@harness-control/protocol 0.1.0

package/dist/json-schema.d.ts

@@ -0,0 +1,19 @@
+export type JsonSchemaValue = boolean | JsonSchema;
+export type JsonSchema = Record<string, unknown> & {
+    $id?: string;
+    $schema?: string;
+    additionalProperties?: JsonSchemaValue;
+    const?: string | number | boolean | null;
+    description?: string;
+    items?: JsonSchemaValue | JsonSchemaValue[];
+    oneOf?: JsonSchema[];
+    pattern?: string;
+    properties?: Record<string, JsonSchemaValue>;
+    required?: string[];
+    title?: string;
+    type?: string;
+};
+export declare const HCP_MESSAGE_JSON_SCHEMA_ID: string;
+export declare function createHcpMessageJsonSchema(): JsonSchema;
+export declare const hcpMessageJsonSchema: JsonSchema;
+//# sourceMappingURL=json-schema.d.ts.map

package/dist/json-schema.js

@@ -0,0 +1,128 @@
+import { z } from "zod";
+import { HCP_VERSION, KNOWN_HCP_EVENT_TYPES, hcpExtensionEventDataSchema, hcpMessageSchema, knownHcpEventDataSchemas, } from "./index.js";
+export const HCP_MESSAGE_JSON_SCHEMA_ID = `https://schemas.harness-control.local/${HCP_VERSION}/message.schema.json`;
+function isJsonSchema(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function asJsonSchema(value, context) {
+    if (!isJsonSchema(value)) {
+        throw new TypeError(`${context} must be a JSON Schema object.`);
+    }
+    return value;
+}
+function getProperties(schema, context) {
+    if (schema.properties === undefined) {
+        throw new TypeError(`${context} must define properties.`);
+    }
+    return schema.properties;
+}
+function getObjectProperty(schema, propertyName, context) {
+    const properties = getProperties(schema, context);
+    return asJsonSchema(properties[propertyName], `${context}.${propertyName}`);
+}
+function cloneJsonSchema(schema) {
+    return asJsonSchema(structuredClone(schema), "cloned JSON Schema");
+}
+function toRootJsonSchema(schema) {
+    return asJsonSchema(z.toJSONSchema(schema), "generated JSON Schema");
+}
+function toEmbeddedJsonSchema(schema) {
+    const jsonSchema = cloneJsonSchema(toRootJsonSchema(schema));
+    delete jsonSchema.$schema;
+    delete jsonSchema.$id;
+    return jsonSchema;
+}
+function hasMessageTypeConst(schema, messageType) {
+    const typeSchema = getObjectProperty(schema, "type", "message schema");
+    return typeSchema.const === messageType;
+}
+function createEventTypeSchema(eventType) {
+    return {
+        type: "string",
+        const: eventType,
+    };
+}
+function createExtensionEventTypeSchema(prefix) {
+    return {
+        type: "string",
+        pattern: `^${prefix}\\..+$`,
+    };
+}
+function withRequiredProperty(schema, propertyName) {
+    const required = schema.required ?? [];
+    if (required.includes(propertyName)) {
+        return schema;
+    }
+    return {
+        ...schema,
+        required: [...required, propertyName],
+    };
+}
+function createHarnessEventPayloadSchema(basePayloadSchema, eventTypeSchema, dataSchema, turnIdRequired) {
+    const payloadSchema = cloneJsonSchema(basePayloadSchema);
+    const properties = getProperties(payloadSchema, "harness.event payload schema");
+    properties.event_type = eventTypeSchema;
+    properties.data = dataSchema;
+    return turnIdRequired ? withRequiredProperty(payloadSchema, "turn_id") : payloadSchema;
+}
+function createHarnessEventMessageSchema(baseMessageSchema, payloadSchema) {
+    const messageSchema = cloneJsonSchema(baseMessageSchema);
+    const properties = getProperties(messageSchema, "harness.event message schema");
