metaharness 0.3.1 → 0.3.2

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 RuvNet (https://ruv.io)
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 RuvNet (https://ruv.io)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,81 +1,118 @@
-# metaharness
-
-Scaffold your own focused AI agent harness — like [ruflo](https://github.com/ruvnet/ruflo), uniquely yours.
-
-> **Proven at the cost-Pareto frontier.** Same "evolve the harness" thesis, measured: the Darwin harness resolves
-> real **SWE-bench Lite** issues at **34.0%** single-trajectory (~$0.005/inst) and **39.7%** Best-of-3
-> (~$0.015/inst) — conformant, official harness. Live
-> **[Cost–Performance leaderboard](https://ruvnet.github.io/agent-harness-generator/cost-pareto.html)** ·
-> [`@metaharness/darwin`](https://www.npmjs.com/package/@metaharness/darwin).
-
-> Published as **`metaharness`** (the `metaharness` and `harness` CLIs). Earlier versions were published as `create-agent-harness`.
-
-## Quick start
+# metaharness
+
+Scaffold your own focused AI agent harness — like [ruflo](https://github.com/ruvnet/ruflo), uniquely yours.
+
+> **Proven at the cost-Pareto frontier.** Same "evolve the harness" thesis, measured: the Darwin harness resolves
+> real **SWE-bench Lite** issues at **34.0%** single-trajectory (~$0.005/inst) and **39.7%** Best-of-3
+> (~$0.015/inst) — conformant, official harness. Live
+> **[Cost–Performance leaderboard](https://ruvnet.github.io/agent-harness-generator/cost-pareto.html)** ·
+> [`@metaharness/darwin`](https://www.npmjs.com/package/@metaharness/darwin).
+
+> Published as **`metaharness`** (the `metaharness` and `harness` CLIs). Earlier versions were published as `create-agent-harness`.
+
+## Quick start
+
+```bash
+npx metaharness my-bot
+```
+
+You'll be prompted for template, host, description. Out comes a complete npm package ready to `npm publish`.
+
+## Non-interactive
+
+```bash
+npx metaharness my-legal-bot \
+  --template vertical:legal \
+  --host claude-code \
+  --description "Contract redline + risk rating"
+```
+
+## Templates
+
+| Template | Best for |
+|---|---|
+| `minimal` | Custom starter — kernel only |
+| `vertical:devops` | Incident response, on-call workflows |
+| `vertical:support` | Customer support, KB-RAG, escalation |
+| `vertical:trading` | Quant trading (paper-default, circuit breakers) |
+| `vertical:legal` | Contract review with citation checking |
+| `vertical:research` | Multi-source dossier with evidence grading |
+
+## Hosts
+
+`--host` selects which host adapter ships with your harness:
+
+| Host | What you get |
+|---|---|
+| `claude-code` | `.claude/settings.json` with MCP + hooks |
+| `codex` | `~/.codex/config.toml` with `[mcp_servers.*]` |
+| `pi-dev` | Pi extension (TypeScript, no MCP by design) |
+| `hermes` | `cli-config.yaml` + `optional-mcps/*.yaml` |
+| `openclaw` | `~/.openclaw/openclaw.json` + workspace SKILL.md + install runbook |
+| `rvm` | RVM partition manifest + capability table + wasm-guest + install runbook (hardware-isolated) |
+
+Multi-host: pass `--host` multiple times.
+
+## Also ships the `harness` CLI
+
+```bash
+harness sign      # produce/update the witness manifest
+harness verify    # check signature
+harness doctor    # smoke-check a scaffolded harness
+harness score     # runtime-readiness badges for a local repo
+harness help
+```
+
+### `harness score` vs `metaharness score` — two different scorecards (#15)
+
+The two CLIs both accept `score` but emit **different, purpose-specific JSON** — so check the schema
+discriminator before parsing:
+
+| Command | Purpose | JSON discriminator |
+|---|---|---|
+| `harness score <dir> --json` | Runtime-readiness **badges** (score + mcpRisk / releaseReady / testsDetected / sbom / witnessSigned) | `"schema": "harness-quickcheck-v1"` (string) |
+| `metaharness score <dir> --json` | 5-dimension harness-fit **scorecard** (harnessFit / compileConfidence / …) | `"schema": 1` (number) |
+
+They are **not interchangeable**. A consumer wiring one into a pipeline expecting the other should
+branch on `schema` (`typeof out.schema === 'string'` ⇒ harness badges; `=== 1` ⇒ metaharness
+scorecard) and refuse the wrong shape rather than silently defaulting missing fields to `0`.
