harness-everything 0.20.7 → 0.22.0

package/ci/mechanism-system-one-router.test.js

@@ -0,0 +1,101 @@
+'use strict';
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const { spawnSync } = require('node:child_process');
+const path = require('node:path');
+const { selectTier, TIER_OPTIONS } = require('../harness-everything/scripts/system-one/router');
+const root = path.resolve(__dirname, '..');
+function scorer(id = 'tier2', domain = 'harness-routing-v1') {
+  return req => ({ status: 'scored', response: { schemaVersion: 1, requestHash: req.requestHash, catalogHash: req.catalogHash,
+    model: { id: 'fixture', revision: 'v1', domain }, scores: req.options.map(o => ({ id: o.id, probability: o.id === id ? 1 : 0 })) } });
+}
+test('S1-R01 off/shadow/prefer and rollback', () => {
+  const input = { prompt: '實作功能', tier: 'Unclassified' };
+  const forbidden = () => { throw new Error('must not invoke'); };
+  assert.deepEqual(selectTier(input, {}, forbidden), { tier: input.tier, diagnostic: null });
+  assert.equal(selectTier(input, { HARNESS_SYSTEM_ONE_MODE: 'off' }, forbidden).tier, input.tier);
+  for (const mode of ['shadow', 'prefer']) {
+    let captured;
+    const result = selectTier(input, { HARNESS_SYSTEM_ONE_MODE: mode }, req => { captured = req; return scorer()(req); });
+    assert.deepEqual(captured.options, TIER_OPTIONS);
+    assert.equal(result.tier, mode === 'prefer' ? 'Tier 2 (Standard Task)' : input.tier);
+    assert.equal(result.diagnostic.status, 'accepted');
+    assert.ok(!JSON.stringify(result.diagnostic).includes(input.prompt));
+  }
+  assert.equal(selectTier(input, { HARNESS_SYSTEM_ONE_MODE: 'unknown' }, forbidden).diagnostic.reason, 'invalid-mode');
+});
+test('S1-R02 explicit precedence, abstention and every failure leave fallback intact', () => {
+  const env = { HARNESS_SYSTEM_ONE_MODE: 'prefer' };
+  const input = { prompt: 'use fable architecture', tier: 'Tier 3 (Macro Task)' };
+  assert.equal(selectTier({ ...input, explicit: true }, env, scorer('tier1')).tier, input.tier);
+  for (const provider of [scorer('unclassified'), scorer('tier1', 'forms-v1'), () => ({ status: 'unavailable', reason: 'provider-timeout' }), () => ({ status: 'scored', response: null }), () => { throw new Error('secret'); }]) {
+    const result = selectTier(input, env, provider);
+    assert.equal(result.tier, input.tier);
+    assert.ok(!JSON.stringify(result).includes('secret'));
+  }
+  assert.equal(selectTier({ ...input, prompt: '' }, env, scorer()).diagnostic.reason, 'invalid-request');
+});
+test('S1-R03 real CLI/kernel off parity and shadow failure repeated', () => {
+  const script = path.join(root, 'harness-everything/scripts/kernel-router-core.js');
+  const run = mode => spawnSync(process.execPath, [script, 'deploy to production'], { cwd: root, encoding: 'utf8', env: { ...process.env, HARNESS_SYSTEM_ONE_MODE: mode, HARNESS_SYSTEM_ONE_CONFIG: '' } });
+  const off = run('off'); assert.equal(off.status, 0);
+  const baseline = run(''); assert.equal(off.stdout, baseline.stdout);
+  const one = run('shadow'); const two = run('shadow');
+  assert.equal(one.status, 0); assert.equal(one.stdout, two.stdout); assert.equal(one.stderr, two.stderr);
+  assert.match(one.stdout, /SYSTEM ONE.*provider-config/);
+  const parse = text => JSON.parse(text.match(/ROUTER WORKFLOW PLAN \(JSON\): (.*)/)[1]);
+  assert.deepEqual(parse(one.stdout), parse(off.stdout));
+  assert.equal(parse(one.stdout).actionGate.required, true);
+});
+test('S1-R04 integrated accepted route preserves policy and explicit model choice', () => {
+  const provider = require('../harness-everything/scripts/system-one/provider');
+  const original = provider.score; const log = console.log; const env = process.env.HARNESS_SYSTEM_ONE_MODE;
+  try {
+    process.env.HARNESS_SYSTEM_ONE_MODE = 'prefer'; console.log = () => {};
+    provider.score = scorer('tier1');
+    const { run } = require('../harness-everything/scripts/tier-router');
+    const risky = run('deploy to production; save lesson to memory');
+    assert.equal(risky.workflowPlan.actionGate.required, true);
+    assert.notEqual(risky.workflowPlan.memory.write, 'none');
+    const explicit = run('use fable-staged without subagents');
+    assert.notEqual(explicit.workflowPlan.strategy, 'direct-single');
+    assert.ok(explicit.workflowPlan.requiredInvariants.includes('replan-after-repeated-failure'));
+    const normal = run('unusual bounded wording');
+    assert.equal(normal.workflowPlan.tier, 'tier1');
+  } finally { provider.score = original; console.log = log; if (env === undefined) delete process.env.HARNESS_SYSTEM_ONE_MODE; else process.env.HARNESS_SYSTEM_ONE_MODE = env; }
+});
