[CLAUDE] Infra: adopt AI_INFRA Harness 1/2/3 — monitor subs (roster 8->10) + wave-folder isolation + email channel (S49)

Harness 1 (Self-observability): NEW tooling-auditor (H1 tooling/docs-freshness 4-faceted) + harvest-curator (H2 harvest-integrity 5-axis) INFORM-only monitor subs, TACH BIET per anh-mandate -> roster 8->10. Wire session-start Phase 2.1.1 RE-REPORT + session-end L.b 6->7-step (H2 5-axis GATE + H1 chot + B5 wave-gom). H3 plugin/skill = gop-vai doc, 0 new agent.

Harness 2 (wave-folder isolation): hmw.js WAVE-MODE (subMdPath + tool-aware writeGuard) + .gitignore wave-*/ + agent-teams/ (B6 git-check-ignore verified) + NEW workflows/README convention. Harness 3 (email channel): broadcasts/ (6+6 folder + 13 .gitkeep + _index + inbox/README, committed) + send/check-email cmd (self=se) + adap-apply base-path fix outbox/all/.

HMW-mode ON: recon fan-out 4 read-only agent -> em main single-writer WRITE -> reviewer PASS all 3. Containment: git-diff 1 benign self-MEMORY + chunk-count 2414=2414 (0 RAG-write). Nac executed-file, verified-runtime PENDING CLI restart. 3 adap-reports + session log. Test 181 unchanged (no product code). CI runs (hmw.js/.gitignore/.gitkeep not path-ignored) but no bundle/migration change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/commands/adap-apply.md

@@ -11,7 +11,7 @@ argument-hint: <id | all-pending>
 **ID/topic:** $ARGUMENTS
 
 ## Flow (lead sister)
-1. **Đọc outbox AI_INFRA:** `D:\Dropbox\CONG_VIEC\AI_INFRA\broadcasts\outbox\*.md` *(base path configurable — AI_INFRA đổi path/web-migration thì sửa 1 dòng này)*. Fallback chi tiết canonical: `cross_project_search`.
+1. **Đọc outbox AI_INFRA:** `D:\Dropbox\CONG_VIEC\AI_INFRA\broadcasts\outbox\all\*.md` *(Harness 3 §8 06-07: broadcast fan-out gom vào `outbox/all/`; base path configurable — AI_INFRA đổi path/web-migration thì sửa 1 dòng này)*. Fallback chi tiết canonical: `cross_project_search`.
 2. **Filter — broadcast `targets` gồm project này (hoặc `all-fit`) VÀ chưa-applied:**
    - **Dedup key:** tồn tại `docs/governance/adap-reports/<id>.md` ⇒ ĐÃ xử → **skip**.
    - **Cold-start:** folder `adap-reports/` chưa có ⇒ **tạo folder** + coi **mọi broadcast = chưa-applied** (lần đầu).

.claude/commands/check-email.md

@@ -0,0 +1,28 @@
+---
+description: Nhận email cross-project (2-stage) qua broadcasts/ (Harness 3 §N) cho SOLUTION_ERP (self=se). Verify hash đối chứng. §J2. Adopt AI_INFRA Harness 3 (2026-06-07).
+argument-hint: <from_project | all>
+---
+# /check-email <from_project> — nhận email cross-project (Harness 3 · self=`se`)
+
+> 🔴 Kênh DUY NHẤT (§N) · **pull-copy** chỉ ghi repo MÌNH (§J2). self=`se`. Path map: xem `send-email`. Detail: AI_INFRA `broadcasts/README.md` §Harness 3.
+
+## Tham số
+- `$1` = from_project (BẮT BUỘC) ∈ 6 others, hoặc `all` = quét cả 6.
+
+## Quy trình 2-STAGE (audit qua folder)
+**STAGE 1 — Nhận (đọc → inbox root, PENDING):**
+1. Validate `$1`.
+2. READ `<from>/broadcasts/outbox/se/*.md` (message gửi cho se).
+3. Mỗi file CHƯA có trong inbox (so id): **COPY VERBATIM** → `broadcasts/inbox/<id>.md` (**root = pending**). [repo MÌNH §J2]
+4. **Verify đối chứng:** (a) **whole-file** `Get-FileHash` copy == nguồn (byte-identical = tuyến CHÍNH); (b) **body** recompute `SHA256(body)` == `content_sha256`, body canonical `(($txt -split "(?m)^---\s*$",3)[2] -replace "^\r?\n","")`. ✗ → **flag tamper, KHÔNG move**, báo anh.
+5. Log `_index.md` §INBOUND: `received · id · <from> → se · status=pending · folder=(root) · sha256(12) · verify=✓`.
+
+**STAGE 2 — Xử lý xong → archive (PROCESSED):**
+6. Sau khi xử lý → **MOVE** `inbox/<id>.md` → `inbox/<from>/<id>.md`.
+7. Update `_index.md`: `status=processed · folder=<from>`.
+
+## Audit (anh)
+`ls broadcasts/inbox/*.md` (root) = **pending chưa xử lý** (backlog hiện ngay) · `inbox/<proj>/` = **đã xử lý**.
+
+## Luật
+🔴 §N single-channel · 🔴 §J2 pull-copy chỉ-ghi-inbox-MÌNH (KHÔNG push repo bên kia) · **KHÔNG sửa** file copy (bằng chứng) · PHẢI committed · verify-hash trước move.

