harness-everything 0.21.0 → 0.22.1

package/harness-everything/scripts/system-one/install.js

@@ -8,7 +8,8 @@ const path = require('node:path');
 const { createHash } = require('node:crypto');
 const { spawnSync } = require('node:child_process');
 const { performance } = require('node:perf_hooks');
-const { validateManifest, provenance, score, PINNED_CUA_S1_REVISION } = require('./provider');
+const { validateManifest, readManifest, provenance, score, PINNED_CUA_S1_REVISION } = require('./provider');
+const resident = require('./resident');
 const { createRequest, decide } = require('./contract');
 const { TIER_OPTIONS } = require('./router');
 
@@ -64,8 +65,8 @@ function buildManifest(dir, python) {
   const manifest = { schemaVersion: 1, python, checkpoint: path.join(checkpointDir(dir), PINS.files.weights.name),
     weightsSha256: PINS.files.weights.sha256, configSha256: PINS.files.config.sha256,
     modelId: PINS.modelId, revision: PINS.modelRevision, domain: PINS.domain,
-    // Each score starts a fresh Python process that imports torch; cold start dominates latency.
-    timeoutMs: 10000 };
+    // One-shot fallback budget (fresh Python + torch import per call); resident keeps the model loaded.
+    timeoutMs: 10000, transport: 'resident', idleTimeoutMs: 1800000 };
   validateManifest(manifest);
   return manifest;
 }
@@ -85,7 +86,8 @@ async function ensureFile(url, dest, spec, fetcher = httpFetch) {
   return 'downloaded';
 }
 function exec(cmd, args, capture = false) {
-  const result = spawnSync(cmd, args, { shell: false, windowsHide: true, encoding: 'utf8', stdio: capture ? 'pipe' : 'inherit' });
+  // Child progress goes to stderr (fd 2): stdout carries only the final JSON report.
+  const result = spawnSync(cmd, args, { shell: false, windowsHide: true, encoding: 'utf8', stdio: capture ? 'pipe' : ['ignore', 2, 2] });
   if (result.error || result.status !== 0) throw new Error(`command-failed: ${[cmd, ...args].join(' ')}`);
   return capture ? result.stdout.trim() : '';
 }
@@ -108,20 +110,27 @@ function plan(opts) {
       `${venvPy} -m pip install "${PINS.cuaS1Spec}"`,
       ...Object.values(PINS.files).map(f => `download ${fileUrl(f.name)} (sha256 ${f.sha256})`),
       `write ${manifestPath}`,
-      'verify provenance (pinned revision) and one real CPU inference',
+      'verify provenance (pinned revision), start the resident server, one warm CPU inference, stop it',
     ],
     env: { HARNESS_SYSTEM_ONE_MODE: 'shadow', HARNESS_SYSTEM_ONE_CONFIG: manifestPath } };
 }
+// Starts the resident server (if needed), scores once warm, then stops a server it started.
 function verify(manifestPath) {
   const source = provenance(manifestPath);
+  const manifest = readManifest(manifestPath);
+  const wasRunning = resident.status(manifest, manifestPath).running;
+  const startMs = performance.now();
+  const ready = resident.ensureReady(manifest, manifestPath, 60000);
+  const readyMs = Math.round(performance.now() - startMs);
   const request = createRequest('tier', 'fix a typo in README', TIER_OPTIONS);
   const start = performance.now();
   const result = score(request, manifestPath);
   const latencyMs = Math.round(performance.now() - start);
+  if (!wasRunning) resident.stop(manifest, manifestPath);
   const decision = result.status === 'scored' ? decide(request, result.response) : result;
   const scores = result.status === 'scored' && decision.status !== 'invalid-output' ? result.response.scores : null;
-  const ok = source.status === 'recorded' && source.provenance.cuaS1.sourceRevisionStatus === 'pinned' && scores !== null;
-  return { ok, source, decision, scores, latencyMs };
+  const ok = ready && source.status === 'recorded' && source.provenance.cuaS1.sourceRevisionStatus === 'pinned' && scores !== null;
+  return { ok, source, residentReady: ready, readyMs, decision, scores, latencyMs };
 }
 async function main(argv) {
   const opts = parseArgs(argv);
@@ -149,4 +158,4 @@ if (require.main === module) {
     console.error(`System One install failed: ${err.message}`); process.exitCode = 1;
   });
 }
-module.exports = { PINS, fileUrl, venvPython, supportedPython, pythonCandidates, parseArgs, buildManifest, ensureFile, plan, verify };
+module.exports = { PINS, fileUrl, venvPython, supportedPython, pythonCandidates, parseArgs, buildManifest, ensureFile, exec, plan, verify };

