@zhivex-ai/harness 0.5.0 → 0.6.1

package/CHANGELOG.md

@@ -4,6 +4,61 @@ All notable changes to Zhivex Harness are documented in this file.
 
 The project follows Semantic Versioning. During `0.x`, minor releases may change user-facing contracts when the change is documented with a migration note. Patch releases remain backwards compatible bug fixes.
 
+## 0.6.1 - 2026-08-17
+
+### Added
+
+- A reproducible hostile-repository demonstration that exercises two durable approval boundaries, SQLite reopen, secret-free OCI execution, denied outbound network, separate host patch import, exactly-once journal evidence, ledger redaction, and stale-host rejection.
+- A deterministic social-preview asset and a launch-oriented README path centered on governed repository change control.
+- Structured GitHub issue forms for reproducible bugs and bounded feature requests.
+
+### Changed
+
+- Repositioned the package as a governed, provider-portable runtime for coding agents instead of a generic coding-agent harness.
+- Expanded npm discovery metadata and documented the verified public `0.6.0` registry/provenance baseline.
+- Updated support, security, roadmap, release, and certification documentation to reflect that `0.6.0` is published.
+
+### Migration
+
+- No runtime, CLI, configuration, persisted-state, or public-library contract changes are required from `0.6.0`.
+
+### Security
+
+- The demo uses a disposable fixture and a decoy secret; it never reads or prints operator credentials.
+- The scripted proof does not weaken approvals: environment execution and host import remain separate interruptible operations.
+
+## 0.6.0 - 2026-08-17
+
+### Added
+
+- An SDK-native enforced execution environment backed by Docker or Podman, with an adapter boundary for future remote workers.
+- Secret-free ephemeral workspace snapshots, no container network, a read-only root filesystem, non-root execution, dropped capabilities, `no-new-privileges`, bounded CPU, memory, PIDs, time, output, workspace, file, and tmpfs usage. Commands run on a quota-backed tmpfs volume and publish successful results through a frozen, validated staging copy rather than a writable host bind mount.
+- Approved argv-only `run_environment_command`, isolated `run_check`, read-only environment status and patch inspection, and a distinct approved patch-import tool for host mutations.
+- Image/policy/workspace/run fingerprint binding, labeled container and volume ownership, cancellation cleanup, orphan cleanup, retained audit metadata, and installed-artifact plus real-runtime smoke coverage.
+- An execution-environment guide and OCI diagnostics in `doctor`.
+
+### Changed
+
+- Resolved configuration uses schema version `4` and adds a discriminated `execution` policy. The default remains `none`, where generic shell is unavailable.
+- Repository tools and subagents use the acquired snapshot while OCI execution is active. Host `git_diff` is omitted from the model tool set, and MCP is rejected before discovery rather than executing undeclared operations outside the no-network environment boundary.
+- CLI runs persist their resolved non-secret configuration so a locator-only `resume --approve|--deny` restores the original OCI policy instead of falling back to `execution=none`.
+- Environment patches compare, review, bind, import, and roll back file permission modes, including mode-only changes and newly created executable files.
+- The Zhivex SDK dependency batch now resolves one `@zhivex-ai/core@1.6.0` runtime; OpenAI is updated to `0.9.5`.
+- The release workflow is OIDC-only and runs the enforced OCI gate before packaging or live-provider certification.
+
+### Migration
+
+- Replace schema-version-pinned `schemaVersion: 3` configuration with `4`. Existing scoped SQLite data needs no database rewrite.
+- Existing behavior remains available with `executionBackend: "none"` or `ZHIVEX_HARNESS_EXECUTION=none`; this does not expose shell-class tools.
+- To enable OCI, preload the configured image and set `executionBackend: "oci"` (or `--execution oci`). Paused `0.5.x` runs cannot be silently rebound because the tool and execution fingerprints changed.
+- Do not combine the enforced no-network OCI policy with network MCP in one run. Perform governed MCP discovery separately, or define a future policy/backend that can enforce the intended network boundary.
+
+### Security
+
+- Host credentials and arbitrary environment variables are not inherited by container processes; hard secret exclusions apply before snapshot creation.
+- The harness never pulls images implicitly, never uses a shell to interpret model commands, and cleans only containers or volumes carrying its ownership label.
+- Host changes require a content- and run-bound patch identifier plus a separate interrupt approval; stale host digests fail closed and deletions remain recoverable through quarantine.
+
 ## 0.5.0 - 2026-08-17
 
