[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_114":115},"routes/modules.$creator.$moduleId",{"_14":15,"_16":17,"_18":19,"_20":21},"routes/modules.$creator.$moduleId.endpoints",{"_11":12,"_13":-5},"error","Module not found","tools","module",{"_20":22,"_23":24,"_25":26,"_27":28,"_29":30,"_31":32,"_33":34,"_35":26,"_36":37,"_38":-5,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":47,"_48":49,"_50":51,"_52":53,"_54":55,"_56":-5,"_57":49,"_58":59,"_60":61,"_62":63,"_64":65,"_66":67,"_68":49,"_69":70,"_71":72,"_73":74,"_75":76,"_77":78,"_79":-5,"_80":-5,"_81":-5,"_82":49,"_83":-5,"_84":59,"_85":86,"_87":88,"_89":90,"_91":92,"_93":94},"apiUrl","https://odel.app/api","creator","elvismusli","moduleId","onlyharness","@elvismusli/onlyharness","displayName","SuperSkill Registry","tagline","Find, inspect and install reviewed reusable AI-agent capabilities from superskill.sh.","iconKey","https://avatars.githubusercontent.com/u/149376360?v=4","category","remote","status","published","visibility","public","metaDescription","deploymentType","external","workerName","bindingName","mcpConfig","{\"url\":\"https://superskill.sh/mcp\",\"transport\":\"streamable-http\",\"authType\":\"none\"}","pricingModel","free","creatorUserId","system:external-import","createdAt",1783484348000,"updatedAt",1788767974000,"sourceRegistry","official-mcp-registry","sourceUrl","https://registry.modelcontextprotocol.io/v0/servers?search=com.onlyharness%2Fregistry","sourceVerified",false,"sourceMissingSince","importedAt","upstreamStars",0,"upstreamUpdatedAt",1785493559000,"detectedTransport","streamable-http","detectedAuthType","none","probeStatus","ok","lastProbedAt","githubRepoUrl","https://github.com/elvismusli/onlyharness","githubRepoFullName","elvismusli/onlyharness","releaseId","ext-elvismusli-onlyharness","version","0.3.1","descriptionMarkdown","# SuperSkill\n\n[superskill.sh](https://superskill.sh) is the single human-facing product for finding and installing reviewed AI-agent capabilities. It preserves existing registrations and workspaces, exposes one universal install link for Codex and Claude Code, and keeps exact release, trust, revocation and consent gates explicit.\n\nThe old OnlyHarness UI and host are compatibility-only: human routes redirect to SuperSkill, while old API/MCP coordinates, npm/package names, database identifiers and immutable archive URLs remain available for installed clients and data continuity. Internal package names still use `@harnesshub/*`; the published compatibility CLI package remains `onlyharness`.\n\n## What is a native harness package?\n\nA native harness package is the strict, verified package format inside the broader OnlyHarness resource catalog:\n\n- `harness.yaml` manifest with runtime, tools, permissions, quality gates, and risk profile.\n- Prompt, examples, eval cases, and expected outputs.\n- CLI commands for validate, eval, gate, diff, import, and PR annotation.\n- Social layer: stars, server-side remix forks, threads, verified gate runs, install confirms, heat, tags, outcomes, and maintainer review.\n\n## Live MVP\n\n- App: [https://superskill.sh](https://superskill.sh)\n- API health: [https://superskill.sh/api/healthz](https://superskill.sh/api/healthz)\n- Registry API: [https://superskill.sh/api/registry](https://superskill.sh/api/registry)\n- Universal installer manifest: [https://superskill.sh/api/superskill/install](https://superskill.sh/api/superskill/install)\n\nSupabase auth is enabled for signup/login, stars, local remix drafts, thread posts, and authenticated publish.\n\n## Features\n\n- HuggingFace-style discovery for agent resources, wrapped in a Win98 desktop with a real window manager (drag, minimize, z-order, taskbar, Start menu).\n- Outcome filters, global search, leaderboard, Harness Heat, stars, server-side remix fork counters, threads, and verified gate-run counters.\n- Harness detail opens as its own window with Overview, Install, Trust, Try sample, Thread, Files, and Versions tabs plus a plain-tone trust panel; Versions is backed by archive snapshot history.