@zhivex-ai/harness 0.11.0 → 0.11.1

package/docs/LIVE_CERTIFICATION.md

@@ -56,11 +56,25 @@ A missing credential, unavailable container runtime, upstream failure, incomplet
 
 ## Current public status
 
-Meta, Qwen, and OpenAI retain the previously published support conclusion for unchanged runtime paths. The published `0.7.0` release added Gemini and mixed-provider routing as provisional surfaces; they require fresh release-candidate evidence before certification.
+`@zhivex-ai/harness@0.11.0` remains published as `latest` with its annotated tag, registry integrity, and SLSA provenance. Version `0.11.1` is a source release candidate whose base, orchestration, routing, model-directed OCI execution, registry-integrity, and SLSA provenance gates are still pending. Those evidence classes remain distinct: supply-chain verification does not by itself certify provider behavior.
+
+The release workflow fails closed on the base, orchestration, routing, and model-directed execution gates before npm publication. The protected `live-certification` environment receives only maintainer-approved provider secrets; credentials are never committed or exposed in evidence.
 
 The controlled and official-SDK MCP interoperability gates remain separate transport evidence. They certify only the tested protocol, implementation, and compatibility mode, not every MCP server or future protocol version.
 
-## Current local pre-release evidence
+## Current local tag-source evidence
+
+On 2026-08-22, a clean checkout of annotated tag `v0.11.0` at `652a299e2d6997ca4001dd9931ef2a82645f7204` passed the base proposal/approval/restart/exactly-once matrix for Meta `muse-spark-1.2`, Qwen `qwen3.8-max`, and OpenAI `gpt-5.6-luna`. The same checkout passed bounded reviewer delegation and persistence for all three providers plus the OpenAI-parent/Qwen-reviewer mixed route.
+
+This evidence is source/tag-bound and date-bound, not a successful protected GitHub run or an installed-artifact provider certification. Model-directed OCI execution was not rerun locally because no Docker daemon was available; deterministic OCI enforcement passed on the exact published commit in CI. Gemini remains provisional.
+
+## Current security-hardening worktree evidence
+
+On 2026-08-23 UTC, the pre-commit security-hardening worktree passed the complete local live matrix for Meta `muse-spark-1.2`, Qwen `qwen3.8-max`, and OpenAI `gpt-5.6-luna`: proposal/approval/restart/exactly-once, bounded reviewer delegation with SQLite reopen, OpenAI-parent/Qwen-reviewer routing, and model-directed command/review/separate-import execution against the pinned OCI image. This confirms the changed worktree behavior only; it is not tag-, installed-artifact-, protected-environment-, registry-, or provenance-bound evidence.
+
+The same worktree passed Gemini `gemini-3.7-flash` proposal/approval/restart/exactly-once and bounded reviewer delegation after the create-only digest field was made explicitly required in the tool schema and certification prompt. Its model-directed OCI execution did not complete: the two bounded attempts stopped on provider HTTP `429 RESOURCE_EXHAUSTED` and `503 UNAVAILABLE` before a successful execution sequence. Gemini therefore remains provisional until execution and any required routing gates pass against an exact release candidate.
+
+## Historical local pre-release evidence
 
 On 2026-08-20, the uncommitted `0.8.0` source worktree with `@zhivex-ai/core@1.7.0` and `@zhivex-ai/openai@0.9.6` passed the base proposal/approval/restart/exactly-once gate for the GPT-5.6 family used by the Harness:
 

