harness-everything 0.21.0 → 0.22.0

package/ci/fixtures/system-one-resident-stub.py

@@ -0,0 +1,28 @@
+"""Stub scorer behind the real resident server code; never model-quality evidence."""
+import importlib.util
+from pathlib import Path
+import sys
+import time
+
+sys.dont_write_bytecode = True  # never leave __pycache__ in the source tree that packaging copies
+path = Path(__file__).resolve().parents[2] / 'harness-everything/scripts/system-one/cua_adapter.py'
+spec = importlib.util.spec_from_file_location('adapter', path)
+adapter = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(adapter)
+
+
+def factory(weights, manifest):
+    if manifest['modelId'] == 'stub-fail':
+        raise ValueError('load-failed')
+
+    def score(request):
+        if manifest['modelId'] == 'stub-slow':
+            time.sleep(3)
+        return [1.0] + [0.0] * (len(request['options']) - 1)
+    return score, {'context_tokens': 224, 'option_tokens': 96}
+
+
+if __name__ == '__main__':
+    if sys.argv[1:2] != ['--serve']:
+        sys.exit(2)
+    sys.exit(adapter.serve_main(sys.argv[2:], scorer_factory=factory))

package/ci/mechanism-packaging-bytecode.test.js

@@ -0,0 +1,61 @@
+'use strict';
+// Python bytecode written by local/CI test runs is an untracked build artifact; no distribution may ship it.
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { copyDir } = require('../scripts/lib/skills');
+const { filesUnder } = require('../scripts/build-openai-submission');
+const root = path.resolve(__dirname, '..');
+const noise = files => files.filter(f => /(^|[\\/])__pycache__([\\/]|$)|\.py[co]$/.test(f));
+
+function plant(dir) {
+  fs.mkdirSync(path.join(dir, '__pycache__'), { recursive: true });
+  fs.writeFileSync(path.join(dir, '__pycache__', 'cua_adapter.cpython-313.pyc'), 'bytecode');
+  fs.writeFileSync(path.join(dir, 'stray.pyc'), 'bytecode');
+  fs.writeFileSync(path.join(dir, 'keep.py'), 'print(1)\n');
+}
+
+test('PK-01 skills installer copy and submission file walk skip Python bytecode', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-pk-'));
+  try {
+    const src = path.join(tmp, 'src', 'scripts');
+    plant(src);
+    copyDir(path.join(tmp, 'src'), path.join(tmp, 'dest'));
+    const copied = filesUnder(path.join(tmp, 'dest'));
+    assert.deepEqual(noise(copied), []);
+    assert.ok(copied.includes('scripts/keep.py'));
+    const walked = filesUnder(path.join(tmp, 'src'));
+    assert.deepEqual(noise(walked), []);
+    assert.deepEqual(walked, ['scripts/keep.py']);
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+});
+
+test('PK-02 plugin sync does not mirror bytecode from the canonical tree', () => {
+  const canonical = path.join(root, 'harness-everything', 'scripts', 'system-one');
+  const planted = [path.join(canonical, '__pycache__', 'cua_adapter.cpython-313.pyc'), path.join(canonical, 'stray.pyc')];
+  const hadCache = fs.existsSync(path.join(canonical, '__pycache__'));
+  try {
+    fs.mkdirSync(path.join(canonical, '__pycache__'), { recursive: true });
+    for (const file of planted) fs.writeFileSync(file, 'bytecode');
+    const sync = spawnSync(process.execPath, [path.join(root, 'scripts', 'sync-openai-plugin.js')], { cwd: root, encoding: 'utf8' });
+    assert.equal(sync.status, 0, sync.stderr);
+    const mirror = path.join(root, 'plugins', 'harness-everything', 'skills', 'harness-everything', 'scripts', 'system-one');
+    assert.deepEqual(noise(filesUnder(mirror)), []);
+    assert.equal(fs.existsSync(path.join(mirror, '__pycache__')), false);
+  } finally {
+    for (const file of planted) fs.rmSync(file, { force: true });
+    if (!hadCache) fs.rmSync(path.join(canonical, '__pycache__'), { recursive: true, force: true });
+  }
+});
+
+test('PK-03 Python tests do not write bytecode into the source tree', () => {
+  const canonical = path.join(root, 'harness-everything', 'scripts', 'system-one');
+  fs.rmSync(path.join(canonical, '__pycache__'), { recursive: true, force: true });
+  const python = process.env.PYTHON || (process.platform === 'win32' ? 'python' : 'python3');
+  const run = spawnSync(python, [path.join(__dirname, 'system-one-adapter-test.py')], { encoding: 'utf8', env: { ...process.env, PYTHONDONTWRITEBYTECODE: '' } });
+  assert.equal(run.status, 0, run.stderr);
+  assert.equal(fs.existsSync(path.join(canonical, '__pycache__')), false);
+});

