@awebai/oats 0.26.0 → 0.27.0

package/docs/desktop-cli-api.md

@@ -28,7 +28,7 @@ refusals below remain authoritative.
 
 Optional features are negotiated from the probe's `features` array. Starting
 an existing home requires `session-start`; named launch configurations and
-runtime/permission overrides require `launch-config`; restarting a running
+harness/permission overrides require `launch-config`; restarting a running
 home also requires `session-restart`. Desktop checks the corresponding
 `remote` entries before offering these operations for a server. The router
 then probes the execution host before sending a mutation. An absent feature
@@ -48,6 +48,63 @@ no progress prose (progress goes to stderr):
 - success (exit 0): `{"schemaVersion":1,"ok":true,"result":{...}}`
 - failure (nonzero exit): `{"schemaVersion":1,"ok":false,"error":{"code":"...","message":"..."}}`
 
+Either may also carry `"warnings":[…]` (0.27.0+), present only when there is
+something to say. The one warning so far is `deprecated-runtime-name` (see
+[the harness rename](#the-harness-rename-feature-harness-oats-0270)). `oats status
+--json`, whose document is not an envelope, carries the same `warnings` beside
+its `problems`. In text mode the warning is one `oats: warning: …` line on stderr.
+
+## The harness rename (feature `harness`, OATS 0.27.0)
+
+What starts an instance (pi, claude or codex) is its **harness**. 0.27.0 renames
+the kernel's `runtime` to `harness` everywhere it means that:
+
+- Outputs speak only the new names.
+- Every input written before 0.27.0 still works. The rule is read either,
+  write new: the old spelling is read as the new one, and the next write
+  records the new one.
+- A command that read an old spelling answers **one** warning:
+  `{"code":"deprecated-runtime-name","key":"runtime","replacement":"harness","sources":[…],"message":"…"}`.
+  `sources` names each place it read the old spelling (a flag, a file and its
+  key, a home).
+- A pair that disagrees is refused rather than guessed, for example
+  `--harness pi --runtime claude`, or both keys with different values.
+- A later release drops the old spellings.
+
+Gate on the feature `harness`. A kernel without it speaks the old names: the
+routed commands (`--server`) already translate for such a host, sending
+`--runtime` and `runtime` keys to it and reading its `runtimes` list.
+
+| Surface | Before 0.27.0 | 0.27.0 | Old spelling still accepted? |
+|---|---|---|---|
+| `oats version --json` | `runtimes: [pi, claude, codex]` | `harnesses: [...]`, feature `harness` | **Dropped**: no `runtimes` alias; gate on the feature |
+| Flag on `spawn` (and `--preview`), `session start`/`restart`, `launch-config preview`, and their `--server` forms | `--runtime <h>` | `--harness <h>` | Yes, with the warning (the okf 2.1.5 harvest worker passes `--runtime` to spawn). Both flags disagreeing → `E_BAD_ARGS` |
+| `oats status --json`: `agents[]` rows (soul default) and `agents[].instances[]` rows | `runtime` | `harness` | Output only |
+| `oats status --json`: instance rows' `composition.materialized` | `runtimePackages`, `runtimePosture` | `harnessPackages`, `harnessPosture` | Output only |