package/harness-everything/scripts/system-one/provider.js

@@ -13,11 +13,13 @@ const label = value => typeof value === 'string' && value.length > 0 && value.le
 function validateManifest(m) {
   const required = ['schemaVersion', 'python', 'checkpoint', 'weightsSha256', 'configSha256', 'modelId', 'revision', 'domain'];
   if (!m || typeof m !== 'object' || Array.isArray(m) || required.some(k => !Object.hasOwn(m, k))
-    || Object.keys(m).some(k => ![...required, 'timeoutMs'].includes(k)) || m.schemaVersion !== 1
+    || Object.keys(m).some(k => ![...required, 'timeoutMs', 'transport', 'idleTimeoutMs'].includes(k)) || m.schemaVersion !== 1
     || ['python', 'modelId', 'revision', 'domain'].some(k => typeof m[k] !== 'string' || !m[k].trim() || m[k].length > 4096 || m[k].includes('\0'))
     || typeof m.checkpoint !== 'string' || !path.isAbsolute(m.checkpoint) || path.extname(m.checkpoint) !== '.safetensors'
     || ['weightsSha256', 'configSha256'].some(k => typeof m[k] !== 'string' || !/^[a-f0-9]{64}$/.test(m[k]))
     || (m.timeoutMs !== undefined && (!Number.isInteger(m.timeoutMs) || m.timeoutMs < 1 || m.timeoutMs > 10000))
+    || (m.transport !== undefined && !['oneshot', 'resident'].includes(m.transport))
+    || (m.idleTimeoutMs !== undefined && (!Number.isInteger(m.idleTimeoutMs) || m.idleTimeoutMs < 60000 || m.idleTimeoutMs > 14400000))
     || (m.modelId === 'cua-ai/cua-s1-forms' && m.domain !== 'forms-v1')) throw new TypeError('invalid-manifest');
   return true;
 }
@@ -48,7 +50,20 @@ function score(request, manifestPath) {
   validateRequest(request);
   let manifest;
   try { manifest = readManifest(manifestPath); } catch (_) { return unavailable('provider-config'); }
-  // Send the exact validated manifest to the child on stdin: no config reread race.
+  if (manifest.transport === 'resident') return require('./resident').score({ ...request }, manifest, manifestPath);
+  return oneShot(request, manifest);
+}
+// Async callers (the hook entry) reach a resident server without the sync worker bridge.
+// One-shot has no server to overlap with, so it runs the same child synchronously.
+async function scoreAsync(request, manifestPath) {
+  validateRequest(request);
+  let manifest;
+  try { manifest = readManifest(manifestPath); } catch (_) { return unavailable('provider-config'); }
+  if (manifest.transport === 'resident') return require('./resident').scoreAsync({ ...request }, manifest, manifestPath);
+  return oneShot(request, manifest);
+}
+// Send the exact validated manifest to the child on stdin: no config reread race.
+function oneShot(request, manifest) {
   return runProvider({ ...request }, manifest.python, [ADAPTER, JSON.stringify(manifest)], manifest.timeoutMs || 2000);
 }
 // The probe reports what is installed; only a PEP 610 VCS commit counts as a source revision.
@@ -73,4 +88,4 @@ function provenance(manifestPath) {
   try { return { status: 'recorded', provenance: validateProvenance(result.value) }; }
   catch (_) { return unavailable('provider-json'); }
 }
-module.exports = { score, runProvider, validateManifest, provenance, validateProvenance, PINNED_CUA_S1_REVISION };
+module.exports = { score, scoreAsync, runProvider, validateManifest, readManifest, provenance, validateProvenance, PINNED_CUA_S1_REVISION };