package/ci/mechanism-system-one-install.test.js

@@ -28,6 +28,7 @@ test('S1-I01 pins stay consistent with the provider contract', () => {
   assert.equal(manifest.checkpoint, path.join(dir, 'checkpoints', PINS.modelRevision, PINS.files.weights.name));
   assert.equal(manifest.weightsSha256, PINS.files.weights.sha256); assert.equal(manifest.configSha256, PINS.files.config.sha256);
   assert.equal(manifest.revision, PINS.modelRevision); assert.equal(manifest.timeoutMs, 10000);
+  assert.equal(manifest.transport, 'resident'); assert.equal(manifest.idleTimeoutMs, 1800000);
 });
 
 test('S1-I02 interpreter selection accepts only the upstream-supported Python range', () => {
@@ -76,6 +77,16 @@ test('S1-I04 downloads are verified before an atomic write; a valid file is reus
   } finally { fs.rmSync(dir, { recursive: true, force: true }); }
 });
 
+test('S1-I06 child command output goes to stderr so stdout stays machine-readable JSON', () => {
+  const code = `require(${JSON.stringify(script)}).exec(process.execPath, ['-e', 'console.log("pip-noise")'])`;
+  const child = spawnSync(process.execPath, ['-e', code], { encoding: 'utf8' });
+  assert.equal(child.status, 0, child.stderr);
+  assert.equal(child.stdout, '');
+  assert.match(child.stderr, /pip-noise/);
+  const captured = spawnSync(process.execPath, ['-e', `process.stdout.write(require(${JSON.stringify(script)}).exec(process.execPath, ['-e', 'console.log("3.13.6")'], true))`], { encoding: 'utf8' });
+  assert.equal(captured.stdout, '3.13.6');
+});
+
 test('S1-I05 dry run prints the pinned plan and changes nothing, repeatably', () => {
   const dir = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'harness-s1-dry-')), 'target');
   try {