+    properties.payload = payloadSchema;
+    return messageSchema;
+}
+function createHarnessEventMessageSchemas(baseMessageSchema) {
+    const basePayloadSchema = getObjectProperty(baseMessageSchema, "payload", "harness.event message schema");
+    const knownEventSchemas = KNOWN_HCP_EVENT_TYPES.map((eventType) => {
+        const dataSchema = toEmbeddedJsonSchema(knownHcpEventDataSchemas[eventType]);
+        const payloadSchema = createHarnessEventPayloadSchema(basePayloadSchema, createEventTypeSchema(eventType), dataSchema, eventType.startsWith("local_capability.action."));
+        return createHarnessEventMessageSchema(baseMessageSchema, payloadSchema);
+    });
+    const extensionEventDataSchema = toEmbeddedJsonSchema(hcpExtensionEventDataSchema);
+    const extensionEventSchemas = ["provider", "extension"].map((prefix) => {
+        const payloadSchema = createHarnessEventPayloadSchema(basePayloadSchema, createExtensionEventTypeSchema(prefix), extensionEventDataSchema, false);
+        return createHarnessEventMessageSchema(baseMessageSchema, payloadSchema);
+    });
+    return [...knownEventSchemas, ...extensionEventSchemas];
+}
+function patchStreamableHttpMcpUrlSchema(schema) {
+    const messageSchemas = schema.oneOf ?? [];
+    const sessionStartSchema = messageSchemas.find((messageSchema) => hasMessageTypeConst(messageSchema, "harness.session.start"));
+    if (sessionStartSchema === undefined) {
+        throw new TypeError("HCP message JSON Schema must contain harness.session.start.");
+    }
+    const payloadSchema = getObjectProperty(sessionStartSchema, "payload", "harness.session.start schema");
+    const mcpServersSchema = getObjectProperty(payloadSchema, "mcp_servers", "session start payload schema");
+    const itemSchema = asJsonSchema(mcpServersSchema.items, "mcp_servers items schema");
+    const attachmentSchemas = itemSchema.oneOf ?? [];
+    const streamableSchema = attachmentSchemas.find((candidate) => {
+        const transportValue = candidate.properties?.transport;
+        const transportSchema = typeof transportValue === "object" && transportValue !== null ? transportValue : undefined;
+        return transportSchema?.const === "streamable_http";
+    });
+    const urlOwner = streamableSchema ?? itemSchema;
+    const urlSchema = getObjectProperty(urlOwner, "url", "streamable HTTP MCP server attachment schema");
+    urlSchema.pattern = "^https?://";
+}
+export function createHcpMessageJsonSchema() {
+    const schema = cloneJsonSchema(toRootJsonSchema(hcpMessageSchema));
+    const messageSchemas = schema.oneOf ?? [];
+    if (messageSchemas.length === 0) {
+        throw new TypeError("HCP message JSON Schema must contain message variants.");
+    }
+    const expandedMessageSchemas = messageSchemas.flatMap((messageSchema) => {
+        if (hasMessageTypeConst(messageSchema, "harness.event")) {
+            return createHarnessEventMessageSchemas(messageSchema);
+        }
+        return [messageSchema];
+    });
+    schema.$id = HCP_MESSAGE_JSON_SCHEMA_ID;
+    schema.title = "HCP protocol message";
+    schema.description =
+        "Structural JSON Schema for known hcp.v0 protocol messages. Runtime parsers enforce additional cross-field invariants such as lease-to-attribution equality.";
+    schema.oneOf = expandedMessageSchemas;
+    patchStreamableHttpMcpUrlSchema(schema);
+    return schema;
+}
+export const hcpMessageJsonSchema = createHcpMessageJsonSchema();
+//# sourceMappingURL=json-schema.js.map