\n- Authenticated quick publish flow (`New Resource Wizard`) that imports markdown into a small unverified scaffold.\n- Share card window (`harness_flex.exe`), Wild West awards, Paint heat chart, and a paperclip mascot that opens the wizard.\n- CLI package `onlyharness` with `hh` compatibility commands plus `superskill install`; `HH_REGISTRY_URL` targets another registry, default `https://superskill.sh/api`.\n- Agent-friendly discovery: [`/llms.txt`](https://superskill.sh/llms.txt), [`/api/openapi.json`](https://superskill.sh/api/openapi.json), [`/server.json`](https://superskill.sh/server.json), and [`/mcp`](https://superskill.sh/mcp).\n- Local bounty flow: create/claim/deliver/accept work-state over the existing `gate_escrow` rail; `paid` is set only after a matching escrow purchase captures against the delivered gate receipt.\n- Semantic PR review and quality gate sidecar API.\n- Docker production stack with system Caddy deployment mode for shared VPS hosts.\n\n## Architecture\n\n```mermaid\nflowchart LR\n Web[\"React/Vite UI\"] --> API[\"Fastify Harness API\"]\n API --> Seeds[\"Seed harnesses\"]\n API --> Imports[\"Imported harnesses\"]\n Web --> Supabase[\"Supabase Auth + RLS tables\"]\n API --> SupabaseAuth[\"Supabase token verification\"]\n Caddy[\"System Caddy / superskill.sh\"] --> Web\n CLI[\"hh CLI\"] --> Schema[\"Schema, eval, gate, diff\"]\n```\n\n## Run locally\n\n```bash\nnpm install\nnpm run seed\nnpm run check\nnpm run smoke\nnpm run dev\n```\n\nOpen:\n\n- UI: `http://127.0.0.1:5177`\n- API: `http://127.0.0.1:8787/healthz`\n- Local Gitea forge: `http://127.0.0.1:3000`\n\n## Operator Payouts\n\nPayout reporting and ledger creation are manual-ops only. The script reads settled `purchases` plus `payout_accounts`, applies the current rates, and can create an idempotent draft payout ledger. It never calls a payout provider and never marks items paid.\n\n```bash\nnpm run payout:report -- --month 2026-07\nnpm run payout:report -- --month 2026-07 --json\nnpm run payout:ledger -- --month 2026-07 --ledger-out data/payout-ledgers/2026-07.json\n```\n\nUse `SUPABASE_URL` + `SUPABASE_SERVICE_ROLE_KEY`, or local JSON fixtures via `--purchases` and `--payout-accounts`. `--record-ledger` upserts `payout_runs`/`payout_items` through Supabase service role. Rows without `creator_user_id` are marked `MISSING_CREATOR_ID`; rows without payout account are blocked as `MISSING_PAYOUT_ACCOUNT`.\n\n## CLI\n\nThe npm package is published:\n\n```bash\nnpx onlyharness@latest search market research\nnpx onlyharness@latest suggest market research --json\nnpx onlyharness@latest resources search superpowers --json\nnpx onlyharness@latest resources detail github:obra/superpowers --json\nnpx onlyharness@latest resources open github:obra/superpowers --json\nnpx onlyharness@latest resources approve onlyharness:harnesses/deep-market-researcher --workspace acme --collection approved --json\nnpx onlyharness@latest install harnesses/deep-market-researcher --target claude-code --json\nnpx onlyharness@latest publish-resource ./agent-tool --name agent-tool --type command_pack --json\nnpx onlyharness@latest publish-resource ./agent-tool --workspace acme --name agent-tool --type command_pack --json\nnpx onlyharness@latest mcp-config deep-market-researcher --target claude-desktop --json\nnpm i -g onlyharness # installs the `hh` command\n```\n\nResource catalog, immutable `publish-resource`, workspace approval/setup/gates, membership expiry, the manual/provider-agnostic workspace subscription lifecycle, universal install, and SuperSkill managed commands are available in published `onlyharness@0.2.19`; `0.2.18` is a known-bad one-link release because its published universal-skill digest is stale. Server catalog flows are also available through MCP/HTTP.