@swarmdo/cli 1.4.8

package/plugins/swarmdo-metaharness/scripts/evolve.mjs

@@ -0,0 +1,244 @@
+#!/usr/bin/env node
+// evolve.mjs — wrapper around `metaharness-darwin evolve <repo>`.
+//
+// ADR-153: Darwin Mode is the WRITE layer that closes the loop ADR-150's
+// READ layer (score / genome / mcp-scan / threat-model / oia-audit) opens.
+// score+genome tell you where the harness IS; darwin evolve tells you which
+// mutation makes it provably better, without retraining the foundation model.
+//
+// SAFETY (ADR-153 §"Safety model"):
+//   - Variant generation + sandbox happen under <repo>/.metaharness/variants/,
+//     never in the repo root. Upstream `inspectVariant()` rejects nested dirs,
+//     symlinks, secret-shaped strings, shell-out / network / dynamic-eval
+//     before any variant runs. Exit code 99 is reserved for "safety-disqualified".
+//   - --confirm is REQUIRED. Without it the script prints a plan and exits 0
+//     (mirrors mint.mjs convention). This is in addition to upstream's safety
+//     layer — defense in depth at the swarmdo boundary.
+//   - Default --generations 3 --children 3 (small) — anything larger is opt-in.
+//     Real evolutions are minutes-to-hours; swarmdo's default sandbox config
+//     errs toward "show me the mechanism works" over "find a winner today".
+//
+// USAGE
+//   node scripts/evolve.mjs --repo .                                       # dry-run plan
+//   node scripts/evolve.mjs --repo . --confirm                             # actually evolve
+//   node scripts/evolve.mjs --repo . --confirm --generations 5 --children 3
+//   node scripts/evolve.mjs --repo . --confirm --sandbox mock              # no real tests
+//   node scripts/evolve.mjs --repo . --confirm --selection pareto
+//
+// EXIT CODES
+//   0  evolved OK (or dry-run, or degraded — MetaHarness Darwin not available)
+//   1  --alert-on-no-improvement and champion did not beat parent
+//   2  config error or evolution failure
+//   99 reserved — upstream "safety-disqualified" (propagated)
+
+import { runDarwinAsync, emitDarwinDegradedJsonAndExit } from './_darwin.mjs';
+import { existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+const ARGS = (() => {
+  const a = {
+    repo: '.',
+    generations: 3,
+    children: 3,
+    concurrency: 2,
+    seed: null,
+    sandbox: 'real',
+    selection: null,
+    crossover: false,
+    epistasis: false,
+    curriculum: false,
+    riskBudget: null,
+    fdr: null,
+    tie: null,
+    bench: null,
+    mutator: 'deterministic',
+    swarmllmUrl: null,
+    swarmllmModel: null,
+    confirm: false,
+    alertOnNoImprovement: false,
+    format: 'json',
+    timeoutMs: null,  // computed below if unset
+  };
+  for (let i = 2; i < process.argv.length; i++) {
+    const v = process.argv[i];
+    if (v === '--repo') a.repo = process.argv[++i];
+    else if (v === '--generations') a.generations = parseInt(process.argv[++i], 10);
+    else if (v === '--children') a.children = parseInt(process.argv[++i], 10);
+    else if (v === '--concurrency') a.concurrency = parseInt(process.argv[++i], 10);
+    else if (v === '--seed') a.seed = parseInt(process.argv[++i], 10);
+    else if (v === '--sandbox') a.sandbox = process.argv[++i];
+    else if (v === '--selection') a.selection = process.argv[++i];
+    else if (v === '--crossover') a.crossover = true;
+    else if (v === '--epistasis') a.epistasis = true;
+    else if (v === '--curriculum') a.curriculum = true;
+    else if (v === '--risk-budget') a.riskBudget = parseInt(process.argv[++i], 10);
+    else if (v === '--fdr') a.fdr = parseFloat(process.argv[++i]);
+    else if (v === '--tie') a.tie = process.argv[++i];
+    else if (v === '--bench') a.bench = process.argv[++i];
+    else if (v === '--mutator') a.mutator = process.argv[++i];
+    else if (v === '--swarmllm-url') a.swarmllmUrl = process.argv[++i];
+    else if (v === '--swarmllm-model') a.swarmllmModel = process.argv[++i];
+    else if (v === '--confirm') a.confirm = true;
+    else if (v === '--alert-on-no-improvement') a.alertOnNoImprovement = true;
+    else if (v === '--format') a.format = process.argv[++i];
