@xingular/harness 2.0.0 → 2.0.1-unstable

package/docs/releases/1.3.1-unstable.4.md

@@ -0,0 +1,56 @@
+# Xingular Harness 1.3.1-unstable.4
+
+Unstable preview of the current Harness work. Install with `npm install @xingular/harness@unstable`.
+
+- Continue a terminal session from a phone or iPad with `/remote-control` (alias `/rc`), without a
+  cloud relay (ADR-0056, [page 15](../architecture/15-remote-control.md)). The harness serves a small
+  phone page on the computer's Tailscale address, or its private Wi-Fi address, and the terminal
+  shows a half-block QR code for a one-device pairing link. A paired phone sends messages, watches
+  the reply stream, stops it, and answers approvals and questions through the same `Terminals` and
+  controller methods the terminal uses. Bodies are sealed with NaCl `secretbox` and a replayed
+  counter is refused; device keys live in memory only, and remote control ends with the session.
+  `xagent --remote-control` (`--rc`) turns it on at start, `/rc off` stops it, and the status bar
+  reads `rc` while it is on and `rc ●` while a device is connected. Terminal runs now also record
+  streamed `message.delta` events. New dependencies: `tweetnacl`, `uqr`.
+- Classify a plan reply instead of guessing at it, and repair one bad reply. An attended top-level
+  plan run has one shared outcome: `plan_ready` for a complete `<proposed_plan>`, `blocked` when a
+  required decision cannot be obtained, and `invalid` for missing, incomplete, conflicting or
+  malformed blocks; only `plan_ready` offers a plan card and Implement (ADR-0055, ADR-0057,
+  ADR-0058). An `invalid` reply gets one hidden format-repair turn in the same run, and a failed
+  repair leaves the run completed with a warning instead of a plan choice. Clarification now goes
+  through the blocking `ask_user` tool, so new final replies no longer use `<plan_clarification>` or
+  free-text questions. Both the server and the terminal use the same classification rather than
+  separate heuristics. The App's plan card has not adopted the classification yet.
+- Report a live reply's heartbeat every 30 seconds, and end a reply that produces nothing but
+  heartbeats for 15 minutes as `interrupted` with reason `stalled`, instead of showing a run that
+  never settles (ADR-0054). A running tool gets 30 minutes, and an unanswered approval or question is
+  never cut short. Before this, a terminal reply reported no heartbeat at all, so the run sweep
+  waited the full 30-minute silence window and recorded `owner_gone` while the process was alive.
+- Stop refusing repeated work (ADR-0053). A reply is no longer refused or ended for calling the same
+  tool with the same arguments three times, for a Bash check that keeps failing, or for editing one
+  path more than four times: those calls are ordinary work and the reply budget is the single bound.
+  The 320-call/60-minute budget, its checkpoint handoff, slice continuation and the
+  three-compaction thrash rule are unchanged, and the `stuck` checkpoint reason stays readable in
+  existing runs.
+- Answer what the latest request was made of with `/context`. The page has a Request tab (one row per
+  contributor with its estimated tokens and share of the window, four-colour ownership bar with a
+  free track and a compaction marker) and a Growth tab (how the window filled over the session).
+  `space` folds a group, `enter` shows one row's text, `g` switches grouping between owner and kind,
+  and `c` asks the session to compact. `terminal.context` serves it from `context.attribution`; the
+  status band reads the same share, such as `18.3%/1M`.
+- Render the `/btw` side answer as Markdown instead of plain text. Headings, emphasis, lists, quotes,
+  links, tables and fenced code use the theme's markdown colours, a streaming answer re-renders in
+  place, and terminal control sequences in model output are still removed.
+
+## Upgrading
+
+- Two new runtime dependencies arrive with remote control: `tweetnacl` and `uqr`.
+- A plan reply that ends in `<plan_clarification>` or a free-text question is now `invalid` and gets
+  the single repair turn; use `ask_user` for a decision the run needs before it can plan.
+- The `stuck` checkpoint reason is no longer produced, but it stays readable in existing run records.
+
+## Publication note
+
+This preview was published with the test job removed and without waiting for the smoke job, by
+request. The `check` job and the smoke gate are restored in the next commit; the candidate pack,
+integrity check, preflight, provenance and registry verification in the publish job still ran.