\n\nFor local development, build the workspace bundle and run it directly:\n\n```bash\nnpm run build -w onlyharness\nnode packages/harness-cli/dist/hh.mjs doctor\nnode packages/harness-cli/dist/hh.mjs audit-setup\nnode packages/harness-cli/dist/hh.mjs suggest market research --apply --out suggested-deep-market-researcher --json\nnode packages/harness-cli/dist/hh.mjs suggest market research --apply --target codex --out suggested-deep-market-researcher --adapter-out .codex/harnesses/deep-market-researcher --json\nnode packages/harness-cli/dist/hh.mjs install harnesses/deep-market-researcher --target codex --out deep-market-researcher --adapter-out .codex/harnesses/deep-market-researcher --json\nnode packages/harness-cli/dist/hh.mjs pull harnesses/deep-market-researcher --version 0.1.0 --out deep-market-researcher-0.1.0 --json\nnode packages/harness-cli/dist/hh.mjs mcp-config deep-market-researcher --target claude-desktop --out mcp.json\nnode packages/harness-cli/dist/hh.mjs benchmark benchmarks/research-discovery.yaml --json\nnode packages/harness-cli/dist/hh.mjs extract ~/.claude/skills/my-skill --out my-skill-harness\nHH_TOKEN= node packages/harness-cli/dist/hh.mjs publish git@github.com:acme/harnesses.git --path harnesses/my-harness --name my-harness --json\nHH_TOKEN= node packages/harness-cli/dist/hh.mjs publish-resource ./agent-tool --name agent-tool --type command_pack --json\nHH_TOKEN= node packages/harness-cli/dist/hh.mjs publish-resource https://github.com/acme/agent-tool.git --path packages/tool --name agent-tool --type command_pack --json\nHH_WORKSPACE_TOKEN= node packages/harness-cli/dist/hh.mjs publish-resource ./agent-tool --workspace acme --name agent-tool --type command_pack --json\nHH_WORKSPACE_TOKEN= node packages/harness-cli/dist/hh.mjs resources search agent-tool --workspace acme --json\nHH_WORKSPACE_TOKEN= node packages/harness-cli/dist/hh.mjs resources detail @acme/agent-tool --json\nHH_WORKSPACE_TOKEN= node packages/harness-cli/dist/hh.mjs workspace setup acme --target claude-code --json\nHH_ORG_TOKEN= node packages/harness-cli/dist/hh.mjs setup @acme\nHH_ORG_TOKEN= node packages/harness-cli/dist/hh.mjs publish workflow.md --org acme --name my-private-harness\nHH_ORG_TOKEN= node packages/harness-cli/dist/hh.mjs sync git@github.com:acme/skills.git --org acme\nTELEGRAM_BOT_TOKEN= HH_ORG_TOKEN= TELEGRAM_CHANNEL_ID= npm run telegram:gate-bot\n```\n\n## SuperSkill internal alpha\n\nSuperSkill is the task-first managed capability layer built on OnlyHarness. The checked-in catalog currently contains 12 exact immutable **candidates** and intentionally exposes zero approved showroom items until real Claude Code, Codex, and human review attestations exist.\n\n- Public, read-only: `GET /api/showroom/capabilities` and `GET /api/showroom/capabilities/{id}`. These routes never recommend, download, or activate files.\n- Selected shelf: `GET /api/showroom/selected` exposes the current reviewed-intake candidates as `selected_unreviewed` cards. They can fill the Daylight catalog, but cannot be recommended or activated until exact-release approval evidence exists.\n- Confirmed-user Bearer: `/api/recommendations`, `/api/capabilities/{id}`, exact release/archive routes, hosted proof publish and managed lifecycle events use one confirmed Supabase user credential plus an active server-side `superskill:managed` grant. Headless clients inherit `HH_TOKEN` explicitly. `HH_SUPERSKILL_TOKEN` is legacy internal-alpha compatibility only and cannot produce public-GO evidence.\n- Managed CLI release: `onlyharness@0.2.19` is the current one-link release, published and verified through a clean `npx` install, and pinned to official npm integrity in `plugins/superskill/runtime.json`. It binds hosted skill detail, archive headers and archive bytes to one immutable version/digest/size/trust tuple. `0.2.14` and `0.2.18` are known-bad one-link releases; never substitute `latest` for the exact runtime pin.\n- Web: the SuperSkill product surface is hostname-locked on `superskill.sh`; legacy query or stored skin state cannot switch it.