+    else if (v === '--timeout-ms') a.timeoutMs = parseInt(process.argv[++i], 10);
+  }
+  return a;
+})();
+
+function safetyChecks() {
+  const repoPath = resolve(ARGS.repo);
+  if (!existsSync(repoPath)) {
+    console.error(`evolve: repo path does not exist: ${repoPath}`);
+    process.exit(2);
+  }
+  if (ARGS.generations < 1 || ARGS.generations > 50) {
+    console.error('evolve: --generations must be 1..50 (swarmdo cap; upstream supports more)');
+    process.exit(2);
+  }
+  if (ARGS.children < 1 || ARGS.children > 20) {
+    console.error('evolve: --children must be 1..20 (swarmdo cap)');
+    process.exit(2);
+  }
+  if (ARGS.concurrency < 1 || ARGS.concurrency > 8) {
+    console.error('evolve: --concurrency must be 1..8 (swarmdo cap)');
+    process.exit(2);
+  }
+  if (!['real', 'mock', 'agent'].includes(ARGS.sandbox)) {
+    console.error(`evolve: --sandbox must be real|mock|agent (got: ${ARGS.sandbox})`);
+    process.exit(2);
+  }
+  if (ARGS.selection && !['quality-diversity', 'behavioral-diversity', 'niche-steering', 'clade', 'pareto'].includes(ARGS.selection)) {
+    console.error(`evolve: --selection must be one of quality-diversity|behavioral-diversity|niche-steering|clade|pareto`);
+    process.exit(2);
+  }
+  if (!['deterministic', 'swarmllm'].includes(ARGS.mutator)) {
+    console.error(`evolve: --mutator must be deterministic|swarmllm`);
+    process.exit(2);
+  }
+  return repoPath;
+}
+
+// Compute a sensible timeout from the search shape if caller didn't specify.
+// Rough budget: each variant ~= 30s (sandbox test command + safety inspect),
+// total ~= generations × children × per-variant / concurrency.
+function defaultTimeoutMs() {
+  const perVariantMs = ARGS.sandbox === 'mock' ? 2_000 : 60_000;
+  const variants = ARGS.generations * ARGS.children;
+  const parallelism = Math.min(ARGS.concurrency, variants);
+  const wall = Math.ceil(variants / parallelism) * perVariantMs;
+  // Add 30s overhead for npm install + initial profile + final report.
+  return Math.max(60_000, wall + 30_000);
+}
+
+async function main() {
+  const repoPath = safetyChecks();
+
+  const plan = {
+    binary: 'metaharness-darwin evolve',
+    repo: repoPath,
+    generations: ARGS.generations,
+    children: ARGS.children,
+    concurrency: ARGS.concurrency,
+    sandbox: ARGS.sandbox,
+    selection: ARGS.selection,
+    crossover: ARGS.crossover,
+    epistasis: ARGS.epistasis,
+    curriculum: ARGS.curriculum,
+    mutator: ARGS.mutator,
+    estVariants: ARGS.generations * ARGS.children,
+    timeoutMs: ARGS.timeoutMs ?? defaultTimeoutMs(),
+    output: `${repoPath}/.metaharness/{archive.json, lineage.json, variants/, runs/, reports/winner.json}`,
+  };
+
+  if (!ARGS.confirm) {
+    const payload = {
+      success: true,
+      data: { plan, dryRun: true, message: 'Pass --confirm to run the evolution.' },
+      generatedAt: new Date().toISOString(),
+    };
+    console.log(JSON.stringify(payload, null, 2));
+    process.exit(0);
+  }
+
+  const cliArgs = ['evolve', repoPath,
+    '--generations', String(ARGS.generations),
+    '--children', String(ARGS.children),
+    '--concurrency', String(ARGS.concurrency),
+    '--sandbox', ARGS.sandbox,
+    '--mutator', ARGS.mutator,
+  ];
+  if (ARGS.seed != null) cliArgs.push('--seed', String(ARGS.seed));
+  if (ARGS.selection) cliArgs.push('--selection', ARGS.selection);
+  if (ARGS.crossover) cliArgs.push('--crossover');
+  if (ARGS.epistasis) cliArgs.push('--epistasis');
+  if (ARGS.curriculum) cliArgs.push('--curriculum');
+  if (ARGS.riskBudget != null) cliArgs.push('--risk-budget', String(ARGS.riskBudget));
+  if (ARGS.fdr != null) cliArgs.push('--fdr', String(ARGS.fdr));
+  if (ARGS.tie) cliArgs.push('--tie', ARGS.tie);
+  if (ARGS.bench) cliArgs.push('--bench', ARGS.bench);
+  if (ARGS.swarmllmUrl) cliArgs.push('--swarmllm-url', ARGS.swarmllmUrl);
+  if (ARGS.swarmllmModel) cliArgs.push('--swarmllm-model', ARGS.swarmllmModel);
+
+  // Forward progress lines to stderr so the user sees per-generation activity
+  // (subprocess-of-an-MCP-tool case: this still surfaces in the agent log).
