harness/

Package adapterclient is the one place the harness spawns an adapter child (plan 3.4, 4.1, 6.6; brief section 2.2).

Package backoff is the retry arithmetic of plan 6.6 and 6.8 item 7 (U-16): an exponential schedule with jitter for the watcher's restart of its `message watch` child (1 s doubling to a 30 s cap) and for adapter errors (1 s doubling to a 5 min cap), and the retryability predicate — only `rate_limited` and `unavailable` (and a crash or signal, which adapterkit.Spawn already maps to `unavailable`) are ever retried; `invalid_input`, `unauthorized`, `loop_detected` and every other code are terminal.

Package bootstrap holds no Go code that ships.

Package commands implements the human and model command surface of the `brigade` binary (plan 6.4): `sessions`, `send`, `whoami`, `team members`, the hold policy's `inbox` and `inbox release` (inbox.go), and the terminal pass-through of `team create|join|leave` and `profile init|status|reset|revoke-credentials`.

Package config is the only harness package that reads configuration from the environment (plan 3.2, 6.5, 7.3; forbidigo enforces the static half).

Package e2e holds the end-to-end harness tests of plan 9.5 (the integrator's half of P3-3/P3-4/P3-5, E2E-01's fs precursor): the built `brigade` binary and the built fs adapter, driven as real processes — the terminal pass-through that creates and joins a team, the three lifecycle hooks with their stdin documents and session environments, the REAL detached watcher the SessionStart hook spawns, `brigade send` from a second principal's own session, the frame arriving at a fake inbox socket, and the token appearing in no file and on no argv afterwards (U-25's whole-tree grep).

Package frame renders and parses the `<brigade-message>` frame of plan 6.7 — the text a receiving model actually reads — in the shape D19 settled on (variant C, decided by E0-3 at an interactive sitting on 2026-08-31): Brigade's own frame, nested by Wrap inside the native `<cross-session-message from-name="…">` wrapper that the Claude Code harness consumes into its "Message from @<name>" attribution.

Package hook implements the three Claude Code lifecycle hooks of plan 6.3 — `brigade hook session-start`, `brigade hook prompt` and `brigade hook session-end` — the processes Claude Code runs from plugin/hooks/hooks.json with a JSON document on stdin and the session's environment (6.5).

Package inbound is the receive-side pipeline of plan 6.8 — the ordered controls every `message` event passes before it is framed and handed to an injector — implemented once, PURE, so that P3-5's watcher (socket post or `--sink`) and P3-4's prompt-hook poll (6.3) run the same code:

Package pidfile is the watcher's single-instance guard (plan 6.6, the `${BRIGADE_STATE_DIR}/watchers/<claude_pid>.json` row of 3.2, corrected by E0-5 items 1 and 3; package tree 7.1).

Package policy decides the inbound policy a session runs under — the step 3 of plan 6.8, with the native `crossSessionInbound` scan of 6.10 folded in — and is the ONLY implementation of that decision: the SessionStart hook (P3-4) calls it to fill the by-pid map's `inbound`, the prompt-hook poll and the watcher's pipeline (internal/harness/ inbound) run under the value it produced.

Package registry reads Claude Code's own session registry, best effort and read-only (plan 6.5, A.3): $CLAUDE_CONFIG_DIR/sessions/<pid>.json, an undocumented file that carries the session's display name (set with --name or /rename), its busy/idle status, the inbox socket path and the Claude Code version.

Package sessionmap is the hook-written state that binds a Claude Code process to its Brigade session (plan 3.2, 6.5): the by-pid map at ${stateDir}/sessions/by-pid/<claude_pid>.json, from which the session-bound commands and the watcher resolve EVERYTHING (profile, config dir, adapter argv, Brigade session id, team, socket path), and the by-native map at ${stateDir}/sessions/by-native/<claude_session_id>.json, which lets a later `claude --resume` re-open the same Brigade session (3.7).

Package socketpost is the inbox socket client of plan 6.7 and A.2: it writes one frame into a Claude Code session's `CLAUDE_CODE_MESSAGING_SOCKET` as the two NDJSON lines the harness reads — an auth line carrying the session's messaging token, then a user line carrying the content — and closes.

Package teamfile reads the one file a project may commit to name its Brigade team: `.brigade.json` at the repository toplevel (plan P7-2, brief §1).

Package teamstore is the user-side trust root of the repo-file model (plan P7-4, brief §3/§5): the team KEY that names a credential directory, the BINDING (`teams/<key>/team.json`, the adapterkit profile schema) verified field-by-field against a parsed repo file — the hash is never trusted alone — and the per-checkout PINS in `projects.json` that separate membership from attachment: a repo file attaches a session only where a human ran `team join` in that checkout.

Package transcript reads Claude Code's own session transcript — the append-only NDJSON file whose path the hooks receive as `transcript_path` — for the two facts `brigade sessions` shows beside a session's name and activity: the model it runs and how much of its context window is in use.

Package watch is the detached inbound watcher of plan 6.6 and 6.8 — the process `brigade hook session-start` spawns with Setsid and the hook-built environment, and which then supervises the adapter's `message watch` child, runs every `message` event through the shared receive-side pipeline (internal/harness/inbound), injects each frame into the Claude Code session's inbox socket (internal/harness/socketpost) or, in the test harness's sink mode, appends it to a file, acknowledges only what was injected, heartbeats the Brigade session, and exits when the Claude Code process, the by-pid map or a SIGTERM says the session is over.