@xingular/harness 1.1.1 → 1.3.1-unstable.0

package/docs/parity.md

@@ -1,6 +1,6 @@
 # Capability parity register
 
-**Status:** descriptive register, as of 2026-10-24. The binding rules are
+**Status:** descriptive register, as of 2026-11-19. The binding rules are
 [14 Surfaces and parity](architecture/14-surfaces-and-parity.md) (`INV-PAR-1`–`INV-PAR-4`).
 
 Every capability a person can use is a Harness capability. The standalone terminal (`xagent`)
@@ -12,44 +12,98 @@ Host-only surfaces (presentation a terminal cannot show, `INV-PAR-4`) are not li
 host keeps its own register. The App's is
 [`App/docs/architecture/app-only-surfaces.md`](../../App/docs/architecture/app-only-surfaces.md).
 
-Status: **parity** (both surfaces pass), **terminal only**, **host only** (a gap), **planned**,
-**host-backed** (needs a host object; terminal fallback named).
+Status: **parity** only where both surfaces passed acceptance; **implemented** means source routes
+exist but acceptance is not certified; **terminal only**, **host only**, **partial**, **planned**,
+and **host-backed** (needs a host object; terminal fallback named). A slash-command row marked
+implemented is not a parity claim; acceptance is tracked per command.
 
