@deeeed/metamask-harness 0.71.0 → 0.73.0

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 ## Unreleased
 
+## 0.73.0 - 2026-10-03
+
+### Changed
+
+- Recipe discovery runs on `@farmslot/recipe-cli`: `run --list` and recipe completion candidates use its readiness rule, and `run --describe` and recipe assistance use its call-graph composition. mm-harness still supplies the view and the policy: only the requested adapter's libraries are loaded, and readiness is judged against the MetaMask manifest `run` executes, so a broken recipe for another platform no longer matters and team manifests follow the same rules as `run --plan`. Flags and output are unchanged; the discovery goldens prove it.
+- Move to the Farmslot release that ships `@farmslot/recipe-cli`: `@farmslot/protocol` 0.34.0, `@farmslot/recipe-harness` 0.22.1, `@farmslot/recipe-cli` 0.1.1, `@farmslot/agent-runtime` 0.16.0 and `@farmslot/expo-recipe` 0.13.1, all on one protocol and one recipe-harness copy. With recipe-harness 0.22, a library's `recipes/terminal/` folder counts as the terminal variant of its plain ids, so `run --list --adapter terminal` with the terminal library also lists `perps.manage-position` and its siblings; the `terminal.perps.*` ids are unchanged.
+
+## 0.72.0 - 2026-10-03
+
+### Added
+
+- Freeze the CLI contract the farms, gateway, and recipe libraries depend on: `docs/cli-contract.md` inventories each caller's commands, flags, and parsed outputs, and `yarn test:goldens [--update]` compares `--json` envelopes, exit codes, and runtime layouts against checked-in goldens (also run in the contract CI shards).
+- `MM_HARNESS_MOBILE_VERIFY_PROBE_TIMEOUT_MS` shortens Mobile verify's wait for the React Native debug target (default unchanged at 60 s), so hermetic tests with no Metro do not wait out the probe.
+
 ## 0.71.0 - 2026-10-02
 
 ### Added

package/dist/adapters/mobile/verify.js

@@ -12,7 +12,11 @@ const AUTO_START_TRUE = ["1", "true", "TRUE", "True", "yes", "YES", "Yes", "on",
 const AUTO_START_FALSE = ["0", "false", "FALSE", "False", "no", "NO", "No", "off", "OFF", "Off", ""];
 const AUTO_START_REFUSAL = "Mobile auto-start is not allowed from product-local scripts. Start or prepare the app through the runner/slot runtime, then rerun verify with --no-auto-start.";
 const EVM_READINESS_EXPRESSION = "(async function(){try{var engine=globalThis.Engine;var controller=engine&&engine.context&&engine.context.NetworkController;if(!controller||typeof controller.getSelectedNetworkClient!=='function')throw new Error('NetworkController selected client is unavailable');var client=controller.getSelectedNetworkClient();if(!client||!client.provider||typeof client.provider.request!=='function')throw new Error('selected EVM provider is unavailable');var result=await client.provider.request({method:'eth_blockNumber'});if(typeof result!=='string'||!/^0x[0-9a-f]+$/i.test(result))throw new Error('eth_blockNumber returned an invalid result');return {ok:true,result:result};}catch(error){return {ok:false,error:error&&(error.message||String(error))};}})()";
-const LIVE_SMOKE_RECIPE = `{
+function liveSmokeProbeTimeoutMs(env = process.env) {
+  const value = Number(env.MM_HARNESS_MOBILE_VERIFY_PROBE_TIMEOUT_MS);
+  return Number.isInteger(value) && value > 0 ? value : 6e4;
+}
+const liveSmokeRecipeText = (timeoutMs) => `{
   "$schema": "https://farmslot.io/schemas/recipe-v1.schema.json",
   "title": "Mobile v1 runner live bridge smoke",
   "description": "Verifies the installed MetaMask runner can read the React Native debug bridge without mutating wallet state.",
@@ -20,7 +24,7 @@ const LIVE_SMOKE_RECIPE = `{
     "entry": "status",
     "nodes": {
       "status": { "action": "app.status", "intent": "Read Mobile app status through the v1 runner", "next": "cdp-probe" },
-      "cdp-probe": { "action": "cdp.target", "intent": "Verify the React Native debug bridge target is reachable", "require_reachable": true, "timeout_ms": 60000, "cdp_timeout_ms": 60000, "next": "done" },
+      "cdp-probe": { "action": "cdp.target", "intent": "Verify the React Native debug bridge target is reachable", "require_reachable": true, "timeout_ms": ${timeoutMs}, "cdp_timeout_ms": ${timeoutMs}, "next": "done" },
       "done": { "action": "end", "status": "pass" }
     }
   }
@@ -386,7 +390,7 @@ async function runMobileVerify(argv, io = defaultIo) {
       }
     }
     const liveSmokeRecipe = path.join(artifacts, "mobile-v1-live-smoke.recipe.json");
-    fs.writeFileSync(liveSmokeRecipe, LIVE_SMOKE_RECIPE);
+    fs.writeFileSync(liveSmokeRecipe, liveSmokeRecipeText(liveSmokeProbeTimeoutMs()));
     const iosSimulatorResolved = resolveJsEnvValue(target, "IOS_SIMULATOR");
     const adbSerialResolved = resolveJsEnvValue(target, "ADB_SERIAL");
     let liveSmokeCode = 1;
@@ -495,6 +499,7 @@ export {
   buildMobileVerifySummary,
   classifyMobileRuntimeOwner,
   isNumericWatcherPort,
+  liveSmokeProbeTimeoutMs,
   parseMobileVerifyArgs,
   resolveJsEnvValue,
   resolveWatcherPort,

