harness-everything 0.20.7 → 0.22.0

package/plugins/harness-everything/skills/harness-everything/scripts/system-one/provider.js

@@ -0,0 +1,79 @@
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { validateRequest } = require('./contract');
+// Upstream cua_s1 source revision documented in docs/system-one-routing.md.
+const PINNED_CUA_S1_REVISION = 'b7f7e2d8714609853a29c7d049140bc46aec0954';
+const ADAPTER = path.join(__dirname, 'cua_adapter.py');
+const unavailable = reason => ({ status: 'unavailable', reason });
+const exact = (value, keys) => value && typeof value === 'object' && !Array.isArray(value)
+  && Object.keys(value).length === keys.length && keys.every(k => Object.hasOwn(value, k));
+const label = value => typeof value === 'string' && value.length > 0 && value.length <= 128 && !/[\u0000-\u001f]/.test(value);
+function validateManifest(m) {
+  const required = ['schemaVersion', 'python', 'checkpoint', 'weightsSha256', 'configSha256', 'modelId', 'revision', 'domain'];
+  if (!m || typeof m !== 'object' || Array.isArray(m) || required.some(k => !Object.hasOwn(m, k))
+    || Object.keys(m).some(k => ![...required, 'timeoutMs', 'transport', 'idleTimeoutMs'].includes(k)) || m.schemaVersion !== 1
+    || ['python', 'modelId', 'revision', 'domain'].some(k => typeof m[k] !== 'string' || !m[k].trim() || m[k].length > 4096 || m[k].includes('\0'))
+    || typeof m.checkpoint !== 'string' || !path.isAbsolute(m.checkpoint) || path.extname(m.checkpoint) !== '.safetensors'
+    || ['weightsSha256', 'configSha256'].some(k => typeof m[k] !== 'string' || !/^[a-f0-9]{64}$/.test(m[k]))
+    || (m.timeoutMs !== undefined && (!Number.isInteger(m.timeoutMs) || m.timeoutMs < 1 || m.timeoutMs > 10000))
+    || (m.transport !== undefined && !['oneshot', 'resident'].includes(m.transport))
+    || (m.idleTimeoutMs !== undefined && (!Number.isInteger(m.idleTimeoutMs) || m.idleTimeoutMs < 60000 || m.idleTimeoutMs > 14400000))
+    || (m.modelId === 'cua-ai/cua-s1-forms' && m.domain !== 'forms-v1')) throw new TypeError('invalid-manifest');
+  return true;
+}
+function readManifest(manifestPath) {
+  if (typeof manifestPath !== 'string' || !path.isAbsolute(manifestPath) || fs.statSync(manifestPath).size > 65536) throw new Error();
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  validateManifest(manifest);
+  return manifest;
+}
+function spawnJson(executable, args, input, timeoutMs) {
+  let result;
+  try {
+    result = spawnSync(executable, args, { input, encoding: 'utf8', shell: false,
+      timeout: timeoutMs, killSignal: 'SIGKILL', maxBuffer: 1024 * 1024, windowsHide: true });
+  } catch (_) { return unavailable('provider-unavailable'); }
+  if (result.error) return unavailable(result.error.code === 'ETIMEDOUT' ? 'provider-timeout'