.claude/commands/send-email.md

@@ -0,0 +1,36 @@
+---
+description: Gửi email cross-project qua broadcasts/ (Harness 3 §N) cho SOLUTION_ERP (self=se). Ghi outbox/<to>/ repo MÌNH. §J2. Adopt AI_INFRA Harness 3 (2026-06-07).
+argument-hint: <to_project> [category] [intent...]
+---
+# /send-email <to_project> — gửi email cross-project (Harness 3 · self=`se`)
+
+> 🔴 Kênh DUY NHẤT (§N) · chỉ ghi repo MÌNH (§J2). self=`se`. Detail: AI_INFRA `broadcasts/README.md` §Harness 3 (pull `cross_project_search`).
+
+## Tham số
+- `$1` = to_project (BẮT BUỘC) ∈ 6 project ≠ `se` (self/unknown → ABORT).
+- `$2` = category ∈ `Governance·Agent·Memory·Rag·Mcp·Skill·Cmd·Coord` (default `Coord`). ✅ *infra-CC ACTIVE: `category` ≠ `Coord` + `to` ≠ `ai_infra` → auto bản-2 vào `outbox/ai_infra/` (bước 6b) để AI_INFRA giám sát infra-comms.*
+
+## Project-path map (7 project — se dùng 6 ≠ self · path-coupling, web-migration sẽ bỏ)
+| id | broadcasts root |
+|---|---|
+| ai_infra | `D:\Dropbox\CONG_VIEC\AI_INFRA\broadcasts` |
+| vipix | `D:\Dropbox\CONG_VIEC\VIPIX_MULTISITE_PROJECT\broadcasts` |
+| se | `D:\Dropbox\CONG_VIEC\SOLUTION\SOLUTION_ERP\broadcasts` (← self) |
+| dyd | `D:\Dropbox\CONG_VIEC\DAI_Y_DUOC\DH_Y_DUOC_SOURCECODE\DH_Y_DUOC\broadcasts` |
+| namgroup | `D:\Dropbox\CONG_VIEC\NAMGROUP\SOURCECODE_CÔNG_TY\NAMGROUP\broadcasts` |
+| ashico | `D:\Dropbox\CONG_VIEC\ASHICO\SOURCE_CODE_WEBSITE_ASHICO\broadcasts` |
+| bvaau | `D:\Dropbox\CONG_VIEC\BENHVIEN_A_AU\SOURCE_CODDE\broadcasts` |
+
+## Quy trình
+1. **Validate** `$1` ∈ 6 others (≠ `se`/unknown) → else ABORT.
+2. **Soạn body** markdown theo intent.
+3. **id** = `<YYYY-MM-DD>-se-to-<to>-<slug>` (unique).
+4. **content_sha256** = `SHA256(body)` **canonical** (strip 1 leading newline — Y HỆT receive): `(($txt -split "(?m)^---\s*$",3)[2] -replace "^\r?\n","")` → SHA256-UTF8.
+5. **Frontmatter:** `id · from: se · to: <to> · category · type: broadcast|update|fix|report|request|coord · date · content_sha256 · nac: sent`.
+6. **Ghi** `broadcasts/outbox/<to>/<id>.md` (**Write tool**, KHÔNG shell-write — chống mojibake). [chỉ repo MÌNH §J2]
+6b. **infra-CC** (Harness-3 §N3) — NẾU `category` ∈ {Governance·Agent·Memory·Rag·Mcp·Skill·Cmd} (≠`Coord`) VÀ `to` ≠ `ai_infra`: ghi **bản-2** `broadcasts/outbox/ai_infra/<id>-cc.md` (Write tool — repo MÌNH = §J2-safe, KHÔNG ghi inbox ai_infra) — **body + `content_sha256` Y HỆT** primary; frontmatter `id: <id>-cc · from: se · to: ai_infra · cc-of: <to> · category · type · date · content_sha256 · nac: sent`. (Đã có `outbox/ai_infra/.gitkeep`.) → AI_INFRA pull qua `/check-email se`.
+7. **Log** append `broadcasts/_index.md` §OUTBOUND (+ 1 row tag `cc` nếu có bản-2).
+8. **Báo.** KHÔNG tự relay — bên nhận tự `/check-email se`.
+
+## Luật
+🔴 §N single-channel · 🔴 §J2 chỉ-ghi-repo-mình · `from`+`to` BẮT BUỘC · id unique · folder khớp `to` · infra-CC bản-2 (category≠Coord → `outbox/ai_infra/`, ghi repo MÌNH = §J2-safe). Outward content → reviewer-gate (no-overclaim G-015) trước relay.

