@hmharness/evolution 0.14.7 → 0.14.10

package/dist/evolve.d.ts

@@ -95,4 +95,18 @@ export declare function runEvolution(opts: {
     presetProposals?: SkillProposal[];
     log?: (line: string) => void;
 }): Promise<EvolveReport>;
+/** Cost-regression veto (pass-by-rambling detector). Multiplicative cap
+ *  alone is a HAIR TRIGGER on microscopic outputs: a case whose expected
+ *  answer is ~4 tokens (cjk-ex-9: 等待中……) allows ~1 token of slack at
+ *  1.3x, so ANY skill that perturbs output by one character vetoes the
+ *  candidate — ten consecutive candidates died exactly there. An absolute
+ *  slack floor (+8 tokens) keeps the intent (real rambling is 2-10x) while
+ *  letting tiny-output cases tolerate needle-scale perturbation. */
+export declare function isCostRegression(base: number, cand: number, cap?: number): boolean;
+/** Dual-metric veto helper: names of cases where the candidate passed but
+ *  cost more than its baseline cap (rambling). Pure - unit-tested. */
+export declare function costRegressionNames(train: Array<{
+    name: string;
+    costCap?: number;
+}>, baseCost: Record<string, number>, candCost: Record<string, number>): string[];
 export declare function screenForPoison(text: string): string | null;

package/dist/evolve.js

@@ -231,13 +231,9 @@ export async function runEvolution(opts) {
             const regression = baseResults.some((b) => b.pass && !candResults.find((c) => c.name === b.name)?.pass);
             // dual-metric veto: a passing case that costs > cost-cap x its
             // baseline counts as a cost regression (the candidate passed by
-            // rambling) - only enforced where the case declares a cost-cap
-            const costRegressions = train.filter((c) => {
-                const cap = c.costCap ?? 1.3; // default 1.3x for all cases
-                const base = baseCost[c.name] ?? 0;
-                const cand = candCost[c.name] ?? 0;
-                return base > 0 && cand > base * cap;
-            }).map((c) => c.name);
+            // rambling); isCostRegression carries the absolute-slack floor that
+            // keeps microscopic-output cases from hair-triggering
+            const costRegressions = costRegressionNames(train, baseCost, candCost);
             const summary = (rs) => rs.map((r) => `${r.name}:${r.pass ? 'pass' : 'FAIL'}`).join(' ');
             if (regression || candRate < baseRate) {
                 await deleteDraft(home, p.name);
@@ -459,6 +455,7 @@ async function proposeSkills(provider, signals, say, ancestor, mergeWith) {
         'Your job: read session signals and decide whether any repeatable procedure is worth crystallizing into a skill.',
         'A skill is a markdown how-to document the agent reads on demand. Topics must be limited to: HarmonyOS toolchain usage (hdc/hvigorw/ohpm/DevEco), this framework\'s tools (list_dir/read_file/write_file/run_command/remember/harmony_*), and reusable task workflows observed in the signals.',
         'Rules: name is kebab-case; description is one line; skill_md is at most 60 lines with concrete steps and example commands; do NOT propose skills about security config, approval policy, or anything outside the topics; if nothing is genuinely reusable, return an empty array.',
+        'COST GATE (learned from repeated rejections): every candidate runs against an output-cost cap - a skill whose text makes the agent MORE verbose on exact-output cases (it restates, adds preambles, or explains around the answer) is auto-rejected even when correctness improves. Write TERSE imperative steps (target under 25 lines): checklists and example commands only; never instruct the agent to add explanations, context, or restatements; the skill itself must teach doing LESS talking, not more.',
         'Respond with ONLY a JSON array: [{"name":"...","description":"...","skill_md":"..."}] - no prose, no code fences.',
     ].join('\n');
     // GEPA ancestor context: vary around a past rejection (its reason is the
@@ -511,6 +508,26 @@ async function distillMemory(provider, recentNotes, say) {
         return null;
     }
 }
+/** Cost-regression veto (pass-by-rambling detector). Multiplicative cap
+ *  alone is a HAIR TRIGGER on microscopic outputs: a case whose expected
+ *  answer is ~4 tokens (cjk-ex-9: 等待中……) allows ~1 token of slack at
+ *  1.3x, so ANY skill that perturbs output by one character vetoes the
+ *  candidate — ten consecutive candidates died exactly there. An absolute
+ *  slack floor (+8 tokens) keeps the intent (real rambling is 2-10x) while
+ *  letting tiny-output cases tolerate needle-scale perturbation. */
+export function isCostRegression(base, cand, cap = 1.3) {
+    if (base <= 0)
+        return false;
+    return cand > Math.max(base * cap, base + 8);
+}
+/** Dual-metric veto helper: names of cases where the candidate passed but
+ *  cost more than its baseline cap (rambling). Pure - unit-tested. */
+export function costRegressionNames(train, baseCost, candCost) {
+    return train.filter((c) => {
+        const cap = c.costCap ?? 1.3;
+        return isCostRegression(baseCost[c.name] ?? 0, candCost[c.name] ?? 0, cap);
+    }).map((c) => c.name);
+}
 /** First balanced JSON array in the text; tolerates fences and prose around it. */
 function parseJsonArray(text) {
     const cleaned = text.replace(/```(?:json)?/g, '');