+  const r = await runDarwinAsync(cliArgs, {
+    timeoutMs: plan.timeoutMs,
+    onProgress: (line) => { if (line.trim()) process.stderr.write(`[evolve] ${line}\n`); },
+  });
+
+  if (r.degraded) {
+    emitDarwinDegradedJsonAndExit(r.reason);
+    return;
+  }
+
+  // Upstream exit code 99 = safety-disqualified — propagate verbatim so
+  // CI gates can distinguish "evolution failed" from "evolution surfaced
+  // a safety-tripping mutation". This is a designed-in tripwire, not an
+  // error the swarmdo layer should remap.
+  if (r.exitCode === 99) {
+    const payload = {
+      success: false,
+      data: { safetyDisqualified: true, hint: 'A variant tripped the safety inspection layer. See <repo>/.metaharness/runs/ for which surface and pattern.' },
+      stderrTail: r.stderr.slice(-400),
+      durationMs: r.durationMs,
+      generatedAt: new Date().toISOString(),
+    };
+    console.log(JSON.stringify(payload, null, 2));
+    process.exit(99);
+  }
+
+  if (r.exitCode !== 0) {
+    const payload = {
+      success: false,
+      data: { exitCode: r.exitCode, stderrTail: r.stderr.slice(-400) },
+      generatedAt: new Date().toISOString(),
+    };
+    console.log(JSON.stringify(payload, null, 2));
+    process.exit(2);
+  }
+
+  const champion = r.json || {};
+  const noImprovement = champion.parentScore != null && champion.championScore != null &&
+                        champion.championScore <= champion.parentScore;
+
+  const payload = {
+    success: true,
+    data: {
+      ...champion,
+      plan,
+      durationMs: r.durationMs,
+      improved: !noImprovement,
+    },
+    generatedAt: new Date().toISOString(),
+  };
+
+  console.log(JSON.stringify(payload, null, 2));
+  if (ARGS.alertOnNoImprovement && noImprovement) process.exit(1);
+  process.exit(0);
+}
+
+main().catch((e) => {
+  console.error(`evolve: unexpected failure: ${e?.message ?? e}`);
+  process.exit(2);
+});

package/plugins/swarmdo-metaharness/scripts/genome.mjs

@@ -0,0 +1,80 @@
+#!/usr/bin/env node
+// genome.mjs — wrapper around `metaharness genome <path>`.
+//
+// Returns the 7-section readiness report: repo_type / agent_topology /
+// risk_score / mcp_surface / test_confidence / publish_readiness +
+// verdict (ready | needs-work | blocked). Reads-only.