.claude/commands/session-end.md

@@ -1,5 +1,5 @@
 ---
-description: Đóng session SOLUTION_ERP — flush 7-agent memory, sync MD/RAG, commit + push, eval. Run cuối mỗi session.
+description: Đóng session SOLUTION_ERP — flush 10-agent memory + H2 harvest-gate (5-trục) + H1 tooling-chốt, sync MD/RAG, commit + push, eval. Run cuối mỗi session.
 ---
 
 # /session-end — Session closeout (FLUSH + WRITE + VERIFY + REPORT + COMMIT + EVAL)
@@ -28,6 +28,8 @@ Em main PHẢI echo **TOÀN BỘ nội dung command body này** (đầy đủ Ph
    - 🟪 **test-specialist** — test bundle added + coverage gap + spec drift detected
    - 🟥 **reviewer** — anti-patterns observed + Smart Friend catches + claim verification
    - 🟢 **cicd-monitor** — Run verdict + bundle hash rotate + Mig prod + corpus drift
+   - 🟫 **tooling-auditor** (monitor H1) — CHỐT tooling/docs-freshness 4-mặt + new-alloc audit (chạy ở §L.b(g))
+   - ⬜ **harvest-curator** (monitor H2) — GATE harvest-integrity 5-trục + wave-folder gom (chạy ở §L.b(d)(f))
 
 2. Synthesize cross-agent learnings → integrate vào:
    - User auto-memory `MEMORY.md` (index — append entry mới, KHÔNG rewrite)
@@ -40,13 +42,14 @@ Em main PHẢI echo **TOÀN BỘ nội dung command body này** (đầy đủ Ph
 
 **§L.a — Deterministic detect (scan action-signature, KHÔNG để AI tự-phán):** quét session theo bảng **AS-1..AS-9** trong error-ledger. Mỗi hit → 1 RCA entry blameless (5-why + fix + guard). **Bug-production = lỗi KÉP → 2 fix** (vá code **VÀ** vá guard/eval-case). List AS mở — gặp class mới thì thêm.
 