package/dist/index.d.ts

@@ -5,6 +5,7 @@ export * from './skillpayload.ts';
 export * from './dataset.ts';
 export * from './readiness.ts';
 export * from './labels.ts';
+export * from './reward-model.ts';
 export * from './insights.ts';
 export * from './skills.ts';
 export * from './bench.ts';

package/dist/index.js

@@ -5,6 +5,7 @@ export * from "./skillpayload.js";
 export * from "./dataset.js";
 export * from "./readiness.js";
 export * from "./labels.js";
+export * from "./reward-model.js";
 export * from "./insights.js";
 export * from "./skills.js";
 export * from "./bench.js";

package/dist/patches.js

@@ -105,9 +105,13 @@ export async function mergeSandbox(repoRoot, branch) {
 }
 /** Run the bench gate on the current branch. Returns pass rate (0-1) or -1 on build failure. */
 export async function sandboxBench(repoRoot, runCase, cases) {
-    // rebuild all packages (the patch may affect any layer)
+    // rebuild all packages (the patch may affect any layer). npm on Windows is
+    // a .cmd shim and modern Node refuses to execFile-spawn .cmd without a
+    // shell (CVE-2024-27980) - the sandbox build silently "failed" (and every
+    // patch reverted) on CI runners while looking fine where npm resolved to
+    // an executable. shell:true resolves the shim on win32, no-op elsewhere.
     try {
-        await execCb('npm', ['run', 'build'], { cwd: repoRoot, timeout: 120_000, windowsHide: true });
+        await execCb('npm', ['run', 'build'], { cwd: repoRoot, timeout: 120_000, windowsHide: true, ...(process.platform === 'win32' ? { shell: true } : {}) });
     }
     catch {
         return -1; // build failed = automatic reject

package/dist/readiness.js

@@ -107,8 +107,20 @@ export async function rlReadiness(home) {
         workflows: false,
     };
     try {
-        const skills = await readdir(join(home, 'skills'));
-        provenance.skills = skills.some((s) => s.endsWith('.md'));
+        // skills layout has BOTH shapes in the wild: legacy flat `skills/<name>.md`
+        // and current `skills/active/<name>/` directories (plus `skills/drafts/*.md`).
+        // A top-level-only .md check silently fails every modern install.
+        const entries = await readdir(join(home, 'skills'), { withFileTypes: true });
+        const activeDir = entries.find((e) => e.isDirectory() && e.name === 'active');
+        const draftsDir = entries.find((e) => e.isDirectory() && e.name === 'drafts');
+        const flatMd = entries.some((e) => e.isFile() && e.name.endsWith('.md'));
+        let active = 0;
+        if (activeDir)
+            active = (await readdir(join(home, 'skills', 'active'))).length;
+        let draftMd = 0;
+        if (draftsDir)
+            draftMd = (await readdir(join(home, 'skills', 'drafts'))).filter((f) => f.endsWith('.md')).length;
+        provenance.skills = flatMd || active > 0 || draftMd > 0;
     }
     catch { /* none */ }
     try {

