@zhivex-ai/harness 0.11.0 → 1.0.0-rc.7

package/CHANGELOG.md

@@ -4,6 +4,135 @@ All notable changes to Zhivex Harness are documented in this file.
 
 The project follows Semantic Versioning. During `0.x`, minor releases may change user-facing contracts when the change is documented with a migration note. Patch releases remain backwards compatible bug fixes.
 
+## 1.0.0-rc.7 - 2026-08-25
+
+### Fixed
+
+- Keep `@zhivex-ai/core@1.10.0`, `@zhivex-ai/agents@1.3.0`, and `@zhivex-ai/openai@0.10.0`, while restoring `@zhivex-ai/qwen@0.10.2`, the last adapter that passed the complete release-bound Qwen representative matrix. Qwen `0.10.3` failed closed before the Harness durable tool-call-ID normalizer could recover the affected turns.
+
+### Changed
+
+- Record the immutable, unpublished RC.6 attempt as failed after exact-artifact and release-bound live certification passed, while Qwen resolved only 12/14 representative cases in both the original protected run and one retry; npm publication remained skipped.
+- Extend the representative release matrix through `v1.0.0-rc.7`; because RC.6 cannot count toward GA, a later independent passing candidate will still be required before stable promotion.
+
+## 1.0.0-rc.6 - 2026-08-25
+
+### Fixed
+
+- Upgrade the coordinated Zhivex SDK batch to `@zhivex-ai/core@1.10.0`, `@zhivex-ai/agents@1.3.0`, `@zhivex-ai/openai@0.10.0`, and `@zhivex-ai/qwen@0.10.3`, retaining exact pins and one Core override across every provider adapter.
+- Preserve the sanitized OpenAI Responses tool-call diagnostic and retryability from durable SDK failures in Time-to-Safe-Fix evidence without retaining raw arguments, provider payloads, or error messages.
+- Complete the governed representative driver from the signed, journaled `apply_environment_patch` receipt after its separate edit, verifier, inspection, and import approvals, avoiding a redundant final provider turn after the authorized repair is already durable.
+
+### Changed
+
+- Record the immutable, unpublished RC.5 attempt as failed after exact-artifact validation and release-bound live certification passed but OpenAI resolved only 13/14 representative cases.
+- Advance the next candidate to `v1.0.0-rc.6`; because RC.5 cannot count toward GA, a later independent passing candidate will still be required before stable promotion.
+
+## 1.0.0-rc.5 - 2026-08-24
+
+### Fixed
+
+- Replace missing, whitespace-only, and legacy numeric Qwen streaming tool-call IDs with deterministic, turn-durable IDs before agent state can observe them; preserve valid provider IDs and reject real duplicates fail-closed.
+- Persist a bounded failure origin and allowlisted provider diagnostic code in Time-to-Safe-Fix failures, including through typed Harness error causes, without retaining provider messages or raw output.
+
+### Changed
+
+- Record the immutable, unpublished RC.4 attempt as failed after its release-bound live-provider gate passed but Qwen resolved only 13/14 representative cases.
+- Extend the representative release matrix through `v1.0.0-rc.6`; RC.5 and RC.6 must both pass independently before GA.
+
+## 1.0.0-rc.4 - 2026-08-24
+
+### Fixed
+
+- Preserve stable typed Harness failure `code`, `category`, and `retryable` metadata alongside Time-to-Safe-Fix semantic classification, so transient provider and OCI execution failures remain machine-classifiable without retaining raw error text.
+
+### Changed
+
+- Record the immutable, unpublished RC.3 release attempt as failed at the representative-evaluation gate after exact-artifact, release-bound live certification, and the Meta matrix passed.
+- Extend the representative release matrix through `v1.0.0-rc.5` because RC.1, RC.2, and RC.3 cannot count toward the two-passing-candidate GA requirement.
+
+## 1.0.0-rc.3 - 2026-08-24
+
+### Fixed
+
+- Persist bounded structured diagnostics for failed representative-provider cases while continuing to exclude raw prompts, model output, raw provider error text, and workspace contents from release artifacts.
+- Record whether the release-bound live-provider gate passed or failed independently from other failed release gates, and reject contradictory ledger evidence.