+test('S1-R05 structural floor: a scorer can raise but never lower a deterministic macro/multi-task tier', () => {
+  const env = { HARNESS_SYSTEM_ONE_MODE: 'prefer' };
+  const macro = { prompt: 'audit every skill in the repository', tier: 'Tier 3 (Macro Task)', floor: 'tier3' };
+  for (const id of ['tier1', 'tier2']) {
+    const result = selectTier(macro, env, scorer(id));
+    assert.equal(result.tier, macro.tier);
+    assert.equal(result.diagnostic.applied, false);
+    assert.equal(result.diagnostic.reason, 'structural-floor');
+    assert.equal(result.diagnostic.selectedId, id);
+  }
+  const multi = { prompt: 'x', tier: 'Tier 2 (Standard Task)', floor: 'tier2' };
+  assert.equal(selectTier(multi, env, scorer('tier1')).tier, multi.tier);
+  assert.equal(selectTier(multi, env, scorer('tier3')).tier, 'Tier 3 (Macro Task)');
+  assert.equal(selectTier({ ...multi, floor: null }, env, scorer('tier1')).tier, 'Tier 1 (Trivial)');
+  assert.equal(selectTier({ ...multi, floor: 'tier9' }, env, () => { throw new Error('must not invoke'); }).diagnostic.reason, 'invalid-request');
+
+  const provider = require('../harness-everything/scripts/system-one/provider');
+  const original = provider.score; const log = console.log; const mode = process.env.HARNESS_SYSTEM_ONE_MODE;
+  try {
+    console.log = () => {};
+    const { run } = require('../harness-everything/scripts/tier-router');
+    for (const prompt of ['audit every skill in the repository', 'Refactor the parser. Then update the tests and also the docs. Finally rerun CI.']) {
+      process.env.HARNESS_SYSTEM_ONE_MODE = 'off';
+      const lexical = run(prompt).workflowPlan;
+      process.env.HARNESS_SYSTEM_ONE_MODE = 'prefer'; provider.score = scorer('tier1');
+      assert.deepEqual(run(prompt).workflowPlan, lexical);
+      provider.score = original;
+    }
+    process.env.HARNESS_SYSTEM_ONE_MODE = 'prefer'; provider.score = scorer('tier1');
+    const plan = run('audit every skill in the repository').workflowPlan;
+    assert.equal(plan.tier, 'tier3');
+    assert.notEqual(plan.strategy, 'direct-single');
+    assert.equal(plan.verification.independent, true);
+  } finally { provider.score = original; console.log = log; if (mode === undefined) delete process.env.HARNESS_SYSTEM_ONE_MODE; else process.env.HARNESS_SYSTEM_ONE_MODE = mode; }
+});

package/ci/system-one-adapter-test.py

@@ -0,0 +1,222 @@
+"""Stdlib adapter tests: no claim of real checkpoint inference."""
+import hashlib
+import importlib.util
+import json
+import os
+from pathlib import Path
+import socket
+import subprocess
+import sys
+import tempfile
+import threading
+import time
+import unittest
+
+sys.dont_write_bytecode = True  # never leave __pycache__ in the source tree that packaging copies
+path = Path(__file__).resolve().parents[1] / 'harness-everything/scripts/system-one/cua_adapter.py'
+spec = importlib.util.spec_from_file_location('adapter', path)
+adapter = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(adapter)
+
+
+class AdapterTests(unittest.TestCase):
+    def test_artifact_hash_and_pickle_rejection(self):
+        with tempfile.TemporaryDirectory() as root:
+            weights = Path(root) / 'model.safetensors'
+            weights.write_bytes(b'synthetic-not-real-weights')
+            sidecar = weights.with_suffix('.json')
+            sidecar.write_text('{}', encoding='utf-8')
+            manifest = {'checkpoint': str(weights), 'weightsSha256': hashlib.sha256(weights.read_bytes()).hexdigest(), 'configSha256': hashlib.sha256(sidecar.read_bytes()).hexdigest()}
+            self.assertEqual(adapter.verify_artifacts(manifest), weights)
+            sidecar.write_text('{"changed":true}', encoding='utf-8')
+            with self.assertRaisesRegex(ValueError, 'artifact-hash'):
+                adapter.verify_artifacts(manifest)
+            manifest['checkpoint'] = str(weights.with_suffix('.pt'))
+            with self.assertRaisesRegex(ValueError, 'checkpoint-format'):
+                adapter.verify_artifacts(manifest)
+
+    def test_byte_limits_no_truncation(self):
+        request = {'context': '中文', 'options': [{'text': 'abc'}, {'text': 'x'}]}
+        adapter.check_limits(request, {'context_tokens': 6, 'option_tokens': 3})
+        for config in [{'context_tokens': 5, 'option_tokens': 3}, {'context_tokens': 6, 'option_tokens': 2}]:
+            with self.assertRaisesRegex(ValueError, 'input-too-long'):
+                adapter.check_limits(request, config)
+
+    def test_source_revision_only_from_recorded_vcs_commit(self):
+        commit = 'b7f7e2d8714609853a29c7d049140bc46aec0954'
+        vcs = {'url': 'https://github.com/trycua/cua', 'vcs_info': {'vcs': 'git', 'commit_id': commit}, 'subdirectory': 'libs/cua-s1/python'}
+        self.assertEqual(adapter.source_revision(json.dumps(vcs)), commit)
