Skip to main content
Loss of provenance

A previous release had provenance metadata, but this release does not. View details.

M2 Harness 🚀 — Cost-Aware Hierarchical Coding Agent & Context Firewall

Python Version License Tests MCP Ready

M2 Harness is a high-throughput, cost-aware Autonomous Worker and Context Firewall framework. It enables Frontier Reasoners (M1) (such as Claude 3.7 Sonnet, Gemini 2.0 Pro, Cursor, or Google Antigravity) to delegate noisy, token-heavy tool loops (searches, test iterations, multi-file refactoring) to a Cheap Worker (M2) (DeepSeek V4-Flash, OpenCode Zen, or local models), filtering raw context by 80%–98% (CCR) before returning verified structured evidence to M1.


🏛️ Architecture Overview

flowchart TD
    User([User Prompt / M1 Frontier]) --> Router{M1 Orchestrator Router}
    
    subgraph Path_A ["Path A: Delegated Worker (85%+ of Tasks)"]
        Router -->|Heavy Search / Multi-file / Test Loop| M2Runtime[M2 Worker Engine]
        M2Runtime --> L0[Zero-Token L0 Layer: AST & Git]
        M2Runtime --> SandboxedTools[Execution Sandbox & Symlink Jail]
        M2Runtime --> ContextFirewall[Context Firewall: 80-98% CCR]
        ContextFirewall --> ResultContract[Structured ResultContract JSON]
    end

    subgraph Path_B ["Path B: Direct Precision Fallback"]
        Router -->|Subtle Race / Exact Bytecode / Review| DirectInspection[Direct Inspection & Precision Edits]
    end

    subgraph Path_C ["Path C: Autonomous Diagnostic Loop"]
        Router -->|Investigate Bug / TDD Repro| DiagnosticLoop[M2 Diagnostic Hypothesis Loop]
        DiagnosticLoop --> TestOracles[Independent Test & AST Oracles]
    end

    ResultContract --> Synthesis[M1 Final Synthesis & User Response]
    DirectInspection --> Synthesis

🌟 Key Features

  1. Context Firewall & Active Working Memory: Filters thousands of characters of verbose logs, greps, and test traces down to high-signal structured evidence ($CCR \ge 80%–98%$).
  2. Zero-Token L0 Deterministic Layer: Instant Python AST outlines, symbol definitions, and git diff summaries consuming 0 LLM tokens.
  3. Tri-Modal Execution:
    • Path A (Delegated): Offloads heavy tool loops to cheap workers.
    • Path B (Direct): Precision fallback for subtle race conditions or exact reviews.
    • Path C (Diagnostic): Autonomous TDD failure reproduction and repair loops.
  4. Deterministic Tri-Level Replay: 100% offline, zero-network regression testing across Provider, Runtime, and Semantic ($Hash_A = Hash_B = Hash_C$) layers.
  5. M2-Bench & Independent Oracles: Multi-oracle evaluation (TestOracle, ASTOracle, FileOracle, IntegrityOracle anti-tampering) with mathematically rigorous metrics (VSR, FSR, Verification Gap, FTAR, ROI).
  6. Release-Grade Diagnostics (m2 doctor): Deep environment inspection across Python, Git, Tree-sitter parsers, sandbox jails, and providers.

📦 Installation

pip install m2-harness

Or install from source:

git clone https://github.com/HamzaDevv/hierarchical-coding-agent.git
cd hierarchical-coding-agent
pip install -e .

🩺 Environment Diagnostics (m2 doctor)

Verify your environment and workspace health in one command:

m2 doctor
=========================================================================
   🩺 M2 WORKER DIAGNOSTIC HEALTH REPORT (m2 doctor)                    
=========================================================================
  [✓ PASS] Python Environment     : Python 3.13.3 with all dependencies ready
  [✓ PASS] Git & Workspace        : Workspace writable and valid Git repository
  [✓ PASS] L0 AST Engine          : L0 zero-token AST parser operational
  [✓ PASS] Security Sandbox       : Execution sandbox path jail and env sanitization active
  [✓ PASS] LLM Providers          : Providers ready (Replay, Zen, DeepSeek, Gemini)
  [✓ PASS] Deterministic Replay   : Deterministic replay fixtures and schema v2.0 verified
-------------------------------------------------------------------------
  Summary: 6 Passed | 0 Warnings | 0 Failures
  Overall Status: ✅ READY FOR PRODUCTION
=========================================================================