 ### Added

package/README.md

@@ -1,12 +1,46 @@
 # Zhivex Harness
 
-Zhivex Harness is a Bun-first coding-agent harness portable across Meta, Qwen, and OpenAI, built on the Stable `@zhivex-ai/agents` runtime.
+**Governed execution for coding agents.**
 
-The model provides capability; the harness provides repository context, narrow tools, limits, approvals, durable state, diagnostics, and verification. Every provider uses the same agent loop and local-tool contract.
+[![npm](https://img.shields.io/npm/v/%40zhivex-ai%2Fharness?logo=npm)](https://www.npmjs.com/package/@zhivex-ai/harness)
+[![CI](https://github.com/Zhivex/zhivex-harness/actions/workflows/ci.yml/badge.svg)](https://github.com/Zhivex/zhivex-harness/actions/workflows/ci.yml)
+[![Bun](https://img.shields.io/badge/Bun-%3E%3D1.3.7-fbf0df?logo=bun)](https://bun.sh/)
+[![License](https://img.shields.io/badge/license-MIT-22c55e.svg)](./LICENSE)
 
-Version `0.5.0` is a publication-ready extensibility-and-orchestration candidate. The package manifest and protected release workflow are ready, but the immutable npm publication has not been executed. Public availability begins only after the repository and npm prerequisites in the [release guide](./docs/RELEASE.md) are completed and a maintainer explicitly dispatches the workflow. See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), the [extensibility guide](./docs/EXTENSIBILITY.md), the [durable-operations guide](./docs/DURABLE_OPERATIONS.md), and the [trusted-editing contract](./docs/REPOSITORY_EDITING.md).
+![Zhivex Harness: Let agents work. Control every change.](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/assets/social-preview.png)
 
-## What 0.5 includes
+Zhivex Harness runs coding agents against real repositories with conflict-safe edits, durable approvals, isolated execution, and redacted operational evidence. It is a Bun-first local CLI and TypeScript library portable across Meta, Qwen, and OpenAI, built on the Stable `@zhivex-ai/agents` runtime.
+
+The model provides capability. The harness controls what it may inspect, execute, change, resume, and prove. Every provider uses the same bounded tool and approval contract.
+
+Version `0.6.1` is the positioning and hostile-repository proof patch for the `0.6.x` enforced-execution line. `0.6.0` is public on npm; its exact tarball, `latest` tag, and SLSA workflow provenance were verified against source tag `v0.6.0`. See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), the [execution-environment guide](./docs/EXECUTION_ENVIRONMENTS.md), the [extensibility guide](./docs/EXTENSIBILITY.md), the [durable-operations guide](./docs/DURABLE_OPERATIONS.md), and the [trusted-editing contract](./docs/REPOSITORY_EDITING.md).
+
+## Why Zhivex Harness
+
+Provider choice, MCP, subagents, and containers are useful building blocks. Zhivex Harness focuses on the change-control path that connects them:
+
+1. copy an eligible, secret-free repository snapshot into an enforced OCI environment;
+2. execute only approved, allowlisted argv commands without host shell interpolation or container network;
+3. inspect a content- and run-bound patch while the host workspace remains unchanged;
+4. require a separate durable approval before importing that exact patch; and
+5. reject the import if either the reviewed patch or the host preconditions changed.
+
+Approvals, leases, idempotency claims, execution bindings, and exactly-once tool journals survive process restarts. Host deletions remain recoverable through quarantine, and operator exports are redacted by default.
+
+## Prove the boundary in five minutes
+
+The hostile-repository demo creates a disposable fixture containing malicious instructions and a decoy `.env`, then exercises the real OCI, approval, restart, patch-import, ledger, and stale-host boundaries:
+
+```bash
+bun install --frozen-lockfile
+docker pull oven/bun:1.3.7-slim
+bun run build
+bun run demo:hostile
+```
+
+The expected result is a schema-versioned JSON proof with `secretExcluded`, `networkDenied`, `exactlyOnceJournal`, and `staleHostImportBlocked` all set to `true`. Pass `--keep` to retain the disposable workspace for inspection. The complete scenario and evidence limits are documented in [docs/HOSTILE_REPOSITORY_DEMO.md](./docs/HOSTILE_REPOSITORY_DEMO.md).
+
+## What 0.6 includes
 