+//
+// USAGE
+//   node scripts/genome.mjs
+//   node scripts/genome.mjs --path <dir> --alert-on-risk-above 0.5 --format json
+//
+// EXIT CODES
+//   0  OK
+//   1  --alert-on-risk-above threshold breached
+//   2  config error or genome failure
+
+import { runMetaharness, emitDegradedJsonAndExit } from './_harness.mjs';
+
+const ARGS = (() => {
+  const a = { path: '.', format: 'json', alertRiskAbove: null };
+  for (let i = 2; i < process.argv.length; i++) {
+    const v = process.argv[i];
+    if (v === '--path') a.path = process.argv[++i];
+    else if (v === '--alert-on-risk-above') a.alertRiskAbove = parseFloat(process.argv[++i]);
+    else if (v === '--format') a.format = process.argv[++i];
+  }
+  return a;
+})();
+
+function main() {
+  const r = runMetaharness(['genome', ARGS.path]);
+  if (r.degraded) { emitDegradedJsonAndExit(r.reason); return; }
+  if (r.exitCode !== 0 || !r.json) {
+    console.error(`genome: metaharness exited ${r.exitCode}`);
+    if (r.stderr) console.error(r.stderr.slice(0, 400));
+    process.exit(2);
+  }
+  // iter 112 — generatedAt for consistency with other --format json outputs
+  const payload = { ...r.json, path: ARGS.path, durationMs: r.durationMs,
+    generatedAt: new Date().toISOString() };
+
+  if (ARGS.alertRiskAbove !== null) {
+    if (!isFinite(ARGS.alertRiskAbove)) {
+      console.error(`genome: --alert-on-risk-above must be a finite number`);
+      process.exit(2);
+    }
+    payload.alert = {
+      threshold: ARGS.alertRiskAbove,
+      triggered: typeof payload.risk_score === 'number' && payload.risk_score > ARGS.alertRiskAbove,
+      reason: typeof payload.risk_score === 'number' && payload.risk_score > ARGS.alertRiskAbove
+        ? `risk_score ${payload.risk_score} > ${ARGS.alertRiskAbove}`
+        : `risk_score ${payload.risk_score ?? 'unknown'} ≤ ${ARGS.alertRiskAbove} — OK`,
+    };
+  }
+
+  if (ARGS.format === 'json') {
+    console.log(JSON.stringify(payload, null, 2));
+  } else {
+    console.log(`# harness-genome — ${ARGS.path}`);
+    console.log('');
+    console.log(`| Section | Value |`);
+    console.log(`|---|---|`);
+    console.log(`| repo_type | ${payload.repo_type ?? '—'} |`);
+    console.log(`| agent_topology | ${(payload.agent_topology || []).join(', ') || '—'} |`);
+    console.log(`| risk_score | ${payload.risk_score ?? '—'} |`);
+    console.log(`| mcp_surface | ${payload.mcp_surface ?? '—'} |`);
+    console.log(`| test_confidence | ${payload.test_confidence ?? '—'} |`);
+    console.log(`| publish_readiness | ${payload.publish_readiness ?? '—'} |`);
+    console.log(`| **duration** | ${payload.durationMs}ms |`);
+    console.log('');
+    if (payload.alert) {
+      console.log(payload.alert.triggered ? `⚠ **ALERT**: ${payload.alert.reason}` : `✓ ${payload.alert.reason}`);
+      console.log('');
+    }
+  }
+
+  if (payload.alert?.triggered) process.exit(1);
+}
+
+main();

package/plugins/swarmdo-metaharness/scripts/mcp-scan.mjs

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+// mcp-scan.mjs — wrapper around `harness mcp-scan <path>`.
+//
+// Static security scan of the harness's declared MCP surface. Reads
+// .mcp/servers.json + .harness/claims.json. Pure-read, no dispatch.
+//
+// USAGE
+//   node scripts/mcp-scan.mjs                           # current dir
+//   node scripts/mcp-scan.mjs --path <dir>
+//   node scripts/mcp-scan.mjs --fail-on high            # exit 1 if any HIGH finding (default)
+//   node scripts/mcp-scan.mjs --fail-on medium          # also fail on MEDIUM
+//   node scripts/mcp-scan.mjs --format json
+//
+// EXIT CODES
+//   0  no findings at or above --fail-on (or degraded)
+//   1  at least one finding ≥ --fail-on severity
+//   2  config error or scan failure
+
+// iter 50 — parseMcpScanText extracted to _harness.mjs so oia-audit
+// can use the same parser without duplicating logic.
+// iter 63 — SEVERITY_RANK also moves to _harness.mjs (single source of
+// truth; previously this file had a literal that diverged from oia-audit's).
+import { runHarness, emitDegradedJsonAndExit, parseMcpScanText, SEVERITY_RANK, rankSeverity } from './_harness.mjs';
+
+const ARGS = (() => {
+  const a = { path: '.', format: 'json', failOn: 'high' };
+  for (let i = 2; i < process.argv.length; i++) {
+    const v = process.argv[i];
+    if (v === '--path') a.path = process.argv[++i];
+    else if (v === '--fail-on') a.failOn = String(process.argv[++i] || 'high').toLowerCase();
+    else if (v === '--format') a.format = process.argv[++i];
+  }
+  return a;
+})();
+
+function main() {
+  if (!SEVERITY_RANK[ARGS.failOn]) {
+    console.error(`mcp-scan: --fail-on must be one of low|medium|high; got ${ARGS.failOn}`);
+    process.exit(2);
+  }
+  const r = runHarness(['mcp-scan', ARGS.path]);
+  if (r.degraded) { emitDegradedJsonAndExit(r.reason); return; }
+  if (r.exitCode !== 0 && r.exitCode !== 1) {
+    // exit 1 from harness can be "findings present"; only treat other
+    // non-zero as a real failure.