package/dist/commands/run-engine.js

@@ -30,6 +30,8 @@ import {
   validateMetaMaskActionInputs
 } from "../metamask-action-validation.js";
 import { gitLibraryProvenance } from "../library-provenance.js";
+import { runnableLibraryRecipes } from "../discovery.js";
+import { recipeComposition } from "@farmslot/recipe-cli";
 import {
   captureExecutionProvenance,
   executionProvenanceDrift,
@@ -710,35 +712,7 @@ function effectiveLibrarySources(librarySources) {
   return librarySources && librarySources.length > 0 ? librarySources : [{ name: "metamask", root: path.resolve(runnerDir, "library") }];
 }
 async function listRunnableRecipes(adapter, librarySources) {
-  const harness = await importRecipeHarness();
-  const sources = effectiveLibrarySources(librarySources);
-  const resolution = await harness.loadRecipeLibraries(
-    sources,
-    {
-      adapter
-    }
-  );
-  const protocol = await importRecipeProtocol();
-  const { manifest } = await resolveActionManifest(adapter, void 0, sources);
-  const externalRecipeIds = new Set(resolution.recipes.keys());
-  const validRefs = new Set([...resolution.recipes.values()].filter((recipe) => protocol.validateRecipeWithManifest(recipe.document, manifest, {
-    externalRecipeIds
-  }).status === "valid").map((recipe) => recipe.ref));
-  return [...resolution.recipes.values()].filter((recipe) => {
-    if (!validRefs.has(recipe.ref)) return false;
-    try {
-      const dependencies = harness.resolveRecipeDependencies({
-        rootRef: recipe.ref,
-        root: recipe.document,
-        rootSource: recipe.provenance,
-        recipes: resolution.recipes
-      });
-      return [...dependencies.recipes.keys()].every((ref) => validRefs.has(ref));
-    } catch (error) {
-      if (error instanceof harness.RecipeResolutionError) return false;
-      throw error;
-    }
-  }).map(
+  return (await runnableLibraryRecipes(adapter, effectiveLibrarySources(librarySources))).map(
     (recipe) => recipeSummary(recipe.ref, adapter, recipe.document, recipe)
   ).sort((left, right) => left.name.localeCompare(right.name));
 }
@@ -822,42 +796,6 @@ function recipeParameters(document) {
     };
   });
 }
-function recipeComposition(recipe, recipes) {
-  const actions = /* @__PURE__ */ new Set();
-  const nestedRecipes = /* @__PURE__ */ new Set();
-  const unresolvedRecipes = /* @__PURE__ */ new Set();
-  const visitedRecipes = /* @__PURE__ */ new Set();
-  const visitNode = (value) => {
-    if (!isRecord(value) || typeof value.action !== "string") return;
-    if (value.action !== "call") {
-      actions.add(value.action);
-      return;
-    }
-    if (typeof value.ref !== "string") return;
-    nestedRecipes.add(value.ref);
-    const dependency = recipes.get(value.ref);
-    if (!dependency) {
-      unresolvedRecipes.add(value.ref);
-      return;
-    }
-    if (visitedRecipes.has(value.ref)) return;
-    visitedRecipes.add(value.ref);
-    visitRecipe(dependency.document);
-  };
-  const visitWorkflow = (value) => {
-    if (!isRecord(value)) return;
-    if (isRecord(value.nodes)) Object.values(value.nodes).forEach(visitNode);
-  };
-  const visitRecipe = (document) => {
-    visitWorkflow(document.workflow);
-  };
-  visitRecipe(recipe);
-  return {
-    actions: [...actions].sort(),
-    nestedRecipes: [...nestedRecipes].sort(),
-    unresolvedRecipes: [...unresolvedRecipes].sort()
-  };
-}
 async function validateRunRecipeStatic(recipeArg, adapter, options, params = {}) {
   let librarySources = await resolveMetaMaskLibrarySources(
     optionStrings(options, "library")
@@ -1492,7 +1430,6 @@ export {
   preflightRecipe,
   prepareHeal,
   prepareRuntimeIfNeeded,
-  recipeComposition,
   resolveMetaMaskLibrarySources,
   resolveRunRecipeArg,
   runOneNode,