package/docs/releases/1.3.1-unstable.5.md

@@ -0,0 +1,53 @@
+# Xingular Harness 1.3.1-unstable.5
+
+Unstable preview of the current Harness work. Install with `npm install @xingular/harness@unstable`.
+
+- Namespace plugin commands (ADR-0061). A plugin-owned extension command and a plugin-owned prompt
+  template now share one owner namespace, `/<owner-prefix>:<name>`, and bare plugin aliases are
+  gone. A package can name its root template with `harness.defaultPrompt`; owner and route
+  collisions fail closed. Standalone templates, `/skill:<name>` and the core commands are
+  unchanged, and structured sessions route through the same registry.
+- Make an approval a control, never a typed permission (INV-GATE-9, ADR-0060). The compiled
+  guidance tells the model to call the tool, and the Harness pauses that exact call in
+  `waiting_for_approval`; Allow resumes it in the same turn and a denial returns a tool result on
+  the still-running turn. No surface accepts a typed approval instead of a control, nothing outside
+  the workspace changes before the click, and Full Permission remains the standing bypass.
+- Record refusals and stop codes (ADR-0059). The gate and the work-slice bound emit `tool.refused`
+  with a bounded reason and a code (`plan_mode`, `workspace`, `scope`, `policy`, `capability`,
+  `approval_denied`, `unattended`, `work_slice`, `controller_unavailable`), `trajectory_search`
+  reports `terminalReason` and `terminalCode`, and `/trajectory` shows both. Compaction events carry
+  the token measurements that were available when they happened; older run records still read.
+- Answer `/context` from one run view. The page gains a Run details tab fed by
+  `context.runDetails`, listing the facts a run recorded (status, mode, model, effort, variant
+  version, workspace, tools and more), with `null` where a record has no such fact.
+- Keep a refused question answer in the terminal. A choice, note or typed answer the Harness would
+  reject stays in the dock with an inline reason naming the question and the field, instead of
+  closing the form and losing the draft.
+- Scroll a `/btw` answer taller than its block: PageUp/PageDown reach the side-question dock while
+  it is open and the wheel over the block browses it. When the answer fits, those keys scroll the
+  transcript as before.
+- Drop the context-use figure from the composer status line, so it no longer ends the token group
+  with a reading such as `6.6%/?`. The project and branch, account, model and effort, and the
+  input/cache hit rate/output tokens remain; the share of the window stays in the `/context` page
+  header. Both the OpenTUI status bar and the exported `tui/status` band lose the reading.
+- Define the interaction side of computer control, still host-owned (PAR-007). `computer/control.ts`
+  is an unregistered adapter whose backend must revalidate session approval, window identity and run
+  liveness at the point of effect; `computer/boundary.ts` builds the approval details for one action
+  against one window; `computer/terminalCapture.ts` is the trusted host contract for a
+  person-selected window with a fresh decision per capture. The Harness registers no computer tool
+  and ships no backend, so the terminal has no computer screenshot or interaction surface; a host
+  that cannot guarantee the contract must not supply one.
+
+## Upgrading
+
+- A bare plugin command such as `/xdiag` no longer resolves. Use the owner namespace,
+  `/<owner-prefix>:<name>`; `xingular-devkit` 0.2.0 ships `harness.commandPrefix` `xdiag`.
+- A typed "yes" is never an approval. Deny a call to end it; Allow resumes that same call.
+- Run records gain refusal events, `terminalReason` and `terminalCode`. Older records remain
+  readable and report `null` for a fact they did not record.
+
+## Publication note
+
+This preview was published with the test job removed and without waiting for the smoke job, by
+request. The candidate pack, integrity check, preflight, provenance and registry verification in
+the publish job still ran. The `check` job and the smoke gate are restored in the next commit.

package/docs/releases/1.3.1-unstable.6.md

@@ -0,0 +1,31 @@
+# Xingular Harness 1.3.1-unstable.6
+
+Unstable preview of the current Harness work. Install with `npm install @xingular/harness@unstable`.
+
+- Refine a variant from the terminal and keep checkpoints of it (PROP-0052, ADR-0065, ADR-0066).
+  `/refine [what to look at]` replays the latest request typed in this chat from a snapshot of the
+  folder as that turn found it, in throwaway shared clones, after a confirmation that shows the run
+  count and models; it runs in the background, and `/refine review` shows every candidate's changes
+  and output and adopts any of them. Guidance reaches improvers and composers only, never the blind
+  selector. Task runs default to this chat's model; `--model` sets the improver's, and an adopted
+  version records the model it was tuned on. `/variant` switches this conversation to another
+  version at the next turn (resuming the same conversation), restores, compares, tags, and takes
+  single components back from an earlier version. New methods: `refine.fromRun`,
+  `refine.candidateDiff`, `refine.candidateOutput`, `variants.tag|untag|tags|resolve|revert`. Run
+  records gain `workspaceSnapshot`, version records `tunedFor`, and scopes `tags.json`.
+- Start a conversation this account cannot use on the account's newest selection. A resumed
+  conversation keeps its model while the account offers it and holds its provider's credentials;
+  otherwise the terminal starts it on the mode's choice, then normal's, then the newest selection in
+  any mode, with that selection's effort, writes the model change into the conversation, and says in
+  one notice which model it replaced. A fallback is never saved as the person's choice, and with no
+  usable saved model Pi's own fallback message stands (ADR-0064).
+- Make unfinished-work handoffs actionable: the stable reporting guidance now names the person’s
+  concrete decision or the next action and its owner for each material blocker, without imposing a
+  fixed heading (PROP-0051, ADR-0063).
+- Share the account sign-in between `npm run dev` and the installed `xagent`. A standalone launch
+  can now take its account identity from another state directory with `--account-state <dir>`
+  (`HarnessOptions.accountsDir` plus that state's `secrets.json`), and `npm run dev` passes the
+  installed one, so one provider sign-in serves both while development keeps its own data,
+  approvals and plugin trust (ADR-0062).
+
+Published without the test suites, by request.