+
+## Optional Cognitum Meta-Proxy sidecar
+
+Meta-Proxy is an optional local Rust sidecar, not an npm dependency and not part
+of normal harness scaffolding. Install it only when you want a locally bound,
+Claude-compatible routing endpoint with Meta-Proxy's own Cognitum OAuth flow:
 
 ```bash
-npx metaharness my-bot
+npx metaharness proxy install --yes   # signed v0.3.0 download; checksum + Ed25519 verified
+npx metaharness proxy login           # browser or headless Cognitum OAuth, owned by Meta-Proxy
+npx metaharness proxy start
+npx metaharness proxy status
 ```
 
-You'll be prompted for template, host, description. Out comes a complete npm package ready to `npm publish`.
-
-## Non-interactive
-
-```bash
-npx metaharness my-legal-bot \
-  --template vertical:legal \
-  --host claude-code \
-  --description "Contract redline + risk rating"
-```
-
-## Templates
-
-| Template | Best for |
-|---|---|
-| `minimal` | Custom starter — kernel only |
-| `vertical:devops` | Incident response, on-call workflows |
-| `vertical:support` | Customer support, KB-RAG, escalation |
-| `vertical:trading` | Quant trading (paper-default, circuit breakers) |
-| `vertical:legal` | Contract review with citation checking |
-| `vertical:research` | Multi-source dossier with evidence grading |
-
-## Hosts
-
-`--host` selects which host adapter ships with your harness:
-
-| Host | What you get |
-|---|---|
-| `claude-code` | `.claude/settings.json` with MCP + hooks |
-| `codex` | `~/.codex/config.toml` with `[mcp_servers.*]` |
-| `pi-dev` | Pi extension (TypeScript, no MCP by design) |
-| `hermes` | `cli-config.yaml` + `optional-mcps/*.yaml` |
-| `openclaw` | `~/.openclaw/openclaw.json` + workspace SKILL.md + install runbook |
-| `rvm` | RVM partition manifest + capability table + wasm-guest + install runbook (hardware-isolated) |
+`proxy install` downloads the platform archive from the public
+[`meta-proxy-dist`](https://github.com/cognitum-one/meta-proxy-dist) release
+channel only after explicit `--yes` consent. The CLI verifies the signed
+`SHA256SUMS` manifest against a public key pinned in MetaHarness before it
+extracts or replaces a binary. The sidecar is installed under
+`~/.metaharness/meta-proxy/`; credentials remain in Meta-Proxy's own storage.
 
-Multi-host: pass `--host` multiple times.
-
-## Also ships the `harness` CLI
-
-```bash
-harness sign      # produce/update the witness manifest
-harness verify    # check signature
-harness doctor    # smoke-check a scaffolded harness
-harness help
-```
+Other commands: `proxy stop`, `proxy path`, and `proxy logout`.
 
 ## Eject from ruflo
-
-If you've been using ruflo and want your own focused harness from it:
-
-```bash
-npx metaharness --from-existing ./
-```
-
-Lifts agents/skills/commands, rewrites every `ruflo` / `claude-flow` reference, preserves attribution blocks marked with `<!-- ruflo-attribution-block -->`.
-
-## Full walkthrough
-
-See [USAGE.md](https://github.com/ruvnet/agent-harness-generator/blob/main/docs/USAGE.md).
-
-## License
-
-MIT
+
+If you've been using ruflo and want your own focused harness from it:
+
+```bash
+npx metaharness --from-existing ./
+```
+
+Lifts agents/skills/commands, rewrites every `ruflo` / `claude-flow` reference, preserves attribution blocks marked with `<!-- ruflo-attribution-block -->`.