+    : result.error.code === 'ENOBUFS' ? 'provider-output-limit' : 'provider-unavailable');
+  if (result.status !== 0) return unavailable('provider-exit');
+  try { return { status: 'ok', value: JSON.parse(result.stdout) }; }
+  catch (_) { return unavailable('provider-json'); }
+}
+function runProvider(request, executable, args, timeoutMs = 2000) {
+  validateRequest(request);
+  const result = spawnJson(executable, args, JSON.stringify(request), timeoutMs);
+  return result.status === 'ok' ? { status: 'scored', response: result.value } : result;
+}
+function score(request, manifestPath) {
+  validateRequest(request);
+  let manifest;
+  try { manifest = readManifest(manifestPath); } catch (_) { return unavailable('provider-config'); }
+  if (manifest.transport === 'resident') return require('./resident').score({ ...request }, manifest, manifestPath);
+  // Send the exact validated manifest to the child on stdin: no config reread race.
+  return runProvider({ ...request }, manifest.python, [ADAPTER, JSON.stringify(manifest)], manifest.timeoutMs || 2000);
+}
+// The probe reports what is installed; only a PEP 610 VCS commit counts as a source revision.
+function validateProvenance(p) {
+  if (!exact(p, ['schemaVersion', 'python', 'cuaS1', 'torch']) || p.schemaVersion !== 1
+    || !exact(p.python, ['implementation', 'version']) || !label(p.python.implementation) || !label(p.python.version)
+    || !exact(p.cuaS1, ['distribution', 'version', 'sourceRevision'])
+    || ![p.cuaS1.distribution, p.cuaS1.version, p.torch].every(v => v === null || label(v))
+    || (p.cuaS1.sourceRevision !== null && !(typeof p.cuaS1.sourceRevision === 'string' && /^[0-9a-f]{40}$/.test(p.cuaS1.sourceRevision)))) {
+    throw new TypeError('invalid-provenance');
+  }
+  const revision = p.cuaS1.sourceRevision;
+  return { python: { ...p.python }, torch: p.torch, cuaS1: { ...p.cuaS1, pinnedRevision: PINNED_CUA_S1_REVISION,
+    sourceRevisionStatus: revision === null ? 'unavailable' : revision === PINNED_CUA_S1_REVISION ? 'pinned' : 'mismatch' } };
+}
+function provenance(manifestPath) {
+  let manifest;
+  try { manifest = readManifest(manifestPath); } catch (_) { return unavailable('provider-config'); }
+  // Metadata scans can exceed the per-score budget; use the manifest cap. No model is loaded.
+  const result = spawnJson(manifest.python, [ADAPTER, '--provenance'], '', 10000);
+  if (result.status !== 'ok') return result;
+  try { return { status: 'recorded', provenance: validateProvenance(result.value) }; }
+  catch (_) { return unavailable('provider-json'); }
+}
+module.exports = { score, runProvider, validateManifest, readManifest, provenance, validateProvenance, PINNED_CUA_S1_REVISION };