 ## Register
 
 | Capability | Harness owner | Method or tool | Terminal surface | App surface | Status | Gap |
 |---|---|---|---|---|---|---|
 | Sessions and turns | `sessions/` | `sessions.run`, `terminal.*` | the terminal itself | Solo chat | parity | — |
-| Plan mode | `sessions/planMode.ts` | `plan: true` | `/plan`, Shift+Tab, plan card | plan request, PlanCard | parity | — |
-| Bash command mode | `sessions/sessions.ts` | `initialBashCommand` | `!command` | `!command` in the composer | parity | — |
+| Plan mode | `sessions/planMode.ts` | `plan: true` | `/plan`, Shift+Tab, plan card; bounded plan/todo context is restored after compaction | plan request, PlanCard; shared Harness checkpoint behavior | parity | — |
+| Capability discovery | `tools/getCapabilities.ts` | read-only `get_capabilities` | terminal extension reports Pi's active tools and schemas; shared plan allowlist includes it | structured Harness run uses the same tool; no duplicate App-owned tool | implemented; acceptance not recertified | — |
+| Bash command mode | `sessions/sessions.ts`, `sessions/initialBash.ts` | `initialBashCommand`; Bash `workspaceWriteScope` | `!command` defaults to workspace; `!outside command` asks before running once | same `!command` and `!outside command` composer semantics | parity | — |
+| Workspace-scoped writes | `core/workspace.ts`, `sessions/workspaceBoundary.ts`, `core/workspaceBashTool.ts`, `core/workspaceSandbox.ts`, `core/workspaceWriteOperations.ts` | pinned non-root `RunRecord.workspaceRoot`; native `edit`/`write`; Bash scope | revalidated atomic native writes; external-hard-link scan and Bash sandbox (Windows: no sandbox, each Bash call asks once, plan-mode Bash refused; ADR-0042); complete escaped outside command in scrollable approval details (deny if too small); no output-triggered retry | same Harness gate and full approval action in scrollable App details; App policy can tighten scope; Full Permission remains the eligible explicit bypass | parity | — |
 | Side questions | `sessions/sideQuestions.ts` | `sideQuestions.start/read/interrupt`; terminal `terminal.sideQuestions.*` | `/btw` contextual dock with scroll and copy | side-question dock through the shared service | parity | — |
 | Approvals and standing approvals | `sessions/approvals.ts` | `approvals.*` | decision dock, `/permissions` | approvals dock, settings | parity | — |
-| Questions (`ask_user`) | `tools/askUser.ts` | `ask_user`; terminal `ask_user_question` | plan-mode dock: strict aligned columns, bounded body scroll, 80×24 source sketch viewport; connected structural projection with high-confidence boundary normalization (PROP-0026, PROP-0028) | plan-mode form accepts the same 80×24 ASCII source contract with literal preview and accessible overflow; no typography change required | parity; terminal projection verified in isolated fixtures | — |
-| Subagents | `sessions/subagentService.ts` | `spawn_subagent` (requires `title`, PROP-0030), `subagents.*` | `/subagents` page and live rows under the status line (mark, profile, parent-set title, `n of m tasks`) | reply trajectory | parity | — |
-| Agent profiles | `agents/profiles.ts` | `spawn_subagent { agent }`, `agents.list/get/create/remove`; terminal `terminal.agents.*` | `/agents` page: browse, create, edit in `$EDITOR`, copy, delete | not shown; `RunRecord.profile` available | terminal done; App planned | PAR-010 |
-| Run checklist | `tools/checklist.ts` | `checklist_write`, `runs.checklist`; terminal `checklist` telemetry | registered in terminal sessions and their subagents; each write shows as a checklist block in the transcript; a subagent row shows its `n of m tasks` | not shown | terminal done; App planned | PAR-001 |
+| Questions (`ask_user`) | `tools/askUser.ts` | shared `ask_user` tool | plan-mode dock: strict aligned columns, bounded body scroll, 80×24 source sketch viewport; connected structural projection with high-confidence boundary normalization (PROP-0026, PROP-0028) | plan-mode form accepts the same 80×24 ASCII source contract with literal preview and accessible overflow; no typography change required | parity; terminal projection verified in isolated fixtures | — |
+| Subagents | `sessions/subagentService.ts` | `spawn_subagent` (requires `title`, PROP-0030; `continue` resumes a stopped child, ADR-0043), `subagents.*`; plan mode allows only named eligible read-only research profiles | `/subagents` page with the `main` row pinned first, and live rows under the status line (mark, profile, parent-set title, `n of m tasks`), both rebuilt from saved runs when a conversation reopens; plan-mode research delegation uses the same Harness gate | reply trajectory; plan-mode research delegation uses the same Harness gate | parity | — |
+| Agent profiles | `agents/profiles.ts` | `spawn_subagent { agent }`, `agents.list/get/create/remove`; terminal `terminal.agents.*` | `/agents` page: browse, create, edit in `$EDITOR`, copy, delete | Solo `/agents` lists profiles; profile details and management are not wired | partial | PAR-010 |
+| Run todo list | `tools/todo.ts` | `todo_write`, `runs.todo` (`runs.checklist` deprecated); terminal `todo` telemetry | registered in terminal sessions and their subagents; each write shows as a todo block in the transcript; `/todo` shows the current list; a subagent row shows its `n of m tasks` | `/todo` shows the current list on demand; each write is not rendered inline | terminal done; App shows it on demand | PAR-001 |
 | Continuation of a stopped run | `sessions/continuation.ts` | `continueFrom`, `runs.continuation` | not offered (`/resume` reopens history only) | not offered | planned | PAR-003 |
+| Bounded replies and checkpoints (PROP-0041) | `sessions/workSlice.ts`, `tools/checkpoint.ts`, `sessions/runner.ts` | `checkpoint_write`, `workSlice`, `runs.continuation.checkpoint`, `checkpoint`/`heartbeat` events | guard on every terminal reply with the shared tool; the handoff is recorded on the run; no checkpoint card or slice control yet | not wired | implemented; terminal card, App presentation and `/slices` open | PAR-004 |