package/dist/reward-model.d.ts

@@ -0,0 +1,62 @@
+import type { HumanLabel } from './labels.ts';
+export type { HumanLabel };
+export interface RewardFeatures {
+    /** outcome bucket: 2=ok, 1=turn-budget, 0=error */
+    outcome: number;
+    /** failed tool calls / total tool calls, 0..1 */
+    toolFailRate: number;
+    /** agent turns used, raw count */
+    turns: number;
+    /** tool calls issued, raw count */
+    toolUses: number;
+}
+export interface RewardWeights {
+    /** logistic weights over [outcome, toolFailRate, log1p(turns), log1p(toolUses), bias] */
+    w: [number, number, number, number, number];
+    trainedAt: string;
+    nSamples: number;
+    trainRmse: number;
+    /** holdout RMSE when n >= 20 (80/20 split, deterministic) */
+    holdoutRmse?: number;
+}
+/** Human label record: re-used from labels.ts (single source). */
+/** Insight record fields the model joins on. */
+export interface InsightLike {
+    session: string;
+    outcome: string;
+    turns?: number;
+    toolUses?: number;
+}
+/** Join labels with insights and map to training rows. Pure - testable. */
+export declare function trainingRows(labels: HumanLabel[], insights: InsightLike[]): Array<{
+    f: RewardFeatures;
+    y: number;
+    session: string;
+}>;
+/** Fit the reward model on joined human labels. Deterministic. */
+export declare function fitRewardModel(labels: HumanLabel[], insights: InsightLike[]): RewardWeights;
+/** Score a run's features with fitted weights -> reward in [0,1]. */
+export declare function scoreFeatures(w: RewardWeights['w'], f: RewardFeatures): number;
+/** Persistence: HMH_HOME/evolution/reward-model.json. */
+export declare function saveRewardModel(home: string, m: RewardWeights): Promise<void>;
+export declare function loadRewardModel(home: string): Promise<RewardWeights | null>;
+/** DPO preference pair for external fine-tuning. */
+export interface DpoPair {
+    prompt: string;
+    chosen: string;
+    rejected: string;
+    /** provenance for auditability */
+    chosenSession: string;
+    rejectedSession: string;
+    gap: number;
+}
+/** Build DPO pairs from joined labels + insights. Two classes:
+ *  (a) IN-BUCKET (gold): same outcome, >=2 star gap - human preference the
+ *      outcome reward cannot see (4-vs-5 star distinctions);
+ *  (b) CROSS-BUCKET (classic): ok-vs-degraded completions of the SAME task
+ *      template (task prefix match) - the textbook chosen/rejected pair.
+ *  Pure - testable. */
+export declare function exportDpoPairs(labels: HumanLabel[], insights: InsightLike[], taskOf: (session: string) => string, answerOf: (session: string) => string, opts?: {
+    minInBucketGap?: number;
+    crossBucketPrefix?: number;
+}): DpoPair[];