package/dist/discovery.js

@@ -0,0 +1,15 @@
+import { assessRecipe } from "@farmslot/recipe-cli";
+import {
+  loadRecipeLibraries
+} from "@farmslot/recipe-harness";
+import { resolveActionManifest } from "./manifest.js";
+async function runnableLibraryRecipes(adapter, sources) {
+  const resolution = await loadRecipeLibraries(sources, { adapter });
+  const { manifest } = await resolveActionManifest(adapter, void 0, sources);
+  return [...resolution.recipes.values()].filter(
+    (recipe) => assessRecipe({ resolution, manifest }, recipe).length === 0
+  );
+}
+export {
+  runnableLibraryRecipes
+};

package/dist/recipe-assistance-context.js

@@ -4,7 +4,8 @@ import { loadRecipeLibraries, resolveRecipeDependencies, rootResolutionRef } fro
 import { isSensitiveKey } from "./command-journal.js";
 import { resolveActionManifest } from "./manifest.js";
 import { describeManifestActions } from "./commands/manifest.js";
-import { recipeComposition, resolveMetaMaskLibrarySources, validateRunRecipeStatic } from "./commands/run-engine.js";
+import { recipeComposition } from "@farmslot/recipe-cli";
+import { resolveMetaMaskLibrarySources, validateRunRecipeStatic } from "./commands/run-engine.js";
 import { CliError, isRecord, optionStrings } from "./commands/parse-args.js";
 import { EXIT } from "./commands/shared.js";
 import { MAX_ADVICE_STATE_BYTES } from "./recipe-assistance-rubric.js";

package/docs/CONTRIBUTING.md

@@ -12,6 +12,7 @@ bin/mm-harness
   -> src/                         typed CLI and product decisions
   -> @farmslot/agent-runtime     checklist state
   -> @farmslot/handoff           scrubbed learning capture/share
+  -> @farmslot/recipe-cli        recipe discovery: libraries, runnable checks, composition
   -> @farmslot/recipe-harness    generic execution, UI transports, evidence
   -> @farmslot/protocol          schemas
   -> adapters/                   focused host/browser/device leaves
@@ -24,6 +25,7 @@ bin/mm-harness
 | `@farmslot/protocol` | recipe and evidence schemas |
 | `@farmslot/agent-runtime` | task-local checklist state and terminal contracts |
 | `@farmslot/handoff` | learning assembly, scrubbing, validation, approval, and publication |
+| `@farmslot/recipe-cli` | recipe discovery: library resolution, runnable checks, composition |
 | `@farmslot/recipe-harness` | generic execution, recovery, traces, artifacts, `ui.*` |
 | `mm-harness` | MetaMask runtime control, diagnostics, durable domain actions |
 | skills/checklists | task workflow and proof expectations |