 - one-shot execution and interactive chat;
 - provider and model selection through the CLI;
@@ -26,27 +60,29 @@ Version `0.5.0` is a publication-ready extensibility-and-orchestration candidate
 - governed MCP over bounded HTTPS/loopback HTTP with explicit server/tool allowlists, permissions, timeouts, approvals, output limits, and environment-backed credentials;
 - named explorer, implementer, tester, and reviewer subagents with independent durable budgets and promoted approvals;
 - deterministic application-owned parallel read-only review groups with child progress, hierarchy, usage, and cost evidence;
+- optional enforced Docker/Podman execution with no container network, a read-only root filesystem, non-root execution, dropped capabilities, bounded CPU/memory/PIDs/time/output, and an ephemeral secret-free workspace snapshot;
+- argv-only allowlisted environment commands, isolated package checks, deterministic patch inspection, and a separate durable approval before importing changes into the host workspace;
+- environment/image/policy fingerprint binding, cancellation cleanup, labeled orphan cleanup, retained audit artifacts, and installed-package plus real-runtime smoke gates;
 - protection against path traversal, symlink escapes, unsafe state targets, secret-file reads, special files, concurrent non-overwrite races, and unbounded output;
 - Linux/macOS CI, installed-tarball smoke coverage, and opt-in live-provider certification.
 
-It does not include arbitrary shell access, `stdio` MCP, permanent deletion, Git writes, a desktop UI, OS isolation, or a managed sandbox. Tools and subagents run inside the workspace with the permissions of the local process.
+It does not include arbitrary host shell access, `stdio` MCP, permanent deletion, Git writes, a desktop UI, a remote worker, or a managed sandbox service. Without `--execution oci`, shell-class tools remain unavailable. With OCI enabled, repository tools, checks, and enabled subagents share the acquired snapshot; network MCP is rejected because it cannot truthfully satisfy the no-network execution policy.
 
 ## Requirements
 
 - Bun 1.3.7 or newer.
 - Git for repository status and diff inspection.
 - At least one supported provider credential for real model execution.
+- Docker or Podman plus a preloaded image when `--execution oci` is requested.
 
 ## Installation
 
-After `0.5.0` is published to npm:
-
 ```bash
 bun add @zhivex-ai/harness
 bunx zhivex-harness --version
 ```
 
-Until then, run the source checkout:
+To exercise the `0.6.1` source checkout:
 
 ```bash
 bun install --frozen-lockfile
@@ -161,17 +197,27 @@ The default check allowlist is `test`, `typecheck`, `lint`, and `build`. Replace
 zhivex-harness run --allow-check test:unit --allow-check format "apply the fix and validate it"
 ```
 
+Enable enforced local execution explicitly. The image must already exist locally; the harness never pulls it implicitly:
+
+```bash
+docker pull oven/bun:1.3.7-slim
+zhivex-harness doctor --execution oci
+zhivex-harness run --execution oci --yes "inspect, implement, test, review the environment patch, and import it"
+```
+
+`--yes` approves both command execution and the distinct host patch import. Omit it when a human should review each durable approval. Configuration, threat boundary, cleanup, and certification details are in [docs/EXECUTION_ENVIRONMENTS.md](./docs/EXECUTION_ENVIRONMENTS.md).
+
 ## Providers and defaults
 
 | Provider | Default model | Current support |
 | --- | --- | --- |
-| Meta | `muse-spark-1.2` | `MODEL_API_KEY` · 0.4 runtime and 0.5 delegation certified |
-| Qwen | `qwen3.8-max` | `DASHSCOPE_API_KEY` or `QWEN_API_KEY` · 0.4 runtime and 0.5 delegation certified |
-| OpenAI | `gpt-5.4` | `OPENAI_API_KEY` · 0.4 runtime and 0.5 delegation certified |
+| Meta | `muse-spark-1.2` | `MODEL_API_KEY` · 0.6 edit, delegation, and OCI execution certified |
+| Qwen | `qwen3.8-max` | `DASHSCOPE_API_KEY` or `QWEN_API_KEY` · 0.6 edit, delegation, and OCI execution certified |
+| OpenAI | `gpt-5.4` | `OPENAI_API_KEY` · 0.6 edit, delegation, and OCI execution certified |
 
 Override any model with `--model`. Optional provider overrides are `META_BASE_URL`, `QWEN_BASE_URL`, `QWEN_WORKSPACE_ID`, `QWEN_REGION`, and `OPENAI_BASE_URL`.
 