+        for text in ['', 'not-json', '[]', json.dumps({'url': 'file:///src', 'dir_info': {'editable': True}}),
+                     json.dumps({'vcs_info': {'commit_id': 'main'}}), json.dumps({'vcs_info': {'commit_id': commit.upper()}}), json.dumps({'vcs_info': []})]:
+            self.assertIsNone(adapter.source_revision(text))
+        self.assertIsNone(adapter.source_revision(None))
+
+    def test_provenance_shape_without_ml_dependency(self):
+        result = adapter.provenance()
+        self.assertEqual(set(result), {'schemaVersion', 'python', 'cuaS1', 'torch'})
+        self.assertEqual(set(result['python']), {'implementation', 'version'})
+        self.assertEqual(set(result['cuaS1']), {'distribution', 'version', 'sourceRevision'})
+        self.assertEqual(json.loads(json.dumps(result)), result)
+
+
+def stub_factory(weights, manifest):
+    return (lambda request: [1.0] + [0.0] * (len(request['options']) - 1)), {'context_tokens': 8, 'option_tokens': 8}
+
+
+def call(port, payload, raw=None):
+    with socket.create_connection(('127.0.0.1', port), timeout=5) as conn:
+        conn.sendall(raw if raw is not None else (json.dumps(payload) + '\n').encode('utf-8'))
+        conn.shutdown(socket.SHUT_WR)
+        data = b''.join(iter(lambda: conn.recv(65536), b''))
+    return json.loads(data)
+
+
+class ResidentServerTests(unittest.TestCase):
+    def setUp(self):
+        self.root = tempfile.TemporaryDirectory()
+        weights = Path(self.root.name) / 'model.safetensors'
+        weights.write_bytes(b'synthetic-not-real-weights')
+        weights.with_suffix('.json').write_text('{}', encoding='utf-8')
+        self.weights = weights
+        self.manifest = {'checkpoint': str(weights), 'modelId': 'stub', 'revision': 'v1', 'domain': 'harness-routing-v1',
+                         'weightsSha256': hashlib.sha256(weights.read_bytes()).hexdigest(),
+                         'configSha256': hashlib.sha256(weights.with_suffix('.json').read_bytes()).hexdigest()}
+        self.state = Path(self.root.name) / 'state.json'
+        self.lock = Path(self.root.name) / 'state.starting'
+        self.lock.write_text('{}', encoding='utf-8')
+
+    def tearDown(self):
+        self.root.cleanup()
+
+    def start(self, idle=30):
+        thread = threading.Thread(target=adapter.serve, args=(self.manifest, self.state, self.lock),
+                                  kwargs={'scorer_factory': stub_factory, 'idle_timeout_s': idle}, daemon=True)
+        thread.start()
+        deadline = time.time() + 10
+        while not self.state.exists() and time.time() < deadline:
+            time.sleep(0.02)
+        self.assertTrue(self.state.exists())
+        return thread, json.loads(self.state.read_text(encoding='utf-8'))
+
+    def request(self, context='fix', options=('a', 'b')):
+        return {'schemaVersion': 1, 'task': 'tier', 'context': context, 'requestHash': 'a' * 64, 'catalogHash': 'b' * 64,
+                'options': [{'id': f'o{i}', 'text': t} for i, t in enumerate(options)]}
+
+    def test_protocol_auth_limits_and_shutdown(self):
+        thread, state = self.start()
+        self.assertEqual(set(state), {'schemaVersion', 'pid', 'port', 'token', 'startedAt'})
+        self.assertRegex(state['token'], r'^[0-9a-f]{64}$')
+        self.assertEqual(state['pid'], os.getpid())
+        self.assertFalse(self.lock.exists())
+        if os.name == 'posix':
+            self.assertEqual(self.state.stat().st_mode & 0o777, 0o600)
+        token, port = state['token'], state['port']
+        self.assertEqual(call(port, {'token': token, 'op': 'ping'})['ok'], True)
+        self.assertEqual(call(port, {'token': '0' * 64, 'op': 'ping'}), {'ok': False, 'reason': 'unauthorized'})
+        self.assertEqual(call(port, {'op': 'ping'}), {'ok': False, 'reason': 'unauthorized'})
+        self.assertEqual(call(port, None, raw=b'not-json\n'), {'ok': False, 'reason': 'invalid-request'})
+        self.assertEqual(call(port, None, raw=b'x' * (2 * 1024 * 1024 + 2)), {'ok': False, 'reason': 'request-limit'})
+        self.assertEqual(call(port, {'token': token, 'op': 'unknown'}), {'ok': False, 'reason': 'invalid-request'})
+        reply = call(port, {'token': token, 'op': 'score', 'request': self.request()})
+        self.assertEqual(reply['ok'], True)
+        self.assertEqual(reply['response']['requestHash'], 'a' * 64)
+        self.assertEqual(reply['response']['model'], {'id': 'stub', 'revision': 'v1', 'domain': 'harness-routing-v1'})
+        self.assertEqual([s['probability'] for s in reply['response']['scores']], [1.0, 0.0])
+        self.assertEqual(call(port, {'token': token, 'op': 'score', 'request': self.request(context='123456789')}),
