@swarmdo/cli 1.4.8

package/plugins/swarmdo-metaharness/scripts/oia-audit.mjs

@@ -0,0 +1,228 @@
+#!/usr/bin/env node
+// oia-audit.mjs — composite Phase-2 worker (ADR-150).
+//
+// Bundles three MetaHarness static-analysis surfaces into one timestamped
+// audit record:
+//   - harness oia-manifest   (Open Infrastructure Architecture L1-L9 alignment)
+//   - harness threat-model   (categorized MCP-surface threat report)
+//   - harness mcp-scan       (per-server/tool policy + permissions + deps)
+//
+// The combined record is stored in the `metaharness-audit` memory
+// namespace, keyed by ISO timestamp. Designed to be invoked on a cron
+// schedule (e.g. weekly) so audit drift is visible over time.
+//
+// USAGE
+//   node scripts/oia-audit.mjs                      # run + store
+//   node scripts/oia-audit.mjs --path <dir>         # audit specific dir
+//   node scripts/oia-audit.mjs --dry-run            # don't write to memory
+//   node scripts/oia-audit.mjs --alert-on-worst high
+//                                                  # exit 1 if threat-model worst >= high
+//   node scripts/oia-audit.mjs --format json
+//
+// EXIT CODES
+//   0  audit OK (or degraded)
+//   1  --alert-on-worst threshold exceeded
+//   2  config error or audit failure
+
+import { spawnSync } from 'node:child_process';
+// iter 63 — SEVERITY_RANK + rankSeverity consolidated to _harness.mjs
+// (was local in iter 62; now shared with audit-trend + mcp-scan).
+import { runHarness, runMetaharness, runHarnessAsync, runMetaharnessAsync, emitDegradedJsonAndExit, parseMcpScanText, SEVERITY_RANK, rankSeverity } from './_harness.mjs';
+
+// iter 63 — SEVERITY_RANK + rankSeverity moved to _harness.mjs (single
+// source of truth). The local copy from iter 62 is gone; the imports
+// at the top of this file provide the same names.
+const NS = process.env.OIA_AUDIT_NAMESPACE || 'metaharness-audit';
+const CLI_PKG = process.env.CLI_CORE === '1'
+  ? '@swarmdo/cli-core@alpha'
+  : '@swarmdo/cli@latest';
+
+const ARGS = (() => {
+  const a = { path: '.', format: 'json', dryRun: false, alertWorst: null };
+  for (let i = 2; i < process.argv.length; i++) {
+    const v = process.argv[i];
+    if (v === '--path') a.path = process.argv[++i];
+    else if (v === '--dry-run') a.dryRun = true;
+    else if (v === '--alert-on-worst') a.alertWorst = String(process.argv[++i] || '').toLowerCase();
+    else if (v === '--format') a.format = process.argv[++i];
+  }
+  return a;
+})();
+
+// iter 47 — the `harness` and `metaharness` CLIs both have `score` /
+// `genome` subcommands but with DIFFERENT output schemas. For the
+// fingerprint to be consumable by _similarity.mjs (which expects the
+// metaharness CLI shape: harnessFit/compileConfidence/agent_topology),
+// we need to dispatch to runMetaharness for score+genome, not runHarness.
+// iter 56 — annotated runOne result is identical for sync/async paths.
+function annotateOne(r, label) {
+  let json = r.json;
+  if (label === 'mcp-scan' && !json && !r.degraded && r.stdout) {
+    const parsed = parseMcpScanText(r.stdout);
+    json = { findings: parsed.findings, summary: parsed.summary, rawStdout: r.stdout.slice(0, 400) };
+  }
+  return {
+    label,
+    exitCode: r.exitCode,
+    degraded: r.degraded,
+    reason: r.degraded ? r.reason : null,
+    json,
+    durationMs: r.durationMs,
+    stderrTail: r.degraded ? (r.stderr || '').slice(-200) : null,
+  };
+}
+
+function runOne(args, label, engine = 'harness') {
+  const r = engine === 'metaharness' ? runMetaharness(args) : runHarness(args);
+  return annotateOne(r, label);
+}
+
+// iter 56 — parallel variant. The composite audit's 5 subprocess calls
+// are mutually independent (each scans the same path read-only), so
+// they can run concurrently. Worst-case wall-clock drops from
+// 5×DEFAULT_TIMEOUT_MS (sequential) to 1×DEFAULT_TIMEOUT_MS (parallel)
+// — the iter-55-flagged gap (oia-audit timeout under unreachable
+// registry) is closed by this.