package/dist/reward-model.js

@@ -0,0 +1,184 @@
+/**
+ * @hmharness/evolution - reward-model (V3 RL phase, ADR-0010)
+ * A LEARNED reward model over run features, fit on the human star labels -
+ * the blueprint's "Reward -> RL" step after the M11 gate opened.
+ *
+ * Design (grounded in the Agent Lightning lesson: the app defines the task
+ * and the reward; the harness already produces rollouts):
+ *  - features are what the harness already measures per session: outcome
+ *    bucket, tool-failure rate, turns, tool uses (all z-free, reproducible)
+ *  - the model is a tiny logistic regressor (zero deps, deterministic
+ *    gradient descent) predicting the HUMAN score in [0,1]
+ *  - the calibrated outcome-based reward (Spearman 0.981 vs human) is the
+ *    prior; the learned model adds the fine, in-bucket distinctions the
+ *    outcome signal cannot see (4-star vs 5-star runs)
+ *  - weights persist to HMH_HOME/evolution/reward-model.json; refit as
+ *    labels accumulate
+ *
+ * What this is NOT: a fine-tuned LLM. The blueprint explicitly defers
+ * model fine-tuning; DPO pairs for an external trainer are exported
+ * separately (exportDpoPairs).
+ */
+import { readFile, writeFile, mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+const FEATURES = [
+    (f) => f.outcome / 2, // 0..1
+    (f) => f.toolFailRate, // 0..1
+    (f) => Math.log1p(Math.min(f.turns, 200)) / Math.log(201), // 0..1
+    (f) => Math.log1p(Math.min(f.toolUses, 200)) / Math.log(201), // 0..1
+];
+function x(f) {
+    return [...FEATURES.map((fn) => fn(f)), 1];
+}
+function sigmoid(z) {
+    return 1 / (1 + Math.exp(-z));
+}
+/** Deterministic 80/20 split by index (no RNG - reproducible fits). */
+function split(rows) {
+    const train = [];
+    const hold = [];
+    rows.forEach((r, i) => (i % 5 === 4 ? hold : train).push(r));
+    return { train, hold };
+}
+function fitLinear(rows, epochs = 4000, lr = 0.05, l2 = 0.01) {
+    const d = 5;
+    let w = new Array(d).fill(0);
+    const xs = rows.map((r) => x(r.f));
+    if (xs.length === 0)
+        return w;
+    for (let e = 0; e < epochs; e++) {
+        const grad = new Array(d).fill(0);
+        for (let i = 0; i < rows.length; i++) {
+            let z = 0;
+            for (let k = 0; k < d; k++)
+                z += w[k] * xs[i][k];
+            const err = sigmoid(z) - rows[i].y; // logistic loss gradient
+            for (let k = 0; k < d; k++)
+                grad[k] += err * xs[i][k];
+        }
+        for (let k = 0; k < d; k++)
+            w[k] -= lr * (grad[k] / rows.length + l2 * w[k]);
+    }
+    return w;
+}
+function rmse(w, rows) {
+    if (rows.length === 0)
+        return 0;
+    let s = 0;
+    for (const r of rows) {
+        let z = 0;
+        const xv = x(r.f);
+        for (let k = 0; k < w.length; k++)
+            z += w[k] * xv[k];
+        s += (sigmoid(z) - r.y) ** 2;
+    }
+    return Math.sqrt(s / rows.length);
+}
+/** Join labels with insights and map to training rows. Pure - testable. */
+export function trainingRows(labels, insights) {
+    const bySession = new Map();
+    for (const i of insights)
+        if (!bySession.has(i.session))
+            bySession.set(i.session, i);
+    const rows = [];
+    for (const l of labels) {
+        const ins = bySession.get(l.session);
+        if (!ins)
+            continue;
+        const uses = Number(ins.toolUses ?? 0);
+        const outcome = ins.outcome === 'ok' ? 2 : ins.outcome === 'turn-budget' ? 1 : 0;
+        rows.push({
+            f: { outcome, toolFailRate: 0, turns: Number(ins.turns ?? 0), toolUses: uses },
+            y: l.score / 5,
+            session: l.session,
+        });
+    }
+    return rows;
+}
+/** Fit the reward model on joined human labels. Deterministic. */
+export function fitRewardModel(labels, insights) {
+    const rows = trainingRows(labels, insights);
+    const { train, hold } = split(rows);
+    const w = fitLinear(train);
+    return {
+        w: w,
+        trainedAt: new Date().toISOString(),
+        nSamples: rows.length,
+        trainRmse: Number(rmse(w, train).toFixed(4)),
+        ...(hold.length >= 4 ? { holdoutRmse: Number(rmse(w, hold).toFixed(4)) } : {}),
+    };
+}
+/** Score a run's features with fitted weights -> reward in [0,1]. */
+export function scoreFeatures(w, f) {
+    const xv = x(f);
+    let z = 0;
+    for (let k = 0; k < w.length; k++)
+        z += w[k] * xv[k];
+    return sigmoid(z);
+}
+/** Persistence: HMH_HOME/evolution/reward-model.json. */
+export async function saveRewardModel(home, m) {
+    const dir = join(home, 'evolution');
+    await mkdir(dir, { recursive: true });
+    await writeFile(join(dir, 'reward-model.json'), JSON.stringify(m, null, 2) + '\n', 'utf8');
+}
+export async function loadRewardModel(home) {
+    try {
+        return JSON.parse(await readFile(join(home, 'evolution', 'reward-model.json'), 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+/** Build DPO pairs from joined labels + insights. Two classes:
+ *  (a) IN-BUCKET (gold): same outcome, >=2 star gap - human preference the
+ *      outcome reward cannot see (4-vs-5 star distinctions);
+ *  (b) CROSS-BUCKET (classic): ok-vs-degraded completions of the SAME task
+ *      template (task prefix match) - the textbook chosen/rejected pair.
+ *  Pure - testable. */
+export function exportDpoPairs(labels, insights, taskOf, answerOf, opts = {}) {
+    const minGap = opts.minInBucketGap ?? 0.4;
+    const prefixLen = opts.crossBucketPrefix ?? 60;
+    const rows = trainingRows(labels, insights);
+    const insOf = new Map(insights.map((i) => [i.session, i]));
+    const pairs = [];
+    for (const a of rows) {
+        for (const b of rows) {
+            if (a.session >= b.session)
+                continue;
+            const gap = a.y - b.y;
+            if (gap < minGap)
+                continue;
+            const hi = gap > 0 ? a : b;
+            const lo = gap > 0 ? b : a;
+            const hiIns = insOf.get(hi.session);
+            const loIns = insOf.get(lo.session);
+            if (!hiIns || !loIns)
+                continue;
+            const sameOutcome = hiIns.outcome === loIns.outcome;
+            let ok = false;
+            if (sameOutcome) {
+                ok = true; // in-bucket gold
+            }
+            else {
+                // cross-bucket: only pair completions of the SAME task template
+                // (bench templates share long prefixes) - otherwise they teach
+                // nothing transferable
+                const ta = taskOf(hi.session);
+                const tb = taskOf(lo.session);
+                ok = ta.length >= prefixLen && ta.slice(0, prefixLen) === tb.slice(0, prefixLen);
+            }
+            if (!ok)
+                continue;
+            pairs.push({
+                prompt: taskOf(hi.session),
+                chosen: answerOf(hi.session),
+                rejected: answerOf(lo.session),
+                chosenSession: hi.session,
+                rejectedSession: lo.session,
+                gap: Number(gap.toFixed(2)),
+            });
+        }
+    }
+    return pairs;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hmharness/evolution",
-  "version": "0.14.7",
+  "version": "0.14.10",
   "description": "hmharness evolution subsystem: persistent memory, insight capture, skill library, and the bench that gives evolution its fitness signal. First-class kernel citizen, not a plugin.",
   "type": "module",
   "main": "dist/index.js",