package/plugins/harness-everything/skills/harness-everything/scripts/system-one/resident.js

@@ -0,0 +1,176 @@
+#!/usr/bin/env node
+'use strict';
+// Resident System One client: one verified model stays loaded in a loopback server.
+// A score never blocks on model loading; a cold start returns provider-starting (lexical route wins).
+const fs = require('node:fs');
+const path = require('node:path');
+const { createHash } = require('node:crypto');
+const { spawn } = require('node:child_process');
+const { Worker } = require('node:worker_threads');
+const { validateRequest } = require('./contract');
+
+const ADAPTER = path.join(__dirname, 'cua_adapter.py');
+const LOCK_TTL_MS = 60000;
+const CALL_TIMEOUT_MS = 1000;
+const MAX_REPLY_BYTES = 1024 * 1024;
+const unavailable = reason => ({ status: 'unavailable', reason });
+const sleep = ms => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+const exact = (value, keys) => value && typeof value === 'object' && !Array.isArray(value)
+  && Object.keys(value).length === keys.length && keys.every(k => Object.hasOwn(value, k));
+const defaultCommand = manifest => [manifest.python, [ADAPTER, '--serve']];
+
+function stateFiles(manifest, manifestPath) {
+  const digest = createHash('sha256').update(JSON.stringify(manifest)).digest('hex').slice(0, 16);
+  const base = path.join(path.dirname(manifestPath), `system-one-resident-${digest}`);
+  return { state: `${base}.json`, lock: `${base}.starting` };
+}
+function readState(file) {
+  try {
+    const s = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (exact(s, ['schemaVersion', 'pid', 'port', 'token', 'startedAt']) && s.schemaVersion === 1
+      && Number.isInteger(s.pid) && s.pid > 0 && Number.isInteger(s.port) && s.port > 0 && s.port < 65536
+      && typeof s.token === 'string' && /^[0-9a-f]{64}$/.test(s.token) && Number.isFinite(s.startedAt)) return s;
+  } catch (_) { /* absent or unreadable state means no usable server */ }
+  return null;
+}
+function lockInfo(file) {
+  try {
+    const ageMs = Date.now() - fs.statSync(file).mtimeMs;
+    let failed = null;
+    try { const body = JSON.parse(fs.readFileSync(file, 'utf8')); if (typeof body.failed === 'string') failed = body.failed; } catch (_) { /* partial write */ }
+    return { ageMs, failed };
+  } catch (_) { return null; }
+}
+function pidAlive(pid) {
+  try { process.kill(pid, 0); return true; } catch (err) { return err.code === 'EPERM'; }
+}
+function removeIfSame(file, state) {
+  const current = readState(file);
+  if (current && current.pid === state.pid && current.token === state.token) { try { fs.unlinkSync(file); } catch (_) { /* raced */ } }
+}
+
+// One socket round trip on a worker thread; the caller blocks with Atomics.wait (router API is synchronous).
+const WORKER = `
+const net = require('node:net');
+const { workerData } = require('node:worker_threads');
+const { port, payload, signal, out } = workerData;
+const view = new Uint8Array(out); const chunks = []; let size = 0; let done = false;
+const finish = (code, buf) => {
+  if (done) return; done = true;
+  if (buf) { view.set(buf); Atomics.store(signal, 1, buf.length); }
+  Atomics.store(signal, 0, code); Atomics.notify(signal, 0);
+};
+const socket = net.connect({ port, host: '127.0.0.1' }, () => socket.end(payload));
+socket.on('data', c => { size += c.length; if (size > view.length) { finish(4); socket.destroy(); } else chunks.push(c); });
+socket.on('end', () => finish(1, Buffer.concat(chunks)));
+socket.on('error', e => finish(e.code === 'ECONNREFUSED' ? 2 : 3));
+`;
+function callSync(port, message, timeoutMs = CALL_TIMEOUT_MS) {
+  const signal = new Int32Array(new SharedArrayBuffer(8));
+  const out = new SharedArrayBuffer(MAX_REPLY_BYTES);
+  let worker;
+  try {
+    worker = new Worker(WORKER, { eval: true, workerData: { port, payload: `${JSON.stringify(message)}\n`, signal, out } });
+    worker.unref();
+  } catch (_) { return { error: 'io' }; }
+  Atomics.wait(signal, 0, 0, timeoutMs);
+  const code = Atomics.load(signal, 0);
+  worker.terminate();
+  if (code === 0) return { error: 'timeout' };
+  if (code !== 1) return { error: code === 2 ? 'refused' : code === 4 ? 'limit' : 'io' };
+  try { return { reply: JSON.parse(Buffer.from(out, 0, Atomics.load(signal, 1)).toString('utf8')) }; }
+  catch (_) { return { error: 'json' }; }
+}
+
+function start(manifest, files, deps) {
+  const lock = lockInfo(files.lock);
+  if (lock && lock.ageMs < LOCK_TTL_MS) return unavailable(lock.failed ? 'provider-unavailable' : 'provider-starting');