package/docs/PUBLIC_SECURITY.md

@@ -0,0 +1,39 @@
+# Public repository security
+
+This document records which GitHub-hosted security controls the project uses, their cost boundary, and the controls that remain intentionally disabled. Recheck the pricing and repository visibility before changing this configuration.
+
+## Enabled no-cost controls
+
+The repository is public. GitHub documents the following controls as available without a paid GitHub Secret Protection or GitHub Code Security license for public repositories:
+
+- private vulnerability reporting;
+- secret scanning alerts for supported provider patterns;
+- repository push protection;
+- Dependabot alerts and security updates;
+- CodeQL code scanning on standard GitHub-hosted runners; and
+- standard GitHub-hosted Actions runners.
+
+The repository additionally uses a `main` ruleset with pull-request review, review-thread resolution, linear history, and required CI checks. Repository Actions default to read-only permissions; individual jobs must request any narrower write capability explicitly. The npm publication job is the only workflow path that requests `id-token: write`, and it uses the protected `npm` environment.
+
+References:
+
+- [GitHub security features](https://docs.github.com/en/code-security/getting-started/github-security-features)
+- [Secret scanning](https://docs.github.com/en/code-security/concepts/secret-security/secret-scanning)
+- [Dependabot security updates](https://docs.github.com/en/code-security/concepts/supply-chain-security/dependabot-security-updates)
+- [CodeQL CLI and public repositories](https://docs.github.com/en/code-security/concepts/code-scanning/codeql/codeql-cli)
+- [GitHub Actions billing](https://docs.github.com/en/billing/concepts/product-billing/github-actions)
+- [Private vulnerability reporting](https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/configure-for-a-repository)
+
+## Cost-gated controls left disabled
+
+The project does not enable larger GitHub-hosted runners, custom runner images, or private-repository GitHub Secret Protection/GitHub Code Security licenses. Those paths can incur GitHub charges and require explicit maintainer approval.
+
+Generic or AI-detected secret patterns, non-provider patterns, and secret validity checks remain disabled until their entitlement and billing behavior are confirmed for the owning organization. Standard provider-pattern secret scanning and repository push protection remain enabled.
+
+If the repository becomes private or internal, treat every security feature and Actions runner as cost-unknown until GitHub billing is rechecked. Do not silently preserve the public-repository assumptions in this document.
+
+## Operational exception: live provider certification
+
+The `live-certification` GitHub environment does not currently contain provider credentials. This is not a paid GitHub feature, but adding credentials transfers sensitive provider keys into GitHub and therefore requires an explicit maintainer decision.
+
+The release workflow fails closed when those credentials are absent: future npm publication depends on the base, orchestration, routing, and model-directed OCI live gates running against the exact annotated release tag and source commit. When credentials are configured, they are exposed only to the final provider-call step; checkout, runtime setup, dependency installation, tag verification, and deterministic OCI validation do not receive them. Local credentials are never copied to GitHub automatically.

package/docs/RELEASE.md

@@ -1,6 +1,6 @@
 # Release process
 
-`@zhivex-ai/harness@0.10.0` is the latest public npm release and `v0.10.0` is its matching repository tag. Version `0.11.0` is the current local source release candidate; it is not a published artifact until its own reviewed commit, annotated `v0.11.0` tag, protected workflow, registry integrity, and provenance all agree. Publication is never performed from a development checkout. The confirmation-gated `.github/workflows/release.yml` workflow builds, inspects, transfers, and publishes one exact tarball through npm Trusted Publishing/OIDC. Creating a tag alone does not publish anything.
+Version `0.11.1` is the current local source release candidate; `@zhivex-ai/harness@0.11.0` remains the latest public npm release and `v0.11.0` its annotated tag until protected publication succeeds. Candidate source, provenance, and live-certification state are tracked in the mutable repository [release-status.json](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json), which is intentionally excluded from immutable npm artifacts. Publication is never performed from a development checkout. The confirmation-gated `.github/workflows/release.yml` workflow builds, inspects, certifies, transfers, and publishes one exact tag-bound tarball through npm Trusted Publishing/OIDC. Creating a tag alone does not publish anything, and publication does not retroactively substitute for a missing live-provider gate.
 
 ## Deterministic gates
 
@@ -24,11 +24,12 @@ Provider behavior is certified separately because it is credential-, account-, m
 ```bash
 ZHIVEX_HARNESS_LIVE=1 bun run scripts/live-provider-smoke.ts
 ZHIVEX_HARNESS_LIVE=1 bun run smoke:live:orchestration
+ZHIVEX_HARNESS_LIVE=1 bun run smoke:live:routing
 ZHIVEX_HARNESS_LIVE=1 bun run smoke:live:execution
 ZHIVEX_HARNESS_OCI_REQUIRED=1 bun run smoke:oci
 ```
 
-The base reviewed-edit gate and the separate delegation gate must pass for every provider in the supported release matrix. The workflow must additionally pass the real OCI boundary before live model execution; model-directed environment use is recorded separately from deterministic container enforcement. Gemini remains provisional until its three provider gates and a mixed-provider route pass. Integrated provisional providers are reported separately and must not be described as certified. `bun run check` also runs controlled Streamable HTTP MCP interoperability gates; each external implementation claim remains bounded to the tested server/version. See [LIVE_CERTIFICATION.md](./LIVE_CERTIFICATION.md).
+The base reviewed-edit gate and the separate delegation gate must pass for every provider in the supported release matrix. The release workflow additionally requires the mixed-provider route and model-directed execution gates against the exact annotated tag before the npm job can start; deterministic OCI enforcement remains a separate prerequisite. Gemini remains provisional until its provider, delegation, routing, and execution gates pass. Integrated provisional providers are reported separately and must not be described as certified. `bun run check` also runs controlled Streamable HTTP MCP interoperability gates; each external implementation claim remains bounded to the tested server/version. See [LIVE_CERTIFICATION.md](./LIVE_CERTIFICATION.md).
 