package/docs/cli-contract.md

@@ -0,0 +1,163 @@
+# mm-harness CLI contract
+
+This page lists every `mm-harness` invocation that something outside this repo depends on, and what that caller reads back. The golden tests in `tests/contract/goldens-*.test.sh` freeze this surface. A refactor that changes any of it fails CI until someone accepts the change with `yarn test:goldens --update` and updates the callers in the same release.
+
+Callers scanned (2026-10-02):
+- Farmslot projects `metamask-{extension,mobile,core}-farm` and `va-mmcx-terminal-farm`: `project.json` hooks, `setup/*.sh`, `scripts/*.sh`, worker templates.
+- Farmslot gateway: `services/gateway/src/methods/recipe.ts` and the modules it calls.
+- Recipe libraries: `experimental-metamask-recipe-perps` and `experimental-metamask-recipe-terminal` (`checks/*.mjs`).
+- This repo's README and `docs/`.
+
+## Resolution and environment
+
+- Farms resolve the binary with `HARNESS_BIN="${METAMASK_HARNESS_BIN:-${MM_HARNESS_BIN:-mm-harness}}"; command -v "$HARNESS_BIN"`. `MM_HARNESS_BIN` hands the whole invocation to another checkout's `bin/mm-harness`.
+- Static review runs `{{support}}/bin/mm-harness` with entry `dist/mm-harness-cli.js`, so the package layout (`bin/`, `dist/`) is part of the contract.
+- Hook environment: `RECIPE_SLOT_ID`, `RECIPE_RUNTIME_DIR` (default `temp/recipe/runtime`), `RECIPE_WALLET_FIXTURE`, `RECIPE_LIBRARY_PATH`, `MM_HARNESS_DOMAIN`, `IOS_SIMULATOR`/`ADB_SERIAL` (mobile slots), `RECIPE_HARNESS_ROOT=temp/recipe/harness` (Extension).
+
+## Commands, callers, and what they consume
+
+`G:` names the golden that freezes the row (`tests/contract/goldens/<family>/<case>.json`).
+
+### Recipe execution (gateway `recipe.ts`, worker templates, library checks)
+
+| Command | Caller | Consumes | G: |
+|---|---|---|---|
+| `run <recipe> --adapter <a> --artifacts-dir <d> --target <repo> [--slot <s>] --json [--cdp-port <p>] [--watcher-port <p>] [--launch-existing-dist] [--record-video=full-run]` | `recipe_run` hook, all four packs | exit code, then the artifact package (below) | `core/run-hook`, `extension/run-hook`, `extension/run-hook-plan` (all flags incl. `--record-video=full-run`), `mobile/run-hook`, `mobile/run-hook-plan`, `core/run-invalid`, `*/run-unknown-flag` |
+| `run <recipe> --artifacts-dir <d> --json` from the checkout | Core templates | exit code; `trace.json` on failure | `core/run-autodetect` |
+| `run <recipe> [k=v…] --plan [--adapter <a>] [--library ns=dir] [--json]`, with `RECIPE_LIBRARY_PATH=ns=dir` or cleared | templates; perps `checks/*.mjs` | exit code; `JSON.parse(stdout).status === 'pass'`; on rejection stdout+stderr matching `RECIPE_PARAMS_INVALID\|parameter\|required\|enum`. No harness code emits `RECIPE_PARAMS_INVALID`: plan rejections exit 5 with findings `recipe.missing_param` / `recipe.invalid_param_value_enum` / unknown-param, and a real run exits 5 with `RECIPE_VALIDATION_FAILED`. The check passes on the `parameter\|required\|enum` alternatives | `core/run-plan`, `mobile/run-plan`, `library/*` |
+| `run --list [--adapter <a>] [--json]`, `run <r> --describe --json` | templates, docs | prose | `discovery/run-list-*`, `discovery/run-describe` |
+| `call <action> [k=v…] --adapter <a> [--target] [--watcher-port] [--json]` | mobile `unlock` hook, templates | exit code (unlock output is ignored) | `core/call-command`, `mobile/call-unlock` |
+| `actions --raw --adapter <a> --json` | `recipe_action_manifest` hook, all packs | stdout is a Recipe v1 action manifest (`validateRecipeActionManifestDocument`) | `discovery/actions-raw-*` |
+| `actions --adapter <a> --json` | templates (Core runs `jq -r '.actions[].name'`) | `.actions[].name` | `discovery/actions-*` |
+| `actions --action <name> --json`, `actions <term> --json` | templates, docs | prose | `discovery/actions-action`, `discovery/actions-search` |
+
+### Readiness (preflight, health_check, recipe_doctor)
+
+| Command | Caller | Consumes | G: |
+|---|---|---|---|
+| `doctor --adapter <a> --target <repo> [--cdp-port\|--watcher-port <p>] --json` | `recipe_doctor` hook | `runner_protocol_version === 1`, `status === 'pass'`, every `checks[].status === 'pass'` | `*/doctor-json` |
+| `doctor --adapter <a> --target <repo> [--cdp-port\|--watcher-port <p>] [--runtime-dir <rd>] [--device <d>] --print-ready` | `health_check` (gateway `slot/check.ts`, `2>/dev/null`) | exit 0 and trimmed stdout equal to `OK` (Extension, Mobile) or `ready` (Core) | `*/doctor-print-ready`, `mobile/doctor-print-ready-device` |