-Meta, Qwen, and OpenAI completed the 0.4 proposal, scoped-SQLite approval, process restart, and exactly-once patch gate on 2026-08-17. They also completed the separate 0.5 model-directed reviewer-delegation, child persistence, SQLite reopen, hierarchy, and aggregate-usage gate at `2026-08-17T02:21:45.553Z`. Controlled Streamable HTTP MCP interoperability over a real loopback server passed at `2026-08-17T13:05:05.542Z`; third-party server compatibility is not implied. Provider capability claims are date-bound by the [live certification gate](./docs/LIVE_CERTIFICATION.md); credential detection and deterministic tests do not replace real provider evidence.
+Meta, Qwen, and OpenAI completed the final `0.6.0` model-directed OCI command/review/import matrix together at `2026-08-17T16:49:12.975Z`, the proposal/approval/restart refresh at `2026-08-17T16:22:34.885Z`, and the delegation/persistence/hierarchy refresh at `2026-08-17T16:24:14.381Z`. Controlled Streamable HTTP MCP interoperability over a real loopback server passed at `2026-08-17T16:48:09.043Z`; independent interoperability with `@modelcontextprotocol/server@2.0.0` passed at `2026-08-17T16:48:09.141Z` in its legacy-stateless compatibility mode. These results do not imply compatibility with every server or protocol feature. Provider capability claims are date-bound by the [live certification gate](./docs/LIVE_CERTIFICATION.md); credential detection and deterministic tests do not replace real provider evidence.
 
 ## Security boundaries
 
@@ -189,8 +235,12 @@ Meta, Qwen, and OpenAI completed the 0.4 proposal, scoped-SQLite approval, proce
 - Remote MCP output is bounded, schema-checked, treated as untrusted, and rejected on common prompt-injection directives.
 - Network MCP always pauses for approval; custom read-only annotation trust must be explicit and injected by the host application.
 - Subagent children inherit scope, workspace, cancellation, approval, and store policy while retaining independent budgets and fingerprints.
+- OCI execution binds the durable run to the resolved image identity and enforced policy; resume fails if either changes.
+- Snapshot discovery excludes secrets, Git internals, harness state, dependency trees, and build output. Dependencies may be mounted separately read-only.
+- Untrusted commands receive a quota-backed tmpfs workspace, never a writable host bind; only successful, frozen, validated snapshots replace durable environment state.
+- Container processes receive no provider credentials or arbitrary host environment values, and host changes require a separately approved digest-bound patch import.
 
-These controls reduce risk but do not provide strong isolation. Use a dedicated container or microVM and a disposable workspace for autonomous execution.
+The default `none` backend provides governance but no OS isolation and therefore exposes no shell-class tool. The local OCI backend enforces the documented container boundary, but it is not a VM or a managed hostile-code sandbox; use a dedicated host or microVM when the container runtime itself is outside the threat model.
 
 ## Development
 

package/ROADMAP.md

@@ -1,9 +1,9 @@
 # Zhivex Harness Roadmap
 
 - Status: active
-- Baseline date: 2026-08-16
+- Baseline date: 2026-08-17
 
-This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library contract. The `0.2.0` source baseline is tagged locally, `0.3.0` and `0.4.0` are private checkpoints, and `0.5.0` is a publication-ready extensibility-and-orchestration candidate. Registry publication remains a separate explicit operation. Releases are ordered by dependency and safety risk, not by calendar date. A version ships only when its exit criteria are satisfied.
+This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library contract. The `0.2.0` source baseline is tagged locally, `0.3.0` and `0.4.0` are private checkpoints, and `0.5.0` plus `0.6.0` are published on npm. `0.6.1` is the local positioning and hostile-repository proof patch; publishing it remains a separate explicit operation. Releases are ordered by dependency and safety risk, not by calendar date. A version ships only when its exit criteria are satisfied.
 
 ## Planning principles
 
@@ -26,9 +26,9 @@ The tagged source baseline provides:
 - durable file-backed runs and approval resume;
 - path traversal, external symlink, secret-file, size, output, step, and timeout guards.
 