+                         {'ok': False, 'reason': 'input-too-long'})
+        self.assertEqual(call(port, {'token': token, 'op': 'score', 'request': {'context': 'x'}}), {'ok': False, 'reason': 'invalid-request'})
+        self.assertEqual(call(port, {'token': token, 'op': 'shutdown'}), {'ok': True})
+        thread.join(5)
+        self.assertFalse(thread.is_alive())
+        self.assertFalse(self.state.exists())
+
+    def test_artifact_change_stops_server(self):
+        thread, state = self.start()
+        time.sleep(0.05)
+        self.weights.write_bytes(b'changed-weights-with-new-size')
+        reply = call(state['port'], {'token': state['token'], 'op': 'score', 'request': self.request()})
+        self.assertEqual(reply, {'ok': False, 'reason': 'artifact-changed'})
+        thread.join(5)
+        self.assertFalse(thread.is_alive())
+        self.assertFalse(self.state.exists())
+
+    def test_idle_timeout_exits_and_removes_state(self):
+        thread, _ = self.start(idle=0.3)
+        thread.join(5)
+        self.assertFalse(thread.is_alive())
+        self.assertFalse(self.state.exists())
+
+    @unittest.skipUnless(os.name == 'nt', 'Windows DACL')
+    def test_state_file_has_owner_only_explicit_dacl_on_windows(self):
+        thread, state = self.start()
+        # Drop the file path (it contains "C:\Users\...") and keep only the ACE text.
+        acl = subprocess.run(['icacls', str(self.state)], capture_output=True, text=True).stdout.replace(str(self.state), '')
+        self.assertIn(':(F)', acl)
+        for bad in ['(I)', 'Users', 'Everyone', 'Administrators', 'SYSTEM']:
+            self.assertNotIn(bad, acl)
+        call(state['port'], {'token': state['token'], 'op': 'shutdown'})
+        thread.join(5)
+
+    @unittest.skipUnless(os.name == 'nt', 'Windows DACL')
+    def test_explicit_foreign_aces_are_replaced_not_kept(self):
+        # CI runners create files with explicit (non-inherited) SYSTEM/Administrators/OWNER RIGHTS entries.
+        target = Path(self.root.name) / 'explicit.json'
+        target.write_text('{}', encoding='utf-8')
+        subprocess.run(['icacls', str(target), '/inheritance:d'], capture_output=True, check=True)
+        subprocess.run(['icacls', str(target), '/grant', '*S-1-5-32-544:F', '*S-1-5-18:F', '*S-1-3-4:F', '*S-1-5-32-545:R'], capture_output=True, check=True)
+        adapter._restrict_to_current_user(target)
+        acl = subprocess.run(['icacls', str(target)], capture_output=True, text=True).stdout.replace(str(target), '')
+        self.assertEqual(acl.count(':('), 1)
+        self.assertIn(':(F)', acl)
+
+    def test_slow_client_does_not_block_others_and_burst_is_served(self):
+        thread, state = self.start()
+        idle = socket.create_connection(('127.0.0.1', state['port']), timeout=5)
+        try:
+            began = time.monotonic()
+            self.assertEqual(call(state['port'], {'token': state['token'], 'op': 'ping'})['ok'], True)
+            self.assertLess(time.monotonic() - began, 0.5)
+            results = []
+            workers = [threading.Thread(target=lambda: results.append(call(state['port'], {'token': state['token'], 'op': 'ping'}))) for _ in range(32)]
+            for w in workers:
+                w.start()
+            for w in workers:
+                w.join(10)
+            self.assertEqual(len(results), 32)
+            self.assertTrue(all(r.get('ok') is True or r == {'ok': False, 'reason': 'busy'} for r in results))
+            self.assertGreaterEqual(sum(1 for r in results if r.get('ok') is True), 16)
+        finally:
+            idle.close()
+        call(state['port'], {'token': state['token'], 'op': 'shutdown'})
+        thread.join(5)
+
+    def test_server_exits_when_its_state_file_no_longer_names_it(self):
+        thread, _ = self.start()
+        self.state.write_text('{"corrupt": true}', encoding='utf-8')
+        thread.join(5)
+        self.assertFalse(thread.is_alive())
+        self.assertEqual(self.state.read_text(encoding='utf-8'), '{"corrupt": true}')
+
+    def test_rejects_requests_outside_phase0_structure(self):
+        thread, state = self.start()
+        token, port = state['token'], state['port']
+        many = self.request(options=tuple('x' for _ in range(257)))
+        extra = dict(self.request(), extra=1)
+        dup = self.request(); dup['options'][1]['id'] = dup['options'][0]['id']
+        bad_id = self.request(); bad_id['options'][0]['id'] = 'Bad ID'
+        wrong_version = dict(self.request(), schemaVersion=2)
+        for request in [many, extra, dup, bad_id, wrong_version]:
+            self.assertEqual(call(port, {'token': token, 'op': 'score', 'request': request}), {'ok': False, 'reason': 'invalid-request'})
