@zhivex-ai/harness 0.10.0 → 0.11.1

package/CHANGELOG.md

@@ -4,6 +4,62 @@ All notable changes to Zhivex Harness are documented in this file.
 
 The project follows Semantic Versioning. During `0.x`, minor releases may change user-facing contracts when the change is documented with a migration note. Patch releases remain backwards compatible bug fixes.
 
+## Unreleased
+
+## 0.11.1 - 2026-08-23
+
+### Changed
+
+- Make provider live certification a fail-closed dependency of the publish job and bind manual certification runs to an explicit release tag.
+- Remove release-version defaults from GitHub workflow inputs. Maintainers enter the annotated tag at dispatch, and release readiness validates it against the single version source in `package.json`.
+- Keep release-artifact transfer actions pinned to immutable commit SHAs while allowing Dependabot SHA upgrades, and represent successful remote tag-bound certification explicitly in the release-status schema.
+- Add a mutable machine-readable repository release-status record, keep it outside immutable npm artifacts, and validate public documentation, release gates, and repository security configuration against it.
+- Bound installed-package smoke subprocesses by time and captured output so a stalled child process cannot hang release validation indefinitely.
+- Keep public documentation consistent with the published `0.11.0` artifact while preserving live-provider certification as a separate evidence boundary.
+- Retry only transient HTTP failures in the opt-in base provider smoke, using fresh temporary state and a bounded three-attempt schedule; contract and approval failures still fail immediately.
+- Preserve transient provider status from failed agent outputs before release-smoke contract assertions so retryable 429/5xx responses reach the bounded retry loop.
+- Mark create-only `expectedDigest: null` as an explicitly required tool-schema field and reinforce that contract in live certification prompts for providers that otherwise omit null-valued arguments.
+- Record current worktree live evidence separately from release-bound certification: the certified cohort passed every local gate, while Gemini Flash 3.7 passed base editing and delegation but remained blocked on provider quota/capacity during OCI execution.
+
+### Security
+
+- Add CodeQL, Dependabot, CODEOWNERS, and documented public-repository security controls. GitHub-side controls that are free for public repositories are enabled; optional cost-bearing analysis remains disabled and explicitly recorded. Live provider credentials are scoped only to the final provider-call step rather than checkout, setup, dependency installation, or deterministic validation.
+- Bind workspace, context, OCI, change-envelope, and release-artifact reads to bounded regular-file descriptors that reject symbolic links, hard-linked OCI exports, special files, and concurrent content replacement.
+- Create SQLite state files and benchmark canaries exclusively, stage release archives from the exact inspected bytes, pin registry identity independently of package metadata, and classify adversarial benchmark failures with a linear complete-token scanner.
+- Recover canonical `.cleanup-<artifact>-<uuid>` OCI artifact directories after interrupted cleanup without weakening inode and metadata revalidation.
+
+### Migration from 0.11.0
+
+No configuration, SQLite, approval, or execution-policy migration is required. Existing `0.11.0` state remains compatible; this patch tightens failure classification, cleanup recovery, and release boundaries.
+
+## 0.11.0 - 2026-08-21
+
+### Added
+
+- Add a dependency-free terminal presentation layer with sanitized/redacted activity events, complete governed approval cards, and `y`/`n`/`v`/`q` decision handling that never partially resolves a durable approval batch.
+- Add `/pending`, `/approve`, and `/deny` so a recovered chat session can inspect and resolve its durable approval without leaving the console; persisted provider, routing, context, and OCI policy are restored before resumption.
+- Add bounded project context/rule discovery, progressive `SKILL.md` disclosure, and version-bound trusted application lifecycle hooks. Repository configuration cannot register executable host hooks.
+- Add opt-in `run_environment_shell` through `--execution oci --oci-shell ask`. The exact script is approval-bound and interpreted only by `sh` inside the no-network OCI snapshot; host mutation still requires the separate content-bound import approval.
+
+### Changed
+
+- Advance resolved config schema to `5` and the OCI execution-policy fingerprint to `2026-08-21-v4`; complete paused `0.10.0` work with the published artifact rather than rebinding it to the changed tool/context surface.
+- Bound the live reviewer-delegation fixture to one read-only child tool call against a temporary repository with a known diff, avoiding provider-specific false failures caused by asking a reviewer to inspect an empty non-Git workspace.
+- Align the default mixed-provider live route with the certified cohort (OpenAI parent, Qwen reviewer); Gemini routing remains an explicit provisional certification target.
+- Await asynchronous harness shutdown throughout release, evaluation, smoke, and test callers so lifecycle hooks and OCI cleanup complete before process exit.
+- Emit `run-finished` only for terminal run states, and have `zhx doctor` load and validate configured project context before reporting readiness.
+
+### Migration from 0.10.x
+
+- Change schema-version-pinned configuration from `schemaVersion: 4` to `5`. Existing SQLite state remains readable, but paused approvals created by `0.10.x` must be completed or denied with the matching `0.10.x` artifact because context, hook, tool, and execution-policy fingerprints changed.
+- Await `harness.close()` in library cleanup paths. Lifecycle hooks can make shutdown asynchronous even when no execution environment is active.
+- Project context discovery is enabled by default. Use `--no-project-context` or `projectContext: false` when an embedding must ignore repository instructions; malformed explicit context manifests fail before provider execution.
+- OCI shell syntax remains opt-in. Existing OCI configurations keep `shellMode: "deny"`; set `--oci-shell ask` or `shellMode: "ask"` only when exact-script approval inside the no-network container is intended.
+
+### Security
+
+- Shell remains `deny` by default, is unavailable without OCI, never inherits host environment variables, and does not enable container networking. Command entrypoint lists do not claim to constrain every descendant process spawned inside the container.
+
 ## 0.10.0 - 2026-08-21
 