+
+### Changed
+
+- Record the immutable, unpublished RC.2 release attempt as failed at the representative-evaluation gate after exact-artifact and release-bound live certification passed.
+- Extend the representative release matrix through `v1.0.0-rc.4` because RC.1 and RC.2 cannot count toward the two-passing-candidate GA requirement.
+
+## 1.0.0-rc.2 - 2026-08-23
+
+### Fixed
+
+- Normalize missing or whitespace-only Qwen tool-call IDs at the built-in provider boundary before durable agent state, approvals, or tool journals can observe them; preserve valid provider IDs and reject duplicate IDs fail-closed.
+
+### Changed
+
+- Record immutable release attempts that fail protected gates without claiming npm publication or provenance, exclude them from passing GA evidence, and require two later passing candidates before stable promotion.
+- Extend the representative release matrix through `v1.0.0-rc.3` because the failed, unpublished RC.1 attempt cannot count toward the two-candidate GA requirement.
+
+## 1.0.0-rc.1 - 2026-08-23
+
+### Added
+
+- Add a machine-checked 1.0 public API/CLI/schema baseline, support matrix, threat/control map, deprecation and rollback policies, representative-evidence schema, and a fail-closed GA readiness ledger.
+- Add an explicit config schema `4` to `5` migration helper that preserves the older authority boundary by disabling project context and OCI shell exposure unless the operator opts in after review.
+- Add stable machine error codes with typed configuration/CLI usage errors and compile a TypeScript consumer against the installed release tarball.
+- Add schema-1 parsers and golden fixtures for public JSON/JSONL output, a command-specific CLI option manifest, and provider-free logical SQLite state status/export/import commands.
+- Add byte-for-byte SQLite migration fixtures generated from the integrity-verified published `0.10.0` and `0.11.1` artifacts and verify them through current run and session APIs.
+- Add a seven-repository, 14-run representative matrix with strict per-case evidence generation, sanitized cross-provider assembly, and a protected Meta/Qwen/OpenAI release job that blocks npm publication.
+- Add a strict release-candidate security-review schema covering every control, trust boundary, authority-bearing tool, finding, reviewer, artifact binding, and remotely verified CI/CodeQL/release workflow.
+
+### Changed
+
+- Allow protected `1.0.0-rc.N` artifacts only on npm `next`, keep stable releases on `latest`, and reject version/channel drift before publication.
+- Bind each GA release-candidate record to a distinct annotated tag, main-reachable commit, published npm integrity, SLSA provenance statement, and successful release workflow; require every declared provider/scenario on both candidates, verify the evaluation workflows through GitHub, and require a concrete security-review artifact.
+- Expose CLI command/subcommand constants as the source for the frozen command manifest and document previously omitted child-budget options in help output.
+- Emit a distinct compact `run-stream-result` JSONL terminal record, keep machine errors message-free, and delay terminal JSONL output until asynchronous persistence/environment cleanup succeeds.
+- Run installed-package smoke against the exact inspected tarball in CI, reject SQLite WAL/SHM sidecars, and clean `dist` before every build.
+- Classify all 213 runtime and 166 type exports explicitly as Stable, Beta, or Experimental, and compare the complete partition with the installed tarball namespace and declarations.
+- Bind every Stable runtime and type export to a reproducible declaration-closure hash and verify that signature snapshot against source-emitted and installed-tarball declarations.
+- Keep Gemini explicitly provisional and outside the 1.0 certified cohort; accept later corrective RCs only as a contiguous sequence after the required RC.1 and RC.2.
+
+### Security
+
+- Stream integrity-pinned historical npm archives directly into an isolated extractor instead of persisting network bytes, constrain MCP authentication to canonical credential headers backed by dedicated `ZHIVEX_MCP_*` variables, publish state backups atomically without clobbering existing targets, and reject orphaned active leases for runs being imported.