+async function runAllParallel(path) {
+  const tasks = [
+    runHarnessAsync(['oia-manifest', path]).then((r) => ['oiaManifest', annotateOne(r, 'oia-manifest')]),
+    runHarnessAsync(['threat-model', path]).then((r) => ['threatModel', annotateOne(r, 'threat-model')]),
+    runHarnessAsync(['mcp-scan', path]).then((r) => ['mcpScan', annotateOne(r, 'mcp-scan')]),
+    runMetaharnessAsync(['score', path]).then((r) => ['score', annotateOne(r, 'score')]),
+    runMetaharnessAsync(['genome', path]).then((r) => ['genome', annotateOne(r, 'genome')]),
+  ];
+  const results = await Promise.all(tasks);
+  return Object.fromEntries(results);
+}
+
+function persist(payload) {
+  const key = `audit-${new Date().toISOString().replace(/[:.]/g, '-')}`;
+  const r = spawnSync('npx', [
+    CLI_PKG, 'memory', 'store',
+    '--namespace', NS,
+    '--key', key,
+    '--value', JSON.stringify(payload),
+  ], { stdio: ['ignore', 'pipe', 'pipe'], encoding: 'utf-8', shell: process.platform === 'win32' });
+  return {
+    ok: r.status === 0,
+    namespace: NS,
+    key,
+    error: r.status === 0 ? null : (r.stderr || '').slice(0, 200),
+  };
+}
+
+async function main() {
+  if (ARGS.alertWorst !== null && !SEVERITY_RANK.hasOwnProperty(ARGS.alertWorst)) {
+    console.error(`oia-audit: --alert-on-worst must be one of clean|low|medium|high; got ${ARGS.alertWorst}`);
+    process.exit(2);
+  }
+
+  const startedAt = new Date().toISOString();
+  const wallStart = Date.now();
+  // iter 56 — run the 5 sub-audits in parallel (was sequential pre-iter-56).
+  // Worst-case wall-clock improves from 5×TIMEOUT to 1×TIMEOUT in the
+  // unreachable-registry case; the happy path improves from sum-of-durations
+  // to max-of-durations (typically ~2-4× faster).
+  const all = await runAllParallel(ARGS.path);
+  const wallMs = Date.now() - wallStart;
+  const { oiaManifest: oia, threatModel: tm, mcpScan: mcp, score, genome } = all;
+
+  // If all FIVE say "metaharness not available", surface the degraded
+  // payload exactly once and exit 0 (architectural constraint #3).
+  if (oia.degraded && tm.degraded && mcp.degraded && score.degraded && genome.degraded) {
+    emitDegradedJsonAndExit('metaharness-not-available');
+    return;
+  }
+
+  // Aggregate the worst-severity signal across mcp-scan + threat-model.
+  // iter 62 — safe lookup using `?? 0` so unknown severities don't
+  // silently bump composite via NaN-comparison (was: `acc | undefined`
+  // → reduce never updated). Now any [WARN]/[CRITICAL]/[ERROR] finding
+  // correctly elevates composite worst.
+  const tmWorst = String(tm.json?.worst || 'clean').toLowerCase();
+  const mcpFindings = Array.isArray(mcp.json?.findings) ? mcp.json.findings : [];
+  // iter 63 — rankSeverity() from _harness.mjs handles unknown-severity
+  // safely (returns 0 instead of undefined) so the reduce never sees NaN.
