@mindrian_os/cli 2.0.0-beta.3 → 2.0.0-beta.31

package/scripts/build-harness-manifest.cjs

@@ -0,0 +1,1090 @@
+#!/usr/bin/env node
+'use strict';
+
+/*
+ * Phase 167-01 Task 1 - the declared harness MANIFEST generator (HARN-01,
+ * D-167-01, D-167-06).
+ *
+ * Produces data/harness-manifest.json: the DECLARED, VERSIONED descriptor that
+ * NAMES the three existing recipe maps as ONE binding and nothing more. It is a
+ * READ LAYER OVER the three maps (a 3-MAP DIGEST), not a merge and not a
+ * per-surface registry. It does NOT merge or retire them (D-166-03 PRESERVED).
+ *
+ * THE GENERATOR IS A PART 7 REUSE SIBLING of
+ * scripts/build-orchestration-projection.cjs and
+ * scripts/build-connector-registry.cjs. It mirrors the shipped generator idiom
+ * wholesale: a deterministic source read -> build -> serialize
+ * (JSON.stringify(...,2) + a single trailing newline, byte-stable across
+ * machines) -> a 3-branch main (default write / --check / --refresh). The ONE
+ * structural difference is grain: the connector/projection generators emit a
+ * per-surface / per-node registry; this manifest emits EXACTLY THREE map entries
+ * (posture / wiring / ranked_next_reach) and NEVER a per-surface row. A surface
+ * (a /mos command, an agent, a skill) is reflected ONLY TRANSITIVELY: it lands
+ * in connector-registry.json (its real home, the per-surface registry), the
+ * wiring map's digest + source_count change, and this manifest's wiring entry
+ * digest + source_count update to match. The manifest digests the three maps; it
+ * never inlines or enumerates the surfaces inside them. This is what keeps
+ * D-166-03 inviolate.
+ *
+ * HIGH-1 (LOCKED): the manifest is a 3-MAP DIGEST naming EXACTLY the three maps
+ * as { role, path, digest(sha256), source_count }:
+ *   posture            -> data/command-registry.json
+ *   wiring             -> data/connector-registry.json
+ *   ranked_next_reach  -> data/brain-orchestration-projection.json
+ *
+ * Canon Part 8 (The Graph Boundary) + the Phase 157 amendment (Appendix D entry
+ * 19): the manifest carries methodology_tier=mindrian-operation machinery
+ * metadata ONLY (the sha256 digests are machinery metadata, NOT contents). It
+ * NEVER carries user content. It is a LOCAL artifact: there is NO live Brain read
+ * and NO live Brain write anywhere in this file - no brain-client require, no
+ * fetch, no http. It is NOT folded into the Brain projection (D-167-01). NO new
+ * deps; node built-ins only (node:fs, node:path, node:crypto for sha256). NO
+ * YAML; NO TS.
+ *
+ * Usage:
+ *   node scripts/build-harness-manifest.cjs
+ *       read the three maps -> write data/harness-manifest.json
+ *   node scripts/build-harness-manifest.cjs --check
+ *       regenerate in memory, assert STALE / UNRESOLVED / MALFORMED, exit-1 on
+ *       any finding with a stderr recovery line, else print an OK line. Phase
+ *       298 (SEED-032) Plan 13: --check ALSO runs every `kind: "contract"`
+ *       policy in data/harness-policies/ INLINE (runContractChecks below) --
+ *       pure file reads a faster feedback path onto the truths the nine
+ *       frozen-phrase tests already pin, never a second source of truth.
+ *   node scripts/build-harness-manifest.cjs --refresh
+ *       re-derive the digests + re-write the artifact (idempotent)
+ *
+ * House rule: hyphens only, no em-dashes.
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+
+const REPO_ROOT = path.resolve(__dirname, '..');
+const DATA_DIR = path.join(REPO_ROOT, 'data');
+
+const COMMAND_REGISTRY_PATH = path.join(DATA_DIR, 'command-registry.json');
+const CONNECTOR_REGISTRY_PATH = path.join(DATA_DIR, 'connector-registry.json');
+const PROJECTION_PATH = path.join(DATA_DIR, 'brain-orchestration-projection.json');
+const MANIFEST_PATH = path.join(DATA_DIR, 'harness-manifest.json');
+
+const GENERATED_NOTE =
+  'GENERATED by scripts/build-harness-manifest.cjs - do not edit by hand';
+
+// The only legal methodology_tier for this LOCAL machinery descriptor (Canon
+// Part 8, Phase 157 amendment). The manifest is mindrian-operation machinery
+// metadata, never pws teaching IP and never user content.
+const TIER_OP = 'mindrian-operation';
+
+const MANIFEST_VERSION = 2;
+
+// ---------------------------------------------------------------------------
+// THE THREE-MAP BINDING (HIGH-1, D-167-01). EXACTLY three entries, one per map.
+// Each entry declares { role, relPath, primaryArrayKey }. The generator reads
+// the on-disk bytes of each path, sha256-digests them (machinery metadata, NOT
+// contents), and counts the primary array's length for source_count. There is
+// NO fourth entry, and NO per-surface row: a surface is digested transitively
+// inside the wiring map's source_count.
+//
+// role -> map (LOCKED naming):
+//   posture            command-registry.json (the posture / autonomy authority)
+//   wiring             connector-registry.json (the reach -> surface wiring)
+//   ranked_next_reach  brain-orchestration-projection.json (the ranked next-reach)
+// ---------------------------------------------------------------------------
+const MAP_BINDINGS = Object.freeze([
+  Object.freeze({
+    role: 'posture',
+    relPath: 'data/command-registry.json',
+    absPath: COMMAND_REGISTRY_PATH,
+    primaryArrayKey: 'commands',
+  }),
+  Object.freeze({
+    role: 'wiring',
+    relPath: 'data/connector-registry.json',
+    absPath: CONNECTOR_REGISTRY_PATH,
+    primaryArrayKey: 'connectors',
+  }),
+  Object.freeze({
+    role: 'ranked_next_reach',
+    relPath: 'data/brain-orchestration-projection.json',
+    absPath: PROJECTION_PATH,
+    primaryArrayKey: 'nodes',
+  }),
+]);
+
+// ---------------------------------------------------------------------------
+// THE RUNTIME-SURFACE BINDINGS (Phase 201-01, SEED-032, D-201-1). The agent is
+// Model + Harness; the three maps above declare the harness's DATA, but SEED-032's
+// point is that the harness's RUNTIME surfaces - the code the harness runs ON -
+// belong in the SAME declared manifest too. These four bindings name each runtime
+// surface as { role, path, digest(sha256) } - DIGEST-ONLY (D-201-1, the RECOMMENDED
+// depth): a fixed-length fingerprint of the on-disk bytes, machinery metadata,
+// NEVER the file contents. There is NO source_count (these are code files, not
+// arrays of sources) and NO richer per-surface schema - a richer schema would turn
+// the read/descriptor into a second orchestration brain (Canon Part 11: one
+// governed path). This block is purely ADDITIVE: it DECLARES what already runs
+// (Part 7), retires no map (D-166-03), keeps maps at EXACTLY three, and opens no
+// Brain wire (Part 8). --check re-digests these files and fails closed on any drift
+// between the declared harness and the on-disk harness.