+
+### Migration
+
+- Existing schema `5` configuration is unchanged. Call `migrateHarnessConfigInput` for an explicitly versioned schema `4` input; the pure migration does not read environment variables or filesystem state. Paused approvals remain bound to the exact older artifact and are never rewritten.
+- Existing schema-1 JSON observers may accept additive fields, but JSONL consumers must recognize the distinct `run-stream-result` and `run-stream-error` terminal kinds. The literal durable `userId` value `"*"` is now rejected because it is reserved for the absent-user scope marker.
+- Rename MCP credential variables to the `ZHIVEX_MCP_*` namespace; HTTP `headerEnv` entries now accept only `authorization` and `x-api-key`.
+
+## 0.11.1 - 2026-08-23
+
+### Changed
+
+- Make provider live certification a fail-closed dependency of the publish job and bind manual certification runs to an explicit release tag.
+- Remove release-version defaults from GitHub workflow inputs. Maintainers enter the annotated tag at dispatch, and release readiness validates it against the single version source in `package.json`.
+- Keep release-artifact transfer actions pinned to immutable commit SHAs while allowing Dependabot SHA upgrades, and represent successful remote tag-bound certification explicitly in the release-status schema.
+- Add a mutable machine-readable repository release-status record, keep it outside immutable npm artifacts, and validate public documentation, release gates, and repository security configuration against it.
+- Bound installed-package smoke subprocesses by time and captured output so a stalled child process cannot hang release validation indefinitely.
+- Keep public documentation consistent with candidate and published artifact state while preserving live-provider certification as a separate evidence boundary.
+- Retry only transient HTTP failures in the opt-in base provider smoke, using fresh temporary state and a bounded three-attempt schedule; contract and approval failures still fail immediately.
+- Preserve transient provider status from failed agent outputs before release-smoke contract assertions so retryable 429/5xx responses reach the bounded retry loop.
+- Mark create-only `expectedDigest: null` as an explicitly required tool-schema field and reinforce that contract in live certification prompts for providers that otherwise omit null-valued arguments.
+- Record current worktree live evidence separately from release-bound certification: the certified cohort passed every local gate, while Gemini Flash 3.7 passed base editing and delegation but remained blocked on provider quota/capacity during OCI execution.
+
+### Security
+
+- Add CodeQL, Dependabot, CODEOWNERS, and documented public-repository security controls. GitHub-side controls that are free for public repositories are enabled; optional cost-bearing analysis remains disabled and explicitly recorded. Live provider credentials are scoped only to the final provider-call step rather than checkout, setup, dependency installation, or deterministic validation.
+- Bind workspace, context, OCI, change-envelope, and release-artifact reads to bounded regular-file descriptors that reject symbolic links, hard-linked OCI exports, special files, and concurrent content replacement.
+- Create SQLite state files and benchmark canaries exclusively, stage release archives from the exact inspected bytes, pin registry identity independently of package metadata, and classify adversarial benchmark failures with a linear complete-token scanner.
+- Recover canonical `.cleanup-<artifact>-<uuid>` OCI artifact directories after interrupted cleanup without weakening inode and metadata revalidation.
+
+### Migration from 0.11.0
+
+No configuration, SQLite, approval, or execution-policy migration is required. Existing `0.11.0` state remains compatible; this patch tightens failure classification, cleanup recovery, and release boundaries.
+
 ## 0.11.0 - 2026-08-21
 
