@zhivex-ai/harness 0.11.1 → 1.0.0-rc.12

package/CHANGELOG.md

@@ -4,7 +4,169 @@ All notable changes to Zhivex Harness are documented in this file.
 
 The project follows Semantic Versioning. During `0.x`, minor releases may change user-facing contracts when the change is documented with a migration note. Patch releases remain backwards compatible bug fixes.
 
-## Unreleased
+## 1.0.0-rc.12 - 2026-09-02
+
+### Fixed
+
+- Keep `git_diff` read-only even under hostile repository configuration: disable repository-controlled filesystem monitors, external diffs, text conversion, and submodule processing; discover changed paths with NUL-safe output; and render only paths permitted by the Harness hard-ignore and sensitive-name policy.
+- Bind MCP configuration loading to one regular, single-link file descriptor with `O_NOFOLLOW`, a 1 MiB limit, canonical-parent containment, and inode continuity from initial inspection through the stable read.
+
+### Changed
+
+- Expand the security-review inventory from mutation/execution tools to all 28 model-facing tool classes, including repository reads, inspection, skill loading, delegation, and dynamic MCP tools, with a regression that rejects future inventory drift.
+- Require direct mitigation, regression evidence, residual risk, and passing status for every reviewed trust boundary and authority-bearing tool. Non-informational findings now require an owner, disposition, rationale, and HTTPS follow-up; critical/high findings cannot be accepted without mitigation.
+- Preserve published RC.11 as immutable historical evidence while authorizing RC.12 as the new pending candidate required by HAR-HU-03 remediation. No RC.12 artifact, live certification, registry integrity, or provenance is claimed before the exact tag completes the protected workflow.
+
+## 1.0.0-rc.11 - 2026-09-02
+
+### Fixed
+
+- Keep the governed Qwen representative driver on its certified Responses path instead of selecting Chat through an incompatible transport-level `maxTokens` option; the same output limit remains enforced by the Harness durable token guard before and after each provider step.
+
+### Changed
+
+- Record the immutable, unpublished RC.10 attempt as failed after its exact tarball passed artifact binding: Meta completed 14/14 representative cases, Qwen completed 13/14, and an OpenAI account-funding issue surfaced as retryable HTTP 500 failures across live and representative gates; npm publication remained skipped.
+- Record the protected RC.11 workflow's fail-closed first attempt, where one Qwen representative case returned `EXECUTION_FAILED`, Meta and OpenAI completed 14/14, Qwen completed 13/14, no unauthorized effects were observed, and npm publication remained skipped for that attempt.
+- Publish the complete second RC.11 attempt to `next` only after every deterministic, exact-artifact, OCI, live-provider, and representative gate passed from scratch; Meta, Qwen, and OpenAI each completed 14/14, and the registry artifact passed exact SHA-512 integrity plus SLSA provenance verification.
+
+## 1.0.0-rc.10 - 2026-09-01
+
+### Fixed
+
+- Isolate the non-release early-diagnostic fixture from release-bound environment variables, so the test remains hermetic when `bun test` runs inside the validation job while real incomplete diagnostic bindings continue to fail closed.
+- Allow the immutable readiness ledger to record a deterministic pre-artifact failure with an explicit null artifact digest and `not-run` live certification instead of inventing an artifact identity.
+
+### Changed
+
+- Record the immutable, unpublished RC.9 attempt as failed during deterministic validation before packing: one environment-sensitive test failed, no release tarball was created, every live/representative gate was skipped, and npm publication was not dispatched.
+- Extend the representative release matrices through `v1.0.0-rc.10`; RC.10 remains pending until its distinct commit and annotated tag complete the full protected workflow.
+
+## 1.0.0-rc.9 - 2026-09-01
+
+### Fixed
+
+- Build `dist/` before the manual tag-bound live-certification workflow packs and inspects the candidate, preventing a source-only tarball from failing artifact binding before OCI and provider gates can run.
+
+### Changed
+
+- Record the immutable, unpublished RC.8 attempt as failed at artifact binding: exact-tag readiness passed, but OCI and every provider gate were skipped, no diagnostic artifact was produced, and npm publication was not dispatched.
+- Extend the representative release matrices through `v1.0.0-rc.9`; RC.9 remains pending until its exact tag completes protected certification.
+
+## 1.0.0-rc.8 - 2026-09-01
+
+### Fixed
+
+- Complete HAR-HU-01 release diagnostics without relaying child stdout/stderr: every live gate now persists only strict sanitized outcomes identified by provider or phase, and the final summary remains fail-closed.