 ## Exact artifact gate
 
@@ -40,17 +41,20 @@ The release workflow performs this sequence across an unprivileged validation jo
 4. create one tarball with `bun pm pack --ignore-scripts`;
 5. allow only the documented package roots, verify the packed manifest, and write `SHA512SUMS`;
 6. install that same tarball in an isolated consumer and execute its CLI and public API;
-7. transfer only the tarball and `SHA512SUMS` into the `npm` environment, then revalidate the checksum and artifact contract;
-8. pass that same file to the npm CLI for the registry transaction; and
-9. retry within one absolute five-minute deadline through registry and attestation propagation, capping every request and sleep by the remaining time, then verify the distribution tag, byte-identical SHA-512 integrity, and SLSA subject/repository/workflow/ref/commit evidence. The ref must be `main` or the exact `v<package-version>` tag; arbitrary branches and tags fail closed.
+7. run the protected base, orchestration, routing, and model-directed OCI live gates from the same annotated tag and source commit;
+8. transfer only the tarball and `SHA512SUMS` into the `npm` environment, then revalidate the checksum and artifact contract;
+9. pass that same file to the npm CLI for the registry transaction; and
+10. retry within one absolute five-minute deadline through registry and attestation propagation, capping every request and sleep by the remaining time, then verify the distribution tag, byte-identical SHA-512 integrity, and SLSA subject/repository/workflow/ref/commit evidence. The ref must be `main` or the exact `v<package-version>` tag; arbitrary branches and tags fail closed.
 
 For a local artifact rehearsal after the source gate:
 
 ```bash
 mkdir -p release-artifacts
-bun pm pack --filename release-artifacts/zhivex-ai-harness-0.11.0.tgz --ignore-scripts
-bun run artifact:check -- release-artifacts/zhivex-ai-harness-0.11.0.tgz
-bun run smoke:artifact -- release-artifacts/zhivex-ai-harness-0.11.0.tgz
+HARNESS_VERSION="$(node -p 'require("./package.json").version')"
+HARNESS_ARTIFACT="release-artifacts/zhivex-ai-harness-${HARNESS_VERSION}.tgz"
+bun pm pack --filename "$HARNESS_ARTIFACT" --ignore-scripts
+bun run artifact:check -- "$HARNESS_ARTIFACT"
+bun run smoke:artifact -- "$HARNESS_ARTIFACT"
 ```
 
 `release-artifacts/`, `.npmrc`, `.env`, source tests, Git metadata, and local run state are excluded from the package.
@@ -65,7 +69,7 @@ Trusted Publishing currently requires npm CLI `11.5.1` or newer and Node `22.14.
 
 ## Tag and dispatch
 
-After review and merge, maintainers create an annotated version tag from the exact release commit and dispatch the protected workflow with an explicit publication confirmation. The canonical dispatch is bound to `main`; recovery is limited to the exact annotated version tag after proving it resolves to the expected commit and remains reachable from `origin/main`.
+After review and merge, maintainers create an annotated `v<package.json version>` tag from the exact release commit and dispatch the protected workflow with that tag plus an explicit publication confirmation. The workflow YAML contains no release-version default: `package.json` is the source of version truth, and the required tag input is validated against it before publication. The canonical dispatch is bound to `main`; recovery is limited to the exact annotated version tag after proving it resolves to the expected commit and remains reachable from `origin/main`.
 
 The confirmation is intentional because registry versions are immutable, and the protected environment adds a second human approval boundary. Do not use a local registry session or manual upload as an alternate path.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhivex-ai/harness",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "description": "Governed, provider-portable runtime for coding agents with durable approvals and isolated repository execution.",
   "type": "module",
   "license": "MIT",
@@ -110,7 +110,7 @@
   "devDependencies": {
     "@modelcontextprotocol/server": "2.0.0",
     "@types/bun": "1.3.14",
-    "@types/node": "24",
+    "@types/node": "26",
     "typescript": "6.0.3"
   },
   "engines": {