@qvac/harness 1.0.0-rc.0 → 1.0.0-rc.2

package/CHANGELOG.md

@@ -8,6 +8,1169 @@ While the major version is `0`, a breaking change bumps the minor version.
 
 ## [Unreleased]
 
+### Added
+
+- `slots` (and `llm.slots` through `spawnHarness`) lets one loaded chat model
+  decode that many completions at once, each with its own context: on the
+  2B, four requests at `slots: 4` decode about 30% more tokens a second in all
+  and each starts in about 0.2 s instead of queueing. At `parallel` 2 or more,
+  `@qvac/llm-llamacpp` 0.53 to 0.56 re-sends every reply as one last chunk,
+  doubling the text and the tool calls; the harness drops that repeat in the
+  stream and in the SDK's final result. (#316)
+
+- A spawned harness takes plugin options. `spawnHarness` and `harnessChild`
+  accept `pluginOptions: { speech?, mcp?: { servers? } }`, sent to the sidecar
+  as JSON in one argv slot. The sidecar builds `Speech` with
+  `pluginOptions.speech` (`tts: 'moss'`, `voice`, `dialogue`) and `McpPlugin`
+  with `pluginOptions.mcp.servers` (each may set `defer`), so a host that
+  spawns the harness reaches MOSS and deferred MCP tools. (#322)
+
+- `Parakeet-TDT-1.1B-Q8_0` is a curated transcription model: it lists in
+  `/models` and `transcribe({ model: 'Parakeet-TDT-1.1B-Q8_0' })` loads it. It
+  transcribes English only, lowercase and without punctuation, so
+  `Parakeet-TDT-0.6B-v3-Q8_0` stays the default on every profile. It runs
+  without Core ML: SDK 0.21 does not fetch its encoder bundle yet.
+  `infraModelsFor` still keeps only the default transcription model.
+- The `base` music choice runs the undistilled ACE-Step 1.5 base DiT (Q4_K_M)
+  on the shared text encoder, LM and VAE, at 50 steps by default. It needs a
+  GPU. Pick it with `modelChoice: 'base'` in the `generate_music` tool-config.
+  (#315)
+- A loaded model reports the engine's own fit probe. `LoadedModel.fit`, in
+  `diagnostics().models` and `model-event.loaded`, carries the probe's verdict
+  (`fit`, `does-not-fit` or `unknown`), its reason, the plan (`nCtx`,
+  `nGpuLayers`, `nGpuDevices`) and the projected `deviceBytes` and `hostBytes`.
+  The pool reads it with `getLoadedModelInfo` after each load; it is report
+  only, and a failed read never fails the load. The harness now writes
+  `fitStubBudgetMs: 10000` into `qvac.config.json`, so an offline registry
+  falls back to the calibrated estimate in 10 s instead of the SDK's 40 s.
+  (#314)
+- Deferred tools. A `ToolDefinition` with `defer: true` (and an optional `group`)
+  is listed by name in the SDK's `tool_search` instead of sending its schema;
+  the model loads it with `tool_search`, whose result appends to the history,
+  so the tool block and the prompt prefix stay fixed. A call to a tool not
+  loaded yet is refused with a reply to search first, and a re-ask after a load
+  is not forced. `McpServerConfig.defer` defers a server's tools under its name.
+  A tool named `tool_search` is refused while anything defers. (#311)
+- MOSS text-to-speech, opt-in with `new Speech({ tts: 'moss' })`. It streams,
+  clones a voice from `voice` (a 24 kHz wav), or speaks a dialogue of up to five
+  `speakers` on a local MOSS-TTSD backbone; a dialogue does not stream. No device
+  profile picks MOSS. Its load evicts the idle chat model first, and a chat load
+  frees an idle MOSS. Downloading `MOSS-TTS-8B-F16` fetches its codec decoder
+  too. `SpeakResult.sampleRate` is the rate the SDK reports.
+  `SpeechService.defaultModel(profile)` names the model an unnamed `speak` loads.
+  (#312)
+
+- An agent may run on its own model. `AgentConfig.model` (and `model` on the
+  wire's agent knobs) names it; absent, the agent runs on the request's
+  `model`. It applies to a single run, to every hop of a chain including the
+  entry agent, and to `delegate` children through `base.agent`, so triage on
+  one model can hand a health question to an agent on `MEDPSY_1_7B`. A resume
+  still matches on the `model` the host first sent.
+
+- An external agent target can run on the user's own login. `login: 'user'`
+  on an `ExternalAgents` target keeps the user's `HOME`, sets no
+  `CODEX_HOME` or `CLAUDE_CONFIG_DIR`, and runs `claude` without `--bare`, so
+  a CLI the user signed in to works with no API key. It then runs with the
+  user's own settings and plugins, and bills their subscription.
+  `claude` also gets `--setting-sources user --strict-mcp-config`, so the
+  workdir's own settings and MCP config never load. The default,
+  `'isolated'`, is unchanged. `DelegateTarget.policyVersion` folds into the
+  `delegate` tool's, so changing a target's login refuses a resume; every
+  existing `delegate` `policyVersion` changes once with this, so a durable run
+  with external targets saved before the upgrade refuses to resume.
+
+- `CodingPlugin` runs on macOS. `SeatbeltSandbox` provides the `sandbox`
+  service: each line runs under `sandbox-exec` with the project as its write
+  root and a `TMPDIR` that lasts until the workspace closes. It is not
+  isolated, so every coding call asks. `shell_jobs` stops a job from the host:
+  SIGTERM to its group, then SIGKILL, and a job runs as long as what its line
+  started. The coding state moves under the provider's `TMPDIR`.
+- **Breaking:** `SandboxWorkspace` gains `start(command, { cwd? })`, a
+  background line the provider holds, returning `{ exited, stop() }`. A
+  custom `SandboxService` must implement it. `SeatbeltSandbox` now declares
+  `provides: ['sandbox']`, so composing it beside another sandbox provider
+  fails at construction; leave one out.
+
+- MCP servers as a plugin. `./plugins/mcp` exports `McpPlugin`, named `mcp`.
+  `servers: [{ name, url, auth? }]` lists each server's tools when the harness
+  opens and adds them as `<server>__<tool>` tools with the server's schema;
+  each asks for approval. A server that fails or does not answer within
+  `setupTimeoutMs` (10 s) adds no tools, and the harness still opens.
+  `auth: { tokenCredentialKey }` sends that credential to that server only.
+  `generic: true` adds `mcp_call` and the skill catalog's mcp operations.
+  `PluginContext.fetch` is a guarded fetch for a plugin's setup, and
+  `Tools.operations(catalog, transports)` compiles a catalog's operations over
+  the transport tools given. (#277)
+
+- `@qvac/harness/tools` exports `Tools`. `Tools.product(options)` returns the
+  product tool list the sidecar serves, in the same order, with the fs tools
+  fenced off the storage root it derives from `options.sdkHome`; it throws
+  without one. The options also take `skillsDir`, `skillCatalog` and
+  `credentialStore`. Operation tools and
+  credentials need `skillCatalog`, and `skill` needs `skillsDir`.
+  `Tools.deniedRoots(sdkHome)` is the deny list. (#273)
+- `PluginContext.deniedRoots` hands every plugin setup the folders the host
+  fences: the storage root and spill dir a harness derives from `sdkHome`, or
+  `PluginRegistryOptions.deniedRoots` for a registry built directly; frozen,
+  canonical at setup like `ExecutionContext.deniedRoots`, so a symlinked
+  storage root matches the real path a plugin resolves, and empty when none is
+  known. (#296, #299)
+
+- `Tools.bundledSkillsDir()` from `@qvac/harness/tools` writes the bundled
+  skills to a private dir named by their content hash, and returns its path,
+  for an in-process host such as the mobile worklet. `@qvac/harness/skill-manifest`
+  exports `credentialSlots(entry)`, which unions an entry's `credentials` and
+  `requires.credentials` into any-of slots (`a|b`). (#283)
+
+- Claude Code hook files. `./plugins/command-hooks` exports `CommandHooks`,
+  a plugin whose config is the `hooks` object of a `settings.json`. Each
+  `type: "command"` hook runs under `/bin/sh -c` on its harness phase
+  (`PreToolUse`, `PostToolUse`, `PostToolUseFailure`, `UserPromptSubmit`,
+  `Stop`, `PreCompact`, `SubagentStart`, `SubagentStop`), reads the event as
+  JSON on stdin, and answers by exit code (2 blocks) or stdout JSON
+  (`permissionDecision`, `updatedInput`, `additionalContext`,
+  `decision: block`, `continue: false`). The default timeout is 60 s, and a
+  timeout kills the command's process group. Other exit codes fail closed.
+  `SessionStart`, `SessionEnd`, `Notification` and `PermissionRequest`
+  entries load but never run. A `PreToolUse`, `PostToolUse` or
+  `PostToolUseFailure` matcher that is not a valid regex fails `validate()`.
+  A config with a `Stop` command also registers `command-hooks:Stop:end` on
+  `runEnd`; when no other `runEnd` hook is loaded, this adds a `hook:runEnd`
+  step to the run log of each run that started. (#261)
+
+- Hooks reach further on the same fold. `HarnessHook.matcher` scopes a tool
+  hook to tool names (full-match regex) and `timeoutMs` bounds a hook (no
+  default). New phases: `promptSubmit` (the prompt and each mid-run input; a
+  rejected input emits `input-rejected` and the run goes on), `toolFailure`
+  (every call that did not succeed), `stop` (`{ continue }` takes one more
+  round within the round limit) and `preFold` (`{ instructions }` for the
+  summary). New results: `{ permission: 'allow' | 'deny' | 'ask' }` on
+  `preToolCall` (a plugin's `allow` is dropped, and no `allow` gets past plan
+  mode or the outbound guard), `{ context }` for the model, and `{ halt }`,
+  which ends the run as a `HookHalt` failure (on a mid-run input it rejects
+  the input instead). Each new phase is journaled, so a
+  resume replays the decision. (#260)
+
+- macOS sandbox. `./plugins/sandbox-macos` exports `SeatbeltSandbox`
+  (`{ preset: 'read-only' | 'workspace-write', network }`). Its `.shell` runs
+  exec's shell under `sandbox-exec`, writing only to the run's local write
+  roots and a temp dir. Its `.plugin` checks the platform and the profile at
+  start, and provides no `sandbox` service yet. Exec passes the write roots to
+  a composed shell as `ExecutionContext.writeRoots`, and `createShellAdapter`
+  takes a `name`. Linux and Windows follow. (#254)
+- Approval quote. `ToolDefinition.quote(args, ctx)` returns the confirmation a
+  person reads before an approvable call runs, such as its cost, or null for
+  none, and `ApproveFn` receives it as `quote`. Over the wire, `approval-ask`
+  carries it in its existing `question` field, and `connectHarness` hands it
+  back as `quote`; no schema field is added. For qvac-core: no API break. (#183)
+- Plugins pack as their own packages. `image`, `knowledge`, `music`,
+  `obsidian`, `sandbox-vm`, `speech` and `weather` each have a
+  `qvac-plugin-<name>` manifest in `plugins/<name>/`, and
+  `prepare-publish --plugin <name>` points it at its `dist-lib/`, rewrites
+  its imports of the core to `@qvac/harness/...` and sets its `@qvac/harness`
+  peer to `^<root version>`.