+  if (lock) { try { fs.unlinkSync(files.lock); } catch (_) { /* another caller replaced it */ } }
+  try { fs.writeFileSync(files.lock, JSON.stringify({ createdAt: Date.now() }), { flag: 'wx', mode: 0o600 }); }
+  catch (_) { return unavailable('provider-starting'); }
+  let child = null;
+  try {
+    const [exe, prefix] = (deps.command || defaultCommand)(manifest);
+    child = spawn(exe, [...prefix, JSON.stringify(manifest), files.state, files.lock],
+      { detached: true, stdio: 'ignore', windowsHide: true, shell: false });
+    child.on('error', () => { /* recorded synchronously below: a failed spawn has no pid */ });
+    child.unref();
+  } catch (_) { child = null; }
+  // The async 'error' event cannot run while callers block in Atomics.wait, so record the failure now.
+  if (!child || !child.pid) {
+    try { fs.writeFileSync(files.lock, JSON.stringify({ createdAt: Date.now(), failed: 'spawn-failed' })); } catch (_) { /* best effort */ }
+    return unavailable('provider-unavailable');
+  }
+  return unavailable('provider-starting');
+}
+// Returns a live server state, or null after removing state that provably belongs to a dead server.
+function liveState(files) {
+  const state = readState(files.state);
+  if (state && !pidAlive(state.pid)) { removeIfSame(files.state, state); return null; }
+  return state;
+}
+function score(request, manifest, manifestPath, deps = {}) {
+  validateRequest(request);
+  const files = stateFiles(manifest, manifestPath);
+  const state = liveState(files);
+  if (!state) return start(manifest, files, deps);
+  const result = callSync(state.port, { token: state.token, op: 'score', request });
+  if (result.reply) {
+    if (result.reply.ok === true && Object.hasOwn(result.reply, 'response')) return { status: 'scored', response: result.reply.response };
+    if (result.reply.ok === false) return unavailable(result.reply.reason === 'unauthorized' ? 'provider-unavailable' : 'provider-exit');
+    return unavailable('provider-json');
+  }
+  if (result.error === 'refused') { removeIfSame(files.state, state); return start(manifest, files, deps); }
+  return unavailable({ timeout: 'provider-timeout', limit: 'provider-output-limit', json: 'provider-json' }[result.error] || 'provider-unavailable');
+}
+function ping(state) {
+  const result = callSync(state.port, { token: state.token, op: 'ping' });
+  return result.reply && result.reply.ok === true ? result.reply : null;
+}
+function ensureReady(manifest, manifestPath, waitMs, deps = {}) {
+  const files = stateFiles(manifest, manifestPath);
+  const deadline = Date.now() + waitMs;
+  while (Date.now() < deadline) {
+    const state = liveState(files);
+    if (state && ping(state)) return true;
+    if (!state) {
+      const lock = lockInfo(files.lock);
+      if (lock && lock.failed && lock.ageMs < LOCK_TTL_MS) return false;
+      if (!lock || lock.ageMs >= LOCK_TTL_MS) start(manifest, files, deps);
+    }
+    sleep(100);
+  }
+  return false;
+}
+function status(manifest, manifestPath) {
+  const state = liveState(stateFiles(manifest, manifestPath));
+  const reply = state && ping(state);
+  return reply ? { running: true, pid: state.pid, port: state.port, startedAt: state.startedAt, model: reply.model } : { running: false };
+}
+function stop(manifest, manifestPath) {
+  const files = stateFiles(manifest, manifestPath);
+  const state = liveState(files);
+  if (!state) return false;
+  const result = callSync(state.port, { token: state.token, op: 'shutdown' });
+  if (!(result.reply && result.reply.ok === true)) {
+    try { process.kill(state.pid); } catch (_) { /* already exited */ }
+    removeIfSame(files.state, state);
+  }
+  return true;
+}
+
+if (require.main === module) {
+  const [op, manifestPath, extra] = process.argv.slice(2);
+  let manifest = null;
+  try {
+    if (!['start', 'status', 'stop'].includes(op) || extra) throw new Error('usage');
+    manifest = require('./provider').readManifest(manifestPath);
+  } catch (_) {
+    console.error('Usage: resident.js start|status|stop <absolute manifest path>');
+    process.exit(2);
+  }
+  if (op === 'start') process.exitCode = ensureReady(manifest, manifestPath, 60000) ? 0 : 1;
+  if (op === 'stop') stop(manifest, manifestPath);
+  process.stdout.write(`${JSON.stringify(status(manifest, manifestPath))}\n`);
+}
+module.exports = { stateFiles, readState, callSync, score, ensureReady, status, stop, LOCK_TTL_MS, CALL_TIMEOUT_MS };

