Summary

Vendor browser-use/browser-harness@216a2c9 into packages/bcode-browser/harness/. Add harness-sync.md runbook for future updates. Pair-rename SYNC.md → opencode-sync.md.

This is ROADMAP A2 — the harness is now in-tree. After this lands we have both the code and the maintenance protocol for it; we are "initialized" for harness work.

What changed

Sync protocol files

• SYNC.md → opencode-sync.md (rename only, no content change)
• harness-sync.md (new) — file-by-file copy workflow, deliberately no git subtree (decided in thread: subtree adds tech debt for a small file set we expect to diverge)
• UPSTREAM.md — consolidated all harness tracking into one doc:
  • Cross-refs to both runbooks
  • §2 harness sync log gets its first real row (216a2c9)
  • §3 (new) Harness divergences table + path-allowlist policy (helpers.py editable; daemon.py/admin.py protected)
  • Drops the separate PROVENANCE.md — single source of truth
  • Fixed two stale scripts/check-upstream.sh refs (correct path is script/check-upstream.sh)

Vendored harness

• packages/bcode-browser/harness/ populated verbatim from upstream 216a2c9
• 4 Python modules (~1.2k lines): run.py, daemon.py, helpers.py, admin.py
• 17 interaction-skills, 66+ domain-skills (markdown)
• pyproject.toml, LICENSE, README.md, SKILL.md, install.md, .env.example, test_js.py, test_run.py

Bcode-browser package wiring

• packages/bcode-browser/README.md — drop PROVENANCE ref, point at root UPSTREAM.md
• packages/bcode-browser/src/index.ts — comment update
• packages/bcode-browser/harness/PROVENANCE.md — removed (collapsed into UPSTREAM.md §3)

Divergences (initial)

No other deliberate deltas yet. Future BrowserCode-specific edits to helpers.py (screenshot-attachment hook, etc.) will land in subsequent PRs and append rows to this table.

Verification

• Smoke test (from packages/bcode-browser/harness/): uv run python -c 'import run, helpers, daemon, admin; print("imports ok")' → imports ok. All deps resolve, package builds, modules import.
• harness git remote added locally (one-line; not committed — remotes are per-clone).
• script/check-upstream.sh works with both upstreams now that the harness table has a real SHA.

Out of scope (next PRs)

• A3 (Python bootstrap on first bcode run)
• A4 (browser_execute tool implementation)
• Any modifications to helpers.py for BrowserCode integration