+
+## Full walkthrough
+
+See [USAGE.md](https://github.com/ruvnet/agent-harness-generator/blob/main/docs/USAGE.md).
+
+## License
+
+MIT

package/dist/completions-cmd.js

@@ -34,107 +34,107 @@ const SECRETS_SUBSUBS = ['check', 'fetch', 'validate-token', 'help'];
 const MCP_SUBSUBS = ['ls', 'invoke', 'help'];
 const FEDERATE_SUBSUBS = ['init', 'add', 'remove', 'list', 'status', 'help'];
 function bashCompletion() {
-    return `# bash completion for harness
-_harness_completion() {
-  local cur prev cmd
-  COMPREPLY=()
-  cur="\${COMP_WORDS[COMP_CWORD]}"
-  prev="\${COMP_WORDS[COMP_CWORD-1]}"
-  cmd="\${COMP_WORDS[1]:-}"
-
-  # Top-level subcommands
-  if [ $COMP_CWORD -eq 1 ]; then
-    COMPREPLY=( $(compgen -W "${SUBCOMMANDS.join(' ')}" -- "$cur") )
-    return 0
-  fi
-
-  case "$cmd" in
-    secrets)
-      [ $COMP_CWORD -eq 2 ] && COMPREPLY=( $(compgen -W "${SECRETS_SUBSUBS.join(' ')}" -- "$cur") )
-      ;;
-    mcp)
-      [ $COMP_CWORD -eq 2 ] && COMPREPLY=( $(compgen -W "${MCP_SUBSUBS.join(' ')}" -- "$cur") )
-      ;;
-    federate)
-      [ $COMP_CWORD -eq 2 ] && COMPREPLY=( $(compgen -W "${FEDERATE_SUBSUBS.join(' ')}" -- "$cur") )
-      ;;
-    completions)
-      [ $COMP_CWORD -eq 2 ] && COMPREPLY=( $(compgen -W "bash zsh fish" -- "$cur") )
-      ;;
-  esac
-  return 0
-}
-complete -F _harness_completion harness
+    return `# bash completion for harness
+_harness_completion() {
+  local cur prev cmd
+  COMPREPLY=()
+  cur="\${COMP_WORDS[COMP_CWORD]}"
+  prev="\${COMP_WORDS[COMP_CWORD-1]}"
+  cmd="\${COMP_WORDS[1]:-}"
+
+  # Top-level subcommands
+  if [ $COMP_CWORD -eq 1 ]; then
+    COMPREPLY=( $(compgen -W "${SUBCOMMANDS.join(' ')}" -- "$cur") )
+    return 0
+  fi
+
+  case "$cmd" in
+    secrets)
+      [ $COMP_CWORD -eq 2 ] && COMPREPLY=( $(compgen -W "${SECRETS_SUBSUBS.join(' ')}" -- "$cur") )
+      ;;
+    mcp)
+      [ $COMP_CWORD -eq 2 ] && COMPREPLY=( $(compgen -W "${MCP_SUBSUBS.join(' ')}" -- "$cur") )
+      ;;
+    federate)
+      [ $COMP_CWORD -eq 2 ] && COMPREPLY=( $(compgen -W "${FEDERATE_SUBSUBS.join(' ')}" -- "$cur") )
+      ;;
+    completions)
+      [ $COMP_CWORD -eq 2 ] && COMPREPLY=( $(compgen -W "bash zsh fish" -- "$cur") )
+      ;;
+  esac
+  return 0
+}
+complete -F _harness_completion harness
 `;
 }
 function zshCompletion() {
-    return `#compdef harness
-# zsh completion for harness
-
-_harness() {
-  local -a subcommands
-  subcommands=(
-    'sign:produce or update the witness manifest'
-    'verify:verify the witness manifest signature'
-    'doctor:smoke-check a scaffolded harness'
-    'federate:manage federation peers (init/add/remove/list/status)'
-    'secrets:GCP Secret Manager: check / fetch / validate-token'
-    'validate:umbrella: doctor + verify + path-guard + mcp + secrets'
-    'mcp:list MCP servers / dispatch a tool through the claim check'
-    'publish:pin the harness manifest to IPFS via Pinata (dry-run default)'
-    'upgrade:re-render template + drift plan (--apply to apply)'
-    'completions:emit shell completion scripts (bash/zsh/fish)'
-    'sbom:emit SPDX-2.3 SBOM for the harness'
-    'audit:npm audit per-harness with structured output'
-    'mcp-scan:security-scan the harness MCP surface (policy + perms + deps)'
-    'analyze-repo:recommend a harness from a local repo'
-    'diag:kernel-version skew check (ADR-027 diagnostic)'
-    'export-config:emit MCP servers + claims + permissions as a single JSON'
-    'compare:diff two harnesses (manifest + per-file fingerprints, ADR-031 --bundle)'
-    'genome:7-section readiness scorecard for a local repo (--json/--bundle, iter 110)'
-    'score:5-dimension harness scorecard 0–100 with badges (--json/--bundle, iter 111)'