+  const mcpWorst = mcpFindings.reduce((acc, f) => {
+    const s = String(f.severity || 'low').toLowerCase();
+    return rankSeverity(s) > rankSeverity(acc) ? s : acc;
+  }, 'clean');
+  const compositeWorst = rankSeverity(tmWorst) > rankSeverity(mcpWorst) ? tmWorst : mcpWorst;
+
+  let alertTriggered = false;
+  let alertReason = null;
+  if (ARGS.alertWorst !== null) {
+    const threshold = rankSeverity(ARGS.alertWorst);
+    const compositeRank = rankSeverity(compositeWorst);
+    if (compositeRank >= threshold && threshold > 0) {
+      alertTriggered = true;
+      alertReason = `composite worst=${compositeWorst} ≥ ${ARGS.alertWorst}`;
+    }
+  }
+
+  // iter 59 — surface parallelization metrics. wallMs is the actual
+  // time the 5 subprocess race took (max of components); the sum of
+  // component.durationMs is what a SERIAL implementation would have
+  // taken. A future smoke gate compares them to catch silent
+  // serialization regression.
+  const sumComponentMs = Object.values(all).reduce(
+    (a, c) => a + (c?.durationMs ?? 0), 0);
+  const payload = {
+    path: ARGS.path,
+    startedAt,
+    finishedAt: new Date().toISOString(),
+    timing: {
+      wallMs,
+      sumComponentMs,
+      parallelSpeedup: sumComponentMs > 0
+        ? Math.round((sumComponentMs / Math.max(wallMs, 1)) * 100) / 100 : 0,
+    },
+    composite: { worst: compositeWorst, threatModelWorst: tmWorst, mcpScanWorst: mcpWorst },
+    components: { oiaManifest: oia, threatModel: tm, mcpScan: mcp, score, genome },
+    // iter 38 — denormalized harness fingerprint for cheap similarity().
+    // Mirrors the shape `_similarity.mjs::similarity()` expects so
+    // audit-trend can call it without reshuffling components.
+    fingerprint: {
+      score: score?.json && !score.degraded ? score.json : null,
+      genome: genome?.json && !genome.degraded ? genome.json : null,
+    },
+    alert: ARGS.alertWorst !== null ? {
+      threshold: ARGS.alertWorst,
+      triggered: alertTriggered,
+      reason: alertReason || `composite worst=${compositeWorst} < ${ARGS.alertWorst} — OK`,
+    } : null,
+    persisted: null,
+  };
+
+  if (!ARGS.dryRun) {
+    payload.persisted = persist(payload);
+  }
+
+  if (ARGS.format === 'json') {
+    console.log(JSON.stringify(payload, null, 2));
+  } else {
+    console.log(`# oia-audit — ${ARGS.path}`);
+    console.log('');
+    console.log(`| Component | Exit | Degraded | Duration |`);
+    console.log(`|---|---:|:---:|---:|`);
+    console.log(`| oia-manifest | ${oia.exitCode} | ${oia.degraded ? '⚠' : '✓'} | ${oia.durationMs}ms |`);
+    console.log(`| threat-model | ${tm.exitCode} | ${tm.degraded ? '⚠' : '✓'} | ${tm.durationMs}ms |`);
+    console.log(`| mcp-scan | ${mcp.exitCode} | ${mcp.degraded ? '⚠' : '✓'} | ${mcp.durationMs}ms |`);
+    console.log('');
+    console.log(`Composite worst severity: **${compositeWorst}** (tm=${tmWorst}, mcp=${mcpWorst})`);
+    if (payload.persisted) {
+      console.log(`Persisted: ${payload.persisted.ok ? `${payload.persisted.namespace}:${payload.persisted.key}` : `FAILED: ${payload.persisted.error}`}`);
+    }
+    if (payload.alert) {
+      console.log('');
+      console.log(payload.alert.triggered ? `⚠ **ALERT**: ${payload.alert.reason}` : `✓ ${payload.alert.reason}`);
+    }
+  }
+
+  if (alertTriggered) process.exit(1);
+}
+
+main().catch((e) => {
+  console.error('oia-audit crashed:', e?.message ?? e);
+  process.exit(2);
+});

package/plugins/swarmdo-metaharness/scripts/router-parallel-analyze.mjs

@@ -0,0 +1,250 @@
+#!/usr/bin/env node
+// router-parallel-analyze.mjs — ADR-150 Phase 2 SelfEvolvingRouter
+// promotion gate.