+- Record a missing provider credential as that provider's configuration failure so the remaining selected providers still execute, and include OCI image preload as an independent diagnostic gate instead of short-circuiting the matrix.
+
+### Changed
+
+- Refresh the coordinated Zhivex dependency set to the current published versions verified for this candidate: `@zhivex-ai/core@1.11.0`, `@zhivex-ai/qwen@0.11.1`, and `@zhivex-ai/gemini@0.11.0`, while retaining current Agents `1.3.0`, Meta `0.2.2`, OpenAI `0.10.0`, exact package pins, and one Core override across every adapter.
+- Keep the Harness Qwen tool-call-ID normalizer as a defense-in-depth boundary while adopting the adapter's current missing/placeholder-ID normalization, Responses continuation correlation, and Bun realtime frame-limit correction.
+- Authorize `v1.0.0-rc.8` in the representative evaluation matrices and record it as pending. No live-provider, representative-repository, release-artifact, registry, or provenance result is claimed before the exact candidate completes those gates.
+
+## 1.0.0-rc.7 - 2026-08-25
+
+### Fixed
+
+- Keep `@zhivex-ai/core@1.10.0`, `@zhivex-ai/agents@1.3.0`, and `@zhivex-ai/openai@0.10.0`, while restoring `@zhivex-ai/qwen@0.10.2`, the last adapter that passed the complete release-bound Qwen representative matrix. Qwen `0.10.3` failed closed before the Harness durable tool-call-ID normalizer could recover the affected turns.
+
+### Changed
+
+- Record the immutable, unpublished RC.6 attempt as failed after exact-artifact and release-bound live certification passed, while Qwen resolved only 12/14 representative cases in both the original protected run and one retry; npm publication remained skipped.
+- Extend the representative release matrix through `v1.0.0-rc.7`; because RC.6 cannot count toward GA, a later independent passing candidate will still be required before stable promotion.
+
+## 1.0.0-rc.6 - 2026-08-25
+
+### Fixed
+
+- Upgrade the coordinated Zhivex SDK batch to `@zhivex-ai/core@1.10.0`, `@zhivex-ai/agents@1.3.0`, `@zhivex-ai/openai@0.10.0`, and `@zhivex-ai/qwen@0.10.3`, retaining exact pins and one Core override across every provider adapter.
+- Preserve the sanitized OpenAI Responses tool-call diagnostic and retryability from durable SDK failures in Time-to-Safe-Fix evidence without retaining raw arguments, provider payloads, or error messages.
+- Complete the governed representative driver from the signed, journaled `apply_environment_patch` receipt after its separate edit, verifier, inspection, and import approvals, avoiding a redundant final provider turn after the authorized repair is already durable.
+
+### Changed
+
+- Record the immutable, unpublished RC.5 attempt as failed after exact-artifact validation and release-bound live certification passed but OpenAI resolved only 13/14 representative cases.
+- Advance the next candidate to `v1.0.0-rc.6`; because RC.5 cannot count toward GA, a later independent passing candidate will still be required before stable promotion.
+
+## 1.0.0-rc.5 - 2026-08-24
+
+### Fixed
+
+- Replace missing, whitespace-only, and legacy numeric Qwen streaming tool-call IDs with deterministic, turn-durable IDs before agent state can observe them; preserve valid provider IDs and reject real duplicates fail-closed.
+- Persist a bounded failure origin and allowlisted provider diagnostic code in Time-to-Safe-Fix failures, including through typed Harness error causes, without retaining provider messages or raw output.
+
+### Changed
+
+- Record the immutable, unpublished RC.4 attempt as failed after its release-bound live-provider gate passed but Qwen resolved only 13/14 representative cases.
+- Extend the representative release matrix through `v1.0.0-rc.6`; RC.5 and RC.6 must both pass independently before GA.
+
+## 1.0.0-rc.4 - 2026-08-24
+
+### Fixed
+
+- Preserve stable typed Harness failure `code`, `category`, and `retryable` metadata alongside Time-to-Safe-Fix semantic classification, so transient provider and OCI execution failures remain machine-classifiable without retaining raw error text.
+
+### Changed
+
+- Record the immutable, unpublished RC.3 release attempt as failed at the representative-evaluation gate after exact-artifact, release-bound live certification, and the Meta matrix passed.
+- Extend the representative release matrix through `v1.0.0-rc.5` because RC.1, RC.2, and RC.3 cannot count toward the two-passing-candidate GA requirement.
+
+## 1.0.0-rc.3 - 2026-08-24
+
+### Fixed
+
+- Persist bounded structured diagnostics for failed representative-provider cases while continuing to exclude raw prompts, model output, raw provider error text, and workspace contents from release artifacts.
+- Record whether the release-bound live-provider gate passed or failed independently from other failed release gates, and reject contradictory ledger evidence.
+
+### Changed
+