 | Accounts | `accounts/` | `accounts.*` | `/accounts` | Accounts | parity | — |
 | Models and effort | `accounts/choices.ts` | — | `/model`, `/effort` | composer pickers | parity | — |
 | Skills | `plugins/`, `tools/dispatch.ts` | `skill_load` | `$name`, `/skill:name`, browser Skills tab | Capability, composer | parity | — |
-| Plugins and Hub | `plugins/`, `hub/` | `plugins.*`, `hub.*` | resource browser | Capability | parity | — |
+| Plugins and Hub | `plugins/`, `hub/` | `plugins.*`, `hub.*` | full-screen `/plugins` local manager; separate full-screen `/hub` Community catalog with bounded registry/document Preview (no Pi-package Preview) | local Plugins manager; Community Hub with payload Preview for non-package entries | parity | — |
 | Connected apps (MCP) | `mcp/` | `connections.*`, broker tools | resource browser Connections tab | Connections | parity | — |
 | Web search and page reading | `web/` | `web_search`, `web_fetch` | world tools | world tools | parity | — |
-| Isolated browser | `browser/` | `browser_*` | world tools, headed on request, `/settings` Browser tab | App WebKit tabs (host-backed) | host-backed | — |
-| Page annotations | `annotations/` (PROP-0017, PROP-0018) | `annotations.*`, `annotations.capture.*`, `page_notes_*` | `/plugin:annotate` pane (inspector, queue, app windows over DevTools or the page bridge), `/plugin:notes` | website tab Annotate panel (inspector, queue to the focused thread, app windows through `annotations.capture.*`) | parity in the working tree; native WKWebView gestures unaccepted | PAR-011 |
-| Managed worktrees | `worktrees/` (PROP-0016) | `worktrees.*` | `--worktree`, `/worktree`, `xagent worktree` | working group **Create worktree** (`worktrees.create`) | partial | PAR-012 |
-| Wiki notes (model tools) | `wiki/`, `tools/` | `wiki_*` | `xagent-wiki` shell command only | tools | host only | PAR-002 |
-| History and trajectory (model tools) | `history/` | `history_*`, `trajectory_*` | shell command, `/trajectory` page | tools, trajectory views | host only | PAR-002 |
+| Isolated browser | `browser/` | shared `browser_*` schemas | isolated world tools, headed on request, `/settings` Browser tab | native WebKit: navigate, tabs, visible-text read and page scroll without refs; unsupported operations refuse explicitly | partial; native backend gap | PAR-015 |
+| Web annotations | `annotations/` (PROP-0017, PROP-0018, PROP-0038) | `annotations.*`, `annotations.capture.*`, `page_notes_*` | `/annotate:` pane (also `/annotate:annotate`), `/annotate:notes` saved list | website tab Annotate panel (inspector, queue to the focused thread, app windows through `annotations.capture.*`) | parity in the working tree; native WKWebView gestures unaccepted | PAR-011 |
+| Managed worktrees | `worktrees/` (PROP-0016) | `worktrees.*` | `--worktree`, `/worktree`, `xagent worktree` | Solo `/worktree` lists records only; Solo starts sessions in the project folder and has no worktree level | partial | PAR-012 |
+| Wiki notes (model tools) | `wiki/`, `tools/` | `wiki_*` | `Terminals.ownTools` registers Wiki-read tools through the session socket; `xagent-wiki` remains a person-facing shell utility | structured Harness tools | implemented on both; acceptance not recertified | PAR-002: acceptance not recertified |
+| History and trajectory (model tools) | `history/` | `history_*`, `trajectory_*` | `Terminals.ownTools` registers model tools through the session socket; `/trajectory` page; `/history` navigates session branches | structured tools and trajectory views | implemented on both; acceptance not recertified | PAR-002: acceptance not recertified |
 | Wiki browsing | `wiki/` | `wiki.*` | none | Wiki | host only | PAR-005 |
 | Variants and refinement | `variant/`, `refine/` | `harnesses.*`, `refine.*` | browser Variant tab (read-only), `xagent refine` | Harness screen | host only | PAR-004 |
-| Output trim and budget guard plugins | `plugins/firstParty.ts` | — | not loaded in terminals | loaded | host only | PAR-006 |
+| Output trim and budget guard plugins | `plugins/firstParty.ts` | trusted first-party hooks | `firstParty.list` loads enabled hooks in `terminal/piExtension.ts` | structured Harness sessions load enabled hooks | implemented on both; acceptance not recertified | PAR-006: acceptance not recertified |
 | Doctor | `doctor/` | `doctor.*` | `/doctor` | diagnostics | parity | — |
 | Run inspection | `sessions/runStore.ts` | `runs.*` | `/trajectory`, `/log` | run views, analytics | parity | — |
-| Session catalog (sessions per folder) | — | — | per-folder history | Solo thread list | planned | PAR-008 |
-| Folder choice and recent folders | `core/projects.ts` | — | launch folder only | working groups | planned | PAR-009 |
+| Usage analytics | `usage/` (PROP-0042) | `usage.summary`, `usage.sync` | `/usage:`, `/usage:analysis` page (Analysis tab) | not wired | terminal implemented; host planned | PAR-016 |
+| Provider limits | `usage/limits/` (PROP-0042) | `usage.limits` | `/usage:limit` page (Limits tab) | not wired | terminal implemented; host planned | PAR-016 |
+| Session catalog (sessions per folder) | `sessions/` saved-history controls; shared catalog not implemented | `sessions.*` controls; no cross-surface catalog method | `/session` selects native Pi histories in the current folder | `/session` reads `bridge.agent.threads(SOLO_ID)`, maps each thread to its project folder, and filters by current effective account; `all` broadens only this App list | planned; catalogs differ | PAR-008 |
+| Folder choice and recent folders | project/worktree selection remains surface-specific | launch `cwd`, `--worktree`, `/worktree` | starts in launch folder; explicit worktree commands | Solo sidebar is Project › Session; new sessions use the project's folder, with no folder/worktree level | planned; no shared recent-folder picker | PAR-009 |
 | Computer control | — | `computer_*` (host tools) | unavailable, with reason | macOS bridge (host-backed) | host-backed | PAR-007 |
 | Shared files vault | — | `files_*` (host tools) | none | Files | host only | PAR-007 |
 