package/docs/releases/1.3.1-unstable.7.md

@@ -0,0 +1,17 @@
+# Xingular Harness 1.3.1-unstable.7
+
+Unstable preview of the current Harness work. Install with `npm install @xingular/harness@unstable`.
+
+- Keep the provider cache working after a compaction (ADR-0067). The compaction checkpoint now arms only
+  for a compaction during the running reply, is built once, and sits right after the summary instead
+  of being rebuilt at the end of every request. A request after a compaction is again the previous
+  request plus new items, so Codex WebSocket continuation and prefix caching apply. Before, every later
+  turn of a compacted session resent its whole context: one measured session fell from 94–99% to
+  18–24% cache hits after its first compaction.
+- Flag a low prompt-cache hit rate in the terminal's composer status bar. `R<percentage>%` now covers the
+  last 10 model responses instead of the whole session (`recentCacheUsage`, `CACHE_HIT_WINDOW`), and
+  gets a yellow `⚠` below 70 percent and a red one below 40 percent. Each drop to a worse level posts
+  one transcript notice. A window of one response, or one with no cache reads or writes, is not judged
+  (`cacheHitLevel`, `CACHE_HIT_WARNING_PERCENT`, `CACHE_HIT_CRITICAL_PERCENT`).
+
+Published without the test suites, by request.

package/docs/releases/1.3.1-unstable.8.md

@@ -0,0 +1,19 @@
+# Xingular Harness 1.3.1-unstable.8
+
+Unstable preview of the current Harness work. Install with `npm install @xingular/harness@unstable`.
+
+- Reword the final-reply guidance so the outcome leads and structure follows what the answer needs. The
+  reporting guidance is part of every request's stable prefix, so this changes the cached prefix.
+- Keep the provider cache working after a compaction (ADR-0067). The compaction checkpoint now arms only
+  for a compaction during the running reply, is built once, and sits right after the summary instead
+  of being rebuilt at the end of every request. A request after a compaction is again the previous
+  request plus new items, so Codex WebSocket continuation and prefix caching apply. Before, every later
+  turn of a compacted session resent its whole context: one measured session fell from 94–99% to
+  18–24% cache hits after its first compaction.
+- Flag a low prompt-cache hit rate in the terminal's composer status bar. `R<percentage>%` now covers the
+  last 10 model responses instead of the whole session (`recentCacheUsage`, `CACHE_HIT_WINDOW`), and
+  gets a yellow `⚠` below 70 percent and a red one below 40 percent. Each drop to a worse level posts
+  one transcript notice. A window of one response, or one with no cache reads or writes, is not judged
+  (`cacheHitLevel`, `CACHE_HIT_WARNING_PERCENT`, `CACHE_HIT_CRITICAL_PERCENT`).
+
+Published without the test suites, by request.