+- Record the immutable, unpublished RC.2 release attempt as failed at the representative-evaluation gate after exact-artifact and release-bound live certification passed.
+- Extend the representative release matrix through `v1.0.0-rc.4` because RC.1 and RC.2 cannot count toward the two-passing-candidate GA requirement.
+
+## 1.0.0-rc.2 - 2026-08-23
+
+### Fixed
+
+- Normalize missing or whitespace-only Qwen tool-call IDs at the built-in provider boundary before durable agent state, approvals, or tool journals can observe them; preserve valid provider IDs and reject duplicate IDs fail-closed.
+
+### Changed
+
+- Record immutable release attempts that fail protected gates without claiming npm publication or provenance, exclude them from passing GA evidence, and require two later passing candidates before stable promotion.
+- Extend the representative release matrix through `v1.0.0-rc.3` because the failed, unpublished RC.1 attempt cannot count toward the two-candidate GA requirement.
+
+## 1.0.0-rc.1 - 2026-08-23
+
+### Added
+
+- Add a machine-checked 1.0 public API/CLI/schema baseline, support matrix, threat/control map, deprecation and rollback policies, representative-evidence schema, and a fail-closed GA readiness ledger.
+- Add an explicit config schema `4` to `5` migration helper that preserves the older authority boundary by disabling project context and OCI shell exposure unless the operator opts in after review.
+- Add stable machine error codes with typed configuration/CLI usage errors and compile a TypeScript consumer against the installed release tarball.
+- Add schema-1 parsers and golden fixtures for public JSON/JSONL output, a command-specific CLI option manifest, and provider-free logical SQLite state status/export/import commands.
+- Add byte-for-byte SQLite migration fixtures generated from the integrity-verified published `0.10.0` and `0.11.1` artifacts and verify them through current run and session APIs.
+- Add a seven-repository, 14-run representative matrix with strict per-case evidence generation, sanitized cross-provider assembly, and a protected Meta/Qwen/OpenAI release job that blocks npm publication.
+- Add a strict release-candidate security-review schema covering every control, trust boundary, authority-bearing tool, finding, reviewer, artifact binding, and remotely verified CI/CodeQL/release workflow.
+
+### Changed
+
+- Allow protected `1.0.0-rc.N` artifacts only on npm `next`, keep stable releases on `latest`, and reject version/channel drift before publication.
+- Bind each GA release-candidate record to a distinct annotated tag, main-reachable commit, published npm integrity, SLSA provenance statement, and successful release workflow; require every declared provider/scenario on both candidates, verify the evaluation workflows through GitHub, and require a concrete security-review artifact.
+- Expose CLI command/subcommand constants as the source for the frozen command manifest and document previously omitted child-budget options in help output.
+- Emit a distinct compact `run-stream-result` JSONL terminal record, keep machine errors message-free, and delay terminal JSONL output until asynchronous persistence/environment cleanup succeeds.
+- Run installed-package smoke against the exact inspected tarball in CI, reject SQLite WAL/SHM sidecars, and clean `dist` before every build.
+- Classify all 213 runtime and 166 type exports explicitly as Stable, Beta, or Experimental, and compare the complete partition with the installed tarball namespace and declarations.
+- Bind every Stable runtime and type export to a reproducible declaration-closure hash and verify that signature snapshot against source-emitted and installed-tarball declarations.
+- Keep Gemini explicitly provisional and outside the 1.0 certified cohort; accept later corrective RCs only as a contiguous sequence after the required RC.1 and RC.2.
+
+### Security
+
+- Stream integrity-pinned historical npm archives directly into an isolated extractor instead of persisting network bytes, constrain MCP authentication to canonical credential headers backed by dedicated `ZHIVEX_MCP_*` variables, publish state backups atomically without clobbering existing targets, and reject orphaned active leases for runs being imported.
+
+### Migration
+
+- Existing schema `5` configuration is unchanged. Call `migrateHarnessConfigInput` for an explicitly versioned schema `4` input; the pure migration does not read environment variables or filesystem state. Paused approvals remain bound to the exact older artifact and are never rewritten.
+- Existing schema-1 JSON observers may accept additive fields, but JSONL consumers must recognize the distinct `run-stream-result` and `run-stream-error` terminal kinds. The literal durable `userId` value `"*"` is now rejected because it is reserved for the absent-user scope marker.
+- Rename MCP credential variables to the `ZHIVEX_MCP_*` namespace; HTTP `headerEnv` entries now accept only `authorization` and `x-api-key`.
 