+## Core slash-command surfaces (PROP-0040)
+
+These are the fixed `CORE_COMMANDS` entries. The App column records the current Solo source route,
+not a claim that it has passed acceptance. `commands.list`, a handler-completeness test, and source
+presence do not certify parity. Each command needs its own acceptance evidence; dynamic
+plugin/extension, prompt-template and skill commands are listed by `commands.list` but are not in
+this fixed table.
+
+| Command | Terminal surface | App Solo route in source | Acceptance / remaining gap |
+|---|---|---|---|
+| `/help` | Command list and palette | Searchable command picker; selection fills the composer | Not certified per command |
+| `/plan` | Plan request / mode toggle | Plan request; bare form toggles persistent plan mode; model Bash runs read-only (PROP-0043) | Not certified per command |
+| `/btw` (`/side`) | Contextual side-question dock | Shared side-question service; bare form dismisses the dock | Not certified per command |
+| `/new` | New conversation | Replaces focused tab with a draft; archives its saved session | Not certified per command |
+| `/stop` | Interrupt current reply | Stops the focused session's reply | Not certified per command |
+| `/session` (`/resume`) | Search/select native saved history in the current folder | Lists App Solo threads by folder and effective account; `all` widens only within that App list | PAR-008: separate catalogs; no native-history path opening; not certified |
+| `/history` (`/tree`) | Navigate branches in the current native session | Calls `session.navigate` with stable native entry ID; same-session navigation, optional summary, no fork fallback | Route uses Harness `sessions.navigate`; per-command acceptance pending |
+| `/fork` | Fork from a user message | Uses session tree/fork and opens the new session | Not certified per command |
+| `/clone` | Clone the current branch | Uses session clone and opens the copy | Not certified per command |
+| `/model` | Choose model | App model picker updates session runtime | Not certified per command |
+| `/effort` | Choose reasoning effort | Updates session runtime effort | Not certified per command |
+| `/thinking` | Toggle thinking display | Toggles transcript thinking visibility | Not certified per command |
+| `/name` | Name the native session | Renames the saved session | Not certified per command |
+| `/compact` | Compact current context | Runs Harness compact command | Not certified per command |
+| `/copy` | Copy last reply | Copies last reply to the clipboard | Not certified per command |
+| `/export` | Export HTML or JSONL | Runs Harness session export; relative paths resolve from the project folder | Not certified per command |
+| `/trajectory` | Inspect recorded runs | Opens trajectory view for the requested or latest run | Not certified per command |
+| `/reload` | Reload trusted resources and keybindings | Reloads Harness resources and refreshes command discovery | Not certified per command |
+| `/accounts` | Accounts page | Opens App Accounts | Not certified per command |
+| `/permissions` | Permissions page | Opens App approval settings | Not certified per command |
+| `/harness` | Harness resource browser | Opens App Harness screen | Not certified per command |
+| `/skills` | Skills browser shortcut | Opens Capability skills | Not certified per command |
+| `/connections` | Connections browser | Opens App connectors | Not certified per command |
+| `/mcp` | Connections browser shortcut | Opens the same App connectors view | Not certified per command |
+| `/tools` | Tools page | Opens Capability tools | Not certified per command |
+| `/plugins` | Full-screen local Plugins manager | Opens local Plugins manager | Not certified per command |
+| `/hub` | Separate full-screen Community Hub catalog | Opens Community Hub | Not certified per command |
+| `/components` | Components browser | Opens App Harness components | Not certified per command |
+| `/settings` | Terminal settings | Opens App settings | Not certified per command |
+| `/doctor` | Doctor checks, including explicitly confirmed live probes | Runs local readiness checks only | Not certified; App route does not expose live checks |
+| `/worktree` | Managed-worktree page and actions | Lists worktrees; Solo has no typed create/status/remove methods wired, and no worktree level | PAR-012; management actions unavailable; not certified |
+| `/subagents` | Live monitor and roster with the `main` row, restored on reopen | Opens latest run's trajectory, not a dedicated subagent roster | Not certified; surfaces differ |
+| `/agents` | Browse/create/edit/copy/delete profiles | Lists profiles only; detail/create/remove methods are not wired into Solo | PAR-010; management actions unavailable; not certified |
+| `/log` | Harness diagnostics and current run events | Opens latest run's trajectory, not a separate log reader | Not certified; surfaces differ |
+| `/hotkeys` | Keyboard controls | Opens App shortcut settings | Not certified per command |
+| `/quit` | Restore terminal and exit | Closes the focused Solo tab; does not exit the App | Not certified per command |
+
 The terminal-only display amendments [PROP-0026](architecture/proposals/PROP-0026-connected-sketch-display.md)
 and [PROP-0028](architecture/proposals/PROP-0028-normalize-question-wireframes.md) permit connected
 structural glyphs, frame-attached standalone dividers, and high-confidence boundary normalization
@@ -62,17 +116,19 @@ or live-model sketch quality.
 