+//
+// Reads paired routing decisions (Thompson bandit pick + SelfEvolvingRouter
+// pick, both with measured outcomes) from a JSONL trajectory file and
+// computes the THREE PROMOTION CRITERIA from ADR-150 review-round-1:
+//
+//   (a) qualityScore improvement > 2%           (relative)
+//   (b) usdPerDecision increase < 1%             (relative)
+//   (c) p95 routing-decision latency increase < 5%  (relative)
+//
+// ALL THREE must hold for promotion. AND, not OR — the OR form let
+// quality gains mask cost regressions, exactly the failure mode ADR-149's
+// Pareto framing was built to prevent.
+//
+// INPUT FORMAT (.swarm/router-parallel.jsonl, one JSON record per line):
+//   {
+//     "ts": "<iso>",
+//     "task": { ... },
+//     "bandit":  { "pick": "<modelId>", "predictedQuality": 0.84, "predictedCostUsd": 0.003 },
+//     "ser":     { "pick": "<modelId>", "predictedQuality": 0.87, "predictedCostUsd": 0.004 },
+//     "outcome": { "actualModel": "<modelId>", "actualQuality": 0.91, "actualUsd": 0.0035, "actualLatencyMs": 1240 }
+//   }
+//
+// USAGE
+//   node scripts/router-parallel-analyze.mjs --input .swarm/router-parallel.jsonl
+//   node scripts/router-parallel-analyze.mjs --input <file> --format json
+//   node scripts/router-parallel-analyze.mjs --input <file> --strict   # exit 1 if NOT promotable
+//
+// EXIT CODES
+//   0  analysis complete; in --strict mode → all three criteria passed
+//   1  --strict requested AND at least one criterion failed (NOT promotable)
+//   2  config error or input file missing/malformed
+
+import { readFileSync, existsSync } from 'node:fs';
+
+const ARGS = (() => {
+  const a = { input: '.swarm/router-parallel.jsonl', format: 'table', strict: false };
+  for (let i = 2; i < process.argv.length; i++) {
+    const v = process.argv[i];
+    if (v === '--input') a.input = process.argv[++i];
+    else if (v === '--format') a.format = process.argv[++i];
+    else if (v === '--strict') a.strict = true;
+  }
+  return a;
+})();
+
+function median(sorted) {
+  if (sorted.length === 0) return 0;
+  const n = sorted.length;
+  return n % 2 === 0 ? (sorted[n / 2 - 1] + sorted[n / 2]) / 2 : sorted[(n - 1) / 2];
+}
+
+function pctile(sorted, q) {
+  if (sorted.length === 0) return 0;
+  const idx = Math.floor(q * (sorted.length - 1));
+  return sorted[idx];
+}
+
+function mean(arr) {
+  if (arr.length === 0) return 0;
+  return arr.reduce((s, x) => s + x, 0) / arr.length;
+}
+
+function main() {
+  if (!existsSync(ARGS.input)) {
+    if (ARGS.format === 'json') {
+      console.log(JSON.stringify({
+        ok: true,
+        sufficient: false,
+        reason: 'input-file-not-found',
+        input: ARGS.input,
+        hint: 'Enable parallel logging (SWARMDO_ROUTER_PARALLEL_LOG=1) and run a workload first.',
+      }, null, 2));
+    } else {
+      console.log(`# router-parallel-analyze`);
+      console.log('');
+      console.log(`_Input file not found: ${ARGS.input}_`);
+      console.log('');
+      console.log('Enable parallel logging by setting `SWARMDO_ROUTER_PARALLEL_LOG=1`');
+      console.log('and running a real workload, then re-run this analyzer.');
+    }
+    process.exit(ARGS.strict ? 1 : 0);
+  }
+
+  let rows = [];
+  try {
+    rows = readFileSync(ARGS.input, 'utf-8')
+      .split('\n')
+      .filter((l) => l.trim())
+      .map((l) => JSON.parse(l));
+  } catch (e) {
+    console.error(`router-parallel-analyze: cannot parse ${ARGS.input}: ${e.message}`);
+    process.exit(2);
+  }
+
+  // Filter to records with both predictions + outcome present.