+//
+// role -> the runtime surface (the code file that IS that surface):
+//   orchestration_spine  lib/core/chain-executor.cjs         (the runChain spine)
+//   decide_engine        lib/core/navigation-engine.cjs      (the decide() engine)
+//   cockpit              lib/statusline/cockpit-renderer.cjs (the statusline cockpit)
+//   brain_orchestration  lib/core/directive-envelope.cjs     (the brain-orchestration reader)
+// ---------------------------------------------------------------------------
+const RUNTIME_SURFACE_BINDINGS = Object.freeze([
+  Object.freeze({
+    role: 'orchestration_spine',
+    relPath: 'lib/core/chain-executor.cjs',
+    absPath: path.join(REPO_ROOT, 'lib/core/chain-executor.cjs'),
+  }),
+  Object.freeze({
+    role: 'decide_engine',
+    relPath: 'lib/core/navigation-engine.cjs',
+    absPath: path.join(REPO_ROOT, 'lib/core/navigation-engine.cjs'),
+  }),
+  Object.freeze({
+    role: 'cockpit',
+    relPath: 'lib/statusline/cockpit-renderer.cjs',
+    absPath: path.join(REPO_ROOT, 'lib/statusline/cockpit-renderer.cjs'),
+  }),
+  Object.freeze({
+    role: 'brain_orchestration',
+    relPath: 'lib/core/directive-envelope.cjs',
+    absPath: path.join(REPO_ROOT, 'lib/core/directive-envelope.cjs'),
+  }),
+]);
+
+// ---------------------------------------------------------------------------
+// THE LARRY SURFACE BINDINGS (Phase 298, SEED-032, D-201-1 sibling). Larry
+// speaks through exactly THREE surfaces; each is its OWN declared, digested
+// binding, kept OUT of RUNTIME_SURFACE_BINDINGS (which stays exactly four -
+// tests/test-201-harness-manifest.cjs's EXPECTED_SURFACE_ROLES pins that
+// length). buildSurfaceEntry(binding) is REUSED VERBATIM (Part 7): a
+// `{ role, path, digest }` triple, digest-only, no source_count, matching the
+// runtime-surface entry shape exactly.
+//
+// role -> the speaking surface (the file that IS that surface):
+//   cli_agent            agents/larry-extended.md          (the CLI agent)
+//   personality_skill     skills/larry-personality/SKILL.md (the skill)
+//   desktop_cowork_wire   lib/mcp/runtime-instructions.cjs  (the Desktop/Cowork wire)
+// ---------------------------------------------------------------------------
+const LARRY_SURFACE_BINDINGS = Object.freeze([
+  Object.freeze({
+    role: 'cli_agent',
+    relPath: 'agents/larry-extended.md',
+    absPath: path.join(REPO_ROOT, 'agents/larry-extended.md'),
+  }),
+  Object.freeze({
+    role: 'personality_skill',
+    relPath: 'skills/larry-personality/SKILL.md',
+    absPath: path.join(REPO_ROOT, 'skills/larry-personality/SKILL.md'),
+  }),
+  Object.freeze({
+    role: 'desktop_cowork_wire',
+    relPath: 'lib/mcp/runtime-instructions.cjs',
+    absPath: path.join(REPO_ROOT, 'lib/mcp/runtime-instructions.cjs'),
+  }),
+]);
+
+// ---------------------------------------------------------------------------
+// THE POLICY DIRECTORY + FIXTURE DIRECTORY (Phase 298, SEED-032). Both are
+// digested as ONE directory-wide entry (path, digest[, count]) - the manifest
+// never enumerates a directory's individual files as rows, exactly as it never
+// enumerates a map's individual sources as rows (HIGH-1's own discipline
+// extended one level).
+// ---------------------------------------------------------------------------
+const POLICIES_DIR = 'data/harness-policies';
+const POLICIES_ABS = path.join(REPO_ROOT, POLICIES_DIR);
+const FIXTURE_DIR = 'data/harness-fixtures/converged-room';
+const FIXTURE_ABS = path.join(REPO_ROOT, FIXTURE_DIR);
+
+// ---------------------------------------------------------------------------
+// The Part 8 boundary-scan field allowlists (D-167-06, BOG-10 sibling). SINGLE
+// SOURCE OF TRUTH the Wave-1 boundary scan
+// (tests/test-harness-manifest-part8-boundary.cjs) asserts against. A top-level
+// manifest key outside NODE_FIELD_ALLOWLIST, or a maps-entry key outside
+// ENTRY_FIELD_ALLOWLIST, is a Part 8 breach (a candidate user-content field) and
+// fails the build before the artifact lands. Every name here is a GENERIC
+// machinery field: an ontology reference, a generated note, a tier enum, a
+// version int, the maps binding, and the per-entry { role, path, digest,
+// source_count } machinery quadruple. NONE is a user-content channel.
+const NODE_FIELD_ALLOWLIST = Object.freeze([
+  'ontology_ref',
+  'generated_note',
+  'methodology_tier',
+  'version',
+  'maps',
+  // Phase 201-01: the additive runtime-surface digest block. Each entry is the
+  // generic { role, path, digest } machinery triple (a subset of
+  // ENTRY_FIELD_ALLOWLIST); no source_count, no user-content channel.
+  'runtime_surfaces',
+  // Phase 298 (SEED-032): three additive generic machinery fields carrying no
+  // user content. `policies` and `fixture_ref` are DIRECTORY-DIGEST objects
+  // (path, digest[, count]), never a per-file enumeration. `larry_surfaces` is
+  // the same { role, path, digest } machinery triple as runtime_surfaces, just
+  // Larry's own three speaking surfaces kept in a separate frozen array.