 ### Added

package/README.md

@@ -13,7 +13,7 @@ Zhivex Harness runs coding agents against real repositories with conflict-safe e
 
 The model provides capability. The harness controls what it may inspect, execute, change, resume, and prove. Every provider uses the same bounded tool and approval contract.
 
-Version `0.11.0` is the current source release candidate. The latest public npm release remains the tagged Node-first `0.10.0` artifact until the reviewed release workflow publishes and verifies `0.11.0`; local validation alone does not publish or certify registry provenance. See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), the [change-envelope guide](./docs/CHANGE_ENVELOPES.md), the [CLI contract](./docs/CLI.md), the [context-engineering guide](./docs/CONTEXT_ENGINEERING.md), the [extensibility guide](./docs/EXTENSIBILITY.md), and the [durable-operations guide](./docs/DURABLE_OPERATIONS.md).
+Version `0.11.1` is the current public npm release and `latest` distribution tag. Its annotated tag, exact registry integrity, SLSA provenance, and release-bound Meta/Qwen/OpenAI certification are recorded in the [repository release status](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json). Publication remains fail-closed on deterministic, installed-package, real-OCI, base-provider, orchestration, routing, and model-directed execution gates. The planned 1.0 promotion is tracked by the [machine-checked readiness gate](./docs/GA_READINESS.md), [API stability policy](./docs/STABILITY.md), [support matrix](./docs/SUPPORT_MATRIX.md), and [threat model](./docs/THREAT_MODEL.md). See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), [public repository security](./docs/PUBLIC_SECURITY.md), the [change-envelope guide](./docs/CHANGE_ENVELOPES.md), the [CLI contract](./docs/CLI.md), the [context-engineering guide](./docs/CONTEXT_ENGINEERING.md), the [extensibility guide](./docs/EXTENSIBILITY.md), and the [durable-operations guide](./docs/DURABLE_OPERATIONS.md).
 
 ## Why Zhivex Harness
 
@@ -109,10 +109,10 @@ It does not include arbitrary host shell access, `stdio` MCP, permanent deletion
 
 ## Installation
 
-Install the published Node-first `0.10.0` artifact with an exact version:
+Install the Node-first `0.11.1` artifact with an exact version:
 
 ```bash
-npx --yes --package=@zhivex-ai/harness@0.10.0 zhx --version
+npx --yes --package=@zhivex-ai/harness@0.11.1 zhx --version
 ```
 
 To exercise the source checkout, contributors use Bun for deterministic repository tooling while the built CLI itself runs on Node:
@@ -196,7 +196,7 @@ zhx run --provider openai --route explorer=qwen --route reviewer=gemini \
   "implement the change, then review it independently"
 ```
 
-Routing with `--max-cost-usd` remains rejected in `0.11.0`: aggregate usage cannot yet be priced correctly when roles use different models.
+Routing with `--max-cost-usd` remains rejected in `0.11.1`: aggregate usage cannot yet be priced correctly when roles use different models.
 
 Writes and checks pause for approval. In a non-interactive execution, state is saved in `.zhivex-harness/runs/operations.sqlite`:
 
@@ -282,14 +282,14 @@ zhivex-harness run --execution oci --oci-shell ask "use a reviewed shell pipelin
 
 | Provider | Default model | Current support |
 | --- | --- | --- |
-| Meta | `muse-spark-1.2` | `MODEL_API_KEY` · 0.6 edit, delegation, and OCI execution certified |
-| Qwen | `qwen3.8-max` | `DASHSCOPE_API_KEY` or `QWEN_API_KEY` · 0.6 edit, delegation, and OCI execution certified |
-| OpenAI | `gpt-5.6-luna` | `OPENAI_API_KEY` · GPT-5.6 Luna, Terra, and Sol base workflow passed locally; release recertification pending |
+| Meta | `muse-spark-1.2` | `MODEL_API_KEY` · 0.11.1 release-bound base, delegation, and OCI execution certified |
+| Qwen | `qwen3.8-max` | `DASHSCOPE_API_KEY` or `QWEN_API_KEY` · 0.11.1 release-bound base, delegation, routing, and OCI execution certified |
+| OpenAI | `gpt-5.6-luna` | `OPENAI_API_KEY` · 0.11.1 release-bound base, delegation, routing, and OCI execution certified |
 | Gemini | `gemini-3.6-flash` | `GEMINI_API_KEY` or `GOOGLE_GENERATIVE_AI_API_KEY` · provisional until the harness live matrix passes |
 
 Override any model with `--model`. Optional provider overrides are `META_BASE_URL`, `QWEN_BASE_URL`, `QWEN_WORKSPACE_ID`, `QWEN_REGION`, `OPENAI_BASE_URL`, and `GEMINI_BASE_URL`. Non-credential transport settings are hash-bound to durable resumes without persisting their values.
 
-Meta and Qwen retain the published support conclusion for the unchanged approval/restart and delegation paths. OpenAI remains GPT-5.6-first from `0.8.0`: Luna is the default, while Terra and Sol remain explicit `--model` selections. The tagged Node-first `0.10.0` artifact is published; the `0.11.0` candidate requires its own clean CI, live-provider, artifact, registry, and provenance gates. Controlled and official-SDK MCP interoperability are verified separately and do not imply compatibility with every server or protocol feature. Provider capability claims remain artifact- and date-bound under the [live certification contract](./docs/LIVE_CERTIFICATION.md); credential detection and deterministic tests do not replace real provider evidence.
+The exact `v0.11.1` tag passed proposal/approval/restart, bounded delegation, OpenAI-parent/Qwen-reviewer routing, and model-directed OCI execution for Meta `muse-spark-1.2`, Qwen `qwen3.8-max`, and OpenAI `gpt-5.6-luna` on 2026-08-23. Luna remains the OpenAI default, while Terra and Sol remain explicit `--model` selections with older local base evidence only. Controlled and official-SDK MCP interoperability are verified separately and do not imply compatibility with every server or protocol feature. Provider capability claims remain artifact- and date-bound under the [live certification contract](./docs/LIVE_CERTIFICATION.md); credential detection and deterministic tests do not replace real provider evidence.
 
 ## Security boundaries
 
@@ -318,6 +318,7 @@ The default `none` backend provides governance but no OS isolation and therefore
 