package/ci/mechanism-system-one-resident.test.js

@@ -0,0 +1,185 @@
+'use strict';
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { createHash } = require('node:crypto');
+const { spawnSync } = require('node:child_process');
+const resident = require('../harness-everything/scripts/system-one/resident');
+const provider = require('../harness-everything/scripts/system-one/provider');
+const { createRequest, decide } = require('../harness-everything/scripts/system-one/contract');
+const { TIER_OPTIONS } = require('../harness-everything/scripts/system-one/router');
+const python = process.env.PYTHON || (process.platform === 'win32' ? 'python' : 'python3');
+const stub = path.join(__dirname, 'fixtures/system-one-resident-stub.py');
+const request = createRequest('tier', 'fix a typo in README', TIER_OPTIONS);
+const sha = file => createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+const sleep = ms => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+
+function fixture(modelId = 'stub') {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-s1-resident-'));
+  const checkpoint = path.join(dir, 'model.safetensors');
+  fs.writeFileSync(checkpoint, 'synthetic-not-real-weights');
+  fs.writeFileSync(path.join(dir, 'model.json'), '{}');
+  const manifest = { schemaVersion: 1, python, checkpoint, weightsSha256: sha(checkpoint), configSha256: sha(path.join(dir, 'model.json')),
+    modelId, revision: 'v1', domain: 'harness-routing-v1', transport: 'resident', idleTimeoutMs: 60000 };
+  const manifestPath = path.join(dir, 'manifest.json');
+  fs.writeFileSync(manifestPath, JSON.stringify(manifest));
+  const spawns = [];
+  const deps = { command: m => { spawns.push(m.modelId); return [python, [stub, '--serve']]; } };
+  return { dir, manifest, manifestPath, spawns, deps };
+}
+function cleanup(f) {
+  try { resident.stop(f.manifest, f.manifestPath); } catch (_) { /* best effort */ }
+  fs.rmSync(f.dir, { recursive: true, force: true });
+}
+
+test('S1-RS01 manifest transport fields and digest-bound file names', () => {
+  const f = fixture();
+  try {
+    assert.equal(provider.validateManifest(f.manifest), true);
+    for (const change of [{ transport: 'oneshot' }, { idleTimeoutMs: 60000 }, { idleTimeoutMs: 14400000 }]) assert.equal(provider.validateManifest({ ...f.manifest, ...change }), true);
+    for (const change of [{ transport: 'daemon' }, { transport: '' }, { idleTimeoutMs: 59999 }, { idleTimeoutMs: 14400001 }, { idleTimeoutMs: '60000' }]) {
+      assert.throws(() => provider.validateManifest({ ...f.manifest, ...change }));
+    }
+    const files = resident.stateFiles(f.manifest, f.manifestPath);
+    const digest = createHash('sha256').update(JSON.stringify(f.manifest)).digest('hex').slice(0, 16);
+    assert.equal(files.state, path.join(f.dir, `system-one-resident-${digest}.json`));
+    assert.equal(files.lock, path.join(f.dir, `system-one-resident-${digest}.starting`));
+    assert.notEqual(resident.stateFiles({ ...f.manifest, revision: 'v2' }, f.manifestPath).state, files.state);
+  } finally { cleanup(f); }
+});
+
+test('S1-RS02 cold start never blocks, spawns once, then serves warm repeatable scores', () => {
+  const f = fixture();
+  try {
+    assert.deepEqual(resident.score(request, f.manifest, f.manifestPath, f.deps), { status: 'unavailable', reason: 'provider-starting' });
+    assert.deepEqual(resident.score(request, f.manifest, f.manifestPath, f.deps), { status: 'unavailable', reason: 'provider-starting' });
+    assert.deepEqual(f.spawns, ['stub']);
+    assert.equal(resident.ensureReady(f.manifest, f.manifestPath, 20000, f.deps), true);
+    assert.equal(f.spawns.length, 1);
+    const one = resident.score(request, f.manifest, f.manifestPath, f.deps);
+    const two = resident.score(request, f.manifest, f.manifestPath, f.deps);
+    assert.equal(one.status, 'scored'); assert.deepEqual(one, two);
+    assert.equal(decide(request, one.response).selectedId, 'tier1');
+    assert.equal(resident.status(f.manifest, f.manifestPath).running, true);
+    assert.equal(resident.stop(f.manifest, f.manifestPath), true);
+    const deadline = Date.now() + 5000;
+    while (fs.existsSync(resident.stateFiles(f.manifest, f.manifestPath).state) && Date.now() < deadline) sleep(50);
+    assert.equal(resident.status(f.manifest, f.manifestPath).running, false);
+  } finally { cleanup(f); }
+});
+
+test('S1-RS03 stale state is removed and replaced; a wrong token is rejected without respawn', () => {
+  const f = fixture();
+  try {
+    const { state } = resident.stateFiles(f.manifest, f.manifestPath);
+    const dead = spawnSync(process.execPath, ['-e', '0']).pid;
+    fs.writeFileSync(state, JSON.stringify({ schemaVersion: 1, pid: dead, port: 9, token: 'a'.repeat(64), startedAt: 1 }));
+    assert.deepEqual(resident.score(request, f.manifest, f.manifestPath, f.deps), { status: 'unavailable', reason: 'provider-starting' });
+    assert.equal(f.spawns.length, 1);
+    assert.equal(resident.ensureReady(f.manifest, f.manifestPath, 20000, f.deps), true);
+    const good = JSON.parse(fs.readFileSync(state, 'utf8'));
+    fs.writeFileSync(state, JSON.stringify({ ...good, token: 'b'.repeat(64) }));
+    assert.deepEqual(resident.score(request, f.manifest, f.manifestPath, f.deps), { status: 'unavailable', reason: 'provider-unavailable' });
+    assert.equal(f.spawns.length, 1);
+    fs.writeFileSync(state, JSON.stringify(good));
+    for (const bad of ['not-json', JSON.stringify({ ...good, extra: 1 }), JSON.stringify({ ...good, token: 'short' })]) {
+      fs.writeFileSync(state, bad);
+      assert.equal(resident.status(f.manifest, f.manifestPath).running, false);
