legal-harness-init

Legal Harness Init

Write the stable collaboration requirements of legal professionals into loadable, incrementally updatable, verifiable harness instructions. Completion does not mean "the file has been written"; you must distinguish:

CONFIG_WRITTEN: files and managed blocks exist.
INSTRUCTIONS_LOADED: a new session reports the exact load source.
BEHAVIOR_VERIFIED: a new session passes four types of behavior probes.

If a new session cannot be started, you must report CONFIG_WRITTEN + NOT_VERIFIED, and must not claim the configuration is already in effect.

Applicable boundaries

Use when the following conditions are all met:

The user is a lawyer, in-house counsel, compliance officer, intellectual property professional, or other legal professional;
The user wants to establish or update AI collaboration rules, AGENTS.md, CLAUDE.md, or a harness baseline.

Do not use for:

legal work such as contract review, case analysis, research, and document drafting;
.claude/、.codex/, skills, docs and other project scaffolding initialization (use project-init）；
Skill or code development instead.

Input parameters

Parameter	Default value	Description
`--guide-mode`	`quick`	`quick` / `guided` / `team`
`--level`	auto-detect	`user` / `project`; team mode processes organization→project→individual
`--platforms`	current runtime + writable installed platforms	platform keys, comma-separated
`--runtime`	auto-detect	pass to when the caller explicitly knows the current platform `detect.sh`
`--project-type`	ask	`litigation` / `transactional` / `ip` / `in-house` / `research`; only routes questions, does not provide standard answers
`--privacy-mode`	`strict`	`strict` / `local` / `team`
`--mode`	`create`	`create` / `update` / `append`; all three only upsert managed blocks
`--block-id`	specified per module	stable marker id, see "Managed blocks"
`--dry-run`	no	only show candidate diff, do not write
`--model`	env allowlist probe	fallback when the init-environment managed block needs it;`ANTHROPIC_MODEL` / `OPENAI_MODEL` / `CLAUDE_MODEL` / `GLM_MODEL` / `MY_MODEL` if hit, use it
`--action`	`init`	operation type of record-init-env.sh:`init` / `update` / `append`
`--record-init-env`	`true`	whether to automatically call record-init-env.sh after write.sh actually writes to disk;`true` / `false`; can be turned off for batch scenarios
`--init-action`	`init`	the operation type passed when write.sh automatically calls record-init-env.sh

Interpret the old parameter --preset as --project-type, and prompt the new name; the project type only determines the follow-up question path and cannot fill in answers for the user.

Step 1: Detect the environment

Run:

bash scripts/detect.sh
# 调用方明确知道当前平台时：
bash scripts/detect.sh --runtime codex

Read schema v3:

runtime_candidates: candidate platforms, signals, confidence, writability;
current_runtime: set only when explicitly declared or uniquely matched with the highest confidence;
harnesses_detected: installed platforms;
project_level: composite evidence of AGENTS.md / CLAUDE.md and project-init .

The detection script only reads known directories, file existence, line counts, and whether runtime environment variables exist; it does not read environment variable values, configuration bodies, Tokens, or credentials. See references/03-harness-detection.md。

Step 2: Choose the guidance mode and privacy mode

quick: 5-minute minimal safety baseline

Used by default. Confirm in one round with at most 5 questions:

What is your role and main type of work?
What are the common deliverables and expected formats?
What actions can AI perform, what must be confirmed first, and what is absolutely prohibited?
Use strict、local or team privacy mode?
Which decisions, evidence changes, deadlines, and deliverable versions need to be traced, and which authoritative vehicle does the project already have?

Each group of answers explains only one sentence of "why it is needed." Do not skip necessary security questions, and do not force the user to complete all teaching sections. Generate M1, M2, M3, the legal security baseline, and M5; at the project level, additionally generate the minimum M6—M8.

guided: co-design module by module

Guide item by item through M1→M8, referring to references/04-modules.md and templates/modules/. When the user is stuck, offer candidate dimensions; do not decide for the user, and do not directly apply the examples.

team: three-layer governance

First read references/20-team-layering.md, and confirm separately:

Organizational layer: stable security, confidentiality, approval, and tool policies that cannot be weakened by the project;
Project layer: matter scope, stage, sources of facts, time limits, and project workflow;
Individual layer: expression, format, and non-mandatory preferences.