-    'threat-model:MCP threat-model artifact for PR/compliance review (--json/--bundle, iter 112)'
-    'oia-manifest:emit .harness/oia-manifest.json — OIA v0.1 layer alignment (ADR-034, iter 121)'
-    'help:show help'
-  )
-
-  if (( CURRENT == 2 )); then
-    _describe -t commands 'harness command' subcommands
-    return
-  fi
-
-  case "$words[2]" in
-    secrets)
-      (( CURRENT == 3 )) && compadd ${SECRETS_SUBSUBS.join(' ')}
-      ;;
-    mcp)
-      (( CURRENT == 3 )) && compadd ${MCP_SUBSUBS.join(' ')}
-      ;;
-    federate)
-      (( CURRENT == 3 )) && compadd ${FEDERATE_SUBSUBS.join(' ')}
-      ;;
-    completions)
-      (( CURRENT == 3 )) && compadd bash zsh fish
-      ;;
-  esac
-}
-
-_harness "$@"
+    return `#compdef harness
+# zsh completion for harness
+
+_harness() {
+  local -a subcommands
+  subcommands=(
+    'sign:produce or update the witness manifest'
+    'verify:verify the witness manifest signature'
+    'doctor:smoke-check a scaffolded harness'
+    'federate:manage federation peers (init/add/remove/list/status)'
+    'secrets:GCP Secret Manager: check / fetch / validate-token'
+    'validate:umbrella: doctor + verify + path-guard + mcp + secrets'
+    'mcp:list MCP servers / dispatch a tool through the claim check'
+    'publish:pin the harness manifest to IPFS via Pinata (dry-run default)'
+    'upgrade:re-render template + drift plan (--apply to apply)'
+    'completions:emit shell completion scripts (bash/zsh/fish)'
+    'sbom:emit SPDX-2.3 SBOM for the harness'
+    'audit:npm audit per-harness with structured output'
+    'mcp-scan:security-scan the harness MCP surface (policy + perms + deps)'
+    'analyze-repo:recommend a harness from a local repo'
+    'diag:kernel-version skew check (ADR-027 diagnostic)'
+    'export-config:emit MCP servers + claims + permissions as a single JSON'
+    'compare:diff two harnesses (manifest + per-file fingerprints, ADR-031 --bundle)'
+    'genome:7-section readiness scorecard for a local repo (--json/--bundle, iter 110)'
+    'score:5-dimension harness scorecard 0–100 with badges (--json/--bundle, iter 111)'
+    'threat-model:MCP threat-model artifact for PR/compliance review (--json/--bundle, iter 112)'
+    'oia-manifest:emit .harness/oia-manifest.json — OIA v0.1 layer alignment (ADR-034, iter 121)'
+    'help:show help'
+  )
+
+  if (( CURRENT == 2 )); then
+    _describe -t commands 'harness command' subcommands
+    return
+  fi
+
+  case "$words[2]" in
+    secrets)
+      (( CURRENT == 3 )) && compadd ${SECRETS_SUBSUBS.join(' ')}
+      ;;
+    mcp)
+      (( CURRENT == 3 )) && compadd ${MCP_SUBSUBS.join(' ')}
+      ;;
+    federate)
+      (( CURRENT == 3 )) && compadd ${FEDERATE_SUBSUBS.join(' ')}
+      ;;
+    completions)
+      (( CURRENT == 3 )) && compadd bash zsh fish
+      ;;
+  esac
+}
+
+_harness "$@"
 `;
 }
 function fishCompletion() {
     const subs = SUBCOMMANDS.map(s => `complete -c harness -f -n '__fish_use_subcommand' -a ${s}`).join('\n');
-    return `# fish completion for harness
-${subs}
-
-# secrets sub-subs
-complete -c harness -f -n '__fish_seen_subcommand_from secrets' -a '${SECRETS_SUBSUBS.join(' ')}'
-# mcp sub-subs
-complete -c harness -f -n '__fish_seen_subcommand_from mcp' -a '${MCP_SUBSUBS.join(' ')}'
-# federate sub-subs
-complete -c harness -f -n '__fish_seen_subcommand_from federate' -a '${FEDERATE_SUBSUBS.join(' ')}'
-# completions sub-subs
-complete -c harness -f -n '__fish_seen_subcommand_from completions' -a 'bash zsh fish'
+    return `# fish completion for harness
+${subs}
+
+# secrets sub-subs
+complete -c harness -f -n '__fish_seen_subcommand_from secrets' -a '${SECRETS_SUBSUBS.join(' ')}'
+# mcp sub-subs
+complete -c harness -f -n '__fish_seen_subcommand_from mcp' -a '${MCP_SUBSUBS.join(' ')}'
+# federate sub-subs