 ## 0.11.1 - 2026-08-23
 
@@ -15,7 +177,7 @@ The project follows Semantic Versioning. During `0.x`, minor releases may change
 - Keep release-artifact transfer actions pinned to immutable commit SHAs while allowing Dependabot SHA upgrades, and represent successful remote tag-bound certification explicitly in the release-status schema.
 - Add a mutable machine-readable repository release-status record, keep it outside immutable npm artifacts, and validate public documentation, release gates, and repository security configuration against it.
 - Bound installed-package smoke subprocesses by time and captured output so a stalled child process cannot hang release validation indefinitely.
-- Keep public documentation consistent with the published `0.11.0` artifact while preserving live-provider certification as a separate evidence boundary.
+- Keep public documentation consistent with candidate and published artifact state while preserving live-provider certification as a separate evidence boundary.
 - Retry only transient HTTP failures in the opt-in base provider smoke, using fresh temporary state and a bounded three-attempt schedule; contract and approval failures still fail immediately.
 - Preserve transient provider status from failed agent outputs before release-smoke contract assertions so retryable 429/5xx responses reach the bounded retry loop.
 - Mark create-only `expectedDigest: null` as an explicitly required tool-schema field and reinforce that contract in live certification prompts for providers that otherwise omit null-valued arguments.

package/README.md

@@ -13,7 +13,7 @@ Zhivex Harness runs coding agents against real repositories with conflict-safe e
 
 The model provides capability. The harness controls what it may inspect, execute, change, resume, and prove. Every provider uses the same bounded tool and approval contract.
 
-Version `0.11.1` is the current source release candidate; `0.11.0` remains the public npm release and `latest` distribution tag until protected publication completes. Candidate provenance and certification are pending in the [repository release status](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json). Publication is fail-closed on deterministic, installed-package, real-OCI, base-provider, orchestration, routing, and model-directed execution gates. See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), [public repository security](./docs/PUBLIC_SECURITY.md), the [change-envelope guide](./docs/CHANGE_ENVELOPES.md), the [CLI contract](./docs/CLI.md), the [context-engineering guide](./docs/CONTEXT_ENGINEERING.md), the [extensibility guide](./docs/EXTENSIBILITY.md), and the [durable-operations guide](./docs/DURABLE_OPERATIONS.md).
+Version `0.11.1` is the current public npm release and `latest` distribution tag. Its annotated tag, exact registry integrity, SLSA provenance, and release-bound Meta/Qwen/OpenAI certification are recorded in the [repository release status](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json). Publication remains fail-closed on deterministic, installed-package, real-OCI, base-provider, orchestration, routing, and model-directed execution gates. The planned 1.0 promotion is tracked by the [machine-checked readiness gate](./docs/GA_READINESS.md), [API stability policy](./docs/STABILITY.md), [support matrix](./docs/SUPPORT_MATRIX.md), and [threat model](./docs/THREAT_MODEL.md). See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), [public repository security](./docs/PUBLIC_SECURITY.md), the [change-envelope guide](./docs/CHANGE_ENVELOPES.md), the [CLI contract](./docs/CLI.md), the [context-engineering guide](./docs/CONTEXT_ENGINEERING.md), the [extensibility guide](./docs/EXTENSIBILITY.md), and the [durable-operations guide](./docs/DURABLE_OPERATIONS.md).
 