\n\n```bash\nnpm run build:superskill-catalog\nnpm run check:superskill-catalog\nnpm run check:superskill-router\nnpm run smoke:superskill\nnpm run superskill:pilot-report\n```\n\nPlugin sources live under `plugins/superskill` with one byte-identical shared skill for Claude Code and Codex. A capability handoff uses one immutable `https://superskill.sh/api/superskill/install/{id}/{version}/{sha256}` URL; the pinned local installer selects exactly one unambiguous client, while routing and activation consent remain separate. Marketplace publication and clean new-session plugin proof remain separate rollout actions.\n\n## For agents\n\n- Discovery: [`/llms.txt`](https://superskill.sh/llms.txt), [`/AGENTS.md`](https://superskill.sh/AGENTS.md), [`/api/openapi.json`](https://superskill.sh/api/openapi.json), MCP Registry metadata at [`/server.json`](https://superskill.sh/server.json), and OAuth protected-resource metadata at [`/.well-known/oauth-protected-resource`](https://superskill.sh/.well-known/oauth-protected-resource). SuperSkill does not advertise a vanity authorization server: managed headless flows receive a confirmed account token manually through `HH_TOKEN`, and `/.well-known/oauth-authorization-server` intentionally returns 404 until one issuer owns a complete standards-valid flow.\n- MCP v0.2.19: `https://superskill.sh/mcp` with the exact inventory `search_harnesses`, `harness_detail`, `search_resources`, `resource_detail`, `resource_use_instructions`, `pull_instructions`, `pull_harness`, `search_docs`, `publish_markdown_to_harness`, and `publish_resource_package`. Resource detail/use tools accept an optional exact `version`; explicit historical reads never drift to latest. Tool results use `structuredContent`; logical failures set `isError: true` with stable machine codes and sanitized details.\n- Public hosted resource-package publishing is enabled in production. Confirmed publishers create immutable semantic versions with idempotency, durable ownership, artifact SHA-256 and bounded text archives; changing an existing version fails closed. The SuperSkill web form accepts a repository folder or an authored skill and labels every accepted release `unreviewed` until separate review evidence exists. A static-v2 `fail` is rejected before any archive, catalog or event mutation with sanitized rule/file evidence; HTTP uses `SECURITY_SCAN_FAILED`, while MCP keeps its stable `VALIDATION_FAILED` envelope. Accepted `pass`/`warn` releases remain unreviewed, and static pass does not claim a known runtime risk tier.\n- Registry publish: `server.json` is remote-only at canonical `https://superskill.sh/mcp`; `com.onlyharness/registry` remains the compatibility identifier. Publication still requires MCP Registry authorization/publication proof for `superskill.sh`, the exact published runtime pin, and a clean client proof; `onlyharness.com` is compatibility-only.\n- Team setup and publish: `hh setup @acme` reads `GET /api/orgs/{slug}/bundle`; `hh publish --org acme` writes an org-private harness. Both use `HH_ORG_TOKEN` when `ORGS_ENABLED=true`. Org auth/bundles/audit read Supabase service-role tables first and keep `HARNESS_ORGS_PATH`/`HARNESS_ORG_AUDIT_PATH` as the local smoke fallback.\n- Team workspace UI/API: Network Neighborhood uses `GET /api/orgs/{slug}/workspace` with the same org token and returns org-private cards, sanitized audit rows, and a permission/risk summary.\n- Workspace resource catalogs: confirmed accounts create an invite-only workspace through `POST /api/workspaces`; the transaction also creates owner membership, the invite policy and the default approved collection. `GET /api/workspaces/{slug}/workspace`, `GET/PUT /api/workspaces/{slug}/setup-bundle`, `GET /api/workspaces/{slug}/resources`, `GET /api/workspaces/{slug}/resources/{id}`, `GET /api/workspaces/{slug}/resources/{id}/archive`, `POST /api/workspaces/{slug}/imports/resource-package`, `POST /api/workspaces/{slug}/resources/approve`, and `/api/workspaces/{slug}/collections...