git:20260919.917dbb0 to git:20260923.097bdb0

1 added, 1 removed. Audit A to A.

---

name: architecture-viewer

- description: Open or update an architecture diagram with the selected builtin or custom viewer, and preserve a neutral session handoff. Use when the user asks to inspect architecture interactively or continue an existing diagram session.

+ description: Open or update an architecture diagram with the selected builtin or custom viewer, preserving a neutral session handoff. Use when asked to inspect architecture interactively or continue an existing diagram session.

---

# Architecture viewer

1. Inspect selection with harness integrations show architecture-viewer --json. Use an explicit

invocation override only when requested. Report unavailable implementations; never silently

change the selection or install an alternative.

2. Run harness integrations doctor architecture-viewer to obtain the selected adapter's actual

capabilities. Missing required capabilities are errors, not evidence that a different viewer

was selected.

3. Prepare an authorized immutable snapshot. For the upstream adapter use architecture-diagram

profile 1, an explicit project root, optional source/metrics roots, and the SHA-256 of the exact

profile bytes. Keep the profile and roots inside that project unless the user pre-authorized an

additional adapter root. Preserve missing observations; report projection omissions.

4. Validate with harness viewer validate --input INPUT_JSON, then invoke harness viewer open

--input INPUT_JSON. Record the returned session_reference, adapter, document identity,

revision, digest, actual capabilities and mapping/evidence paths.

5. For an update, query harness viewer status --session REFERENCE, prepare a new immutable input,

then use harness viewer replace-document --session REFERENCE --input REPLACEMENT_JSON

--request-id REQUEST_UUID. Include the observed expected_revision. Only an acknowledged

successful result means the viewer accepted the document.

6. Preserve the request ID when inspecting uncertain outcomes. A timeout is not cancellation.

Conflicts, stale epochs, expired claims and indeterminate generation require explicit

reconciliation; do not automatically reopen or replay source-changing work.

7. A regeneration request belongs to the current authorized workflow owner. Claim it only with

the configured consumer identity and required capability, capture source identity, run the

normal source-change gates, and publish with the claimed revision. Selection and viewing do

not authorize edits. A detached viewer remains useful for viewing.

8. Put session and evidence references in the shared task handoff. Continue using the pinned

session across runtimes, establishing native permissions anew. Close with harness viewer

close --session REFERENCE when the user is finished.

The complete configuration, adapter envelope, profile mapping and limitations are documented in

docs/viewer-integrations.md in the harness checkout. Runtime bindings share this procedure;

viewer selection is independent of model/provider selection.