Within the same governance scope that the platform permits to be configured, in the event of conflict the order must be legal security boundaries/organizational mandatory policies > project-specific rules > individual preferences; for conflicts at the same layer, request the responsible person to confirm and keep a record. AGENTS.md/CLAUDE.md are persistent default baselines, and this team-layer rule must not be interpreted as a general rewrite of the platform instruction hierarchy or the user's current explicit authorization.

Three privacy modes

Execute according to references/18-privacy-and-context.md :

strict: AGENTS.md records only the project code name, type, stage, key time points, and rules, and does not record real parties, case numbers, amounts, contact information, or identity numbers.
local: Real facts are written into 0600 with write permission and excluded by .gitignore from .legal-context.local.md; AGENTS.md retains only entry points and rules for reading on demand.
team: Real facts enter only organization-approved controlled team vehicles; AGENTS.md records the vehicle path, access conditions, and de-identification/external disclosure rules, and does not record credentials or highly sensitive personal identity numbers.

Step 3: Generate the legal security baseline

M4/M5 must cover four contracts, and the project configuration must not directly contain credentials, highly sensitive identity numbers, or identifiable case information unrelated to collaboration:

Permission contract: what authorization is required for reading, writing, external sending, submission, deletion, and payment respectively; external or irreversible actions must be confirmed item by item.
Confidentiality contract: default to the minimum necessary context; it is prohibited to write client materials, identity numbers, credentials, or un-de-identified facts into public configurations, logs, submissions, or external services.
Traceability contract: distinguish material facts, inferences, and recommendations; legal conclusions retain source, time, and scope of application; clearly identify gaps when information is insufficient.
Human adjudication contract: AI does not make final legal judgments; deadlines, amounts, subjects, statutory citations, and external deliverables must be reviewed by designated personnel.

Choose the retrospective vehicle according to the nature of the facts, and prioritize reusing the project's existing authoritative sources:

Decision/trade-off → existing DECISIONS.md or project-designated decision vehicle;
Addition of evidence materials, changes in source or purpose of proof → evidence catalog/evidence index/project-designated evidence log;
Deadlines and responsible persons → existing TASKS.md, deadline ledger, or authorized calendar;
Deliverable versions and user-visible changes → CHANGELOG.md Or a project-specified delivery record.

When a project does not have a certain type of file enabled, ask first or mark it as pending supplementation; do not create empty documents for the sake of formal completeness. See references/06-audit-trail-contract.md。

Step 4: Generate the minimal project context

M6—M8 generate only by default:

# 项目：{项目代号}

- 类型：{项目类型}
- 阶段：{当前阶段}
- 关键时点：{日期 + 事项；未知则写待补充}
- 受控事实入口：{不需要则写“无”}
- 文件结构与权威载体：{沿用项目现有约定}

Do not by default ask for or write complete parties, real case numbers, amounts, or unified social credit codes. When real facts genuinely need to be used, write them into a controlled carrier according to the privacy mode. The project type is used only to decide the next necessary question; see references/12-module-project-context.md and references/13-module-case-facts.md。

If project-init composite evidence is detected, only supplement the legal safety, traceback, and controlled context entry points; do not modify the project scaffold.

Step 5: Preview with stable managed blocks

Each module uses a fixed block-id, updating only one logical block at a time:

Content	block-id
Role	`m1-role`
Workflow	`m2-workflow`
Collaboration preferences	`m3-collab-style`
Legal safety baseline (including M4)	`legal-safety-baseline`
Traceback contract	`m5-traceability`
Project context	`m6-project-context`
Controlled fact entry point	`m7-fact-entry`
File structure	`m8-file-structure`
Initialization environment (subject to `legal-harness-init` automatic append)	`init-environment`

write.sh Must automatically add the form  unique paired markers, and deduplicate by actual target path; content temporary files must not add outer markers on their own. First run content validation, then use --dry-run to show the merge candidate diff.