` are gated by `WORKSPACES_ENABLED=true`. API/web reads accept either an active, non-expired workspace member session or `HH_WORKSPACE_TOKEN`; CLI stays token-based for now, with `HH_ORG_TOKEN` as a migration fallback. `hh workspace setup acme --target claude-code` installs workspace-hosted packages and writes instructions for approved public resources without pretending those have workspace archives. `GET/POST /api/workspaces/{slug}/members`, `POST /api/workspaces/{slug}/invites`, `POST /api/workspaces/{slug}/join`, and `DELETE /api/workspaces/{slug}/members/{userId}` manage membership through `member:write`/`invite:write`; `POST /members` accepts optional `expiresAt`, and expired or removed members cannot use private install/archive paths. Raw invite codes are returned once, only hashed values are stored, and the web share URL keeps the raw code after `#` so it is not sent to the server before the explicit join. Workspace gates add `GET/PUT /api/workspaces/{slug}/join-policies`, `POST /api/workspaces/{slug}/join-code`, read-only `POST /api/workspaces/{slug}/join-code/verify`, and explicit `POST /api/workspaces/{slug}/join-grants` for Telegram/Discord/entitlement checks with `gate:verify`/`gate:write` scopes. Active `paid_subscription` join policies require `WORKSPACE_SUBSCRIPTIONS_ENABLED=true`; `POST /subscriptions/checkout` creates an incomplete receipt only, the signed `POST /webhooks/workspace-subscriptions` activates/renews/graces/cancels access idempotently, does not restore removed/suspended members, and `POST /subscriptions/sweep` expires ended access without charging money. Use `hh resources approve onlyharness:harnesses/deep-market-researcher --workspace acme --collection approved` to add a scanned public listing to a workspace collection as local curation, not OnlyHarness verification; `not_scanned` and failed resources are rejected for installable approval.\n- Team git sync: `hh sync --org acme` clones/scans markdown skills and runbooks, then imports them through the org publish endpoint. First version has no webhooks.\n- Maintainer publish: `hh publish ` requires local `.harnesshub/results.json`; `hh publish --path ` clones to a temp dir, runs local eval/gate there, then publishes only if the server rechecks schema, security and gate successfully.\n- Resource package publish: `hh publish-resource --name --type ` packages safe bounded text files from skills, plugins, workflows, MCP servers, command packs, scripts, docs or source bundles into OnlyHarness archive storage and lists the result in `/api/resources`. It is not a Verified harness badge.\n- Workspace resource package publish: `hh publish-resource --workspace acme --name --type ` publishes the same full package into a private workspace catalog as `@acme/name`; it does not go through the markdown scaffold path and does not claim a Verified badge.\n- Org-private pulls use the same token path: `HH_ORG_TOKEN= hh pull @acme/private-harness`.\n- Directory shelf entries are link-only discovery indexes under owner `directories`. They show `open ` in search results and `GET /api/repos/directories/{name}/archive` returns `409 DIRECTORY_LINK_ONLY` instead of runnable files.\n- Server-side remix is a local draft flow with a real fork graph row: `POST /api/repos/{owner}/{repo}/remixes` creates a free unverified `local/{name}` copy from archive files only and records the source -> fork edge. Paid, org/private, directory, link-only and unspecified-license sources fail closed; copied fallback recipes do not increment forks or store prompts/local paths.\n- Public API payloads never expose server filesystem paths: registry/detail use public forge, OnlyHarness GitHub mirror, or upstream URLs when available, `/healthz` only returns status, and maintainer review in detail is explicitly a `local-demo` preview until a real forge PR source is connected.\n- `/api/resources` is the primary mixed source-aware catalog for skills, plugins, workflows, MCP servers, configs, guides, runtimes, directories and native harness-format packages. `/api/registry` keeps the harness-plus-link-only-directory contract for existing agent clients.\n- Category benchmark infrastructure is local-first: `hh benchmark ` compares candidate and analog harnesses from local paths using declared eval case scores. Suites live in `benchmarks/`, smoke runs every YAML suite there, and this remains a runner/comparison layer, not an independent LLM quality measurement.