 ### Changed

package/README.md

@@ -13,7 +13,7 @@ Zhivex Harness runs coding agents against real repositories with conflict-safe e
 
 The model provides capability. The harness controls what it may inspect, execute, change, resume, and prove. Every provider uses the same bounded tool and approval contract.
 
-Version `0.10.0` is the source candidate for the Node-first runtime and package-manager-neutral repository checks. The latest public npm release is `0.9.0`; local validation does not imply that `0.10.0` has been published or release-certified. See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), the [change-envelope guide](./docs/CHANGE_ENVELOPES.md), the [CLI contract](./docs/CLI.md), the [extensibility guide](./docs/EXTENSIBILITY.md), and the [durable-operations guide](./docs/DURABLE_OPERATIONS.md).
+Version `0.11.1` is the current source release candidate; `0.11.0` remains the public npm release and `latest` distribution tag until protected publication completes. Candidate provenance and certification are pending in the [repository release status](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json). Publication is fail-closed on deterministic, installed-package, real-OCI, base-provider, orchestration, routing, and model-directed execution gates. See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), [public repository security](./docs/PUBLIC_SECURITY.md), the [change-envelope guide](./docs/CHANGE_ENVELOPES.md), the [CLI contract](./docs/CLI.md), the [context-engineering guide](./docs/CONTEXT_ENGINEERING.md), the [extensibility guide](./docs/EXTENSIBILITY.md), and the [durable-operations guide](./docs/DURABLE_OPERATIONS.md).
 
 ## Why Zhivex Harness
 
@@ -40,7 +40,15 @@ bun run demo:hostile
 
 The expected result is a schema-versioned JSON proof with `secretExcluded`, `networkDenied`, `exactlyOnceJournal`, and `staleHostImportBlocked` all set to `true`. Pass `--keep` to retain the disposable workspace for inspection. The complete scenario and evidence limits are documented in [docs/HOSTILE_REPOSITORY_DEMO.md](./docs/HOSTILE_REPOSITORY_DEMO.md).
 
-## What 0.10 changes
+## What 0.11 changes
+
+- adds a dependency-free terminal presentation layer with redacted activity, complete approval cards, and durable `y`/`n`/`v`/`q` decisions;
+- lets recovered chat sessions inspect and resolve their current approval with `/pending`, `/approve`, and `/deny` after restoring the exact persisted provider, routing, context, and OCI policy;
+- loads bounded `AGENTS.md`, project context, rules, and progressively disclosed skills while binding their digests into durable compatibility;
+- adds trusted application lifecycle hooks with versioned identities, bounded events, timeouts, and redacted failures; and
+- exposes exact-script shell syntax only through explicit `--execution oci --oci-shell ask`, preserving denied network and the separate host-import approval.
+
+## What 0.10 changed
 
 - makes Node.js `>=22.13.0` the primary public CLI and library runtime while retaining Bun-compatible imports and Bun-managed contributor workflows;
 - replaces `bun:sqlite` and `Bun.spawn` with `node:sqlite` and argv-only `node:child_process` boundaries without changing the durable SQLite file format;
@@ -90,7 +98,7 @@ The expected result is a schema-versioned JSON proof with `secretExcluded`, `net
 - protection against path traversal, symlink escapes, unsafe state targets, secret-file reads, special files, concurrent non-overwrite races, and unbounded output;
 - Linux/macOS CI, installed-tarball smoke coverage, and opt-in live-provider certification.
 