+    console.error(`mcp-scan: harness exited ${r.exitCode}`);
+    if (r.stderr) console.error(r.stderr.slice(0, 400));
+    process.exit(2);
+  }
+  // The JSON output shape from `harness mcp-scan` historically didn't
+  // include structured findings — it emits text even with --json. Parse
+  // the text into findings (iter 50) so audit-trend's introduced/cleared
+  // diff actually works. If a future upstream version DOES emit
+  // findings[], the parsed-text findings are overridden.
+  const parsed = parseMcpScanText(r.stdout);
+  // iter 124 — normalize finding shape so consumers see a stable contract.
+  // Upstream metaharness@0.1.x JSON path emits {id, severity, title, detail};
+  // our parseMcpScanText emits {severity, message}. Project both into a
+  // unified {severity, message, title?, detail?} so audit-trend's fingerprint
+  // diff and test-mcp-tools' assertions don't care which path produced them.
+  const rawFindings = Array.isArray(r.json?.findings) ? r.json.findings : parsed.findings;
+  const findings = rawFindings.map((f) => ({
+    ...f,
+    message: typeof f.message === 'string' && f.message
+      ? f.message
+      : (f.title || f.detail || ''),
+  }));
+  const payload = {
+    ...(r.json ?? {}),
+    findings,
+    summary: r.json?.summary ?? parsed.summary,
+    rawStdout: r.stdout.slice(0, 400),
+  };
+  const threshold = SEVERITY_RANK[ARGS.failOn];
+  // iter 63 — rankSeverity() safe lookup. Pre-iter-63 `undefined >= 3`
+  // was false → unknown-severity findings (e.g., warn / error) were
+  // silently excluded from the offending set, weakening --fail-on alerts.
+  const offending = findings.filter((f) => rankSeverity(f.severity) >= threshold);
+
+  const alert = {
+    threshold: ARGS.failOn,
+    triggered: offending.length > 0,
+    offendingCount: offending.length,
+    reason: offending.length > 0
+      ? `${offending.length} finding(s) at or above ${ARGS.failOn} severity`
+      : `no findings at or above ${ARGS.failOn} severity — OK`,
+  };
+
+  if (ARGS.format === 'json') {
+    // iter 112 — generatedAt for consistency with other --format json outputs
+    console.log(JSON.stringify({
+      ...payload, durationMs: r.durationMs, alert,
+      generatedAt: new Date().toISOString(),
+    }, null, 2));
+  } else {
+    console.log(`# harness mcp-scan — ${ARGS.path}`);
+    console.log('');
+    console.log(`Total findings: ${findings.length}`);
+    console.log(`| Severity | ID | Server | Tool | Message |`);
+    console.log(`|---|---|---|---|---|`);
+    for (const f of findings.slice(0, 50)) {
+      console.log(`| ${f.severity} | ${f.id ?? '—'} | ${f.server ?? '—'} | ${f.tool ?? '—'} | ${f.message ?? ''} |`);
+    }
+    console.log('');
+    console.log(alert.triggered ? `⚠ **ALERT**: ${alert.reason}` : `✓ ${alert.reason}`);
+  }
+
+  if (alert.triggered) process.exit(1);
+}
+
+main();

package/plugins/swarmdo-metaharness/scripts/mint.mjs

@@ -0,0 +1,119 @@
+#!/usr/bin/env node
+// mint.mjs — wrapper around `metaharness new <name> --template <id> --host <id>`.
+//
+// SAFETY (ADR-150 architectural constraint + "executing actions with care"):
+//   - Target directory MUST be explicitly specified via --target. Defaults to
+//     a temp dir under /tmp/swarmdo-mint-<timestamp>/ if not given — never the
+//     project root (swarmdo behavioral rule "never save to root folder").
+//   - --confirm flag required. Without it the script prints a dry-run plan
+//     and exits 0 without writing files. This honors the "destructive-action
+//     confirmation" pattern in swarmdo's CLAUDE.md.