+| `doctor … --expect-live [--json]` | Extension `ensure-runtime-ready.sh`, `preflight.sh`; templates | exit code; JSON shown to the agent | `extension/doctor-expect-live-json`, `mobile/doctor-expect-live-json` |
+| `prepare --target <repo> --platform <extension\|mobile\|core> --artifacts-dir <repo>/<rd> --json` | preflight (all packs, stdout to `/dev/null`) | exit code; gateway reads `<rd>/sandbox.json`: `schemaVersion === 1`, `steps[]` (`id`, `status`, `reason`), `ready`, `harness.name`, `harness.version` | `*/prepare` |
+| `install --adapter <a> --target <repo>` | `recipe_harness_install`, Core preflight | exit code | `*/install` |
+| `verify --adapter <a> --target <repo> [--json]` | `recipe_harness_verify`, Core preflight | exit code (JSON not parsed) | `core/verify`, `mobile/verify` |
+| `cleanup --adapter <a> --target <repo>` | `recipe_harness_cleanup`, Extension recycle | exit code | `*/cleanup` |
+
+### Runtime lifecycle
+
+| Command | Caller | Consumes | G: |
+|---|---|---|---|
+| `launch --verify --adapter extension --target <repo> --watcher-port <p> --cdp-port <p> --surface <fullscreen\|sidepanel> [--build] [--url <u>]` | Extension `preflight.sh` | exit code | `extension/launch-verify` |
+| `launch --adapter extension --target --cdp-port (--fullscreen \| --sidepanel --url <u>) [--verify] [--build] [--remote-flag K=V] [--json]` | Extension browser resource boot hook and slot actions | exit code | `extension/launch-boot-fullscreen`, `extension/launch-sidepanel-url`, `extension/launch-verify-remote-flag`, `extension/launch-build-verify` (cold, through the stubbed browser/build leaf; `live-calls.log` frozen) |
+| `launch <ios\|android> --adapter mobile --target <repo> --verify --json --watcher-port <p> [--build] [--device <d>]` | Mobile `preflight.sh` | exit code; stdout saved to `<rd>/mobile-launch/summary.json` (not parsed) | `mobile-launch/launch-ios-verify`, `mobile-launch/launch-ios-device-verify`, `mobile-launch/launch-android-device-verify` (`leaf-calls.log` frozen) |
+| `stop --adapter <extension\|mobile> --port <p> --target <repo>` | teardown, recycle, shutdown hooks | exit code | `extension/stop`, `mobile/stop` |
+| `fixtures set --adapter extension --target <repo> --fixture <rd>/wallet-fixture.json` | Extension preflight | exit code | `extension/fixtures-set-no-browser` |
+| `fixtures set --adapter mobile --target <repo> --json` | Mobile preflight | exit code; stdout saved to `<rd>/mobile-launch/wallet-setup.json` | `mobile/fixtures-set` |
+| `fixtures generate --target <repo> --fixture <rd>/wallet-fixture.json --out <rd>/fixture-state.json` | Extension `launch-browser.sh` | reads `fixture-state.json` | `extension/fixtures-generate` |
+| `<repo>/temp/recipe/harness/extension/runner/bin/mm-harness resolve-extension --adapter extension --target <repo>` (overlay path, not the public bin) | Extension `setup/launch-browser.sh:53,449` | stdout must match `/^[a-p]{32}$/`; failure falls back to scanning | `extension/resolve-extension-overlay` |
+| `provision runway <ios\|android> --adapter mobile --target --slot --watcher-port --runtime-dir --run <id> [--device] [--force]` | Mobile `runway-preflight.sh` | exit code (non-zero falls back) | `mobile/provision-runway-android` (ios needs `gh` + network: not covered) |
+
+### Task tooling (gateway and worker templates)
+
+| Command | Caller | Consumes | G: |
+|---|---|---|---|
+| `checklist mark <taskDir> {start\|<n>\|complete [--mark-last]\|blocked --reason <s>\|no-change --reason <s>\|--help}` | `{{TASK_DIR}}/mark` shim (`mark_cmd`) | exit code; `SIGNAL.json`, `CHECKLIST.md` | `task/mark-*` |
+| `pr-body render <taskDir> --json` (cwd = task dir) | gateway `pr-body-render.ts` (`pr_body_cmd`) | on failure `JSON.parse(stdout).error`, else stderr; then `artifacts/pr-body.md` | `task/pr-body-render-*` |
+| `review checklist --out <file> [--domain <d>] [--since <sha>]` | domain fixtures, review templates | the written file | `task/review-checklist` |
+| `check diff …`, `recipe-quality build …` | templates | exit code | not covered: run repo lint/test tooling |
+
+### Discovery (moves to Farmslot in phase 2a)
+
+`--help`, `--version`, `help [review] --json`, `actions` (above), `run --list`, `call --list`, `completion-candidates actions`, `execution-template {new,list,materialize} --json`, `completions {zsh,bash}`, and the unknown-command error. G: `discovery/*`.
+
+## Files callers read
+