+| `oats inspect --json` `souls[]` rows, remote roster rows | `runtime` | `harness` | Output only; a pre-0.27 host's `runtime` rows are read as `harness` |
+| `oats inspect --home --json` `instance` | `runtime` | `harness` | Output only |
+| The launch plan's package check (`launch-config preview` `problems[]`) | `runtime-packages` | `harness-packages` | Output only |
+| Soul `soul.yaml` (member souls and capability-defined agents) | `runtime:` | `harness:` | Yes, **without** a warning: released capabilities (oats.aweb 1.13.1) ship `runtime:`, and the operator cannot fix a provider's file. Both, disagreeing → `E_BAD_MANIFEST` |
+| `oats-local.yaml` `launch-configs.<name>` | `runtime:` | `harness:` | Yes, with the warning. Both, disagreeing → `E_WORKSPACE_SCHEMA`. `launch-config set` writes `harness` (a `runtime` in its `--file` definition too) |
+| `launch-config list/preview --json` rows and `selection` | `runtime` | `harness` | Output only |
+| Home `instance.json` | `runtime`; launch recipe `launch` version 1 `{runtime}` | `harness`; recipe version **2** `{harness}` | Yes, with the warning naming the home: a 0.26.0 home inspects, starts, restarts and retires; its next start or restart records the new names |
+| `oats spawn … --preview` decision | `effective.runtime` | `effective.harness` | Output only. The revision digests the key names, so a decision previewed by a 0.26 kernel is `E_DECISION_STALE` at apply (with the fresh decision) |
+| `spawn`/`session` results, `spawned` event `data` | `runtime` | `harness` | Output only |
+| Schedule definitions (`schedule add/update --spec-json`, stored jobs, `schedule list`) | `runtime` | `harness` | Yes, with the warning. A stored job is read in the new name and saved in it next time. Both, disagreeing → `E_SCHEDULE_INVALID` (a stored job: invalid on its own) |
+| Schedule run records (`lastRun`, `recentRuns`) | `startedRuntime` | `startedHarness` | Output; a 0.26.0 record's `startedRuntime` is still read |
+| Error codes | `E_UNSUPPORTED_RUNTIME`, `E_RUNTIME_PACKAGE`, `E_RUNTIME_RESOURCE_MISSING` | `E_UNSUPPORTED_HARNESS`, `E_HARNESS_PACKAGE`, `E_HARNESS_RESOURCE_MISSING` | Output only |
+| Hook environment (spawn and launch hooks) | `OATS_RUNTIME`, `OATS_PREVIOUS_RUNTIME` | `OATS_HARNESS`, `OATS_PREVIOUS_HARNESS` | Both are set, with the same values, for released hooks |
+| Capability manifest `requires[]` harness package | `runtime` | `harness` | Yes, **without** a warning (a provider's file); a row naming both is refused |
+| Package verification `loadedBy` | `runtime-discovery` | `harness-discovery` | Output only |
+
+Unchanged, because they do not name the harness: the session endpoint
+vocabulary (`runtimeAuthority`, `runtimeState`/`runtimeError` in liveness,
+`E_RUNTIME_ENDPOINT_UNKNOWN`, `E_RUNTIME_AUTHORITY_MISMATCH`,
+`E_RUNTIME_QUIESCE_FAILED`); `capabilityRuntime`; the retirement baseline's
+`runtime`; oats.okf's `harvest-runtime` setting; and the kernel's
+"runtime-neutral" design. Hook stdin carries no `launch.runtime` (no 0.26 hook
+emitter wrote it).
+
 ## Inspect, readiness and operation run on the workspace model (`operationsApi: 2`, `soulsApi: 2`, `readinessApi: 2`, OATS 0.26.0)
 