+  Nothing is published yet. The root `exports` map gains the 11 keys the
+  plugins import: `./lib/contract/index.ts`, `./lib/contract/knowledge.ts`,
+  `./lib/contract/models.ts`, `./lib/contract/speech.ts`, `./lib/guards.ts`,
+  `./lib/helpers/load-stall.ts`, `./lib/helpers/retry-memo.ts`,
+  `./lib/helpers/spawn-path.ts`, `./lib/log.ts`, `./lib/models/context.ts` and
+  `./lib/models/model-source.ts`. They are internals for the plugins, not a
+  stable API, and can change in a minor release. (#187)
+- A run with `agents` takes `CompletionContext.input`. `Agent.follow` gives each
+  hop its own queue, so a steer or follow-up reaches the running hop, and input a
+  hop leaves unacked at a transfer goes to the next hop first. (#247)
+- `@qvac/harness/addon-externals` exports `scripts/addon-externals.cjs` and its
+  types, so a host seeds `copyAddonExternals` with `deferredAddonPackages(bundle)`
+  instead of keeping its own copy of the script. (#228)
+- `QuickJs` from `./plugins/quickjs` runs `language: "javascript"` in QuickJS
+  WASM as an exec language: compose `quickjs.language` into
+  `createExecTool({ languages })` and pass `quickjs.plugin`. A run has no files,
+  network, modules or tools, only `console`, so it is a read. Each call gets a
+  fresh runtime with memory and stack limits, and its deadline is the smallest
+  of `timeoutMs`, the run budget and 30 s. It runs on the harness thread and is
+  desktop-only until mobile is verified. Code mode runs on `QuickJs.run` beside
+  it. (#232)
+- The harness folds a chat when its window runs short (what `@qvac/core` called
+  compaction). `lib/fold/` holds the trigger tiers on `cacheTokens / ctxSize`,
+  the 4,096 floor, the summary turn and the summarizer prompt. A run folds
+  before its first round when the last reading for its `cacheKey` is past its
+  tier, and on an overflow of the whole history before the ladder drops turns,
+  then retries the round. After text was shown, an overflow still folds and
+  deletes the key, and the run fails as before. The fold keeps the last user
+  turn and this run's own rounds, deletes the chat key once, records the
+  summarizer request in the run log, and emits `fold` `{ phase: 'start' }` and
+  `{ phase: 'done', summary, throughId, foldedTurns }`. `ChatMessage.id` (and
+  `id` on the wire message) is a new optional opaque field: `throughId` is the
+  id of the last folded message, and a history without it does not fold. For
+  qvac-core: send each message's last chunk id, store the fold from the `done`
+  event, and turn its own fold off in the same release; the decision record
+  lists what core deletes and keeps. (#241)
+- `@qvac/harness/plugins/coding`: `CodingPlugin` adds `shell`, `shell_jobs` and
+  `write_file` in a new `coding` toolset, run in a sandbox provider. `shell` keeps
+  the cwd and exported variables between calls of a run, allows pipes and
+  redirects, waits 300 s by default (1800 s at most, cut to the run budget) and
+  starts background jobs that `shell_jobs` lists, reads from an offset and stops;
+  a run's jobs stop when it ends. `write_file` creates or overwrites a file in the
+  run's single write root. The plugin needs the new `sandbox` service
+  (`SandboxService` in `lib/contract/sandbox.ts`, exported as
+  `./lib/contract/sandbox.ts`); no provider ships yet. A tool is a read only on an
+  isolated provider under the host's `read: CodingPlugin.TOOLS` grant and outside
+  plan mode, which refuses it. qvac-core: opt in by passing a provider and the
+  plugin, grant one writable directory, pass `maxToolRounds`, and label the
+  `coding` toolset. A harness given `sdkHome` makes `shell` and `write_file`
+  refuse a workspace that holds the storage root or sits inside it, since the
+  provider mounts the whole workspace; `deniedRoots` adds folders to that
+  list. (#179, #279, #296)
+- Code mode: `new CodeMode({ quickjs })` from `./plugins/code-mode` adds
+  `run_code`, a script that calls the run's other tools as
+  `await tools.<name>(args)`. Compose it as `{ plugin, read: ['run_code'] }`
+  beside `quickjs.plugin`. Each inner call takes the same hooks, policy checks,
+  plan-mode refusal and approval as a direct call, one at a time, at most 16 per
+  script. `QuickJs.run` is the runtime under it. New `ToolDefinition.callsTools`
+  and `minCapabilityProfile`; `run_code` is offered from `mid` models only. For
+  qvac-core: no API break; an inner approval carries the call id `<outer>.<n>`.
+  (#237)
+- `CompletionContext.goal` keeps a run going across answers until the goal is
+  met: `{ objective, rounds?, ms?, tokens? }`. A goal is met when every step of
+  the run's plan is done, and a goal run is always offered `update_plan`. While
+  it is unmet, the run adds a goal turn after each answer and continues: the
+  goal nudge (`wording.goalContinuation`), the objective and the open plan.
+  Queued input still comes first. The run stops when its round budget
+  (`rounds`, 40 by default), its deadline (`ms`) or its generated tokens
+  (`tokens`, checked when an answer ends) run out. Each continuation and the
+  end emit a `goal` event `{ status, turn, round, text? }`, with `status` one of
+  `open`, `met`, `rounds`, `time` or `tokens`; `text` is the turn the run
+  added. A resume keeps the run's own goal. A run seeds its plan from the last
+  `update_plan` call in `messages`, unless that plan was finished. Single runs
+  only: a run with `agents` drops the goal, and a goal with a `responseFormat`
+  is refused, since a structured answer has no `update_plan`. The goal crosses the wire in the
+  start payload, and the event as `goal`. For qvac-core: no API break; a goal
+  run has several answers, which a host splits on `goal` events, and it stores
+  each goal turn from the event's `text` so that the next request replays it.
+  (#240)
+- `update_plan` keeps a plan in the run: a list of up to 12 steps, each
+  `pending`, `in_progress` or `done`, that the model replaces on each call. The
+  run keeps the plan in its machine context, so a pause, resume or replay
+  keeps it. The plan is shown to the model on the continuation nudge while a
+  step is open, and is never put in the system prompt. Turn it on with the
+  agent knob `plan`, which is off by default. `CompletionContext.planMode`
+  starts a run in plan mode. Plan mode refuses every write except
+  `update_plan` with `submit: true`, which goes to the approver with the
+  numbered steps as its `quote`. Once the submit is approved, or auto-approved
+  under `skip-all`, writes run. With no approver, the run stays plan-only.
+  Outside plan mode a submit is an ordinary update and asks no one.
+  `planMode` crosses the wire in the start payload, and `plan` crosses it in
+  the agent frame. For qvac-core: no API break. The continuation nudge in a
+  captured inference call can now end in a `Plan:` block. (#234)
+- Oversized host shell output spills to a run-scoped file the model reads back.
+  When a run has `read_files`, an exec stream over `maxOutputChars` is written
+  whole to `<tmp>/qvac-harness-spill-<user>/<runId>/`, and its marker carries a
+  locator: `…[N chars omitted; read_files path=<abs> startLine=<n>]…`. The
+  directory is removed when the run ends, except after a durable pause, and a
+  boot sweep reclaims what a crash left. For qvac-core: no API break, but stored
+  exec `stdout` and `stderr` can now carry the locator, and `deniedRootsFor`
+  returns two roots, the storage root and the spill root. With no `read_files`
+  the marker is unchanged. (#238)
+- `CompletionContext.input` sends turns to a running run. A `steer` is
+  delivered at the next tool boundary, in place of the continuation nudge; a
+  `follow-up` continues the same run after its answer, under the run's round
+  budget and deadline. Each delivery emits an `input` event with the input's
+  `id`, `text` and the `round` it precedes; input with no such event was not
+  delivered. Over the wire it travels as `steer` and `follow-up` frames and an
+  `input` event. Text only, and for single runs: a run with `agents` ignores it. (#186)
+- `RunLog.watch()` follows a run live from the steps the host commits. Feed it
+  with `watch.step(step)` after an in-process `onStep` commit, or wrap a
+  spawned run's `HostRunLog` with `watch.host(runLog)`. `views()` streams one
+  view per record: the state, the transition trace with its guards, the
+  approval, `pendingCall`, `currentCall`, `toolQueue`, `outcome` and the
+  inspector's lines. `html()` streams the inspector page, with the current
+  state highlighted and no script. A bad step becomes an error view and never
+  fails the run. `step()` follows a single run, so an in-process host makes a
+  new watcher per run. Through `host()` one watcher follows runs one after
+  another, such as a handoff's hops; concurrent runs need one watcher each.
+  `RunLog.renderHtml` now tags each graph node with `data-state`.