+  const usable = rows.filter((r) => r.bandit && r.ser && r.outcome);
+
+  if (usable.length < 30) {
+    const payload = {
+      ok: true,
+      sufficient: false,
+      reason: `n=${usable.length} < 30 (insufficient sample for AND-gate evaluation)`,
+      hint: 'Continue collecting parallel-routing data; statistical significance needs ≥30 paired decisions per arm.',
+      sampleSize: usable.length,
+      generatedAt: new Date().toISOString(),
+    };
+    if (ARGS.format === 'json') console.log(JSON.stringify(payload, null, 2));
+    else {
+      console.log(`# router-parallel-analyze`);
+      console.log('');
+      console.log(`Sample size: **${usable.length}** paired decisions`);
+      console.log('');
+      console.log(`_Insufficient — need ≥30 for the 3-criteria AND-gate._`);
+    }
+    process.exit(ARGS.strict ? 1 : 0);
+  }
+
+  // For each record, attribute the outcome to BOTH arms when they
+  // agreed on the model pick; when they disagreed, the actual outcome
+  // belongs only to the bandit (which was the executing arm). The SER
+  // arm gets its PREDICTED metrics for the counterfactual.
+  const banditOutcomes = usable.map((r) => ({
+    qualityActual: r.outcome.actualQuality,
+    usdActual: r.outcome.actualUsd,
+    latencyActual: r.outcome.actualLatencyMs,
+  }));
+
+  // SER counterfactual: use ser.predictedQuality / predictedCostUsd
+  // when picks disagreed; use actual when they agreed. Latency: when
+  // they agreed, both saw the same actual latency; when they
+  // disagreed, the SER pick's latency is unknown — fall back to the
+  // mean of agreed-decision latencies for that model.
+  const agreedLatencyByModel = {};
+  for (const r of usable) {
+    if (r.bandit.pick === r.ser.pick) {
+      const m = r.outcome.actualModel || r.bandit.pick;
+      (agreedLatencyByModel[m] = agreedLatencyByModel[m] || []).push(r.outcome.actualLatencyMs);
+    }
+  }
+  const modelMeanLatency = {};
+  for (const [m, arr] of Object.entries(agreedLatencyByModel)) {
+    modelMeanLatency[m] = mean(arr);
+  }
+
+  const serOutcomes = usable.map((r) => {
+    const agreed = r.bandit.pick === r.ser.pick;
+    return {
+      qualityActual: agreed ? r.outcome.actualQuality : r.ser.predictedQuality,
+      usdActual: agreed ? r.outcome.actualUsd : r.ser.predictedCostUsd,
+      latencyActual: agreed
+        ? r.outcome.actualLatencyMs
+        : (modelMeanLatency[r.ser.pick] ?? r.outcome.actualLatencyMs),
+    };
+  });
+
+  // Compute the three criteria.
+  const banditQuality = mean(banditOutcomes.map((o) => o.qualityActual));
+  const serQuality    = mean(serOutcomes.map((o) => o.qualityActual));
+  const qualityImprovementPct =
+    banditQuality > 0 ? ((serQuality - banditQuality) / banditQuality) * 100 : 0;
+
+  const banditUsd = mean(banditOutcomes.map((o) => o.usdActual));
+  const serUsd    = mean(serOutcomes.map((o) => o.usdActual));
+  const usdIncreasePct = banditUsd > 0 ? ((serUsd - banditUsd) / banditUsd) * 100 : 0;
+
+  const banditLatencyP95 = pctile(banditOutcomes.map((o) => o.latencyActual).sort((a, b) => a - b), 0.95);
+  const serLatencyP95    = pctile(serOutcomes.map((o) => o.latencyActual).sort((a, b) => a - b), 0.95);
+  const latencyIncreasePct =
+    banditLatencyP95 > 0 ? ((serLatencyP95 - banditLatencyP95) / banditLatencyP95) * 100 : 0;
+
+  const passes = {
+    quality: qualityImprovementPct > 2,
+    cost: usdIncreasePct < 1,
+    latency: latencyIncreasePct < 5,
+  };
+  const allPass = passes.quality && passes.cost && passes.latency;
+
+  // Disagreement rate (informational; not part of the gate).