 On a workspace deployment (an `oats-local.yaml` in reach of `--dir`), and for
@@ -121,7 +178,7 @@ payload the spawn recorded for a home, or the resolution computes for a soul.
  "subject":{"kind":"instance","instance":"release-manager-x","home":"/w/agents/release-manager/instances/release-manager-x","soul":"release-manager"},
  "workspace":{"key":"github.com/northwind/agents","name":null,"deployment":"/w","commit":"461b9c24…","standalone":false},
  "souls":[{"soulsApi":2,"name":"release-manager","repoKey":"github.com/northwind/agents","commit":"461b9c24…","team":"engineering",
-   "kind":null,"path":null,"description":"Cuts, verifies and announces platform releases.","work":"worktree","runtime":null,"model":null,
+   "kind":null,"path":null,"description":"Cuts, verifies and announces platform releases.","work":"worktree","harness":null,"model":null,
    "declarations":{"requires":null,"defaults":null,"knowledge":{"owns":"release-manager","reads":["platform-engineer"]},"teams":null,"resources":null,"children":null,
                    "capabilities":{"nw-release-tooling":{"from":"here"},"nw-deploy":{"from":"package"}}},
    "declarationProblems":[],
@@ -138,7 +195,7 @@ payload the spawn recorded for a home, or the resolution computes for a soul.
     "operations":[{"name":"inspect","kind":"view","command":"inspect","context":"home","description":"…","args":[],"argv":["okf","inspect"],"available":true,"reason":null}]}],
  "knowledge":{"provider":"oats.okf","version":"2.1.3","operations":[{"name":"inspect","kind":"view","available":true,"reason":null}]},
  "instance":{"home":"/w/agents/release-manager/instances/release-manager-x","instance":"release-manager-x","agent":"release-manager",
-   "runtime":"pi","model":null,"yolo":null,"launched":false,"createdAt":"<iso>","resolution":"7217670b…",
+   "harness":"pi","model":null,"yolo":null,"launched":false,"createdAt":"<iso>","resolution":"7217670b…",
    "soulDir":"/w/agents/release-manager/souls/461b9c24929c",
    "instructions":{"file":"/w/agents/release-manager/instances/release-manager-x/AGENTS.md","text":"…","truncated":false,
                    "sources":[{"source":"kernel:instance-boundary","file":"…"},{"source":"capability:oats.okf","file":"…/.oats/modules/oats.okf/injects/okf.md"}]}},
@@ -471,7 +528,7 @@ home's removal, so a retired instance's `retired` event is still readable).
 
 ```json
 {"eventsApi":1,"instance":"dev-1","home":"/abs/home","count":7,"returned":7,"truncated":false,
- "events":[{"eventsApi":1,"at":"<iso>","instance":"dev-1","home":"/abs/home","producer":"kernel","kind":"spawned","data":{"agent":"dev","work":"worktree","branch":"agents/dev-1","runtime":"claude","model":null,"parentInstance":null,"relation":null,"launched":true}},
+ "events":[{"eventsApi":1,"at":"<iso>","instance":"dev-1","home":"/abs/home","producer":"kernel","kind":"spawned","data":{"agent":"dev","work":"worktree","branch":"agents/dev-1","harness":"claude","model":null,"parentInstance":null,"relation":null,"launched":true}},
            {"…":"launched | restarted | stopped | stop-refused | retire-planned | worktree-retained | worktree-removed | branch-deleted | retired | child-spawn-refused"}],
  "lastEvent":{"kind":"stopped","at":"<iso>","producer":"kernel"},
  "waitingOnYou":null,
@@ -628,12 +685,12 @@ unchecked, echoed a stored `definition.id` without checking it, and named a
 The Spawn modal's fields are backed by the kernel's own decision, taken **before
 any side effect**: `oats spawn <agent> [same flags as a real spawn] --preview --json`
 runs every preflight a spawn runs (placement, composition, resources,
-executable, runtime packages, child-spawn policy) and returns what the spawn
+executable, harness packages, child-spawn policy) and returns what the spawn
 *would* do — then returns without creating a home, branch or worktree.
 