+  `examples/run-log/live.ts` replaces `examples/run-log/tail.ts`. (#236)
+- **Breaking:** the run log records every model request. Before each send,
+  the engine appends a `request` record (`round`, `attempt`, `droppedTurns`,
+  `keep`, `messages`, `tools`, `params`) and waits for the host to take it, so
+  the log holds every request the model saw, overflow steps and grammar or
+  forced-call retries included. A record carries the messages the previous
+  request did not (`keep` counts the ones it shares), messages identical to the
+  run request's point at them by index, and the tool block is written once per
+  process under its sha256 `ref`. The messages are redacted as the
+  checkpoint history is; the tool block and generation params are kept as
+  sent. `RunLog.requests(core)` rebuilds each request, byte for byte where
+  redaction changed nothing, with its `index`, `round`, `attempt` and
+  `droppedTurns`, and `RunLog.inspect` and
+  `renderHtml` list them; `requestRecord` (`--request` in
+  `examples/run-log/inspect.ts`) prints one in full. `EngineOperationPort`
+  gains `recordRequest`. For qvac-core: a host run-log codec that allows only
+  known record types must accept `request` before it moves to this version;
+  `RUN_LOG_VERSION` stays 1. (#235)
+- `ToolDefinition.concurrent` lets a read tool run alongside the round's other
+  opted-in reads. Up to four that need no approval run together; a write, a
+  call that needs approval and any tool that does not opt in run alone. Results
+  land and events go out in the model's order, each event with its own
+  `callId`. `read_files`, `grep` and `file_glob` opt in. (#193)
+- A completion follows an agent's handoffs. `CompletionContext.agents`, in
+  `index.ts` and `./lib/contract-types.ts`, holds the agents `agent` may hand
+  to, by id. When a run ends with `transfer_to_agent`, the completion emits a
+  `transfer` event (`from`, `to`, `reason`, the new `TransferEvent`) and goes on
+  as the next agent's run, with the reason noted on the last user turn. Each
+  hop is a run of its own: hop k runs as `<runId>/<k>-<agent>` with cache key
+  `<cacheKey>/a-<agent>`. After three transfers the last agent must answer.
+  Every event in a chained run carries `agent`. Over the wire, `agent-knobs`
+  carries `handoffs` (a new `agent-handoff` struct), and the client runs each
+  hop as its own wire completion with its own `HostRunLog` lease. In process,
+  `agents` with `boot` or `onStep` throws. The loop is `Agent.follow`. For
+  qvac-core: pass `agents` to `harness.completion()` to hand a run on, and
+  resume a hop with its own `runId`. (#233)
+- `LspPlugin` from `./plugins/lsp` gives a run one read tool, `lsp`, over
+  the language servers a host configures: `definition`, `references`,
+  `hover`, `symbols` (a file's outline, or a project search with `query`)
+  and `diagnostics`. A position is a 1-based `line` and the `symbol` on it.
+  Paths are scoped like the file tools: a harness given `sdkHome` fences the
+  storage root (#296) and the config's `deniedRoots` adds to it;
+  locations and hover text from a denied root are not shown. The server
+  starts through `/bin/sh`, so a bad command is an error and never a failed
+  spawn. One server runs per language and granted root, is shared, stops after
+  `idleMs` and on close, and restarts after a crash. Add
+  `{ plugin: new LspPlugin(), config: { servers }, read: ['lsp'] }` to
+  `HarnessOptions.plugins`, with absolute commands; TypeScript 7's
+  `tsc --lsp --stdio` is the tested server. Nothing wires it yet (#179).
+  (#202)
+- `HarnessOptions.llmLoad` (and `llm.llmLoad` for a spawned harness) passes
+  llama.cpp load knobs to every completion load: `threads`, `batch-size`,
+  `ubatch-size`, `kv-offload` (`false` only) and `n-cpu-moe`. Each one keys
+  the model pool. Unset, the SDK defaults apply; the harness sets none until
+  they are measured (#184). (#194)
+- Plugin services share one context per harness. A plugin reads the services
+  it names in `needs` or `provides` through `ctx.services`; the core keeps the
+  context private. The framework lives in `lib/plugins/`, with concrete
+  implementations in `plugins/`. `@qvac/harness/plugins` exports the framework,
+  `PluginRegistry`, with `PluginRegistry.API_VERSION` and
+  `PluginRegistry.loadAddons` as statics; augment `Services` through
+  `@qvac/harness/plugins/context`. Plugins can register cleanup immediately
+  with `ctx.onDispose`, including during partial setup that later fails. Startup rolls back before rejecting, and close waits
+  for active setup while skipping later plugins. The context stays local to
+  the process and survives runs and suspend/resume. (#171) `./plugins` does
+  not export the contract types: import `AddonLoaders` from the root or
+  `./lib/contract/index.ts`, and `ExecLanguage`, `ExecRoute` and `ExecShell`
+  from the root or `./lib/contract/exec.ts`. (#284)
+
+- Knowledge is a plugin: `knowledgePlugin` from `./plugins/knowledge` keeps
+  one TurboVec index for the harness, fed by the host through
+  `knowledgeUpsert`, `knowledgeRemove`, `knowledgeSearch` and
+  `knowledgeStatus` (also over hrpc). An artifact whose vectors name the
+  local embedder is indexed with no re-embedding; any other is re-embedded
+  and its vectors handed back. `CompletionContext.knowledge = { scopes }`
+  grants a run its scopes: the hits are injected into the last user turn
+  before the first round, and with `tool: true` the plugin adds
+  `knowledge_search`. Absent, a run retrieves nothing. A hit scoring under
+  `minScore` (cosine, default 0.4) is dropped, so a run with no related
+  knowledge injects nothing and keeps its cache key. The core lends plugins
+  a second service, `embed`. `spawnHarness({ knowledge: { dir, model } })`
+  adds the plugin to the bundled sidecar. (#197)
+- `createExecTool({ shell })` takes an `ExecShell`, where shell lines run
+  after every exec check; the default is the host shell (`name: 'host'`). The
+  shell name folds into exec's `policyVersion`. `VmShell` from
+  `./plugins/sandbox-vm` runs the shell in a barevisor VM with no network, no
+  disk and no mounts, from a prebuilt guest image the host ships: pass `shell`
+  to `createExecTool` and `plugin` in `HarnessOptions.plugins`. It is opt-in,
+  nothing wires it, and it is not a sandbox for untrusted code. **Upgrade:**
+  `bare-process` moves to 4.5.1 (barevisor needs it), which adds the native
+  addon `bare-posix`; a host that pins `bare-process` or audits its addons
+  follows. Exec's `policyVersion` changes once, so a run paused before the
+  upgrade does not resume. (#178)
+- Python is a plugin. `createPython({ loadPyodide, network })` from
+  `./plugins/python` returns `{ language, plugin }`: pass `language` to
+  `createExecTool({ languages })` and `plugin` in `HarnessOptions.plugins`,
+  whose teardown closes the python worker. The entry also exports
+  `stageInputs`, `runPython` and `closePythonWorker`. (#174)
+- Plugins: `HarnessOptions.plugins` takes `{ plugin, config, read }` entries. A
+  `HarnessPlugin` declares its `name`, `api` (`PLUGIN_API_VERSION`), the
+  services it `provides` and `needs`, an optional `validate(config)`, and a
+  `setup(ctx, config)` that returns tools, hooks, services and a `teardown`.
+  The list is checked when the `Harness` is constructed; plugins start on open
+  in dependency order and are torn down in reverse on close. A plugin tool is a
+  write unless the host lists it in `read`, it keeps `autoApprove` only then, its
+  toolset must be one of `TOOLSETS` and its name may not repeat another tool on
+  the harness, `transfer_to_agent` included. A granted tool with
+  `autoApprove: true` runs unasked whatever its classifier says, so grant
+  `read` only to a tool you would let run unasked. A plugin's `preToolCall`
+  hooks run before the harness's hooks, so the gates check its arg rewrites; its other
+  hooks run after them. `tools()` now waits for `ready()`, as `describe()`
+  does, and `toolNames` and `diagnostics()` list plugin tools only after it,
+  which a `spawnHarness` host never sees. With no plugins nothing changes. (#171)
+- A tool declares that it reaches the network with `egress(args)`, which
+  returns the URL a call targets, or `null` when that is not known before the
+  call. `HookPipeline.EgressGuardHook` now checks every tool that declares it,
+  whatever its name, and no tool that does not: `http_request`, `web_fetch` and
+  `mcp_call` declare it. A host tool named `http_request` built by hand must
+  declare `egress` to keep the pre-call check. A plugin tool that declares
+  `egress` gets `ctx.fetch`, a guarded fetch that reaches only the host its
+  call's `egress` returned (none when that is `null`), refuses private hosts on
+  every hop, stops with the call and refuses everything in sandbox mode. (#172,
+  #224)
+- A run sets its tool-round limit with `maxToolRounds` (an integer of 1 or
+  more, default 10), in process and on the wire. In process it also sets the
+  model-facing text with `wording: { toolContinuation, toolDenied, toolCutOff }`:
+  the nudge after a tool round, the result a declined call returns and the
+  result of a call refused because the response hit the length limit. A resume
+  keeps the values the run started with. An invalid `maxToolRounds` throws, in
+  process and from `connectHarness` before the frame is sent; 0 on the wire
+  means unset. (#159)
+- The `metrics` event reports speed per round and per run: `rounds[]` with
+  each round's tokens, prefill and decode rates, time to first token, wall
+  time and stop reason; `tools[]` with each tool's wall time; and `modelMs`
+  and `toolMs`, the wall time spent in rounds and in tools. An in-process run
+  without `onStep` that is stopped by its `signal` now sends `metrics` for the
+  rounds it finished; a durable run or one over the wire sends none. The
+  README's "Speed stats" section describes each field. (#195)
+- A host can replay an earlier turn's tool work: an assistant message may carry
+  `toolCalls: { id, name, arguments }[]`, and a `tool` message `toolCallId` and
+  `name`, with the result as JSON in `content`. A round's calls go in one
+  assistant turn, grouped by the events' `round`, then one `tool` message per
+  call. The harness renders them as the run that made the calls sent them, so a
+  follow-up question is answered from the earlier result and the KV cache's
+  message count still lines up. A replayed `skill` result becomes the reload
+  stub; a replayed preload goes back into its user turn, and a replayed direct
+  web search gets no nudge. In process and on the wire. It is opt-in: a host
+  that sends plain turns and the `skillLoadedTurn` stub, as qvac-core does,
+  works as before. **Upgrade:** switching rewrites history before the tail,
+  which a warm cache ignores and mis-slices, so delete each chat's KV cache
+  when it switches, as after a fold; that chat's next turn cold-primes once.