+    }
+    fs.writeFileSync(state, JSON.stringify(good));
+  } finally { cleanup(f); }
+});
+
+test('S1-RS04 a slow server times out within the deadline and is not respawned', () => {
+  const f = fixture('stub-slow');
+  try {
+    assert.equal(resident.ensureReady(f.manifest, f.manifestPath, 20000, f.deps), true);
+    const start = Date.now();
+    assert.deepEqual(resident.score(request, f.manifest, f.manifestPath, f.deps), { status: 'unavailable', reason: 'provider-timeout' });
+    assert.ok(Date.now() - start < 2500);
+    assert.equal(f.spawns.length, 1);
+  } finally { cleanup(f); }
+});
+
+test('S1-RS05 startup failure is visible and throttled instead of respawning every prompt', () => {
+  const f = fixture('stub-fail');
+  try {
+    assert.equal(resident.score(request, f.manifest, f.manifestPath, f.deps).reason, 'provider-starting');
+    assert.equal(resident.ensureReady(f.manifest, f.manifestPath, 20000, f.deps), false);
+    const lock = JSON.parse(fs.readFileSync(resident.stateFiles(f.manifest, f.manifestPath).lock, 'utf8'));
+    assert.equal(lock.failed, 'load-failed');
+    assert.deepEqual(resident.score(request, f.manifest, f.manifestPath, f.deps), { status: 'unavailable', reason: 'provider-unavailable' });
+    assert.equal(f.spawns.length, 1);
+  } finally { cleanup(f); }
+});
+
+test('S1-RS06 provider dispatch uses the real adapter and reports a missing ML runtime', () => {
+  const f = fixture();
+  try {
+    assert.deepEqual(provider.score(request, f.manifestPath), { status: 'unavailable', reason: 'provider-starting' });
+    const { lock } = resident.stateFiles(f.manifest, f.manifestPath);
+    const deadline = Date.now() + 20000;
+    while (Date.now() < deadline && !(fs.existsSync(lock) && JSON.parse(fs.readFileSync(lock, 'utf8')).failed)) sleep(100);
+    const probe = spawnSync(python, ['-c', 'import torch, cua_s1'], { encoding: 'utf8' });
+    if (probe.status !== 0) {
+      assert.equal(JSON.parse(fs.readFileSync(lock, 'utf8')).failed, 'load-failed');
+      assert.deepEqual(provider.score(request, f.manifestPath), { status: 'unavailable', reason: 'provider-unavailable' });
+    }
+    const off = { ...f.manifest, transport: 'oneshot' };
+    fs.writeFileSync(f.manifestPath, JSON.stringify(off));
+    assert.notEqual(provider.score(request, f.manifestPath).reason, 'provider-starting');
+  } finally { cleanup(f); }
+});
+
+test('S1-RS07 operator CLI reports status and stops a running server', () => {
+  const f = fixture();
+  try {
+    const cli = args => spawnSync(process.execPath, [path.join(__dirname, '../harness-everything/scripts/system-one/resident.js'), ...args], { encoding: 'utf8' });
+    assert.equal(JSON.parse(cli(['status', f.manifestPath]).stdout).running, false);
+    assert.equal(resident.ensureReady(f.manifest, f.manifestPath, 20000, f.deps), true);
+    const running = JSON.parse(cli(['status', f.manifestPath]).stdout);
+    assert.equal(running.running, true); assert.ok(!JSON.stringify(running).includes('token'));
+    assert.equal(cli(['stop', f.manifestPath]).status, 0);
+    const deadline = Date.now() + 5000;
+    while (JSON.parse(cli(['status', f.manifestPath]).stdout).running && Date.now() < deadline) sleep(50);
+    assert.equal(JSON.parse(cli(['status', f.manifestPath]).stdout).running, false);
+    assert.equal(cli(['bogus', f.manifestPath]).status, 2);
+    assert.equal(cli(['status', 'relative.json']).status, 2);
+  } finally { cleanup(f); }
+});
+
+test('S1-RS08 an executable that cannot spawn is recorded as a visible, throttled failure', () => {
+  const f = fixture();
+  try {
+    const missing = path.join(f.dir, 'no-such-python.exe');
+    const deps = { command: () => { f.spawns.push('missing'); return [missing, []]; } };
+    assert.deepEqual(resident.score(request, f.manifest, f.manifestPath, deps), { status: 'unavailable', reason: 'provider-unavailable' });
+    assert.equal(JSON.parse(fs.readFileSync(resident.stateFiles(f.manifest, f.manifestPath).lock, 'utf8')).failed, 'spawn-failed');
+    assert.deepEqual(resident.score(request, f.manifest, f.manifestPath, deps), { status: 'unavailable', reason: 'provider-unavailable' });
+    assert.equal(resident.ensureReady(f.manifest, f.manifestPath, 2000, deps), false);
+    assert.deepEqual(f.spawns, ['missing']);
+  } finally { cleanup(f); }
+});
+
+test('S1-RS09 a corrupted state file never leaves an orphan server behind', () => {
+  const f = fixture();
+  try {
+    assert.equal(resident.ensureReady(f.manifest, f.manifestPath, 20000, f.deps), true);
+    const { state } = resident.stateFiles(f.manifest, f.manifestPath);
+    const old = JSON.parse(fs.readFileSync(state, 'utf8'));
+    fs.writeFileSync(state, 'corrupt');
+    assert.equal(resident.ensureReady(f.manifest, f.manifestPath, 20000, f.deps), true);
+    const fresh = JSON.parse(fs.readFileSync(state, 'utf8'));
+    assert.notEqual(fresh.pid, old.pid);
+    // "Stopped serving" is the contract. On POSIX an exited child stays a zombie (kill(pid, 0) succeeds)
+    // until this blocked test process reaps it, so a refused/failed ping also proves the server is gone.
+    const alive = pid => { try { process.kill(pid, 0); return true; } catch (e) { return e.code === 'EPERM'; } };
+    const serving = () => alive(old.pid) && resident.callSync(old.port, { token: old.token, op: 'ping' }).reply?.ok === true;
+    const deadline = Date.now() + 5000;
+    while (serving() && Date.now() < deadline) sleep(100);
+    assert.equal(serving(), false);
+    assert.equal(resident.status(f.manifest, f.manifestPath).pid, fresh.pid);
+  } finally { cleanup(f); }
+});