package/harness-everything/scripts/system-one/resident.js

@@ -0,0 +1,200 @@
+#!/usr/bin/env node
+'use strict';
+// Resident System One client: one verified model stays loaded in a loopback server.
+// A score never blocks on model loading; a cold start returns provider-starting (lexical route wins).
+const fs = require('node:fs');
+const path = require('node:path');
+const { createHash } = require('node:crypto');
+const net = require('node:net');
+const { spawn } = require('node:child_process');
+const { Worker } = require('node:worker_threads');
+const { validateRequest } = require('./contract');
+
+const ADAPTER = path.join(__dirname, 'cua_adapter.py');
+const LOCK_TTL_MS = 60000;
+const CALL_TIMEOUT_MS = 1000;
+const MAX_REPLY_BYTES = 1024 * 1024;
+const unavailable = reason => ({ status: 'unavailable', reason });
+const sleep = ms => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+const exact = (value, keys) => value && typeof value === 'object' && !Array.isArray(value)
+  && Object.keys(value).length === keys.length && keys.every(k => Object.hasOwn(value, k));
+const defaultCommand = manifest => [manifest.python, [ADAPTER, '--serve']];
+
+function stateFiles(manifest, manifestPath) {
+  const digest = createHash('sha256').update(JSON.stringify(manifest)).digest('hex').slice(0, 16);
+  const base = path.join(path.dirname(manifestPath), `system-one-resident-${digest}`);
+  return { state: `${base}.json`, lock: `${base}.starting` };
+}
+function readState(file) {
+  try {
+    const s = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (exact(s, ['schemaVersion', 'pid', 'port', 'token', 'startedAt']) && s.schemaVersion === 1
+      && Number.isInteger(s.pid) && s.pid > 0 && Number.isInteger(s.port) && s.port > 0 && s.port < 65536
+      && typeof s.token === 'string' && /^[0-9a-f]{64}$/.test(s.token) && Number.isFinite(s.startedAt)) return s;
+  } catch (_) { /* absent or unreadable state means no usable server */ }
+  return null;
+}
+function lockInfo(file) {
+  try {
+    const ageMs = Date.now() - fs.statSync(file).mtimeMs;
+    let failed = null;
+    try { const body = JSON.parse(fs.readFileSync(file, 'utf8')); if (typeof body.failed === 'string') failed = body.failed; } catch (_) { /* partial write */ }
+    return { ageMs, failed };
+  } catch (_) { return null; }
+}
+function pidAlive(pid) {
+  try { process.kill(pid, 0); return true; } catch (err) { return err.code === 'EPERM'; }
+}
+function removeIfSame(file, state) {
+  const current = readState(file);
+  if (current && current.pid === state.pid && current.token === state.token) { try { fs.unlinkSync(file); } catch (_) { /* raced */ } }
+}
+
+// One socket round trip on a worker thread; the caller blocks with Atomics.wait (router API is synchronous).
+const WORKER = `
+const net = require('node:net');
+const { workerData } = require('node:worker_threads');
+const { port, payload, signal, out } = workerData;
+const view = new Uint8Array(out); const chunks = []; let size = 0; let done = false;
+const finish = (code, buf) => {
+  if (done) return; done = true;
+  if (buf) { view.set(buf); Atomics.store(signal, 1, buf.length); }
+  Atomics.store(signal, 0, code); Atomics.notify(signal, 0);
+};
+const socket = net.connect({ port, host: '127.0.0.1' }, () => socket.end(payload));
+socket.on('data', c => { size += c.length; if (size > view.length) { finish(4); socket.destroy(); } else chunks.push(c); });
+socket.on('end', () => finish(1, Buffer.concat(chunks)));
+socket.on('error', e => finish(e.code === 'ECONNREFUSED' ? 2 : 3));
+`;
+function callSync(port, message, timeoutMs = CALL_TIMEOUT_MS) {
+  const signal = new Int32Array(new SharedArrayBuffer(8));
+  const out = new SharedArrayBuffer(MAX_REPLY_BYTES);
+  let worker;
+  try {
+    worker = new Worker(WORKER, { eval: true, workerData: { port, payload: `${JSON.stringify(message)}\n`, signal, out } });
+    worker.unref();
+  } catch (_) { return { error: 'io' }; }
+  Atomics.wait(signal, 0, 0, timeoutMs);
+  const code = Atomics.load(signal, 0);
+  worker.terminate();
+  if (code === 0) return { error: 'timeout' };
+  if (code !== 1) return { error: code === 2 ? 'refused' : code === 4 ? 'limit' : 'io' };
+  try { return { reply: JSON.parse(Buffer.from(out, 0, Atomics.load(signal, 1)).toString('utf8')) }; }
+  catch (_) { return { error: 'json' }; }
+}
+// The same round trip for async callers (the hook entry): no worker thread to bootstrap.
+function callAsync(port, message, timeoutMs = CALL_TIMEOUT_MS) {
+  return new Promise(resolve => {
+    const chunks = []; let size = 0; let done = false; let socket = null;
+    const finish = value => { if (done) return; done = true; clearTimeout(timer); if (socket) socket.destroy(); resolve(value); };
+    const timer = setTimeout(() => finish({ error: 'timeout' }), timeoutMs);
+    socket = net.connect({ port, host: '127.0.0.1' }, () => socket.end(`${JSON.stringify(message)}\n`));
+    socket.on('data', c => { size += c.length; if (size > MAX_REPLY_BYTES) finish({ error: 'limit' }); else chunks.push(c); });
+    socket.on('end', () => {
+      try { finish({ reply: JSON.parse(Buffer.concat(chunks).toString('utf8')) }); } catch (_) { finish({ error: 'json' }); }
+    });