-The deterministic baseline, TypeScript typechecking, dependency-externalized build, package inspection, and installed-tarball smoke are implemented. The package is configured for a first public release with MIT metadata, CI, changelog, CLI/config schema versioning, `doctor`, and negative security regressions. All three provider credentials are configured locally without being exposed by diagnostics. Live certification is date-bound and recorded separately; publication and provenance remain external release operations.
+The deterministic baseline, TypeScript typechecking, dependency-externalized build, package inspection, and installed-tarball smoke are implemented. The package has public MIT metadata, CI, changelog, CLI/config schema versioning, `doctor`, and negative security regressions. All three provider credentials are configured locally without being exposed by diagnostics. Live certification is date-bound and recorded separately; each later publication and provenance verification remains an external release operation.
 
-The release candidate keeps `@zhivex-ai/core@1.5.0`. Although `1.6.0` is published, the installed `agents@1.2.0` and provider adapters still resolve their compatible runtime to `1.5.0`; upgrading only the direct dependency produced duplicate core types. The `1.6.0` move is deferred until the agents/providers batch can be installed and certified against one runtime version.
+The `0.6.0` dependency batch pins and overrides `@zhivex-ai/core@1.6.0`, retaining `@zhivex-ai/agents@1.2.0`, Meta `0.2.1`, Qwen `0.10.1`, and updating OpenAI to `0.9.5`. The Bun lockfile resolves one core runtime rather than duplicating SDK contract identities.
 
 ## Release sequence
 
@@ -37,8 +37,9 @@ The release candidate keeps `@zhivex-ai/core@1.5.0`. Although `1.6.0` is publish
 | `0.2.0` | Releasable foundation | A versioned, installable, diagnosable CLI | Local release baseline | M |
 | `0.3.0` | Trusted repository editing | Reviewable and recoverable multi-file changes | Private checkpoint | M |
 | `0.4.0` | Durable operations | Inspectable, budgeted, cancellable, evaluable runs | Private checkpoint | L |
-| `0.5.0` | Extensibility and orchestration | Governed MCP and bounded multi-agent work | Publication-ready candidate | L |
-| `0.6.0` | Enforced execution | Shell and checks inside a real isolation boundary | Planned | XL |
+| `0.5.0` | Extensibility and orchestration | Governed MCP and bounded multi-agent work | Published on npm | L |
+| `0.6.0` | Enforced execution | Shell and checks inside a real isolation boundary | Published on npm | XL |
+| `0.6.1` | Positioning and proof | Reproducible hostile-repository control evidence | Implemented locally | S |
 | `1.0.0` | Stable contract | Supported compatibility and release guarantees | Planned | L |
 
 Relative size is for sequencing only; dates require a capacity decision.
@@ -140,7 +141,7 @@ Validation snapshot (2026-08-17):
 
 Goal: support larger tasks through governed external tools and bounded delegation without weakening workspace policy.
 
-Status: publication-ready candidate. Configuration, migration, MCP, and orchestration contracts live in [docs/EXTENSIBILITY.md](./docs/EXTENSIBILITY.md); registry publication remains pending an explicit maintainer dispatch and the external prerequisites in [docs/RELEASE.md](./docs/RELEASE.md).
+Status: published on npm. Configuration, migration, MCP, and orchestration contracts live in [docs/EXTENSIBILITY.md](./docs/EXTENSIBILITY.md). Its Trusted Publisher/OIDC release path is the baseline for later immutable versions.
 
 Scope:
 
@@ -163,14 +164,17 @@ Validation snapshot (2026-08-17 UTC):
 
 - deterministic tests, the seven-case golden evaluation gate, typecheck, docs, build, dependency audit, dry-run package inspection, and installed-tarball smoke pass;
 - malformed MCP, HTTP handshake/session, injection/output bounds, approval/restart, child mutation exactly-once, cancellation, scoped hierarchy, aggregate budget, and parallel review have regression coverage;
-- controlled Streamable HTTP MCP interoperability passed over a real loopback server with session negotiation, JSON and SSE responses, tool discovery, bounded execution, and forced network approval at `2026-08-17T13:05:05.542Z`;
+- controlled Streamable HTTP MCP interoperability passed over a real loopback server with session negotiation, JSON and SSE responses, tool discovery, bounded execution, and forced network approval at `2026-08-17T16:48:09.043Z`;
+- independent interoperability with `@modelcontextprotocol/server@2.0.0` passed over loopback in its documented `2025-06-18` legacy-stateless compatibility mode at `2026-08-17T16:48:09.141Z`;
 - Meta `muse-spark-1.2`, Qwen `qwen3.8-max`, and OpenAI `gpt-5.4` passed the separate model-directed reviewer delegation, child persistence, SQLite reopen, hierarchy, and aggregate-usage matrix at `2026-08-17T02:21:45.553Z`;
-- exact-artifact and publication controls are prepared, while registry publication, provenance, tag creation, and push have not been attempted or claimed.
+- the exact `0.5.0` artifact was published and its post-publication registry/provenance verification completed; that evidence does not pre-certify `0.6.0`.
 