 ```json
 {"spawnPreviewApi":1,"preview":true,"agent":"dev","kind":"persistent","instance":"dev-fix-login","home":"/abs/agents/dev/instances/dev-fix-login",
- "repo":"/abs/repo","work":"worktree","runtime":"claude","model":"opus","modelSource":"explicit","launchConfig":null,"yolo":false,"backend":"tmux",
+ "repo":"/abs/repo","work":"worktree","harness":"claude","model":"opus","modelSource":"explicit","launchConfig":null,"yolo":false,"backend":"tmux",
  "branch":"agents/dev-fix-login","base":{"ref":"HEAD","oid":"<oid>"},"worktree":"/abs/agents/dev/instances/dev-fix-login/work",
  "relation":null,"parentInstance":null,"policy":{"childSpawns":{"allowed":true,"origin":{"kind":"default","detail":"…"}}},
  "executable":"/abs/bin/claude","capabilities":["oats.core"],"skills":["oats-operate","oats-souls"],"task":"…"}
@@ -650,7 +707,7 @@ executable, runtime packages, child-spawn policy) and returns what the spawn
   the worktree **from that exact oid**.
 - **Model**: `model`/`modelSource` are the resolved selection. Omitting
   `--model` **inherits** the launch configuration's or soul's preference;
-  `--model @native-default` is the explicit "use the runtime's own default"
+  `--model @native-default` is the explicit "use the harness's own default"
   (`modelSource: "native default (explicit)"`). These are different requests
   and the UI must not relabel one as the other.
 - **Policy**: `policy.childSpawns` is what this instance will record (soul
@@ -722,11 +779,11 @@ the pre-fix marker and is never accepted for dispatch.
 - **Bounded preflight**: every native probe a preview runs (`pi --list-models`,
   `pi list`, `claude plugin list`) shares ONE budget (20 s default), runs in its
   own process group and is group-killed on timeout; `preflight {status:
-  complete|timeout, budgetMs, elapsedMs}` says which. A hanging runtime cannot
+  complete|timeout, budgetMs, elapsedMs}` says which. A hanging harness CLI cannot
   hang a preview.
 - **Confirmed apply contract** (0.24.10+, feature `spawn-apply-2`,
   `spawnApplyApi: 1`) — what a GUI may promise at "Confirm spawn":
-  - `decision` gains **`effective {repo, work, runtime, model, launchConfig,
+  - `decision` gains **`effective {repo, work, harness, model, launchConfig,
     yolo, backend, childSpawns, relation{kind, anchor{instance, agentsRoot}}}`**
     and `revision` hashes placement + effective. An inherited default that would
     change what launches (the soul's model edited between preview and apply,
@@ -1342,7 +1399,7 @@ are described in [the operations contract](design/operations-contract.md).
 
 ```text
 oats session start --home /absolute/home [--server id] \
-  [--launch-config name] [--runtime pi|claude|codex] \
+  [--launch-config name] [--harness pi|claude|codex] \
   [--model id] [--yolo|--no-yolo] --json
 oats session restart --home /absolute/home [the same options] --json
 ```
@@ -1366,7 +1423,7 @@ oats launch-config list [--dir /scope | --home /home | --soul name --agents-root
 oats launch-config set name --file /private/definition.json [--keep-env] --dir /scope --json
 oats launch-config remove name --dir /scope --json
 oats launch-config preview (--home /home | --soul name --agents-root /scope/agents --dir /scope) \
-  [--launch-config name] [--runtime runtime] [--model id] [--yolo|--no-yolo] --json
+  [--launch-config name] [--harness harness] [--model id] [--yolo|--no-yolo] --json
 ```
 
 All accept `--server id`. Scope edits follow the registration; inspection and
@@ -1375,7 +1432,7 @@ is serialized to SSH stdin and read on the host with `--file -`; the local
 filename is never passed to the server as though it existed there.
 
 The list result supplies `context`, `selected` and `configurations`. Each
-configuration has a name, runtime, executable, literal argument array,
+configuration has a name, harness, executable, literal argument array,
 environment, model, permission choice and declaring `source`. Environment
 literals appear as `{ "redacted": true }`; references appear as
 `{ "fromEnv": "VARIABLE_NAME" }`. Optional executable/model/yolo fields can be
@@ -1410,7 +1467,7 @@ See [launch configuration syntax](configuration.md) and
 | `warnings` | string[]        | non-fatal warnings (always an array)       |
 | `tmux`     | {session,window} \| null | tmux target                       |
 
-Additional informative fields: `repo`, `runtime`, `model`, `parent`,
+Additional informative fields: `repo`, `harness`, `model`, `parent`,
 `sibling` (explicit sibling cluster link when a root-level sibling relation
 was declared, else null), `relation` (`child`/`sibling`/`parent` when a
 relation was declared at spawn, else null), `spawnOrigin`, `attach`.

package/docs/desktop-instance-start.md

@@ -9,7 +9,7 @@ The Desktop roster is the place to return to it:
 - The hierarchy's action popover offers **Start…** for a stopped instance.
 - An unknown status is shown as unknown, not as permission to launch another process.
 
-The Start/Restart dialog names the existing instance, runtime and host. Choose
+The Start/Restart dialog names the existing instance, harness and host. Choose
 a named launch configuration or keep the recorded launch. Without a selected
 configuration, the harness can also be changed directly. A named configuration
 fixes its harness; model and permission choices can override its defaults.
@@ -53,7 +53,7 @@ Use the server's workspace to manage configurations defined on that server.
 Desktop sends `POST /api/start/<instance>?ws=…&home=…` (and `server=…` for a
 remote instance). The backend resolves that exact roster identity and calls
 `oats session start --home <absolute-home> [--server <id>] [--model <model>] --json`.
-Launch choices add `--launch-config`, `--runtime` or `--yolo`/`--no-yolo`.
+Launch choices add `--launch-config`, `--harness` or `--yolo`/`--no-yolo`.
 Restart uses `POST /api/restart/<instance>?ws=…&home=…` and the single kernel
 command `oats session restart` with the same selectors and choices.
 Configuration inspection and editing use `POST /api/launch-configs?ws=…`,

package/docs/first-team.md

@@ -103,7 +103,7 @@ oats spawn backend-expert --purpose first-fix --task "Fix one small issue, run t
 oats status
 ```
 