+- **Recipe artifacts dir** (`--artifacts-dir`): `summary.json` (`.status`), `trace.json`, `artifact-manifest.json` (`.runStatus` equals `summary.status`; Recipe v1), optional `recipe.json`, `recipe-resolution.json` with `resolved-recipes/<sha256>.recipe.json`, and videos when `--record-video=full-run`. Frozen with full normalised values (`valueTrees`) for passing runs in `core/run-hook`, `core/run-autodetect`, `core/call-command` and `library/run-library-recipe`. `extension/run-hook` and `mobile/run-hook` run cold with no runtime, so they freeze the failure envelope and exit code, and their artifact tree is `null` (nothing is written). A passing Extension or Mobile artifact package needs a live runtime and is not covered.
+- **`<rd>/sandbox.json`** from `prepare`: frozen in full by `*/prepare`.
+- **Pid files and logs** under `<rd>`: `browser.pid`, `recipe-harness-webpack.pid`, `recipe-harness-webpack.log` (Extension); `metro.log` (Mobile); the gateway kills `launcher.pid`, `browser.pid`, `chromium.pid`, `webpack.pid` and deletes `extension.id` and `preflight.pgid`. Live-runtime only, so not covered by the cold-path goldens.
+- **`<rd>/fixture-state.json`** from `fixtures generate`: `extension/fixtures-generate`.
+- **Task artifacts**: `SIGNAL.json`, `artifacts/pr-body.md`, review checklist file.
+
+## Callers that are out of contract today
+
+These are real farm bugs. The goldens freeze the current rejections, so fixing either side shows up as a reviewed golden change. The farm fixes go in a separate Farmslot PR.
+
+| Caller | Today | Correct call | G: |
+|---|---|---|---|
+| Mobile `scripts/cleanup-recipe-harness.sh:30` (`recipe_harness_cleanup`) | `cleanup … --allow-managed-changes` exits 2 (`CLI_UNKNOWN_OPTION`); its `No mobile harness backup found` fallback never matches, so the hook always fails | `cleanup --adapter mobile --target <repo>` | `mobile/cleanup-allow-managed-changes`, `mobile/cleanup` |
+| Mobile `project.json` `unlock` hook | `call app.unlock` exits 2 (unknown action); the gateway ignores the result, so unlock is a silent no-op | `call metamask.wallet.ensure_unlocked --adapter mobile --target <repo> --watcher-port <p>` | `mobile/call-unlock` |
+| Mobile `scripts/runway-preflight.sh:66` | `provision runway android` exits 2 (only `ios`), so the Android runway profile always falls back | add Android runway to the harness, or have the farm reject Android before calling | `mobile/provision-runway-android` |
+| Mobile templates `dev.md`, `dev-interactive.md`, `fix-bug.md`, `review-pr.md` | `mark complete --status blocked --outcome partial --reason …` exits 2 | `mark blocked --reason "<why>"` | `task/mark-invalid-status-outcome`, `task/mark-blocked` |
+| Docs | `launch --build-lavamoat` (only `runtime-launch` has it); `run --target <recipe-file>` | `runtime-launch --build-lavamoat`; `run <recipe-file> --target <repo>` | — |
+
+## Terminal adapter: TODO
+
+#298 merged the `terminal` adapter (`fd1c77e`). Discovery already reflects it (`discovery/actions-matrix`, the adapter hint in `help`). **Follow-up, not in this PR:** freeze its farm hooks once a stub browser replaces the LaunchServices launch of a visible Chrome for Testing (the goldens must never start a real browser). Add `tests/contract/goldens-terminal.test.sh` covering the `va-mmcx-terminal-farm` hooks:
+
+- [ ] `run <recipe> --adapter terminal --artifacts-dir <d> --target <repo> --slot <s> --cdp-port <p> --watcher-port <p> --json`
+- [ ] `actions --raw --adapter terminal --json`
+- [ ] `doctor --adapter terminal --target <repo> --cdp-port <p> --watcher-port <p> --json`
+- [ ] `install --adapter terminal --target <repo>`
+- [ ] `verify --adapter terminal --target <repo> -- --cdp-port <p> --watcher-port <p> --account <a>`
+- [ ] `cleanup --adapter terminal --target <repo> -- --cdp-port <p>`
+- [ ] `launch --adapter terminal --target <repo> --cdp-port <p> --watcher-port <p> --signer extension --account <a>` (use the stub browser from #298's `tests/fixtures/terminal-stub-browser.mjs`)
+- [ ] `stop --adapter terminal --target <repo>` with `RECIPE_CDP_PORT`
+- [ ] `run terminal.perps.<name> k=v… --adapter terminal --target <t> --cdp-port <p> --watcher-port <p> --plan` (recipe-terminal `checks/plan-recipes.mjs`)
+- [ ] runtime layout of `temp/recipe/runtime/terminal/` (`browser.pid` is watched by the farm)
+- [ ] discovery: add `terminal` to the per-adapter loop in `goldens-discovery.test.sh` (`actions --raw`, `actions`, `run --list`, `call --list`)