-**§L.b — 6-step auto-maintain (đủ 6, KHÔNG skip — thiếu = ledger thối):**
+**§L.b — 7-step auto-maintain (đủ 7, KHÔNG skip — thiếu = ledger thối). (d)(f) = H2 harvest-curator · (g) = H1 tooling-auditor (2026-06-07 Harness 1):**
 - **(a) summary-index** += 1 dòng/session vào `STATUS.md` Recently Done (pointer, KHÔNG full-log).
 - **(b) Active-Guards** (error-ledger): promote guard **2-strike** (episodic→procedural) · mark `verified` nếu held qua session · retire theo **net-effect** (hại>lợi → gỡ).
 - **(c) chore-flag:** agent L1 >~30KB → archive L2 · error-ledger open-entry quá ngưỡng · **0-byte memory check (AS-8)**.
-- **(d) flush agent-memory** mỗi sub đã spawn session này — **spawn-record 4-field** `{agent · task · nấc(agreed/executed/verified) · evidence}`. (0 sub spawn → "n-a".)
+- **(d) flush agent-memory** mỗi sub đã spawn session này — **spawn-record 4-field** `{agent · task · nấc(agreed/executed/verified) · evidence}`. (0 sub spawn → "n-a".) → **⬜ harvest-curator (H2) HỖ TRỢ:** spawn → propose spawn-record cho mọi sub đã chạy → em main single-writer VERIFY → APPEND (B3 no-overwrite-unverified).
 - **(e) pending-request audit:** request anh CHƯA-thực-thi đã log SPECIFICS chưa (KHÔNG placeholder).
-- **(f) harvest-integrity double-check:** verify spawn-record (d) đủ + đúng mọi sub (moved-not-cut).
+- **(f) 🌾 harvest-integrity GATE (⬜ harvest-curator H2 — 5-trục, Harness 1+2):** verify spawn-record (d) đủ+đúng mọi sub TRƯỚC khi đóng — **Coverage** (0 silent-miss) · **Completeness** (đủ 4-field) · **Placement** (delta đúng `agent-memory/X`) · **Corruption** (moved-not-cut, no-mojibake/shell-baked) · **Fidelity-FLAG** (nghi bịa/on-behalf → escalate 🟥 reviewer, KHÔNG tự phán). + **🌊 wave-folder gom (Harness 2 B5):** nếu session chạy WAVE-MODE (tồn tại `.claude/workflows/wave-*/`) → quét `sub-*.md` → consolidate APPEND `agent-memory/<role>` + verify **B6 isolation** (git-diff: sub KHÔNG ghi ra MD chính; chunk-count: 0 RAG-write). GATE = chưa đủ 5-trục thì CHƯA đóng.
+- **(g) 🔌 tooling-freshness CHỐT (🟫 tooling-auditor H1 — Harness 1):** spawn → chốt 4-mặt (skill·sub-role·plugin·docs) đổi gì session này + **new-alloc audit** (skill/plugin MỚI chưa phân-bổ → đề-xuất gán em main + sub phù-hợp vai) + flag doc-drift/roster-lệch/count-stale. Propose → em main APPEND/sửa doc (single-writer). 🔴 G-015: 2 monitor = propose-only, em main VERIFY trước APPEND (Bash residual → KHÔNG "read-only enforced").
 
 ## Phase 2 — WRITE (update MD/RAG)
 
@@ -75,7 +78,7 @@ Em main PHẢI echo **TOÀN BỘ nội dung command body này** (đầy đủ Ph
 - Phase 9 UAT mode: feature test-after (có thể skip per chunk), vẫn `npm run build` × 2 app. Nếu chỉ docs/infra → ghi "N/A".
 
 ### 3.2 Sub-agent state
-- Kiểm tra trạng thái spawn sub-agent (7-agent)
+- Kiểm tra trạng thái spawn sub-agent (10-agent — 8 product/quality + 2 monitor INFORM-only)
 - Task bất kỳ phải phân việc đầy đủ đúng vai trò split boundary (BE→backend, FE→frontend, test→test-specialist)
 
 ### 3.3 RAG + MCP state

.claude/commands/session-start.md

@@ -1,5 +1,5 @@
 ---
-description: Bootstrap session SOLUTION_ERP — load context, audit state (7-agent + RAG + tests), report plan. Run đầu mỗi session.
+description: Bootstrap session SOLUTION_ERP — load context, audit state (10-agent + RAG + tests + monitor RE-REPORT), report plan. Run đầu mỗi session.
 ---
 