+  (#169)
+- `CompletionEngine` takes an optional `outbound` guard
+  (`new CompletionEngine(sdk, { outbound })` or
+  `CompletionEngine.run(sdk, args, { outbound })`), defaulting to the built-in
+  one. (#166)
+- `list()` rows for curated chat models that are not loaded carry `fit`,
+  `fitBasis` and `fitEvidence`, from one batched SDK `assessModelFit` ask that
+  is kept until a model loads or unloads, or the harness resumes. The
+  `model-info` wire fields are new and optional. qvac-core can show "fits" for
+  `likely-fits`, "too large" for `likely-too-large` and nothing for `unknown`,
+  and suggest the largest `likely-fits` row; none of them blocks a download. (#196)
+- A curated chat model with no context set by the agent or `contextSize` steps
+  down from today's tier to 32768, 16384 or 8192 on its first load when the
+  SDK says the tier would not fit and confirms a lower one from calibration or
+  the engine's fitter. The choice is kept for the process, and the load, the
+  run's budget and the fit ask read it from one function. A cold run's
+  `metrics.ctxSize` is the context the model loaded with. A manual `loadModel`
+  steps down the same way and refuses only when no rung is confirmed. (#196)
+- The load decision for a curated chat model passes its registry coordinates,
+  so the SDK runs the engine's own fitter (`native-fit`) once per load. Pin
+  re-checks and list rows stay on the cheap calibrated estimate. (#196)
+- An embedding load that the SDK says would not fit unloads idle chat models
+  that are not pinned and that no reply is using. (#196)
+
+- Ternary Bonsai 2 27B joins the curated catalog in two builds,
+  `Ternary-Bonsai-2-27B-PQ2_0` (7.2 GB) and `Ternary-Bonsai-2-27B-PTQ1_0`
+  (5.9 GB), each with its vision projection. Both sit in the `high` tier, by
+  their memory footprint rather than their parameter count. As a Qwen3.8-27B
+  fine-tune whose name the SDK's dialect router does not recognise, it parses
+  tool calls as `qwen35`; a catalog entry can now name its tool dialect.
+
+### Changed
+
+- **Breaking:** `@qvac/harness/plugins/speech` exports `Speech` and the types
+  it takes (`SpeechOptions`, `SpeechDialogue`, `SpeechSpeaker`, `TtsEngine`)
+  and nothing else. `buildWavBuffer`, `packSamples`, `speakOnce`,
+  `speakStreamOnce`, `transcribeStreaming`, `normalizeForSpeech`,
+  `SPEECH_LEXICON`, `needsResample`, `resampleForTranscription`, `wavFormat` and
+  `TARGET_SAMPLE_RATE` are internal; qvac-core imports none of them. (#312,
+  #217)
+
+- **Breaking:** translation is a plugin. The translate runtime, the NMT
+  catalog and the `translation` and `translation-nmtcpp` addon loaders moved
+  from `lib/` to `plugins/translation/`, exported as
+  `@qvac/harness/plugins/translation` (`TranslationPlugin`, package
+  `qvac-plugin-translation`). A `Harness` built without it answers
+  `invoke({ capability: 'translate' })` with
+  `translate is not available on this device` and loads no NMT model or
+  binding. `translate` is still never
+  in `toolNames`, `tools()` or an agent's tool list: it comes from the new
+  `PluginSetup.capabilities`, tools that only `invoke` reaches, whose names
+  the registry checks like a tool's and which keep their own `effect`.
+  `ModelHost.completionModel(model, signal)` loads a GGUF through the chat
+  pool and returns `{ modelId, release }`; the core never leases a model
+  borrowed this way as the resident chat model, which retires the
+  `TranslatePsy-` name check from the core. The bundled sidecar passes the
+  plugin, so a `spawnHarness` host is unchanged. **Upgrade:** a host that
+  constructs `Harness` itself adds `new TranslationPlugin()` to `plugins`,
+  with `import { TranslationPlugin } from '@qvac/harness/plugins/translation'`.
+  The root exports `./lib/helpers/clean-answer.ts` and
+  `./lib/capabilities/detect-language.ts` for the packed plugin. (#275)
+- **Breaking:** the translation catalog is `TranslationPlugin` statics. The
+  root no longer exports them: `NMT_TO_ENGLISH`, `NMT_FROM_ENGLISH`,
+  `EURONANO_LANGUAGES`, `SLM_LANGUAGE_CODES` and `SLM_LANGUAGE_NAMES` are
+  `TranslationPlugin.NMT_TO_ENGLISH` and so on, `translationPlanFor(from, to)`
+  is `TranslationPlugin.planFor(from, to)`, and the `TranslationPlan` type
+  (with `TranslationRefusal`) comes from `@qvac/harness/plugins/translation`.
+  There are no deprecated aliases. (#275)
+- A translation pack no longer stays resident across chat turns:
+  `TranslationPlugin` frees it on the same idle sweeps as the image and music
+  models, when a chat turn ends and when a chat model loads, and never while
+  a translation is running or waiting. The next translation reloads it. (#275)
+- **Breaking:** `web_search` is a plugin. `Tools.product` no longer includes it;
+  `WebSearchPlugin` from `@qvac/harness/plugins/web-search` provides it, with
+  the same name, toolset, description and schema. Its options are `engines`
+  (a subset, in tie-break order; default all seven), `maxResults` (overrides
+  the 8 or 12 the context window picks) and `read`. `validate()` refuses an
+  unknown engine, an empty list and a `maxResults` that is not a positive
+  integer. The engines now fetch through the plugin `ctx.fetch`, so each
+  request is checked for a private address, and a redirect to a host the call
+  did not declare is refused: an engine that redirects to a consent or region
+  page fails for that call. `ToolDefinition.egress` may return a list of URLs;
+  the egress hook checks each one, and the plugin fetch admits the hosts they
+  name. The tool moves after `exec` in the prompt prefix, which changes cache
+  keys and bench comparability. `lib/web-search/html-helpers.ts` and
+  `user-agents.ts` move to `lib/helpers/`. **Upgrade:** qvac-core and the
+  mobile worklet add `new WebSearchPlugin({ read: ['web_search'] })` to
+  `plugins`, next to the `Tools.product` list; without the read grant every
+  search asks for approval. Hosts that use `spawnHarness` get it from the
+  sidecar. A run paused on a `web_search` call does not resume across the
+  upgrade. (#276)
+
+- **Breaking:** plugins are an array of instances, and the harness builds `exec`
+  from what they declare. `HarnessOptions.plugins` is `readonly HarnessPlugin[]`;
+  `PluginEntry` and `{ plugin, config, read }` are gone, and so are the `config`
+  arguments of `validate` and `setup`. A plugin's options go to its constructor
+  and the host's read grant is a constructor option carried as
+  `HarnessPlugin.read`. Every shipped plugin is a class: `Speech`, `Weather`,
+  `Image`, `Music` and `Knowledge` replace the object constants, `Python`
+  replaces `createPython()`, and `ObsidianRoute`, `VmShell`, `SeatbeltSandbox`,
+  `QuickJs` and `CodeMode` implement `HarnessPlugin` with no `.plugin` pair;
+  `SeatbeltSandbox.name` is now the plugin name `sandbox-macos`, and the
+  `seatbelt:<preset>:<network>` label is `.shell.name`.
+  `CommandHooks` takes the hooks object first, `new CommandHooks(hooks, { cwd })`;
+  `LspPlugin` and `ExternalAgents` take their options in the constructor.
+  `PluginSetup.exec` declares the languages, routes and shell a plugin adds;
+  with `HarnessOptions.exec` (`true` or
+  `{ spawn, killProcess, realpath, policyVersion }`) the harness builds the
+  `exec` tool from them, with its own `skillsDir` and skill settings, and
+  rebuilds it on every dynamic swap. Two
+  shells fail the start naming both; a host `exec` tool beside a contributing
+  plugin fails the start naming the plugin. `HarnessOptions.sdkHome` is the SDK
+  home, from which the harness derives the denied roots of the exec it builds.
+  `ExecLanguage`, `ExecRoute`, `ExecShell` and the exec adapter and runner types
+  live in `lib/contract/exec.ts` (export `./lib/contract/exec.ts`); the root
+  exports the three. The `./docx` export is gone; `./office` keeps its functions.
+  (#269) For qvac-core: `desktop/electron/assistant-sidecar.mjs` and the mobile
+  worklet pass instances, `new Weather({ read: ['weather_lookup'] })`,
+  `new Image({ model, clamps, read: ['generate_image'] })`; the sidecar drops
+  `createExecTool`, `createPython` and the obsidian route from `tools` and passes
+  `exec: true` with `sdkHome: sdkStorage.home`; `extractDocxText` callers move to
+  `@qvac/harness/office`; the three `@qvac/harness` pins move to 0.9.0, the release after 0.8.5. The
+  `./lib` keys stay this release; `./lib/tools/*` is gone (#273).
+
+- **Breaking:** `CompletionEvent` gains `input-rejected`, and `HookPhase` and
+  `HookRejection.phase` each gain `promptSubmit`, `toolFailure`, `stop` and
+  `preFold`; a host that switches on them exhaustively must handle the new
+  members. Every steer and follow-up now passes `promptSubmit` hooks. The hrpc
+  `completion-event-type` enum now has `input-rejected`: before, a harness
+  served over hrpc died when it emitted one. An older host decodes it with a
+  `null` type. (#260, #264)
+
+- **Breaking:** `PreToolCallPayload.effect` and `.resource` are now required,
+  so a pre-tool hook can single out writes and the resource a call touches. A
+  host that calls `HookPipeline#runPreToolFold` itself passes both; a hook that
+  only reads the payload is unaffected. The `hook:runPreToolFold` operation now
+  records both in its arguments, so a run paused after a pre-tool hook ran
+  before the upgrade does not resume (`Operation identity mismatch`). (#183)
+- `exec` refuses a `language` that no composed language claims, other than
+  `shell`, instead of running `command` as a shell line. `python` keeps its own
+  message. The language a call names reads it first, so Python's source
+  inference no longer takes a call named for another language. (#232)
+- Long tool output keeps its start and end. Exec, python, the sandbox VM and
+  obsidian keep the first and last `maxOutputChars` of each stream, joined by
+  a marker that counts the chars dropped (`…[N chars omitted]…`), so errors
+  and tracebacks at the end survive. The output no longer ends in
+  `… [truncated]`, and the marker counts against `maxOutputChars`; a host that
+  matched the old suffix follows. A result whose payload is over 65536 chars
+  is trimmed the same way when it is rendered for the model, each long string
+  field cut so the payload still parses; the `tool-result` event and the run
+  log keep the full result, and the `skill` tool is exempt. (#180)
+
+- **Breaking:** a plugin can own a skill's readiness. `PluginSetup.skills`
+  takes `SkillReadiness` entries: `skill`, `state(ctx)`, and optional
+  `probeVersions` and `deviceSharedKeys`. The registry collects them into
+  `StartedPlugins.skills`, and two plugins claiming one skill fail. `state()`
+  runs after the platform, stub and model gates and before the bin gate; a
+  state settles the skill, `null` defers. The obsidian readiness, the
+  version-probe exclusion, the device-shared `obsidian_vault_path` and the
+  vault-mode note moved from the core into `ObsidianRoute#plugin`, and
+  `ObsidianRoute` takes `probe` for its filesystem checks.