Step 6: Validate and write safely

bash scripts/validate-content.sh \
  --file <模块内容文件> \
  --privacy-mode <strict|local|team>

bash scripts/write.sh \
  --content-file <模块内容文件> \
  --level <user|project> \
  --platforms <key,key> \
  --mode <create|update|append> \
  --block-id <稳定-id> \
  --privacy-mode <strict|local|team> \
  --project-dir <项目路径> \
  --dry-run

After confirming the diff, remove --dry-run. The script must:

Deduplicate by actual target path; when Codex + OpenClaw point to the same project AGENTS.md , write only once;
After validating markers and sensitive information, construct the candidate in the same target directory and replace it atomically;
Save the .bak.legal-harness-init and permission/hash metadata before the first write, and save a unique snapshot for each change;
Tighten user-level configuration, original backups, snapshots, and metadata to 0600；
When the same content is written a second time, report unchangedwithout generating a new snapshot.

When rollback is needed:

bash scripts/restore.sh --target <AGENTS.md-or-CLAUDE.md>

For platform paths and non-AGENTS.md mode restrictions, see scripts/README.md。

Step 6.5: Record the initialization environment

write.sh After the real on-disk write (v0.4.2+)has automatically called once record-init-env.sh, the agent does not need to chain it manually. To disable it (such as in batch script scenarios), pass --record-init-env false . See references/22-initialization-environment.md and templates/modules/init-environment.md。

write.sh After the on-disk write, it is called automatically; the following command is used only in --record-init-env false or when a manual supplementary record is needed:

bash scripts/record-init-env.sh \
  --target <项目/AGENTS.md|CLAUDE.md> \
  --action <init|update|append> \
  [--model <model-name>] \
  [--harness <key>] \
  [--harness-version <v>] \
  [--skill-version <v>] \
  [--note "<额外说明>"] \
  [--probe-from-session] \
  [--dry-run]

Semi-automatic collection by script; if all env entries match, it can be called directly:

harness(name): default source detect.sh takes current_runtime(schema v3); can use --harness to explicitly override
harness version: detect claude --version / codex --version(2s timeout, on failure unknown); if not claude/codex, write n/a
model: env whitelist ANTHROPIC_MODEL / OPENAI_MODEL / CLAUDE_MODEL / GLM_MODEL / MY_MODEL detection,when all fail to match: v0.5.2+ if --probe-from-session is passed, then reverse-lookup the model from the current harness session—claude-code/qwenwork/qoderwork/myagents (CC clone jsonl,role=assistant.message.model）、codex（turn_context.payload.model), workbuddy (trace spans toolOutput chat.completion.model); openclaw/orca are temporarily not_found; if still no match, refuse to append and require --model Fallback (do not fabricate)
init skill version: read from this skill root SKILL.md frontmatter version field

The script must:

Be wrapped in managed markers, append-only table rows (do not overwrite history)
If the block is incomplete (only start or only end), refuse to append and prompt for manual repair
Fail closed: refuse if parameters are invalid, the target does not exist, the candidate marker is incomplete, or the overall structure is abnormal
When the table has >50 rows, softly prompt on stderr to archive (do not block)

Each time write.sh is actually persisted (not a dry-run, not needs_confirmation), write.sh has automatically called record-init-env.shonce (v0.4.2+, controlled by the --record-init-env switch). Missing this record is equivalent to "the config was changed but the tool environment was not recorded". If the model cannot be obtained, do not fabricate; you must explicitly pass --model or fall back to NOT_VERIFIED.

Step seven: verify it takes effect in a new session

According to references/19-activation-verification.md , newly start the target harness session, confirm the load source, and execute four types of probes: permissions, confidentiality, information gaps, and traceback carrier selection.

Save the evidence as a local temporary key=value file and then run:

bash scripts/verify.sh \
  --target <配置文件> \
  --block-id <稳定-id> \
  --session-evidence <证据文件>

The evidence must include new_session=true、loaded=true, the exact source_path, the config_sha256consistent with the current configuration, and the four probe_*=pass before you can report BEHAVIOR_VERIFIED. After the configuration changes, old evidence becomes invalid; the self-report of the current writing session does not count as load evidence.

Acceptance