package/ci/system-one-adapter-test.py

@@ -2,10 +2,17 @@
 import hashlib
 import importlib.util
 import json
+import os
 from pathlib import Path
+import socket
+import subprocess
+import sys
 import tempfile
+import threading
+import time
 import unittest
 
+sys.dont_write_bytecode = True  # never leave __pycache__ in the source tree that packaging copies
 path = Path(__file__).resolve().parents[1] / 'harness-everything/scripts/system-one/cua_adapter.py'
 spec = importlib.util.spec_from_file_location('adapter', path)
 adapter = importlib.util.module_from_spec(spec)
@@ -52,5 +59,164 @@ class AdapterTests(unittest.TestCase):
         self.assertEqual(json.loads(json.dumps(result)), result)
 
 
+def stub_factory(weights, manifest):
+    return (lambda request: [1.0] + [0.0] * (len(request['options']) - 1)), {'context_tokens': 8, 'option_tokens': 8}
+
+
+def call(port, payload, raw=None):
+    with socket.create_connection(('127.0.0.1', port), timeout=5) as conn:
+        conn.sendall(raw if raw is not None else (json.dumps(payload) + '\n').encode('utf-8'))
+        conn.shutdown(socket.SHUT_WR)
+        data = b''.join(iter(lambda: conn.recv(65536), b''))
+    return json.loads(data)
+
+
+class ResidentServerTests(unittest.TestCase):
+    def setUp(self):
+        self.root = tempfile.TemporaryDirectory()
+        weights = Path(self.root.name) / 'model.safetensors'
+        weights.write_bytes(b'synthetic-not-real-weights')
+        weights.with_suffix('.json').write_text('{}', encoding='utf-8')
+        self.weights = weights
+        self.manifest = {'checkpoint': str(weights), 'modelId': 'stub', 'revision': 'v1', 'domain': 'harness-routing-v1',
+                         'weightsSha256': hashlib.sha256(weights.read_bytes()).hexdigest(),
+                         'configSha256': hashlib.sha256(weights.with_suffix('.json').read_bytes()).hexdigest()}
+        self.state = Path(self.root.name) / 'state.json'
+        self.lock = Path(self.root.name) / 'state.starting'
+        self.lock.write_text('{}', encoding='utf-8')
+
+    def tearDown(self):
+        self.root.cleanup()
+
+    def start(self, idle=30):
+        thread = threading.Thread(target=adapter.serve, args=(self.manifest, self.state, self.lock),
+                                  kwargs={'scorer_factory': stub_factory, 'idle_timeout_s': idle}, daemon=True)
+        thread.start()
+        deadline = time.time() + 10
+        while not self.state.exists() and time.time() < deadline:
+            time.sleep(0.02)
+        self.assertTrue(self.state.exists())
+        return thread, json.loads(self.state.read_text(encoding='utf-8'))
+
+    def request(self, context='fix', options=('a', 'b')):
+        return {'schemaVersion': 1, 'task': 'tier', 'context': context, 'requestHash': 'a' * 64, 'catalogHash': 'b' * 64,
+                'options': [{'id': f'o{i}', 'text': t} for i, t in enumerate(options)]}
+
+    def test_protocol_auth_limits_and_shutdown(self):
+        thread, state = self.start()
+        self.assertEqual(set(state), {'schemaVersion', 'pid', 'port', 'token', 'startedAt'})
+        self.assertRegex(state['token'], r'^[0-9a-f]{64}$')
+        self.assertEqual(state['pid'], os.getpid())
+        self.assertFalse(self.lock.exists())
+        if os.name == 'posix':
+            self.assertEqual(self.state.stat().st_mode & 0o777, 0o600)
+        token, port = state['token'], state['port']
+        self.assertEqual(call(port, {'token': token, 'op': 'ping'})['ok'], True)
+        self.assertEqual(call(port, {'token': '0' * 64, 'op': 'ping'}), {'ok': False, 'reason': 'unauthorized'})
+        self.assertEqual(call(port, {'op': 'ping'}), {'ok': False, 'reason': 'unauthorized'})
+        self.assertEqual(call(port, None, raw=b'not-json\n'), {'ok': False, 'reason': 'invalid-request'})
+        self.assertEqual(call(port, None, raw=b'x' * (2 * 1024 * 1024 + 2)), {'ok': False, 'reason': 'request-limit'})
+        self.assertEqual(call(port, {'token': token, 'op': 'unknown'}), {'ok': False, 'reason': 'invalid-request'})
+        reply = call(port, {'token': token, 'op': 'score', 'request': self.request()})
+        self.assertEqual(reply['ok'], True)
+        self.assertEqual(reply['response']['requestHash'], 'a' * 64)
+        self.assertEqual(reply['response']['model'], {'id': 'stub', 'revision': 'v1', 'domain': 'harness-routing-v1'})
+        self.assertEqual([s['probability'] for s in reply['response']['scores']], [1.0, 0.0])
+        self.assertEqual(call(port, {'token': token, 'op': 'score', 'request': self.request(context='123456789')}),
+                         {'ok': False, 'reason': 'input-too-long'})
+        self.assertEqual(call(port, {'token': token, 'op': 'score', 'request': {'context': 'x'}}), {'ok': False, 'reason': 'invalid-request'})
+        self.assertEqual(call(port, {'token': token, 'op': 'shutdown'}), {'ok': True})
+        thread.join(5)
+        self.assertFalse(thread.is_alive())
+        self.assertFalse(self.state.exists())