package/dist/pairing.d.ts

@@ -0,0 +1,59 @@
+import { z } from "zod";
+export declare const pairingCreateRequestSchema: z.ZodObject<{
+    exchange_secret_hash: z.ZodString;
+    runner_id: z.ZodString;
+    host_id: z.ZodString;
+    protocol_version: z.ZodLiteral<"hcp.v0">;
+}, z.core.$strict>;
+export declare const pairingCodeResponseSchema: z.ZodObject<{
+    request_id: z.ZodString;
+    pairing_code: z.ZodString;
+    pairing_url: z.ZodString;
+    expires_at: z.ZodString;
+    poll_interval_seconds: z.ZodNumber;
+}, z.core.$strict>;
+export declare const pairingExchangeRequestSchema: z.ZodObject<{
+    request_id: z.ZodString;
+    exchange_secret: z.ZodString;
+    runner_id: z.ZodString;
+    host_id: z.ZodString;
+    protocol_version: z.ZodLiteral<"hcp.v0">;
+}, z.core.$strict>;
+export declare const runnerCredentialSchema: z.ZodObject<{
+    credential_id: z.ZodString;
+    credential_secret: z.ZodString;
+    runner_id: z.ZodString;
+    host_id: z.ZodString;
+    control_plane_url: z.ZodString;
+    issued_at: z.ZodString;
+    mcp_proof_secret: z.ZodString;
+}, z.core.$strict>;
+export declare const pairingExchangeResponseSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    status: z.ZodLiteral<"pending">;
+}, z.core.$strict>, z.ZodObject<{
+    status: z.ZodLiteral<"approved">;
+    control_plane_url: z.ZodString;
+    credential: z.ZodObject<{
+        credential_id: z.ZodString;
+        credential_secret: z.ZodString;
+        runner_id: z.ZodString;
+        host_id: z.ZodString;
+        control_plane_url: z.ZodString;
+        issued_at: z.ZodString;
+        mcp_proof_secret: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>], "status">;
+export declare const connectionTokenRequestSchema: z.ZodObject<{
+    protocol_schema_sha256: z.ZodString;
+    credential_id: z.ZodString;
+    credential_secret: z.ZodString;
+    runner_id: z.ZodString;
+    host_id: z.ZodString;
+    protocol_version: z.ZodLiteral<"hcp.v0">;
+}, z.core.$strict>;
+export declare const connectionTokenResponseSchema: z.ZodObject<{
+    connection_token: z.ZodString;
+    expires_at: z.ZodString;
+}, z.core.$strict>;
+export type PairingCodeResponse = z.infer<typeof pairingCodeResponseSchema>;
+//# sourceMappingURL=pairing.d.ts.map

package/dist/pairing.js

@@ -0,0 +1,42 @@
+import { z } from "zod";
+const identity = { runner_id: z.string().min(1).max(200), host_id: z.string().min(1).max(200), protocol_version: z.literal("hcp.v0") };
+export const pairingCreateRequestSchema = z.object({
+    ...identity,
+    exchange_secret_hash: z.string().regex(/^[a-f0-9]{64}$/),
+}).strict();
+export const pairingCodeResponseSchema = z.object({
+    request_id: z.string().min(1),
+    pairing_code: z.string().min(1),
+    pairing_url: z.string().url(),
+    expires_at: z.string().datetime({ offset: true }),
+    poll_interval_seconds: z.number().int().min(1).max(30),
+}).strict();
+export const pairingExchangeRequestSchema = z.object({
+    ...identity,
+    request_id: z.string().min(1),
+    exchange_secret: z.string().min(32).max(256),
+}).strict();
+export const runnerCredentialSchema = z.object({
+    credential_id: z.string().min(1),
+    credential_secret: z.string().min(1),
+    runner_id: z.string().min(1),
+    host_id: z.string().min(1),
+    control_plane_url: z.string().url(),
+    issued_at: z.string().datetime({ offset: true }),
+    mcp_proof_secret: z.string().min(1),
+}).strict();
+export const pairingExchangeResponseSchema = z.discriminatedUnion("status", [
+    z.object({ status: z.literal("pending") }).strict(),
+    z.object({ status: z.literal("approved"), control_plane_url: z.string().url(), credential: runnerCredentialSchema }).strict(),
+]);
+export const connectionTokenRequestSchema = z.object({
+    ...identity,
+    protocol_schema_sha256: z.string().regex(/^[a-f0-9]{64}$/),
+    credential_id: z.string().min(1),
+    credential_secret: z.string().min(1).max(256),
+}).strict();
+export const connectionTokenResponseSchema = z.object({
+    connection_token: z.string().min(1),
+    expires_at: z.string().datetime({ offset: true }),
+}).strict();
+//# sourceMappingURL=pairing.js.map