+  'policies',
+  'larry_surfaces',
+  'fixture_ref',
+]);
+
+// Every maps entry is EXACTLY { role, path, digest, source_count }. A maps-entry
+// key outside this set is a Part 8 breach.
+const ENTRY_FIELD_ALLOWLIST = Object.freeze([
+  'role',
+  'path',
+  'digest',
+  'source_count',
+]);
+
+// ---------------------------------------------------------------------------
+// readBytes(p) -- read a committed source file's raw bytes. Returns null on any
+// failure so the generator/validator degrades rather than throwing (mirrors the
+// shipped generators' readJson degrade discipline).
+// ---------------------------------------------------------------------------
+function readBytes(p) {
+  try {
+    return fs.readFileSync(p);
+  } catch (_e) {
+    return null;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// digestBytes(buf) -- sha256 hex of the raw on-disk bytes. This is MACHINERY
+// METADATA (a fixed-length hex fingerprint), NEVER the map's contents. A digest
+// changes iff the map's bytes change, so a single surface landing in
+// connector-registry.json flips the wiring entry's digest transitively.
+// ---------------------------------------------------------------------------
+function digestBytes(buf) {
+  return crypto.createHash('sha256').update(buf).digest('hex');
+}
+
+// ---------------------------------------------------------------------------
+// primaryArrayCount(buf, key) -- parse the JSON bytes and return the length of
+// the named primary array (a scalar count, NOT the contents). Returns 0 on a
+// missing / malformed source or a non-array key, so the count degrades to a
+// legible zero rather than throwing.
+// ---------------------------------------------------------------------------
+function primaryArrayCount(buf, key) {
+  if (!buf) return 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(buf.toString('utf8'));
+  } catch (_e) {
+    return 0;
+  }
+  const arr = parsed && parsed[key];
+  return Array.isArray(arr) ? arr.length : 0;
+}
+
+// ---------------------------------------------------------------------------
+// buildMapEntry(binding) -- build ONE { role, path, digest, source_count } map
+// entry. Reads the on-disk bytes once: digests them and counts the primary
+// array. A missing source yields a stable empty-digest sentinel (the sha256 of
+// the empty byte string) + a zero count, so the manifest is still byte-stable
+// when a source is absent; --check then flags the absence as UNRESOLVED.
+// ---------------------------------------------------------------------------
+function buildMapEntry(binding) {
+  const buf = readBytes(binding.absPath);
+  const digest = buf ? digestBytes(buf) : digestBytes(Buffer.from(''));
+  const source_count = primaryArrayCount(buf, binding.primaryArrayKey);
+  return {
+    role: binding.role,
+    path: binding.relPath,
+    digest: digest,
+    source_count: source_count,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// buildSurfaceEntry(binding) -- build ONE { role, path, digest } runtime-surface
+// entry (Phase 201-01, D-201-1 digest-only). Reads the on-disk code bytes once and
+// sha256-digests them (machinery metadata, NOT contents). A missing surface yields
+// the stable empty-digest sentinel so the manifest stays byte-stable when a file is
+// absent; --check then flags the absence as UNRESOLVED. There is NO source_count:
+// a runtime surface is one code file, not an array of sources.
+// ---------------------------------------------------------------------------
+function buildSurfaceEntry(binding) {
+  const buf = readBytes(binding.absPath);
+  const digest = buf ? digestBytes(buf) : digestBytes(Buffer.from(''));
+  return {
+    role: binding.role,
+    path: binding.relPath,
+    digest: digest,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// listFilesRecursive(rootDir) -- list every FILE under rootDir (recursing into
+// subdirectories), as paths relative to rootDir using '/' separators
+// regardless of OS, in a plain lexicographic sort over the FULL relative path.
+// Returns [] for a missing or unreadable directory (degrade, never throw).
+// ---------------------------------------------------------------------------
+function listFilesRecursive(rootDir) {
+  const out = [];
+  function walk(dirAbs, relPrefix) {
+    let entries;
+    try {
+      entries = fs.readdirSync(dirAbs, { withFileTypes: true });
+    } catch (_e) {
+      return;
+    }
+    for (const entry of entries) {
+      const relPath = relPrefix ? relPrefix + '/' + entry.name : entry.name;
+      const absPath = path.join(dirAbs, entry.name);
+      if (entry.isDirectory()) {
+        walk(absPath, relPath);
+      } else if (entry.isFile()) {
+        out.push(relPath);
+      }
+    }
+  }
+  walk(rootDir, '');
+  return out.sort();
+}
+
+// ---------------------------------------------------------------------------
+// digestDirectory(dirPath) -- digest a DIRECTORY as ONE value (Phase 298,
+// SEED-032). There is NO shipped directory-digest precedent in this file (the
+// three existing digests are all single-file digestBytes calls), so THE
+// COMPOSITION RULE IS STATED HERE, the way every other invariant in this file
+// is stated:
+//
+//   1. List every file under dirPath, recursing into subdirectories.
+//   2. Sort the relative paths with a plain lexicographic sort (the full
+//      relative path, '/' separators, no OS-specific ordering).
+//   3. For each file, in that sorted order, build the line:
+//        <relative-path> + NUL(\0) + <lowercase-hex-sha256-of-the-file-bytes> + \n
+//   4. Concatenate those lines in order and return the sha256 hex of the
+//      concatenation.
+//
+// This makes the digest filesystem-independent (relative paths only) and
+// RENAME-SENSITIVE: renaming a file with byte-identical content changes the
+// digest, because the relative path is part of what is hashed - which is the
+// correct behavior for a declared harness fingerprint. A missing directory (or
+// an empty one) yields the sha256 of the empty buffer, the SAME stable
+// sentinel readBytes's degrade path already uses for a missing single file.
+// ---------------------------------------------------------------------------
+function digestDirectory(dirPath) {
+  const files = listFilesRecursive(dirPath);
+  if (files.length === 0) {
+    return digestBytes(Buffer.from(''));
+  }
+  const lines = files.map((relPath) => {
+    const buf = readBytes(path.join(dirPath, relPath));
+    const fileDigest = buf ? digestBytes(buf) : digestBytes(Buffer.from(''));
+    return relPath + '\0' + fileDigest + '\n';
+  });
+  return digestBytes(Buffer.from(lines.join(''), 'utf8'));
+}
+
+// ---------------------------------------------------------------------------
+// listPolicyFileNames(dirAbs) -- the policy directory's *.json files, EXCLUDING
+// `_schema.json` (the vocabulary declaration itself, not a policy) and any
+// non-JSON file (e.g. CONTEXT.md). Sorted for determinism. Returns [] for a
+// missing/unreadable directory (degrade, never throw).