package/plugins/harness-everything/skills/harness-everything/scripts/system-one/router.js

@@ -0,0 +1,37 @@
+'use strict';
+const { createRequest, decide } = require('./contract');
+const provider = require('./provider');
+const TIER_OPTIONS = Object.freeze([
+  { id: 'tier1', text: 'A small bounded edit or operation with clear scope.' },
+  { id: 'tier2', text: 'Implementation or bug fix needing iterative testing.' },
+  { id: 'tier3', text: 'Architecture, repository-wide change or multi-stage engineering.' },
+  { id: 'unclassified', text: 'Unclear intent, insufficient context or outside these categories.' },
+].map(Object.freeze));
+const LABELS = { tier1: 'Tier 1 (Trivial)', tier2: 'Tier 2 (Standard Task)', tier3: 'Tier 3 (Macro Task)' };
+const RANK = { tier1: 1, tier2: 2, tier3: 3 };
+// input.floor is the deterministic structural minimum; a scorer may raise the tier, never lower it below the floor.
+function selectTier(input, env = process.env, scorer = provider.score) {
+  const mode = env.HARNESS_SYSTEM_ONE_MODE || 'off';
+  if (mode === 'off') return { tier: input.tier, diagnostic: null };
+  const fallback = (reason, status = 'unavailable') => ({ tier: input.tier, diagnostic: { mode: ['shadow', 'prefer'].includes(mode) ? mode : 'invalid', status, reason } });
+  if (!['shadow', 'prefer'].includes(mode)) return fallback('invalid-mode');
+  if (input.floor != null && !Object.hasOwn(RANK, input.floor)) return fallback('invalid-request');
+  let request;
+  try { request = createRequest('tier', input.prompt, TIER_OPTIONS); }
+  catch (_) { return fallback('invalid-request'); }
+  let result;
+  try { result = scorer(request, env.HARNESS_SYSTEM_ONE_CONFIG); }
+  catch (_) { return fallback('provider-unavailable'); }
+  if (!result || result.status !== 'scored') {
+    const allowed = ['provider-timeout', 'provider-output-limit', 'provider-exit', 'provider-json', 'provider-config', 'provider-unavailable', 'provider-starting'];
+    return fallback(allowed.includes(result?.reason) ? result.reason : 'provider-unavailable');
+  }
+  const decision = decide(request, result.response);
+  if (decision.selectedId === 'unclassified') Object.assign(decision, { selectedId: null, status: 'abstain', reason: 'unclassified' });
+  const accepted = decision.status === 'accepted';
+  const belowFloor = accepted && input.floor != null && RANK[decision.selectedId] < RANK[input.floor];
+  const applied = mode === 'prefer' && accepted && !input.explicit && !belowFloor;
+  const reason = input.explicit && accepted ? 'explicit-precedence' : belowFloor ? 'structural-floor' : decision.reason;
+  return { tier: applied ? LABELS[decision.selectedId] : input.tier, diagnostic: { mode, ...decision, applied, reason } };
+}
+module.exports = { selectTier, TIER_OPTIONS };

package/plugins/harness-everything/skills/harness-everything/scripts/tier-router.js

@@ -313,6 +313,19 @@ function run(userPrompt, context) {
     }
   }
 
+  const { selectTier } = require('./system-one/router');
+  const structuralFloor = hasMacroSignal ? 'tier3'
+    : !isTrivialDocsEdit && hasMultipleTasks && hasMultipleSentences ? 'tier2' : null;
+  const semantic = selectTier({ prompt: userPrompt, tier: recommendedTier, floor: structuralFloor,
+    explicit: Boolean(detectExplicitStrategy(userPrompt, detectFableModel(userPrompt))) });
+  if (semantic.diagnostic) console.log(`\n=> SYSTEM ONE: ${JSON.stringify(semantic.diagnostic)}`);
+  if (semantic.diagnostic?.applied) {
+    recommendedTier = semantic.tier;
+    rationale = 'System One selected a tier from the fixed catalog; deterministic policy remains authoritative.';
+    reasonCodes.splice(loadedConfig.reasonCodes.length);
+    addReason(reasonCodes, 'system-one-tier');
+  }
+
   console.log(`\n=> RECOMMENDED TIER: ${recommendedTier}`);
   console.log(`=> RATIONALE: ${rationale}`);
 
@@ -447,6 +460,7 @@ function run(userPrompt, context) {
   return contract;
 }
 
+if (require.main === module) {
 let userPrompt = process.argv[2] || '';
 let hookContext = null;
 