 ## 0.6.0 — Enforced execution environments
 
 Goal: introduce shell-class capabilities only when the declared filesystem, process, network, and resource controls are real.
 
+Status: 0.6.0 is published on npm. Deterministic, exact installed-artifact, real-OCI, MCP-interoperability, all-provider live, registry-integrity, and SLSA provenance gates passed.
+
 Scope:
 
 - Implement the SDK execution-environment contract for a local OCI/container backend, with an adapter boundary for future remote workers.
@@ -188,6 +192,27 @@ Exit criteria:
 - Installed-artifact and live-provider tests exercise the enforced backend.
 - The product is described as a local enforced runner, not a managed sandbox service.
 
+Implementation snapshot (2026-08-17):
+
+- the SDK execution-environment contract is implemented with a Docker/Podman adapter, immutable image identity, per-tool-call isolation, manifest authorization, and run fingerprint binding;
+- the enforced policy denies network and undeclared tools, uses a non-root identity, read-only root, dropped capabilities, no-new-privileges, and bounded memory, CPU, PIDs, time, output, snapshot, imported-file, and tmpfs resources;
+- repository tools and subagents share an ephemeral secret-free snapshot; package checks and argv-only commands run inside OCI, while network MCP fails closed under the no-network policy;
+- content- and run-bound patch inspection plus a separate durable import approval are the only environment-to-host mutation path; deletes remain recoverable through quarantine;
+- lifecycle metadata, cancellation removal, run-labeled container and quota-volume cleanup, terminal artifact retention cleanup, deterministic regression tests, installed-package smoke, and required Linux OCI workflow gates are implemented;
+- the real Docker smoke passed again at `2026-08-17T16:48Z` against Docker `29.7.2` and the pinned Bun image digest, covering network/root/secret boundaries, total-workspace and per-file capacity, read-only dependency reuse, memory/PID/output limits, cancellation, transactional snapshot synchronization, patch import, and zero labeled orphans;
+- the installed-package smoke passed with the public execution-environment API and snapshot/import flow;
+- the exact local `0.6.0` tarball passed the 31-file allowlist, SHA-512 generation, isolated consumer install, binary, public API, durability, and execution-environment smoke;
+- Meta, Qwen, and OpenAI passed the final model-directed OCI command, patch review, separate import approval, journal, host-content, and binding matrix together at `2026-08-17T16:49:12.975Z`;
+- the base approval/restart matrix and bounded reviewer-delegation/persistence/hierarchy matrix passed again at `2026-08-17T16:22:34.885Z` and `2026-08-17T16:24:14.381Z` respectively;
+- `@zhivex-ai/core@1.6.0` resolves as one runtime through the aligned dependency batch;
+- annotated tag `v0.6.0`, push, protected OIDC publication, exact registry integrity, the `latest` distribution tag, and SLSA workflow provenance agree with source commit `fd420f7560b2`.
+
+### 0.6.1 positioning patch
+
+`0.6.1` keeps the `0.6.0` runtime, CLI, configuration, state, and library contracts unchanged. It adds a launch-oriented package description, expanded discovery metadata, a deterministic social card, structured issue forms, and a hostile-repository demo that exposes the existing safety chain as one reproducible product proof.
+
+Its deterministic demo test uses an injected OCI adapter. The public `bun run demo:hostile` command uses a real preloaded Docker/Podman image and proves secret exclusion, network denial, two durable approvals across persistence reopen, host immutability before import, exactly-once journal evidence, redacted inspection, and stale-host rejection. Publication, a `v0.6.1` tag, registry integrity, and provenance are not claimed until the normal protected release workflow completes.
+
 ## 1.0.0 — Stable CLI and library contract
 
 Goal: freeze a supportable public contract after the pre-1.0 safety and operational surfaces have been exercised in real repositories.
@@ -233,7 +258,7 @@ These can become separate post-1.0 tracks after the CLI/runtime contract and sec
 