Use --strict in CI/CD pipelines to fail on any warning:

m2 doctor --strict --json

🚀 Quick Start (CLI)

# Execute one-shot task
m2 "Find all references to ResultContract and outline their symbols"

# Launch instant zero-token AST code outline (0 LLM tokens)
m2 outline

# Launch instant zero-token git diff summary (0 LLM tokens)
m2 diff

# Scaffold cognitive rule files (AGENTS.md, .cursorrules) into project
m2 init

# Launch local Webview HUD live dashboard
m2 hud --port 4040

# Replay an execution trace offline
m2 replay tests/replay/golden_task --mode semantic

# Run benchmark suite
m2 bench run --suite dev --baselines C

🔌 Model Context Protocol (FastMCP) Integration

M2 exposes a high-performance FastMCP server for IDEs (Cursor, Windsurf, Claude Desktop, Antigravity):

{
  "mcpServers": {
    "m2-worker-agent": {
      "command": "m2-mcp-server",
      "env": {
        "DEEPSEEK_API_KEY": "sk-...",
        "WORKSPACE_ROOT": "/path/to/your/project"
      }
    }
  }
}

🐍 Python SDK Usage

from m1_m2_agent import M1OrchestratorAgent, TaskContract

# Initialize M1/M2 Hierarchical Agent
agent = M1OrchestratorAgent(workspace_root=".")

# Route and execute task through Context Firewall
result = agent.route_and_execute(
    objective="Analyze contracts/models.py and verify ResultContract fields"
)

print(f"Status: {result['contract']['status']}")
print(f"Evidence: {result['contract']['evidence']}")
print(f"Context Compression: {agent.get_telemetry_report()['context_compression_ratio']}%")

📊 Documentation Index


📄 License

Licensed under the Apache License, Version 2.0.

Metadata

Release files for m1-m2-agent 0.6.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Loss of provenance

These files do not have provenance metadata, despite files in a prior release including this data.

We recommend further investigation before installing these files. View details.

Source distribution (sdist)

Source distribution for m1-m2-agent 0.6.0
File Size Uploaded Provenance
m1_m2_agent-0.6.0.tar.gz 222.4 kB Without provenance Details

Built distribution (wheel)

Table of built distributions (wheels) for m1-m2-agent 0.6.0
File Interpreter ABI Platform
m1_m2_agent-0.6.0-py3-none-any.whl Python 3 none any Details

Total release size: 437.5 kB

Release files / m1_m2_agent-0.6.0.tar.gz

Loss of provenance

This file belongs to a release without provenance metadata, despite a prior release including this data.

We recommend further investigation before installing this file. View details.

Download URL m1_m2_agent-0.6.0.tar.gz
Size 222.4 kB
Tags Source
SHA-256 checksum
How to use checksums
45739e4458f3ca1b43ab3e694b8e1c34496ad66929aa45eb81bacf5cd8c9f550
BLAKE2b-256 checksum
How to use checksums
84b3a7547235379bdcc7cb70d362f28ace84a5522259ad510442875535293ba6
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/7.0.0 CPython/3.13.3

Release files / m1_m2_agent-0.6.0-py3-none-any.whl

Loss of provenance

This file belongs to a release without provenance metadata, despite a prior release including this data.

We recommend further investigation before installing this file. View details.

Download URL m1_m2_agent-0.6.0-py3-none-any.whl
Size 215.1 kB
Tags Python 3
SHA-256 checksum
How to use checksums
934e07c291022b25c3fc2a8dbd6acb4a46324666c628be8706f4802a4c107e7d
BLAKE2b-256 checksum
How to use checksums
b68e2bf60240db124fdc4fe180bc4f815288d73f54de23588261bda5eba421aa
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/7.0.0 CPython/3.13.3

Security for m1-m2-agent 0.6.0

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Loss of provenance

A previous release of these files had provenance metadata, but this release does not.

While this could reflect a routine change by the project maintainers, it may also indicate that the release files have been compromised.

Release comparison

  • Removed 0.3.2 2 files With provenance
  • Added 0.6.0 2 files Without provenance

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page