+        self.assertEqual(call(port, {'token': token, 'op': 'score', 'request': self.request(options=tuple('x' for _ in range(256)))})['ok'], True)
+        call(port, {'token': token, 'op': 'shutdown'})
+        thread.join(5)
+
+    def test_startup_failure_is_recorded_in_lock(self):
+        self.manifest['weightsSha256'] = '0' * 64
+        adapter.serve(self.manifest, self.state, self.lock, scorer_factory=stub_factory, idle_timeout_s=1)
+        self.assertFalse(self.state.exists())
+        self.assertEqual(json.loads(self.lock.read_text(encoding='utf-8'))['failed'], 'artifact-hash')
+
+
+if __name__ == '__main__':
+    unittest.main()

package/docs/platform-capabilities.md

@@ -120,3 +120,17 @@ The OpenCode adapter uses the documented plugin API and has deterministic mechan
 The matrix records the official documentation reviewed for each platform. Important source families include [OpenAI plugin packaging](https://developers.openai.com/plugins/build/plugins), [OpenAI public submission](https://developers.openai.com/plugins/deploy/submission), [Codex skills](https://learn.chatgpt.com/docs/build-skills), [Codex hooks](https://learn.chatgpt.com/docs/hooks), [Claude skills](https://code.claude.com/docs/en/skills), [OpenCode skills](https://opencode.ai/docs/skills), [GitHub Copilot Agent Skills](https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/add-skills), [Cursor skills](https://cursor.com/docs/skills), [Continue rules](https://docs.continue.dev/customize/rules), and [Hermes skills](https://hermes-agent.nousresearch.com/docs/user-guide/features/skills).
 
 When a platform behavior changes, update this page, `docs/platform-compatibility.json`, and every affected current-state surface in the same change. `npm run test:docs:capabilities` and the compatibility mechanism suite enforce the repository-side contract; they do not replace manual live-host evidence.
+# Experimental System One routing
+
+The shared tier router supports opt-in `HARNESS_SYSTEM_ONE_MODE=shadow|prefer`
+with a local CUA-S1 provider manifest (`HARNESS_SYSTEM_ONE_CONFIG`). Default `off`
+retains existing behavior; `prefer` never lowers a tier below the deterministic
+structural floor. Canonical and packaged runtime copies use the same
+contract; this establishes no new live-host capability. Python, PyTorch and a
+compatible local checkpoint are optional external dependencies, not npm payloads;
+the explicit `npm run system-one:install` sets them up and hooks never run it.
+With `transport: "resident"`, an opted-in router hook may spawn one detached
+loopback-only Python server per manifest; host survival of that process after
+a hook exits is not live-verified.
+Public Skills-only artifacts do not acquire lifecycle hooks from this feature.
+See [System One routing](system-one-routing.md) for limits, rollback and evidence.

package/docs/system-one-routing.md

@@ -0,0 +1,271 @@
+# System One routing migration
+
+Status: experimental engineering; issue [#233](https://github.com/dyphn1/Harness-everything/issues/233).
+The default router stays lexical until a Harness checkpoint passes the rollout gates.
+Implement each phase in **documentation → failing tests → implementation** order.
+
+## Phase 0: scorer contract
+
+System One scores a complete, caller-owned candidate list in one pass. It cannot
+generate a workflow, execute actions, authorize tools, or write memory. Policy and
+contract assembly remain deterministic. This boundary does not add execution locks.
+
+`createRequest(task, context, options)` returns a version-1 request. Task names and
+candidate IDs use lowercase letters, digits, dots, underscores or hyphens (1–80
+characters). Context is nonempty UTF-8 (at most 65,536 bytes). There are 2–256
+unique `{id, text}` options; text is nonempty and at most 4,096 bytes. Empty,
+malformed, unknown-field and wrong-type inputs are errors. Input objects are not
+mutated. Candidate order matters. `catalogHash` is SHA-256 of JSON-encoded
+`{task, options}`; `requestHash` additionally binds the exact context. Neither
+fingerprint grants permission or authenticates a model.
+
+The provider response has exactly `schemaVersion`, `requestHash`, `catalogHash`,
+`model`, and `scores`. Model has nonempty `id`, `revision`, and `domain` strings.
+Scores have exactly `{id, probability}` in request order. All candidates occur
+exactly once; probabilities are finite numbers in [0, 1], summing to one within
+1e-6. Unknown fields, stale request/catalog hashes, and version mismatches fail.
+
+`decide(request, response, policy)` returns exactly `status`, `reason`,
+`selectedId`, `confidence`, `margin`, and `model`. Status is `accepted`, `abstain`,
+or `invalid-output`; nonaccepted results always have `selectedId: null`.