 ```bash
 bun run typecheck
+bun run readiness:1.0
 bun test
 bun run build
 bun run evaluate

package/ROADMAP.md

@@ -3,7 +3,7 @@
 - Status: active
 - Baseline date: 2026-08-21
 
-This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library contract. The `0.2.0` source baseline is tagged locally, `0.3.0` and `0.4.0` are private checkpoints, and `0.5.0` through `0.10.0` are published on npm. Version `0.11.0` is the local source release candidate for interactive operation, context engineering, and opt-in OCI shell workflows; publication and release certification remain separate operations. Releases are ordered by dependency and safety risk, not by calendar date. A version ships only when its exit criteria are satisfied.
+This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library contract. The `0.2.0` source baseline is tagged locally, `0.3.0` and `0.4.0` are private checkpoints, and `0.5.0` through `0.11.1` are published on npm. Version `0.11.1` delivers file and release hardening without a `0.11.x` contract change; registry publication, supply-chain provenance, and provider certification remain separate evidence boundaries. Releases are ordered by dependency and safety risk, not by calendar date. A version ships only when its exit criteria are satisfied.
 
 ## Planning principles
 
@@ -44,7 +44,8 @@ The `0.6.0` dependency batch pins and overrides `@zhivex-ai/core@1.6.0`, retaini
 | `0.8.0` | SDK refresh and GPT-5.6 | One Core runtime, current adapters, and a GPT-5.6-first OpenAI path | Published on npm | M |
 | `0.9.0` | Fast governed change admission | Lower repository/OCI overhead plus portable offline evidence bound to exact patch bytes | Published on npm | L |
 | `0.10.0` | Node-first portability | Node CLI/library, portable SQLite/processes, manager-aware checks, and Node OCI | Published on npm | L |
-| `0.11.0` | Daily-driver foundations | Richer terminal operation, governed context/skills/hooks, and opt-in OCI shell | Local release candidate | L |
+| `0.11.0` | Daily-driver foundations | Richer terminal operation, governed context/skills/hooks, and opt-in OCI shell | Published on npm | L |
+| `0.11.1` | Security and release hardening | Bounded reads, recoverable cleanup, and fail-closed release evidence | Published on npm | S |
 | `1.0.0` | Stable contract | Supported compatibility and release guarantees | Planned | L |
 
 Relative size is for sequencing only; dates require a capacity decision.
@@ -313,7 +314,7 @@ Exit criteria:
 
 ## 0.11.0 — daily-driver foundations
 
-Status: local source release candidate. It is not yet tagged or published as a new artifact.
+Status: published on npm as `latest` with annotated tag `v0.11.0`, exact registry integrity, and SLSA provenance. Release-bound remote provider certification remains pending and is not implied by publication.
 