+// ---------------------------------------------------------------------------
+function listPolicyFileNames(dirAbs) {
+  let entries;
+  try {
+    entries = fs.readdirSync(dirAbs);
+  } catch (_e) {
+    return [];
+  }
+  return entries.filter((f) => f.endsWith('.json') && f !== '_schema.json').sort();
+}
+
+// ---------------------------------------------------------------------------
+// loadPolicySchema() -- read data/harness-policies/_schema.json's `_doc` block
+// (the closed vocabularies + runner_path_rule + policy_fields). Returns null
+// on any failure so a caller can degrade to a single MALFORMED finding rather
+// than throwing (mirrors readBytes's degrade discipline).
+// ---------------------------------------------------------------------------
+function loadPolicySchema() {
+  try {
+    const raw = fs.readFileSync(path.join(POLICIES_ABS, '_schema.json'), 'utf8');
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === 'object' && parsed._doc ? parsed._doc : null;
+  } catch (_e) {
+    return null;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// EXTRA_KEYS_BY_POLICY_ID -- the narrow extra-key exception
+// data/harness-policies/_schema.json's own `_doc.validation_rule` documents in
+// prose (that file has no separate machine-readable field for it): two
+// migration-slice-1 policy files carry a small set of additional keys beyond
+// the eleven common `policy_fields`. This states that SAME exception verbatim
+// rather than inventing a new one or restating a different description of it.
+// ---------------------------------------------------------------------------
+const EXTRA_KEYS_BY_POLICY_ID = Object.freeze({
+  'memory-write-policy': Object.freeze([
+    'channels', 'verbs', 'basket_fires_at', 'claim_review_status',
+    'toggled_off_writes', 'narrated',
+  ]),
+  'contract-parity-larry': Object.freeze([
+    'surfaces', 'byte_budget',
+  ]),
+});
+
+// ---------------------------------------------------------------------------
+// isValidRunnerPath(runner) -- the schema's own runner_path_rule, implemented:
+// null (an honest declared ghost) is always valid; otherwise runner must be a
+// repo-relative string beginning with the literal prefix "scripts/", carrying
+// no parent-directory ("..") segment, never an absolute path, and resolving
+// inside the repository root when joined to it.
+// ---------------------------------------------------------------------------
+function isValidRunnerPath(runner) {
+  if (runner === null) return true;
+  if (typeof runner !== 'string' || runner.length === 0) return false;
+  if (!runner.startsWith('scripts/')) return false;
+  if (path.isAbsolute(runner)) return false;
+  if (runner.split('/').includes('..')) return false;
+  const resolved = path.resolve(REPO_ROOT, runner);
+  const rel = path.relative(REPO_ROOT, resolved);
+  return rel !== '' && rel !== '..' && !rel.startsWith('..' + path.sep) && !path.isAbsolute(rel);
+}
+
+// ---------------------------------------------------------------------------
+// validatePolicyFile(policy, fileName, schema) -- validate ONE parsed policy
+// object against the closed vocabularies + runner_path_rule READ from the
+// schema (never restated as a second hardcoded copy). Returns an array of
+// finding strings, each naming the file and the failing key; an empty array
+// means the file is valid. Fails closed: every rejection reason from the
+// schema's `default_on_miss` is enforced here.
+// ---------------------------------------------------------------------------
+function validatePolicyFile(policy, fileName, schema) {
+  const findings = [];
+  const RECOVERY_POLICY =
+    'Recovery: fix data/harness-policies/' + fileName +
+    ' against data/harness-policies/_schema.json, then re-run ' +
+    'node scripts/build-harness-manifest.cjs --check.';
+
+  if (!policy || typeof policy !== 'object' || Array.isArray(policy)) {
+    findings.push(
+      'MALFORMED: policy file ' + fileName + ' is not a JSON object. ' + RECOVERY_POLICY
+    );
+    return findings;
+  }
+  if (!schema || typeof schema !== 'object') {
+    findings.push(
+      'MALFORMED: policy file ' + fileName + ' cannot be validated - ' +
+        'data/harness-policies/_schema.json is missing or invalid. ' + RECOVERY_POLICY
+    );
+    return findings;
+  }
+
+  const commonFields = Array.isArray(schema.policy_fields)
+    ? schema.policy_fields.map((f) => f && f.field).filter((f) => typeof f === 'string')
+    : [];
+  const id = typeof policy.id === 'string' ? policy.id : '';
+  const extraAllowed = EXTRA_KEYS_BY_POLICY_ID[id] || [];
+  const allowedKeys = new Set([...commonFields, ...extraAllowed]);
+
+  // Unknown top-level key.
+  for (const key of Object.keys(policy)) {
+    if (!allowedKeys.has(key)) {
+      findings.push(
+        'MALFORMED: policy file ' + fileName + ' carries unknown top-level key "' + key +
+          '" (not one of the schema\'s policy_fields, and not an extra key the schema ' +
+          'permits for this policy id). ' + RECOVERY_POLICY
+      );
+    }
+  }
+
+  // Missing required field.
+  for (const field of commonFields) {
+    if (!Object.prototype.hasOwnProperty.call(policy, field)) {
+      findings.push(
+        'MALFORMED: policy file ' + fileName + ' is missing required key "' + field + '". ' +
+          RECOVERY_POLICY
+      );
+    }
+  }
+
+  // rung: member of the closed rung_vocabulary.
+  const rungVocab = Array.isArray(schema.rung_vocabulary) ? schema.rung_vocabulary : [];
+  if (Object.prototype.hasOwnProperty.call(policy, 'rung') && !rungVocab.includes(policy.rung)) {
+    findings.push(
+      'MALFORMED: policy file ' + fileName + ' carries unknown "rung" value ' +
+        JSON.stringify(policy.rung) + ' (not a member of the schema\'s rung_vocabulary). ' +
+        RECOVERY_POLICY
+    );
+  }
+
+  // kind: member of the closed kind_vocabulary.