 ## Immediate next actions
 
-1. Dogfood governed MCP and bounded delegation on representative repositories before freezing the contract.
-2. Validate additional third-party Streamable HTTP servers without broadening the transport or trust claims.
-3. Make the repository public, enable private vulnerability reporting, protect the `npm` environment, and verify `@zhivex-ai` scope rights before dispatching publication.
-4. Bootstrap the first npm version through the protected workflow, configure `release.yml` as the package Trusted Publisher, revoke the temporary bootstrap token, and verify registry integrity/provenance against the tagged commit.
+1. Review the `0.6.1` positioning/demo diff and run the full deterministic, real-OCI, and installed-artifact gates.
+2. Record the hostile-repository demo and publish the exact evidence output with the release notes.
+3. Merge/push the reviewed release commit, create the annotated `v0.6.1` tag, then dispatch the protected OIDC workflow and verify registry integrity/provenance against the exact tagged artifact.
+4. Continue governed MCP/delegation dogfood on representative repositories beyond the controlled and official-SDK interoperability gates.

package/SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Supported versions
 
-Security fixes are provided for the latest published `0.5.x` version. Pre-release source snapshots and older private checkpoints are not supported release channels.
+Security fixes are provided for the latest published `0.6.x` version. Pre-release source snapshots and older private checkpoints are not supported release channels.
 
 ## Reporting a vulnerability
 

package/SUPPORT.md

@@ -1,6 +1,6 @@
 # Support
 
-Zhivex Harness `0.5.x` is a pre-1.0 CLI and TypeScript library for Bun. Observable contracts may change in a later minor release when the change and migration path are documented in [CHANGELOG.md](./CHANGELOG.md).
+Zhivex Harness `0.6.x` is a pre-1.0 CLI and TypeScript library for Bun. Observable contracts may change in a later minor release when the change and migration path are documented in [CHANGELOG.md](./CHANGELOG.md).
 
 ## Supported baseline
 
@@ -10,7 +10,7 @@ Zhivex Harness `0.5.x` is a pre-1.0 CLI and TypeScript library for Bun. Observab
 - the provider/model combinations marked certified in the package documentation; and
 - HTTPS or explicitly allowed loopback-HTTP MCP endpoints using the documented bounded JSON-RPC subset.
 
-Only the most recent published `0.5.x` patch receives routine fixes. Live provider evidence is account-, model-, endpoint-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](./docs/LIVE_CERTIFICATION.md).
+Only the most recent published `0.6.x` patch receives routine fixes. Live provider evidence is account-, model-, endpoint-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](./docs/LIVE_CERTIFICATION.md).
 