+  const disagreements = usable.filter((r) => r.bandit.pick !== r.ser.pick).length;
+  const disagreementPct = (disagreements / usable.length) * 100;
+
+  const payload = {
+    ok: true,
+    sufficient: true,
+    sampleSize: usable.length,
+    disagreement: {
+      count: disagreements,
+      pct: Math.round(disagreementPct * 100) / 100,
+    },
+    bandit: {
+      meanQuality: Math.round(banditQuality * 10000) / 10000,
+      meanUsd: Math.round(banditUsd * 1e6) / 1e6,
+      p95LatencyMs: Math.round(banditLatencyP95),
+    },
+    ser: {
+      meanQuality: Math.round(serQuality * 10000) / 10000,
+      meanUsd: Math.round(serUsd * 1e6) / 1e6,
+      p95LatencyMs: Math.round(serLatencyP95),
+    },
+    criteria: {
+      qualityImprovementPct: Math.round(qualityImprovementPct * 100) / 100,
+      qualityThresholdPct: 2,
+      qualityPasses: passes.quality,
+      usdIncreasePct: Math.round(usdIncreasePct * 100) / 100,
+      usdThresholdPct: 1,
+      costPasses: passes.cost,
+      latencyIncreasePct: Math.round(latencyIncreasePct * 100) / 100,
+      latencyThresholdPct: 5,
+      latencyPasses: passes.latency,
+    },
+    verdict: {
+      promotable: allPass,
+      reason: allPass
+        ? 'All three criteria met (quality > 2% AND cost < 1% AND latency < 5%)'
+        : `Blocked by: ${[
+            !passes.quality && `quality only +${(qualityImprovementPct).toFixed(2)}% (need >2%)`,
+            !passes.cost && `cost +${(usdIncreasePct).toFixed(2)}% (need <1%)`,
+            !passes.latency && `latency +${(latencyIncreasePct).toFixed(2)}% (need <5%)`,
+          ].filter(Boolean).join(', ')}`,
+    },
+    generatedAt: new Date().toISOString(),
+  };
+
+  if (ARGS.format === 'json') {
+    console.log(JSON.stringify(payload, null, 2));
+  } else {
+    console.log('# router-parallel-analyze (ADR-150 SelfEvolvingRouter promotion gate)');
+    console.log('');
+    console.log(`Sample size: **${payload.sampleSize}** paired decisions`);
+    console.log(`Disagreement rate: ${payload.disagreement.pct}% (${payload.disagreement.count} / ${payload.sampleSize})`);
+    console.log('');
+    console.log(`| Metric | Bandit | SER | Delta | Threshold | Passes |`);
+    console.log(`|---|---:|---:|---:|---:|:---:|`);
+    console.log(`| Mean quality | ${payload.bandit.meanQuality} | ${payload.ser.meanQuality} | ${payload.criteria.qualityImprovementPct >= 0 ? '+' : ''}${payload.criteria.qualityImprovementPct}% | >+2% | ${passes.quality ? '✓' : '⚠'} |`);
+    console.log(`| Mean $/decision | $${payload.bandit.meanUsd.toFixed(6)} | $${payload.ser.meanUsd.toFixed(6)} | ${payload.criteria.usdIncreasePct >= 0 ? '+' : ''}${payload.criteria.usdIncreasePct}% | <+1% | ${passes.cost ? '✓' : '⚠'} |`);
+    console.log(`| p95 latency | ${payload.bandit.p95LatencyMs}ms | ${payload.ser.p95LatencyMs}ms | ${payload.criteria.latencyIncreasePct >= 0 ? '+' : ''}${payload.criteria.latencyIncreasePct}% | <+5% | ${passes.latency ? '✓' : '⚠'} |`);
+    console.log('');
+    console.log(`**Verdict**: ${allPass ? '✓ PROMOTABLE' : '⚠ NOT promotable'}`);
+    console.log('');
+    console.log(`_${payload.verdict.reason}_`);
+  }
+
+  if (ARGS.strict && !allPass) process.exit(1);
+  process.exit(0);
+}
+
+main();

package/plugins/swarmdo-metaharness/scripts/score.mjs

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+// score.mjs — `cost-style` wrapper around `metaharness score <path>`.
+//
+// Returns the 5-dimension scorecard (harnessFit / compileConfidence /
+// taskCoverage / toolSafety / memoryUsefulness) + estCostPerRunUsd +
+// scaffoldReady boolean. Reads-only; no side effects.
