Eleven pieces, one harness

A setup you can verify in one command

Schema, hook jar, registered hooks, boundary rules and provenance, checked before anything is generated. The hooks exit 0 when they cannot verify something; the doctor is what turns those silent greens into a named line.

Generated through the Initializr, with the harness inside

The base project comes from start.spring.io at run time, never from the model's memory, and CI fails if a version is written as a fact. The project carries its own .claude/ and does not need this repository afterwards.

Guide →

A spec with one owner per layer

use-case-design → domain-modeling → rest-api-architect or graphql-api-architect → security, outbound HTTP, AI, search, messaging and jobs when they apply → persistence-architect → cache when it applies → test-architect. It asks only the questions that change the design.

ONLY HERE approved spec frozen by a hook

A restricted executor, in groups

After /clear, the approved spec goes to the executor agent. In UC-005: domain 2m29s · adapters 14m22s · tests 17m29s · compose 4m05s · publish 3m55s.

Every run measured, at zero token cost

One report per skill or agent invocation: billable tokens and model per piece, a chain tree with durations, files touched, failed tools, HEAD before and after. Prompts are redacted.

ONLY HERE deterministic per-run trail

Update without losing hand edits

Installs the harness into a project born elsewhere, or updates one that is behind. It refuses a dirty worktree, stamps a hash for every file it writes, and prints migration notes without running them.

Guide →

ONLY HERE local edits detected by hash

A way up for a project below the floor

/arch-adopt refuses a project on Spring Boot below 4.0. /platform-upgrade takes the build to the line the Initializr serves today: an OpenRewrite recipe written from data, then a guided pass until the build is green. The tests run before and after, and it never commits.

Guide →

Write territory per class

design, orchestrator, build, observer, report, ops, meta. The class declares which paths a skill may write; guard refuses everything else, deny by default.

ONLY HERE territory as data

Agents scoped by rule, not by goodwill

driver, executor, installer, verifier. A subagent is judged by its own class, whatever phase its caller left open.

Refused before the file changes

Through Write and Edit, through the shell write shapes it can read (>, tee, sed -i, sh -c), and again at Stop, against what git saw change during the turn.

The rest of the harness

docker-architect for infrastructure decided in the design, sonar-lessons → report-issue to close the loop in public, AGENTS.md in every project, ArchHook.java with eleven modes and no shell, and a CI that validates the harness itself.