-`--runtime pi|claude|codex` picks the harness; complete any native folder
+`--harness pi|claude|codex` picks the harness; complete any native folder
 trust or authentication prompt in the printed session. The instance home is
 `agents/<soul>/instances/<instance>/`; `work/` is its repository view;
 `.oats/modules/<cap>/` and `.agents/skills/<cap>/` are the copied capabilities;

package/docs/implementation.md

@@ -162,7 +162,7 @@ instance homed inside a repository with its own `.claude/skills` sees those
 too. Project *settings* — hooks, plugins, permissions, custom agents — resolve
 from the instance home rather than from ancestors.
 
-Codex is available with `--runtime codex`. It starts in the instance home,
+Codex is available with `--harness codex`. It starts in the instance home,
 reads `AGENTS.md` and `.agents/skills` natively, and receives `TASK.md` as its
 initial prompt. User configuration, approval policy, ancestor instructions and
 ambient skill sources remain native. Worktrees are already below the instance
@@ -175,8 +175,8 @@ The Desktop model field accepts a native id without using Pi's model catalog.
 This launch support does not supply an aweb channel for Codex: agents can use
 `aw` from their home, with automatic wake delivery tracked separately.
 
-All runtimes record what they actually expose in `instance.json` under
-`composition.materialized.runtimePosture`: the OATS-composed set, what is
+All harnesses record what they actually expose in `instance.json` under
+`composition.materialized.harnessPosture`: the OATS-composed set, what is
 curtailed, and what remains ambient. The deviation from strict composition is
 auditable rather than implied.
 

package/docs/oats-local.schema.json

@@ -42,10 +42,11 @@
       "additionalProperties": {
         "type": "object",
         "additionalProperties": false,
-        "required": ["runtime"],
+        "anyOf": [{ "required": ["harness"] }, { "required": ["runtime"] }],
         "properties": {
-          "runtime": { "type": "string", "enum": ["pi", "claude", "codex"], "description": "The harness family this configuration starts; it decides the kernel's own baseline arguments (skills, instructions, task) and how model/yolo are expressed." },
-          "executable": { "type": "string", "minLength": 1, "description": "The program to run instead of the runtime's default binary: a bare name is looked up on PATH on the execution host; a path containing a slash is resolved against the deployment directory (where this oats-local.yaml lives) when relative. Checked to exist and be executable before any start; never executed just to probe it." },
+          "harness": { "type": "string", "enum": ["pi", "claude", "codex"], "description": "The harness this configuration starts (named `runtime` before 0.27.0); it decides the kernel's own baseline arguments (skills, instructions, task) and how model/yolo are expressed." },
+          "runtime": { "type": "string", "enum": ["pi", "claude", "codex"], "deprecated": true, "description": "The pre-0.27 name of `harness`, still read (a deprecation warning); both, disagreeing, are refused. `oats launch-config set` writes `harness`." },
+          "executable": { "type": "string", "minLength": 1, "description": "The program to run instead of the harness's default binary: a bare name is looked up on PATH on the execution host; a path containing a slash is resolved against the deployment directory (where this oats-local.yaml lives) when relative. Checked to exist and be executable before any start; never executed just to probe it." },
           "args": { "type": "array", "items": { "type": "string" }, "description": "Extra arguments, each passed literally (no shell interpretation): native configuration files or profiles go here as ordinary arguments." },
           "env": {
             "type": "object",
@@ -58,7 +59,7 @@
             },
             "description": "Environment for the harness. A string is a literal (non-secret by contract; still redacted in every answer). {fromEnv: NAME} is resolved from the execution host's environment at start time; the reference, never the value, is recorded. A missing reference refuses the start before anything stops."
           },
-          "model": { "type": "string", "minLength": 1, "description": "Model for this configuration's runtime; overrides the soul default when this configuration is selected." },
+          "model": { "type": "string", "minLength": 1, "description": "Model for this configuration's harness; overrides the soul default when this configuration is selected." },
           "yolo": { "type": "boolean", "description": "Permission bypass for this configuration; overrides scope and soul defaults when selected." }
         }
       }

package/docs/packages.md

@@ -286,5 +286,5 @@ says so.
 replacement (`details.removed` / `details.replacement` in `--json`). There is
 no installed-capability directory, no config template adoption, no host
 requirement installer. A manifest's `requires` still describes what must exist
-on the host (runtime packages are verified at spawn; host commands are the
+on the host (harness packages are verified at spawn; host commands are the
 operator's to install).