-It does not include arbitrary host shell access, `stdio` MCP, permanent deletion, Git writes, a desktop UI, a remote worker, or a managed sandbox service. Without `--execution oci`, shell-class tools remain unavailable. With OCI enabled, repository tools, checks, and enabled subagents share the acquired snapshot; network MCP is rejected because it cannot truthfully satisfy the no-network execution policy.
+It does not include arbitrary host shell access, `stdio` MCP, permanent deletion, Git writes, a desktop UI, a remote worker, or a managed sandbox service. Without `--execution oci`, shell-class tools remain unavailable. The opt-in `--oci-shell ask` policy exposes approval-bound `sh` only inside OCI. With OCI enabled, repository tools, checks, and enabled subagents share the acquired snapshot; network MCP is rejected because it cannot truthfully satisfy the no-network execution policy.
 
 ## Requirements
 
@@ -101,19 +109,13 @@ It does not include arbitrary host shell access, `stdio` MCP, permanent deletion
 
 ## Installation
 
-The currently published `0.9.0` package still uses the Bun-first runtime:
+After protected publication, install the Node-first `0.11.1` artifact with an exact version:
 
 ```bash
-bunx --package @zhivex-ai/harness@0.9.0 zhx --version
+npx --yes --package=@zhivex-ai/harness@0.11.1 zhx --version
 ```
 
-After the exact `0.10.0` artifact is published and registry-verified, the Node-first installation is:
-
-```bash
-npx --yes --package=@zhivex-ai/harness@0.10.0 zhx --version
-```
-
-Do not omit the version while npm `latest` still resolves to `0.9.0`. To exercise the `0.10.0` source checkout now, contributors use Bun for deterministic repository tooling while the built CLI itself runs on Node:
+To exercise the source checkout, contributors use Bun for deterministic repository tooling while the built CLI itself runs on Node:
 
 ```bash
 bun install --frozen-lockfile
@@ -153,7 +155,9 @@ zhx chat --continue
 zhivex-harness --version
 ```
 
-Inside the console, `/help` lists `/provider`, `/model`, `/route`, `/status`, `/diff`, `/review`, `/resume`, `/compact`, `/new`, `/rename`, and `/exit`.
+Inside the console, `/help` lists `/provider`, `/model`, `/route`, `/status`, `/diff`, `/review`, `/resume`, `/pending`, `/approve`, `/deny`, `/compact`, `/new`, `/rename`, and `/exit`. Tool and step activity is rendered without tool payloads; approval cards sanitize terminal controls and keep governed edit/command payloads fully reviewable.
+
+Project context engineering is enabled by default. A root `AGENTS.md` plus an optional `.zhivex/harness.json` can declare bounded context files, rule files, and progressively loaded `SKILL.md` directories. Disable discovery with `--no-project-context` or select another manifest with `--context-config`.
 
 Show providers and detected configuration without printing secrets:
 
@@ -192,7 +196,7 @@ zhx run --provider openai --route explorer=qwen --route reviewer=gemini \
   "implement the change, then review it independently"
 ```
 
-Routing with `--max-cost-usd` remains rejected in `0.10.0`: aggregate usage cannot yet be priced correctly when roles use different models.
+Routing with `--max-cost-usd` remains rejected in `0.11.0`: aggregate usage cannot yet be priced correctly when roles use different models.
 
 Writes and checks pause for approval. In a non-interactive execution, state is saved in `.zhivex-harness/runs/operations.sqlite`:
 
@@ -269,9 +273,10 @@ Enable enforced local execution explicitly. The image must already exist locally
 docker pull node:24-bookworm-slim
 zhivex-harness doctor --execution oci
 zhivex-harness run --execution oci --yes "inspect, implement, test, review the environment patch, and import it"
+zhivex-harness run --execution oci --oci-shell ask "use a reviewed shell pipeline inside the isolated snapshot"
 ```
 