 ## Support channels
 

package/dist/cli.d.ts

@@ -1,8 +1,11 @@
 #!/usr/bin/env bun
-import { type AgentApprovalRequest, type AgentRunOutput, type AgentStatus } from "@zhivex-ai/agents";
-import { providerAvailability, resolveHarnessConfig, type HarnessProvider, type HarnessSubagentProfile } from "./config.js";
+import { type AgentApprovalRequest, type AgentRunInput, type AgentRunOutput, type AgentRunState, type AgentStatus } from "@zhivex-ai/agents";
+import { providerAvailability, resolveHarnessConfig, type HarnessConfig, type HarnessConfigInput, type HarnessProvider, type HarnessSubagentProfile } from "./config.js";
 import { type ZhivexHarness } from "./harness.js";
+import { type HarnessOciRuntimeAdapter } from "./execution-environment.js";
 export declare const CLI_JSON_SCHEMA_VERSION: 1;
+export declare const HARNESS_RESUME_METADATA_KEY: "zhivexHarnessResume";
+export declare const HARNESS_RESUME_METADATA_SCHEMA_VERSION: 1;
 export declare const CLI_EXIT_CODES: {
     readonly success: 0;
     readonly runtimeError: 1;
@@ -43,6 +46,18 @@ export interface CliOptions {
     subagentMaxTotalTokens?: number;
     subagentTimeoutMs?: number;
     maxParallelReviews?: number;
+    executionBackend?: string;
+    ociRuntime?: string;
+    ociImage?: string;
+    ociAllowedCommands?: string[];
+    ociMaxProcessRuntimeMs?: number;
+    ociMaxProcessOutputBytes?: number;
+    ociMaxMemoryMb?: number;
+    ociMaxPids?: number;
+    ociMaxCpus?: number;
+    ociMaxWorkspaceBytes?: number;
+    ociMaxFileWriteBytes?: number;
+    ociTmpfsMb?: number;
     mcpConfigPath?: string;
     prompt?: string;
     runId?: string;
@@ -62,6 +77,9 @@ export interface CliOptions {
 export declare class CliUsageError extends Error {
     constructor(message: string);
 }
+export declare const createHarnessResumeMetadata: (config: HarnessConfig) => NonNullable<AgentRunInput["metadata"]>;
+export declare const readHarnessResumeConfig: (state: Pick<AgentRunState, "metadata">) => HarnessConfigInput | undefined;
+export declare const resumeCommand: (runId: string, config: HarnessConfig, approve?: boolean) => string;
 export declare const parseCliArgs: (argv: string[]) => CliOptions;
 export declare const summarizeApproval: (approval: AgentApprovalRequest) => string;
 export declare const runResultDocument: (result: AgentRunOutput, harness: ZhivexHarness) => {
@@ -72,6 +90,15 @@ export declare const runResultDocument: (result: AgentRunOutput, harness: Zhivex
         childBudget: import("./config.js").HarnessBudget;
         mcpServers: string[];
     };
+    execution: {
+        backend: "oci";
+        binding: import("@zhivex-ai/core").AgentExecutionEnvironmentBinding | undefined;
+        image: import("./execution-environment.js").OciImageInspection;
+    } | {
+        backend: "none";
+        binding?: never;
+        image?: never;
+    };
     store: {
         backend: "sqlite" | "file";
         stateDirectory: string;
@@ -175,6 +202,7 @@ export interface DoctorReport {
         allowedChecks: readonly string[];
         requiredCapabilities: ReturnType<typeof resolveHarnessConfig>["requiredCapabilities"];
         orchestration: ReturnType<typeof resolveHarnessConfig>["orchestration"];
+        execution: ReturnType<typeof resolveHarnessConfig>["execution"];
         mcpConfigPath?: string;
     };
     checks: DoctorCheck[];
@@ -183,8 +211,9 @@ export interface DoctorReport {
 export interface DoctorContext {
     env?: NodeJS.ProcessEnv;
     bunVersion?: string;
+    ociRuntimeAdapter?: HarnessOciRuntimeAdapter;
 }
-export declare const createDoctorReport: (options?: Pick<CliOptions, "provider" | "model" | "workspace" | "stateDirectory" | "storeBackend" | "tenantId" | "userId" | "namespace" | "maxSteps" | "timeoutMs" | "maxToolCalls" | "maxToolErrors" | "maxInputTokens" | "maxOutputTokens" | "maxTotalTokens" | "maxCostUsd" | "inputCostPerMillion" | "outputCostPerMillion" | "allowedChecks" | "requiredCapabilities" | "subagentProfiles" | "subagentMaxSteps" | "subagentMaxToolCalls" | "subagentMaxToolErrors" | "subagentMaxInputTokens" | "subagentMaxOutputTokens" | "subagentMaxTotalTokens" | "subagentTimeoutMs" | "maxParallelReviews" | "mcpConfigPath">, context?: DoctorContext) => Promise<DoctorReport>;
+export declare const createDoctorReport: (options?: Pick<CliOptions, "provider" | "model" | "workspace" | "stateDirectory" | "storeBackend" | "tenantId" | "userId" | "namespace" | "maxSteps" | "timeoutMs" | "maxToolCalls" | "maxToolErrors" | "maxInputTokens" | "maxOutputTokens" | "maxTotalTokens" | "maxCostUsd" | "inputCostPerMillion" | "outputCostPerMillion" | "allowedChecks" | "requiredCapabilities" | "subagentProfiles" | "subagentMaxSteps" | "subagentMaxToolCalls" | "subagentMaxToolErrors" | "subagentMaxInputTokens" | "subagentMaxOutputTokens" | "subagentMaxTotalTokens" | "subagentTimeoutMs" | "maxParallelReviews" | "executionBackend" | "ociRuntime" | "ociImage" | "ociAllowedCommands" | "ociMaxProcessRuntimeMs" | "ociMaxProcessOutputBytes" | "ociMaxMemoryMb" | "ociMaxPids" | "ociMaxCpus" | "ociMaxWorkspaceBytes" | "ociMaxFileWriteBytes" | "ociTmpfsMb" | "mcpConfigPath">, context?: DoctorContext) => Promise<DoctorReport>;
 export declare const formatDoctorReport: (report: DoctorReport) => string;
 export declare const cliExitCodeForError: (error: unknown) => 2 | 1;
 export declare const main: (argv?: string[]) => Promise<void>;