feat(homecore): add WASM-first developer metaharness (#1477)

Adds the accepted ADR-285 Homecore metaharness, WASM-first kernel, read-only MCP guidance, guarded local host adapters, reviewed memory, and provenance-only npm release gates.
2026-07-30 18:41:42 +00:00 · 2026-07-29 19:51:21 -04:00
parent c798cc913c
commit 90b29595fb
54 changed files with 3722 additions and 16 deletions
@@ -0,0 +1,85 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: MIT
+
+import { createHash } from 'node:crypto';
+import {
+  readdirSync,
+  readFileSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs';
+import { dirname, join, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { loadBrain } from '../src/brain.js';
+
+const ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
+const quiet = process.argv.includes('--quiet');
+const INCLUDE = [
+  'package.json',
+  'bin',
+  'src',
+  'skills',
+  '.claude/settings.json',
+  '.claude/skills',
+  '.codex',
+  '.mcp',
+  '.harness/claims.json',
+  '.harness/mcp-policy.json',
+  'brain/corpus/core.jsonl',
+  'scripts',
+  'AGENTS.md',
+  'CLAUDE.md',
+  'README.md',
+  'LICENSE',
+];
+
+const sha = (value) => createHash('sha256').update(value).digest('hex');
+const canonicalFile = (path) => readFileSync(path, 'utf8').replace(/\r\n/g, '\n');
+const files = [];
+
+function walk(path) {
+  const stat = statSync(path);
+  if (stat.isDirectory()) {
+    for (const name of readdirSync(path).sort()) walk(join(path, name));
+  } else {
+    files.push(path);
+  }
+}
+
+for (const entry of INCLUDE) walk(join(ROOT, entry));
+const hashes = Object.fromEntries(files.sort().map((path) => [
+  relative(ROOT, path).replaceAll('\\', '/'),
+  sha(canonicalFile(path)),
+]));
+const pkg = JSON.parse(readFileSync(join(ROOT, 'package.json'), 'utf8'));
+const policy = canonicalFile(join(ROOT, '.harness', 'mcp-policy.json'));
+const manifest = {
+  schema: 2,
+  generator: 'Homecore metaharness provenance v1',
+  template: 'vertical:repo-maintainer+homecore',
+  name: pkg.name,
+  version: pkg.version,
+  hosts: ['claude-code', 'codex'],
+  kernel: {
+    package: '@metaharness/kernel',
+    version: pkg.dependencies['@metaharness/kernel'],
+    preference: 'wasm-first',
+    fallback: 'native-or-js-reported',
+  },
+  toolPolicy: 'default-deny-execution',
+  files: hashes,
+  filesDigest: sha(JSON.stringify(hashes)),
+  brainDigest: loadBrain().digest,
+  policyDigest: sha(policy),
+  dependencies: pkg.dependencies,
+  meta: {
+    surface: 'cli+mcp+brain+wasm+local-hosts',
+    adr: 'ADR-285',
+  },
+};
+const json = `${JSON.stringify(manifest, null, 2)}\n`;
+writeFileSync(join(ROOT, '.harness', 'manifest.json'), json);
+writeFileSync(join(ROOT, '.harness', 'manifest.sha256'), `${sha(json)}  manifest.json\n`);
+if (!quiet) {
+  console.log(JSON.stringify({ ok: true, files: files.length, digest: sha(json) }));
+}
@@ -0,0 +1,80 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: MIT
+
+import { createHash } from 'node:crypto';
+import {
+  existsSync,
+  readdirSync,
+  readFileSync,
+  statSync,
+} from 'node:fs';
+import { dirname, join, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
+const quiet = process.argv.includes('--quiet');
+const INCLUDE = [
+  'package.json',
+  'bin',
+  'src',
+  'skills',
+  '.claude/settings.json',
+  '.claude/skills',
+  '.codex',
+  '.mcp',
+  '.harness/claims.json',
+  '.harness/mcp-policy.json',
+  'brain/corpus/core.jsonl',
+  'scripts',
+  'AGENTS.md',
+  'CLAUDE.md',
+  'README.md',
+  'LICENSE',
+];
+
+const sha = (value) => createHash('sha256').update(value).digest('hex');
+const canonicalFile = (path) => readFileSync(path, 'utf8').replace(/\r\n/g, '\n');
+const path = join(ROOT, '.harness', 'manifest.json');
+const raw = readFileSync(path);
+const manifest = JSON.parse(raw);
+const findings = [];
+const actualFiles = [];
+
+function walk(target) {
+  const stat = statSync(target);
+  if (stat.isDirectory()) {
+    for (const name of readdirSync(target).sort()) walk(join(target, name));
+  } else {
+    actualFiles.push(relative(ROOT, target).replaceAll('\\', '/'));
+  }
+}
+
+for (const entry of INCLUDE) walk(join(ROOT, entry));
+const actualSet = new Set(actualFiles);
+const expectedSet = new Set(Object.keys(manifest.files || {}));
+
+for (const [name, expected] of Object.entries(manifest.files || {})) {
+  const target = join(ROOT, name);
+  if (!existsSync(target)) findings.push(`${name}:missing`);
+  else if (sha(canonicalFile(target)) !== expected) findings.push(`${name}:hash-mismatch`);
+}
+for (const name of actualSet) {
+  if (!expectedSet.has(name)) findings.push(`${name}:untracked-by-manifest`);
+}
+for (const name of expectedSet) {
+  if (!actualSet.has(name)) findings.push(`${name}:not-in-package-surface`);
+}
+
+const expectedOuter = readFileSync(join(ROOT, '.harness', 'manifest.sha256'), 'utf8')
+  .trim()
+  .split(/\s+/)[0];
+if (sha(raw) !== expectedOuter) findings.push('manifest.sha256:mismatch');
+
+if (!quiet) {
+  console.log(JSON.stringify({
+    ok: findings.length === 0,
+    files: expectedSet.size,
+    findings,
+  }, null, 2));
+}
+process.exit(findings.length ? 1 : 0);