+  const kindVocab = Array.isArray(schema.kind_vocabulary) ? schema.kind_vocabulary : [];
+  if (Object.prototype.hasOwnProperty.call(policy, 'kind') && !kindVocab.includes(policy.kind)) {
+    findings.push(
+      'MALFORMED: policy file ' + fileName + ' carries unknown "kind" value ' +
+        JSON.stringify(policy.kind) + ' (not a member of the schema\'s kind_vocabulary). ' +
+        RECOVERY_POLICY
+    );
+  }
+
+  // applies_to: every member is in the closed applies_to_vocabulary.
+  const appliesVocab = Array.isArray(schema.applies_to_vocabulary) ? schema.applies_to_vocabulary : [];
+  if (Object.prototype.hasOwnProperty.call(policy, 'applies_to')) {
+    if (!Array.isArray(policy.applies_to)) {
+      findings.push(
+        'MALFORMED: policy file ' + fileName + ' "applies_to" is not an array. ' + RECOVERY_POLICY
+      );
+    } else {
+      for (const member of policy.applies_to) {
+        if (!appliesVocab.includes(member)) {
+          findings.push(
+            'MALFORMED: policy file ' + fileName + ' carries unknown "applies_to" member ' +
+              JSON.stringify(member) + ' (not a member of the schema\'s applies_to_vocabulary). ' +
+              RECOVERY_POLICY
+          );
+        }
+      }
+    }
+  }
+
+  // promotion_rule: exactly its three documented keys.
+  if (Object.prototype.hasOwnProperty.call(policy, 'promotion_rule')) {
+    const pr = policy.promotion_rule;
+    const requiredPrKeys = ['window_runs', 'max_false_positive_rate', 'min_true_positives'];
+    if (!pr || typeof pr !== 'object' || Array.isArray(pr)) {
+      findings.push(
+        'MALFORMED: policy file ' + fileName + ' "promotion_rule" is not an object. ' +
+          RECOVERY_POLICY
+      );
+    } else {
+      const missingPr = requiredPrKeys.filter(
+        (k) => !Object.prototype.hasOwnProperty.call(pr, k)
+      );
+      if (missingPr.length) {
+        findings.push(
+          'MALFORMED: policy file ' + fileName + ' "promotion_rule" is missing key(s): ' +
+            missingPr.join(', ') + '. ' + RECOVERY_POLICY
+        );
+      }
+    }
+  }
+
+  // runner: the schema's own runner_path_rule (read, not restated).
+  if (Object.prototype.hasOwnProperty.call(policy, 'runner') && !isValidRunnerPath(policy.runner)) {
+    findings.push(
+      'MALFORMED: policy file ' + fileName + ' "runner" value ' + JSON.stringify(policy.runner) +
+        ' violates the schema\'s runner_path_rule (' +
+        (typeof schema.runner_path_rule === 'string'
+          ? schema.runner_path_rule
+          : 'see data/harness-policies/_schema.json') +
+        '). ' + RECOVERY_POLICY
+    );
+  }
+
+  return findings;
+}
+
+// ---------------------------------------------------------------------------
+// loadPolicies(rootDir) -- read + validate every policy file in the policy
+// directory. Per-file try/catch (T-233-01 / T-217-01 self-DoS-avoidance
+// pattern): one malformed file is reported by name and skipped from the
+// returned `policies` list, and the loop NEVER aborts the rest of the scan.
+// Returns { policies: [{fileName, id, policy}], findings: string[] }.
+// ---------------------------------------------------------------------------
+function loadPolicies(rootDir) {
+  const dirAbs = rootDir || POLICIES_ABS;
+  const schema = loadPolicySchema();
+  const fileNames = listPolicyFileNames(dirAbs);
+  const policies = [];
+  const findings = [];
+
+  for (const fileName of fileNames) {
+    let parsed;
+    try {
+      parsed = JSON.parse(fs.readFileSync(path.join(dirAbs, fileName), 'utf8'));
+    } catch (e) {
+      findings.push(
+        'MALFORMED: policy file ' + fileName + ' is not valid JSON (' + e.message + '). ' +
+          'Recovery: fix the JSON syntax in data/harness-policies/' + fileName + '.'
+      );
+      continue;
+    }
+    const fileFindings = validatePolicyFile(parsed, fileName, schema);
+    if (fileFindings.length) {
+      for (const f of fileFindings) findings.push(f);
+      continue;
+    }
+    policies.push({ fileName, id: parsed.id, policy: parsed });
+  }
+
+  return { policies, findings };
+}
+
+// ---------------------------------------------------------------------------
+// runContractChecks(rootDir) -- Phase 298 Plan 13 (SEED-032, R-06). Runs every
+// `kind: "contract"` policy in data/harness-policies/ INLINE (pure file
+// reads, no spawn, no runner): each declared phrase must be a literal
+// substring of its declared surface file, and the declared byte_budget's
+// EVALUATED constant (required and read, never file-statted) must sit at or
+// under its declared limit. The generator HARDCODES NO PHRASE of its own --
+// `contract-parity-larry.json` is the single declaration (T-298-27); a grep
+// for two of its pinned phrases inside this file must return zero. A missing
+// phrase or a busted budget produces ONE named finding: the surface role,
+// path and the exact missing phrase, or the constant name, the measured
+// bytes and the limit -- so the failure is actionable without opening the
+// policy file. Returns an array of finding strings (empty = clean).