+  `SkillStateInputs.obsidianProbe` and the `credentialStore` option of
+  `createSkillTool` are gone, and the core shares no credential key by default. `versionProbeSkills` takes
+  `{ installedTools, platform, readiness }` after the catalog. The bundled
+  sidecar wires the plugin; its hook joins the hook manifest, so a run paused
+  before the upgrade does not resume. **Upgrade:** a host
+  that builds its own tools, such as qvac-app, passes the route's plugin too:
+  `const obsidian = new ObsidianRoute({ credentialStore })`, then
+  `routes: [obsidian]` and `plugins: [{ plugin: obsidian.plugin }]`. A host that
+  ships the obsidian skill without the plugin gets the generic gates: the vault
+  path is per agent and no longer stands in for the bin, the load has no vault
+  note, and `skills()` probes `obsidian version`, which opens the desktop app.
+  (#227)
+
+- **Breaking:** every module's entry exports one class as its API, plus the
+  types it takes and returns. (#217, #216, #218 to #221) For qvac-core:
+  - The root no longer exports `completion()`: call
+    `CompletionEngine.run(sdk, args, options)`, which takes the same arguments
+    and defaults. `new CompletionEngine(sdk, options).run(args)` is the
+    instance form. The `./lib/capabilities/completion.ts` subpath is gone: its
+    `imageSettingsFrom`, `skillInContext`, `unreadySkillState`, `toSdkTool`,
+    `loadedSkillsFrom`, `skillLoadedTurn` and `CONTEXT_OVERFLOW_MESSAGE` are
+    root exports, and its types (`CompletionArgs`, `CompletionRun`,
+    `CompletionSkillEntry` and the contract types) are root types.
+    `trustedSourcesFrom` is no longer exported.
+  - `defaultHooks()` is `HookPipeline.defaults()`, and `EgressGuardHook` and
+    `SkillCatalogGuardHook` are `HookPipeline.EgressGuardHook` and
+    `HookPipeline.SkillCatalogGuardHook`. The root exports `HookPipeline`. The
+    hook types live in the contract, so the root also exports the hook payload
+    types.
+  - The contract type `Agent` is `AgentConfig`. `./agent` exports the `Agent`
+    class: `resolveAgent`, `agentPolicy`, `parseToolGrant`, `enabledTools`,
+    `permittedTools`, `collectToolGrants` and `skillIsActive` are its statics
+    `resolve`, `policy` and the same names, and the tool-name constants and
+    `NETWORK_TOOLSETS` are statics too. `new Agent(config, ports)` binds one
+    agent.
+  - `./plugins` exports the `PluginRegistry` class in place of
+    `createPluginRegistry(entries, options)`: call
+    `new PluginRegistry(entries, options)`. Its checks, messages and lifecycle
+    are unchanged.
+  - `./run-log` and `./run-log-inspect` both export the `RunLog` class.
+    `createEngineBoot`, `buildEngineBoot`, `validateEngineBoot`,
+    `applyEngineStep`, `contextFromBoot` and `requestFromBoot` are its statics,
+    `RUN_LOG_VERSION` and `RUN_LOG_PROTOCOL_VERSION` are `RunLog.VERSION` and
+    `RunLog.PROTOCOL_VERSION`, and `inspectRun` and `renderRunLogHtml` are
+    `RunLog.inspect` and `RunLog.renderHtml`. `./run-log` now loads XState.
+    It no longer exports the `Operation` and `RunBudget` types; the root
+    still exports `Operation` and `RunBudget`.
+  - `lib/machine` exports `CompletionMachine` and no longer re-exports the run
+    log. `createCompletionMachine`, `completionMachineDefinition`,
+    `emptyCompletionContext` and `MACHINE_VERSION` are `create`, `definition`,
+    `emptyContext` and `VERSION`. `runEngine` moved to the completion engine,
+    and `stableStringify`, `raceDrain` and `didDrainTimeOut` to `lib/helpers`.
+  - The machine entry exports only `CompletionMachine` (`VERSION`, `create`,
+    `definition`, `emptyContext`, `transitionName`) and the types those take
+    and return. It no longer exports the error classes, `tagError`,
+    `rehydrateError`, the failure-result helpers or the stage payload types.
+    `AbortedError` stays on `./race-abort`. The shared run types (`Message`,
+    `Operation`, `ToolExecutionOutcome`, ...) moved to the contract, so the
+    root now also exports `Operation`, `RunOutcome`, `HistorySplice`,
+    `CompletionHistoryEntry`, `FailureResultReference`, `TrustedOrigin`,
+    `TrustedSource` and `TrustedSourceFacts`. The `./lib/tool-call-display.ts`
+    subpath is gone; `ToolCallDisplay` and `ToolExecutionOutcome` come from
+    the root. (#229)
+- `@qvac/sdk` and `@qvac/inference` 0.20.1. Every `llamacpp-completion` load
+  now sends `system_prompt: ''`, so the SDK no longer seeds
+  `'You are a helpful assistant.'` in front of a history with no system
+  message. **For qvac-core:** no API break, but every completion modelId
+  changes once, so each chat cold primes once after the upgrade. `fit` is left
+  out: a 2B load with `fit: true` showed no fitting, and the SDK sends it as
+  `'true'` where fabric's `--fit` takes `on` or `off`. (#194)
+- `@qvac/sdk` and `@qvac/inference` 0.21.0, with `@qvac/llm-llamacpp` 0.55.0,
+  and the addons the plugins load directly at the SDK's peer ranges
+  (`@qvac/asr-ggml` 0.7, `@qvac/tts-ggml` 0.10, `@qvac/audiogen-ggml` 0.5,
+  `@qvac/diffusion-cpp` 0.26, `@qvac/embed-llamacpp` 0.43.0,
+  `@qvac/translation-nmtcpp` 0.18.0). The SDK fits models itself, so
+  `@qvac/model-fit` leaves the dependencies, `SdkLoader.addons` and
+  `NATIVE_ADDON_PACKAGES`. `@qvac/fabric` ships its prebuilds as per-platform
+  packages (`@qvac/fabric-<os>-<cpu>`); `collectRuntimeClosure` now follows a
+  dependency's `#host-addon` package as well as a seed's, and a host that
+  packages the addons exempts those names from any install age gate. The fit
+  check asks the SDK's `loadModel`-shaped `assessModelFit` input with the
+  model's source, and an embedding model is assessed as one. (#302)
+- **Breaking:** the chat-file staging and output policy the office, pdf and
+  Python paths share move from `./plugins/python` into the core:
+  `Tools.stageInputs` and the `ExecInput` type come from `@qvac/harness/tools`,
+  and `./plugins/python` no longer exports them. `ExecLanguage.validate` takes
+  an `ExecValidateScope`, which adds the round's `toolNames`, and
+  `ResidentPoolSpec.modelConfigFor` lays a model's own config over the pool's,
+  as the speech plugin does for Supertonic's steps. `wording.fileDelivered`
+  replaces the nudge after a round that attached a file, and a run that wraps
+  up one round after a delivered file ends with the `delivered` outcome.
+- The `pdf` tool declares `bare-pdfium` in its `addons`, so a sealed sidecar has
+  it loaded before the first PDF call, and `NATIVE_ADDON_PACKAGES` names it.
+- **Breaking:** the sidecar seals native addon loading once the harness is ready
+  (`Bare.Addon.seal()` through `#addon-seal`, a no-op on Node), so nothing a run
+  does can load a new native addon. Whatever loads one declares it:
+  `HarnessPlugin.addons`, `ToolDefinition.addons` and `SdkLoader.addons`, each a
+  name and a literal `import()`. On Bare the harness loads them all as it opens,
+  each plugin's before its `setup`. A failure rejects `ready()` naming the
+  plugin or tool and the addon, and rolls the started plugins back. The build
+  fails on a native addon `NATIVE_ADDON_PACKAGES` does not name. **Upgrade:** a
+  host-written plugin or tool that imports a native addon lazily declares it in
+  `addons`, or it fails under the seal. An entry set in
+  `QVAC_PYODIDE_WORKER_ENTRY` must exit when `workerData.preload` is true, as
+  the real entry does, or `ready()` waits on it. Opening a harness on Bare now loads the
+  SDK's addons up front, not on the first call. (#177)
+- Plugin service registration rejects `undefined` and names reserved by the
+  context, such as `get`, `provide` and `onDispose`. Rename conflicting services
+  and return an initialized value. A failed registry cannot restart; construct
+  another harness to retry. `HarnessPlugin` entries are the only plugin shape;
+  the lower-level runtime is not exported. Model unload callbacks, tool grants
+  and wire APIs keep their contracts. No qvac-core migration is
+  needed for this framework integration. (#171)
+- **Breaking:** a tool declares that it reaches the network with
+  `egress(args)`, which returns the URL a call targets, or `null` when that is
+  not known before the call. `HookPipeline.EgressGuardHook` now checks every
+  tool that declares it, whatever its name, and no tool that does not:
+  `http_request`, `web_fetch` and `mcp_call` declare it. A plugin tool that
+  declares `egress` gets `ctx.fetch`, a guarded fetch that refuses private
+  hosts on every hop, stops with the call and refuses everything in sandbox
+  mode. The v0.7.3 names `createGuardedFetch`, `GuardedResponse`,
+  `GuardedResponseInit`, `GuardedFetchOptions`, `MAX_RESPONSE_BYTES`,
+  `ConnectPolicy`, `setConnectPolicy` and `isGuardedFetch` from
+  `./lib/tools/exec/adapters/python/guarded-fetch.ts` have no public path; a
+  plugin tool uses `ctx.fetch`. **Upgrade:** a host tool that reaches the
+  network declares `egress(args)`; one named `http_request`, `web_fetch` or
+  `mcp_call` without it loses the pre-call check. `createHttpRequestTool`,
+  `createWebFetchTool` and `createMcpCallTool` declare it, so qvac-core and
+  qvac-app's mobile worklet are unchanged. (#172)
+
+- **Breaking:** speech is a plugin. Transcription, text-to-speech and the
+  `bare-ffmpeg` audio decoding moved from `lib/` to `plugins/speech/`,
+  exported as `@qvac/harness/plugins/speech` (`speechPlugin`). A `Harness`
+  built without it rejects `transcribe`, `speak`, `speakStream` and a
+  `loadModel` or `unloadModel` of a voice model with `speech needs the speech plugin`, before
+  loading anything. The bundled sidecar passes the plugin, so a host that uses
+  `spawnHarness` (qvac-core) is unchanged. **Upgrade:** a host that constructs
+  `Harness` itself, such as qvac-app's `mobile/worker/harness-worklet.mjs`,
+  adds `plugins: [{ plugin: speechPlugin }]` with
+  `import { speechPlugin } from '@qvac/harness/plugins/speech'`. `SpeechService`, `SpeakResult` and the voice context types
+  are exported from `index.ts`, and `SpeakResult` from
+  `./lib/contract-types.ts`. (#173)
+- **Breaking:** `weather_lookup` is a plugin. It moved from
+  `lib/tools/weather-lookup.ts` to `plugins/weather/`, exported as
+  `@qvac/harness/plugins/weather` (`weatherPlugin`, and the tool as
+  `weatherLookupTool`); `createWeatherLookupTool` and its `fetch` and
+  `resolveHost` options are gone. The tool declares `egress` and fetches with
+  the guarded `ctx.fetch`; a refused fetch is a plain `{ error }` with no
+  `transport` code, and the 400 KB body cap is dropped. Granted read, it keeps
+  `autoApprove`, so its schema still has no `intent` argument. The bundled
+  sidecar passes the plugin, so `spawnHarness` hosts are unchanged. **Upgrade:** a host that constructs `Harness` itself, such as
+  qvac-app's mobile worklet, adds
+  `{ plugin: weatherPlugin, read: ['weather_lookup'] }` to `plugins` with
+  `import { weatherPlugin } from '@qvac/harness/plugins/weather'`. Without it
+  there is no `weather_lookup` and the bundled `weather` skill is unsupported.