 # /session-start — Session bootstrap (READ + AUDIT + REPORT)
@@ -34,15 +34,15 @@ Em main đọc `.claude/hmw-mode.on` → **BÁO ngay đầu response** (anh kh
 4. **`docs/PROJECT-MAP.md`** — bản đồ tổng quan module
 5. **`docs/changelog/migration-todos.md`** — atomic tasks theo phase (Phase 11 polish hiện tại)
 6. **`docs/workflow-contract.md`** — state machine 9 phase HĐ (base pattern cho PE/Proposal workflow V2)
-7. **`.claude/agents/README.md`** — 7-agent decision tree + skill matrix + split boundary
+7. **`.claude/agents/README.md`** — 10-agent decision tree + skill matrix + split boundary
 8. **`.claude/agent-memory/{spawned-agent}/MEMORY.md`** — L1 HOT auto-inject (Tiered Memory v1 ~30KB) + L2 `archive/` Read-on-demand + L3 RAG `search_memory` just-in-time
 9. **User auto-memory `MEMORY.md`** — auto-loaded bởi harness (index feedback_* entries)
 10. **Liên quan task hiện tại:** `docs/rules.md`, `docs/architecture.md`, `docs/gotchas.md` (55), `docs/database/schema-diagram.md`, `docs/flows/`
 
 ## Phase 2 — AUDIT (state check)
 
-### 2.1 Sub-agent state (7-agent topology)
-- Check 7 sub-agent đã spawn chưa:
+### 2.1 Sub-agent state (10-agent topology — 8 product/quality + 2 monitor INFORM-only)
+- Check 10 sub-agent đã spawn chưa:
   - 🟦 **investigator-codebase** — internal SQL/EF/grep/reference mirror audit
   - 🟦 **investigator-api** — external docs/CVE/lib/cross-project reference
   - 🟨 **implementer-backend** — .NET Domain+App+Infra+Api scaffold
@@ -50,11 +50,21 @@ Em main đọc `.claude/hmw-mode.on` → **BÁO ngay đầu response** (anh kh
   - 🟪 **test-specialist** — tests/ xUnit dedicated
   - 🟥 **reviewer** — adversarial pre-commit + live curl prod
   - 🟩 **cicd-monitor** — post-deploy Gitea + bundle hash + smoke
+  - 🟫 **tooling-auditor** (monitor H1, INFORM-only) — tooling/docs-freshness 4-mặt (skill·sub-role·plugin·docs)
+  - ⬜ **harvest-curator** (monitor H2, INFORM-only) — harvest-integrity 5-trục (Coverage/Completeness/Fidelity/Placement/Corruption)
 - Task match delegate criteria (ACCEPT) → BẮT BUỘC delegate (xem `.claude/agents/README.md` decision tree)
 - KHÔNG spawn mới khi con cũ rảnh → fresh spawn re-inject MEMORY (SendMessage N/A harness này)
 - Nạp full context project cho sub-agent spawn, giữ context sống đến cuối session
 - Em main solo CHỈ khi: schema/UX/architecture decision · cross-stack tight · bug reasoning chain · gotcha #53/#54/#55 fallback (truncate/529)
 
+### 2.1.1 Monitor RE-REPORT — H1 tooling-freshness + H2 harvest-integrity (2026-06-07 Harness 1)
+
+> Đầu session: 2 monitor sub BÁO LẠI trạng-thái + **diff vs session trước** (floor Harness 1 H1.2 + H2.2). INFORM-only — em main đọc + VERIFY→APPEND nếu có delta hợp-lệ (B3), KHÔNG sub tự sửa.
+
+- **🟫 tooling-auditor (H1):** spawn → báo tooling-state 4-mặt (skill · sub-role · plugin · docs) + **DIFF vs last-session** (THÊM/ĐỔI/XÓA/stale). Bắt drift doc-vs-thực-tế ngay đầu session (vd roster/count lệch, skill stale, plugin pending).
+- **⬜ harvest-curator (H2):** spawn → báo **harvest-MD mới** (workflow-wave / sub-agent / agent-team kể từ last) + **delta mồ-côi chưa-APPEND** + wave-folder tồn-đọng. Bắt 0-byte memory (gotcha #53) + delta chưa thu-hoạch.
+- Cơ-chế = báo-lại-diff đầu session (FORM tự do trình bày). 2 monitor spawn parallel OK. **Light session / hỏi-đáp → có thể skip; bug/feature/multi-agent/wave session → nên chạy.**
+
 ### 2.2 Skill registry (6 skill)
 - Liệt kê: `contract-workflow` · `form-engine` · `permission-matrix` · `dependency-audit-erp` · `ef-core-migration` · `iis-deploy-runbook`
 - Dùng skill khi task khớp (KHÔNG tự suy luận lại). Phân bổ per agent: xem README skill matrix.