+complete -c harness -f -n '__fish_seen_subcommand_from federate' -a '${FEDERATE_SUBSUBS.join(' ')}'
+# completions sub-subs
+complete -c harness -f -n '__fish_seen_subcommand_from completions' -a 'bash zsh fish'
 `;
 }
 export function completionsCmd(args) {

package/dist/diag.d.ts

@@ -7,6 +7,8 @@ export type SubcommandResult = {
 /** Compute the skew verdict between two semvers. */
 export type SkewVerdict = 'match' | 'patch-diff' | 'minor-diff' | 'major-diff' | 'unparseable';
 export declare function skewVerdict(manifestVer: string | undefined, localVer: string | undefined): SkewVerdict;
+/** GH #22: the kernel backend that actually answered on this machine. */
+export type KernelBackendTier = 'native' | 'wasm' | 'js';
 export interface DiagReport {
     dir: string;
     surface: string | undefined;
@@ -17,6 +19,12 @@ export interface DiagReport {
     manifestGeneratorVersion: string | undefined;
     localGeneratorVersion: string | undefined;
     generatorVerdict: SkewVerdict;
+    kernelBackend: KernelBackendTier | undefined;
+    requestedBackend: string | null;
+    backendReasons: {
+        native?: string;
+        wasm?: string;
+    };
 }
 export declare function buildDiagReport(harnessDir: string): Promise<DiagReport>;
 /**

package/dist/diag.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"diag.d.ts","sourceRoot":"","sources":["../src/diag.ts"],"names":[],"mappings":"AAuBA;uEACuE;AACvE,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAejE,oDAAoD;AACpD,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,YAAY,GAAG,YAAY,GAAG,YAAY,GAAG,aAAa,CAAC;AAE/F,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAStG;AAiED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,qBAAqB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,OAAO,EAAE,WAAW,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAO/B,wBAAwB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,qBAAqB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,gBAAgB,EAAE,WAAW,CAAC;CAC/B;AAED,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA2C7E;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,gBAAgB,CAgErE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,gBAAgB,CAQzE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,CAAC,CAAC;IACV,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,UAAU,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,OAAO,EAAE;QACP,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;QAChC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;QACnC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACnC,CAAC;IACF,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,SAAS,CAAA;KAAE,CAAC;IAC7D,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,GAAG,EAAE;QACH,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAgBD,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA8DnF;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuBvE"}
+{"version":3,"file":"diag.d.ts","sourceRoot":"","sources":["../src/diag.ts"],"names":[],"mappings":"AAwBA;uEACuE;AACvE,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAejE,oDAAoD;AACpD,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,YAAY,GAAG,YAAY,GAAG,YAAY,GAAG,aAAa,CAAC;AAE/F,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAStG;AAED,yEAAyE;AACzE,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,MAAM,GAAG,IAAI,CAAC;AA6HzD,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,qBAAqB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,OAAO,EAAE,WAAW,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAO/B,wBAAwB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,qBAAqB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,gBAAgB,EAAE,WAAW,CAAC;IAK9B,aAAa,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAC7C,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,cAAc,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACpD;AAED,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA+C7E;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,gBAAgB,CAiFrE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,gBAAgB,CAQzE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,CAAC,CAAC;IACV,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,UAAU,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,OAAO,EAAE;QACP,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;QAChC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;QACnC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACnC,CAAC;IACF,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,SAAS,CAAA;KAAE,CAAC;IAC7D,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,GAAG,EAAE;QACH,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAWD,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA8DnF;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuBvE"}

package/dist/diag.js

@@ -19,7 +19,8 @@ import { createRequire } from 'node:module';
 import { readFile } from 'node:fs/promises';
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { redactSecretsDeep } from './redact.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 /**
  * Parse "X.Y.Z[-pre]" into a tuple. Returns null on unrecognised input
@@ -47,6 +48,58 @@ export function skewVerdict(manifestVer, localVer) {
         return 'patch-diff';
     return 'match';
 }
+/**
+ * GH #22: resolve WHICH kernel backend the harness actually loads on this
+ * machine (native > wasm > js), the backend explicitly requested via
+ * METAHARNESS_KERNEL_BACKEND (if any), and the reason each higher tier was
+ * unavailable. The version diagnostic above answers "is the kernel the right
+ * VERSION?"; this answers "am I getting the FAST kernel, and if not, why not?"
+ * — the #1 support question after version skew (silent js fallback, GH #22).
+ *
+ * Never throws — consistent with the rest of diag. Two ways the fast path is
+ * absent are BOTH captured: (a) auto mode fell through to js → `kernelDiagnostics`
+ * carries the per-tier reasons; (b) a specific backend was REQUESTED but can't
+ * load → `loadKernel` throws, and we surface that throw under the requested tier
+ * (that throw message IS the diagnostic the operator asked for).
+ */
+async function resolveKernelBackend(harnessDir) {
+    const requested = (process.env.METAHARNESS_KERNEL_BACKEND || '').trim().toLowerCase() || null;
+    const entry = resolveKernelEntry(harnessDir);
+    if (!entry)
+        return { backend: undefined, requested, reasons: {} };
+    try {
+        const mod = (await import(pathToFileURL(entry).href));
+        if (typeof mod.kernelDiagnostics === 'function') {
+            const d = await mod.kernelDiagnostics();
+            return { backend: d.resolved, requested: d.requested ?? requested, reasons: d.reasons ?? {} };
+        }
+        // Kernel present but predates kernelDiagnostics() (GH #22) — can't report the backend.
+        return { backend: undefined, requested, reasons: {} };
+    }
+    catch (e) {
+        // A REQUESTED-but-unavailable backend makes loadKernel throw — capture that
+        // reason under the requested tier so the operator sees exactly why.
+        const reasons = {};
+        if (requested === 'native' || requested === 'wasm')
+            reasons[requested] = e.message;
+        return { backend: undefined, requested, reasons };
+    }
+}
+/**
+ * Resolve the @metaharness/kernel entry module the same way we resolve its
+ * version — from the harness's own node_modules first, then the workspace
+ * checkout — so the reported backend matches the kernel the harness loads.