package/docs/release-notes/v0.27.0.md

@@ -0,0 +1,100 @@
+# OATS 0.27.0
+
+What starts an instance (pi, claude or codex) is now called its **harness**
+everywhere the kernel used to say `runtime`: in flags, configuration, records,
+JSON and error codes. Nothing already written stops working. The rule is read
+either, write new: every spelling from before 0.27.0 is still read, and the
+next write records the new one. A command that reads an old spelling answers
+one `deprecated-runtime-name` warning, and a later release drops the old
+spellings. See [Upgrading from 0.26](#upgrading-from-026).
+
+## Changed
+
+- **runtime → harness.** [The Desktop CLI API](../desktop-cli-api.md#the-harness-rename-feature-harness-oats-0270)
+  has the complete table. In short:
+  - Flags: `--harness` replaces `--runtime` on `spawn` (and `--preview`),
+    `session start|restart` and `launch-config preview`, including their
+    `--server` forms. `--runtime` is still accepted, with the warning. The
+    two given with different values are refused (`E_BAD_ARGS`).
+  - `oats-local.yaml`: a launch configuration names `harness:`. `runtime:` is
+    still read, with the warning. Both, disagreeing, is a schema error
+    (`E_WORKSPACE_SCHEMA`). `oats launch-config set` writes `harness`.
+  - Schedules: a spawn job names `harness`. A job stored with `runtime` is
+    read as `harness`, with the warning, and saved in the new name next time.
+    Both, disagreeing, makes that job invalid (`E_SCHEDULE_INVALID`).
+    `lastRun`/`recentRuns` record `startedHarness` (was `startedRuntime`).
+  - Homes: `instance.json` records `harness`, and the launch recipe is version
+    **2** (`harness`; version 1 said `runtime`). A home spawned by 0.26.0 is
+    read in the new names, with the warning naming the home. It inspects,
+    starts, restarts and retires as before, and its next start or restart
+    records the new names.
+  - `soul.yaml` names `harness:`. `runtime:` is still read, **without** a
+    warning, because released capabilities ship it (oats.aweb 1.13.1's agents)
+    and an operator cannot fix a provider's file. Both, disagreeing:
+    `E_BAD_MANIFEST`. The same holds for a capability manifest's
+    `requires[]` harness package (`harness`, or `runtime`, never both).
+  - Hooks get `OATS_HARNESS` and `OATS_PREVIOUS_HARNESS` beside
+    `OATS_RUNTIME` and `OATS_PREVIOUS_RUNTIME`, with the same values.
+  - JSON outputs speak only the new names:
+    - `oats version --json` lists `harnesses` (no `runtimes`) and the feature
+      `harness`;
+    - `harness` replaces `runtime` in the status, inspect, spawn, preview,
+      session, launch-config, schedule and event documents;
+    - `harnessPackages` and `harnessPosture` replace `runtimePackages` and
+      `runtimePosture` in `composition.materialized`;
+    - the launch plan's package check (`launch-config preview` `problems[]`)
+      is `harness-packages`, and package verification's `loadedBy` is
+      `harness-discovery`.
+  - Error codes: `E_UNSUPPORTED_HARNESS`, `E_HARNESS_PACKAGE` and
+    `E_HARNESS_RESOURCE_MISSING` replace `E_UNSUPPORTED_RUNTIME`,
+    `E_RUNTIME_PACKAGE` and `E_RUNTIME_RESOURCE_MISSING`.
+  - JSON envelopes may carry `warnings: [...]`, only when there is something
+    to say. `oats status --json` carries it beside `problems`. In text mode,
+    a warning is one `oats: warning: …` line on stderr.
+  - Routed commands (`--server`) speak each host's own vocabulary. A host
+    without the `harness` feature (0.26.x and older) is sent `--runtime` and
+    `runtime` keys, and its `runtimes` list and `runtime` roster rows are read
+    as harnesses.
+  - A spawn decision previewed by a 0.26 kernel is `E_DECISION_STALE` at a
+    0.27 apply (the revision covers the key names), with the fresh decision
+    attached.
+  - Unchanged, because they do not name the harness: the session endpoint's
+    `runtimeAuthority`, `runtimeState` and `runtimeError`, the
+    `E_RUNTIME_ENDPOINT_*`, `E_RUNTIME_AUTHORITY_MISMATCH` and
+    `E_RUNTIME_QUIESCE_FAILED` codes, `capabilityRuntime`, the retirement
+    baseline, and oats.okf's `harvest-runtime` setting.
+
+## Desktop
+
+- **The Desktop speaks the harness names** on a kernel that declares feature
+  `harness` (`--harness`, `harness`/`harnesses`), and the old names on released
+  0.25.8–0.26.x kernels. It reads either spelling everywhere, shows only the
+  harness the kernel reports (no `pi` default for an instance that doesn't say),
+  and accepts kernels `>=0.25.8 <0.28.0`.
+- **Core capabilities name their origin** (soul, workspace or team) on the soul
+  page and the instance sidebar, on a kernel with feature `layers-from`.
+- The unused "the workspace's team settings" origin label is gone (0.26.0's
+  teams amendment K stopped emitting it).
+
+## Fixed
+
+- **0.26.0's notes said per-workspace personal teams need undeployed aweb
+  server support.** The aweb service (0.8.13 and later) and CLI (1.36.8 and
+  later) already carry personal enrollment; what remains is oats.aweb 1.15
+  adopting it. The bundled oats.aweb is still 1.13.1 (the personal team only);
+  the team verbs come with oats.aweb 1.14.1 in a 0.27.x patch.
+
+## Upgrading from 0.26
+
+Nothing to do. Old spellings keep working with a `deprecated-runtime-name`
+warning, and a later release drops them. To stop the warning:
+
+- write `harness:` for `runtime:` in `oats-local.yaml` launch configurations
+  (or re-save them with `oats launch-config set`);
+- pass `--harness` for `--runtime` in scripts;
+- re-save any schedule the warning names (`oats schedule update`). A stored
+  job is also rewritten on its next save.
+
+A 0.26.0 home stops warning after its next start or restart. A Desktop that
+gates on the `harness` feature reads the new names; an older Desktop reads
+`runtimes` and `runtime` and needs its update.

