Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Composite Phase-2 audit worker (ADR-150). Bundles harness oia-manifest + threat-model + mcp-scan into one timestamped audit record stored in the `metaharness-audit` memory namespace. Designed for cron-scheduled drift detection.
.claude/skills/ruvnet-harness-oia-audit/SKILL.md| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-01 | ✗→✓ | ▲ Improved | 43% | 0% |
| case-02 | ✗→✓ | ▲ Improved | 5% | 0% |
| case-04 | ✗→✓ | ▲ Improved | -34% | 0% |
| case-07 | ✗→✓ | ▲ Improved | -22% | 0% |
| case-08 | ✗→✓ | ▲ Improved | -7% | 0% |
The 13th worker (ADR-150 Phase 2) — runs three MetaHarness static surfaces in one shot, computes a composite worst-severity signal, and persists the audit record to memory so drift over time is visible.
Implementation: scripts/oia-audit.mjs.
harness oia-manifest <path> — Open Infrastructure Architecturelayer alignment (L1-L9).
harness threat-model <path> — categorized MCP-surface threatreport with worst: clean|low|medium|high.
harness mcp-scan <path> — per-server/tool policy + permissions+ dep findings.
max(threatModel.worst, max(mcpScan.findings.severity)).metaharness-audit with keyaudit-<iso-timestamp> (unless --dry-run).
--alert-on-worst <severity>: exit 1 if composite worst ≥ threshold.When ALL three components report metaharness-not-available, the script emits the standard degraded payload and exits 0. When only some are degraded, each individual component carries its own degraded: true flag in the audit record — the audit still runs and persists what it could gather.
Designed for weekly cron in .github/workflows/:
yamlon: schedule: - cron: '17 4 * * 0' # Sundays at 04:17 UTC jobs: oia-audit: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 - run: node plugins/ruflo-metaharness/scripts/oia-audit.mjs --alert-on-worst high
--alert-on-worst high fails the job on any HIGH-severity finding; drift below HIGH is logged but doesn't block.
Each audit run stores under metaharness-audit:audit-<iso-ts>. To list recent audits:
bashnpx @claude-flow/cli@latest memory list --namespace metaharness-audit --limit 10
To diff two audits (drift detection):
bashA=$(npx ... memory retrieve --key audit-2026-06-01... --namespace metaharness-audit) B=$(npx ... memory retrieve --key audit-2026-06-15... --namespace metaharness-audit) # Compare composite.worst, components.threatModel.worst, etc.
A future ADR can wire this into a dedicated cost-diff-style diff viewer specifically for audit drift.
harness-threat-model — the underlying threat-model componentharness-mcp-scan — the underlying MCP-scan componentharness-score + harness-genome — readiness metrics (orthogonal to audit)| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-01 | fail→pass | 13,770 | 17,384 | +26% | 1 | 1 | 0% | 1,711 | 2,442 | +43% | 0 | 0 | — |
case-02 | fail→pass | 32,791 | 6,472 | -80% | 1 | 1 | 0% | 1,967 | 2,059 | +5% | 0 | 0 | — |
case-03 | fail→fail | 10,062 | 5,052 | -50% | 1 | 1 | 0% | 1,744 | 1,087 | -38% | 0 | 0 | — |
case-04 | fail→pass | 14,524 | 6,261 | -57% | 1 | 1 | 0% | 2,699 | 1,777 | -34% | 0 | 0 | — |
case-05 | pass→pass | 9,192 | 3,717 | -60% | 1 | 1 | 0% | 1,726 | 1,496 | -13% | 0 | 0 | — |
case-06 | fail→fail | 16,336 | 14,967 | -8% | 1 | 1 | 0% | 2,688 | 3,322 | +24% | 0 | 0 | — |
case-07 | fail→pass | 8,623 | 3,066 | -64% | 1 | 1 | 0% | 1,549 | 1,206 | -22% | 0 | 0 | — |
case-08 | fail→pass | 11,025 | 4,451 | -60% | 1 | 1 | 0% | 1,865 | 1,736 | -7% | 0 | 0 | — |
case-09 | fail→pass | 10,066 | 5,804 | -42% | 1 | 1 | 0% | 1,803 | 1,863 | +3% | 0 | 0 | — |
case-10 | fail→pass | 10,514 | 3,926 | -63% | 1 | 1 | 0% | 1,776 | 1,235 | -30% | 0 | 0 | — |
case-11 | pass→pass | 3,744 | 2,620 | -30% | 1 | 1 | 0% | 587 | 1,139 | +94% | 0 | 0 | — |
case-12 | fail→pass | 18,248 | 2,008 | -89% | 1 | 1 | 0% | 3,144 | 1,113 | -65% | 0 | 0 | — |
case-13 | fail→pass | 8,446 | 3,255 | -61% | 1 | 1 | 0% | 1,647 | 1,352 | -18% | 0 | 0 | — |
case-14 | fail→pass | 11,303 | 4,023 | -64% | 1 | 1 | 0% | 1,735 | 1,110 | -36% | 0 | 0 | — |
case-15 | fail→pass | 13,533 | 1,450 | -89% | 1 | 1 | 0% | 2,317 | 954 | -59% | 0 | 0 | — |
case-16 | pass→pass | 10,573 | 6,401 | -39% | 1 | 1 | 0% | 1,749 | 1,823 | +4% | 0 | 0 | — |
case-17 | fail→pass | 10,243 | 1,941 | -81% | 1 | 1 | 0% | 1,791 | 1,055 | -41% | 0 | 0 | — |
case-18 | pass→pass | 3,907 | 2,578 | -34% | 1 | 1 | 0% | 809 | 1,190 | +47% | 0 | 0 | — |
case-19 | fail→pass | 13,127 | 7,911 | -40% | 1 | 1 | 0% | 2,463 | 2,316 | -6% | 0 | 0 | — |
case-20 | fail→pass | 7,528 | 1,328 | -82% | 1 | 1 | 0% | 1,351 | 957 | -29% | 0 | 0 | — |
case-21 | pass→pass | 7,047 | 1,891 | -73% | 1 | 1 | 0% | 1,201 | 1,077 | -10% | 0 | 0 | — |
case-22 | fail→pass | 10,274 | 1,880 | -82% | 1 | 1 | 0% | 2,063 | 1,080 | -48% | 0 | 0 | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted, and 21 counted toward the lift figure. The other 1 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +68 percentage points is the difference between those two pass rates over the 21 comparable cases.
Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.
Other measured skills in the registry, with their headline benchmark lift.