package/docs/releases/1.3.1-unstable.9.md

@@ -0,0 +1,54 @@
+# Xingular Harness 1.3.1-unstable.9
+
+Unstable preview of the current Harness work. Install with `npm install @xingular/harness@unstable`.
+
+- A reply can no longer quietly stop with work open (ADR-0069, ADR-0071). In attended top-level runs,
+  terminal included, a reply that ends while its todo list has open items is sent back to the model,
+  naming the items, up to three times per reply and never after a nudge produced no work; such a reply
+  settles `interrupted` with the stop codes `needs_person` or `unfinished`, never `completed`, with a
+  checkpoint the harness writes from the todo list, files and checks. `checkpoint_write` is removed.
+  The work-slice budget now covers the whole reply, so Pi's own continuations no longer reset it.
+  A live terminal session keeps the code it started with, so restart it to get the gate.
+- A completion check decides whether a reply may end (ADR-0071). When a reply that did work ends with
+  its todo list closed or absent, the run's own model, at low effort and with a fresh context, judges
+  the person's request against what the reply did: `done`, `continue` (the reply is sent back with the
+  reason and next step) or `needs_person`. It shares the stop gate's cap of three nudges per reply and
+  its no-progress rule, its request counts in the run's usage, and any failure leaves the reply as it
+  was. `finish` is removed: a live run used it after 23 seconds to ask something the handoff already
+  answered. `XINGULAR_STOP_GATE=off` and `XINGULAR_COMPLETION_CHECK=off` switch either layer off at
+  launch.
+- The model is told it has `edit` and `write`. Pi drops the definition's prompt line and guidelines for
+  its edit and write tools and lists only tools that have one, so every terminal and headless run's
+  system prompt named only `read` and `bash`; models edited files through shell scripts instead (one
+  2-hour run: 156 script edits, 14 failed, no `edit` call). `createWorkspaceFileTools` now restores the
+  prompt line and guidelines, for the terminal and the runner alike.
+- A plan no longer leaks its tools into normal mode. A rebuild before Pi recorded the restored normal
+  set (a new runtime, resume, switch, fork or tree navigation) replayed the plan set, so normal work
+  ran without `edit`, `write`, browser and connected-app tools even though the model had planned to use
+  them. The terminal now marks each plan request in the session and restores the normal set after any
+  rebuild.
+- Terminal replies continue across work slices (ADR-0070). A reply that reaches its 320-call or
+  60-minute budget after doing work continues in place as the next slice, with a checkpoint and a
+  notice, up to 8 slices, instead of waiting for "continue" and re-sending the whole context uncached.
+  Fruitless, blocked, failed, aborted and plan slices still stop. `XINGULAR_WORK_SLICE` also accepts
+  key=value pairs such as `maxToolCalls=15,maxSlices=3`.
+- One copy of each credential: no more `invalid_grant` from terminals. A terminal kept the account's
+  tokens in its own `auth.json` under its own lock while the host, its subagents and usage probes
+  refreshed the same token in the Keychain, and `terminalEnd` copied the file back over whatever the
+  Keychain held; OpenAI rotates refresh tokens, so whichever side refreshed second failed. A terminal
+  now reads and refreshes through the host store (`accounts.credentials.*`, INV-ACC-5), holding its
+  lock for the refresh, and folds in an `auth.json` left by an older terminal, newest token first.
+- A stalled terminal reply is recorded as `stalled`. Pi's abort reports through `terminal.interrupt`
+  like a person's Esc, which closed the run as `user_abort` before the reply settled as `stalled`; one
+  silent 15-minute hang was recorded as the person's abort. The interrupt now carries the stall, and an
+  interrupt also ends a settling reply's wait for its subagents.
+- `spawn_subagent` returns the child's tools, and the read-only profiles say up front when a brief needs
+  a tool they lack.
+- Prompt: the role paragraph sets the scope of the work — the obvious adjacent step, what the work
+  itself exposes, the check it needs, inside the working folder and away from what a person must decide
+  (a deploy, a secret, remote data, money), without asking first inside those bounds — and the
+  reporting guidance requires `## Beyond what you asked` and `## What would make this complete` when
+  they apply (ADR-0068). The role budget rises from 1,500 to 2,200 characters and the reporting budget
+  from 2,000 to 2,400. All of it is stable-prefix text, so the cached prefix changes once per session.
+
+Published without the test suites, by request.

package/docs/releases/1.4.0-unstable.md

@@ -0,0 +1,25 @@
+# Xingular Harness 1.4.0-unstable
+
+Unstable preview of the current Harness work. Install with `npm install @xingular/harness@unstable`.
+
+- **Long-running `/goal` sessions.** Start a bounded goal run, inspect and update its goal, pause or
+  resume it, and let the completion check judge the goal when the run claims completion. Ordinary
+  replies no longer incur a model-judged completion check.
+- **Completion and continuation guidance.** Codex-inspired prompt sections cover autonomy,
+  persistence, steering, compaction and clear handoffs. Reporting guidance is expanded with examples
+  and concrete requirements for changes, checks, blockers and follow-up actions.
+- **Skill installation and discovery.** The plugin-authoring skill documents supported skill
+  locations and safe install routes. Foreign plugin manifests can expose skills, and plugin
+  installation rejects repository `tree` and `blob` page URLs with actionable guidance.
+- **Terminal and session fixes.** Terminal behavior now accounts for the goal lifecycle, retains the
+  right completion behavior, and includes related prompt, status and lifecycle updates.
+
+Test suites were not run for this candidate, at the request to bypass tests.
+
+Published from commit `5f4c907` with a manual `npm publish --access public --tag unstable`, after the
+reviewed candidate was built from the same commit (SHA-256
+`2b1c12ddcd4c63a57714ab3538ff5198dec88d408230a0ef42bb8ece22cffe00`). The published tarball has that
+relation recorded by its npm integrity, `sha512-zlPE8HB3X0iR7AqELgYMVJzWjZMlEFdOKCjBJHyxQreWaDwyGnZ5M83rcA4Op/+CgGpl8BuYwFOcjcXa6Fayeg==`.
+Because the suites and the exact-tarball smoke checks did not run, and the workflow's OIDC publish path
+was not used, this version carries no provenance attestation and `scripts/release-verify.mjs` cannot
+verify it. The release workflow's gates are unchanged for the next release.