+  (#176)
+- **Breaking:** Obsidian is an exec route in `plugins/obsidian/`, exported as
+  `@qvac/harness/plugins/obsidian` (`ObsidianRoute`). The modules under
+  `lib/tools/exec/obsidian/` leave the package, and
+  `ExecToolOptions.credentialStore` is gone: the route takes the store.
+  `createExecTool({ routes })` takes `ExecRoute`s; the first route that claims a
+  shell command runs it instead of the shell, after the shell checks. Route
+  names fold into exec's `policyVersion`, so a run paused on an exec call does
+  not resume. The bundled sidecar passes the route, so `spawnHarness` hosts are
+  unchanged. **Upgrade:** a host that builds `exec` itself, such as qvac-app's
+  mobile worklet, passes
+  `routes: [new ObsidianRoute({ credentialStore })]` with
+  `import { ObsidianRoute } from '@qvac/harness/plugins/obsidian'`. Without it
+  `obsidian …` goes to the shell (on a phone, instead of the desktop-agent
+  guidance), and the obsidian skill should be left out, since its readiness
+  still reads `ready` when a vault path is set (#227). (#223)
+- **Breaking:** image and music generation are plugins. `generate_image`,
+  `edit_image`, `generate_music`, their runtimes, the SDK diffusion and
+  audiogen plugin registration, and the `bare-media` and `bare-image-resample`
+  imports moved from `lib/` to `plugins/image/` and `plugins/music/`, exported
+  as `@qvac/harness/plugins/image` (`imagePlugin`) and
+  `@qvac/harness/plugins/music` (`musicPlugin`). `HarnessOptions` loses
+  `imageModel`, `imageClamps`, `musicModel` and `musicClamps`, and the root
+  loses `ImageModelOptions`, `MusicModelOptions`, `settingsDimension` and
+  `settingsSteps`; the last two are exported from `@qvac/harness/plugins/image`.
+  The three tools sit in two new toolsets, `image` and `music`, at the end of
+  `TOOLSETS`, so an agent can switch each off. A plugin may now `need` the
+  core's `models` service (`ModelHost`) and return `unload()` and
+  `unloadIdle()`, which the harness calls on suspend, close, idle unload and
+  before a chat model loads. `spawnHarness` and `harnessChild` keep their
+  options and the bundled sidecar passes both plugins, granting
+  `generate_image` and `generate_music` read. **Upgrade:** a host that
+  constructs `Harness` itself passes
+  `{ plugin: imagePlugin, config: { model, clamps }, read: ['generate_image'] }`
+  and `{ plugin: musicPlugin, config: { model: musicModelSet(choice), clamps }, read: ['generate_music'] }`;
+  music takes resolved stages, not a choice name. qvac-core's TUI imports
+  `settingsDimension` from `@qvac/harness/plugins/image` instead of
+  `@qvac/harness/lib/tools/generate-image.ts`, and adds `TOOLSET_HINTS` for
+  `image` and `music`. (#175)
+- **Breaking:** `MAX_TOOL_ROUNDS`, `TOOL_CONTINUATION_NUDGE`,
+  `TOOL_DENIED_MESSAGE` and `TOOL_CUT_OFF_MESSAGE` are no longer exported from
+  `lib/machine`. All four are defaults now, exported from
+  `lib/capabilities/tool-turns.ts`.
+  `toolDeniedResult` takes its message, `contextCandidates` and
+  `lastFailedToolAnswer` take the run's nudge, and
+  `CompletionMachine.emptyContext` requires a `policy`. (#159)
+- **Breaking:** `skillPreloadMessage` is exported from
+  `./lib/capabilities/tool-turns.ts`, no longer from
+  `./lib/tools/skills/mention.ts`. (#166)
+- **Breaking:** `metrics.durationMs`, and `stats.durationMs` on the `runEnd`
+  hook, are the run's wall time, as they already were for a capability
+  invoke. They were an estimate of decode time. `promptTokensPerSecond` is
+  weighted by every round's prompt tokens instead of being the first round's.
+  (#195)
+- **Breaking:** `MACHINE_VERSION` and `RUN_LOG_VERSION` are both 1, and stay
+  at 1 until 1.0.0 ships. A run saved with `1.0.0-rc.0` or `1.0.0-rc.1` does
+  not resume, and `./run-log-inspect` no longer reads v4 or rc logs. (#205)
+- **Breaking:** the completion graph no longer has skill states. A turn's
+  skill preload runs as a generic prepare step (`prepareChecking` and
+  `prepareRunning`, actors `inspectPrepare` and `runPrepare`), and a skill call
+  in a round runs in `executing`, so `tools.loadingSkill` is gone. Context
+  `skills` is now `activated: string[]` and `skillPreload` is
+  `prepareStep: { id, tool, args, facts? }`. `lib/machine` no longer exports
+  `SkillLoadOutput`, `SkillPreloadState`, `PreloadInspectionOutput`,
+  `SkillReadyPayload` or `SkillFailedPayload`; it exports `PrepareStep`,
+  `PrepareStepProposal`, `PrepareInspectionOutput`, `PrepareRunOutput`,
+  `PrepareResult` and `PrepareFailure`. `PreparingOutput` carries `step`,
+  `InspectingOutput` only `call`, `execution` and `rejection`, and
+  `ToolExecutionSnapshot` has `origin` in place of `kind: 'skill'` and
+  `skillName`. Events, call ids (`preload-<name>`) and their order are
+  unchanged. A run saved paused in a removed state does not resume. (#170)
+- A response cut off by the length limit no longer runs its tool calls. Each
+  call gets a `tool-call` and then an error `tool-result` carrying the run's
+  `wording.toolCutOff` text (#159), which asks for a shorter re-issue. Nothing
+  runs, no approval is asked for, and the next round starts. A complete re-send
+  in a later round still runs. (#155)
+- Arg repair converts a string argument to the schema's scalar type when the
+  conversion is lossless: a JSON number that does not underflow, a whole one
+  only within the safe-integer range (`"1e20"` stays a string), `true`/`false`
+  in any case, `"null"` where null is allowed, and an enum value matched
+  ignoring case. Nested fields count too. An optional field sent as `"null"`
+  is dropped only when its schema allows neither string nor null: an optional
+  string field keeps `"null"`, and a nullable one becomes `null`. A tool may now
+  receive `3` where it used to get `"3"`. (#156)
+- A tool description spells out a parameter's nested and defaulted fields
+  (`Each item: {…}`), which the SDK strips from the schema. The prompt bytes of
+  `read_files`, `create_documents`, `edit_documents`, `grep` and `edit_image`
+  change, so each chat's first turn after the upgrade misses the prefix cache
+  once. A tool with only flat parameters is unchanged. (#157)
+- exec labels a Pyodide run of inline Python, source pasted into `script`
+  included, as `python[ · network: …]: …` in the approval; a bundled script
+  keeps `python script <skill>/<script>`. `command` together with `script` is
+  rejected. Pasted source classifies like the same source in `command`. (#163)
+- **Breaking:** `resolveScriptRun` returns `{ args, trusted: false }` instead
+  of `null` for a call that is not a script run (#163). It moved out of
+  `./lib/tools/exec.ts` into the python plugin and is no longer exported
+  (#174).