+//
+// USAGE
+//   node scripts/score.mjs                          # current dir
+//   node scripts/score.mjs --path <dir>             # specific dir
+//   node scripts/score.mjs --alert-on-fit-below 70  # exit 1 if harnessFit < 70
+//   node scripts/score.mjs --format json
+//
+// EXIT CODES
+//   0  scored OK (or degraded — MetaHarness not available)
+//   1  --alert-on-fit-below threshold breached
+//   2  config error or scoring failure
+
+import { runMetaharness, emitDegradedJsonAndExit } from './_harness.mjs';
+
+const ARGS = (() => {
+  const a = { path: '.', format: 'json', alertFitBelow: null };
+  for (let i = 2; i < process.argv.length; i++) {
+    const v = process.argv[i];
+    if (v === '--path') a.path = process.argv[++i];
+    else if (v === '--alert-on-fit-below') a.alertFitBelow = parseFloat(process.argv[++i]);
+    else if (v === '--format') a.format = process.argv[++i];
+  }
+  return a;
+})();
+
+function main() {
+  const r = runMetaharness(['score', ARGS.path]);
+  if (r.degraded) {
+    emitDegradedJsonAndExit(r.reason);
+    return;
+  }
+  if (r.exitCode !== 0 || !r.json) {
+    console.error(`score: metaharness exited ${r.exitCode}`);
+    if (r.stderr) console.error(r.stderr.slice(0, 400));
+    process.exit(2);
+  }
+  const payload = { ...r.json, durationMs: r.durationMs };
+
+  if (ARGS.alertFitBelow !== null) {
+    if (!isFinite(ARGS.alertFitBelow)) {
+      console.error(`score: --alert-on-fit-below must be a finite number`);
+      process.exit(2);
+    }
+    payload.alert = {
+      threshold: ARGS.alertFitBelow,
+      triggered: typeof payload.harnessFit === 'number' && payload.harnessFit < ARGS.alertFitBelow,
+      reason: typeof payload.harnessFit === 'number' && payload.harnessFit < ARGS.alertFitBelow
+        ? `harnessFit ${payload.harnessFit} < ${ARGS.alertFitBelow}`
+        : `harnessFit ${payload.harnessFit ?? 'unknown'} ≥ ${ARGS.alertFitBelow} — OK`,
+    };
+  }
+
+  if (ARGS.format === 'json') {
+    console.log(JSON.stringify(payload, null, 2));
+  } else {
+    console.log(`# harness-score — ${payload.repo || ARGS.path}`);
+    console.log('');
+    console.log(`| Dimension | Value |`);
+    console.log(`|---|---:|`);
+    console.log(`| harnessFit | ${payload.harnessFit ?? '—'} |`);
+    console.log(`| compileConfidence | ${payload.compileConfidence ?? '—'} |`);
+    console.log(`| taskCoverage | ${payload.taskCoverage ?? '—'} |`);
+    console.log(`| toolSafety | ${payload.toolSafety ?? '—'} |`);
+    console.log(`| memoryUsefulness | ${payload.memoryUsefulness ?? '—'} |`);
+    console.log(`| estCostPerRunUsd | $${payload.estCostPerRunUsd ?? '—'} |`);
+    console.log(`| recommendedMode | ${payload.recommendedMode ?? '—'} |`);
+    console.log(`| archetype | ${payload.archetype ?? '—'} |`);
+    console.log(`| template | ${payload.template ?? '—'} |`);
+    console.log(`| scaffoldReady | ${payload.scaffoldReady ?? '—'} |`);
+    console.log(`| hardConstraints | ${payload.hardConstraints ?? '—'} |`);
+    console.log(`| **duration** | ${payload.durationMs}ms |`);
+    console.log('');
+    if (payload.alert) {
+      if (payload.alert.triggered) {
+        console.log(`⚠ **ALERT**: ${payload.alert.reason}`);
+      } else {
+        console.log(`✓ ${payload.alert.reason}`);
+      }
+      console.log('');
+    }
+  }
+
+  if (payload.alert?.triggered) process.exit(1);
+}
+
+main();