+// ---------------------------------------------------------------------------
+function runContractChecks(rootDir) {
+  const dirAbs = rootDir || REPO_ROOT;
+  const { policies } = loadPolicies(POLICIES_ABS);
+  const findings = [];
+  const RECOVERY_CONTRACT =
+    'Recovery: restore the declared phrase, or the declared byte budget, or ' +
+    'update data/harness-policies/<id>.json if the contract itself changed, ' +
+    'then re-run node scripts/build-harness-manifest.cjs --check.';
+
+  for (const entry of policies) {
+    const policy = entry && entry.policy;
+    if (!policy || policy.kind !== 'contract') continue;
+    const fileName = entry.fileName;
+
+    const surfaces = Array.isArray(policy.surfaces) ? policy.surfaces : [];
+    for (const surface of surfaces) {
+      if (!surface || typeof surface.path !== 'string') continue;
+      const absSurfacePath = path.join(dirAbs, surface.path);
+      const buf = readBytes(absSurfacePath);
+      const text = buf ? buf.toString('utf8') : null;
+      const phrases = Array.isArray(surface.phrases) ? surface.phrases : [];
+      for (const phrase of phrases) {
+        if (typeof phrase !== 'string') continue;
+        if (text === null || text.indexOf(phrase) === -1) {
+          findings.push(
+            'CONTRACT: ' + fileName + ' declares the phrase ' + JSON.stringify(phrase) +
+              ' on surface "' + (surface.role || surface.path) + '" (' + surface.path +
+              '), but it is not present on disk. ' + RECOVERY_CONTRACT
+          );
+        }
+      }
+    }
+
+    const budget = policy.byte_budget;
+    if (budget && typeof budget.path === 'string' && typeof budget.constant === 'string' &&
+        typeof budget.limit === 'number') {
+      const absModulePath = path.resolve(dirAbs, budget.path);
+      let value;
+      try {
+        const resolved = require.resolve(absModulePath);
+        delete require.cache[resolved];
+        const mod = require(absModulePath);
+        value = mod && mod[budget.constant];
+      } catch (_e) {
+        value = undefined;
+      }
+      if (typeof value !== 'string') {
+        findings.push(
+          'CONTRACT: ' + fileName + ' declares byte_budget constant "' + budget.constant +
+            '" on ' + budget.path + ', but requiring the module and reading that export ' +
+            'failed. ' + RECOVERY_CONTRACT
+        );
+      } else {
+        const measured = Buffer.byteLength(value, 'utf8');
+        if (measured > budget.limit) {
+          findings.push(
+            'CONTRACT: ' + fileName + ' byte_budget constant "' + budget.constant + '" (' +
+              budget.path + ') measured ' + measured + ' bytes, exceeding its declared ' +
+              'limit of ' + budget.limit + ' bytes. ' + RECOVERY_CONTRACT
+          );
+        }
+      }
+    }
+  }
+
+  return findings;
+}
+
+// ---------------------------------------------------------------------------
+// buildManifest() -- the core. Emits the declared descriptor object:
+//   { ontology_ref, generated_note, methodology_tier, version, maps }
+// where maps is EXACTLY the three { role, path, digest, source_count } entries
+// (posture / wiring / ranked_next_reach). NO per-surface rows. NO inlined map
+// contents. methodology_tier=mindrian-operation machinery metadata (D-167-01).
+// ---------------------------------------------------------------------------
+function buildManifest() {
+  const maps = MAP_BINDINGS.map((b) => buildMapEntry(b));
+  const runtime_surfaces = RUNTIME_SURFACE_BINDINGS.map((b) => buildSurfaceEntry(b));
+  const larry_surfaces = LARRY_SURFACE_BINDINGS.map((b) => buildSurfaceEntry(b));
+  const policyCount = listPolicyFileNames(POLICIES_ABS).length;
+  return {
+    ontology_ref:
+      'data/command-registry.json + data/connector-registry.json + ' +
+      'data/brain-orchestration-projection.json',
+    generated_note: GENERATED_NOTE,
+    methodology_tier: TIER_OP,
+    version: MANIFEST_VERSION,
+    maps: maps,
+    runtime_surfaces: runtime_surfaces,
+    policies: {
+      path: POLICIES_DIR,
+      digest: digestDirectory(POLICIES_ABS),
+      count: policyCount,
+    },
+    larry_surfaces: larry_surfaces,
+    fixture_ref: {
+      path: FIXTURE_DIR,
+      digest: digestDirectory(FIXTURE_ABS),
+    },
+  };
+}
+
+// ---------------------------------------------------------------------------
+// serializeManifest(manifest) -- deterministic JSON + a single trailing newline
+// (byte-stable across machines), mirroring the shipped serialize* idiom. Emits
+// ONLY the serialized fields in a stable key order; each maps entry emits its
+// four keys in a stable order.
+// ---------------------------------------------------------------------------
+function serializeManifest(manifest) {
+  const clean = {
+    ontology_ref: manifest.ontology_ref,
+    generated_note: manifest.generated_note,
+    methodology_tier: manifest.methodology_tier,
+    version: manifest.version,
+    maps: (Array.isArray(manifest.maps) ? manifest.maps : []).map((m) => ({
+      role: m.role,
+      path: m.path,
+      digest: m.digest,
+      source_count: m.source_count,
+    })),
+    runtime_surfaces: (Array.isArray(manifest.runtime_surfaces)
+      ? manifest.runtime_surfaces
+      : []
+    ).map((s) => ({
+      role: s.role,
+      path: s.path,
+      digest: s.digest,
+    })),
+    policies: {
+      path: manifest.policies && manifest.policies.path,
+      digest: manifest.policies && manifest.policies.digest,
+      count: manifest.policies && manifest.policies.count,
+    },
+    larry_surfaces: (Array.isArray(manifest.larry_surfaces)
+      ? manifest.larry_surfaces
+      : []
+    ).map((s) => ({
+      role: s.role,
+      path: s.path,
+      digest: s.digest,
+    })),
+    fixture_ref: {
+      path: manifest.fixture_ref && manifest.fixture_ref.path,
+      digest: manifest.fixture_ref && manifest.fixture_ref.digest,
+    },
+  };
+  return JSON.stringify(clean, null, 2) + '\n';
+}
+
+// ---------------------------------------------------------------------------
+// validateManifest(manifest) -- the 3-mode drift taxonomy (D-167-01 / D-167-03).
+// Returns { stale, unresolved, malformed }: three categorized arrays of error
+// strings (each empty = that mode is clean). PURE with respect to the Brain:
+// reads ONLY the passed manifest + the committed on-disk manifest file (for the
+// byte-compare) + the three named source paths (for the resolve check). ZERO
+// Brain/network calls (Part 8). Mirrors validateProjection in
+// build-orchestration-projection.cjs (categorized error arrays exercised
+// directly by the test without spawning a subprocess).
+//
+//   STALE       -- the serialized regeneration differs byte-for-byte from the
+//                  committed data/harness-manifest.json (a source map changed, or
+//                  the committed file was hand-edited, without regenerating).
+//   UNRESOLVED  -- a named map path does not exist on disk (a spoofed binding).
+//   MALFORMED   -- a maps entry is missing a required key (role / path / digest),
+//                  OR the maps section is not exactly the three declared roles
+//                  (an extra entry, a per-surface row, or a missing role).