+
+    def test_artifact_change_stops_server(self):
+        thread, state = self.start()
+        time.sleep(0.05)
+        self.weights.write_bytes(b'changed-weights-with-new-size')
+        reply = call(state['port'], {'token': state['token'], 'op': 'score', 'request': self.request()})
+        self.assertEqual(reply, {'ok': False, 'reason': 'artifact-changed'})
+        thread.join(5)
+        self.assertFalse(thread.is_alive())
+        self.assertFalse(self.state.exists())
+
+    def test_idle_timeout_exits_and_removes_state(self):
+        thread, _ = self.start(idle=0.3)
+        thread.join(5)
+        self.assertFalse(thread.is_alive())
+        self.assertFalse(self.state.exists())
+
+    @unittest.skipUnless(os.name == 'nt', 'Windows DACL')
+    def test_state_file_has_owner_only_explicit_dacl_on_windows(self):
+        thread, state = self.start()
+        # Drop the file path (it contains "C:\Users\...") and keep only the ACE text.
+        acl = subprocess.run(['icacls', str(self.state)], capture_output=True, text=True).stdout.replace(str(self.state), '')
+        self.assertIn(':(F)', acl)
+        for bad in ['(I)', 'Users', 'Everyone', 'Administrators', 'SYSTEM']:
+            self.assertNotIn(bad, acl)
+        call(state['port'], {'token': state['token'], 'op': 'shutdown'})
+        thread.join(5)
+
+    @unittest.skipUnless(os.name == 'nt', 'Windows DACL')
+    def test_explicit_foreign_aces_are_replaced_not_kept(self):
+        # CI runners create files with explicit (non-inherited) SYSTEM/Administrators/OWNER RIGHTS entries.
+        target = Path(self.root.name) / 'explicit.json'
+        target.write_text('{}', encoding='utf-8')
+        subprocess.run(['icacls', str(target), '/inheritance:d'], capture_output=True, check=True)
+        subprocess.run(['icacls', str(target), '/grant', '*S-1-5-32-544:F', '*S-1-5-18:F', '*S-1-3-4:F', '*S-1-5-32-545:R'], capture_output=True, check=True)
+        adapter._restrict_to_current_user(target)
+        acl = subprocess.run(['icacls', str(target)], capture_output=True, text=True).stdout.replace(str(target), '')
+        self.assertEqual(acl.count(':('), 1)
+        self.assertIn(':(F)', acl)
+
+    def test_slow_client_does_not_block_others_and_burst_is_served(self):
+        thread, state = self.start()
+        idle = socket.create_connection(('127.0.0.1', state['port']), timeout=5)
+        try:
+            began = time.monotonic()
+            self.assertEqual(call(state['port'], {'token': state['token'], 'op': 'ping'})['ok'], True)
+            self.assertLess(time.monotonic() - began, 0.5)
+            results = []
+            workers = [threading.Thread(target=lambda: results.append(call(state['port'], {'token': state['token'], 'op': 'ping'}))) for _ in range(32)]
+            for w in workers:
+                w.start()
+            for w in workers:
+                w.join(10)
+            self.assertEqual(len(results), 32)
+            self.assertTrue(all(r.get('ok') is True or r == {'ok': False, 'reason': 'busy'} for r in results))
+            self.assertGreaterEqual(sum(1 for r in results if r.get('ok') is True), 16)
+        finally:
+            idle.close()
+        call(state['port'], {'token': state['token'], 'op': 'shutdown'})
+        thread.join(5)
+
+    def test_server_exits_when_its_state_file_no_longer_names_it(self):
+        thread, _ = self.start()
+        self.state.write_text('{"corrupt": true}', encoding='utf-8')
+        thread.join(5)
+        self.assertFalse(thread.is_alive())
+        self.assertEqual(self.state.read_text(encoding='utf-8'), '{"corrupt": true}')
+
+    def test_rejects_requests_outside_phase0_structure(self):
+        thread, state = self.start()
+        token, port = state['token'], state['port']
+        many = self.request(options=tuple('x' for _ in range(257)))
+        extra = dict(self.request(), extra=1)
+        dup = self.request(); dup['options'][1]['id'] = dup['options'][0]['id']
+        bad_id = self.request(); bad_id['options'][0]['id'] = 'Bad ID'
+        wrong_version = dict(self.request(), schemaVersion=2)
+        for request in [many, extra, dup, bad_id, wrong_version]:
+            self.assertEqual(call(port, {'token': token, 'op': 'score', 'request': request}), {'ok': False, 'reason': 'invalid-request'})
+        self.assertEqual(call(port, {'token': token, 'op': 'score', 'request': self.request(options=tuple('x' for _ in range(256)))})['ok'], True)
+        call(port, {'token': token, 'op': 'shutdown'})
+        thread.join(5)
+
+    def test_startup_failure_is_recorded_in_lock(self):
+        self.manifest['weightsSha256'] = '0' * 64
+        adapter.serve(self.manifest, self.state, self.lock, scorer_factory=stub_factory, idle_timeout_s=1)
+        self.assertFalse(self.state.exists())
+        self.assertEqual(json.loads(self.lock.read_text(encoding='utf-8'))['failed'], 'artifact-hash')
+
+
 if __name__ == '__main__':
     unittest.main()