package/docs/schedules.md

@@ -39,7 +39,7 @@ see [Captured definitions](#captured-definitions-removed-in-026).
 ## Kinds
 
 - **spawn** `{id, enabled, cron, tz, kind: "spawn", agent, agentsRoot?,
-  repo?, backend?, purpose?, task, runtime?, model?, yolo?, wake?}` — every
+  repo?, backend?, purpose?, task, harness?, model?, yolo?, wake?}` — every
   due minute launches one disposable instance of `agent` with the same
   options `oats spawn` takes. `agentsRoot` names the exact agents root that
   holds the soul (it must lie inside the workspace and defaults to the
@@ -136,7 +136,7 @@ running}], scheduler: {installed, active, lastTick, maxConcurrent, ...}}`.
 ## What a run reports
 
 `launched` (spawn or command returned), `active` (the instance is running;
-a home whose retirement is pending still counts, its runtime may be alive),
+a home whose retirement is pending still counts, its harness may be alive),
 `ended` (its home is gone), `stopped` (home present, nothing running: needs
 attention, never removed for you), `launch-failed`, `unknown`, and for wake
 jobs `delivered`, `started` or `skipped`. The kernel never claims a task
@@ -159,13 +159,13 @@ unknown; check the roster and the host by hand, then
 slot (or `remove --force` forgets the job).
 
 A wake job that starts a stopped home holds a launch slot while that
-runtime is starting, active, retiring or unobservable, and releases it when
-the runtime is proven stopped (the session start receipt's exit marker for
+harness is starting, active, retiring or unobservable, and releases it when
+the harness is proven stopped (the session start receipt's exit marker for
 that launch, or a home that no longer has a session) or the home is gone.
 A persistent home that outlives its process does not keep a slot. Delivering
 a message to a home that is already running takes no slot. The host tick
 observes every registered scope first, then admits due jobs in one
-host-wide order, least recently launched first (only an actual runtime
+host-wide order, least recently launched first (only an actual harness
 launch counts; a skipped or pending job keeps its place at the front), so
 one frequent job in one scope cannot keep the only slot forever. An invalid
 or malformed definition is reported on that job and the rest of the tick
@@ -177,7 +177,7 @@ execution identity, kind and target cannot
 change; cron, tz and enabled can. A cold wake persists its slot before
 the session start runs and keeps it on any start exception, whatever its code
 (the kernel can refuse while recording, after the session exists); the next
-observation releases it once the runtime is proven stopped or absent, one tick
+observation releases it once the harness is proven stopped or absent, one tick
 at worst.
 `remove` refuses while the job's instance is still tracked (`--force`
 forgets the job without stopping anything). Retiring an instance removes the