+// ---------------------------------------------------------------------------
+function validateManifest(manifest) {
+  const stale = [];
+  const unresolved = [];
+  const malformed = [];
+
+  const RECOVERY = 'Run: node scripts/build-harness-manifest.cjs';
+
+  const m = manifest && typeof manifest === 'object' ? manifest : {};
+  const maps = Array.isArray(m.maps) ? m.maps : [];
+
+  // ---- STALE: byte-compare the serialized manifest vs the committed file. ----
+  const serialized = serializeManifest(m);
+  const onDisk = fs.existsSync(MANIFEST_PATH)
+    ? fs.readFileSync(MANIFEST_PATH, 'utf8')
+    : '';
+  if (onDisk !== serialized) {
+    stale.push(
+      'STALE: data/harness-manifest.json diverges from the regenerated ' +
+        'manifest (a source map changed without regenerating, or the committed ' +
+        'file was hand-edited). ' + RECOVERY
+    );
+  }
+
+  // ---- UNRESOLVED: each of the three named map paths must exist on disk. ----
+  for (const binding of MAP_BINDINGS) {
+    if (!fs.existsSync(binding.absPath)) {
+      unresolved.push(
+        'UNRESOLVED: the ' + binding.role + ' map path "' + binding.relPath +
+          '" does not exist on disk (a fabricated / missing map binding). ' +
+          RECOVERY
+      );
+    }
+  }
+
+  // ---- MALFORMED: per-entry well-formedness + EXACTLY the three roles. ----
+  // The maps section must carry EXACTLY three entries, one per declared role,
+  // and NO per-surface row (HIGH-1: a 3-map digest, never a per-surface
+  // registry). An extra entry, a missing role, or a non-declared role key is a
+  // MALFORMED finding.
+  const declaredRoles = MAP_BINDINGS.map((b) => b.role);
+  if (maps.length !== declaredRoles.length) {
+    malformed.push(
+      'MALFORMED: the maps section has ' + maps.length + ' entries; expected ' +
+        'EXACTLY ' + declaredRoles.length + ' (one per map: ' +
+        declaredRoles.join(', ') + '). A per-surface row or an extra entry ' +
+        'breaks the 3-map digest invariant (D-166-03 / HIGH-1). ' + RECOVERY
+    );
+  }
+  const seenRoles = new Set();
+  for (const entry of maps) {
+    if (!entry || typeof entry !== 'object') {
+      malformed.push('MALFORMED: a maps entry is not an object. ' + RECOVERY);
+      continue;
+    }
+    const missing = [];
+    if (typeof entry.role !== 'string' || !entry.role) missing.push('role');
+    if (typeof entry.path !== 'string' || !entry.path) missing.push('path');
+    if (typeof entry.digest !== 'string' || !entry.digest) missing.push('digest');
+    if (missing.length) {
+      malformed.push(
+        'MALFORMED: maps entry ' + JSON.stringify(entry.role || entry.path || '?') +
+          ' is missing required key(s): ' + missing.join(', ') + '. ' + RECOVERY
+      );
+    }
+    if (typeof entry.role === 'string') {
+      if (!declaredRoles.includes(entry.role)) {
+        malformed.push(
+          'MALFORMED: maps entry carries non-declared role "' + entry.role +
+            '" (a per-surface row or an invented role; the only legal roles are ' +
+            declaredRoles.join(', ') + '). ' + RECOVERY
+        );
+      }
+      if (seenRoles.has(entry.role)) {
+        malformed.push(
+          'MALFORMED: duplicate maps role "' + entry.role + '". ' + RECOVERY
+        );
+      }
+      seenRoles.add(entry.role);
+    }
+  }
+
+  // ---- RUNTIME-SURFACE DRIFT (Phase 201-01, D-201-1, fail closed). Each
+  // declared runtime surface's committed digest must equal the sha256 of the
+  // on-disk code file. A missing surface file is UNRESOLVED; a digest that
+  // diverges from the file is STALE and NAMES THE ROLE, so --check fails closed
+  // the moment the declared harness and the running harness diverge. This reads
+  // the COMMITTED manifest (the byte-compare STALE above already covers a
+  // hand-edited / stale committed file); here we prove the declared surface
+  // fingerprints still match the code they fingerprint. Zero Brain/network. ----
+  let committed = null;
+  try {
+    committed = JSON.parse(fs.readFileSync(MANIFEST_PATH, 'utf8'));
+  } catch (_e) {
+    committed = null;
+  }
+  const committedSurfaces =
+    committed && Array.isArray(committed.runtime_surfaces)
+      ? committed.runtime_surfaces
+      : [];
+  for (const binding of RUNTIME_SURFACE_BINDINGS) {
+    if (!fs.existsSync(binding.absPath)) {
+      unresolved.push(
+        'UNRESOLVED: the ' + binding.role + ' runtime surface "' +
+          binding.relPath + '" does not exist on disk (a fabricated / missing ' +
+          'surface binding). ' + RECOVERY
+      );
+      continue;
+    }
+    const declared = committedSurfaces.find(
+      (s) => s && s.role === binding.role
+    );
+    // A committed manifest that never declared this surface is caught by the
+    // byte-compare STALE (the regeneration adds the missing entry); skip here.