+    socket.on('error', e => finish({ error: e.code === 'ECONNREFUSED' ? 'refused' : 'io' }));
+  });
+}
+
+function start(manifest, files, deps) {
+  const lock = lockInfo(files.lock);
+  if (lock && lock.ageMs < LOCK_TTL_MS) return unavailable(lock.failed ? 'provider-unavailable' : 'provider-starting');
+  if (lock) { try { fs.unlinkSync(files.lock); } catch (_) { /* another caller replaced it */ } }
+  try { fs.writeFileSync(files.lock, JSON.stringify({ createdAt: Date.now() }), { flag: 'wx', mode: 0o600 }); }
+  catch (_) { return unavailable('provider-starting'); }
+  let child = null;
+  try {
+    const [exe, prefix] = (deps.command || defaultCommand)(manifest);
+    child = spawn(exe, [...prefix, JSON.stringify(manifest), files.state, files.lock],
+      { detached: true, stdio: 'ignore', windowsHide: true, shell: false });
+    child.on('error', () => { /* recorded synchronously below: a failed spawn has no pid */ });
+    child.unref();
+  } catch (_) { child = null; }
+  // The async 'error' event cannot run while callers block in Atomics.wait, so record the failure now.
+  if (!child || !child.pid) {
+    try { fs.writeFileSync(files.lock, JSON.stringify({ createdAt: Date.now(), failed: 'spawn-failed' })); } catch (_) { /* best effort */ }
+    return unavailable('provider-unavailable');
+  }
+  return unavailable('provider-starting');
+}
+// Returns a live server state, or null after removing state that provably belongs to a dead server.
+function liveState(files) {
+  const state = readState(files.state);
+  if (state && !pidAlive(state.pid)) { removeIfSame(files.state, state); return null; }
+  return state;
+}
+function score(request, manifest, manifestPath, deps = {}) {
+  validateRequest(request);
+  const files = stateFiles(manifest, manifestPath);
+  const state = liveState(files);
+  if (!state) return start(manifest, files, deps);
+  return outcome(callSync(state.port, { token: state.token, op: 'score', request }), files, state, manifest, deps);
+}
+async function scoreAsync(request, manifest, manifestPath, deps = {}) {
+  validateRequest(request);
+  const files = stateFiles(manifest, manifestPath);
+  const state = liveState(files);
+  if (!state) return start(manifest, files, deps);
+  return outcome(await callAsync(state.port, { token: state.token, op: 'score', request }), files, state, manifest, deps);
+}
+function outcome(result, files, state, manifest, deps) {
+  if (result.reply) {
+    if (result.reply.ok === true && Object.hasOwn(result.reply, 'response')) return { status: 'scored', response: result.reply.response };
+    if (result.reply.ok === false) return unavailable(result.reply.reason === 'unauthorized' ? 'provider-unavailable' : 'provider-exit');
+    return unavailable('provider-json');
+  }
+  if (result.error === 'refused') { removeIfSame(files.state, state); return start(manifest, files, deps); }
+  return unavailable({ timeout: 'provider-timeout', limit: 'provider-output-limit', json: 'provider-json' }[result.error] || 'provider-unavailable');
+}
+function ping(state) {
+  const result = callSync(state.port, { token: state.token, op: 'ping' });
+  return result.reply && result.reply.ok === true ? result.reply : null;
+}
+function ensureReady(manifest, manifestPath, waitMs, deps = {}) {
+  const files = stateFiles(manifest, manifestPath);
+  const deadline = Date.now() + waitMs;
+  while (Date.now() < deadline) {
+    const state = liveState(files);
+    if (state && ping(state)) return true;
+    if (!state) {
+      const lock = lockInfo(files.lock);
+      if (lock && lock.failed && lock.ageMs < LOCK_TTL_MS) return false;
+      if (!lock || lock.ageMs >= LOCK_TTL_MS) start(manifest, files, deps);
+    }
+    sleep(100);
+  }
+  return false;
+}
+function status(manifest, manifestPath) {
+  const state = liveState(stateFiles(manifest, manifestPath));
+  const reply = state && ping(state);
+  return reply ? { running: true, pid: state.pid, port: state.port, startedAt: state.startedAt, model: reply.model } : { running: false };
+}
+function stop(manifest, manifestPath) {
+  const files = stateFiles(manifest, manifestPath);
+  const state = liveState(files);
+  if (!state) return false;
+  const result = callSync(state.port, { token: state.token, op: 'shutdown' });
+  if (!(result.reply && result.reply.ok === true)) {
+    try { process.kill(state.pid); } catch (_) { /* already exited */ }
+    removeIfSame(files.state, state);
+  }
+  return true;
+}
+
+if (require.main === module) {
+  const [op, manifestPath, extra] = process.argv.slice(2);
+  let manifest = null;
+  try {
+    if (!['start', 'status', 'stop'].includes(op) || extra) throw new Error('usage');
+    manifest = require('./provider').readManifest(manifestPath);
+  } catch (_) {
+    console.error('Usage: resident.js start|status|stop <absolute manifest path>');
+    process.exit(2);
+  }
+  if (op === 'start') process.exitCode = ensureReady(manifest, manifestPath, 60000) ? 0 : 1;
+  if (op === 'stop') stop(manifest, manifestPath);
+  process.stdout.write(`${JSON.stringify(status(manifest, manifestPath))}\n`);
+}
+module.exports = { stateFiles, readState, callSync, callAsync, score, scoreAsync, ensureReady, status, stop, LOCK_TTL_MS, CALL_TIMEOUT_MS };