package/dist/session-reducer.d.ts

@@ -0,0 +1,36 @@
+import type { HcpHarnessEventPayload, HcpSessionSnapshotPayload, HostResumeCursor } from "./index.js";
+export type HcpEventApplyResult = {
+    outcome: "applied";
+    event: HcpHarnessEventPayload;
+} | {
+    outcome: "duplicate";
+    event: HcpHarnessEventPayload;
+} | {
+    outcome: "gap";
+    session_id: string;
+    expected_sequence: number;
+    received_sequence: number;
+} | {
+    outcome: "conflict";
+    session_id: string;
+    sequence: number;
+    existing_event: HcpHarnessEventPayload;
+    received_event: HcpHarnessEventPayload;
+};
+export type HcpSnapshotApplyResult = {
+    outcome: "applied";
+    completeness: HcpSessionSnapshotPayload["completeness"];
+    applied_events: number;
+    duplicate_events: number;
+    tombstones: HcpSessionSnapshotPayload["tombstones"];
+} | Extract<HcpEventApplyResult, {
+    outcome: "gap" | "conflict";
+}>;
+export declare class HcpSessionEventReducer {
+    #private;
+    applyEvent(event: HcpHarnessEventPayload): HcpEventApplyResult;
+    applySnapshot(snapshot: HcpSessionSnapshotPayload): HcpSnapshotApplyResult;
+    resumeCursor(): HostResumeCursor | undefined;
+    events(): HcpHarnessEventPayload[];
+}
+//# sourceMappingURL=session-reducer.d.ts.map