+Policy requires a domain (default `harness-routing-v1`), minimum confidence
+(default 0.9) and minimum margin (default 0.2). Invalid policy is a caller error.
+Reject domain mismatch, tied winners, low confidence and low margin. A softmax
+score is not calibrated correctness probability. Invalid output returns no raw
+response, exception, or prompt. Identical inputs give identical decisions.
+
+## Phase 1: local provider
+
+`provider.score(request, manifestPath)` uses a trusted host-configured manifest,
+never a prompt-supplied executable. No shell or automatic download is used.
+The manifest is version 1 with `python` (executable), `checkpoint` (absolute
+`.safetensors` path), `weightsSha256`, `configSha256` (matching `.json` sidecar),
+`modelId`, `revision`, `domain`, and optional `timeoutMs` (1–10000, default 2000).
+All fields are required except the timeout; unknown fields are rejected. Hashes
+must be lowercase SHA-256. Revision and domain are artifact-owner declarations,
+not independently verified quality claims. The known `cua-ai/cua-s1-forms` ID
+must use domain `forms-v1`. No pickle format or remote URL is accepted.
+
+Install the optional `cua_s1` source in a dedicated Python 3.11–3.13 environment
+from upstream revision `b7f7e2d8714609853a29c7d049140bc46aec0954`, using the
+`libs/cua-s1/python` project. This npm package does not install Python, torch or
+weights. Configure its Python executable in the manifest. A manifest alone does
+not prove which Python package was installed, so `provider.provenance(manifestPath)`
+runs `cua_adapter.py --provenance` with the configured interpreter. The probe
+reads installed metadata only (no torch import, no checkpoint load) and reports
+the Python implementation/version, the distribution providing `cua_s1`, its
+version, the torch version, and the source revision. Only a PEP 610
+`direct_url.json` VCS `commit_id` counts as a source revision, so install from a
+VCS URL pinned to that commit (not an editable or local-directory install).
+The status is `pinned` when it matches, `mismatch` otherwise, or `unavailable`
+when no revision is recorded. Malformed probe output is `provider-json`.
+
+`npm run system-one:install` (or `node harness-everything/scripts/system-one/install.js`)
+performs these steps on explicit request; hooks never run it. It selects a
+Python 3.11–3.13 interpreter (`--python` overrides; 3.14 is rejected by upstream),
+creates `<dir>/venv`, installs CPU-only torch from the PyTorch CPU index, then
+installs the pinned `cua_s1` Git URL. It downloads the `cua-ai/cua-s1-forms`
+safetensors weights and JSON sidecar at Hugging Face revision
+`f54adbf447f4ca6ec259f529ee3f2e3e09f8cc71`, verifies pinned sizes and SHA-256
+before an atomic write (the pickle `.pt` is never fetched), and writes
+`<dir>/manifest.json` with `timeoutMs: 10000`, `transport: "resident"` and
+`idleTimeoutMs: 1800000`. The default `<dir>` is
+`~/.agents/harness-everything/system-one`; `--dir` takes an absolute path and
+`--dry-run` prints the plan without changes. Acceptance requires a `pinned`
+provenance probe and one real warm CPU inference through a resident server that
+the installer starts and then stops; otherwise the exit code is 1. Child-process
+output goes to stderr; stdout carries only the JSON report.
+Torch/numpy/safetensors versions resolve at install time and are recorded by
+the probe. The installer does not change the router mode: it prints
+`HARNESS_SYSTEM_ONE_MODE=shadow` and the manifest path for the host
+environment. This checkpoint declares domain `forms-v1`, so shadow diagnostics
+report `domain-mismatch` and prefer never applies it. It also rejects context
+above its 224-byte limit (`provider-exit`), so installing it proves the local
+inference path only, not Harness routing quality.
+
+The adapter verifies both files before `load_checkpoint(..., 'cpu')`, sets one
+torch thread and deterministic inference, calls the upstream collator/model,
+and returns a probability for every option. It rejects context or option text
+that exceeds the loaded byte limits before collation (no silent truncation).
+No prompts or model values are written to disk or echoed in error messages.
+
+The Node transport has a hard timeout and a 1 MiB stdout/stderr bound; it kills
+the direct child on timeout. It starts one short-lived Python process per score
+request. This is the default `oneshot` transport, not a warm server; see the
+resident provider below.
+The process cannot execute actions and is not given a CUA driver. Failures return
+`{status: 'unavailable', reason}` with a bounded reason code; malformed score
+responses are checked by Phase 0. Transport fixtures prove IPC and failure
+handling only. Real checkpoint inference and measured CPU latency remain a
+separate gate, with explicit unavailable evidence if dependencies are absent.
+
+## Resident provider (Phase 4 prerequisite)
+
+The one-shot bridge pays Python start, `import torch` and checkpoint load on every
+call (measured ≈5 s on CPU); warm in-process inference is a few milliseconds. The
+manifest may set `transport: "resident"` (default `"oneshot"`) and optional
+`idleTimeoutMs` (60000–14400000, default 1800000) to keep one verified model in
+memory. Other manifest rules are unchanged; the timeout remains one-shot only.