+- **Breaking:** `createExecTool()` runs shell commands only unless it is given
+  `languages`. Without Python its schema has no `language`, `packages`,
+  `inputs`, `outputs`, `script`, `skill` or `scriptArgs`, and a
+  `language: "python"`, interpreter or pip call is refused with a message that
+  says no call runs it. Without a language, `packages`, `inputs`, `outputs` or
+  `script` on a shell call is refused too, as before. `disablePyodide`, `loadPyodide` and `pythonNetwork` are
+  gone: pass `loadPyodide` and `network` to `createPython()`. The harness no
+  longer closes the python worker itself; the plugin's teardown does. The
+  modules under `./lib/tools/exec/adapters/python/` moved to
+  `plugins/python/` and are no longer exported one by one; take `stageInputs`
+  from `./plugins/python`. With Python, the exec schema lists
+  `script`, `skill` and `scriptArgs` before `workdir`, so each chat's first
+  turn after the upgrade misses the prefix cache once, and a run paused on an
+  exec call does not resume. (#174)
+- A round whose only tool calls the SDK could not parse or validate
+  (`final.toolErrors`) gets a re-ask on its first stall: the failed markup as
+  the assistant turn, a `call-malformed` tool turn with each error's code and
+  message, then the continuation nudge. A round cut off at the length limit
+  gets `wording.toolCutOff` in the tool turn instead. Once that re-ask is spent
+  or no round is left, the round answers in prose as before, or takes the
+  narrated re-ask when its prose narrates a call. The re-ask has its own
+  one-retry budget, separate from the narrated re-ask, and a round that runs a
+  call resets it. The run log keeps `toolErrors` with `raw` and `message`
+  redacted, and redacts the malformed assistant turn and the `call-malformed`
+  tool turn wholesale. Nothing changes on the wire or in `RunPolicy`. (#190)
+- The re-ask after a round that narrated a call, and the re-ask after a
+  malformed call, demand a call: they send `tool_choice: 'required'` and
+  `reasoning_budget: 0` over the session's params. A malformed round cut off at
+  `length` is re-asked unforced. A mute retry of a re-ask is forced too, even
+  after a cut-off. A run with no tools or with a response format is never
+  forced. Every other round, the wrap-up included, keeps the session's params.
+  When the addon refuses the forced call, the round runs again unforced on a
+  fresh KV session. A grammar fault still falls back to
+  `tool_choice: 'none'`. Each forced round resends the tool block into the
+  chat's cache; #212 measures the cost. `LlmGenerationParams.tool_choice` now
+  admits `'required'`. **Upgrade:** do not set it for a whole run, in process
+  or in the wire's `generationParams`. The wrap-up sends no tools, and the SDK
+  rejects `required` with none, so the run fails. qvac-core sends no
+  `tool_choice` and is unchanged. (#191, #213)
+
+### Removed
+
+- **Breaking:** `Tools.product` no longer lists `mcp_call` or compiles the
+  skill catalog's mcp operations (notion's `notion_create_page` and
+  `notion_insert_content`). Add
+  `new McpPlugin({ generic: true, skillCatalog, credentialStore, read: ['mcp_call'] })`
+  from `@qvac/harness/plugins/mcp`; without `read`, every `mcp_reads` method
+  asks. `mcp_call` now follows the exec tools in the prompt, so every cached
+  prompt changes. (#277)
+- **Breaking:** the `./lib/tools/*` wildcard and five tool factory exports.
+  Build the product list with `Tools.product` from `@qvac/harness/tools`:
+  - `./lib/tools/http-request.ts` (`createHttpRequestTool`): `Tools.product`.
+  - `./lib/tools/mcp-call.ts` (`createMcpCallTool`): `new McpPlugin({ generic: true })`
+    from `@qvac/harness/plugins/mcp`.
+  - `./lib/tools/web-search.ts` (`createWebSearchTool`): `WebSearchPlugin` from
+    `./plugins/web-search` (#276).
+  - `./lib/tools/web-fetch.ts` (`createWebFetchTool`): `Tools.product`.
+  - `./lib/tools/skill.ts` (`createSkillTool`): `Tools.product` with `skillsDir`.
+  - `./lib/tools/read-files.ts`, `file-glob.ts`, `grep.ts`,
+    `create-documents.ts`, `edit-documents.ts`, `operations/compile.ts`:
+    `Tools.product`, which passes them the denied roots.
+  - `./lib/tools/skills/credential-slots.ts` (`credentialSlots`):
+    `credentialSlots` from `@qvac/harness/skill-manifest` (#283).
+  - `./lib/tools/skills/scope-key.ts` (`isDeviceSharedCredentialKey`, which
+    #227 removed; `scopeKey` and `deviceSharedKeys` are harness-internal): no
+    replacement. Plugins now declare their device-shared keys in
+    `SkillReadiness.deviceSharedKeys`. A host that picks a credential's
+    storage key outside the harness keeps its own list of device-shared keys,
+    matching the plugins it composes. Today that is `obsidian_vault_path`,
+    from `ObsidianRoute`. A mismatch fails closed: a key the host stores
+    device-wide that no plugin shares reads as unset for an agent, and the
+    skill shows needs-setup. (#283)
+  - `./lib/tools/skills/bundled-dir.ts` (`ensureBundledSkillsDir`):
+    `Tools.bundledSkillsDir()` from `@qvac/harness/tools` (#283).
+  - `./lib/tools/skills/catalog.ts`: `./lib/tools/skills/index.ts` or the root
+    `@qvac/harness`, which both re-export it.
+  - `./lib/tools/skills/auth-resolver.ts`, `cli-schema.ts` and
+    `credential-grants.ts`: `./lib/tools/skills/index.ts`, which re-exports
+    them.
+  - `./lib/tools/skills/frontmatter-parser.ts`: `./skill-manifest` or
+    `./lib/tools/skills/index.ts`.
+  - `./lib/tools/skills/skill-state-constants.ts`: `./skill-state`.
+  - `./lib/tools/skills/tool-grants.ts` (`parseToolGrant`, already gone this
+    release): `Agent.parseToolGrant` from `@qvac/harness/agent`.
+  - Any other `./lib/tools/...` path: no replacement.
+
+  Only `./lib/tools/exec.ts`, `./lib/tools/toolsets.ts`,
+  `./lib/tools/skills/index.ts`, `./lib/tools/skills/mention.ts` and
+  `./lib/tools/skills/mention-name.ts` keep their keys, and the packed plugins
+  reach `exec/runner.ts`, `exec/shell-argv.ts`,
+  `exec/adapters/shell/shell-adapter.ts`, `fs/scope.ts` and `fs/write.ts`
+  through their own keys. (#273)
+
+- **Breaking:** `lib/team` and `Team`, with `TeamConfig`, `TeamRequest`,
+  `TeamHost` and `TeamEvent`. `harness.completion({ agent, agents, messages })`
+  replaces `Team.run(host, { entry, agents }, request)`; `TransferEvent` is a
+  contract type now. (#233)
+- The sidecar bundle no longer ships `@qvac/ocr-ggml`: no harness code imports
+  it, and the shipped addon closure is now seeded from the `@qvac` packages the
+  bundle defers (`deferredAddonPackages`), so a host bundling neither image nor
+  music ships neither `@qvac/diffusion-cpp` nor `@qvac/audiogen-ggml`. (#226)
+
+- **Breaking:** `rag_search`, the `ragSearch` host callback and its types.
+  `CompletionArgs.ragSearch`, `CompletionContext.ragSearch` (`index.ts` and
+  `./lib/contract-types.ts`), `ToolExecuteContext.ragSearch` (a root type),
+  `RagSearchFn`, `RagSearchResult` and the `./lib/tools/rag-search.ts` export
+  are gone. The callback was bound onto every tool's execute context, so a
+  host's own tool could call `ctx.ragSearch`; no harness tool did. A host drops
+  the field, and knowledge still reaches the model by injection. The `rag-ask`
+  and `rag-result` wire values stay in the schema. (#162)
+- **Breaking:** `harnessHooks`. Hooks belong to a `Harness`:
+  `new Harness({ hooks })` replaces the built-ins, and
+  `HookPipeline.defaults()` returns fresh instances of them (arg-repair,
+  egress-guard, sandbox, skill-catalog). To add a hook, pass
+  `[...HookPipeline.defaults(), mine]`. `CompletionEngine` takes a `hooks`
+  option and defaults to `HookPipeline.defaults()`, so a host that passes
+  nothing runs the same four as before. (#158)
+- **Breaking:** the agent's tool selection and tool names are exported as
+  `@qvac/harness/agent`, which replaces `./lib/capabilities/tool-selection.ts`
+  and `./lib/capabilities/tool-names.ts` (and the unreleased
+  `./lib/agent/tool-selection.ts` and `./lib/agent/tool-names.ts`). It exports
+  the `Agent` class, with the statics `resolve`, `policy`, `parseToolGrant`,
+  `enabledTools`, `permittedTools`, `collectToolGrants`, `skillIsActive`,
+  `follow`, `NETWORK_TOOLSETS`, `SKILL_TOOL_NAME`, `WEB_SEARCH_TOOL_NAME`,
+  `TRANSFER_TOOL_NAME` and `MAX_TRANSFERS`.
+  `isSelected`, `skillsAreSelected`, `MCP_CALL_TOOL_NAME` and the types
+  `ToolGrantSource`, `ToolGrants`, `SelectableTool` and `ToolGateInputs` are no
+  longer exported; `SkillActivation` is a root type.
+  `parseToolGrant` left `./lib/tools/skills/tool-grants.ts` (gone), and
+  `NETWORK_TOOLSETS` and `permittedTools` left `./lib/tools/toolsets.ts`,
+  which keeps `TOOLSETS`, `Toolset`, `asToolset` and `toolsetEnabled`.
+  `ToolGrant` is no longer exported; `ToolsetScoped`, and `SystemPromptParts`
+  from `./lib/prompt.ts`, are root types. (#165, #206)
+- **Breaking:** `./lib/tools/model-args.ts` (`unquoteArg`) is no longer
+  exported. (#166)
+
+### Fixed
+
+- A reply that said it would act ("I'll …", "Let me …") but asked the user
+  something got the narrated re-ask, and the forced round called a tool with
+  the input the user was asked for made up. Such a reply is now the answer,
+  and the turn ends there: a question mark outside code and outside a URL
+  query, or a request for the user's input such as "tell me", "show me",
+  "send me", "give me …", "please provide …" or "let me know". A request for
+  time, such as "give me a moment, I'll check", still gets the re-ask.
+  Nothing changes on the wire or in `RunPolicy`. (#252, #272, #292)
+- Under `SeatbeltSandbox` (`./plugins/sandbox-macos`), a shell line could read
+  and write the app storage root when a write root held it, for example a home
+  grant: `cat <storage>/sdk-home/key` worked under both presets. Exec now passes
+  its canonical `deniedRoots` to the shell as `ExecutionContext.deniedRoots`,
+  and the Seatbelt profile denies reads and writes under each one, plus the
+  rename or removal of each folder above a denied root, up to and including
+  `/`. `SeatbeltSandbox.profile` takes `{ roots, denied, ancestors }`. (#293)
+- On Node, exec's default shell runtime failed every command with
+  `require.addon is not a function`: it imported `bare-subprocess` and
+  `bare-process` directly. It now imports `child_process` and `process`, which
+  resolve to the Bare modules on Bare. The skill bin probe and the capability
+  probe share this runtime. (#274)
+- On Node, a shell line run through `SeatbeltSandbox` (`./plugins/sandbox-macos`)
+  failed with `require.addon is not a function`: the plugin imported
+  `bare-subprocess` directly. It now imports `child_process`, which resolves to
+  `bare-subprocess` on Bare. (#281)
+- A completion event the hrpc schema could not encode (a cycle in a tool
+  result, a negative number such as `progress({ percentage: -1 })`) killed the
+  harness process: hrpc encodes in a deferred write, outside any try/catch.