-`--yes` approves both command execution and the distinct host patch import. Omit it when a human should review each durable approval. Configuration, threat boundary, cleanup, and certification details are in [docs/EXECUTION_ENVIRONMENTS.md](./docs/EXECUTION_ENVIRONMENTS.md).
+`--yes` approves eligible command execution and the distinct host patch import; it cannot enable a shell whose policy is `deny`. Omit it when a human should review each durable approval. Configuration, threat boundary, cleanup, and certification details are in [docs/EXECUTION_ENVIRONMENTS.md](./docs/EXECUTION_ENVIRONMENTS.md).
 
 ## Providers and defaults
 
@@ -284,7 +289,7 @@ zhivex-harness run --execution oci --yes "inspect, implement, test, review the e
 
 Override any model with `--model`. Optional provider overrides are `META_BASE_URL`, `QWEN_BASE_URL`, `QWEN_WORKSPACE_ID`, `QWEN_REGION`, `OPENAI_BASE_URL`, and `GEMINI_BASE_URL`. Non-credential transport settings are hash-bound to durable resumes without persisting their values.
 
-Meta and Qwen retain the published support conclusion for the unchanged approval/restart and delegation paths. OpenAI remains GPT-5.6-first from `0.8.0`: Luna is the default, while Terra and Sol remain explicit `--model` selections. The Node-first `0.10.0` source candidate passes the local npm-installed artifact and real OCI boundary smokes; the Node 22/24 CI matrix and live-provider release certification remain pending. Controlled and official-SDK MCP interoperability are verified separately and do not imply compatibility with every server or protocol feature. Provider capability claims remain artifact- and date-bound under the [live certification contract](./docs/LIVE_CERTIFICATION.md); credential detection and deterministic tests do not replace real provider evidence.
+Meta and Qwen retain the published support conclusion for the unchanged approval/restart and delegation paths. OpenAI remains GPT-5.6-first from `0.8.0`: Luna is the default, while Terra and Sol remain explicit `--model` selections. The tagged Node-first `0.11.0` artifact is published with registry integrity and provenance; its release-bound remote provider matrix remains pending and is not implied by publication. Controlled and official-SDK MCP interoperability are verified separately and do not imply compatibility with every server or protocol feature. Provider capability claims remain artifact- and date-bound under the [live certification contract](./docs/LIVE_CERTIFICATION.md); credential detection and deterministic tests do not replace real provider evidence.
 
 ## Security boundaries
 

package/ROADMAP.md

@@ -3,7 +3,7 @@
 - Status: active
 - Baseline date: 2026-08-21
 
-This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library contract. The `0.2.0` source baseline is tagged locally, `0.3.0` and `0.4.0` are private checkpoints, and `0.5.0` through `0.9.0` are published on npm. `0.10.0` is the source candidate for a Node-first public runtime and package-manager-neutral repository checks; publication and release certification remain separate operations. Releases are ordered by dependency and safety risk, not by calendar date. A version ships only when its exit criteria are satisfied.
+This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library contract. The `0.2.0` source baseline is tagged locally, `0.3.0` and `0.4.0` are private checkpoints, and `0.5.0` through `0.11.0` are published on npm. Version `0.11.1` is the local source release candidate for file and release hardening without a `0.11.x` contract change. It is not yet tagged or published as a new artifact; registry publication, supply-chain provenance, and provider certification remain separate evidence boundaries. Releases are ordered by dependency and safety risk, not by calendar date. A version ships only when its exit criteria are satisfied.
 
 ## Planning principles
 
@@ -43,7 +43,9 @@ The `0.6.0` dependency batch pins and overrides `@zhivex-ai/core@1.6.0`, retaini
 | `0.7.0` | Multi-provider agent console | Durable sessions, extensible providers, safe role routing, and automation events | Published on npm | L |
 | `0.8.0` | SDK refresh and GPT-5.6 | One Core runtime, current adapters, and a GPT-5.6-first OpenAI path | Published on npm | M |
 | `0.9.0` | Fast governed change admission | Lower repository/OCI overhead plus portable offline evidence bound to exact patch bytes | Published on npm | L |
-| `0.10.0` | Node-first portability | Node CLI/library, portable SQLite/processes, manager-aware checks, and Node OCI | Source candidate | L |
+| `0.10.0` | Node-first portability | Node CLI/library, portable SQLite/processes, manager-aware checks, and Node OCI | Published on npm | L |
+| `0.11.0` | Daily-driver foundations | Richer terminal operation, governed context/skills/hooks, and opt-in OCI shell | Published on npm | L |
+| `0.11.1` | Security and release hardening | Bounded reads, recoverable cleanup, and fail-closed release evidence | Local release candidate | S |
 | `1.0.0` | Stable contract | Supported compatibility and release guarantees | Planned | L |
 