package/harness-everything/scripts/system-one/router.js

@@ -23,7 +23,7 @@ function selectTier(input, env = process.env, scorer = provider.score) {
   try { result = scorer(request, env.HARNESS_SYSTEM_ONE_CONFIG); }
   catch (_) { return fallback('provider-unavailable'); }
   if (!result || result.status !== 'scored') {
-    const allowed = ['provider-timeout', 'provider-output-limit', 'provider-exit', 'provider-json', 'provider-config', 'provider-unavailable'];
+    const allowed = ['provider-timeout', 'provider-output-limit', 'provider-exit', 'provider-json', 'provider-config', 'provider-unavailable', 'provider-starting'];
     return fallback(allowed.includes(result?.reason) ? result.reason : 'provider-unavailable');
   }
   const decision = decide(request, result.response);
@@ -34,4 +34,20 @@ function selectTier(input, env = process.env, scorer = provider.score) {
   const reason = input.explicit && accepted ? 'explicit-precedence' : belowFloor ? 'structural-floor' : decision.reason;
   return { tier: applied ? LABELS[decision.selectedId] : input.tier, diagnostic: { mode, ...decision, applied, reason } };
 }
-module.exports = { selectTier, TIER_OPTIONS };
+// Hook entry: score the same fixed-catalog request asynchronously before routing (no sync worker bridge).
+// Returns a scorer for selectTier, or null when System One is off/invalid; nothing is called then.
+async function prescoreTier(prompt, env = process.env, scoreAsync = provider.scoreAsync) {
+  if (!['shadow', 'prefer'].includes(env.HARNESS_SYSTEM_ONE_MODE)) return null;
+  let request;
+  try { request = createRequest('tier', prompt, TIER_OPTIONS); }
+  catch (_) { return null; }
+  let result; let failed = false;
+  try { result = await scoreAsync(request, env.HARNESS_SYSTEM_ONE_CONFIG); }
+  catch (_) { failed = true; }
+  return (req, config) => {
+    if (req.requestHash !== request.requestHash) return provider.score(req, config);
+    if (failed) throw new Error('provider-unavailable');
+    return result;
+  };
+}
+module.exports = { selectTier, prescoreTier, TIER_OPTIONS };

package/harness-everything/scripts/tier-router.js

@@ -231,7 +231,7 @@ function emitDynamicSkills(promptLower, context, recommendedGuides) {
   }
 }
 