+  `serve` now encodes each event before it sends it. When that fails, the run
+  ends with an `error` event `cannot encode <type> event: <reason>`, and a later
+  run on the same connection still completes. (#267)
+- The other wire writes no longer kill the process on a value the hrpc schema
+  cannot encode. `modelEvents` sends
+  `{ status: 'error', message: 'cannot encode model event: <reason>' }` with no
+  `model` and keeps the subscription open. `download` ends with an `error`
+  event `cannot encode <type> event: <reason>`. `speakStream` rejects with
+  `cannot encode speak frame: <reason>`, for a worker frame and for a host
+  fragment; before, it ended cleanly but cut short. A host `completion` frame that cannot encode destroys the stream and
+  rejects with `cannot encode <type> frame: <reason>`, with no `HARNESS_DIED`
+  code. The generated `spec/bind.js` turns a non-Error throw from a stream
+  handler into an `Error` and destroys `writeStream` with it. (#278)
+- `copyAddonExternals` ships a dependency nested under a package because the
+  root copy is out of its range (`@qvac/tts-ggml`'s `bare-subprocess` ^5). (#228)
+- On the last tool round, a response with no answer and no tool call re-asked
+  the model one round past `maxToolRounds`, and tool calls from that extra
+  round still ran. The run now wraps up instead. (#167)
+- A `FAIL` sent while a run was finishing ran the finishing step again, and
+  with it the `runEnd` hook. The run now fails at once, as it does when the
+  finishing step itself throws. `runEnd` does not fire for that failure, so a
+  host hook does not see it. (#167)
+
+## [0.8.5] - 2026-10-06
+
+### Added
+
+- Skill-gated `pptx`, `docx` and `xlsx` tools on the office engine. A call takes
+  an `attachmentId` (or `create` options), `ops` that name engine methods with
+  named arguments, and an `output` file name; with an `attachmentId` alone it
+  returns the file's contents. The first failing op saves nothing and returns
+  the engine's error. An edit is never saved under the attached file's own
+  name. Saving the same file again in one turn answers with the one already
+  attached, and a changed file under that name is refused. The one-line answer
+  comes back as `reply`. These are the tools the presentations, word and excel
+  skills in `@qvac/skills` 0.1.12 call. (#286)
+
+### Changed
+
+- **Breaking:** `@qvac/skills` is now 0.1.12, whose office and pdf skills run on
+  the `pptx`, `docx`, `xlsx` and `pdf` tools instead of Python. A host that
+  passes its own `skillsDir` needs 0.1.12 as well: older office skills import
+  Python libraries this release no longer ships. (#286)
+- `extractOfficeText` and `extractDocxText` read .docx, .xlsx and .pptx in
+  process on the engine instead of starting Pyodide, and read at most 1M cells
+  across a workbook. Extracted workbook booleans read `true`/`false` instead of
+  `True`/`False`. `closeOfficeWorker` and `closeDocxWorker` remain as no-ops.
+  (#286)
+- `exec` refuses Python that imports `pptx`, `docx` or `openpyxl`, or declares
+  their packages, before it runs, and names the tool (or the skill that grants
+  it) to use instead. (#287)
+- **Breaking:** Python run through `exec` asks for approval like any other
+  write, including a run that only builds a new PDF. (#289)
+
+### Removed
+
+- **Breaking:** the vendored Python wheels for python-pptx, python-docx,
+  openpyxl, fpdf2 and pypdf, and their dependencies. Only micropip is still
+  seeded; any other package installs from PyPI, which sandbox mode refuses.
+  Use the office and `pdf` tools. (#286, #289)
+- The `exec` guidance written for python-pptx, python-docx and fpdf2 code:
+  their error hints and source checks, and the shrink-to-fit pass on saved
+  decks. (#288, #289)
+
+## [0.8.0] - 2026-10-05
+
+### Added
+
+- A skill-gated `pdf` tool on `bare-pdfium` 1.6.0. With an `attachmentId` and
+  no `action` it reads a PDF: the page count, each page's text and the form
+  fields. With an `action` it saves a new file named `output` and attaches it:
+  `create` from Markdown (chat images placed with `![caption](attachmentId)`),
+  `merge`, `split`, `rotate`, `watermark`, `fill`, `encrypt`, `decrypt` and
+  `text`. Errors name what exists, a locked PDF takes its password on any
+  action, and the one-line answer comes back as `reply`. On Node it reports
+  that the device cannot open PDFs. The pdf skill in the next `@qvac/skills`
+  release uses it instead of Python. (#256)
+- An office engine in `lib/office/engine/` that reads, edits and creates `.pptx`,
+  `.docx` and `.xlsx` files in TypeScript on Bare and Node, so office editing no
+  longer needs Python and can run on mobile. It keeps untouched parts byte for
+  byte, fails with a `DocsError` whose code names the problem, and moves Excel
+  references when rows and columns change. It adds `@xmldom/xmldom`, makes
+  `bare-zlib` a direct dependency and maps `#zlib` to `bare-zlib` or `zlib`.
+
+### Fixed
+
+- Qwen3.5-family models: a tool call that ran goes back into the chat history
+  in the Qwen3.5 template's own format (`<tool_call>` wrapper, one line per tag,
+  string values as written) instead of a compact `<function=…>` line. A model
+  several calls into a turn copied the compact form, the tool grammar rejected
+  it, and the run ended in "This didn't finish". Models with another tool format
+  (e.g. MedPsy) still get a format that is not their own, until the SDK accepts
+  structured tool calls in history. (QVAC-23092, #146)
+- A skill loaded with a `file` it does not have, before its instructions were
+  loaded, now returns those instructions with a line naming the files it has,
+  so the skill counts as loaded and its skill-gated tools appear. Before, a
+  one-file skill answered that the model already had its instructions, and its
+  tools stayed hidden. (#257)
+- After a tool attaches a file, the loop tells the model the file is shown and
+  to answer, allows one more tool round, then writes the answer in a tool-less
+  round. Small models no longer keep calling tools on their own output until
+  the round cap. (#258)
+- `exec`: a `$` before a digit, a space or punctuation in a shell command is
+  escaped instead of rejected, so text like `$1,299` runs on the first try. Real
+  shell expansion is still refused, now with a hint to single-quote the text.
+  (#208)
+
+## [0.7.3] - 2026-10-01
+
+### Added
+
+- A tool result may carry `answer: true` beside its `content` to end the turn
+  with that content as the reply, without another round through the model.
+  The `tool-result` event still fires. `weather_lookup` uses it for an
+  ambiguous or unknown place: the question that lists the namesakes, or the
+  not-found line, is the reply.
+
+### Fixed
+
+- `weather_lookup` finds the place before it asks for the weather. It looks the
+  city up on Open-Meteo's geocoder, `geocoding-api.open-meteo.com`, a new
+  outbound host, and asks wttr.in for the forecast at the coordinates of the
+  place it picked, which leads the report. A bare "Nassau" now reports Nassau,
+  Bahamas. It used to ask wttr.in by name, whose own geocoder put it in
+  Westbury, New York. A name that places of a similar size share, such as
+  Springfield, gets a question listing up to four of them instead of a
+  forecast: any namesake with a tenth of the largest one's population counts.
+  A country or state in the request picks among them. When the geocoder is
+  blocked, slow or failing, or knows no such place, the lookup asks wttr.in by
+  name, as before. The resource label names both hosts.
+
+## [0.7.2] - 2026-10-01
+
+### Added
+
+- `web_fetch` attaches a plain-text file (.txt, .csv, .json…) to the chat
+  besides returning its text, so the user can open or save it and `exec` can
+  stage it to read past the returned text. The result carries its
+  `attachmentId`, `fileName` and `byteLength`. A body cut at the fetch cap is
+  not attached, and a host that cannot store files gets the text alone, as
+  with page images. (#147, #148)
+
+### Changed
+
+- Speech sounds cleaner on desktops. Devices on the `mid` profile and up now
+  speak with Supertonic 3 FP16 (`Supertonic3-FP16`, 207 MB) instead of Q8_0
+  (127 MB), at 16 inference steps instead of 5, which removes the artifacts
+  the 5-step output had. Synthesis takes about 2.7× as long, still around 7×
+  faster than real time on an M-series Mac. Phones (`low`) and `tiny` devices
+  keep Q4_0 at 5 steps. A host that prefetches `infraModelsFor` downloads the
+  FP16 model once; `Supertonic3-Q8_0` stays in the catalog, and now also runs
+  at 16 steps when a host asks for it by name. (#149)
+
 ## [0.7.1] - 2026-09-30
 
 ### Added
@@ -1019,7 +2182,11 @@ Tagged but never published to npm; these changes first shipped in 0.2.12.
 - GPU stats are read through `bare-gpu-info`, so every dependency installs from
   the public npm registry. (#12)
 
-[Unreleased]: https://github.com/tetherto/qvac-harness/compare/v0.7.1...HEAD
+[Unreleased]: https://github.com/tetherto/qvac-harness/compare/v0.8.5...HEAD
+[0.8.5]: https://github.com/tetherto/qvac-harness/compare/v0.8.0...v0.8.5
+[0.8.0]: https://github.com/tetherto/qvac-harness/compare/v0.7.3...v0.8.0
+[0.7.3]: https://github.com/tetherto/qvac-harness/compare/v0.7.2...v0.7.3
+[0.7.2]: https://github.com/tetherto/qvac-harness/compare/v0.7.1...v0.7.2
 [0.7.1]: https://github.com/tetherto/qvac-harness/compare/v0.7.0...v0.7.1
 [0.7.0]: https://github.com/tetherto/qvac-harness/compare/v0.6.0...v0.7.0
 [0.6.0]: https://github.com/tetherto/qvac-harness/compare/v0.5.0...v0.6.0