 Relative size is for sequencing only; dates require a capacity decision.
@@ -290,7 +292,7 @@ Exit criteria:
 
 ## 0.10.0 — Node-first runtime portability
 
-Status: source candidate. The full deterministic suite, evaluation, documentation, npm-installed exact-tarball smoke, direct Node/Bun imports, Bun-created approval resume under Node, and required real-Docker OCI boundary gate pass locally. The Node 22/24 CI matrix, live providers, clean release gate, tag, registry, and provenance remain separate.
+Status: published on npm with the `v0.10.0` tag. Later source work is not covered by that release's artifact or provenance evidence.
 
 Goal: remove Bun as an installation prerequisite without weakening governed execution or forcing target repositories to adopt one package manager.
 
@@ -310,6 +312,45 @@ Exit criteria:
 - Linux real-OCI validation passes on the preloaded Node 24 image with unchanged network/rootfs/resource/patch-import guarantees.
 - Documentation, typecheck, full tests, evaluation, build, package inspection, installed-artifact smoke, release checks, live matrix, tag, registry integrity, and provenance are closed independently.
 
+## 0.11.0 — daily-driver foundations
+
+Status: published on npm as `latest` with annotated tag `v0.11.0`, exact registry integrity, and SLSA provenance. Release-bound remote provider certification remains pending and is not implied by publication.
+
+Goal: make the governed runtime practical for daily interactive work without giving repository content or shell syntax authority over host policy.
+
+Scope:
+
+- Render redacted step/tool activity and safe approval cards, and resolve recovered approvals from the durable chat console with `/pending`, `/approve`, and `/deny`.
+- Load bounded root/project context and rules, expose a metadata-only skill catalog, and load skill instructions progressively instead of injecting every skill into the initial prompt.
+- Add trusted application lifecycle hooks identified by version in the harness binding; repository manifests never introduce executable host hooks.
+- Expose full shell syntax only behind explicit `--execution oci --oci-shell ask`, with exact-script approval, denied container network, resource limits, and separate host patch-import approval.
+- Keep semantic search, IDE clients, remote workers, executable project hooks, and network-enabled sandbox profiles as later independently governed tracks.
+
+Exit criteria:
+
+- TTY, no-color, approval-resume, context traversal/symlink, skill disclosure, hook redaction/failure, and OCI shell policy regressions pass.
+- The full deterministic, package, and real-OCI gates pass from a clean commit before any release number, tag, or publication is claimed.
+
+## 0.11.1 — security and release hardening
+
+Status: local source release candidate. It is not yet tagged or published as a new artifact; provenance and release-bound live certification remain pending.
+
+Goal: ship the reviewed security and release hardening accumulated after `0.11.0` without changing configuration, durable state, or execution-policy contracts.
+
+Scope:
+
+- bind sensitive reads and release archive staging to bounded, no-follow regular-file snapshots;
+- recover cleanup directories left by interrupted OCI artifact deletion;
+- preserve transient provider status through the live-smoke retry boundary;
+- classify tool failures with complete tokens in one linear scan; and
+- keep publication fail-closed on the exact tag, tarball, live-provider matrix, registry integrity, and provenance.
+
+Exit criteria:
+
+- focused security regressions, the complete deterministic gate, installed-package smoke, and real OCI pass;
+- the exact annotated tag passes base, orchestration, routing, and model-directed live execution; and
+- npm `latest`, tarball SHA-512, SLSA provenance, tag, and source commit agree.
+
 ## 1.0.0 — Stable CLI and library contract
 
 Goal: freeze a supportable public contract after the pre-1.0 safety and operational surfaces have been exercised in real repositories.
@@ -355,8 +396,8 @@ These can become separate post-1.0 tracks after the CLI/runtime contract and sec
 