package/docs/releases/1.5.0-unstable.md

@@ -0,0 +1,32 @@
+# Xingular Harness 1.5.0-unstable
+
+Unstable preview of the current Harness work. Install with `npm install @xingular/harness@unstable`.
+
+- **No todo gate.** The stop gate, its three reminders and the `unfinished` status that open todo
+  items produced are removed. A reply the model ends settles `completed`; the goal loop and the
+  work-slice guard keep their stop codes and checkpoints. `XINGULAR_STOP_GATE` is retired.
+- **Codex's final-answer guidance.** The reporting section adopts Codex's `gpt-6.1-sol` wording:
+  self-contained final, outcome first, what changed and why, how it was tested, risks and limits,
+  evidence summarized, tables for comparisons, length by complexity, prose before lists. It falls
+  from 9.2k to 3.7k characters.
+- **Personality and model identity.** A person's own session reads Codex's personality paragraph,
+  and the identity names the model the session runs when the host knows it. The unclear-scope rule
+  uses Codex's wording with `ask_user` for the follow-up.
+- **Work rules and credentials.** The tool guidance gains Codex's `rg`-first search, shell quoting,
+  command-separator, variable-name and test-restraint rules, plus the skill and plugin principles.
+  A login that blocks the work is answered with the exact command.
+
+Test suites were not run for this candidate, at the request to bypass tests.
+
+Prepared from commit f7c6fce. The candidate was built from that clean commit: SHA-256
+`c58bbc67a22778f2724a9cbbc101a1bbbcd60434b05acab3013a3690a5c61fef`, npm integrity
+`sha512-PJLxG42u+Wq8AliaplF93kbQeC2vZiqUzPW4pVXDIViVG6AwrGxzu6EvPEE5dZRAysSD07Aw3cLzvnEwLMgfrQ==`.
+Published from commit f7c6fce with a manual `npm publish --access public --tag unstable`, after the
+candidate was built from the same commit (SHA-256
+`c58bbc67a22778f2724a9cbbc101a1bbbcd60434b05acab3013a3690a5c61fef`, tarball shasum
+`e372cb575bffe266ac40d0d5c58581b7c45db1f4`, npm integrity
+`sha512-PJLxG42u+Wq8AliaplF93kbQeC2vZiqUzPW4pVXDIViVG6AwrGxzu6EvPEE5dZRAysSD07Aw3cLzvnEwLMgfrQ==`).
+The registry held the version in its malware scan for about 27 minutes before `unstable` moved to
+it. Because the suites and the exact-tarball smoke checks did not run, and the workflow's OIDC path
+was not used, this version carries no provenance attestation and `scripts/release-verify.mjs`
+cannot verify it. The release workflow's gates are unchanged for the next release.

package/docs/releases/1.5.1-unstable.md

@@ -0,0 +1,24 @@
+# Xingular Harness 1.5.1-unstable
+
+Unstable preview of the current Harness work. Install with `npm install @xingular/harness@unstable`.
+
+- **Tool names in the terminal transcript.** Tools render in CamelCase (`todo_write` becomes
+  `TodoWrite`, `computer_screenshot` becomes `ComputerScreenshot`) instead of the raw tool id. The
+  todo card reads `Todo`, a custom message carries its type in the same form, a running child's
+  activity reads `Read` rather than `read`, and the phone page's transcript and approval card use
+  the same names.
+- **Claude Code prompt study.** `STUDY-0007` reads Claude Code v2.1.88's shipped prompt from the
+  leaked source map and compares it with this harness's pack in 20 areas;
+  `scripts/study-claude-prompt.mjs` reproduces the measurement.
+
+Test suites were not run for this candidate, at the request to bypass tests.
+
+The candidate was built from commit `f6870fb`: SHA-256
+`a9f49f244c160cf9bf9e6cf4192822ca658cba24f055c9196ea8a546bf5e45bd`, npm integrity
+`sha512-uWzJE+QJfmsgOuS+EHAc2hbAt6lvHmvzhVqkyAQfwj9rwVb+kkZXnzBk94qHATI17pS3mX8IyJjNePTYJFTsXg==`.
+Publication is blocked on npm's one-time password: publish the tarball with the browser flow, or push
+the `v1.5.1-unstable` tag and let the release workflow publish it with provenance.
+
+The tree has since moved past `f6870fb` (the transcript names reach the todo card, custom message
+types, a child's activity and the phone page), so that tarball predates part of the note above: build
+a new candidate from the current commit before publishing.