+ */
+function resolveKernelEntry(harnessDir) {
+    try {
+        const require = createRequire(join(harnessDir, 'package.json'));
+        return require.resolve('@metaharness/kernel');
+    }
+    catch {
+        const wsEntry = resolve(__dirname, '..', '..', 'kernel-js', 'dist', 'index.js');
+        return existsSync(wsEntry) ? wsEntry : undefined;
+    }
+}
 /**
  * Resolve the locally-installed @metaharness/kernel version. Uses createRequire
  * so it follows real Node resolution from the harness's package.json. We
@@ -135,6 +188,7 @@ export async function buildDiagReport(harnessDir) {
     const verdict = skewVerdict(manifestKernelVersion, localKernelVersion);
     const localGeneratorVersion = resolveLocalGeneratorVersion();
     const generatorVerdict = skewVerdict(manifestGeneratorVersion, localGeneratorVersion);
+    const kb = await resolveKernelBackend(harnessDir);
     let actionable;
     if (verdict === 'major-diff') {
         actionable = `Run: npm install @metaharness/kernel@${manifestKernelVersion} (major skew — APIs may break)`;
@@ -158,6 +212,9 @@ export async function buildDiagReport(harnessDir) {
         manifestGeneratorVersion,
         localGeneratorVersion,
         generatorVerdict,
+        kernelBackend: kb.backend,
+        requestedBackend: kb.requested,
+        backendReasons: kb.reasons,
     };
 }
 /**
@@ -177,6 +234,23 @@ export function formatDiagReport(report) {
     lines.push(`  surface:              ${report.surface ?? '(unknown — pre-iter-56 manifest)'}`);
     lines.push(`  manifest kernel:      ${report.manifestKernelVersion ?? '(unset — pre-iter-58 manifest)'}`);
     lines.push(`  installed kernel:     ${report.localKernelVersion ?? '(not installed)'}`);
+    // GH #22: which backend actually answers + (if a specific one was requested) that request.
+    const reqSuffix = report.requestedBackend ? `  [requested: ${report.requestedBackend}]` : '';
+    // When no backend resolved, the reason differs: a REQUESTED tier that threw
+    // (kernel is installed, that tier just isn't) vs. the kernel not resolving at all.
+    const unresolvedLabel = report.requestedBackend
+        ? '(requested backend unavailable — see below)'
+        : '(not loadable — kernel not installed?)';
+    lines.push(`  kernel backend:       ${report.kernelBackend ?? unresolvedLabel}${reqSuffix}`);
+    // GH #22: WHY the faster tiers didn't answer — the whole point of the issue
+    // (a silent js fallback with no explanation). Only show a tier that failed
+    // AND isn't the one that ended up answering.
+    if (report.backendReasons.native && report.kernelBackend !== 'native') {
+        lines.push(`     native unavailable — ${report.backendReasons.native}`);
+    }
+    if (report.backendReasons.wasm && report.kernelBackend !== 'wasm') {
+        lines.push(`     wasm unavailable — ${report.backendReasons.wasm}`);
+    }
     lines.push(`  manifest generator:   ${report.manifestGeneratorVersion ?? '(unset)'}`);
     lines.push(`  installed generator:  ${report.localGeneratorVersion ?? '(not installed)'}`);
     lines.push('');
@@ -248,21 +322,11 @@ export function formatDiagReportJson(report) {
     };
 }
 const REDACT_KEY_RE = /^(secret|token|key|password|api[-_]?key)/i;
+// GH #4 (HIGH-2): redact by KEY name AND by VALUE shape — a secret-shaped value in a non-secret-named
+// field (e.g. a token pasted into a `vars` entry) must not survive into a bundle a user pastes into an
+// issue. Value-aware detection lives in redact.ts (single source of truth, finding #7).
 function sanitiseManifest(m) {
-    if (m === null || typeof m !== 'object')
-        return m;
-    if (Array.isArray(m))
-        return m.map(sanitiseManifest);
-    const out = {};
-    for (const [k, v] of Object.entries(m)) {
-        if (REDACT_KEY_RE.test(k))
-            out[k] = '<redacted>';
-        else if (typeof v === 'string' && REDACT_KEY_RE.test(k))
-            out[k] = '<redacted>';
-        else
-            out[k] = sanitiseManifest(v);
-    }
-    return out;
+    return redactSecretsDeep(m, { keyRe: REDACT_KEY_RE, replacement: '<redacted>' });
 }
 export async function buildSupportBundle(harnessDir) {
     const report = await buildDiagReport(harnessDir);