package/docs/platform-capabilities.md

@@ -129,5 +129,8 @@ structural floor. Canonical and packaged runtime copies use the same
 contract; this establishes no new live-host capability. Python, PyTorch and a
 compatible local checkpoint are optional external dependencies, not npm payloads;
 the explicit `npm run system-one:install` sets them up and hooks never run it.
+With `transport: "resident"`, an opted-in router hook may spawn one detached
+loopback-only Python server per manifest; host survival of that process after
+a hook exits is not live-verified.
 Public Skills-only artifacts do not acquire lifecycle hooks from this feature.
 See [System One routing](system-one-routing.md) for limits, rollback and evidence.

package/docs/system-one-routing.md

@@ -68,10 +68,13 @@ installs the pinned `cua_s1` Git URL. It downloads the `cua-ai/cua-s1-forms`
 safetensors weights and JSON sidecar at Hugging Face revision
 `f54adbf447f4ca6ec259f529ee3f2e3e09f8cc71`, verifies pinned sizes and SHA-256
 before an atomic write (the pickle `.pt` is never fetched), and writes
-`<dir>/manifest.json` with `timeoutMs: 10000`. The default `<dir>` is
+`<dir>/manifest.json` with `timeoutMs: 10000`, `transport: "resident"` and
+`idleTimeoutMs: 1800000`. The default `<dir>` is
 `~/.agents/harness-everything/system-one`; `--dir` takes an absolute path and
 `--dry-run` prints the plan without changes. Acceptance requires a `pinned`
-provenance probe and one real CPU inference; otherwise the exit code is 1.
+provenance probe and one real warm CPU inference through a resident server that
+the installer starts and then stops; otherwise the exit code is 1. Child-process
+output goes to stderr; stdout carries only the JSON report.
 Torch/numpy/safetensors versions resolve at install time and are recorded by
 the probe. The installer does not change the router mode: it prints
 `HARNESS_SYSTEM_ONE_MODE=shadow` and the manifest path for the host
@@ -88,13 +91,79 @@ No prompts or model values are written to disk or echoed in error messages.
 
 The Node transport has a hard timeout and a 1 MiB stdout/stderr bound; it kills
 the direct child on timeout. It starts one short-lived Python process per score
-request. This is an evaluation bridge, not a warm, persistent low-latency server.
+request. This is the default `oneshot` transport, not a warm server; see the
+resident provider below.
 The process cannot execute actions and is not given a CUA driver. Failures return
 `{status: 'unavailable', reason}` with a bounded reason code; malformed score
 responses are checked by Phase 0. Transport fixtures prove IPC and failure
 handling only. Real checkpoint inference and measured CPU latency remain a
 separate gate, with explicit unavailable evidence if dependencies are absent.
 