package/docs/releases/1.6.0-unstable.md

@@ -0,0 +1,59 @@
+# Xingular Harness 1.6.0-unstable
+
+Unstable preview of the current Harness work. Install with `npm install @xingular/harness@unstable`.
+
+- **Your own signed-in Brave profile (ADR-0082).** `/settings` → Browser now chooses the browser
+  backend: the isolated Harness profile, or Brave through a paired unpacked extension that ships in
+  the package. Pairing uses a one-time `port:code` over an authenticated loopback bridge; each site
+  is allowed separately by exact origin in the extension popup; an in-page badge offers Pause and
+  Stop. The agent gets the same `browser_*` tools and the same approval gate, snapshot refs
+  included, and `browser_upload` stays WebKit-only. A disconnect refuses calls and never falls back
+  to the isolated browser. New methods `browser.config`, `browser.configure` and
+  `browser.extension.status|start|stop`; `browser.json` gains `backend`.
+- **A reply that waits on children or on a flaky network no longer looks stalled (ADR-0078).** Each
+  subagent the reply waits on gets its own stall clock, the parent's clock pauses while it only
+  waits, and a transient model failure retries for about four minutes instead of fourteen seconds.
+  The working row says what the reply is doing: waiting on children, running a long tool, waiting
+  for the model, reconnecting, or making no progress.
+- **A plan run may conclude that no plan is needed (ADR-0077).** A plan reply with no plan block
+  ends as `no_plan` with no card, notice or repair turn. Only a block the model started and left
+  incomplete is repaired, once, in the same run.
+- **No work-slice budget by default (ADR-0081).** A reply is no longer ended at 320 tool calls or
+  60 minutes and continued as a "next slice". `workSlice` on a run and `XINGULAR_WORK_SLICE` still
+  set a budget, and the three-compaction guard stays.
+- **Phase-led, flexible reporting (ADR-0079).** The `reporting` guidance is written for a reader
+  picking up cold: verification that did not run says so, subagents get a concise caller-facing
+  report contract, and a substantial report may use content-named headings. The duplicated
+  progress-update line moved out of `reporting` and stays in `writing`.
+- **The follow-up and steering queue has a page.** `/follow-up`, and clicking a `Steer:` or
+  `Follow-up:` row, opens an editor for the queued messages with edit, send next, remove and
+  return. An explicit stop now sends one unconsumed steering message before the follow-ups.
+- **Question sketches use one 80-column canvas (ADR-0080).** The model draws on a fixed 80-column
+  canvas and the terminal pads every valid sketch to it, with the frame inside the dock and
+  horizontally pannable. Stored sketches and answer payloads are unchanged.
+- **CamelCase names everywhere in the transcript.** The 1.5.1 candidate predated the last of this
+  work, so this release carries the todo card, custom message types, a child's activity and the
+  phone page using the same `TodoWrite`/`ComputerScreenshot` form.
+
+Two prompt sections change (`reporting` and the work-slice wording), so the stable prefix misses the
+provider cache once per existing session after the upgrade. The Brave backend is opt-in and off by
+default; the isolated browser is unchanged.
+
+The release workflow builds the tarball from the `v1.6.0-unstable` tag, reruns CI on Ubuntu and
+macOS, smoke-tests that exact tarball on both, and attaches it with `SHA256SUMS` to the GitHub
+release before publishing it to npm's `unstable` dist-tag with provenance. The published SHA-256 and
+npm integrity are the ones in that attached file, which `scripts/release-verify.mjs` checks against
+the registry.
+
+Checks on this source before tagging: `npm run typecheck` clean; `npm test` green (220 test files,
+1,794 passing tests, 4 skipped); `npm run prove` green; `npm run release:smoke -- <tarball>
+--terminal` green in a fresh installation (SDK, subpaths, Doctor, packaged CLI, JSON-lines server
+and the terminal in an isolated PTY); `npm run release:preflight` reporting `1.6.0-unstable` unused,
+with `unstable` on `1.5.1-unstable` and `latest` on `1.2.0`. The tarball carries 880 files and the
+`browser-extension/` folder.
+
+The live Brave acceptance test did not run: it needs `XINGULAR_BRAVE_LIVE=1` and a disposable Brave
+window, so live control of a real profile is unverified here. The App's own checks were run against
+this Harness source and are reported separately: its typecheck reports pre-existing `@xingular/ui`
+prop-type errors (the `Xingular UI` path its tsconfig expects is absent), and one pre-existing Solo
+test fails because the App does not wire `/goal` (PAR-017). Neither comes from this change.