 | ID | Gap | Planned change |
 |---|---|---|
-| PAR-001 | Checklist absent from the App | The terminal registers the tool and renders a checklist block; the App renders it too. |
-| PAR-002 | Wiki, history and trajectory reach terminal models only through a shell command | Register the harness tools in terminal sessions; retire the shell commands (drift D-4). |
+| PAR-001 | Todo list not rendered inline in the App | Both surfaces can show the current list: the terminal renders each write as a todo block and `/todo` shows a snapshot; the App's `/todo` shows a read-only list. The App still does not draw an inline block for each write. |
+| PAR-002 | Acceptance of terminal-model History/Wiki/skill tools | Source gap resolved: `Terminals.ownTools` registers History/trajectory, Wiki-read and skill tools over the session socket; `xagent-wiki` is a user-facing shell utility, not the model's only route. Acceptance has not been recertified in this documentation pass. |
 | PAR-003 | Continuation unused | `/resume` lists interrupted runs and continues one with `continueFrom`; the App offers Continue. |
 | PAR-004 | Refinement and adoption only in the App | Variant tab actions: start, candidates, adopt, trust. |
 | PAR-005 | Wiki browsing only in the App | A `/wiki` page over `wiki.*`. |
-| PAR-006 | First-party hook plugins not loaded in terminals | Load them through the terminal's trusted selection. |
+| PAR-006 | Acceptance of terminal first-party hooks | Source gap resolved: enabled hooks are returned by protected `firstParty.list` and loaded by `terminal/piExtension.ts`. Acceptance has not been recertified in this documentation pass. |
 | PAR-007 | Host tools without a Harness owner | Decide each: computer control stays host-backed (terminal shows unavailable); the files vault becomes a Harness capability or is dropped. |
-| PAR-008 | Separate session catalogs | A Harness session catalog per folder, read by both front ends (needs a proposal). |
-| PAR-009 | Folder choice | Built on PAR-008: recent folders in both front ends. |
-| PAR-010 | Agent profiles absent from the App | An Agents screen over `agents.*`, and the profile name and colour on subagent rows (PROP-0029). |
-| PAR-011 | Page annotations | Harness, terminal and App source done (PROP-0017, PROP-0018, 2026-10-24): the App calls `annotations.*`, imports its old notes once, uses the `page_notes_*` tools, and has the Annotate panel. Open: acceptance of the inspector and selection gestures in the running App's WKWebView. |
-| PAR-012 | Managed worktrees | Harness and terminal done (PROP-0016). The App creates through `worktrees.create`; its groups do not yet offer hand off, prune, restore or managed worktrees per thread. |
-| PAR-014 | Connected terminal sketch display | Closed by [PROP-0026 verification](evidence/terminal-connected-sketches/README.md) and extended by [PROP-0028 verification](evidence/terminal-wireframe-normalization/README.md): production PTY fixtures cover connected corners/tees, title-bearing rules, missing and whitespace-shifted side edges, internal table widths, frame-attached dividers, resize/panning and unchanged raw persistence/answers. Harness and host checks passed. Host literal rendering remains permitted; no host implementation change was required. This is fixture verification, not an every-font or live-model guarantee. |
+| PAR-008 | Separate session catalogs | Proposal approved; shared catalog is not implemented. Terminal `/session` selects native Pi history in the current folder. App `/session` reads Solo `agent.threads`, maps threads through Solo project groups, and filters to the current effective account and folder; `/session all` broadens only within that App catalog. It cannot open an arbitrary native session path. No cross-surface catalog or visibility guarantee exists. |
+| PAR-009 | Shared folder/recent-project choice | Terminal starts from its launch `cwd` and can switch through its worktree surface. App Solo uses Project › Session and starts new sessions in the selected project's folder; it has no folder/worktree level or shared recent-folder picker. |
+| PAR-010 | Agent profile management in Solo | App Solo `/agents` can list profiles. Although the renderer allowlist includes `agents.get`, Solo does not wrap it; `agents.create/remove` are not exposed there. Profile details and management actions are unavailable, unlike terminal `/agents`. |
+| PAR-011 | Web annotations | Harness, terminal and App source done (PROP-0017, PROP-0018, 2026-10-24): the App calls `annotations.*`, imports its old notes once, uses the `page_notes_*` tools, and has the Annotate panel. Open: acceptance of the inspector and selection gestures in the running App's WKWebView. PROP-0038 (2026-10-25): both front ends share the page helper, so open shadow roots work in the terminal's capture browser and the App's tabs alike; composed text capture, save, resolve and reveal were exercised in an isolated App WKWebView, inspector clicks were not. |
+| PAR-012 | Managed worktree management in Solo | Harness and terminal provide full worktree operations (PROP-0016). Solo `/worktree` lists records only: its renderer adapter does not wire typed `worktrees.create`, `status` or `remove` calls, and Solo session creation stays at the project folder with no worktree level. Handoff, branch, prune, restore and setup-trust actions are also absent from this Solo surface. |
 | PAR-013 | Expanded question wireframes and terminal layout | Closed by [PROP-0025 verification](evidence/terminal-question-wireframes/README.md): four-size production PTY acceptance covers aligned compact columns, body scrolling, pinned controls, Shift+arrow sketch panning and live resizing. Host contracts accept 80×24 literal ASCII sketches (1,943 bytes); six isolated browser tests include exact-boundary content, accessible overflow and unchanged selection/answers. This is controlled fixture acceptance, not live-provider or native Tauri evidence. |
+| PAR-014 | Connected terminal sketch display | Closed by [PROP-0026 verification](evidence/terminal-connected-sketches/README.md) and extended by [PROP-0028 verification](evidence/terminal-wireframe-normalization/README.md): production PTY fixtures cover connected corners/tees, title-bearing rules, missing and whitespace-shifted side edges, internal table widths, frame-attached dividers, resize/panning and unchanged raw persistence/answers. Harness and host checks passed. Host literal rendering remains permitted; no host implementation change was required. This is fixture verification, not an every-font or live-model guarantee. |
+| PAR-016 | Usage analytics and provider limits in the App | The terminal has `/usage:analysis` and `/usage:limit` over `usage.*`. The App presents the same capability: an analytics view and a per-account provider limit view. |
+| PAR-015 | Native WebKit browser-tool coverage | The shared browser schema is wider than the native backend. Native WebKit supports navigation, tabs, visible-text reads and scrolling without refs. Accessibility snapshots, snapshot-ref interactions (including click/type/select/ref-scroll), browser screenshots, waits and keyboard presses return an explicit `browser_unsupported` refusal before effects; there is no automatic switch to the isolated Harness browser. See page 13 and the native backend's `surfaces` note. |