@@ -471,3 +485,5 @@ if (process.argv[2]) {
     run(userPrompt, hookContext);
   });
 }
+}
+module.exports = { run };

package/sbom.cdx.json

@@ -2,23 +2,23 @@
   "$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.7",
-  "serialNumber": "urn:uuid:12ceeeac-7f99-5fb2-82a3-768d5d708e00",
+  "serialNumber": "urn:uuid:0f18cc7a-103c-5369-a33b-bdbe1bf12efb",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-22T16:17:00.105Z",
+    "timestamp": "2026-09-23T05:03:30.779Z",
     "tools": [
       {
         "vendor": "Harness Everything",
         "name": "generate-sbom.js",
-        "version": "0.20.7"
+        "version": "0.22.0"
       }
     ],
     "component": {
       "type": "application",
-      "bom-ref": "pkg:npm/harness-everything@0.20.7",
+      "bom-ref": "pkg:npm/harness-everything@0.22.0",
       "name": "harness-everything",
-      "version": "0.20.7",
-      "purl": "pkg:npm/harness-everything@0.20.7"
+      "version": "0.22.0",
+      "purl": "pkg:npm/harness-everything@0.22.0"
     }
   },
   "components": [
@@ -1999,7 +1999,7 @@
       ]
     },
     {
-      "ref": "pkg:npm/harness-everything@0.20.7",
+      "ref": "pkg:npm/harness-everything@0.22.0",
       "dependsOn": [
         "pkg:npm/%40commitlint/cli@19.8.1",
         "pkg:npm/%40commitlint/config-conventional@19.8.1",

package/scripts/build-openai-submission.js

@@ -4,6 +4,7 @@
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
+const { isPackagingNoise } = require('./lib/packaging-noise');
 
 const ROOT = path.resolve(__dirname, '..');
 const SKILLS_ROOT = path.join(ROOT, 'plugins', 'harness-everything', 'skills');
@@ -24,6 +25,7 @@ function parseArgs(argv) {
 
 function filesUnder(root, base = root, out = []) {
   for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
+    if (isPackagingNoise(entry.name)) continue;
     const full = path.join(root, entry.name);
     if (entry.isDirectory()) filesUnder(full, base, out);
     else if (entry.isFile()) out.push(path.relative(base, full).replace(/\\/g, '/'));

