorded as a defect, never muted.

## Improvement

A run never edits the harness. Its review writes typed defects to `defects.jsonl`; the improvement harness (`~/dev/etna/harness/discover-improve/`) turns them into probed candidates, and the user approves each change before it is delivered to the forge at `~/dev/etna/harness/discover/` with a zero-drift `diff -r`.