 ## Why Zhivex Harness
 
@@ -109,7 +109,7 @@ It does not include arbitrary host shell access, `stdio` MCP, permanent deletion
 
 ## Installation
 
-After protected publication, install the Node-first `0.11.1` artifact with an exact version:
+Install the Node-first `0.11.1` artifact with an exact version:
 
 ```bash
 npx --yes --package=@zhivex-ai/harness@0.11.1 zhx --version
@@ -196,7 +196,7 @@ zhx run --provider openai --route explorer=qwen --route reviewer=gemini \
   "implement the change, then review it independently"
 ```
 
-Routing with `--max-cost-usd` remains rejected in `0.11.0`: aggregate usage cannot yet be priced correctly when roles use different models.
+Routing with `--max-cost-usd` remains rejected in `0.11.1`: aggregate usage cannot yet be priced correctly when roles use different models.
 
 Writes and checks pause for approval. In a non-interactive execution, state is saved in `.zhivex-harness/runs/operations.sqlite`:
 
@@ -282,14 +282,14 @@ zhivex-harness run --execution oci --oci-shell ask "use a reviewed shell pipelin
 
 | Provider | Default model | Current support |
 | --- | --- | --- |
-| Meta | `muse-spark-1.2` | `MODEL_API_KEY` · 0.6 edit, delegation, and OCI execution certified |
-| Qwen | `qwen3.8-max` | `DASHSCOPE_API_KEY` or `QWEN_API_KEY` · 0.6 edit, delegation, and OCI execution certified |
-| OpenAI | `gpt-5.6-luna` | `OPENAI_API_KEY` · GPT-5.6 Luna, Terra, and Sol base workflow passed locally; release recertification pending |
+| Meta | `muse-spark-1.2` | `MODEL_API_KEY` · 0.11.1 release-bound base, delegation, and OCI execution certified |
+| Qwen | `qwen3.8-max` | `DASHSCOPE_API_KEY` or `QWEN_API_KEY` · 0.11.1 release-bound base, delegation, routing, and OCI execution certified |
+| OpenAI | `gpt-5.6-luna` | `OPENAI_API_KEY` · 0.11.1 release-bound base, delegation, routing, and OCI execution certified |
 | Gemini | `gemini-3.6-flash` | `GEMINI_API_KEY` or `GOOGLE_GENERATIVE_AI_API_KEY` · provisional until the harness live matrix passes |
 
 Override any model with `--model`. Optional provider overrides are `META_BASE_URL`, `QWEN_BASE_URL`, `QWEN_WORKSPACE_ID`, `QWEN_REGION`, `OPENAI_BASE_URL`, and `GEMINI_BASE_URL`. Non-credential transport settings are hash-bound to durable resumes without persisting their values.
 
-Meta and Qwen retain the published support conclusion for the unchanged approval/restart and delegation paths. OpenAI remains GPT-5.6-first from `0.8.0`: Luna is the default, while Terra and Sol remain explicit `--model` selections. The tagged Node-first `0.11.0` artifact is published with registry integrity and provenance; its release-bound remote provider matrix remains pending and is not implied by publication. Controlled and official-SDK MCP interoperability are verified separately and do not imply compatibility with every server or protocol feature. Provider capability claims remain artifact- and date-bound under the [live certification contract](./docs/LIVE_CERTIFICATION.md); credential detection and deterministic tests do not replace real provider evidence.
+The exact `v0.11.1` tag passed proposal/approval/restart, bounded delegation, OpenAI-parent/Qwen-reviewer routing, and model-directed OCI execution for Meta `muse-spark-1.2`, Qwen `qwen3.8-max`, and OpenAI `gpt-5.6-luna` on 2026-08-23. Luna remains the OpenAI default, while Terra and Sol remain explicit `--model` selections with older local base evidence only. Controlled and official-SDK MCP interoperability are verified separately and do not imply compatibility with every server or protocol feature. Provider capability claims remain artifact- and date-bound under the [live certification contract](./docs/LIVE_CERTIFICATION.md); credential detection and deterministic tests do not replace real provider evidence.
 