+- [ ] recipe-terminal `console-guard.mjs` imports the harness's `library/actions/shared/console-findings.mjs` and `tests/fixtures/console-allowlist-vectors.json`: freeze both paths and the exported surface
+
+## Running the goldens
+
+```bash
+yarn test:goldens               # compare all families in parallel (CI runs them in the contract shards)
+yarn test:goldens mobile        # families whose name contains "mobile"
+yarn test:goldens --update      # rewrite goldens, print a per-field diff summary, drop orphans
+```
+
+Every family checks its own golden directory: a golden no case writes fails the family, in CI too (`--update` deletes it). Every family also fails on a golden directory that has no `goldens-<dir>.test.sh`, so deleting a whole family script is caught. Families run in parallel locally and sequentially inside the contract CI shards.
+
+Each case runs under a safety cap, `GOLDENS_CASE_TIMEOUT` (default 600 s). A case that hits it reports `TIMEOUT <case>` and fails without being compared or written, so `--update` can never accept a truncated capture.
+
+Each family is a normal contract test (`tests/contract/goldens-<family>.test.sh`). `gd_init` (`tests/contract/goldens/lib.sh`) builds a sandbox on `ct_init`, and every case runs under `env -i`:
+- `gd_init` first unsets every inherited `MM_HARNESS_*`, `RECIPE_*`, `METAMASK_*` and `FARMSLOT_*` variable, plus device and port pins (`IOS_SIMULATOR`, `ADB_SERIAL`, `WATCHER_PORT`, `METRO_PORT`, `CDP_PORT`, `IDB_PATH`, `ANDROID_HOME`, …). A developer's `MM_HARNESS_BIN` or `MM_HARNESS_IDB_PATH` export therefore cannot redirect a case;
+- the environment is an allowlist: sandbox `HOME`, caches, config, `FARMSLOT_HOME`, `TZ=UTC`, no update probe, and only the variables the family sets itself;
+- every interpreter and tool the goldens launch is resolved to its real binary before `HOME` moves into the sandbox: `node` (`process.execPath`), `git` (`git --exec-path`), `bash` (`$BASH`) and `timeout`. The goldens need no Python. A tool that resolves to a script, the shape of an asdf/mise/volta/pyenv shim, fails the family up front with a message naming it. Each is checked to run with a sandboxed `HOME`;
+- `PATH` is pinned to the case stubs, the sandbox stubs, those real binaries, and `/usr/bin:/bin:/usr/sbin:/sbin`. Host tools (`idb`, `capture-helper`, a developer's Chrome) cannot change a golden;
+- device-tool discovery is pinned: `MM_HARNESS_IDB_PATH` and `MM_HARNESS_ADB_PATH` point at sandbox stubs, which discovery checks before any absolute Homebrew or pipx path;
+- localhost probes cannot reach a real server. `gd_reserve_ports` runs a Node port holder (`tests/contract/goldens/port-holder.mjs`) that holds ephemeral ports on `127.0.0.1` and `::1` and resets every connection it accepts, so Metro `/status` and CDP probes never get a response and nothing real can take the port mid-run. Each family exports the farm's slot port variables (`RECIPE_CDP_PORT`, `WATCHER_PORT`, `METRO_PORT`) set to those ports, so commands without an explicit port use them too. Goldens show them as `<PORT:NAME>`, rewritten only in port positions (`*port` keys, `:<port>`, `port <n>`/`PORT=<n>`, or a string that is exactly the port), so an unrelated equal number such as a 60000 ms timeout is never rewritten;
+- `tmux`, `xcrun` and `adb` are stubbed (`ct_init`, plus one booted simulator and one Android device for Mobile);
+- forbidden stubs record any call to `open`, `osascript`, `lsappinfo`, `screencapture`, `yarn`, `npx`, `npm`, `corepack`, `gh` and Chrome/Chromium, and the family fails if one is called. A browser stub answers only `--version`, and `npm` only `root -g` (install-source detection), with a sandbox path;
+- inert stubs on the case PATH only: `lsof`, `pgrep` and `pkill` find nothing, `ps` passes per-pid queries (`-p`, the CLI identifying its own processes) and lists an empty host for table listings, and `watchman` and `caffeinate` are no-ops. `stop` cannot see or signal a real process or touch a host daemon;
+- `RECIPE_HARNESS_BROWSER` points at the sandbox Chrome stub, so browser resolution never probe-launches Chrome for Testing or reads host Chrome policy;
+- `MM_HARNESS_MOBILE_VERIFY_PROBE_TIMEOUT_MS=2000` shortens Mobile verify's live-bridge wait (default 60 s), because no fixture provides a debug target.
+
+Mobile Metro, device, bridge and wallet leaves, the Extension build/browser leaf, and the fixture-state leaf are stubbed through `MM_HARNESS_SCRIPT_BIN_*`. `leaf-calls.log` and `live-calls.log` are frozen per launch case.