package/scripts/evaluate-system-one.js

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+'use strict';
+const fs = require('node:fs');
+const os = require('node:os');
+const { performance } = require('node:perf_hooks');
+const { validateCorpus, evaluate } = require('../harness-everything/scripts/system-one/evaluate');
+const { score, provenance, readManifest } = require('../harness-everything/scripts/system-one/provider');
+const resident = require('../harness-everything/scripts/system-one/resident');
+const { decide } = require('../harness-everything/scripts/system-one/contract');
+const { run: route } = require('../harness-everything/scripts/tier-router');
+
+function run(corpus, manifest) {
+  validateCorpus(corpus);
+  let config = null;
+  try { config = readManifest(manifest); } catch (_) { /* Missing provider remains an explicit unavailable measurement. */ }
+  // Resident runs are measured only after readiness, so every sample is warm; one-shot samples are cold.
+  const warm = config?.transport === 'resident';
+  const wasRunning = warm && resident.status(config, manifest).running;
+  const ready = warm && resident.ensureReady(config, manifest, 60000);
+  const records = [];
+  const originalMode = process.env.HARNESS_SYSTEM_ONE_MODE;
+  const originalLog = console.log;
+  try {
+    process.env.HARNESS_SYSTEM_ONE_MODE = 'off';
+    console.log = () => {};
+    for (const c of corpus.cases.filter(item => item.split === 'holdout')) {
+      const tier = route(c.request.context).workflowPlan.tier;
+      const runs = [];
+      for (let i = 0; i < 2; i++) {
+        const start = performance.now();
+        const result = score(c.request, manifest);
+        const decision = result.status === 'scored' ? decide(c.request, result.response) : result;
+        if (decision.selectedId === 'unclassified') Object.assign(decision, { status: 'abstain', reason: 'unclassified', selectedId: null });
+        const scores = ['accepted', 'abstain'].includes(decision.status) ? result.response.scores.map(s => s.probability) : null;
+        runs.push({ decision, scores, latencyMs: performance.now() - start, coldStart: !warm });
+      }
+      records.push({ id: c.id, baseline: tier === 'unclassified' ? null : tier, runs });
+    }
+  } finally {
+    if (warm && !wasRunning) resident.stop(config, manifest);
+    console.log = originalLog;
+    if (originalMode === undefined) delete process.env.HARNESS_SYSTEM_ONE_MODE;
+    else process.env.HARNESS_SYSTEM_ONE_MODE = originalMode;
+  }
+  let artifact = null;
+  try {
+    const m = JSON.parse(fs.readFileSync(manifest, 'utf8'));
+    artifact = { declaredModelId: m.modelId, declaredRevision: m.revision, weightsSha256: m.weightsSha256, configSha256: m.configSha256 };
+  } catch (_) { /* Missing provider remains an explicit unavailable measurement. */ }
+  const source = provenance(manifest);
+  return { ...evaluate(corpus, records, source), evidence: { kind: warm ? 'offline-resident' : 'offline-one-shot', artifact, source,
+    residentReady: warm ? ready : null,
+    environment: { cpu: os.cpus()[0]?.model || 'unknown', os: `${os.platform()} ${os.release()} ${os.arch()}`, node: process.version,
+      python: source.status === 'recorded' ? source.provenance.python : null, threads: 1 },
+    limitations: ['No independently verified holdout review', ...(warm ? [] : ['No warm inference measurement']), 'No live-host or policy evidence'] }, records };
+}
+if (require.main === module) {
+  try {
+    const [input, manifest, output, extra] = process.argv.slice(2);
+    if (!input || !manifest || !output || extra) throw new Error('usage');
+    const report = run(JSON.parse(fs.readFileSync(input, 'utf8')), manifest);
+    fs.writeFileSync(output, JSON.stringify(report, null, 2) + '\n');
+    console.log(JSON.stringify({ cases: report.cases, coverage: report.model.coverage, rolloutReady: report.rolloutReady }));
+  } catch (_) { console.error('System One evaluation failed: invalid corpus, arguments, or output path.'); process.exitCode = 1; }
+}
+module.exports = { run };

package/scripts/lib/packaging-noise.js

@@ -0,0 +1,6 @@
+'use strict';
+// Untracked local/CI build artifacts that no distribution (installer copy, plugin mirror,
+// public submission) may ship, even when they exist in the working tree.
+const isPackagingNoise = name => name === '__pycache__' || /\.py[co]$/.test(name);
+
+module.exports = { isPackagingNoise };

package/scripts/lib/skills.js

@@ -2,11 +2,13 @@
 const fs = require('fs');
 const path = require('path');
 const manifest = require('./manifest');
+const { isPackagingNoise } = require('./packaging-noise');
 
 function copyDir(src, dest) {
   fs.mkdirSync(dest, { recursive: true });
   const entries = fs.readdirSync(src, { withFileTypes: true });
   for (const entry of entries) {
+    if (isPackagingNoise(entry.name)) continue;
     const srcPath = path.join(src, entry.name);
     const destPath = path.join(dest, entry.name);
     if (entry.isDirectory()) copyDir(srcPath, destPath);

package/scripts/sync-openai-plugin.js

@@ -3,6 +3,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const { isPackagingNoise } = require('./lib/packaging-noise');
 
 const ROOT = path.resolve(__dirname, '..');
 const manifest = JSON.parse(fs.readFileSync(path.join(ROOT, '.claude-plugin', 'plugin.json'), 'utf8'));
@@ -32,7 +33,7 @@ function syncTree(source, destination) {
   fs.rmSync(destination, { recursive: true, force: true });
   fs.mkdirSync(path.dirname(destination), { recursive: true });
   if (fs.statSync(source).isDirectory()) {
-    fs.cpSync(source, destination, { recursive: true });
+    fs.cpSync(source, destination, { recursive: true, filter: src => !isPackagingNoise(path.basename(src)) });
     normalizeTree(destination);
   } else {
     fs.copyFileSync(source, destination);