 Goal: make the governed runtime practical for daily interactive work without giving repository content or shell syntax authority over host policy.
 
@@ -330,10 +331,32 @@ Exit criteria:
 - TTY, no-color, approval-resume, context traversal/symlink, skill disclosure, hook redaction/failure, and OCI shell policy regressions pass.
 - The full deterministic, package, and real-OCI gates pass from a clean commit before any release number, tag, or publication is claimed.
 
+## 0.11.1 — security and release hardening
+
+Status: published on npm as `latest` with annotated tag `v0.11.1`, exact registry integrity, SLSA provenance, and successful release-bound Meta/Qwen/OpenAI certification.
+
+Goal: ship the reviewed security and release hardening accumulated after `0.11.0` without changing configuration, durable state, or execution-policy contracts.
+
+Scope:
+
+- bind sensitive reads and release archive staging to bounded, no-follow regular-file snapshots;
+- recover cleanup directories left by interrupted OCI artifact deletion;
+- preserve transient provider status through the live-smoke retry boundary;
+- classify tool failures with complete tokens in one linear scan; and
+- keep publication fail-closed on the exact tag, tarball, live-provider matrix, registry integrity, and provenance.
+
+Exit criteria:
+
+- focused security regressions, the complete deterministic gate, installed-package smoke, and real OCI pass;
+- the exact annotated tag passes base, orchestration, routing, and model-directed live execution; and
+- npm `latest`, tarball SHA-512, SLSA provenance, tag, and source commit agree.
+
 ## 1.0.0 — Stable CLI and library contract
 
 Goal: freeze a supportable public contract after the pre-1.0 safety and operational surfaces have been exercised in real repositories.
 
+Status: RC.1 through RC.6 passed exact-artifact validation but failed protected certification, so every publication was skipped and npm remained unchanged. RC.6 passed release-bound live certification and Meta's complete representative matrix, then failed closed at Qwen with 12/14 safe resolutions in both the original run and one retry. RC.7 keeps the Core, Agents, and OpenAI corrections while restoring the last Qwen adapter that passed this exact release-bound matrix. Public API/CLI/schema baselines, config `4 → 5` migration, historical tarball fixtures, support/security/rollback policy, RC channel enforcement, representative-evaluation generation, and evidence requirements remain machine-checked. GA remains blocked on the two open evidence classes in [`docs/ga-readiness.json`](./docs/ga-readiness.json): representative results across two passing release candidates and the final-candidate security review.
+
 Scope:
 
 - Stabilize CLI commands, config schema, JSON/event schemas, library exports, state migrations, and error taxonomy.
@@ -375,8 +398,8 @@ These can become separate post-1.0 tracks after the CLI/runtime contract and sec
 
 ## Immediate next actions
 
-1. Review and commit the exact `0.11.0` source candidate on `main`, then require clean Linux/macOS CI and Node 22.13/24 artifact compatibility.
-2. Run the required real-OCI gate against `node:24-bookworm-slim` plus installed-artifact smoke coverage for terminal, context, lifecycle-hook, and OCI shell exports.
-3. Complete the provider live matrices affected by the changed context/tool fingerprint; keep any missing or failed path outside the certified release evidence.
-4. Create annotated tag `v0.11.0` from the reviewed release commit and dispatch the protected workflow only after confirming npm still lacks that immutable version.
-5. Verify the exact published tarball, `latest` tag, integrity, and SLSA provenance before calling `0.11.0` released.
+1. Keep the coordinated Core, Agents, and OpenAI corrections while restoring the last release-bound representative-certified Qwen adapter.
+2. Create and dispatch the exact annotated `v1.0.0-rc.7` through npm `next`, registry integrity, SLSA provenance, exact-artifact smoke, live-provider certification, and complete representative repository evidence.
+3. If RC.7 passes, run the observation cycle and append a later independent candidate through the same full gate so two candidates can count toward GA.
+4. Complete the named security review against the final passing candidate and close every critical/high finding.
+5. Promote a separately tagged and verified `1.0.0` artifact to `latest` only after the release-mode readiness gate passes with two passing candidates.

