Harness foundation: INTENT, ADR-001, architecture, prototype adoption

- INTENT.md: three-layer model (blueprint/instance/harness), single
  shared runtime, never-become boundaries
- ADR-001 (accepted): DEC-2026-002 resolution — one harness repo for
  all projects; instances are declarative state in consuming repos
- docs/architecture.md: components, contracts (manifest, tool
  profiles, completion events, credential lanes), deployment shape
- agent_harness/: executor-worker prototype adopted and renamed
  (6/6 tests green); HARNESS-WP-0001 initial workplan (7 tasks)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

workplans/HARNESS-WP-0001-harness-foundation.md

@@ -0,0 +1,103 @@
+---
+id: HARNESS-WP-0001
+title: "Harness Foundation: from prototype to shared runtime"
+status: active
+---
+
+Turn the adopted executor-worker prototype into the single shared agent
+runtime per ADR-001 / DEC-2026-002. Tenant #1 is binky-control; its
+cutover (BINKY-WP-0004-T06) gates on T06 here. Boundaries per INTENT.md:
+no scheduling, no blueprint authoring, no tenant-specific logic.
+
+## Task: Instance manifest spec and validation
+
+Specify the declarative instance manifest (extends ADR-005
+`.kaizen/schedule.yml`): blueprint, cadence, enabled, lane, tool_profile
+(by name), budget, pinned harness major. Implement `agent-harness
+validate --target <repo>` mirroring kaizen's schedule validate. Align
+the schema with kaizen-agentic owners (their file, our extra keys — or a
+sibling manifest if they prefer separation).
+
+```task
+id: HARNESS-WP-0001-T01
+status: todo
+priority: high
+```
+
+## Task: Named tool profiles
+
+Central tool-profile registry (seed: `green-commit-only` from the
+prototype allow-list; add `blue-mail-triage`). Manifests reference
+profiles by name; the runner resolves and enforces them. Unknown profile
+= refuse to run.
+
+```task
+id: HARNESS-WP-0001-T02
+status: todo
+priority: high
+```
+
+## Task: Task intake from activity-core emission
+
+Replace the JSON task-file MVP source with polling the issue-core REST
+sink (or TaskExecutorWorkflow handoff) for emitted tasks labeled for the
+harness; map emissions to TaskSpec. Keep the task-file path for local
+development.
+
+```task
+id: HARNESS-WP-0001-T03
+status: todo
+priority: high
+```
+
+## Task: Kaizen metrics emission per run
+
+After each run, write `.kaizen/metrics` records in the target repo
+(tokens, duration, ok/failed, commit) so the kaizen optimization loop
+observes harness-run agents. Follow kaizen-agentic's metrics conventions
+(ADR-004).
+
+```task
+id: HARNESS-WP-0001-T04
+status: todo
+priority: medium
+```
+
+## Task: Budget enforcement
+
+Wire llm-connect's BudgetTracker to the manifest `budget` field; refuse
+or truncate runs over budget and report the event to the hub (token
+events feed the Token Cost dashboard).
+
+```task
+id: HARNESS-WP-0001-T05
+status: todo
+priority: medium
+```
+
+## Task: Railiance deployment
+
+Package (container per llm-connect/activity-core conventions) and deploy
+one harness instance on Railiance. Gated on founder Red-lane secret
+provisioning (binky-control `integrations/executor-worker-secrets.md`
+Lanes 2–3). Verify the sandbox smoke task end-to-end remotely; hub via
+:18000 bridge.
+
+```task
+id: HARNESS-WP-0001-T06
+status: todo
+priority: high
+```
+
+## Task: Tenant #1 onboarding — binky-control
+
+Commit binky-control's instance manifest (daily rhythm, weekly mail
+intake, weekly review prep on the T01 schema), run the three definitions
+through the deployed harness, then hand off to BINKY-WP-0004-T06 for the
+cron-bridge cutover.
+
+```task
+id: HARNESS-WP-0001-T07
+status: todo
+priority: medium
+```