 ## Security boundaries
 
@@ -318,6 +318,7 @@ The default `none` backend provides governance but no OS isolation and therefore
 
 ```bash
 bun run typecheck
+bun run readiness:1.0
 bun test
 bun run build
 bun run evaluate

package/ROADMAP.md

@@ -3,7 +3,7 @@
 - Status: active
 - Baseline date: 2026-08-21
 
-This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library contract. The `0.2.0` source baseline is tagged locally, `0.3.0` and `0.4.0` are private checkpoints, and `0.5.0` through `0.11.0` are published on npm. Version `0.11.1` is the local source release candidate for file and release hardening without a `0.11.x` contract change. It is not yet tagged or published as a new artifact; registry publication, supply-chain provenance, and provider certification remain separate evidence boundaries. Releases are ordered by dependency and safety risk, not by calendar date. A version ships only when its exit criteria are satisfied.
+This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library contract. The `0.2.0` source baseline is tagged locally, `0.3.0` and `0.4.0` are private checkpoints, and `0.5.0` through `0.11.1` are published on npm. Version `0.11.1` delivers file and release hardening without a `0.11.x` contract change; registry publication, supply-chain provenance, and provider certification remain separate evidence boundaries. Releases are ordered by dependency and safety risk, not by calendar date. A version ships only when its exit criteria are satisfied.
 
 ## Planning principles
 
@@ -45,7 +45,7 @@ The `0.6.0` dependency batch pins and overrides `@zhivex-ai/core@1.6.0`, retaini
 | `0.9.0` | Fast governed change admission | Lower repository/OCI overhead plus portable offline evidence bound to exact patch bytes | Published on npm | L |
 | `0.10.0` | Node-first portability | Node CLI/library, portable SQLite/processes, manager-aware checks, and Node OCI | Published on npm | L |
 | `0.11.0` | Daily-driver foundations | Richer terminal operation, governed context/skills/hooks, and opt-in OCI shell | Published on npm | L |
-| `0.11.1` | Security and release hardening | Bounded reads, recoverable cleanup, and fail-closed release evidence | Local release candidate | S |
+| `0.11.1` | Security and release hardening | Bounded reads, recoverable cleanup, and fail-closed release evidence | Published on npm | S |
 | `1.0.0` | Stable contract | Supported compatibility and release guarantees | Planned | L |
 
 Relative size is for sequencing only; dates require a capacity decision.
@@ -333,7 +333,7 @@ Exit criteria:
 
 ## 0.11.1 — security and release hardening
 
-Status: local source release candidate. It is not yet tagged or published as a new artifact; provenance and release-bound live certification remain pending.
+Status: published on npm as `latest` with annotated tag `v0.11.1`, exact registry integrity, SLSA provenance, and successful release-bound Meta/Qwen/OpenAI certification.
 
 Goal: ship the reviewed security and release hardening accumulated after `0.11.0` without changing configuration, durable state, or execution-policy contracts.
 
@@ -355,6 +355,8 @@ Exit criteria:
 
 Goal: freeze a supportable public contract after the pre-1.0 safety and operational surfaces have been exercised in real repositories.
 
+Status: RC.1 through RC.6 did not complete every protected gate, so every publication was skipped. RC.6 passed release-bound live certification and Meta's complete representative matrix, then failed closed at Qwen with 12/14 safe resolutions in both the original run and one retry. RC.7 retained the Core, Agents, and OpenAI corrections, restored Qwen to the last adapter certified by this matrix, passed exact-artifact, live-provider, and all three 14-case representative gates, and was published to npm `next` with verified SHA-512 integrity and SLSA provenance. RC.8 carried the coordinated Core `1.11.0`, Qwen `0.11.1`, and Gemini `0.11.0` refresh and passed exact-tag readiness, but its manual protected workflow packed before building `dist/`; artifact binding failed, OCI and provider gates were skipped, and npm publication was not dispatched. RC.9 corrected that workflow and passed manual protected certification, but its release-bound deterministic job exposed an environment-sensitive early-diagnostic test before packing; no release tarball was created and every downstream job was skipped. RC.10 isolated that fixture and produced a valid exact tarball, then failed closed because an OpenAI account-funding issue surfaced as retryable HTTP 500 failures and Qwen resolved 13/14 representative cases; npm publication was skipped. RC.11 preserved its fail-closed first attempt, then reran every protected gate from scratch; Meta, Qwen, and OpenAI each completed 14/14 representative cases, and the exact validated artifact was published to npm `next` with verified SHA-512 integrity and SLSA provenance. Public API/CLI/schema baselines, config `4 → 5` migration, historical tarball fixtures, support/security/rollback policy, RC channel enforcement, representative-evaluation generation, and evidence requirements remain machine-checked. The two required passing candidates are now recorded; GA remains blocked on the final-candidate security review in [`docs/ga-readiness.json`](./docs/ga-readiness.json).