package/docs/releases/2.0.1-unstable.md

@@ -0,0 +1,63 @@
+# Xingular Harness 2.0.1-unstable
+
+Unstable preview of the current Harness work. Install with `npm install @xingular/harness@unstable`.
+2.0.0-unstable was tagged but never published; this is its first release.
+This is a 2.0 line because the terminal's runtime changes: `xagent` is now a client of the harness
+(ADR-0083), which adds methods and a socket transport and changes who owns execution in the
+terminal. The package API and the stored data layout are otherwise unchanged.
+
+- **One session runtime (ADR-0083): the terminal is now a client of the harness.** `xagent` runs no
+  agent loop in its window any more. Each turn is a harness run with the same gate, run records,
+  plan mode, goals and subagents as a host's, and the harness keeps the conversation's Pi session
+  open across turns (`sessions.run { live: true }`), so steering, queued follow-ups and plugin
+  state carry from one turn to the next. New methods `sessions.live`, `sessions.close`,
+  `sessions.followUp` and `sessions.followUp.clear`. `XINGULAR_TERMINAL_RUNTIME=inprocess` runs the
+  previous in-process runtime.
+- **A long-lived harness (opt-in).** `xagent daemon start|stop|status` runs one harness per state
+  folder on an owner-only socket; `xagent --daemon` windows use it, so a reply keeps running when
+  its window closes, and `xagent attach [session]` reconnects. Plain `xagent` is unchanged: its
+  window runs its own private harness.
+- **Every harness run now ends when it stops making progress.** A reply that produces nothing for
+  fifteen minutes (thirty with a tool running; a pending approval or a wait for subagents does not
+  count) is interrupted with reason `stalled`, whatever front end started it, and its live session
+  is closed rather than reused. Every run now sends the 30-second `heartbeat`, not only runs with a
+  work slice, so a long quiet tool is no longer settled as `owner_gone`.
+- **Switching accounts starts on the new account's model.** A conversation resumed on another
+  account that names a model this account cannot use starts on this account's own latest choice,
+  with a notice, instead of showing and sending the old account's model. Plan and normal mode keep
+  their own model and effort in the new terminal: a mode that never chose an effort starts on the
+  default rather than the other mode's, a mode switch during a reply waits for it to settle, and a
+  one-shot `/plan` runs on the plan mode's choice.
+- **The new terminal offers every effort level the model supports.** It stopped at `high`; it now
+  lists `xhigh` and `max` where the model maps them, and runs a model at the nearest level it
+  supports when asked for one it does not.
+- **Fenced code in labeled panels.** Code blocks appear in a bordered panel labeled with the fence
+  language, with tree-sitter highlighting where a grammar is bundled and lightweight Python, shell
+  and JSON highlighting otherwise. The final-answer prompt asks for language-labeled fences and
+  `bash` fences for commands the person must run.
+- **A reply whose provider request timed out and was retried successfully is now recorded as
+  completed**, not failed. A terminal window whose terminal closed no longer leaves its process
+  running.
+- Terminal runs now record Pi's session id as `nativeSessionId`, as host runs do (in-process runs
+  keep recording their history file). `/session` takes a saved conversation's session id as well
+  as its file. Plugin dialogs reach the window as questions.
+
+Two prompt lines change (the language-labeled fences), so the stable prefix misses the provider
+cache once per existing session after the upgrade.
+
+Behaviour changes to know about: in the default terminal, plugins get the host's interface
+(dialogs, notices, status lines and text widgets); custom terminal components, key handlers,
+renderers, shortcuts and themes need `XINGULAR_TERMINAL_RUNTIME=inprocess`.
+
+Known gaps: a list item's wrapped lines are not aligned beneath its text (the renderer that did
+that cost the blank rows between paragraphs, so lists wrap as in the previous release; Known drift
+D-32). Remote control (`/remote-control`) still belongs to a terminal session, so a phone cannot
+reach an App chat, and a reply that outlives its window under `--daemon` loses its phone
+(PAR-018). The stall guard was tested with a fake Pi session and fake timers; no live model
+request exercised it.
+
+The release workflow builds the tarball from the `v2.0.1-unstable` tag, reruns CI on Ubuntu and
+macOS, smoke-tests that exact tarball on both, and attaches it with `SHA256SUMS` to the GitHub
+release before publishing it to npm's `unstable` dist-tag with provenance. The published SHA-256 and
+npm integrity are the ones in that attached file, which `scripts/release-verify.mjs` checks against
+the registry.

package/docs/releases/4.0.0.md

@@ -0,0 +1,47 @@
+# Xingular Harness 4.0.0
+
+This major release builds on the published 1.0.0 baseline. It extends Harness-owned terminal
+surfaces and adds generic worktree and page-annotation capabilities; it also changes the built-in
+terminal command namespace, documented below. Earlier published versions remain available.
+
+## Included
+
+- Managed Git worktrees for sessions and the terminal, with leases, guarded setup scripts, handoff,
+  pruning, restoration, and bounded snapshots that preserve uncommitted work.
+- Web annotations and queued comments, including capture, review, resolution, sharing, and delivery
+  through Harness methods and terminal `/annotate:` and `/annotate:notes` pages.
+- A unified terminal resource browser with persistent full-screen sections for browser tabs,
+  plugins, skills, connectors, variants, and other Harness resources.
+- A full-screen `/history:trajectory` Runs/Events browser with searchable event details, selected-event
+  JSON, and a responsive split-pane layout.
+- Additional terminal controls for browser settings, plugin settings, and subagent activity.
+- Fix Node 22 SQLite parameter binding in recall and run indexes, and guard worktree Git calls
+  against early child-process exits while writing input.
+- Updated architecture and parity documentation for Harness capabilities and their terminal and
+  host surfaces.
+
+## Installation and requirements
+
+Use `npm install --global @xingular/harness@4.0.0`, then `xagent`. Node 22.19 or later is required.
+The interactive terminal also requires Bun; release CI uses Node 22.19.0 and Bun 1.4.2. Browser
+operation requires an installed compatible browser or a deliberately configured endpoint. Model
+credentials are configured inside an isolated Harness account.
+
+## Compatibility
+
+The new server methods are additive. The published executable is `xagent`, replacing the earlier
+`xharness` candidate command without a compatibility alias; scripts using that candidate name must
+be updated. All plugin-owned terminal commands use `/<owner-prefix>:<command>`: for example,
+`/subagents:subagents`, `/history:trajectory`, `/doctor:doctor`, `/worktrees:worktree`, and
+`/annotate:annotate`. The annotation prefix root `/annotate:` opens the default capture pane, and
+`/annotate:notes` opens saved annotations. Existing `/plugin:<command>` and former bare required-plugin
+forms remain hidden compatibility aliases for one release. Existing session, variant, account, plugin,
+and browser contracts remain in place. Install this exact version or use the `latest` tag; historical
+versions remain available.
+
+## Verification scope
+
+The Harness CI suite, standalone proof, App typecheck/tests/layer check/Rust tests, and App UI
+consistency check must pass for the reviewed release candidate. The release tag workflow separately
+builds and smoke-tests the exact tarball on its supported operating systems before publishing it
+with npm provenance.