package/dist/session-reducer.js

@@ -0,0 +1,96 @@
+export class HcpSessionEventReducer {
+    #eventsBySession = new Map();
+    applyEvent(event) {
+        const sessionEvents = this.#eventsBySession.get(event.session_id) ?? new Map();
+        const existingEvent = sessionEvents.get(event.sequence);
+        if (existingEvent) {
+            return canonicalStringify(existingEvent) === canonicalStringify(event)
+                ? { outcome: "duplicate", event: existingEvent }
+                : {
+                    outcome: "conflict",
+                    session_id: event.session_id,
+                    sequence: event.sequence,
+                    existing_event: existingEvent,
+                    received_event: event,
+                };
+        }
+        const expectedSequence = sessionEvents.size === 0 ? 1 : Math.max(...sessionEvents.keys()) + 1;
+        if (event.sequence !== expectedSequence) {
+            return {
+                outcome: "gap",
+                session_id: event.session_id,
+                expected_sequence: expectedSequence,
+                received_sequence: event.sequence,
+            };
+        }
+        sessionEvents.set(event.sequence, event);
+        this.#eventsBySession.set(event.session_id, sessionEvents);
+        return { outcome: "applied", event };
+    }
+    applySnapshot(snapshot) {
+        if (snapshot.completeness === "complete") {
+            const replacement = new Map();
+            for (const event of snapshot.events) {
+                replacement.set(event.sequence, event);
+            }
+            this.#eventsBySession.set(snapshot.session_id, replacement);
+            return {
+                outcome: "applied",
+                completeness: "complete",
+                applied_events: snapshot.events.length,
+                duplicate_events: 0,
+                tombstones: snapshot.tombstones,
+            };
+        }
+        let appliedEvents = 0;
+        let duplicateEvents = 0;
+        for (const event of snapshot.events) {
+            const result = this.applyEvent(event);
+            if (result.outcome === "gap" || result.outcome === "conflict") {
+                return result;
+            }
+            if (result.outcome === "applied") {
+                appliedEvents += 1;
+            }
+            else {
+                duplicateEvents += 1;
+            }
+        }
+        return {
+            outcome: "applied",
+            completeness: "partial",
+            applied_events: appliedEvents,
+            duplicate_events: duplicateEvents,
+            tombstones: snapshot.tombstones,
+        };
+    }
+    resumeCursor() {
+        const sessions = Array.from(this.#eventsBySession.entries())
+            .map(([sessionId, events]) => ({
+            session_id: sessionId,
+            last_event_sequence: Math.max(...events.keys()),
+        }))
+            .sort((left, right) => left.session_id.localeCompare(right.session_id));
+        return sessions.length > 0 ? { sessions } : undefined;
+    }
+    events() {
+        return Array.from(this.#eventsBySession.values())
+            .flatMap((events) => Array.from(events.values()))
+            .sort((left, right) => left.session_id === right.session_id
+            ? left.sequence - right.sequence
+            : left.session_id.localeCompare(right.session_id));
+    }
+}
+function canonicalStringify(value) {
+    if (value === null || typeof value !== "object") {
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        return `[${value.map((entry) => canonicalStringify(entry)).join(",")}]`;
+    }
+    const entries = Object.entries(value).sort(([left], [right]) => left.localeCompare(right));
+    return `{${entries
+        .map(([key, entryValue]) => `${JSON.stringify(key)}:${canonicalStringify(entryValue)}`)
+        .join(",")}}`;
+}
+//# sourceMappingURL=session-reducer.js.map

package/fixtures/conformance/invalid/arbitrary-event-family.json

@@ -0,0 +1,13 @@
+{
+  "id": "message-arbitrary-event-family",
+  "type": "harness.event",
+  "version": "hcp.v0",
+  "sent_at": "2026-01-01T00:00:00.000Z",
+  "payload": {
+    "session_id": "session-1",
+    "sequence": 1,
+    "event_type": "custom.raw",
+    "created_at": "2026-01-01T00:00:01.000Z",
+    "data": {}
+  }
+}

package/fixtures/conformance/invalid/local-action-lease-binding-mismatch.json

@@ -0,0 +1,51 @@
+{
+  "id": "message-local-action-lease-binding-mismatch",
+  "type": "local.action.request",
+  "version": "hcp.v0",
+  "sent_at": "2026-01-01T00:00:00.000Z",
+  "payload": {
+    "request_id": "local-action-read-bad",
+    "action": "local.filesystem.read",
+    "issued_at": "2026-01-01T00:00:01.000Z",
+    "attribution": {
+      "session_id": "session-1",
+      "turn_id": "turn-1",
+      "workspace_id": "workspace-1",
+      "provider_instance_id": "provider-1",
+      "run_id": "run-1"
+    },
+    "lease": {
+      "lease_id": "local-lease-read",
+      "capability_id": "git",
+      "scope": "workspace_read",
+      "run_id": "run-1",
+      "hcp_session_id": "session-1",
+      "execution_host_id": "host-1",
+      "provider_instance_id": "provider-1",
+      "workspace_id": "workspace-1"
+    },
+    "sandbox": {
+      "mode": "workspace_write",
+      "workspace_root": "/tmp/workspace",
+      "cwd": "/tmp/workspace",
+      "requires_workspace_containment": true
+    },
+    "approval": {
+      "status": "not_required"
+    },
+    "output_limits": {
+      "content_bytes": 65536
+    },
+    "cancellation": {
+      "cancellable": false
+    },
+    "audit": {
+      "started_event_type": "local_capability.action.started",
+      "completed_event_type": "local_capability.action.completed",
+      "failed_event_type": "local_capability.action.failed"
+    },
+    "input": {
+      "path": "README.md"
+    }
+  }
+}