 ## Immediate next actions
 
-1. Complete the `0.10.0` Node-first source gate and inspect every runtime-facing diff, compatibility export, documentation contract, and lockfile change.
-2. Run required real-OCI validation against `node:24-bookworm-slim` plus installed-artifact smokes under Node 22/24 and secondary Bun import coverage.
-3. Dogfood npm, pnpm, Yarn, and Bun repositories, including ambiguous lockfiles, lifecycle hooks, custom OCI images, and durable state created by `0.9.x`.
-4. Complete the provider live matrices affected by the new OCI controller; keep uncertified paths provisional on any failure or missing evidence.
-5. Only after those gates, date the changelog, create the annotated tag, dispatch the reviewed release workflow, and verify registry integrity and provenance against the exact artifact.
+1. Configure maintainer-approved provider secrets in the protected `live-certification` environment and run the complete release-bound matrix against the exact annotated tag.
+2. Keep publication fail-closed on base, orchestration, routing, model-directed OCI execution, exact-artifact, integrity, and provenance evidence.
+3. Stabilize the CLI, config, JSON/event, library export, state migration, and error contracts required for the first `1.0.0` release candidate.
+4. Publish the support matrix, threat model, migration/export path, and representative cross-provider repository evaluation evidence.
+5. Complete two release candidates without a contract-breaking defect before promoting `1.0.0` to `latest`.

package/SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Supported versions
 
-Security fixes are provided for the latest published `0.8.x` version. The `0.9.x` source candidate and older private checkpoints are not supported release channels until their exact artifacts are published and verified.
+Security fixes are provided for the latest published `0.11.x` patch. Older minors and private checkpoints are not supported release channels. Registry integrity and provenance do not substitute for the separate provider and execution evidence recorded in [docs/LIVE_CERTIFICATION.md](./docs/LIVE_CERTIFICATION.md).
 
 ## Reporting a vulnerability
 
@@ -14,7 +14,9 @@ Do not open a public issue for a suspected vulnerability. Use [GitHub private vu
 - the practical impact; and
 - any suggested mitigation.
 
-Private vulnerability reporting must be enabled before the repository is made public. If that channel is unavailable, do not disclose exploit details in a public issue.
+Private vulnerability reporting is enabled for this public repository. If GitHub reports that the channel is unavailable, do not disclose exploit details in a public issue; wait for the maintainers to restore the private channel.
+
+The enabled no-cost public controls and the explicitly cost-gated features left disabled are recorded in [docs/PUBLIC_SECURITY.md](./docs/PUBLIC_SECURITY.md).
 
 ## Scope
 

package/SUPPORT.md

@@ -1,6 +1,6 @@
 # Support
 
-Zhivex Harness `0.10.x` is a pre-1.0 Node-first CLI and TypeScript library. Observable contracts may change in a later minor release when the change and migration path are documented in [CHANGELOG.md](./CHANGELOG.md). The source checkout may be a release candidate newer than the latest public npm artifact.
+Zhivex Harness `0.11.x` is the latest supported pre-1.0 Node-first CLI and TypeScript library. Observable contracts may change in a later minor release when the change and migration path are documented in [CHANGELOG.md](./CHANGELOG.md). The mutable machine-readable public release state is recorded in the repository [release-status.json](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json), outside immutable npm artifacts.
 
 ## Supported baseline
 
@@ -11,7 +11,7 @@ Zhivex Harness `0.10.x` is a pre-1.0 Node-first CLI and TypeScript library. Obse
 - the provider/model combinations marked certified in the package documentation; and
 - HTTPS or explicitly allowed loopback-HTTP MCP endpoints using the documented bounded JSON-RPC subset.
 
-Only the most recent published patch receives routine fixes. Meta and Qwen retain their date-bound certification, OpenAI GPT-5.6 has local `0.8.0` base-gate evidence, and Gemini remains provisional until the complete harness live matrix passes. Live provider evidence is account-, model-, endpoint-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](./docs/LIVE_CERTIFICATION.md).
+Only the most recent published `0.11.x` patch receives routine fixes. The exact `v0.11.0` tag source has date-bound local base and orchestration evidence for Meta, Qwen, and OpenAI plus OpenAI-to-Qwen routing evidence. The `0.11.1` candidate must pass the protected release-bound matrix before publication, and Gemini remains provisional until its complete harness live matrix passes. Live provider evidence is account-, model-, endpoint-, artifact-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](./docs/LIVE_CERTIFICATION.md).
 