+
+**Lifecycle.** A resident-mode score never blocks on model loading. If no live
+server exists, the Node provider creates a start lock with exclusive-create,
+spawns `cua_adapter.py --serve` detached with the configured Python (no shell),
+and returns `unavailable/provider-starting`, so the lexical route is used for
+that prompt. Concurrent callers seeing a lock younger than 60 s do not spawn
+again. The server verifies artifact hashes before `load_checkpoint`, writes its
+state file atomically, then removes the lock. A startup failure writes a bounded
+reason into the lock and exits; callers report `provider-unavailable` without
+respawning until the lock is 60 s old. An executable that cannot be spawned at
+all is detected synchronously (no child PID) and recorded as `spawn-failed` the
+same way. The server exits after `idleTimeoutMs` without requests, on
+`shutdown`, when either checkpoint file's size or modification time changes
+(`artifact-changed`), or as soon as its state file no longer names its PID and
+token (replaced, corrupted or deleted), so an undiscoverable server never
+lingers as an orphan. It deletes only a state file that still names it.
+
+**Files.** State and lock live beside the manifest as
+`system-one-resident-<digest>.json` / `.starting`, where `<digest>` is the first
+16 hex digits of SHA-256 of the parsed manifest re-serialized with `JSON.stringify`
+(file key order). Editing the manifest
+therefore selects a new server; the old one exits when idle. The state file has
+exactly `schemaVersion: 1`, `pid`, `port`, `token` (64 hex), and `startedAt`, and
+is created with mode 0600; on Windows the file instead receives an explicit
+DACL with inheritance removed and a single full-control entry for the current
+user's SID before the token is written. The manifest directory must still be
+writable only by that user: whoever can replace files there can redirect the
+client, and whoever can edit the manifest chooses the executable.
+
+**Protocol.** The server binds only `127.0.0.1` on an ephemeral port and handles
+one request per connection: one newline-terminated JSON object of at most 2 MiB
+with `token`, `op` (`score`, `ping`, `shutdown`) and, for `score`, a request with
+the exact Phase 0 structure (fields, lowercase IDs, unique options, 2–256
+options, 64-hex fingerprints). Connections are served concurrently, up to 64, each
+with a 1 s read deadline; beyond that the reply is `busy`. Inference itself is
+serialized, so a silent or slow client cannot delay other callers. Tokens are compared in constant time; a mismatch returns
+`{ok: false, reason: "unauthorized"}`. `score` applies the same byte limits
+(no truncation) and returns `{ok: true, response}` in the Phase 0 response
+format, which Phase 0 validation still checks. Any other failure returns
+`{ok: false, reason}` with a bounded code; no prompt, traceback, path or score is
+echoed in errors. The server never executes actions and is not given a driver.
+
+**Client.** The router API is synchronous, so the client performs one socket
+round trip on a worker thread and waits with `Atomics.wait` (1000 ms deadline).
+Results map to the existing reasons: timeout → `provider-timeout` (no respawn);
+refused connection or dead PID → stale state removed and a new start
+(`provider-starting`); `unauthorized` → `provider-unavailable`; any other
+server-declined request → `provider-exit`; malformed replies → `provider-json`.
+
+**Operators.** `node harness-everything/scripts/system-one/resident.js
+start|status|stop <absolute manifest>` controls a server explicitly; `start`
+waits up to 60 s for readiness. The evaluation CLI waits for readiness before
+measuring, so resident runs are recorded with `coldStart: false`. The installer
+writes `transport: "resident"`, verifies one resident score, and stops the server
+it started. Repository tests use a stub scorer behind the real server/protocol
+code; they prove the mechanism, not host survival of detached processes or model
+quality. Those require retained evidence.
+
+## Phase 2: tier integration and rollback
+
+Set `HARNESS_SYSTEM_ONE_MODE=off|shadow|prefer` in the host environment. Default
+is `off`: no provider process, diagnostic, or contract change. Supply an absolute
+`HARNESS_SYSTEM_ONE_CONFIG` path to the Phase 1 manifest for the other modes.
+An unknown mode reports `invalid-mode` and leaves the lexical result unchanged.
+Shadow records the decision but never changes the route. Prefer replaces only
+the recommended tier when a valid `harness-routing-v1` result passes Phase 0
+thresholds. The full fixed tier catalog (tier1, tier2, tier3, unclassified) is
+always scored; it is never filtered using lexical matches. `unclassified` means
+abstention and keeps the existing route. Explicit strategy/model requests keep
+precedence and prevent model tier replacement. Set mode back to `off` to roll back.
+
+Prefer can raise a tier but never lower it below the deterministic structural
+floor: a macro-scope signal sets floor `tier3`, and multi-task, multi-sentence
+structure (other than a trivial docs edit) sets floor `tier2`. An accepted result
+below the floor is not applied and reports `structural-floor`, so repository-wide
+work keeps its Tier 3 strategy, independent verification and worktree
+invariants. Tier-3 keywords are lexical guesses, not structural floors. The
+policy assembler still consumes the original structural and risk signals.
+Safety, explicit prohibitions, memory ownership, and verification are not model
+outputs. This phase does not yet replace guide matching, dynamic
+skill triggers, fact-audit reminders, or the structural workflow signals.