package/docs/releases/README.md

@@ -0,0 +1,49 @@
+# Release procedure
+
+1. Review and commit the completed Harness changes on the active release branch. Review App
+   compatibility changes separately. Preserve old tags and exclude outputs, external references,
+   and caches. Stable versions use `X.Y.Z`; unstable previews use `X.Y.Z-unstable` or `X.Y.Z-unstable.N` and publish
+   to npm's `unstable` dist-tag. Use a new, unused version for every publication.
+2. Run `npm run ci` and the required App checks. Require green CI on Ubuntu and macOS; install Bun
+   1.4.2 and use Node 22.19.0. Do not waive failing checks.
+3. Run `npm run release:pack` and inspect the candidate inventory, SHA-256 and npm integrity. Run
+   `npm run release:smoke -- <tarball> --terminal` for a fresh-install SDK/server/terminal check;
+   `--offline` is only a local smoke check, not fresh-install acceptance. Unstable candidates go
+   through the same checks as stable releases.
+4. Run `npm run release:preflight`. Verify npm scope ownership and trusted-publisher settings for
+   `tanntnny/xingular-harness` and `release.yml`, with direct publishing enabled. Configure the
+   GitHub `npm-publish` environment with required reviewers. No login is started automatically; an
+   already-used version, unreachable registry, or missing publishing configuration blocks release.
+5. Candidate approval is a pre-tag gate. Present the exact clean commit, candidate inventory,
+   SHA-256, npm integrity, release notes and check results for approval. Do not create or push the
+   matching `v<version>` tag until the person explicitly approves that candidate.
+6. After candidate approval, push the reviewed commit and matching tag. The workflow reruns CI on
+   both OSes, builds one candidate, and smoke-tests that exact tarball on both OSes. Before approving
+   the protected `npm-publish` environment, compare the uploaded candidate's commit, SHA-256 and npm
+   integrity with the approved local candidate; stop if they differ. This environment approval is a
+   separate publication gate. The publish job publishes that same tarball with OIDC provenance and
+   `--tag latest` for stable versions or `--tag unstable` for unstable previews, then verifies the
+   matching registry dist-tag, integrity and provenance and creates a GitHub release (marked
+   prerelease for unstable versions). No local publishing token is needed. Inspect registry state before retrying any failed publication.
+
+A published version cannot be replaced. Corrections require a later version. This package's
+intentional 1.0.0 reset does not rewrite historical decisions or claim an ordering above older
+2.x–5.x development versions. Publication status and local evidence belong in the candidate report.
+
+## Historical 4.0.0 candidate evidence
+
+The following report records a prior candidate and registry snapshot; it is not evidence for any
+current candidate or a description of the current release gates.
+
+At the time, local checks on that candidate source passed: Harness `npm run ci` (typecheck, 134 test
+files with 1,004 passing tests and 3 skipped, plus the standalone proof); App typecheck, `npm test`
+(566 renderer tests, 47 sidecar tests, and 7 dev-signing tests passed with 1 skipped), layer check,
+and Rust tests (168 passed, 1 ignored); and App UI consistency. The registry snapshot listed 1.0.0 as
+`latest` and 4.0.0 as unused. Its clean-tree preflight, exact-tarball packaging and fresh-install
+smoke test passed. The package-owner verification of npm trusted-publisher configuration for
+`tanntnny/xingular-harness` and `release.yml` was still required; `npm login` does not verify that
+setting. These results and registry values are historical.
+
+At that time, the workflow ran full CI and exact-tarball smoke on Ubuntu and macOS before publishing.
+The current workflow and approval gates are described above. No local test failure was waived by the
+historical report.