+    if (!declared || typeof declared.digest !== 'string') continue;
+    const actual = digestBytes(fs.readFileSync(binding.absPath));
+    if (declared.digest !== actual) {
+      stale.push(
+        'STALE: the ' + binding.role + ' runtime surface (' + binding.relPath +
+          ') digest in the manifest drifts from the on-disk file - the DECLARED ' +
+          'harness and the RUNNING harness have diverged. ' + RECOVERY
+      );
+    }
+  }
+
+  // ---- LARRY-SURFACE DRIFT (Phase 298, SEED-032). Copies the runtime-surface
+  // drift loop above EXACTLY, over LARRY_SURFACE_BINDINGS / committed.larry_surfaces
+  // instead. ----
+  const committedLarrySurfaces =
+    committed && Array.isArray(committed.larry_surfaces) ? committed.larry_surfaces : [];
+  for (const binding of LARRY_SURFACE_BINDINGS) {
+    if (!fs.existsSync(binding.absPath)) {
+      unresolved.push(
+        'UNRESOLVED: the ' + binding.role + ' larry surface "' +
+          binding.relPath + '" does not exist on disk (a fabricated / missing ' +
+          'surface binding). ' + RECOVERY
+      );
+      continue;
+    }
+    const declaredLarry = committedLarrySurfaces.find(
+      (s) => s && s.role === binding.role
+    );
+    if (!declaredLarry || typeof declaredLarry.digest !== 'string') continue;
+    const actualLarry = digestBytes(fs.readFileSync(binding.absPath));
+    if (declaredLarry.digest !== actualLarry) {
+      stale.push(
+        'STALE: the ' + binding.role + ' larry surface (' + binding.relPath +
+          ') digest in the manifest drifts from the on-disk file - the DECLARED ' +
+          'harness and the RUNNING harness have diverged. ' + RECOVERY
+      );
+    }
+  }
+
+  // ---- POLICIES DIRECTORY DRIFT (Phase 298). A directory-digest divergence
+  // between the committed manifest's `policies.digest` and the live directory. ----
+  if (!fs.existsSync(POLICIES_ABS)) {
+    unresolved.push(
+      'UNRESOLVED: the policies directory "' + POLICIES_DIR +
+        '" does not exist on disk (a fabricated / missing policies binding). ' + RECOVERY
+    );
+  } else if (committed && committed.policies && typeof committed.policies.digest === 'string') {
+    const actualPolicies = digestDirectory(POLICIES_ABS);
+    if (committed.policies.digest !== actualPolicies) {
+      stale.push(
+        'STALE: the policies directory (' + POLICIES_DIR + ') digest in the manifest ' +
+          'drifts from the on-disk directory - a policy file changed without regenerating. ' +
+          RECOVERY
+      );
+    }
+  }
+
+  // ---- FIXTURE_REF DRIFT (Phase 298). A directory-digest divergence between
+  // the committed manifest's `fixture_ref.digest` and the live directory. ----
+  if (!fs.existsSync(FIXTURE_ABS)) {
+    unresolved.push(
+      'UNRESOLVED: the fixture directory "' + FIXTURE_DIR +
+        '" does not exist on disk (a fabricated / missing fixture_ref binding). ' + RECOVERY
+    );
+  } else if (committed && committed.fixture_ref && typeof committed.fixture_ref.digest === 'string') {
+    const actualFixture = digestDirectory(FIXTURE_ABS);
+    if (committed.fixture_ref.digest !== actualFixture) {
+      stale.push(
+        'STALE: the fixture_ref directory (' + FIXTURE_DIR + ') digest in the manifest ' +
+          'drifts from the on-disk directory - the converged-room fixture changed without ' +
+          'regenerating. ' + RECOVERY
+      );
+    }
+  }
+
+  return { stale, unresolved, malformed };
+}
+
+// ---------------------------------------------------------------------------
+// runCheck() -- the --check mode. Regenerate the manifest from the LIVE sources
+// in memory, run validateManifest, print each named finding + its recovery line
+// to stderr, and exit non-zero on ANY finding. Exit 0 + an OK line on a clean
+// repo. Mirrors build-orchestration-projection.cjs runCheck. ZERO Brain/network
+// calls (Part 8).
+// ---------------------------------------------------------------------------
+function runCheck() {
+  const manifest = buildManifest();
+  const { stale, unresolved, malformed } = validateManifest(manifest);
+  // Phase 298 (SEED-032): validate every policy file against the closed
+  // schema. An invalid policy file is a MALFORMED finding naming the file and
+  // the failing key; one bad file is reported and skipped, never aborting the
+  // rest of the scan (T-233-01 / T-217-01 self-DoS-avoidance pattern).
+  const { findings: policyFindings } = loadPolicies(POLICIES_ABS);
+  // Phase 298 Plan 13 (R-06): the contract-* policies, run inline as a fourth
+  // finding class beside stale/unresolved/malformed -- a dropped Larry phrase
+  // or a busted Desktop-wire byte budget fails --check by name.
+  const contractFindings = runContractChecks(REPO_ROOT);
+  const all = [...stale, ...unresolved, ...malformed, ...policyFindings, ...contractFindings];
+  if (all.length) {
+    console.error(all.join('\n'));
+    console.error(
+      'Recovery: regenerate the manifest, then re-stage it: ' +
+        'node scripts/build-harness-manifest.cjs'
+    );
+    process.exit(1);
+    return;
+  }
+  console.log('harness-manifest: OK');
+}
+
+// ---------------------------------------------------------------------------
+// writeManifest() -- the default + --refresh write path: re-derive the digests
+// from the live sources and write the artifact (idempotent). --refresh is the
+// manifest's analogue of the connector --refresh-names: it re-reads the sources,
+// re-digests, and re-writes, which is a byte-identical no-op when nothing
+// changed.
+// ---------------------------------------------------------------------------
+function writeManifest() {
+  const manifest = buildManifest();
+  fs.mkdirSync(DATA_DIR, { recursive: true });
+  fs.writeFileSync(MANIFEST_PATH, serializeManifest(manifest));
+  console.log(
+    'Wrote data/harness-manifest.json (' + manifest.maps.length + ' map entries: ' +
+      manifest.maps.map((e) => e.role).join(', ') + '; ' +
+      manifest.runtime_surfaces.length + ' runtime surfaces: ' +
+      manifest.runtime_surfaces.map((e) => e.role).join(', ') + '; ' +
+      manifest.policies.count + ' policies digested; ' +
+      manifest.larry_surfaces.length + ' larry surfaces: ' +
+      manifest.larry_surfaces.map((e) => e.role).join(', ') + ')'
+  );
+}
+
+// ---------------------------------------------------------------------------
+// main() -- the 3-branch entry: default write / --check / --refresh.
+// ---------------------------------------------------------------------------
+function main() {
+  const argv = process.argv.slice(2);
+
+  if (argv.includes('--check')) {
+    runCheck();
+    return;
+  }
+
+  // --refresh re-derives the digests + re-writes (idempotent). The default
+  // branch is the same write path; --refresh is named for parity with the
+  // connector generator's --refresh-names idiom.
+  writeManifest();
+}
+
+if (require.main === module) {
+  main();
+} else {
+  module.exports = {
+    buildManifest,
+    buildMapEntry,
+    buildSurfaceEntry,
+    serializeManifest,
+    validateManifest,
+    digestBytes,
+    digestDirectory,
+    primaryArrayCount,
+    loadPolicies,
+    validatePolicyFile,
+    runContractChecks,
+    MAP_BINDINGS,
+    RUNTIME_SURFACE_BINDINGS,
+    LARRY_SURFACE_BINDINGS,
+    POLICIES_DIR,
+    FIXTURE_DIR,
+    NODE_FIELD_ALLOWLIST,
+    ENTRY_FIELD_ALLOWLIST,
+    MANIFEST_PATH,
+  };
+}