+The same scorer API can evaluate caller-supplied text options; additional routing
+surfaces require their own catalog and held-out evidence before integration.
+
+When enabled, a single `SYSTEM ONE` JSON diagnostic reports mode, status, reason,
+selected candidate, model identity, confidence and margin; it omits prompt text,
+score vectors and artifact paths. The existing router contract schema is unchanged.
+Kernel/packaged entry points inherit these host environment variables. Prompts
+and hook payload fields cannot set model configuration or launch executables.
+Repository tests establish mechanism/package evidence only; actual host loading
+and semantic quality remain unverified until retained sessions demonstrate them.
+
+## Phase 3: corpus and paired evaluation
+
+Use `node scripts/evaluate-system-one.js corpus.json /absolute/manifest.json report.json`.
+The corpus is `{schemaVersion: 1, cases: [...]}`. Each case has exactly `id`,
+`family`, `split` (`train|validation|holdout`), `language` (`en|zh-TW`), `source`
+(human-reviewed provenance, not baseline-generated gold), `reviewed` (boolean),
+`request` (Phase 0 tier request), and `gold` (candidate ID, or null for abstention).
+The complete fixed tier catalog must match. IDs and request hashes are unique;
+no family may span splits. Evaluation uses only holdout, never training labels.
+The committed seed corpus is a mechanism fixture, not an independently reviewed
+holdout. Expand and review it separately before making quality claims.
+
+The CLI runs the real lexical baseline and the configured provider twice per
+holdout case. Records contain IDs, baseline prediction, decision, model identity,
+the catalog-order probability vector (`scores`; null for unavailable or invalid
+output), latency, and `coldStart: true`; they do not copy prompts into the
+report. A scored run's confidence and margin must match its vector. Gold
+`unclassified` is represented by null. Nonaccepted model results also predict
+null. The evaluator rejects missing, duplicate or unknown cases, unsupported
+predictions, malformed measurements, and inconsistent model identities. Reruns
+compare the full decision, model identity and score vector, but not measured
+latency: equal top-2 values with a reordered tail still disagree.
+No normalization is permitted for candidate IDs or model revision.
+
+Report both baseline and model accuracy/macro-F1, model coverage, accepted
+precision/error rate, abstention, repeated-decision agreement, and separate
+cold/warm p95. Zero accepted decisions has null precision and never passes.
+Unavailable responses remain abstentions and count against coverage. Null gold
+is included in macro-F1's class set; the four catalog labels are always included
+even when unobserved, preventing favorable per-run class selection.
+
+The evaluator emits explicit rollout checks, not an automatic deployment. It
+requires reviewed holdout counts, semantic/coverage thresholds, repeatability,
+warm measurements, a `pinned` source revision, plus independently retained
+policy and live-host evidence. The report's `evidence.source` keeps the probe
+result (including `mismatch` or `unavailable`) and `environment.python`.
+The latter evidence is not supplied by this offline runner, so it always reports
+those gates pending. With the one-shot adapter, all latency is cold and the warm
+gate also remains pending. Exporting a report never changes router defaults.
+
+## Model suitability
+
+The [CUA-S1-FORMS model card](https://huggingface.co/cua-ai/cua-s1-forms)
+describes a form-specific option scorer, with English-centric training and short
+byte contexts. These results do not establish Harness routing quality. Its
+checkpoint is an experimental baseline, not a production routing checkpoint.
+The [upstream source](https://github.com/trycua/cua/tree/main/libs/cua-s1)
+has a source-only release description; source and checkpoint provenance/licenses
+must be checked independently. Do not infer a published Python wheel or use an
+unversioned download during a prompt hook.
+
+## Planned phases
+
+| Phase | Deliverable | Acceptance evidence |
+| --- | --- | --- |
+| 0 | Versioned option-scoring boundary | Complete positive/negative contract tests |
+| 1 | Local CUA-S1 adapter | Bounded subprocess, artifact validation, explicit failures |
+| 2 | Router integration | Off/shadow/prefer, existing policy invariants, rollback |
+| 3 | Corpus and paired evaluator | Leakage checks, coverage/error metrics, repeatability |
+| 4 | Harness training and rollout | Real checkpoint, reviewed holdout, measured host results |
+
+## Rollout gates
+
+Phase 4 requires a separately reviewed, family-disjoint holdout of at least 200
+cases, at least 50 each in English and Traditional Chinese. Accepted precision
+must be ≥98%, coverage ≥80%, and macro-F1 at least the lexical baseline.
+Policy invariants must remain intact in every case; repeat decisions twice with
+100% agreement. Record checkpoint/source hashes, CPU, OS, runtime, thread count,
+cold latency and warm p95 (target ≤100ms). Synthetic fixtures and mock providers
+only validate mechanisms. They cannot satisfy these model/behavior gates.
+Until measured evidence passes, retain the default, fallback and this open issue.

package/harness-everything/SKILL.md

@@ -4,7 +4,7 @@ description: "Route software/project work through Harness: classify tier/topolog
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.19.1
+  version: 0.22.0
 ---
 
 # Harness Everything