 ## Support channels
 

package/dist/cli.d.ts

@@ -55,6 +55,7 @@ export interface CliOptions {
     ociRuntime?: string;
     ociImage?: string;
     ociAllowedCommands?: string[];
+    ociShellMode?: string;
     ociMaxProcessRuntimeMs?: number;
     ociMaxProcessOutputBytes?: number;
     ociMaxMemoryMb?: number;
@@ -64,6 +65,8 @@ export interface CliOptions {
     ociMaxFileWriteBytes?: number;
     ociTmpfsMb?: number;
     mcpConfigPath?: string;
+    contextConfigPath?: string;
+    projectContext?: boolean;
     prompt?: string;
     runId?: string;
     idempotencyKey?: string;
@@ -200,6 +203,7 @@ export interface DoctorReport {
         allowedChecks: readonly string[];
         requiredCapabilities: ReturnType<typeof resolveHarnessConfig>["requiredCapabilities"];
         orchestration: ReturnType<typeof resolveHarnessConfig>["orchestration"];
+        context: ReturnType<typeof resolveHarnessConfig>["context"];
         execution: ReturnType<typeof resolveHarnessConfig>["execution"];
         mcpConfigPath?: string;
     };
@@ -213,7 +217,7 @@ export interface DoctorContext {
     bunVersion?: string;
     ociRuntimeAdapter?: HarnessOciRuntimeAdapter;
 }
-export declare const createDoctorReport: (options?: Pick<CliOptions, "provider" | "model" | "workspace" | "stateDirectory" | "storeBackend" | "tenantId" | "userId" | "namespace" | "maxSteps" | "timeoutMs" | "maxToolCalls" | "maxToolErrors" | "maxInputTokens" | "maxOutputTokens" | "maxTotalTokens" | "maxCostUsd" | "inputCostPerMillion" | "outputCostPerMillion" | "allowedChecks" | "requiredCapabilities" | "subagentProfiles" | "subagentMaxSteps" | "subagentMaxToolCalls" | "subagentMaxToolErrors" | "subagentMaxInputTokens" | "subagentMaxOutputTokens" | "subagentMaxTotalTokens" | "subagentTimeoutMs" | "maxParallelReviews" | "executionBackend" | "ociRuntime" | "ociImage" | "ociAllowedCommands" | "ociMaxProcessRuntimeMs" | "ociMaxProcessOutputBytes" | "ociMaxMemoryMb" | "ociMaxPids" | "ociMaxCpus" | "ociMaxWorkspaceBytes" | "ociMaxFileWriteBytes" | "ociTmpfsMb" | "mcpConfigPath">, context?: DoctorContext) => Promise<DoctorReport>;
+export declare const createDoctorReport: (options?: Pick<CliOptions, "provider" | "model" | "workspace" | "stateDirectory" | "storeBackend" | "tenantId" | "userId" | "namespace" | "maxSteps" | "timeoutMs" | "maxToolCalls" | "maxToolErrors" | "maxInputTokens" | "maxOutputTokens" | "maxTotalTokens" | "maxCostUsd" | "inputCostPerMillion" | "outputCostPerMillion" | "allowedChecks" | "requiredCapabilities" | "subagentProfiles" | "subagentMaxSteps" | "subagentMaxToolCalls" | "subagentMaxToolErrors" | "subagentMaxInputTokens" | "subagentMaxOutputTokens" | "subagentMaxTotalTokens" | "subagentTimeoutMs" | "maxParallelReviews" | "executionBackend" | "ociRuntime" | "ociImage" | "ociAllowedCommands" | "ociShellMode" | "ociMaxProcessRuntimeMs" | "ociMaxProcessOutputBytes" | "ociMaxMemoryMb" | "ociMaxPids" | "ociMaxCpus" | "ociMaxWorkspaceBytes" | "ociMaxFileWriteBytes" | "ociTmpfsMb" | "mcpConfigPath" | "contextConfigPath" | "projectContext">, context?: DoctorContext) => Promise<DoctorReport>;
 export declare const formatDoctorReport: (report: DoctorReport) => string;
 export declare const cliExitCodeForError: (error: unknown) => 1 | 2;
 export declare const main: (argv?: string[]) => Promise<void>;