+
 Scope:
 
 - Stabilize CLI commands, config schema, JSON/event schemas, library exports, state migrations, and error taxonomy.
@@ -396,8 +398,9 @@ These can become separate post-1.0 tracks after the CLI/runtime contract and sec
 
 ## Immediate next actions
 
-1. Configure maintainer-approved provider secrets in the protected `live-certification` environment and run the complete release-bound matrix against the exact annotated tag.
-2. Keep publication fail-closed on base, orchestration, routing, model-directed OCI execution, exact-artifact, integrity, and provenance evidence.
-3. Stabilize the CLI, config, JSON/event, library export, state migration, and error contracts required for the first `1.0.0` release candidate.
-4. Publish the support matrix, threat model, migration/export path, and representative cross-provider repository evaluation evidence.
-5. Complete two release candidates without a contract-breaking defect before promoting `1.0.0` to `latest`.
+1. Preserve RC.7's published exact-artifact, live-provider, representative-matrix, registry-integrity, and SLSA provenance evidence.
+2. Preserve RC.8 as an immutable failed attempt bound to its source-only tarball and protected run; do not move or reuse its tag.
+3. Preserve RC.9 and RC.10 as failed, unpublished attempts with their distinct failure evidence; do not move or reuse either tag.
+4. Preserve RC.11's published exact-artifact, live-provider, representative-matrix, registry-integrity, and SLSA provenance evidence, including its separate fail-closed first attempt.
+5. Complete the named security review against the final passing candidate and close every critical/high finding.
+6. Promote a separately tagged and verified `1.0.0` artifact to `latest` only after the release-mode readiness gate passes with two passing candidates.

package/SUPPORT.md

@@ -2,6 +2,8 @@
 
 Zhivex Harness `0.11.x` is the latest supported pre-1.0 Node-first CLI and TypeScript library. Observable contracts may change in a later minor release when the change and migration path are documented in [CHANGELOG.md](./CHANGELOG.md). The mutable machine-readable public release state is recorded in the repository [release-status.json](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json), outside immutable npm artifacts.
 
+The detailed 1.0 target is tracked in the [machine-readable support matrix](./docs/support-matrix.json) and its [human-readable view](./docs/SUPPORT_MATRIX.md). Compatibility and removals follow [DEPRECATIONS.md](./docs/DEPRECATIONS.md) once 1.0 is promoted.
+
 ## Supported baseline
 
 - Node.js `22.13.0` or newer; Node 24 LTS is the release and default OCI baseline;
@@ -11,7 +13,7 @@ Zhivex Harness `0.11.x` is the latest supported pre-1.0 Node-first CLI and TypeS
 - the provider/model combinations marked certified in the package documentation; and
 - HTTPS or explicitly allowed loopback-HTTP MCP endpoints using the documented bounded JSON-RPC subset.
 
-Only the most recent published `0.11.x` patch receives routine fixes. The exact `v0.11.0` tag source has date-bound local base and orchestration evidence for Meta, Qwen, and OpenAI plus OpenAI-to-Qwen routing evidence. The `0.11.1` candidate must pass the protected release-bound matrix before publication, and Gemini remains provisional until its complete harness live matrix passes. Live provider evidence is account-, model-, endpoint-, artifact-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](./docs/LIVE_CERTIFICATION.md).
+Only the most recent published `0.11.x` patch receives routine fixes. The exact `v0.11.1` tag passed the protected release-bound base, orchestration, routing, and model-directed execution matrix for Meta, Qwen, and OpenAI on 2026-08-23. Gemini remains provisional until its complete harness live matrix passes against an exact release candidate. Live provider evidence is account-, model-, endpoint-, artifact-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](./docs/LIVE_CERTIFICATION.md).
 
 ## Support channels