\n- Agent autopilot: `hh suggest --json` searches, returns ranked candidates with trust fields, fetches detail for the selected harness, prints a full trust summary, and records a privacy-safe `suggested` event. Use `--pick ` to inspect/apply another candidate. `hh suggest --apply --out ` installs the selected harness through the same archive path as `hh pull`, records `accepted` when `--apply` is chosen, and records `applied` only after files are written. Add `--target cli|claude-code|codex|cursor` to run the full adapter install path before `applied`.\n- Versioned archives: harness detail includes `versions[]`; `hh pull owner/name --version ` and `hh install owner/name --version ` request the same immutable `/archive?version=` path and keep `.harnesshub/source.json` pinned to the resolved version.\n- `hh eval` and `hh gate` record privacy-safe `eval`/`gate` events for pulled harnesses when they pass; detail payloads expose `verification.lastVerifiedAt` from those events. Registry `runs` are counted only from passed `gate` events, never from `hh run` sample preview.\n- `hh gate --receipt` writes a signed gate receipt with harness ref, version, `resultsHash`, verdict and timestamp. `POST /api/receipts` verifies the ed25519 signature only; it is side-effect-free and does not store prompts, local paths, payments or entitlements.\n- Gate escrow is reserved-first: `pricing.model: gate_escrow` checkout/webhook creates `reserved` plus an expiring `escrow_reserved` archive entitlement. `POST /api/billing/escrow/receipt` captures on a valid passing receipt or refunds on a valid failing receipt; `POST /api/billing/escrow/timeout` refunds after the 72h window.\n- Bounties are work-state over the same escrow rail: `/api/bounties*` supports create, claim, deliver and accept; accept verifies the delivered receipt, escrow target, amount and currency, blocks escrow reuse, and writes `paid` only after capture.\n- Hosted endpoints are not live yet: `hh run` executes locally as sample preview only, and HTTP/MCP surfaces deliver harness files rather than running author code server-side. `pricing.model=per_call` returns `409 HOSTED_EXECUTION_NOT_AVAILABLE` until a runner/partner path is shipped and smoked.\n- Paid installs/pulls return 402 until entitled. When `PAYMENTS_ENABLED=true`, `X402_ENABLED=true`, and `X402_PAY_TO` is set, the archive response also includes an x402 v2 `PAYMENT-REQUIRED` header. Successful `hh install --pay` or `hh pull --pay` archive delivery requires `X402_FACILITATOR_URL` to verify/settle and then grants a wallet entitlement.\n- Checkout URLs land on `/checkout`: without `provider_ref` the web UI asks the buyer to log on and create a manual checkout session; with `provider_ref` it shows a pending manual handoff. Neither state grants access client-side.\n- Manual checkout is the only enabled checkout provider (`PAYMENT_PROVIDER` unset or `manual`). Any other provider value fails closed before creating a purchase; x402 remains a separate archive-payment rail.\n- Buyer receipts are read-only: `GET /api/billing/receipt?provider_ref=` returns the authenticated user's pending/paid purchase status and entitlement flag, but never settles providers or grants access.\n- Bot gates can call `GET /api/entitlements/check?subject=user:&harness=owner/name` with an org token that has `entitlements:read`; this returns a decision only, never archive files.\n- Safer community gates use short-lived signed codes: the buyer calls `POST /api/community/invite-code` after entitlement, then the Telegram/Discord bot calls `POST /api/community/verify-code` with a scoped org token before granting access. `COMMUNITY_INVITE_SECRET` must be configured on the API.\n- Registry items include `installConfirms`; only authenticated `kind=install&client=claude-code` events count toward the `works in Claude Code: N confirms` badge.