package/docs/releases/1.1.1.md

@@ -0,0 +1,28 @@
+# Xingular Harness 1.1.1
+
+The first published release of the 1.1 line, and npm `latest`. It follows the published 1.0.0
+baseline. The 1.1.0 tag was pushed, but its release run stopped before publishing, so nothing was
+published under 1.1.0.
+
+## Agent profiles and named subagents
+
+- A subagent can start from a named profile: the built-in `worker` and `explorer`, a person's
+  `<data root>/agents/<name>.md`, a repository's `.xingular/agents/<name>.md`, or a variant's c5
+  subagent. A profile narrows the child's tools and plugins and may choose its variant, model and
+  effort (PROP-0029, ADR-0030).
+- The parent names each subagent. `spawn_subagent` requires a short `title`; `subagents.spawn`
+  takes an optional one (PROP-0030). The live roster, `/subagents` and the transcript show the
+  title.
+- The terminal runs the checklist tool and shows each write as a checklist block. An in-progress
+  item shows a yellow dot, and a running subagent's row shows the working spinner in its profile's
+  colour.
+
+## Release pipeline
+
+- The release pack and smoke scripts take their npm cache from the system temp folder. They
+  previously used a macOS-only path, which failed on Linux runners.
+- The `/help` terminal check matches the documented grouped, scrollable help: it pages until every
+  group is seen, and its expected group is `Plugins`.
+
+Checks for this release: `npm run ci` (148 test files, 1111 tests), the exact-tarball fresh
+installation smoke test including the packaged terminal, and the release preflight.

package/docs/releases/1.2.0.md

@@ -0,0 +1,49 @@
+# Xingular Harness 1.2.0
+
+This release builds on the published 1.1.1 line.
+
+## Compatibility note
+
+The filesystem root cannot be used as an active workspace, because that would make the boundary
+meaningless. The workspace boundary is intentionally stricter: model-controlled writes outside the active project,
+including writes to temporary directories, require a one-call approval unless the eligible Full
+Permission switch is explicitly enabled. Remembered per-tool grants do not cover them; unattended
+runs cannot request approval. The Full Permission switch remains off by default. A workspace with
+an external hard-link alias blocks default-scope Bash until the alias is removed or the file is
+replaced with a copy. Native writes use atomic replacement and preserve ordinary file mode where
+possible; ACLs and extended attributes are not guaranteed to survive replacement. On macOS, the
+sandbox also blocks workspace-local hard-link creation.
+
+## Workspace write boundary
+
+Model-controlled file writes and Bash are scoped to the active project workspace by default. Native
+write/edit operations revalidate the target and atomically replace the directory entry under an
+OS-enforced write scope, so an in-workspace hard link does not modify an outside alias. Default Bash
+scans for external hard links and runs in an OS sandbox that prevents cross-boundary hard-link
+creation; unavailable or incomplete enforcement fails closed. Reads remain unchanged. Explicit
+outside Bash writes require pre-execution one-call approval and run exactly once (`workspaceWriteScope:
+'outside'`; in the terminal composer, `!outside <command>`). The approval shows the complete quoted
+command in scrollable details; if the terminal is too small to show both details and choices, the
+request is denied. Command output cannot trigger approval or automatic retry. Runs record their
+resolved `workspaceRoot`; older run records remain readable.
+Protection from a separate same-user process outside Harness is not provided.
+
+## Planning and run continuity
+
+Plan mode now requires evidence-grounded repository research and can delegate bounded read-only investigations to eligible research profiles. After compaction, active runs rehydrate the latest checklist and plan instructions. The terminal keeps the latest subagent status visible until its next run.
+
+## Terminal commands and annotations
+
+Plugin-owned terminal commands use `/<owner-prefix>:<command>`, while Harness-owned routes such as `/doctor`, `/worktree`, `/trajectory`, `/subagents`, and `/agents` are first-class core commands. Prior command forms remain hidden compatibility aliases for one release; migrate scripts and keybindings to the canonical names.
+
+The annotation inspector now supports content in open shadow roots, including composed selections and targets. Closed shadow roots and frames remain unsupported, and existing document-only annotations retain their behavior.
+
+## Terminal interaction
+
+`/session` without a path now opens a searchable saved-session picker. Composer history includes user prompts, Bash commands and executed slash commands; browsing temporarily replaces the draft and restores its cursor, mode and attachments when it returns. Compact question docks now size each tab independently, keep nested sketches scrollable, and preserve page-footer hints at narrow widths.
+
+## Performance evidence
+
+Adds reproducible PTY and session-runtime profiling and publishes the [EXP-0003 report](../experiments/EXP-0003-performance-audit/results.md). That report is a 1.1.1 baseline captured from a dirty worktree, not a clean 1.2.0 benchmark; it also records a failed narrow-width `/settings` footer check and other measurement limits.
+
+Node 22.19 or later is required. Building or running the standalone terminal also requires Bun 1.3.14 or later. See the project license and notices for third-party terms.