package/fixtures/conformance/invalid/local-action-missing-turn-id.json

@@ -0,0 +1,21 @@
+{
+  "id": "message-local-action-missing-turn-id",
+  "type": "harness.event",
+  "version": "hcp.v0",
+  "sent_at": "2026-01-01T00:00:00.000Z",
+  "payload": {
+    "session_id": "session-1",
+    "sequence": 1,
+    "event_type": "local_capability.action.started",
+    "created_at": "2026-01-01T00:00:01.000Z",
+    "data": {
+      "lease_id": "local-lease-1",
+      "run_id": "run-1",
+      "workspace_id": "workspace-1",
+      "provider_instance_id": "provider-1",
+      "capability_id": "filesystem",
+      "action": "read_file",
+      "status": "started"
+    }
+  }
+}

package/fixtures/conformance/invalid/local-action-patch-missing-base-hash.json

@@ -0,0 +1,53 @@
+{
+  "id": "message-local-action-patch-missing-base-hash",
+  "type": "local.action.request",
+  "version": "hcp.v0",
+  "sent_at": "2026-01-01T00:00:00.000Z",
+  "payload": {
+    "request_id": "local-action-patch-bad",
+    "action": "local.filesystem.patch",
+    "issued_at": "2026-01-01T00:00:01.000Z",
+    "attribution": {
+      "session_id": "session-1",
+      "turn_id": "turn-1",
+      "workspace_id": "workspace-1",
+      "provider_instance_id": "provider-1",
+      "run_id": "run-1"
+    },
+    "lease": {
+      "lease_id": "local-lease-patch",
+      "capability_id": "filesystem",
+      "scope": "workspace_write",
+      "run_id": "run-1",
+      "hcp_session_id": "session-1",
+      "execution_host_id": "host-1",
+      "provider_instance_id": "provider-1",
+      "workspace_id": "workspace-1"
+    },
+    "sandbox": {
+      "mode": "workspace_write",
+      "workspace_root": "/tmp/workspace",
+      "cwd": "/tmp/workspace",
+      "requires_workspace_containment": true
+    },
+    "approval": {
+      "status": "not_required"
+    },
+    "output_limits": {},
+    "cancellation": {
+      "cancellable": false
+    },
+    "audit": {
+      "started_event_type": "local_capability.action.started",
+      "completed_event_type": "local_capability.action.completed",
+      "failed_event_type": "local_capability.action.failed"
+    },
+    "input": {
+      "path": "README.md",
+      "patch": {
+        "format": "unified_diff",
+        "content": "--- a/README.md\n+++ b/README.md\n@@\n-old\n+new\n"
+      }
+    }
+  }
+}

package/fixtures/conformance/invalid/local-action-shell-missing-approval.json

@@ -0,0 +1,56 @@
+{
+  "id": "message-local-action-shell-missing-approval",
+  "type": "local.action.request",
+  "version": "hcp.v0",
+  "sent_at": "2026-01-01T00:00:00.000Z",
+  "payload": {
+    "request_id": "local-action-shell-bad",
+    "action": "local.shell.exec",
+    "issued_at": "2026-01-01T00:00:01.000Z",
+    "attribution": {
+      "session_id": "session-1",
+      "turn_id": "turn-1",
+      "workspace_id": "workspace-1",
+      "provider_instance_id": "provider-1",
+      "run_id": "run-1"
+    },
+    "lease": {
+      "lease_id": "local-lease-shell",
+      "capability_id": "shell",
+      "scope": "workspace",
+      "run_id": "run-1",
+      "hcp_session_id": "session-1",
+      "execution_host_id": "host-1",
+      "provider_instance_id": "provider-1",
+      "workspace_id": "workspace-1"
+    },
+    "sandbox": {
+      "mode": "workspace_write",
+      "workspace_root": "/tmp/workspace",
+      "cwd": "/tmp/workspace",
+      "requires_workspace_containment": true
+    },
+    "approval": {
+      "status": "not_required"
+    },
+    "output_limits": {
+      "stdout_bytes": 65536,
+      "stderr_bytes": 65536
+    },
+    "cancellation": {
+      "cancellable": true,
+      "timeout_ms": 60000
+    },
+    "audit": {
+      "started_event_type": "local_capability.action.started",
+      "completed_event_type": "local_capability.action.completed",
+      "failed_event_type": "local_capability.action.failed"
+    },
+    "input": {
+      "executable": "npm",
+      "argv": ["test"],
+      "cwd": "/tmp/workspace",
+      "use_shell": false
+    }
+  }
+}