\n- Claude Code compatibility marketplace: `claude plugin marketplace add elvismusli/onlyharness` then `claude plugin install superskill@superskill`. The one-link installer is the primary path.\n- Codex MCP setup: `codex mcp add superskill --url https://superskill.sh/mcp --bearer-token-env-var HH_TOKEN`.\n- Local validation: `npm run check:mcp-registry && npm run check:plugin`; when Claude CLI is installed, also run `claude plugin validate . && claude plugin validate plugins/onlyharness`.\n\nCreate local env from the examples:\n\n```bash\ncp .env.example .env.local\ncp .env.example apps/registry-web/.env.local\n```\n\n## Production deploy\n\nThe current VPS uses a shared system Caddy on ports `80/443`. OnlyHarness runs behind it on `127.0.0.1:8097`.\n\n```bash\nSSH_TARGET=hetzner-root DEPLOY_MODE=system-caddy scripts/deploy-production.sh\n```\n\n`scripts/deploy-production.sh` runs public smoke by default after containers reload: `/api/healthz`, `/server.json`, `/.well-known/oauth-protected-resource`, the intentional 404 at `/.well-known/oauth-authorization-server`, `/checkout`, and `/mcp`. Override `PUBLIC_BASE_URL` for a non-default hostname or set `RUN_DEPLOY_SMOKE=0` only for a deliberately partial deploy.\nFor authenticated production smoke without creating throwaway users, set the compatibility QA credentials in the ignored production env and run `scripts/smoke-production-auth.ts` against `https://superskill.sh/api`.\n\nDeployment artifacts:\n\n- `infra/production-compose.yml`\n- `infra/production-system-caddy.override.yml`\n- `infra/Caddyfile.local-smoke`\n- `scripts/deploy-production.sh`\n- `scripts/smoke-production-compose.sh`\n- `scripts/smoke-production-auth.ts`\n\nProduction smoke:\n\n```bash\nscripts/smoke-production-compose.sh\n\nset -a\n. infra/production.env\nset +a\nSMOKE_API_URL=https://superskill.sh/api SMOKE_EXPECT_EMAIL_CONFIRMATION=1 npm run smoke:prod-auth\n```\n\n## Verification\n\nCurrent verification gates:\n\n```bash\nnpm run build\nnpm run check\nnpm run smoke\nnpm run smoke:mcp\nnpm run smoke:x402\nscripts/smoke-production-compose.sh\n```\n\nThe production auth smoke creates a QA Supabase user and verifies that email confirmation blocks immediate sign-in. To test authenticated publish with a pre-confirmed token, pass `HH_TOKEN` to the CLI publish flow or run the API publish smoke against a confirmed session.\n\n## Repository Layout\n\n```text\napps/\n harness-api/ Fastify API and registry endpoints\n registry-web/ React/Vite OnlyHarness UI\npackages/\n cli/ hh CLI\n schema/ harness.yaml schema, validation, risk checks\n semantic-diff/ harness semantic diff and PR review markdown\nseed-harnesses/ curated MVP harness examples\nsupabase/ auth/social/thread schema migrations\ninfra/ Docker, Caddy, Gitea, and production compose\nscripts/ seed, smoke, deploy, Gitea proof scripts\n```\n\n## Security Notes\n\n- Real `.env.local`, app env, and `infra/production.env` files are gitignored.\n- Publish requires a valid Supabase bearer token in production.\n- Internal webhook/eval endpoints require `HARNESS_WEBHOOK_TOKEN` when configured.\n- Organization setup is behind `ORGS_ENABLED`; org tokens are stored as `sha256:` hashes in Supabase or the local fallback store, and audit logs must not contain raw tokens.\n- Supabase tables use RLS policies for profiles, user actions, and thread posts.\n","changelogMarkdown","videoKey","requiredSecretsJson","publishedAt","priceCents","trialDays","upstream",{"_103":104,"_105":-5,"_106":107,"_108":109,"_110":111,"_112":113},"requiredSecrets",[],"tags",[97,98,99,21,100,101,102],"assets",[],"stats",{"_95":59,"_96":59},"ratingAvg","reviewCount","agent-harness","ai-agents","fastify","react","supabase","vite","topics",[97,98,99,21,100,101,102],"license","language","TypeScript","registryName","com.onlyharness/registry","homepage","https://superskill.sh","packages",[],"ENV",{"_116":117,"_118":119,"_120":121},"ENVIRONMENT","production","TURNSTILE_SITE_KEY","0x4AAAAAAB8-rEI2gNDf_QhU","SENTRY_DSN","https://45fd1229f78089d5c3ee78be128030e1@o4510583261757440.ingest.de.sentry.io/4510584253448272"]