package/docs/releases/1.3.0.md

@@ -0,0 +1,21 @@
+# Xingular Harness 1.3.0
+
+This minor release builds on 1.2.0 with clearer run progress, more reliable work-slice limits, bounded plan research, and distinct local-plugin and Community Hub experiences.
+
+## Run progress and work slices
+
+- `session_name` guidance names the session before the first tool call when a request needs tools or changes state. Multi-step work uses `todo_write`; the prompt and tool descriptions share the same concrete guidance.
+- The run checklist is now a todo list: `todo_write`, `todo.updated`, `runs.todo`, the `todo` plugin and a terminal todo block. `/todo` displays the current list without a model request; `/checklist` remains an alias. Existing `checklist.updated` events are still read, and legacy pinned tools and server methods remain available as deprecated compatibility aliases for one release.
+- Work slices default to 320 tool calls and 60 minutes, with no token cap unless configured. Stall detection recognizes meaningful progress, bounds repeated calls by name and arguments within each reply, and resets its counters between replies.
+- Plan research can delegate only to named profiles whose effective tools and plugins qualify for read-only research. The active plan and latest todo list are restored after compaction.
+
+## Plugins and Community Hub
+
+- `/plugins` is a dedicated local plugin manager for installed packages, switching, trust, settings, install, update and removal. `/hub` is a separate Community catalog with Catalog and Installed views; Installed retains receipts from every channel and labels each channel.
+- Hub shows cached or bundled catalog entries before refreshing remotely, and exposes origin, refresh time and stale/error status. Registry/document entries keep a bounded payload Preview; Pi packages have no payload Preview. Hub-owned packages remain pinned to receipt versions: removal is receipt-aware, and floating plugin updates cannot silently replace them.
+- No catalog schema or storage migration is required; existing receipts, settings and trust remain intact. The broad `/harness` resource browser remains available.
+
+## Terminal
+
+- Skill completion and syntax highlighting distinguish enabled skill invocations, command names and arguments while retaining the existing composer workflow.
+- Doctor's Bash readiness check now requires the platform write-boundary sandbox. Its live check runs one fixed, no-network command through the same workspace boundary as normal Bash, reports only the exit status, and stays subject to policy without being widened by Full Permission.

package/docs/releases/4.0.0.md

@@ -8,11 +8,11 @@ terminal command namespace, documented below. Earlier published versions remain
 
 - Managed Git worktrees for sessions and the terminal, with leases, guarded setup scripts, handoff,
   pruning, restoration, and bounded snapshots that preserve uncommitted work.
-- Page annotations and queued notes, including capture, review, resolution, sharing, and delivery
-  through Harness methods and terminal `/plugin:annotate` and `/plugin:notes` pages.
+- Web annotations and queued comments, including capture, review, resolution, sharing, and delivery
+  through Harness methods and terminal `/annotate:` and `/annotate:notes` pages.
 - A unified terminal resource browser with persistent full-screen sections for browser tabs,
   plugins, skills, connectors, variants, and other Harness resources.
-- A full-screen `/trajectory` Runs/Events browser with searchable event details, selected-event
+- A full-screen `/history:trajectory` Runs/Events browser with searchable event details, selected-event
   JSON, and a responsive split-pane layout.
 - Additional terminal controls for browser settings, plugin settings, and subagent activity.
 - Fix Node 22 SQLite parameter binding in recall and run indexes, and guard worktree Git calls
@@ -31,12 +31,13 @@ credentials are configured inside an isolated Harness account.
 
 The new server methods are additive. The published executable is `xagent`, replacing the earlier
 `xharness` candidate command without a compatibility alias; scripts using that candidate name must
-be updated. Required built-in plugin commands use unprefixed names:
-`/subagents`, `/trajectory`, `/doctor`, and `/worktree`. Optional built-in and third-party extension
-commands use `/plugin:<command>`; the optional page-annotation commands remain `/plugin:notes` and
-`/plugin:annotate`. Update scripts and keybindings that used the earlier candidate's prefixed forms
-for required commands. Existing session, variant, account, plugin, and browser contracts remain in
-place. Install this exact version or use the `latest` tag; historical versions remain available.
+be updated. All plugin-owned terminal commands use `/<owner-prefix>:<command>`: for example,
+`/subagents:subagents`, `/history:trajectory`, `/doctor:doctor`, `/worktrees:worktree`, and
+`/annotate:annotate`. The annotation prefix root `/annotate:` opens the default capture pane, and
+`/annotate:notes` opens saved annotations. Existing `/plugin:<command>` and former bare required-plugin
+forms remain hidden compatibility aliases for one release. Existing session, variant, account, plugin,
+and browser contracts remain in place. Install this exact version or use the `latest` tag; historical
+versions remain available.
 