package/fixtures/conformance/invalid/mcp-stdio-attachment.json

@@ -0,0 +1,27 @@
+{
+  "id": "message-mcp-stdio-attachment",
+  "type": "harness.session.start",
+  "version": "hcp.v0",
+  "sent_at": "2026-01-01T00:00:00.000Z",
+  "payload": {
+    "session_id": "session-1",
+    "workspace_id": "workspace-1",
+    "provider_instance_id": "provider-1",
+    "driver_kind": "codex",
+    "cwd": "/tmp/workspace",
+    "sandbox_mode": "workspace_write",
+    "approval_policy": "ask",
+    "continue_session": false,
+    "model_selection": {
+      "model": "gpt-5.3-codex"
+    },
+    "mcp_servers": [
+      {
+        "name": "bad",
+        "transport": "stdio",
+        "command": "node",
+        "args": ["server.js"]
+      }
+    ]
+  }
+}

package/fixtures/conformance/invalid/session-snapshot-unsafe-omission.json

@@ -0,0 +1,26 @@
+{
+  "id": "message-session-snapshot-partial",
+  "type": "harness.session.snapshot",
+  "version": "hcp.v0",
+  "sent_at": "2026-01-01T00:00:01.000Z",
+  "payload": {
+    "command_id": "message-session-snapshot-request",
+    "session_id": "session-1",
+    "generated_at": "2026-01-01T00:00:01.000Z",
+    "completeness": "partial",
+    "omission_semantics": "replace",
+    "reason": "retention_gap",
+    "from_sequence": 2,
+    "through_sequence": 2,
+    "events": [
+      {
+        "session_id": "session-1",
+        "sequence": 2,
+        "event_type": "session.state.changed",
+        "created_at": "2026-01-01T00:00:00.500Z",
+        "data": { "state": "running" }
+      }
+    ],
+    "tombstones": []
+  }
+}

package/fixtures/conformance/invalid/terminal-turn-missing-final-output.json

@@ -0,0 +1,16 @@
+{
+  "id": "message-terminal-turn-missing-final-output",
+  "type": "harness.event",
+  "version": "hcp.v0",
+  "sent_at": "2026-01-01T00:00:00.000Z",
+  "payload": {
+    "session_id": "session-1",
+    "turn_id": "turn-1",
+    "sequence": 1,
+    "event_type": "turn.completed",
+    "created_at": "2026-01-01T00:00:01.000Z",
+    "data": {
+      "status": "accepted"
+    }
+  }
+}

package/fixtures/conformance/invalid/unknown-payload-field.json

@@ -0,0 +1,14 @@
+{
+  "id": "message-unknown-payload-field",
+  "type": "host.hello",
+  "version": "hcp.v0",
+  "sent_at": "2026-01-01T00:00:00.000Z",
+  "payload": {
+    "runner_id": "runner-local",
+    "host_id": "host-local",
+    "runner_version": "0.0.0",
+    "supported_protocol_versions": ["hcp.v0"],
+    "capabilities": [],
+    "unexpected": true
+  }
+}