+//
+// USAGE
+//   node scripts/mint.mjs --name my-harness --template vertical:coding --host claude-code
+//     # → prints dry-run plan, exits 0
+//   node scripts/mint.mjs --name my-harness --template vertical:coding --host claude-code --target /tmp/foo --confirm
+//     # → actually scaffolds
+
+import { runMetaharness, emitDegradedJsonAndExit } from './_harness.mjs';
+import { existsSync, mkdirSync } from 'node:fs';
+import { resolve, dirname, basename } from 'node:path';
+import { tmpdir } from 'node:os';
+
+const ARGS = (() => {
+  const a = { name: null, template: null, host: 'claude-code', target: null, confirm: false, format: 'json' };
+  for (let i = 2; i < process.argv.length; i++) {
+    const v = process.argv[i];
+    if (v === '--name') a.name = process.argv[++i];
+    else if (v === '--template') a.template = process.argv[++i];
+    else if (v === '--host') a.host = process.argv[++i];
+    else if (v === '--target') a.target = process.argv[++i];
+    else if (v === '--confirm') a.confirm = true;
+    else if (v === '--format') a.format = process.argv[++i];
+  }
+  return a;
+})();
+
+function safetyChecks() {
+  if (!ARGS.name) {
+    console.error('mint: --name is required');
+    process.exit(2);
+  }
+  if (!ARGS.template) {
+    console.error('mint: --template is required (e.g. vertical:coding, minimal)');
+    process.exit(2);
+  }
+  if (!ARGS.target) {
+    ARGS.target = resolve(tmpdir(), `swarmdo-mint-${Date.now()}-${ARGS.name}`);
+  }
+  const targetAbs = resolve(ARGS.target);
+  const repoRoot = resolve(process.cwd());
+  if (targetAbs === repoRoot) {
+    console.error(`mint: refusing to write to project root (${repoRoot}). Specify a different --target.`);
+    process.exit(2);
+  }
+  if (targetAbs.startsWith(repoRoot + '/')) {
+    console.error(`mint: refusing to write inside the calling repo root. Use a --target outside ${repoRoot}.`);
+    process.exit(2);
+  }
+}
+
+function main() {
+  safetyChecks();
+  const plan = {
+    action: 'metaharness new',
+    name: ARGS.name,
+    template: ARGS.template,
+    host: ARGS.host,
+    target: ARGS.target,
+    confirm: ARGS.confirm,
+    willWrite: ARGS.confirm,
+  };
+  if (!ARGS.confirm) {
+    if (ARGS.format === 'json') console.log(JSON.stringify({ ...plan, dryRun: true }, null, 2));
+    else {
+      console.log(`# harness-mint (dry-run)`);
+      console.log('');
+      for (const [k, v] of Object.entries(plan)) console.log(`- ${k}: ${v}`);
+      console.log('');
+      console.log('Re-run with `--confirm` to actually scaffold.');
+    }
+    process.exit(0);
+  }
+  if (existsSync(ARGS.target)) {
+    console.error(`mint: target ${ARGS.target} already exists`);
+    process.exit(2);
+  }
+  // ITER 27 FIX (forward-compatible) — at the time of writing,
+  // metaharness@0.1.12 silently ignored the --target flag and wrote
+  // to $CWD/<name> instead. Upstream issue #9
+  // (upstream/agent-harness-generator) was filed + fixed in 0.1.13
+  // within ~20 min — but this workaround is intentionally
+  // forward-compatible: setting `cwd: dirname(target)` + passing
+  // `basename(target)` as <name> produces the same correct landing
+  // path on BOTH broken (0.1.12) and fixed (0.1.13+) upstream
+  // versions. Keeping it as belt-and-braces against any future
+  // regression. See `iter 29` for the verification log.
+  const parentDir = dirname(ARGS.target);
+  const cliName = basename(ARGS.target);
+  mkdirSync(parentDir, { recursive: true });
+  const r = runMetaharness(
+    ['new', cliName, '--template', ARGS.template, '--host', ARGS.host],
+    { json: false, cwd: parentDir, timeoutMs: 180_000 },
+  );
+  if (r.degraded) { emitDegradedJsonAndExit(r.reason); return; }
+  if (r.exitCode !== 0) {
+    console.error(`mint: metaharness exited ${r.exitCode}`);
+    if (r.stderr) console.error(r.stderr.slice(0, 400));
+    process.exit(2);
+  }
+  const result = { ...plan, exitCode: r.exitCode, durationMs: r.durationMs, ok: true };
+  if (ARGS.format === 'json') console.log(JSON.stringify(result, null, 2));
+  else {
+    console.log(`# harness-mint — done`);
+    console.log('');
+    for (const [k, v] of Object.entries(result)) console.log(`- ${k}: ${v}`);
+  }
+}
+
+main();