 ## Verification scope
 

package/docs/releases/README.md

@@ -1,41 +1,46 @@
 # Release procedure
 
-1. Review and commit completed Harness changes on the active release branch. Review App
+1. Review and commit the completed Harness changes on the active release branch. Review App
    compatibility changes separately. Preserve old tags and exclude outputs, external references,
    and caches.
-2. Run npm run ci and the required App checks on unrestricted macOS/Linux runners. Install Bun
-   1.4.2 and use Node 22.19.0 for the release build. Do not waive failing checks.
-3. Run npm run release:pack. The unique output folder contains the candidate tarball, inventory,
-   SHA-256 checksum and npm integrity. Run npm run release:smoke -- <tarball> --terminal for a fresh
-   dependency installation and packaged SDK/server/terminal checks. --offline reuses the checkout's
-   installed dependency tree and is only a local smoke check, not fresh-install acceptance.
-4. Run npm run release:preflight. Verify npm scope ownership and trusted-publisher settings for
-   tanntnny/xingular-harness and workflow release.yml, with direct publishing enabled. No login is
-   started automatically. An already-used target version or unreachable registry blocks publication.
-5. Present the exact commit, candidate inventory/hash, notes and check results for approval. Pushing
-   the matching v<version> tag triggers publication; do not push it before this approval. Preserve
-   historical tags.
-6. After approval, push the reviewed commits and tag. The workflow runs both OS checks, packages
-   and tests one candidate, then publishes that same tarball with OIDC provenance and --tag latest.
-   No local publishing token is needed. It verifies registry integrity/provenance and creates a
-   GitHub release. Inspect registry state before retrying any failed publication.
+2. Run `npm run ci` and the required App checks. Require green CI on Ubuntu and macOS; install Bun
+   1.4.2 and use Node 22.19.0. Do not waive failing checks.
+3. Run `npm run release:pack` and inspect the candidate inventory, SHA-256 and npm integrity. Run
+   `npm run release:smoke -- <tarball> --terminal` for a fresh-install SDK/server/terminal check;
+   `--offline` is only a local smoke check, not fresh-install acceptance.
+4. Run `npm run release:preflight`. Verify npm scope ownership and trusted-publisher settings for
+   `tanntnny/xingular-harness` and `release.yml`, with direct publishing enabled. Configure the
+   GitHub `npm-publish` environment with required reviewers. No login is started automatically; an
+   already-used version, unreachable registry, or missing publishing configuration blocks release.
+5. Candidate approval is a pre-tag gate. Present the exact clean commit, candidate inventory,
+   SHA-256, npm integrity, release notes and check results for approval. Do not create or push the
+   matching `v<version>` tag until the person explicitly approves that candidate.
+6. After candidate approval, push the reviewed commit and matching tag. The workflow reruns CI on
+   both OSes, builds one candidate, and smoke-tests that exact tarball on both OSes. Before approving
+   the protected `npm-publish` environment, compare the uploaded candidate's commit, SHA-256 and npm
+   integrity with the approved local candidate; stop if they differ. This environment approval is a
+   separate publication gate. The publish job publishes that same tarball with OIDC provenance and
+   `--tag latest`, then verifies registry integrity/provenance and creates a GitHub release. No local
+   publishing token is needed. Inspect registry state before retrying any failed publication.
 
 A published version cannot be replaced. Corrections require a later version. This package's
 intentional 1.0.0 reset does not rewrite historical decisions or claim an ordering above older
 2.x–5.x development versions. Publication status and local evidence belong in the candidate report.
 
-## 4.0.0 candidate preparation
+## Historical 4.0.0 candidate evidence
 
-Local checks on the candidate source passed: Harness `npm run ci` (typecheck, 134 test files with
-1,004 passing tests and 3 skipped, plus the standalone proof); App typecheck, `npm test` (566 renderer
-tests, 47 sidecar tests, and 7 dev-signing tests passed with 1 skipped), layer check, and Rust tests
-(168 passed, 1 ignored); and App UI consistency. The registry lists 1.0.0 as `latest` and 4.0.0 as
-unused. The clean-tree release preflight passed. Exact-tarball packaging and a fresh-install smoke
-test passed, including the packaged SDK, types, CLI, server and isolated terminal. The tagged
-preflight, two-OS CI, and exact-tarball smoke are enforced by the release workflow. The npm
-trusted-publisher configuration for `tanntnny/xingular-harness` and `release.yml` requires
-package-owner verification; `npm login` does not verify that setting.
+The following report records a prior candidate and registry snapshot; it is not evidence for any
+current candidate or a description of the current release gates.
 
-The release workflow runs its full CI and exact-tarball smoke test on both Ubuntu and macOS before
-publishing. Branch upload and the matching release-tag push are separate GitHub side effects; only
-the tag triggers publication. No local test failure is waived by this note.
+At the time, local checks on that candidate source passed: Harness `npm run ci` (typecheck, 134 test
+files with 1,004 passing tests and 3 skipped, plus the standalone proof); App typecheck, `npm test`
+(566 renderer tests, 47 sidecar tests, and 7 dev-signing tests passed with 1 skipped), layer check,
+and Rust tests (168 passed, 1 ignored); and App UI consistency. The registry snapshot listed 1.0.0 as
+`latest` and 4.0.0 as unused. Its clean-tree preflight, exact-tarball packaging and fresh-install
+smoke test passed. The package-owner verification of npm trusted-publisher configuration for
+`tanntnny/xingular-harness` and `release.yml` was still required; `npm login` does not verify that
+setting. These results and registry values are historical.
+
+At that time, the workflow ran full CI and exact-tarball smoke on Ubuntu and macOS before publishing.
+The current workflow and approval gates are described above. No local test failure was waived by the
+historical report.

package/docs/study/00-index.md

@@ -20,6 +20,9 @@ written and the claim moves to checked behavior. Cite material as
   side question, and checked-out external implementations.
 - [Harness feature-gap review](feature-gap-review.md) — task/goal management, long-running work,
   memory, execution isolation, verification, and observability gaps against the studied peers.
+- [Why a long run takes hours](STUDY-0003-long-horizon-runs.md) — measured diagnosis of two 70–97
+  minute replies (447 and 266 tool calls, 5 and 2 compactions, zero assistant text), what other
+  harnesses do about it, and the fixes proposed in [PROP-0041](../architecture/proposals/PROP-0041-bounded-work-slices.md).
 
 ## Sources