-function run(userPrompt, context) {
+function run(userPrompt, context, options = {}) {
   console.log(`[Tier Routing Pre-check]`);
 
   const promptLower = userPrompt.toLowerCase();
@@ -317,7 +317,7 @@ function run(userPrompt, context) {
   const structuralFloor = hasMacroSignal ? 'tier3'
     : !isTrivialDocsEdit && hasMultipleTasks && hasMultipleSentences ? 'tier2' : null;
   const semantic = selectTier({ prompt: userPrompt, tier: recommendedTier, floor: structuralFloor,
-    explicit: Boolean(detectExplicitStrategy(userPrompt, detectFableModel(userPrompt))) });
+    explicit: Boolean(detectExplicitStrategy(userPrompt, detectFableModel(userPrompt))) }, process.env, options.systemOneScorer || undefined);
   if (semantic.diagnostic) console.log(`\n=> SYSTEM ONE: ${JSON.stringify(semantic.diagnostic)}`);
   if (semantic.diagnostic?.applied) {
     recommendedTier = semantic.tier;
@@ -460,12 +460,21 @@ function run(userPrompt, context) {
   return contract;
 }
 
+// Entry point: pre-score System One asynchronously so routing never needs the sync worker bridge.
+async function main(prompt, context) {
+  let systemOneScorer = null;
+  if (['shadow', 'prefer'].includes(process.env.HARNESS_SYSTEM_ONE_MODE)) {
+    try { systemOneScorer = await require('./system-one/router').prescoreTier(prompt); } catch (_) { /* the sync path still scores */ }
+  }
+  run(prompt, context, { systemOneScorer });
+}
+
 if (require.main === module) {
 let userPrompt = process.argv[2] || '';
 let hookContext = null;
 
 if (process.argv[2]) {
-  run(userPrompt);
+  main(userPrompt);
 } else if (process.stdin.isTTY) {
   run('');
 } else {
@@ -482,7 +491,7 @@ if (process.argv[2]) {
     } catch (err) {
       // Not valid JSON on stdin - fall back to argv/manual behavior.
     }
-    run(userPrompt, hookContext);
+    main(userPrompt, hookContext);
   });
 }
 }

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.21.0",
+  "version": "0.22.1",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.21.0",
+  "version": "0.22.1",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.21.0",
+  "version": "0.22.1",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.21.0",
+  "version": "0.22.1",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/scripts/lib/packaging-noise.js

@@ -0,0 +1,6 @@
+'use strict';
+// Untracked local/CI build artifacts that no distribution (installer copy, plugin mirror,
+// public submission) may ship, even when they exist in the working tree.
+const isPackagingNoise = name => name === '__pycache__' || /\.py[co]$/.test(name);
+
+module.exports = { isPackagingNoise };

package/plugins/harness-everything/scripts/lib/skills.js

@@ -2,11 +2,13 @@
 const fs = require('fs');
 const path = require('path');
 const manifest = require('./manifest');
+const { isPackagingNoise } = require('./packaging-noise');
 
 function copyDir(src, dest) {
   fs.mkdirSync(dest, { recursive: true });
   const entries = fs.readdirSync(src, { withFileTypes: true });
   for (const entry of entries) {
+    if (isPackagingNoise(entry.name)) continue;
     const srcPath = path.join(src, entry.name);
     const destPath = path.join(dest, entry.name);
     if (entry.isDirectory()) copyDir(srcPath, destPath);

package/plugins/harness-everything/skills/harness-everything/SKILL.md

@@ -4,7 +4,7 @@ description: "Route software/project work through Harness: classify tier/topolog
 license: Apache-2.0
 metadata:
   author: Miya Daniel
-  version: 0.21.0
+  version: 0.22.1
 ---
 
 # Harness Everything