+
+A golden records:
+- `bin` (only when a case runs another executable) and argv;
+- the exit code;
+- stdout (parsed JSON, or lines), and stderr when the exit code is non-zero;
+- `--file`/`--log` files in full;
+- `--tree` runtime trees: relative paths plus each JSON file's key shape, where arrays record the union of every element;
+- `--value-tree` artifact packages: relative paths plus each JSON file's normalised values;
+- `--shallow-tree` for the internal overlay: paths two levels deep, no shapes.
+
+The goldens need the harness to be a git checkout: `execution-provenance.json` `runner.head` and `libraries[0].head` are `null` outside one, which changes the artifact goldens. CI and the farm checkouts satisfy this.
+
+### Normaliser
+
+`tests/contract/goldens/normalize.mjs` is the only normaliser. It rewrites only volatile values:
+
+1. Absolute paths: the sandbox becomes `<SANDBOX>`, the repo `<REPO>`, the real `$HOME` `<HOME>`, the node binary and its prefix `<NODE>`/`<NODE_PREFIX>`, and `os.tmpdir()` `<TMP>`. Both `/var` and `/private/var` spellings are covered. Ports from `gd_reserve_ports` become `<PORT:NAME>` in port positions only: numbers under `*port` keys, and in text after `:`, `port `, `port=` or `PORT=`, or a string that is exactly the port (`^<port>$`; `60000 ms` is left alone).
+2. UUIDs become `<UUID>`. Git object ids (40 hex, or a short hex value under a `*head`/`*gitRef`/`*commit` key) become `<GIT_REF>`. ISO-8601 timestamps become `<TIMESTAMP>`, and compact stamps in names `<STAMP>`. Path-derived slot ids `local-<adapter>-<8 hex>` become `local-<adapter>-<HASH>`.
+3. The package version becomes `<HARNESS_VERSION>`. Any other `x.y.z` under a key ending in `version` becomes `<VERSION>`.
+4. Numbers under volatile keys: `*pid` becomes `<PID>`, `*port` `<PORT>`, `*At`/`*Time`/`*timestamp`/`mtime*` `<TIMESTAMP>`, and `*Ms`/`duration*`/`elapsed*` `<DURATION>`. Values inside `schema` and `examples` subtrees (static manifest content) are never rewritten.
+5. `invocationDigest` becomes `<DIGEST>`: it hashes `recipe-invocation.json`, which carries sandbox paths and timestamps and is frozen itself in normalised form. `runner.sourceFingerprint` becomes `<FINGERPRINT>`: it hashes the harness source tree, so any harness edit changes it. A `status` holding `git status --porcelain` output (provenance `runner.status` and `libraries[].status`, empty when clean) becomes `<GIT_STATUS>`. Content-only digests (recipe and dependency digests) stay frozen.
+6. Durations in text (`0.3s`, `123ms`) become `<DURATION>`.
+
+In tree listings, files whose names differ only by a volatile token collapse into one row: a count and the union of their key shapes, or the sorted list of their values in a value tree.
+
+The `--update` summary diffs objects by key. Arrays whose entries all carry a unique `id`, `name` or `path` (manifest artifacts) diff by that key, so an inserted entry reads as one addition. Lists of plain values report `+[added] -[removed]`; other arrays diff element by element.
+
+The goldens run from the source checkout, so `harness.source` reads `source-checkout/source-checkout` and `harness.executable` is `<REPO>/bin/mm-harness`. On the farm both name the installed package instead.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deeeed/metamask-harness",
-  "version": "0.71.0",
+  "version": "0.73.0",
   "type": "module",
   "bin": {
     "mm-harness": "bin/mm-harness"
@@ -12,6 +12,7 @@
     "check": "node scripts/check.mjs",
     "test:unit": "vitest run --config scripts/vitest.config.mjs",
     "test:coverage": "vitest run --coverage --config scripts/vitest.config.mjs",
+    "test:goldens": "bash scripts/test-goldens.sh",
     "qa:human": "node scripts/validate-human-outcomes.mjs",
     "site:contrast": "node scripts/site-contrast.mjs",
     "self-test": "bin/mm-harness self-test",
@@ -20,11 +21,12 @@
     "check:syntax": "find . -name '*.mjs' -print0 | xargs -0 -n1 node --check"
   },
   "dependencies": {
-    "@farmslot/agent-runtime": "0.15.1",
-    "@farmslot/expo-recipe": "0.12.2",
+    "@farmslot/agent-runtime": "0.16.0",
+    "@farmslot/expo-recipe": "0.13.1",
     "@farmslot/handoff": "^0.3.1",
-    "@farmslot/protocol": "0.33.0",
-    "@farmslot/recipe-harness": "0.21.1",
+    "@farmslot/protocol": "0.34.0",
+    "@farmslot/recipe-cli": "0.1.1",
+    "@farmslot/recipe-harness": "0.22.1",
     "agent-device": "0.19.3",
     "commander": "^12.0.0",
     "es-module-lexer": "2.3.1",