package/docs/servers.md

@@ -25,8 +25,8 @@ oats server list
 - `--path` names directories to prepend to the remote PATH for every routed
   command (`~/.local/bin:/opt/pi/bin`). A non-interactive ssh command runs in
   the login shell's minimal PATH, and the remote kernel's spawn preflight looks
-  for the runtime binary (`claude`, `pi`, `codex`) there; without this, a
-  runtime installed under the user's home is "not found" even though it runs
+  for the harness binary (`claude`, `pi`, `codex`) there; without this, a
+  harness installed under the user's home is "not found" even though it runs
   fine in an interactive shell on that host.
 - Registrations live in `~/.oats/servers.json` on this machine, never in a
   repository scope.
@@ -44,13 +44,13 @@ worktree, identity, launch, retirement. The local side only routes: a local
 `--task-file` travels as text, every argument is quoted for the remote login
 shell, and the remote's version and envelope are checked before either
 mutation (spawn and retire). A spawn is also held to what the remote
-advertises: a runtime it does not list (including the soul's own default as
+advertises: a harness it does not list (including the soul's own default as
 the remote roster reports it), a session backend it lacks, or a launch option
 such as `--yolo` it does not know is refused with `E_REMOTE_INCOMPATIBLE`
 saying what was established. A remote that advertises nothing (any kernel
 before 0.22.2) is assumed to run pi and claude on tmux with no options, and
 the refusal says so rather than claiming the remote lacks the feature; a soul
-the remote roster does not list with a runtime is validated by the remote
+the remote roster does not list with a harness is validated by the remote
 kernel itself at spawn. `--dir` and `--server` do not combine; the remote
 workspace comes from the registration.
 

package/docs/souls-and-instances.md

@@ -68,9 +68,9 @@ compatibility:                            # optional floors on PACKAGE versions
 | `compatibility` | `<cap>: <semver range>` checked against the locked package version (`E_COMPATIBILITY`). |
 
 Schema: [`soul.schema.json`](soul.schema.json). Not in v2: `kind`, `type`,
-`repo`, `runtime`, `model`, `backend`, `yolo`, `launch-config`, `children`,
+`repo`, `harness`, `model`, `backend`, `yolo`, `launch-config`, `children`,
 `requires`, `source:`, `stores.inherit`. Runtime, model, backend, yolo and the
-launch configuration are spawn-time host choices (`--runtime`, `--model`,
+launch configuration are spawn-time host choices (`--harness`, `--model`,
 `--backend`, `--yolo`, `--launch-config`, or a launch configuration in
 `oats-local.yaml`), not soul identity: a soul is model-agnostic as an artifact.
 A child-spawn policy is a spawn flag too (`--no-child-spawns`).
@@ -303,13 +303,13 @@ evidence but never waits for a model or GitHub: independent processing and
 source-targeted inspection continue after the home disappears.
 
 `oats retire <instance> --self` lets an instance retire itself when the human
-or briefing says it is done. A live runtime cannot give a stable final
+or briefing says it is done. A live harness cannot give a stable final
 inspection of its own work, so the calling process inspects, runs, and removes
 nothing: it records the intent beside its home as
 `.oats-retire-pending-<instance>.json` and starts a detached completion, then returns so the instance can report final
 status before its tmux window dies a few seconds later. The completion then
 retires the instance exactly as an external `oats retire` would: quiesce the
-runtime, preserve uncommitted work, run retire hooks, repair lineage, remove
+harness, preserve uncommitted work, run retire hooks, repair lineage, remove
 the worktree and the home. Success leaves nothing behind: the home and the
 marker are gone. A failure writes `.oats-retired-<instance>.json` beside the
 retained home (plus the usual quarantine marker when hooks reported incomplete
@@ -399,7 +399,7 @@ directory; without it, the deployment directory (where `oats-local.yaml` is) is
 used. No implicit fallback changes the other modes.
 
 `--work-dir` and `--branch` are rejected. Canonical instructions, skill
-composition, provider trust and runtime preflight still apply. No worktree setup
+composition, provider trust and harness preflight still apply. No worktree setup
 runs. Retirement preserves nonempty work in verified recovery storage beside the
 home (`workRecovery.path/work`) before deleting it, including files created by
 hooks; directory work has no disposable-root exemptions. The work-root cannot be
@@ -469,7 +469,7 @@ they are stated separately:
   compatibility aliases for the separately published pi extension.
 - **Lifecycle hooks**: `OATS_INSTANCE_HOME` and `OATS_HOME`, alongside the rest of
   the hook contract. `OATS_HOME` predates `OATS_INSTANCE_HOME` and is kept because
-  shipped capability hooks read it; it is **not** exported to runtime sessions.
+  shipped capability hooks read it; it is **not** exported to harness sessions.
 
 Neither is `OATS_HOME_DIR`, which is the package store root — do not conflate
 them.

package/injects/instance-boundary.md

@@ -1,7 +1,7 @@
 ## Your two directories
 
 **`<instance-home>` is where this session starts** — the specific gitignored OATS
-instance directory you woke up in, given to your runtime and to every lifecycle
+instance directory you woke up in, given to your harness and to every lifecycle
 hook as `$OATS_INSTANCE_HOME`. It is not your user home (`~`), not the repository
 root, and not the work tree. Anything that says "your home" means this directory.