+## Resident provider (Phase 4 prerequisite)
+
+The one-shot bridge pays Python start, `import torch` and checkpoint load on every
+call (measured ≈5 s on CPU); warm in-process inference is a few milliseconds. The
+manifest may set `transport: "resident"` (default `"oneshot"`) and optional
+`idleTimeoutMs` (60000–14400000, default 1800000) to keep one verified model in
+memory. Other manifest rules are unchanged; the timeout remains one-shot only.
+
+**Lifecycle.** A resident-mode score never blocks on model loading. If no live
+server exists, the Node provider creates a start lock with exclusive-create,
+spawns `cua_adapter.py --serve` detached with the configured Python (no shell),
+and returns `unavailable/provider-starting`, so the lexical route is used for
+that prompt. Concurrent callers seeing a lock younger than 60 s do not spawn
+again. The server verifies artifact hashes before `load_checkpoint`, writes its
+state file atomically, then removes the lock. A startup failure writes a bounded
+reason into the lock and exits; callers report `provider-unavailable` without
+respawning until the lock is 60 s old. An executable that cannot be spawned at
+all is detected synchronously (no child PID) and recorded as `spawn-failed` the
+same way. The server exits after `idleTimeoutMs` without requests, on
+`shutdown`, when either checkpoint file's size or modification time changes
+(`artifact-changed`), or as soon as its state file no longer names its PID and
+token (replaced, corrupted or deleted), so an undiscoverable server never
+lingers as an orphan. It deletes only a state file that still names it.
+
+**Files.** State and lock live beside the manifest as
+`system-one-resident-<digest>.json` / `.starting`, where `<digest>` is the first
+16 hex digits of SHA-256 of the parsed manifest re-serialized with `JSON.stringify`
+(file key order). Editing the manifest
+therefore selects a new server; the old one exits when idle. The state file has
+exactly `schemaVersion: 1`, `pid`, `port`, `token` (64 hex), and `startedAt`, and
+is created with mode 0600; on Windows the file instead receives an explicit
+DACL with inheritance removed and a single full-control entry for the current
+user's SID before the token is written. The manifest directory must still be
+writable only by that user: whoever can replace files there can redirect the
+client, and whoever can edit the manifest chooses the executable.
+
+**Protocol.** The server binds only `127.0.0.1` on an ephemeral port and handles
+one request per connection: one newline-terminated JSON object of at most 2 MiB
+with `token`, `op` (`score`, `ping`, `shutdown`) and, for `score`, a request with
+the exact Phase 0 structure (fields, lowercase IDs, unique options, 2–256
+options, 64-hex fingerprints). Connections are served concurrently, up to 64, each
+with a 1 s read deadline; beyond that the reply is `busy`. Inference itself is
+serialized, so a silent or slow client cannot delay other callers. Tokens are compared in constant time; a mismatch returns
+`{ok: false, reason: "unauthorized"}`. `score` applies the same byte limits
+(no truncation) and returns `{ok: true, response}` in the Phase 0 response
+format, which Phase 0 validation still checks. Any other failure returns
+`{ok: false, reason}` with a bounded code; no prompt, traceback, path or score is
+echoed in errors. The server never executes actions and is not given a driver.
+
+**Client.** The router API is synchronous, so the client performs one socket
+round trip on a worker thread and waits with `Atomics.wait` (1000 ms deadline).
+Results map to the existing reasons: timeout → `provider-timeout` (no respawn);
+refused connection or dead PID → stale state removed and a new start
+(`provider-starting`); `unauthorized` → `provider-unavailable`; any other
+server-declined request → `provider-exit`; malformed replies → `provider-json`.
+
+**Operators.** `node harness-everything/scripts/system-one/resident.js
+start|status|stop <absolute manifest>` controls a server explicitly; `start`
+waits up to 60 s for readiness. The evaluation CLI waits for readiness before
+measuring, so resident runs are recorded with `coldStart: false`. The installer
+writes `transport: "resident"`, verifies one resident score, and stops the server
+it started. Repository tests use a stub scorer behind the real server/protocol
+code; they prove the mechanism, not host survival of detached processes or model
+quality. Those require retained evidence.
+
 ## Phase 2: tier integration and rollback
 
 Set `HARNESS_SYSTEM_ONE_MODE=off|shadow|prefer` in the host environment. Default

package/harness-everything/SKILL.md

@@ -4,7 +4,7 @@ description: "Route software/project work through Harness: classify tier/topolog
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.21.0
+  version: 0.22.0
 ---
 
 # Harness Everything