package/SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Supported versions
 
-Security fixes are provided for the latest published `0.8.x` version. The `0.9.x` source candidate and older private checkpoints are not supported release channels until their exact artifacts are published and verified.
+Security fixes are provided for the latest published `0.11.x` patch. Older minors and private checkpoints are not supported release channels. Registry integrity and provenance do not substitute for the separate provider and execution evidence recorded in [docs/LIVE_CERTIFICATION.md](./docs/LIVE_CERTIFICATION.md).
 
 ## Reporting a vulnerability
 
@@ -14,7 +14,9 @@ Do not open a public issue for a suspected vulnerability. Use [GitHub private vu
 - the practical impact; and
 - any suggested mitigation.
 
-Private vulnerability reporting must be enabled before the repository is made public. If that channel is unavailable, do not disclose exploit details in a public issue.
+Private vulnerability reporting is enabled for this public repository. If GitHub reports that the channel is unavailable, do not disclose exploit details in a public issue; wait for the maintainers to restore the private channel.
+
+The enabled no-cost public controls and the explicitly cost-gated features left disabled are recorded in [docs/PUBLIC_SECURITY.md](./docs/PUBLIC_SECURITY.md).
 
 ## Scope
 

package/SUPPORT.md

@@ -1,6 +1,8 @@
 # Support
 
-Zhivex Harness `0.10.x` is a pre-1.0 Node-first CLI and TypeScript library. Observable contracts may change in a later minor release when the change and migration path are documented in [CHANGELOG.md](./CHANGELOG.md). The source checkout may be a release candidate newer than the latest public npm artifact.
+Zhivex Harness `0.11.x` is the latest supported pre-1.0 Node-first CLI and TypeScript library. Observable contracts may change in a later minor release when the change and migration path are documented in [CHANGELOG.md](./CHANGELOG.md). The mutable machine-readable public release state is recorded in the repository [release-status.json](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json), outside immutable npm artifacts.
+
+The detailed 1.0 target is tracked in the [machine-readable support matrix](./docs/support-matrix.json) and its [human-readable view](./docs/SUPPORT_MATRIX.md). Compatibility and removals follow [DEPRECATIONS.md](./docs/DEPRECATIONS.md) once 1.0 is promoted.
 
 ## Supported baseline
 
@@ -11,7 +13,7 @@ Zhivex Harness `0.10.x` is a pre-1.0 Node-first CLI and TypeScript library. Obse
 - the provider/model combinations marked certified in the package documentation; and
 - HTTPS or explicitly allowed loopback-HTTP MCP endpoints using the documented bounded JSON-RPC subset.
 
-Only the most recent published patch receives routine fixes. Meta and Qwen retain their date-bound certification, OpenAI GPT-5.6 has local `0.8.0` base-gate evidence, and Gemini remains provisional until the complete harness live matrix passes. Live provider evidence is account-, model-, endpoint-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](./docs/LIVE_CERTIFICATION.md).
+Only the most recent published `0.11.x` patch receives routine fixes. The exact `v0.11.1` tag passed the protected release-bound base, orchestration, routing, and model-directed execution matrix for Meta, Qwen, and OpenAI on 2026-08-23. Gemini remains provisional until its complete harness live matrix passes against an exact release candidate. Live provider evidence is account-, model-, endpoint-, artifact-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](./docs/LIVE_CERTIFICATION.md).
 
 ## Support channels